Go mod tidy

* Add regression test for relay state lock
* Make connect not hold a lock in openConnVia

agent-network/README.md

@@ -1,47 +1,16 @@
 # NetBird Agent Network
 
-Agent Network is NetBird's access control layer for AI agents and the people who run them. 
-It gives every agent a real identity, tied to an identity provider (IdP), and governs what it can reach: LLM APIs and 
-AI gateways it can call, and the internal resources it can access. Traffic flows only over the encrypted NetBird tunnel, 
-scoped by policy, with no API keys or other credentials to leak. It also gives you control over cost and token usage.
+Agent Network is NetBird's access control layer for AI agents and the people who run
+them. It gives every agent a real identity, tied to your identity provider (IdP), and
+governs what it can reach — the LLM APIs and AI gateways it can call, and the internal
+resources it can access. Traffic flows only over the encrypted NetBird tunnel, scoped by
+policy, with no API keys to leak.
 
-Because every LLM request passes through an
-identity-aware proxy, you can:
-
-- **Set spending and rate limits** per agent, per user, or per team — with hard caps
-  that stop requests once a budget is reached.
-- **Restrict models and providers** so agents can only call approved (and cost-appropriate)
-  endpoints, keeping expensive models off-limits unless explicitly allowed.
-- **Attribute usage** by tracking token consumption and cost per identity, group, or cost center so every
-  request is tied back to the agent and person responsible.
-- **Reuse your existing AI gateway** — point the proxy at a gateway you already run,
-  keeping its routing and config in place while it adds identity on top, so you skip
-  API key distribution.
-
-https://github.com/user-attachments/assets/44d18286-d8ab-49f8-a457-98ccd66f3268
-
-> **Beta.** Agent Network is in beta, but it's stable and already running in
-> production environments. It's fully open source and can be self-hosted on your own
-> infrastructure, with no vendor lock-in and no data leaving your environment.
+> **Beta.** Agent Network is open source and can be self-hosted on your own
+> infrastructure.
 
 ## How it works
 
-Say you have a simple use case: your Engineering or IT team needs access to Claude Code or Codex, and you want visibility into usage plus the ability to enforce budgets.
-How can you do that without creating a dedicated API key for every team?
-
-With Agent Network you get a private endpoint inside your network, for example: https://mirror.netbird.ai
-Teams configure their agents to point to that endpoint instead of using individual API keys directly. 
-
-This endpoint is only reachable when users are connected to your NetBird network and authenticated through your IdP. Otherwise, it is not accessible from the public internet.
-You can then use this private endpoint to configure your AI agents, whether that is Claude Code, Codex, or another tool.
-
-## Quickstart
-
-Full step-by-step setup:
-**https://docs.netbird.io/agent-network/quickstart**
-
-## Architecture 
-
 Agent Network is built on two existing NetBird capabilities:
 
 - **Overlay network** — the encrypted WireGuard mesh between peers.
@@ -53,9 +22,6 @@ LLM traffic is routed through the proxy's identity-aware pipeline, while interna
 resources (databases, internal APIs, self-hosted models) are reached directly over
 peer-to-peer WireGuard tunnels, governed by the same identities and access policies.
 
-<img width="4720" height="2218" alt="image" src="https://github.com/user-attachments/assets/1afa5da1-4b82-4f8a-a7a8-f417efadf1eb" />
-
-
 ## Where the code lives
 
 There is no separate "agent-network" service — it reuses the reverse-proxy and management

client/cmd/up.go

@@ -401,12 +401,6 @@ func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, pro
 	if cmd.Flag(serverSSHAllowedFlag).Changed {
 		req.ServerSSHAllowed = &serverSSHAllowed
 	}
-	if cmd.Flag(serverVNCAllowedFlag).Changed {
-		req.ServerVNCAllowed = &serverVNCAllowed
-	}
-	if cmd.Flag(disableVNCApprovalFlag).Changed {
-		req.DisableVNCApproval = &disableVNCApproval
-	}
 	if cmd.Flag(enableSSHRootFlag).Changed {
 		req.EnableSSHRoot = &enableSSHRoot
 	}
@@ -509,14 +503,30 @@ func setupConfig(customDNSAddressConverted []byte, cmd *cobra.Command, configFil
 	if cmd.Flag(serverSSHAllowedFlag).Changed {
 		ic.ServerSSHAllowed = &serverSSHAllowed
 	}
-	if cmd.Flag(serverVNCAllowedFlag).Changed {
-		ic.ServerVNCAllowed = &serverVNCAllowed
-	}
-	if cmd.Flag(disableVNCApprovalFlag).Changed {
-		ic.DisableVNCApproval = &disableVNCApproval
+
+	if cmd.Flag(enableSSHRootFlag).Changed {
+		ic.EnableSSHRoot = &enableSSHRoot
 	}
 
-	applySSHFlagsToConfig(cmd, &ic)
+	if cmd.Flag(enableSSHSFTPFlag).Changed {
+		ic.EnableSSHSFTP = &enableSSHSFTP
+	}
+
+	if cmd.Flag(enableSSHLocalPortForwardFlag).Changed {
+		ic.EnableSSHLocalPortForwarding = &enableSSHLocalPortForward
+	}
+
+	if cmd.Flag(enableSSHRemotePortForwardFlag).Changed {
+		ic.EnableSSHRemotePortForwarding = &enableSSHRemotePortForward
+	}
+
+	if cmd.Flag(disableSSHAuthFlag).Changed {
+		ic.DisableSSHAuth = &disableSSHAuth
+	}
+
+	if cmd.Flag(sshJWTCacheTTLFlag).Changed {
+		ic.SSHJWTCacheTTL = &sshJWTCacheTTL
+	}
 
 	if cmd.Flag(interfaceNameFlag).Changed {
 		if err := parseInterfaceName(interfaceName); err != nil {
@@ -589,49 +599,6 @@ func setupConfig(customDNSAddressConverted []byte, cmd *cobra.Command, configFil
 	return &ic, nil
 }
 
-func applySSHFlagsToConfig(cmd *cobra.Command, ic *profilemanager.ConfigInput) {
-	if cmd.Flag(enableSSHRootFlag).Changed {
-		ic.EnableSSHRoot = &enableSSHRoot
-	}
-	if cmd.Flag(enableSSHSFTPFlag).Changed {
-		ic.EnableSSHSFTP = &enableSSHSFTP
-	}
-	if cmd.Flag(enableSSHLocalPortForwardFlag).Changed {
-		ic.EnableSSHLocalPortForwarding = &enableSSHLocalPortForward
-	}
-	if cmd.Flag(enableSSHRemotePortForwardFlag).Changed {
-		ic.EnableSSHRemotePortForwarding = &enableSSHRemotePortForward
-	}
-	if cmd.Flag(disableSSHAuthFlag).Changed {
-		ic.DisableSSHAuth = &disableSSHAuth
-	}
-	if cmd.Flag(sshJWTCacheTTLFlag).Changed {
-		ic.SSHJWTCacheTTL = &sshJWTCacheTTL
-	}
-}
-
-func applySSHFlagsToLogin(cmd *cobra.Command, req *proto.LoginRequest) {
-	if cmd.Flag(enableSSHRootFlag).Changed {
-		req.EnableSSHRoot = &enableSSHRoot
-	}
-	if cmd.Flag(enableSSHSFTPFlag).Changed {
-		req.EnableSSHSFTP = &enableSSHSFTP
-	}
-	if cmd.Flag(enableSSHLocalPortForwardFlag).Changed {
-		req.EnableSSHLocalPortForwarding = &enableSSHLocalPortForward
-	}
-	if cmd.Flag(enableSSHRemotePortForwardFlag).Changed {
-		req.EnableSSHRemotePortForwarding = &enableSSHRemotePortForward
-	}
-	if cmd.Flag(disableSSHAuthFlag).Changed {
-		req.DisableSSHAuth = &disableSSHAuth
-	}
-	if cmd.Flag(sshJWTCacheTTLFlag).Changed {
-		ttl := int32(sshJWTCacheTTL)
-		req.SshJWTCacheTTL = &ttl
-	}
-}
-
 func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte, cmd *cobra.Command) (*proto.LoginRequest, error) {
 	loginRequest := proto.LoginRequest{
 		SetupKey:            providedSetupKey,
@@ -661,14 +628,31 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 	if cmd.Flag(serverSSHAllowedFlag).Changed {
 		loginRequest.ServerSSHAllowed = &serverSSHAllowed
 	}
-	if cmd.Flag(serverVNCAllowedFlag).Changed {
-		loginRequest.ServerVNCAllowed = &serverVNCAllowed
-	}
-	if cmd.Flag(disableVNCApprovalFlag).Changed {
-		loginRequest.DisableVNCApproval = &disableVNCApproval
+
+	if cmd.Flag(enableSSHRootFlag).Changed {
+		loginRequest.EnableSSHRoot = &enableSSHRoot
 	}
 
-	applySSHFlagsToLogin(cmd, &loginRequest)
+	if cmd.Flag(enableSSHSFTPFlag).Changed {
+		loginRequest.EnableSSHSFTP = &enableSSHSFTP
+	}
+
+	if cmd.Flag(enableSSHLocalPortForwardFlag).Changed {
+		loginRequest.EnableSSHLocalPortForwarding = &enableSSHLocalPortForward
+	}
+
+	if cmd.Flag(enableSSHRemotePortForwardFlag).Changed {
+		loginRequest.EnableSSHRemotePortForwarding = &enableSSHRemotePortForward
+	}
+
+	if cmd.Flag(disableSSHAuthFlag).Changed {
+		loginRequest.DisableSSHAuth = &disableSSHAuth
+	}
+
+	if cmd.Flag(sshJWTCacheTTLFlag).Changed {
+		sshJWTCacheTTL32 := int32(sshJWTCacheTTL)
+		loginRequest.SshJWTCacheTTL = &sshJWTCacheTTL32
+	}
 
 	if cmd.Flag(disableAutoConnectFlag).Changed {
 		loginRequest.DisableAutoConnect = &autoConnectDisabled

client/cmd/vnc_agent.go

@@ -1,100 +0,0 @@
-//go:build windows || (darwin && !ios)
-
-package cmd
-
-import (
-	"fmt"
-	"net"
-	"net/netip"
-	"os"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-
-	vncserver "github.com/netbirdio/netbird/client/vnc/server"
-)
-
-var (
-	vncAgentSocket    string
-	vncAgentTargetUID uint32
-)
-
-func init() {
-	vncAgentCmd.Flags().StringVar(&vncAgentSocket, "socket", "", "Unix-domain socket path the agent listens on (required)")
-	vncAgentCmd.Flags().Uint32Var(&vncAgentTargetUID, "target-uid", 0, "uid the agent should drop privileges to before listening (darwin only; 0 = stay as current uid)")
-	rootCmd.AddCommand(vncAgentCmd)
-}
-
-// vncAgentCmd runs a VNC server inside the user's interactive session,
-// listening on a Unix-domain socket. The NetBird service spawns it: on
-// Windows via CreateProcessAsUser into the console session, on macOS via
-// launchctl asuser into the Aqua session.
-var vncAgentCmd = &cobra.Command{
-	Use:    "vnc-agent",
-	Short:  "Run VNC capture agent (internal, spawned by service)",
-	Hidden: true,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		log.SetReportCaller(true)
-		log.SetFormatter(&log.JSONFormatter{})
-		log.SetOutput(os.Stderr)
-
-		if vncAgentSocket == "" {
-			return fmt.Errorf("--socket is required")
-		}
-
-		token := os.Getenv("NB_VNC_AGENT_TOKEN")
-		if token == "" {
-			return fmt.Errorf("NB_VNC_AGENT_TOKEN not set; agent requires a token from the service")
-		}
-		// Purge the token from env so it doesn't leak via /proc/<pid>/environ.
-		if err := os.Unsetenv("NB_VNC_AGENT_TOKEN"); err != nil {
-			log.Debugf("unset NB_VNC_AGENT_TOKEN: %v", err)
-		}
-
-		// Drop root privileges to the target console user BEFORE creating
-		// the listening socket: keeps a post-auth bug in the encoder /
-		// input / capture paths confined to the user's own privileges
-		// rather than escalating to host root, and makes the daemon's
-		// LOCAL_PEERCRED check see the right uid. No-op on Windows
-		// (both processes run as SYSTEM) and when --target-uid is 0.
-		if vncAgentTargetUID != 0 {
-			if err := dropAgentPrivileges(vncAgentTargetUID); err != nil {
-				return fmt.Errorf("drop privileges to uid %d: %w", vncAgentTargetUID, err)
-			}
-		}
-
-		if err := os.Remove(vncAgentSocket); err != nil && !os.IsNotExist(err) {
-			log.Debugf("remove stale socket %s: %v", vncAgentSocket, err)
-		}
-		ln, err := net.Listen("unix", vncAgentSocket)
-		if err != nil {
-			return fmt.Errorf("listen on %s: %w", vncAgentSocket, err)
-		}
-		if err := os.Chmod(vncAgentSocket, 0o600); err != nil {
-			log.Debugf("chmod %s: %v", vncAgentSocket, err)
-		}
-
-		capturer, injector, err := newAgentResources()
-		if err != nil {
-			_ = ln.Close()
-			return err
-		}
-		srv := vncserver.New(vncserver.Config{
-			Capturer:      capturer,
-			Injector:      injector,
-			DisableAuth:   true,
-			AgentTokenHex: token,
-			Listener:      ln,
-		})
-
-		if err := srv.Start(cmd.Context(), netip.AddrPort{}, netip.Prefix{}); err != nil {
-			return fmt.Errorf("start vnc server: %w", err)
-		}
-		log.Infof("vnc-agent listening on %s, ready", vncAgentSocket)
-
-		<-cmd.Context().Done()
-		log.Info("vnc-agent context cancelled, shutting down")
-		return srv.Stop()
-	},
-	SilenceUsage: true,
-}

client/cmd/vnc_agent_darwin.go

@@ -1,18 +0,0 @@
-//go:build darwin && !ios
-
-package cmd
-
-import (
-	"fmt"
-
-	vncserver "github.com/netbirdio/netbird/client/vnc/server"
-)
-
-func newAgentResources() (vncserver.ScreenCapturer, vncserver.InputInjector, error) {
-	capturer := vncserver.NewMacPoller()
-	injector, err := vncserver.NewMacInputInjector()
-	if err != nil {
-		return nil, nil, fmt.Errorf("macOS input injector: %w", err)
-	}
-	return capturer, injector, nil
-}

client/cmd/vnc_agent_dropprivs_darwin.go

@@ -1,74 +0,0 @@
-//go:build darwin && !ios
-
-package cmd
-
-import (
-	"fmt"
-	"os"
-	"os/user"
-	"strconv"
-	"syscall"
-)
-
-// dropAgentPrivileges drops the vnc-agent process from root (its
-// launchctl-asuser-inherited starting uid) to the target console user
-// before any other initialisation runs. Without this the agent runs as
-// root for the lifetime of the session; any post-auth memory-safety
-// issue in the capture/input/encode paths would then be a root-level
-// RCE on the host instead of a user-level one. Also makes the daemon's
-// LOCAL_PEERCRED check correctly identify the agent as the console user,
-// not as root.
-//
-// Returns an error when the agent is running as a non-root uid that
-// differs from targetUID: non-root can only setuid to itself, so a
-// mismatch here means the spawn went to the wrong session.
-func dropAgentPrivileges(targetUID uint32) error {
-	if targetUID == 0 {
-		return fmt.Errorf("refusing to keep agent running as root (target uid 0)")
-	}
-	cur := uint32(os.Getuid())
-	if cur == targetUID {
-		return nil
-	}
-	if cur != 0 {
-		return fmt.Errorf("agent uid %d does not match expected %d and we lack root to fix it", cur, targetUID)
-	}
-	// Resolve the target user's real primary group rather than reusing
-	// targetUID as the gid: a user's primary group on macOS is typically
-	// staff(20), not gid==uid. Fail closed if the lookup fails.
-	targetGID, err := primaryGroupID(targetUID)
-	if err != nil {
-		return err
-	}
-	// Drop supplementary groups first: setgid alone doesn't touch the
-	// auxiliary group list, leaving root's groups attached would let the
-	// dropped process write to root-only group-writable files.
-	if err := syscall.Setgroups([]int{}); err != nil {
-		return fmt.Errorf("setgroups([]): %w", err)
-	}
-	if err := syscall.Setgid(targetGID); err != nil {
-		return fmt.Errorf("setgid(%d): %w", targetGID, err)
-	}
-	if err := syscall.Setuid(int(targetUID)); err != nil {
-		return fmt.Errorf("setuid(%d): %w", targetUID, err)
-	}
-	if uint32(os.Getuid()) != targetUID || uint32(os.Geteuid()) != targetUID {
-		return fmt.Errorf("setuid verification: uid=%d euid=%d, expected %d", os.Getuid(), os.Geteuid(), targetUID)
-	}
-	return nil
-}
-
-// primaryGroupID resolves the real primary group id of the user with the
-// given uid. Fails closed: a lookup or parse error returns an error so the
-// caller never falls back to using uid as the gid.
-func primaryGroupID(targetUID uint32) (int, error) {
-	u, err := user.LookupId(strconv.Itoa(int(targetUID)))
-	if err != nil {
-		return 0, fmt.Errorf("look up uid %d: %w", targetUID, err)
-	}
-	gid, err := strconv.Atoi(u.Gid)
-	if err != nil {
-		return 0, fmt.Errorf("parse gid %q for uid %d: %w", u.Gid, targetUID, err)
-	}
-	return gid, nil
-}

client/cmd/vnc_agent_dropprivs_darwin_test.go

@@ -1,55 +0,0 @@
-//go:build darwin && !ios
-
-package cmd
-
-import (
-	"strings"
-	"testing"
-)
-
-// TestDropAgentPrivileges_RefusesRootTarget locks in the contract that
-// dropAgentPrivileges must never be a no-op when asked to keep the
-// agent as root (target uid 0). A future caller that passes 0 by
-// mistake would otherwise leave the post-auth attack surface running
-// with full root privileges.
-func TestDropAgentPrivileges_RefusesRootTarget(t *testing.T) {
-	err := dropAgentPrivileges(0)
-	if err == nil {
-		t.Fatal("expected refusal for target uid 0, got nil")
-	}
-	if !strings.Contains(err.Error(), "root") {
-		t.Fatalf("error should mention root, got: %v", err)
-	}
-}
-
-// TestDropAgentPrivileges_NoOpWhenAlreadyTarget covers the dev path
-// where the agent is launched by hand as the target user (no root
-// available, no setuid needed). The helper must succeed silently
-// instead of trying (and failing) a setuid to its current uid.
-func TestDropAgentPrivileges_NoOpWhenAlreadyTarget(t *testing.T) {
-	// Skip when running as root: the early-return path we want to
-	// cover only fires when current uid == target uid.
-	uid := currentUIDForTest()
-	if uid == 0 {
-		t.Skip("test must not run as root; cannot exercise the no-op early-return")
-	}
-	if err := dropAgentPrivileges(uid); err != nil {
-		t.Fatalf("expected no-op when current uid == target, got: %v", err)
-	}
-}
-
-// TestDropAgentPrivileges_RefusesMismatchedNonRoot guards the "non-root
-// caller tries to setuid to a different uid" path: setuid would fail
-// with EPERM anyway, but the helper should surface a clear error
-// before issuing the syscall so a misconfigured spawn (wrong --target-uid
-// flag) is debuggable.
-func TestDropAgentPrivileges_RefusesMismatchedNonRoot(t *testing.T) {
-	uid := currentUIDForTest()
-	if uid == 0 {
-		t.Skip("test must not run as root; covered case requires non-root caller")
-	}
-	err := dropAgentPrivileges(uid + 1)
-	if err == nil {
-		t.Fatal("expected refusal when non-root caller asks to setuid elsewhere")
-	}
-}

client/cmd/vnc_agent_dropprivs_testhelpers_darwin.go

@@ -1,11 +0,0 @@
-//go:build darwin && !ios
-
-package cmd
-
-import "os"
-
-// currentUIDForTest exposes os.Getuid for the darwin dropprivs tests
-// without leaking an os import into the test file itself.
-func currentUIDForTest() uint32 {
-	return uint32(os.Getuid())
-}

client/cmd/vnc_agent_dropprivs_windows.go

@@ -1,14 +0,0 @@
-//go:build windows
-
-package cmd
-
-// dropAgentPrivileges is a no-op on Windows: the agent and the daemon
-// both run as SYSTEM (the daemon spawns the agent into the interactive
-// session via CreateProcessAsUser with an impersonation token, but the
-// resulting process still runs under SYSTEM, not under the user's
-// account). The Windows path relies on the DACL-restricted socket
-// directory, the unpredictable per-spawn socket name, the listen-readiness
-// gate, and the per-spawn token for integrity instead.
-func dropAgentPrivileges(_ uint32) error {
-	return nil
-}

client/cmd/vnc_agent_windows.go

@@ -1,15 +0,0 @@
-//go:build windows
-
-package cmd
-
-import (
-	log "github.com/sirupsen/logrus"
-
-	vncserver "github.com/netbirdio/netbird/client/vnc/server"
-)
-
-func newAgentResources() (vncserver.ScreenCapturer, vncserver.InputInjector, error) {
-	sessionID := vncserver.GetCurrentSessionID()
-	log.Infof("VNC agent running in Windows session %d", sessionID)
-	return vncserver.NewDesktopCapturer(), vncserver.NewWindowsInputInjector(), nil
-}

client/cmd/vnc_flags.go

@@ -1,16 +0,0 @@
-package cmd
-
-const (
-	serverVNCAllowedFlag   = "allow-server-vnc"
-	disableVNCApprovalFlag = "disable-vnc-approval"
-)
-
-var (
-	serverVNCAllowed   bool
-	disableVNCApproval bool
-)
-
-func init() {
-	upCmd.PersistentFlags().BoolVar(&serverVNCAllowed, serverVNCAllowedFlag, false, "Allow embedded VNC server on peer")
-	upCmd.PersistentFlags().BoolVar(&disableVNCApproval, disableVNCApprovalFlag, false, "Disable per-connection user approval prompts for the embedded VNC server")
-}

client/configs/configs.go

@@ -6,30 +6,19 @@ import (
 	"runtime"
 )
 
-var (
-	// StateDir holds persistent state (config, profiles, install metadata).
-	StateDir string
-	// RuntimeDir holds ephemeral artifacts that should not survive reboot,
-	// such as Unix sockets for daemon and per-session IPC. Empty on
-	// platforms without a conventional /var/run-style location.
-	RuntimeDir string
-)
+var StateDir string
 
 func init() {
+	StateDir = os.Getenv("NB_STATE_DIR")
+	if StateDir != "" {
+		return
+	}
 	switch runtime.GOOS {
 	case "windows":
 		StateDir = filepath.Join(os.Getenv("PROGRAMDATA"), "Netbird")
 	case "darwin", "linux":
 		StateDir = "/var/lib/netbird"
-		RuntimeDir = "/var/run/netbird"
 	case "freebsd", "openbsd", "netbsd", "dragonfly":
 		StateDir = "/var/db/netbird"
-		RuntimeDir = "/var/run/netbird"
-	}
-	if v := os.Getenv("NB_STATE_DIR"); v != "" {
-		StateDir = v
-	}
-	if v := os.Getenv("NB_RUNTIME_DIR"); v != "" {
-		RuntimeDir = v
 	}
 }

client/internal/approval/broker.go

@@ -1,219 +0,0 @@
-// Package approval brokers per-attempt user-accept prompts for inbound
-// remote access (VNC today, SSH and others in the future). A caller pushes
-// a Prompt; the broker emits a SystemEvent on the daemon→UI stream and
-// blocks until the UI calls the daemon's RespondApproval RPC, the per-
-// request timeout fires, or no subscriber is connected. The latter case
-// fails closed so a backgrounded UI cannot silently bypass the gate.
-package approval
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"sync"
-	"time"
-
-	"github.com/google/uuid"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// Metadata keys the broker reserves on the emitted SystemEvent. Callers
-// should not set these themselves; values in Prompt.Metadata that collide
-// are overwritten by the broker.
-const (
-	MetaRequestID = "request_id"
-	MetaKind      = "kind"
-	MetaExpiresAt = "expires_at"
-)
-
-// ShortKeyFingerprint formats a hex-encoded Noise_IK static pubkey as a
-// short, eyeball-able fingerprint to display in the approval dialog.
-// The dashboard-supplied display name attached to a SessionPubKey isn't
-// cryptographically asserted by the connecting client, so the prompt
-// must also show something that IS: the key fingerprint, a hash of
-// the static public key the client just proved possession of during the
-// Noise handshake. Returns the empty string when the input is too short
-// to plausibly be a hex pubkey, so the row is omitted rather than
-// rendered as a misleading partial.
-//
-// Output format: 16 hex chars grouped as XXXX-XXXX-XXXX-XXXX (64 bits of
-// fingerprint, resistant to random-prefix collisions and easy for a human
-// to compare with an out-of-band reference).
-func ShortKeyFingerprint(hexKey string) string {
-	if len(hexKey) < 8 {
-		return ""
-	}
-	src := hexKey
-	if len(src) > 16 {
-		src = src[:16]
-	}
-	var out []byte
-	for i, c := range src {
-		if i > 0 && i%4 == 0 {
-			out = append(out, '-')
-		}
-		out = append(out, byte(c))
-	}
-	return string(out)
-}
-
-// Kind values for the well-known prompt subjects. New subsystems should
-// add a constant here so the UI can dispatch on a known string.
-const (
-	KindVNC = "vnc"
-	KindSSH = "ssh"
-)
-
-// DefaultTimeout is the wall-clock window the user has to accept or deny a
-// pending approval before the broker fails closed and returns ErrTimeout.
-// Kept well under typical VNC client and dashboard connection timeouts so
-// the RFB rejection actually reaches the browser instead of racing the
-// browser's own "connection timed out" message.
-const DefaultTimeout = 15 * time.Second
-
-// timeoutValue returns the active timeout. It's a var so tests in this
-// package can shorten the wait without exposing a setter on the public
-// API. Production code always sees DefaultTimeout.
-var timeoutValue = func() time.Duration { return DefaultTimeout }
-
-// ErrNoSubscriber indicates no UI is connected to consume the prompt.
-// The caller must reject the underlying connection (fail-closed).
-var ErrNoSubscriber = errors.New("no UI subscriber connected for approval")
-
-// ErrTimeout indicates the user did not respond within DefaultTimeout.
-var ErrTimeout = errors.New("approval timed out")
-
-// ErrDenied indicates the user explicitly denied the connection.
-var ErrDenied = errors.New("approval denied")
-
-// EventPublisher is the subset of peer.Status used to emit prompts.
-type EventPublisher interface {
-	PublishEvent(
-		severity proto.SystemEvent_Severity,
-		category proto.SystemEvent_Category,
-		msg string,
-		userMsg string,
-		metadata map[string]string,
-	)
-	HasEventSubscribers() bool
-}
-
-// Prompt describes the pending request shown to the user. Kind selects
-// the UI dispatch path (e.g. "vnc", "ssh"). Subject is the human-readable
-// one-liner the UI may show as a title or notification body. Metadata is
-// passed through verbatim and is the subsystem-specific payload (peer
-// name, source IP, mode, etc.).
-type Prompt struct {
-	Kind     string
-	Subject  string
-	Metadata map[string]string
-}
-
-// Decision carries the user's response to an approval prompt. ViewOnly is
-// only meaningful when Accept is true; it lets the host grant the
-// connection but signal the requester that input control is withheld.
-type Decision struct {
-	Accept   bool
-	ViewOnly bool
-}
-
-// Broker holds in-flight approval requests keyed by request ID.
-type Broker struct {
-	pub EventPublisher
-
-	mu      sync.Mutex
-	pending map[string]chan Decision
-}
-
-// New returns a broker that publishes prompts via pub.
-func New(pub EventPublisher) *Broker {
-	return &Broker{
-		pub:     pub,
-		pending: make(map[string]chan Decision),
-	}
-}
-
-// Request emits a SystemEvent for p and blocks until the UI calls Respond,
-// ctx is cancelled, or DefaultTimeout elapses. Returns a Decision when
-// the user replied; ErrDenied / ErrTimeout / ErrNoSubscriber / ctx.Err
-// otherwise. Callers must treat any non-nil error as a deny.
-func (b *Broker) Request(ctx context.Context, p Prompt) (Decision, error) {
-	var zero Decision
-	if b == nil || b.pub == nil {
-		return zero, fmt.Errorf("approval broker not configured")
-	}
-	if !b.pub.HasEventSubscribers() {
-		return zero, ErrNoSubscriber
-	}
-
-	id := uuid.NewString()
-	resp := make(chan Decision, 1)
-
-	b.mu.Lock()
-	b.pending[id] = resp
-	b.mu.Unlock()
-
-	defer b.dropPending(id)
-
-	timeout := timeoutValue()
-	expiresAt := time.Now().Add(timeout)
-	meta := make(map[string]string, len(p.Metadata)+3)
-	for k, v := range p.Metadata {
-		meta[k] = v
-	}
-	meta[MetaRequestID] = id
-	meta[MetaKind] = p.Kind
-	meta[MetaExpiresAt] = expiresAt.UTC().Format(time.RFC3339)
-
-	subject := p.Subject
-	if subject == "" {
-		subject = fmt.Sprintf("%s connection requires approval", p.Kind)
-	}
-	b.pub.PublishEvent(proto.SystemEvent_INFO, proto.SystemEvent_APPROVAL, subject, subject, meta)
-	log.Debugf("approval request %s (%s) emitted: %s", id, p.Kind, subject)
-
-	timer := time.NewTimer(timeout)
-	defer timer.Stop()
-
-	select {
-	case d := <-resp:
-		if !d.Accept {
-			return zero, ErrDenied
-		}
-		return d, nil
-	case <-timer.C:
-		return zero, ErrTimeout
-	case <-ctx.Done():
-		return zero, ctx.Err()
-	}
-}
-
-// Respond delivers the user's decision for id. Returns true when a pending
-// request matched and was woken, false when id was unknown or already done.
-func (b *Broker) Respond(id string, d Decision) bool {
-	if b == nil {
-		return false
-	}
-	b.mu.Lock()
-	ch, ok := b.pending[id]
-	if ok {
-		delete(b.pending, id)
-	}
-	b.mu.Unlock()
-	if !ok {
-		return false
-	}
-	select {
-	case ch <- d:
-	default:
-	}
-	return true
-}
-
-func (b *Broker) dropPending(id string) {
-	b.mu.Lock()
-	delete(b.pending, id)
-	b.mu.Unlock()
-}

client/internal/approval/broker_test.go

@@ -1,434 +0,0 @@
-package approval
-
-import (
-	"context"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// fakePublisher records published events and reports whether subscribers
-// are connected. The subscribers flag is the security-critical signal:
-// when false the broker must refuse to emit and the gate must fail closed.
-type fakePublisher struct {
-	mu          sync.Mutex
-	subscribers bool
-	events      []*proto.SystemEvent
-}
-
-func (p *fakePublisher) PublishEvent(
-	severity proto.SystemEvent_Severity,
-	category proto.SystemEvent_Category,
-	msg string,
-	userMsg string,
-	metadata map[string]string,
-) {
-	p.mu.Lock()
-	p.events = append(p.events, &proto.SystemEvent{
-		Severity:    severity,
-		Category:    category,
-		Message:     msg,
-		UserMessage: userMsg,
-		Metadata:    metadata,
-	})
-	p.mu.Unlock()
-}
-
-func (p *fakePublisher) HasEventSubscribers() bool {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	return p.subscribers
-}
-
-func (p *fakePublisher) lastEvent(t *testing.T) *proto.SystemEvent {
-	t.Helper()
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	require.NotEmpty(t, p.events, "publisher saw no events")
-	return p.events[len(p.events)-1]
-}
-
-func (p *fakePublisher) eventCount() int {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	return len(p.events)
-}
-
-// TestRequestNoSubscriberFailsClosed is the core fail-closed invariant:
-// when the UI is not subscribed, the broker must refuse without emitting
-// an event or arming a waiter. A regression here is a silent bypass.
-func TestRequestNoSubscriberFailsClosed(t *testing.T) {
-	pub := &fakePublisher{subscribers: false}
-	b := New(pub)
-
-	_, err := b.Request(context.Background(), Prompt{Kind: KindVNC, Subject: "test"})
-	assert.ErrorIs(t, err, ErrNoSubscriber)
-	assert.Equal(t, 0, pub.eventCount(), "no event must be emitted when fail-closed")
-
-	b.mu.Lock()
-	pending := len(b.pending)
-	b.mu.Unlock()
-	assert.Equal(t, 0, pending, "no waiter must be registered on fail-closed")
-}
-
-// TestRequestTimeoutDenies verifies that a request without a UI response
-// returns ErrTimeout (deny) rather than nil (silent accept). Uses a short
-// per-test broker timeout via Respond after the fact to keep the test fast.
-func TestRequestTimeoutDenies(t *testing.T) {
-	// Replace DefaultTimeout for the lifetime of this test.
-	orig := DefaultTimeout
-	defaultTimeout(t, 60*time.Millisecond)
-	defer defaultTimeout(t, orig)
-
-	pub := &fakePublisher{subscribers: true}
-	b := New(pub)
-
-	start := time.Now()
-	_, err := b.Request(context.Background(), Prompt{Kind: KindVNC, Subject: "test"})
-	assert.ErrorIs(t, err, ErrTimeout, "missing user response must yield ErrTimeout, not nil")
-	assert.GreaterOrEqual(t, time.Since(start), 50*time.Millisecond, "timeout fired prematurely")
-}
-
-// TestRequestDenied returns ErrDenied when the UI responds with false.
-func TestRequestDenied(t *testing.T) {
-	pub := &fakePublisher{subscribers: true}
-	b := New(pub)
-
-	var requestID string
-	done := make(chan error, 1)
-	go func() {
-		done <- requestErr(b, context.Background(), Prompt{Kind: KindVNC, Subject: "test"})
-	}()
-
-	requestID = waitForRequestID(t, pub)
-	require.True(t, b.Respond(requestID, Decision{Accept: false}))
-
-	select {
-	case err := <-done:
-		assert.ErrorIs(t, err, ErrDenied)
-	case <-time.After(time.Second):
-		t.Fatal("Request did not return after Respond(false)")
-	}
-}
-
-// TestRequestAccepted is the happy path. Failure here doesn't bypass the
-// gate but breaks the feature.
-func TestRequestAccepted(t *testing.T) {
-	pub := &fakePublisher{subscribers: true}
-	b := New(pub)
-
-	done := make(chan error, 1)
-	go func() {
-		done <- requestErr(b, context.Background(), Prompt{Kind: KindVNC, Subject: "test"})
-	}()
-
-	id := waitForRequestID(t, pub)
-	require.True(t, b.Respond(id, Decision{Accept: true}))
-
-	select {
-	case err := <-done:
-		assert.NoError(t, err)
-	case <-time.After(time.Second):
-		t.Fatal("Request did not return after Respond(true)")
-	}
-}
-
-// TestRequestCtxCancelDenies verifies that an upstream cancel (e.g. the
-// engine shutting down mid-prompt) returns the cancel error rather than
-// nil. A nil here would be a silent bypass on shutdown races.
-func TestRequestCtxCancelDenies(t *testing.T) {
-	pub := &fakePublisher{subscribers: true}
-	b := New(pub)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan error, 1)
-	go func() {
-		done <- requestErr(b, ctx, Prompt{Kind: KindVNC, Subject: "test"})
-	}()
-
-	// Wait until the prompt is in flight so cancel races a live waiter.
-	_ = waitForRequestID(t, pub)
-	cancel()
-
-	select {
-	case err := <-done:
-		assert.ErrorIs(t, err, context.Canceled)
-	case <-time.After(time.Second):
-		t.Fatal("Request did not return after ctx cancel")
-	}
-}
-
-// TestRespondUnknownIsNoop ensures a stray RespondApproval RPC cannot
-// affect or accidentally accept any in-flight request whose id it doesn't
-// match. Also confirms it doesn't panic.
-func TestRespondUnknownIsNoop(t *testing.T) {
-	pub := &fakePublisher{subscribers: true}
-	b := New(pub)
-
-	// No in-flight prompts: Respond returns false.
-	assert.False(t, b.Respond("does-not-exist", Decision{Accept: true}))
-
-	// With an in-flight prompt, a wrong id still returns false and the
-	// prompt remains armed (eventually timing out as a deny).
-	defaultTimeout(t, 60*time.Millisecond)
-	defer defaultTimeout(t, DefaultTimeout)
-
-	done := make(chan error, 1)
-	go func() {
-		done <- requestErr(b, context.Background(), Prompt{Kind: KindVNC})
-	}()
-	realID := waitForRequestID(t, pub)
-	assert.False(t, b.Respond("totally-bogus", Decision{Accept: true}), "unknown id must not match")
-	assert.NotEqual(t, "totally-bogus", realID)
-
-	select {
-	case err := <-done:
-		assert.ErrorIs(t, err, ErrTimeout, "armed prompt must still time out, not accept")
-	case <-time.After(time.Second):
-		t.Fatal("prompt did not resolve")
-	}
-}
-
-// TestRespondAfterTimeoutNoop confirms a late accept response can't
-// retroactively flip a denied (timed-out) request. The dropPending defer
-// in Request must have removed the entry by the time Respond races in.
-func TestRespondAfterTimeoutNoop(t *testing.T) {
-	defaultTimeout(t, 30*time.Millisecond)
-	defer defaultTimeout(t, DefaultTimeout)
-
-	pub := &fakePublisher{subscribers: true}
-	b := New(pub)
-
-	done := make(chan error, 1)
-	go func() {
-		done <- requestErr(b, context.Background(), Prompt{Kind: KindVNC})
-	}()
-	id := waitForRequestID(t, pub)
-
-	select {
-	case err := <-done:
-		require.ErrorIs(t, err, ErrTimeout)
-	case <-time.After(time.Second):
-		t.Fatal("prompt did not time out")
-	}
-
-	assert.False(t, b.Respond(id, Decision{Accept: true}), "late respond must be no-op")
-}
-
-// TestRespondDoubleNoop ensures a duplicate ack from the UI doesn't leak
-// past the matched waiter or panic on a closed/full channel.
-func TestRespondDoubleNoop(t *testing.T) {
-	pub := &fakePublisher{subscribers: true}
-	b := New(pub)
-
-	done := make(chan error, 1)
-	go func() {
-		done <- requestErr(b, context.Background(), Prompt{Kind: KindVNC})
-	}()
-	id := waitForRequestID(t, pub)
-	require.True(t, b.Respond(id, Decision{Accept: true}))
-	assert.False(t, b.Respond(id, Decision{Accept: false}), "second response must be no-op")
-
-	select {
-	case err := <-done:
-		assert.NoError(t, err)
-	case <-time.After(time.Second):
-		t.Fatal("prompt did not resolve")
-	}
-}
-
-// TestNilBrokerRequestErrors guards the engine pre-init path where the
-// broker may not yet exist (or its publisher is nil): Request must
-// error, never silently accept.
-func TestNilBrokerRequestErrors(t *testing.T) {
-	var b *Broker
-	_, err := b.Request(context.Background(), Prompt{Kind: KindVNC})
-	assert.Error(t, err, "nil broker must error, never silently accept")
-
-	b2 := New(nil)
-	_, err = b2.Request(context.Background(), Prompt{Kind: KindVNC})
-	assert.Error(t, err, "broker with nil publisher must error, never silently accept")
-}
-
-// TestPromptMetadataInjected confirms the broker stamps request_id, kind,
-// and expires_at on the emitted event. The UI relies on these keys; if
-// they are dropped, the user cannot route the prompt and the response
-// path breaks (which fails closed via timeout).
-func TestPromptMetadataInjected(t *testing.T) {
-	pub := &fakePublisher{subscribers: true}
-	b := New(pub)
-
-	done := make(chan error, 1)
-	go func() {
-		done <- requestErr(b, context.Background(), Prompt{
-			Kind:     KindVNC,
-			Subject:  "VNC connection from peerA",
-			Metadata: map[string]string{"peer_name": "peerA"},
-		})
-	}()
-
-	id := waitForRequestID(t, pub)
-	ev := pub.lastEvent(t)
-
-	assert.Equal(t, proto.SystemEvent_APPROVAL, ev.Category)
-	assert.Equal(t, KindVNC, ev.Metadata[MetaKind])
-	assert.Equal(t, id, ev.Metadata[MetaRequestID])
-	assert.NotEmpty(t, ev.Metadata[MetaExpiresAt])
-	assert.Equal(t, "peerA", ev.Metadata["peer_name"], "caller metadata must pass through")
-
-	require.True(t, b.Respond(id, Decision{Accept: true}))
-	<-done
-}
-
-// TestConcurrentRequests verifies that two concurrent prompts are tracked
-// independently. A bug that aliases ids would let one Respond unblock
-// the wrong waiter (a silent accept across prompts).
-func TestConcurrentRequests(t *testing.T) {
-	pub := &fakePublisher{subscribers: true}
-	b := New(pub)
-
-	const n = 20
-	results := make(chan error, n)
-	for i := 0; i < n; i++ {
-		go func() {
-			results <- requestErr(b, context.Background(), Prompt{Kind: KindVNC})
-		}()
-	}
-
-	ids := waitForNRequestIDs(t, pub, n)
-	require.Len(t, ids, n)
-
-	// Deny exactly half, accept the rest. Track outcome per id so we can
-	// match each Request's return value against the response we sent.
-	denySet := make(map[string]bool, n)
-	for i, id := range ids {
-		deny := i%2 == 0
-		denySet[id] = deny
-		require.True(t, b.Respond(id, Decision{Accept: !deny}))
-	}
-
-	// Collect all returns and check no nil errors slipped past a deny.
-	var accepted, denied atomic.Int32
-	for i := 0; i < n; i++ {
-		select {
-		case err := <-results:
-			if err == nil {
-				accepted.Add(1)
-			} else {
-				assert.ErrorIs(t, err, ErrDenied)
-				denied.Add(1)
-			}
-		case <-time.After(2 * time.Second):
-			t.Fatalf("only got %d/%d responses", i, n)
-		}
-	}
-	assert.Equal(t, int32(n/2), denied.Load())
-	assert.Equal(t, int32(n/2), accepted.Load())
-}
-
-// waitForRequestID blocks until the publisher sees its next event and
-// returns the request_id stamped on it.
-func waitForRequestID(t *testing.T, pub *fakePublisher) string {
-	t.Helper()
-	deadline := time.Now().Add(2 * time.Second)
-	for time.Now().Before(deadline) {
-		pub.mu.Lock()
-		count := len(pub.events)
-		var id string
-		if count > 0 {
-			id = pub.events[count-1].Metadata[MetaRequestID]
-		}
-		pub.mu.Unlock()
-		if id != "" {
-			return id
-		}
-		time.Sleep(2 * time.Millisecond)
-	}
-	t.Fatal("timeout waiting for emitted event")
-	return ""
-}
-
-func waitForNRequestIDs(t *testing.T, pub *fakePublisher, n int) []string {
-	t.Helper()
-	deadline := time.Now().Add(2 * time.Second)
-	for time.Now().Before(deadline) {
-		pub.mu.Lock()
-		count := len(pub.events)
-		pub.mu.Unlock()
-		if count >= n {
-			break
-		}
-		time.Sleep(2 * time.Millisecond)
-	}
-	pub.mu.Lock()
-	defer pub.mu.Unlock()
-	out := make([]string, 0, len(pub.events))
-	seen := make(map[string]struct{}, len(pub.events))
-	for _, ev := range pub.events {
-		id := ev.Metadata[MetaRequestID]
-		if id == "" {
-			continue
-		}
-		if _, dup := seen[id]; dup {
-			continue
-		}
-		seen[id] = struct{}{}
-		out = append(out, id)
-	}
-	if len(out) < n {
-		t.Fatalf("only got %d/%d request ids", len(out), n)
-	}
-	return out
-}
-
-// defaultTimeout swaps the broker's per-request wall-clock window so the
-// timeout tests run quickly. Restores the prior value on the next call.
-func defaultTimeout(t *testing.T, d time.Duration) {
-	t.Helper()
-	if d <= 0 {
-		t.Fatal("defaultTimeout must be > 0")
-	}
-	timeoutValue = func() time.Duration { return d }
-}
-
-// requestErr wraps Broker.Request to drop the Decision when tests only
-// care about the error path. Keeps the goroutine bodies tight.
-func requestErr(b *Broker, ctx context.Context, p Prompt) error {
-	_, err := b.Request(ctx, p)
-	return err
-}
-
-// TestRequestViewOnly checks the view-only outcome flows through Request's
-// Decision return without being silently swallowed.
-func TestRequestViewOnly(t *testing.T) {
-	pub := &fakePublisher{subscribers: true}
-	b := New(pub)
-
-	type result struct {
-		d   Decision
-		err error
-	}
-	done := make(chan result, 1)
-	go func() {
-		d, err := b.Request(context.Background(), Prompt{Kind: KindVNC})
-		done <- result{d, err}
-	}()
-
-	id := waitForRequestID(t, pub)
-	require.True(t, b.Respond(id, Decision{Accept: true, ViewOnly: true}))
-
-	select {
-	case r := <-done:
-		assert.NoError(t, r.err)
-		assert.True(t, r.d.Accept)
-		assert.True(t, r.d.ViewOnly, "ViewOnly must survive the round-trip")
-	case <-time.After(time.Second):
-		t.Fatal("view-only request did not resolve")
-	}
-}

client/internal/approval/fingerprint_test.go

@@ -1,62 +0,0 @@
-package approval
-
-import "testing"
-
-// TestShortKeyFingerprint locks in the format the VNC approval prompt
-// shows to the user. The fingerprint is the user's only cryptographic
-// anchor against a malicious management server that pushes a spoofed
-// display name, so accidental changes to its format would silently
-// undermine that defence.
-func TestShortKeyFingerprint(t *testing.T) {
-	cases := []struct {
-		name string
-		in   string
-		want string
-	}{
-		{
-			name: "full_32_byte_pubkey",
-			in:   "0123456789abcdeffedcba9876543210ffeeddccbbaa99887766554433221100",
-			want: "0123-4567-89ab-cdef",
-		},
-		{
-			name: "exactly_16_chars",
-			in:   "0123456789abcdef",
-			want: "0123-4567-89ab-cdef",
-		},
-		{
-			name: "borderline_8_chars",
-			in:   "01234567",
-			want: "0123-4567",
-		},
-		{
-			name: "too_short_returns_empty",
-			in:   "0123",
-			want: "",
-		},
-		{
-			name: "empty_returns_empty",
-			in:   "",
-			want: "",
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			got := ShortKeyFingerprint(tc.in)
-			if got != tc.want {
-				t.Fatalf("ShortKeyFingerprint(%q) = %q, want %q", tc.in, got, tc.want)
-			}
-		})
-	}
-}
-
-// TestShortKeyFingerprint_DistinctKeysDistinctOutputs guards against a
-// formatting bug that would collapse different prefixes onto the same
-// displayed fingerprint and let an attacker substitute their pubkey for
-// a victim's while keeping the prompt visually identical.
-func TestShortKeyFingerprint_DistinctKeysDistinctOutputs(t *testing.T) {
-	a := ShortKeyFingerprint("0123456789abcdef" + "rest_of_pubkey_ignored")
-	b := ShortKeyFingerprint("0123456789abcde0" + "rest_of_pubkey_ignored")
-	if a == b {
-		t.Fatalf("expected distinct outputs for distinct prefixes, both = %q", a)
-	}
-}

client/internal/auth/auth.go

@@ -344,7 +344,6 @@ func (a *Auth) setSystemInfoFlags(info *system.Info) {
 		a.config.RosenpassEnabled,
 		a.config.RosenpassPermissive,
 		a.config.ServerSSHAllowed,
-		a.config.ServerVNCAllowed,
 		a.config.DisableClientRoutes,
 		a.config.DisableServerRoutes,
 		a.config.DisableDNS,

client/internal/auth/device_flow.go

@@ -259,18 +259,12 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 	ticker := time.NewTicker(interval)
 	defer ticker.Stop()
 
-	log.Infof("device flow: waiting for user authorization, polling token endpoint every %s, code expires in %s", interval, timeout)
-
-	start := time.Now()
-	polls := 0
-
 	for {
 		select {
 		case <-waitCtx.Done():
 			return TokenInfo{}, waitCtx.Err()
 		case <-ticker.C:
 
-			polls++
 			tokenResponse, err := d.requestToken(info)
 			if err != nil {
 				return TokenInfo{}, fmt.Errorf("parsing token response failed with error: %v", err)
@@ -278,12 +272,10 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 
 			if tokenResponse.Error != "" {
 				if tokenResponse.Error == "authorization_pending" {
-					log.Tracef("device flow: authorization still pending after poll %d", polls)
 					continue
 				} else if tokenResponse.Error == "slow_down" {
 					interval += (3 * time.Second)
 					ticker.Reset(interval)
-					log.Infof("device flow: IdP requested slow_down, polling interval increased to %s", interval)
 					continue
 				}
 
@@ -304,7 +296,6 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 				return TokenInfo{}, fmt.Errorf("validate access token failed with error: %v", err)
 			}
 
-			log.Infof("device flow: user authorization confirmed after %d polls in %s", polls, time.Since(start).Round(time.Second))
 			return tokenInfo, err
 		}
 	}

client/internal/auth/pkce_flow.go

@@ -188,8 +188,6 @@ func (p *PKCEAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowInfo
 	waitCtx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
-	log.Infof("pkce flow: waiting for authorization callback on %s, timeout %s", p.oAuthConfig.RedirectURL, timeout)
-
 	tokenChan := make(chan *oauth2.Token, 1)
 	errChan := make(chan error, 1)
 
@@ -223,7 +221,6 @@ func (p *PKCEAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowInfo
 func (p *PKCEAuthorizationFlow) startServer(server *http.Server, tokenChan chan<- *oauth2.Token, errChan chan<- error) {
 	mux := http.NewServeMux()
 	mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
-		log.Infof("pkce flow: received authorization callback from IdP")
 		cert := p.providerConfig.ClientCertPair
 		if cert != nil {
 			tr := &http.Transport{
@@ -274,18 +271,11 @@ func (p *PKCEAuthorizationFlow) handleRequest(req *http.Request) (*oauth2.Token,
 		return nil, fmt.Errorf("authentication failed: missing code")
 	}
 
-	exchangeStart := time.Now()
-	token, err := p.oAuthConfig.Exchange(
+	return p.oAuthConfig.Exchange(
 		req.Context(),
 		code,
 		oauth2.SetAuthURLParam("code_verifier", p.codeVerifier),
 	)
-	if err != nil {
-		return nil, err
-	}
-
-	log.Infof("pkce flow: authorization code exchanged for token in %s", time.Since(exchangeStart).Round(time.Millisecond))
-	return token, nil
 }
 
 func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo, error) {

client/internal/conn_mgr.go

@@ -109,7 +109,7 @@ func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) er
 			return nil
 		}
 
-		log.Infof("lazy connection manager is enabled by the management feature flag")
+		log.Warnf("lazy connection manager is enabled by management feature flag")
 		e.initLazyManager(ctx)
 		e.statusRecorder.UpdateLazyConnection(true)
 		return e.addPeersToLazyConnManager()

client/internal/connect.go

@@ -604,8 +604,6 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 		RosenpassEnabled:              config.RosenpassEnabled,
 		RosenpassPermissive:           config.RosenpassPermissive,
 		ServerSSHAllowed:              util.ReturnBoolWithDefaultTrue(config.ServerSSHAllowed),
-		ServerVNCAllowed:              config.ServerVNCAllowed != nil && *config.ServerVNCAllowed,
-		DisableVNCApproval:            config.DisableVNCApproval,
 		EnableSSHRoot:                 config.EnableSSHRoot,
 		EnableSSHSFTP:                 config.EnableSSHSFTP,
 		EnableSSHLocalPortForwarding:  config.EnableSSHLocalPortForwarding,
@@ -688,7 +686,6 @@ func loginToManagement(ctx context.Context, client mgm.Client, pubSSHKey []byte,
 		config.RosenpassEnabled,
 		config.RosenpassPermissive,
 		config.ServerSSHAllowed,
-		config.ServerVNCAllowed,
 		config.DisableClientRoutes,
 		config.DisableServerRoutes,
 		config.DisableDNS,

client/internal/debug/debug.go

@@ -669,12 +669,6 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	if g.internalConfig.SSHJWTCacheTTL != nil {
 		configContent.WriteString(fmt.Sprintf("SSHJWTCacheTTL: %d\n", *g.internalConfig.SSHJWTCacheTTL))
 	}
-	if g.internalConfig.ServerVNCAllowed != nil {
-		configContent.WriteString(fmt.Sprintf("ServerVNCAllowed: %v\n", *g.internalConfig.ServerVNCAllowed))
-	}
-	if g.internalConfig.DisableVNCApproval != nil {
-		configContent.WriteString(fmt.Sprintf("DisableVNCApproval: %v\n", *g.internalConfig.DisableVNCApproval))
-	}
 
 	configContent.WriteString(fmt.Sprintf("DisableClientRoutes: %v\n", g.internalConfig.DisableClientRoutes))
 	configContent.WriteString(fmt.Sprintf("DisableServerRoutes: %v\n", g.internalConfig.DisableServerRoutes))

client/internal/debug/debug_test.go

@@ -864,8 +864,6 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		RosenpassEnabled:              true,
 		RosenpassPermissive:           true,
 		ServerSSHAllowed:              &bTrue,
-		ServerVNCAllowed:              &bTrue,
-		DisableVNCApproval:            &bTrue,
 		EnableSSHRoot:                 &bTrue,
 		EnableSSHSFTP:                 &bTrue,
 		EnableSSHLocalPortForwarding:  &bTrue,

client/internal/engine.go

@@ -34,7 +34,6 @@ import (
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/acl"
-	"github.com/netbirdio/netbird/client/internal/approval"
 	"github.com/netbirdio/netbird/client/internal/debug"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
@@ -133,8 +132,6 @@ type EngineConfig struct {
 	RosenpassPermissive bool
 
 	ServerSSHAllowed              bool
-	ServerVNCAllowed              bool
-	DisableVNCApproval            *bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -225,9 +222,7 @@ type Engine struct {
 
 	networkMonitor *networkmonitor.NetworkMonitor
 
-	sshServer      sshServer
-	vncSrv         vncServer
-	approvalBroker *approval.Broker
+	sshServer sshServer
 
 	statusRecorder *peer.Status
 
@@ -334,7 +329,6 @@ func NewEngine(
 		TURNs:              []*stun.URI{},
 		networkSerial:      0,
 		statusRecorder:     services.StatusRecorder,
-		approvalBroker:     approval.New(services.StatusRecorder),
 		stateManager:       services.StateManager,
 		portForwardManager: portforward.NewManager(),
 		checks:             services.Checks,
@@ -409,10 +403,6 @@ func (e *Engine) stopLocked() {
 		log.Warnf("failed to stop SSH server: %v", err)
 	}
 
-	if err := e.stopVNCServer(); err != nil {
-		log.Warnf("failed to stop VNC server: %v", err)
-	}
-
 	e.cleanupSSHConfig()
 
 	if e.ingressGatewayMgr != nil {
@@ -561,7 +551,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		} else {
 			log.Infof("running rosenpass in strict mode")
 		}
-		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName, publicKey)
+		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName)
 		if err != nil {
 			return fmt.Errorf("create rosenpass manager: %w", err)
 		}
@@ -1167,7 +1157,6 @@ func (e *Engine) applyInfoFlags(info *system.Info) {
 		e.config.RosenpassEnabled,
 		e.config.RosenpassPermissive,
 		&e.config.ServerSSHAllowed,
-		&e.config.ServerVNCAllowed,
 		e.config.DisableClientRoutes,
 		e.config.DisableServerRoutes,
 		e.config.DisableDNS,
@@ -1222,10 +1211,6 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 		}
 	}
 
-	if err := e.updateVNC(); err != nil {
-		log.Warnf("failed handling VNC server setup: %v", err)
-	}
-
 	state := e.statusRecorder.GetLocalPeerState()
 	state.IP = e.wgInterface.Address().String()
 	state.IPv6 = e.wgInterface.Address().IPv6String()
@@ -1526,11 +1511,6 @@ func (e *Engine) reconcilePeers(networkMap *mgmProto.NetworkMap) ([]*mgmProto.Re
 		}
 	}
 
-	// VNC auth: always sync, including nil so cleared auth on the management
-	// side is applied locally, and so it isn't skipped on the RemotePeersIsEmpty
-	// cleanup path.
-	e.updateVNCServerAuth(networkMap.GetVncAuth())
-
 	// cleanup request, most likely our peer has been deleted
 	if networkMap.GetRemotePeersIsEmpty() {
 		err := e.removeAllPeers()
@@ -2045,7 +2025,6 @@ func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, err
 		e.config.RosenpassEnabled,
 		e.config.RosenpassPermissive,
 		&e.config.ServerSSHAllowed,
-		&e.config.ServerVNCAllowed,
 		e.config.DisableClientRoutes,
 		e.config.DisableServerRoutes,
 		e.config.DisableDNS,
@@ -2826,16 +2805,3 @@ func decodeRelayIP(b []byte) netip.Addr {
 	}
 	return ip.Unmap()
 }
-
-// RespondApproval relays the user's decision for a pending approval to
-// the broker. viewOnly is honoured only when accept is true. Returns
-// true when the request_id matched a live prompt.
-func (e *Engine) RespondApproval(requestID string, accept, viewOnly bool) bool {
-	if e == nil || e.approvalBroker == nil {
-		return false
-	}
-	return e.approvalBroker.Respond(requestID, approval.Decision{
-		Accept:   accept,
-		ViewOnly: accept && viewOnly,
-	})
-}

client/internal/engine_ssh.go

@@ -12,10 +12,10 @@ import (
 	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface/netstack"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
+	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
 	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
 	sshserver "github.com/netbirdio/netbird/client/ssh/server"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-	sshauth "github.com/netbirdio/netbird/shared/sessionauth"
 	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
 )
 
@@ -237,18 +237,22 @@ func (e *Engine) startSSHServer(jwtConfig *sshserver.JWTConfig) error {
 		return errors.New("wg interface not initialized")
 	}
 
-	wgAddr := e.wgInterface.Address()
 	serverConfig := &sshserver.Config{
-		HostKeyPEM:        e.config.SSHKey,
-		JWT:               jwtConfig,
-		NetstackNet:       e.wgInterface.GetNet(),
-		NetworkValidation: wgAddr,
+		HostKeyPEM: e.config.SSHKey,
+		JWT:        jwtConfig,
 	}
 	server := sshserver.New(serverConfig)
 
+	wgAddr := e.wgInterface.Address()
+	server.SetNetworkValidation(wgAddr)
+
 	netbirdIP := wgAddr.IP
 	listenAddr := netip.AddrPortFrom(netbirdIP, sshserver.InternalSSHPort)
 
+	if netstackNet := e.wgInterface.GetNet(); netstackNet != nil {
+		server.SetNetstackNet(netstackNet)
+	}
+
 	e.configureSSHServer(server)
 
 	if err := server.Start(e.ctx, listenAddr); err != nil {

client/internal/engine_vnc.go

@@ -1,325 +0,0 @@
-//go:build !js && !ios && !android
-
-package internal
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/netip"
-
-	log "github.com/sirupsen/logrus"
-
-	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/internal/approval"
-	"github.com/netbirdio/netbird/client/internal/metrics"
-	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
-	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/client/vnc"
-	vncserver "github.com/netbirdio/netbird/client/vnc/server"
-	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-	sshauth "github.com/netbirdio/netbird/shared/sessionauth"
-	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
-)
-
-type vncServer interface {
-	Start(ctx context.Context, addr netip.AddrPort, network netip.Prefix) error
-	AddListener(ctx context.Context, addr netip.AddrPort, network netip.Prefix) error
-	Stop() error
-	ActiveSessions() []vncserver.ActiveSessionInfo
-}
-
-func (e *Engine) setupVNCPortRedirection() error {
-	if e.firewall == nil || e.wgInterface == nil {
-		return nil
-	}
-
-	localAddr := e.wgInterface.Address().IP
-	if !localAddr.IsValid() {
-		return errors.New("invalid local NetBird address")
-	}
-
-	if err := e.firewall.AddInboundDNAT(localAddr, firewallManager.ProtocolTCP, vnc.ExternalPort, vnc.InternalPort); err != nil {
-		return fmt.Errorf("add VNC port redirection: %w", err)
-	}
-	log.Infof("VNC port redirection: %s:%d -> %s:%d", localAddr, vnc.ExternalPort, localAddr, vnc.InternalPort)
-
-	if wgAddr := e.wgInterface.Address(); wgAddr.HasIPv6() {
-		v6 := wgAddr.IPv6
-		if err := e.firewall.AddInboundDNAT(v6, firewallManager.ProtocolTCP, vnc.ExternalPort, vnc.InternalPort); err != nil {
-			log.Warnf("failed to add IPv6 VNC port redirection: %v", err)
-		} else {
-			log.Infof("VNC port redirection: [%s]:%d -> [%s]:%d", v6, vnc.ExternalPort, v6, vnc.InternalPort)
-		}
-	}
-
-	return nil
-}
-
-func (e *Engine) cleanupVNCPortRedirection() error {
-	if e.firewall == nil || e.wgInterface == nil {
-		return nil
-	}
-
-	localAddr := e.wgInterface.Address().IP
-	if !localAddr.IsValid() {
-		return errors.New("invalid local NetBird address")
-	}
-
-	if err := e.firewall.RemoveInboundDNAT(localAddr, firewallManager.ProtocolTCP, vnc.ExternalPort, vnc.InternalPort); err != nil {
-		return fmt.Errorf("remove VNC port redirection: %w", err)
-	}
-
-	if wgAddr := e.wgInterface.Address(); wgAddr.HasIPv6() {
-		if err := e.firewall.RemoveInboundDNAT(wgAddr.IPv6, firewallManager.ProtocolTCP, vnc.ExternalPort, vnc.InternalPort); err != nil {
-			log.Debugf("failed to remove IPv6 VNC port redirection: %v", err)
-		}
-	}
-
-	return nil
-}
-
-// updateVNC handles starting/stopping the VNC server based on the config flag.
-func (e *Engine) updateVNC() error {
-	if !e.config.ServerVNCAllowed {
-		if e.vncSrv != nil {
-			log.Info("VNC server disabled, stopping")
-		}
-		return e.stopVNCServer()
-	}
-
-	if e.config.BlockInbound {
-		log.Info("VNC server disabled because inbound connections are blocked")
-		return e.stopVNCServer()
-	}
-
-	if e.vncSrv != nil {
-		return nil
-	}
-
-	return e.startVNCServer()
-}
-
-func (e *Engine) startVNCServer() error {
-	if e.wgInterface == nil {
-		return errors.New("wg interface not initialized")
-	}
-
-	capturer, injector, ok := newPlatformVNC()
-	if !ok {
-		log.Debug("VNC server not supported on this platform")
-		return nil
-	}
-
-	netbirdIP := e.wgInterface.Address().IP
-
-	var sessionRecorder func(vncserver.SessionTick)
-	if e.clientMetrics != nil {
-		sessionRecorder = func(t vncserver.SessionTick) {
-			e.clientMetrics.RecordVNCSessionTick(e.ctx, metrics.VNCSessionTick{
-				Period:        t.Period,
-				BytesOut:      t.BytesOut,
-				Writes:        t.Writes,
-				FBUs:          t.FBUs,
-				MaxFBUBytes:   t.MaxFBUBytes,
-				MaxFBURects:   t.MaxFBURects,
-				MaxWriteBytes: t.MaxWriteBytes,
-				WriteNanos:    t.WriteNanos,
-			})
-		}
-	}
-	serviceMode := vncNeedsServiceMode()
-	if serviceMode {
-		log.Info("VNC: running as system service, enabling service mode (per-session agent proxy)")
-	}
-	requireApproval := e.config.DisableVNCApproval == nil || !*e.config.DisableVNCApproval
-	srv := vncserver.New(vncserver.Config{
-		Capturer:        capturer,
-		Injector:        injector,
-		IdentityKey:     e.config.WgPrivateKey[:],
-		ServiceMode:     serviceMode,
-		SessionRecorder: sessionRecorder,
-		NetstackNet:     e.wgInterface.GetNet(),
-		RequireApproval: requireApproval,
-		Approver:        &vncApprover{broker: e.approvalBroker, statusRecorder: e.statusRecorder},
-	})
-
-	listenAddr := netip.AddrPortFrom(netbirdIP, vnc.InternalPort)
-	network := e.wgInterface.Address().Network
-	if err := srv.Start(e.ctx, listenAddr, network); err != nil {
-		return fmt.Errorf("start VNC server: %w", err)
-	}
-
-	if wgAddr := e.wgInterface.Address(); wgAddr.HasIPv6() {
-		v6Addr := netip.AddrPortFrom(wgAddr.IPv6, vnc.InternalPort)
-		if err := srv.AddListener(e.ctx, v6Addr, wgAddr.IPv6Net); err != nil {
-			log.Warnf("failed to add IPv6 VNC listener: %v", err)
-		}
-	}
-
-	e.vncSrv = srv
-
-	if netstackNet := e.wgInterface.GetNet(); netstackNet != nil {
-		if registrar, ok := e.firewall.(interface {
-			RegisterNetstackService(protocol nftypes.Protocol, port uint16)
-		}); ok {
-			registrar.RegisterNetstackService(nftypes.TCP, vnc.InternalPort)
-			log.Debugf("registered VNC service with netstack for TCP:%d", vnc.InternalPort)
-		}
-	}
-
-	if err := e.setupVNCPortRedirection(); err != nil {
-		log.Warnf("setup VNC port redirection: %v", err)
-	}
-
-	log.Info("VNC server enabled")
-	return nil
-}
-
-// updateVNCServerAuth updates VNC fine-grained access control from management.
-// A nil vncAuth clears all authorized users and session pubkeys so management
-// can revoke access by omitting the field on the next sync.
-func (e *Engine) updateVNCServerAuth(vncAuth *mgmProto.VNCAuth) {
-	if e.vncSrv == nil {
-		return
-	}
-
-	vncSrv, ok := e.vncSrv.(*vncserver.Server)
-	if !ok {
-		return
-	}
-
-	if vncAuth == nil {
-		vncSrv.UpdateVNCAuth(&sshauth.Config{})
-		return
-	}
-
-	protoUsers := vncAuth.GetAuthorizedUsers()
-	authorizedUsers := make([]sshuserhash.UserIDHash, len(protoUsers))
-	for i, hash := range protoUsers {
-		if len(hash) != 16 {
-			log.Warnf("invalid VNC auth hash length %d, expected 16", len(hash))
-			return
-		}
-		authorizedUsers[i] = sshuserhash.UserIDHash(hash)
-	}
-
-	machineUsers := make(map[string][]uint32)
-	for osUser, indexes := range vncAuth.GetMachineUsers() {
-		machineUsers[osUser] = indexes.GetIndexes()
-	}
-
-	sessionPubKeys := make([]sshauth.SessionPubKey, 0, len(vncAuth.GetSessionPubKeys()))
-	for _, pk := range vncAuth.GetSessionPubKeys() {
-		pub := pk.GetPubKey()
-		if len(pub) != 32 {
-			log.Warnf("VNC session pubkey wrong length %d", len(pub))
-			continue
-		}
-		hash := pk.GetUserIdHash()
-		if len(hash) != 16 {
-			log.Warnf("VNC session user id hash wrong length %d", len(hash))
-			continue
-		}
-		sessionPubKeys = append(sessionPubKeys, sshauth.SessionPubKey{
-			PubKey:      pub,
-			UserIDHash:  sshuserhash.UserIDHash(hash),
-			DisplayName: pk.GetDisplayName(),
-		})
-	}
-
-	vncSrv.UpdateVNCAuth(&sshauth.Config{
-		AuthorizedUsers: authorizedUsers,
-		MachineUsers:    machineUsers,
-		SessionPubKeys:  sessionPubKeys,
-	})
-}
-
-// GetVNCServerStatus returns whether the VNC server is running and the list
-// of active VNC sessions. The pointer is captured under syncMsgMux so a
-// concurrent updateVNC/stopVNCServer cannot swap it out between the nil
-// check and the ActiveSessions call.
-func (e *Engine) GetVNCServerStatus() (enabled bool, sessions []vncserver.ActiveSessionInfo) {
-	e.syncMsgMux.Lock()
-	vncSrv := e.vncSrv
-	e.syncMsgMux.Unlock()
-	if vncSrv == nil {
-		return false, nil
-	}
-	return true, vncSrv.ActiveSessions()
-}
-
-func (e *Engine) stopVNCServer() error {
-	if e.vncSrv == nil {
-		return nil
-	}
-
-	if err := e.cleanupVNCPortRedirection(); err != nil {
-		log.Warnf("cleanup VNC port redirection: %v", err)
-	}
-
-	if e.wgInterface != nil && e.wgInterface.GetNet() != nil {
-		if registrar, ok := e.firewall.(interface {
-			UnregisterNetstackService(protocol nftypes.Protocol, port uint16)
-		}); ok {
-			registrar.UnregisterNetstackService(nftypes.TCP, vnc.InternalPort)
-		}
-	}
-
-	log.Info("stopping VNC server")
-	err := e.vncSrv.Stop()
-	e.vncSrv = nil
-	if err != nil {
-		return fmt.Errorf("stop VNC server: %w", err)
-	}
-	return nil
-}
-
-// vncApprover adapts the generic approval.Broker for the VNC server.
-type vncApprover struct {
-	broker         *approval.Broker
-	statusRecorder *peer.Status
-}
-
-func (a *vncApprover) Request(ctx context.Context, info vncserver.ApprovalInfo) (vncserver.ApprovalDecision, error) {
-	// Resolve the source overlay IP to a peer FQDN for the prompt label.
-	if info.PeerName == "" && info.SourceIP != "" && a.statusRecorder != nil {
-		if fqdn, ok := a.statusRecorder.PeerByIP(info.SourceIP); ok {
-			info.PeerName = fqdn
-		}
-	}
-	subject := fmt.Sprintf("VNC connection from %s", displayPeer(info))
-	meta := map[string]string{
-		"peer_name":   info.PeerName,
-		"peer_pubkey": info.PeerPubKey,
-		"source_ip":   info.SourceIP,
-		"mode":        info.Mode,
-		"username":    info.Username,
-		"initiator":   info.Initiator,
-	}
-	d, err := a.broker.Request(ctx, approval.Prompt{
-		Kind:     approval.KindVNC,
-		Subject:  subject,
-		Metadata: meta,
-	})
-	if err != nil {
-		return vncserver.ApprovalDecision{}, err
-	}
-	return vncserver.ApprovalDecision{ViewOnly: d.ViewOnly}, nil
-}
-
-func displayPeer(info vncserver.ApprovalInfo) string {
-	if info.Initiator != "" {
-		return info.Initiator
-	}
-	if info.PeerName != "" {
-		return info.PeerName
-	}
-	if info.SourceIP != "" {
-		return info.SourceIP
-	}
-	if info.PeerPubKey != "" {
-		return info.PeerPubKey
-	}
-	return "unknown peer"
-}

client/internal/engine_vnc_console_freebsd.go

@@ -1,31 +0,0 @@
-//go:build freebsd
-
-package internal
-
-import (
-	"fmt"
-
-	log "github.com/sirupsen/logrus"
-
-	vncserver "github.com/netbirdio/netbird/client/vnc/server"
-)
-
-// newConsoleVNC builds the FreeBSD console fallback: vt(4) framebuffer
-// for capture, /dev/uinput for input. The uinput device requires the
-// `uinput` kernel module (`kldload uinput`); without it, input init
-// fails and we drop to a stub injector so the user still gets a
-// view-only screen mirror.
-func newConsoleVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, error) {
-	poller := vncserver.NewFBPoller("")
-	w, h := poller.Width(), poller.Height()
-	if w == 0 || h == 0 {
-		poller.Close()
-		return nil, nil, fmt.Errorf("vt framebuffer init failed (vt may not allow mmap on this driver)")
-	}
-	if inj, err := vncserver.NewUInputInjector(w, h); err == nil {
-		return poller, inj, nil
-	} else {
-		log.Infof("VNC console: uinput unavailable (%v); view-only mode. Run `kldload uinput` to enable input.", err)
-		return poller, &vncserver.StubInputInjector{}, nil
-	}
-}

client/internal/engine_vnc_console_linux.go

@@ -1,30 +0,0 @@
-//go:build linux && !android
-
-package internal
-
-import (
-	"fmt"
-
-	log "github.com/sirupsen/logrus"
-
-	vncserver "github.com/netbirdio/netbird/client/vnc/server"
-)
-
-// newConsoleVNC builds a framebuffer + uinput VNC backend for boxes
-// without a running X server. Used as the auto-fallback when
-// newPlatformVNC can't reach X. Returns an error when /dev/fb0 or
-// /dev/uinput aren't usable so the caller can drop back to a stub.
-func newConsoleVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, error) {
-	poller := vncserver.NewFBPoller("")
-	w, h := poller.Width(), poller.Height()
-	if w == 0 || h == 0 {
-		poller.Close()
-		return nil, nil, fmt.Errorf("framebuffer capturer init failed (is /dev/fb0 readable?)")
-	}
-	inj, err := vncserver.NewUInputInjector(w, h)
-	if err != nil {
-		log.Debugf("uinput unavailable, falling back to view-only VNC: %v", err)
-		return poller, &vncserver.StubInputInjector{}, nil
-	}
-	return poller, inj, nil
-}

client/internal/engine_vnc_darwin.go

@@ -1,34 +0,0 @@
-//go:build darwin && !ios
-
-package internal
-
-import (
-	"os"
-
-	log "github.com/sirupsen/logrus"
-
-	vncserver "github.com/netbirdio/netbird/client/vnc/server"
-)
-
-func newPlatformVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, bool) {
-	capturer := vncserver.NewMacPoller()
-	// Prompt for Screen Recording at server-enable time rather than first
-	// client-connect. The native prompt is far easier for users to act on
-	// in the moment they toggled VNC on than later when "the screen looks
-	// like wallpaper" would otherwise be the only clue.
-	vncserver.PrimeScreenCapturePermission()
-	injector, err := vncserver.NewMacInputInjector()
-	if err != nil {
-		log.Debugf("VNC: macOS input injector: %v", err)
-		return capturer, &vncserver.StubInputInjector{}, true
-	}
-	return capturer, injector, true
-}
-
-// vncNeedsServiceMode reports whether the running process is a system
-// LaunchDaemon (root, parented by launchd). Daemons sit in the global
-// bootstrap namespace and cannot talk to WindowServer; we route capture
-// through a per-user agent in that case.
-func vncNeedsServiceMode() bool {
-	return os.Geteuid() == 0 && os.Getppid() == 1
-}

client/internal/engine_vnc_stub.go

@@ -1,23 +0,0 @@
-//go:build js || ios || android
-
-package internal
-
-import (
-	log "github.com/sirupsen/logrus"
-
-	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-)
-
-type vncServer interface{}
-
-func (e *Engine) updateVNC() error { return nil }
-
-func (e *Engine) updateVNCServerAuth(auth *mgmProto.VNCAuth) {
-	if auth == nil {
-		return
-	}
-	log.Debugf("ignoring VNC auth push on platform without a VNC server: %d session pubkeys, %d authorized users",
-		len(auth.GetSessionPubKeys()), len(auth.GetAuthorizedUsers()))
-}
-
-func (e *Engine) stopVNCServer() error { return nil }

client/internal/engine_vnc_windows.go

@@ -1,13 +0,0 @@
-//go:build windows
-
-package internal
-
-import vncserver "github.com/netbirdio/netbird/client/vnc/server"
-
-func newPlatformVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, bool) {
-	return vncserver.NewDesktopCapturer(), vncserver.NewWindowsInputInjector(), true
-}
-
-func vncNeedsServiceMode() bool {
-	return vncserver.GetCurrentSessionID() == 0
-}

client/internal/engine_vnc_x11.go

@@ -1,35 +0,0 @@
-//go:build (linux && !android) || freebsd
-
-package internal
-
-import (
-	log "github.com/sirupsen/logrus"
-
-	vncserver "github.com/netbirdio/netbird/client/vnc/server"
-)
-
-func newPlatformVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, bool) {
-	// Prefer X11 when an X server is reachable. NewX11InputInjector probes
-	// DISPLAY (and /proc) eagerly, so a non-nil error here means no X.
-	injector, err := vncserver.NewX11InputInjector("", "", "")
-	if err == nil {
-		return vncserver.NewX11Poller("", ""), injector, true
-	}
-	log.Debugf("VNC: X11 not available: %v", err)
-
-	// Fallback for headless / pre-X states (kernel console, login manager
-	// without X, physical server in recovery): stream the framebuffer and
-	// inject input via /dev/uinput.
-	consoleCap, consoleInj, err := newConsoleVNC()
-	if err == nil {
-		log.Infof("VNC: using framebuffer console capture (%dx%d)", consoleCap.Width(), consoleCap.Height())
-		return consoleCap, consoleInj, true
-	}
-	log.Debugf("VNC: framebuffer console fallback unavailable: %v", err)
-
-	return &vncserver.StubCapturer{}, &vncserver.StubInputInjector{}, false
-}
-
-func vncNeedsServiceMode() bool {
-	return false
-}

client/internal/metrics/influxdb.go

@@ -120,36 +120,6 @@ func (m *influxDBMetrics) RecordSyncDuration(_ context.Context, agentInfo AgentI
 	m.trimLocked()
 }
 
-func (m *influxDBMetrics) RecordVNCSessionTick(_ context.Context, agentInfo AgentInfo, tick VNCSessionTick) {
-	tags := fmt.Sprintf("deployment_type=%s,version=%s,os=%s,arch=%s,peer_id=%s",
-		agentInfo.DeploymentType.String(),
-		agentInfo.Version,
-		agentInfo.OS,
-		agentInfo.Arch,
-		agentInfo.peerID,
-	)
-
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	m.samples = append(m.samples, influxSample{
-		measurement: "netbird_vnc_traffic",
-		tags:        tags,
-		fields: map[string]float64{
-			"period_seconds":     tick.Period.Seconds(),
-			"bytes_out":          float64(tick.BytesOut),
-			"writes":             float64(tick.Writes),
-			"fbus":               float64(tick.FBUs),
-			"max_fbu_bytes":      float64(tick.MaxFBUBytes),
-			"max_fbu_rects":      float64(tick.MaxFBURects),
-			"max_write_bytes":    float64(tick.MaxWriteBytes),
-			"write_time_seconds": float64(tick.WriteNanos) / 1e9,
-		},
-		timestamp: time.Now(),
-	})
-	m.trimLocked()
-}
-
 func (m *influxDBMetrics) RecordSyncPhase(_ context.Context, agentInfo AgentInfo, phase string, duration time.Duration) {
 	tags := fmt.Sprintf("deployment_type=%s,version=%s,os=%s,arch=%s,peer_id=%s,phase=%s",
 		agentInfo.DeploymentType.String(),

client/internal/metrics/metrics.go

@@ -63,11 +63,6 @@ type metricsImplementation interface {
 	// RecordLoginDuration records how long the login to management took
 	RecordLoginDuration(ctx context.Context, agentInfo AgentInfo, duration time.Duration, success bool)
 
-	// RecordVNCSessionTick records a periodic snapshot of one VNC
-	// session's wire activity. Called once per metricsConn tick interval
-	// (and once at session close), only when the tick saw activity.
-	RecordVNCSessionTick(ctx context.Context, agentInfo AgentInfo, tick VNCSessionTick)
-
 	// Export exports metrics in InfluxDB line protocol format
 	Export(w io.Writer) error
 
@@ -87,21 +82,6 @@ type ClientMetrics struct {
 	pushCancel context.CancelFunc
 }
 
-// VNCSessionTick is one sampling slice of a VNC session's wire activity.
-// BytesOut / Writes / FBUs / WriteNanos are deltas observed during this
-// tick; Max* fields are the high-water marks observed during the tick.
-// Period is the wall-clock duration the deltas cover.
-type VNCSessionTick struct {
-	Period        time.Duration
-	BytesOut      uint64
-	Writes        uint64
-	FBUs          uint64
-	MaxFBUBytes   uint64
-	MaxFBURects   uint64
-	MaxWriteBytes uint64
-	WriteNanos    uint64
-}
-
 // ConnectionStageTimestamps holds timestamps for each connection stage
 type ConnectionStageTimestamps struct {
 	SignalingReceived  time.Time // First signal received from remote peer (both initial and reconnection)
@@ -151,18 +131,6 @@ func (c *ClientMetrics) RecordSyncDuration(ctx context.Context, duration time.Du
 	c.impl.RecordSyncDuration(ctx, agentInfo, duration)
 }
 
-// RecordVNCSessionTick records a periodic snapshot of one VNC session.
-func (c *ClientMetrics) RecordVNCSessionTick(ctx context.Context, tick VNCSessionTick) {
-	if c == nil {
-		return
-	}
-	c.mu.RLock()
-	agentInfo := c.agentInfo
-	c.mu.RUnlock()
-
-	c.impl.RecordVNCSessionTick(ctx, agentInfo, tick)
-}
-
 // RecordSyncPhase records the duration of a single sub-phase of sync processing
 func (c *ClientMetrics) RecordSyncPhase(ctx context.Context, phase string, duration time.Duration) {
 	if c == nil {

client/internal/metrics/push_test.go

@@ -76,9 +76,6 @@ func (m *mockMetrics) RecordSyncPhase(_ context.Context, _ AgentInfo, _ string,
 func (m *mockMetrics) RecordLoginDuration(_ context.Context, _ AgentInfo, _ time.Duration, _ bool) {
 }
 
-func (m *mockMetrics) RecordVNCSessionTick(_ context.Context, _ AgentInfo, _ VNCSessionTick) {
-}
-
 func (m *mockMetrics) Export(w io.Writer) error {
 	if m.exportData != "" {
 		_, err := w.Write([]byte(m.exportData))

client/internal/netflow/store/event_aggregation_test.go

@@ -175,9 +175,7 @@ func TestFlowAggregationOfUnknownProtocols(t *testing.T) {
 }
 
 func TestResetAggregationWindow(t *testing.T) {
-	now := time.Now()
-	nowFunc := func() time.Time { return now }
-	store := NewAggregatingMemoryStoreWithTimeFunc(nowFunc)
+	store := NewAggregatingMemoryStore()
 	store.StoreEvent(&types.Event{
 		ID:        uuid.New(),
 		Timestamp: time.Now(),
@@ -200,7 +198,6 @@ func TestResetAggregationWindow(t *testing.T) {
 		},
 	})
 
-	now = now.Add(1 * time.Second)
 	reset := store.ResetAggregationWindow()
 	previousEvents, ok := reset.(*AggregatingMemory)
 	assert.True(t, ok)

client/internal/netflow/store/memory.go

@@ -29,7 +29,6 @@ type AggregatingMemory struct {
 	WindowStart time.Time
 	WindowEnd   time.Time
 	rnd         *v2.PCG
-	nowFunc     func() time.Time
 }
 
 func (m *Memory) StoreEvent(event *types.Event) {
@@ -63,19 +62,14 @@ func (m *Memory) DeleteEvents(ids []uuid.UUID) {
 }
 
 func NewAggregatingMemoryStore() *AggregatingMemory {
-	return NewAggregatingMemoryStoreWithTimeFunc(defaultNowFunc)
-}
-
-// used in tests when deterministic (less random) time intervals are required
-func NewAggregatingMemoryStoreWithTimeFunc(nowFunc func() time.Time) *AggregatingMemory {
-	return &AggregatingMemory{WindowStart: nowFunc(), Memory: Memory{events: make(map[uuid.UUID]*types.Event)}, nowFunc: nowFunc, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
+	return &AggregatingMemory{WindowStart: time.Now(), Memory: Memory{events: make(map[uuid.UUID]*types.Event)}, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
 }
 
 func (am *AggregatingMemory) ResetAggregationWindow() types.FlowEventAggregator {
 	am.mux.Lock()
 	defer am.mux.Unlock()
 
-	now := am.nowFunc()
+	now := time.Now()
 	toret := AggregatingMemory{WindowStart: am.WindowStart, WindowEnd: now, Memory: Memory{events: am.events}, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
 
 	am.events = make(map[uuid.UUID]*types.Event)
@@ -158,7 +152,3 @@ func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event {
 
 	return slices.Collect(maps.Values(aggregated)) // could return an iterator instead here
 }
-
-func defaultNowFunc() time.Time {
-	return time.Now()
-}

client/internal/peer/conn.go

@@ -30,11 +30,6 @@ import (
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
 
-// wgTimeoutEscalationThreshold is the number of consecutive WireGuard
-// handshake timeouts after which the rosenpass state for the peer is
-// considered desynced and gets reset.
-const wgTimeoutEscalationThreshold = 3
-
 // MetricsRecorder is an interface for recording peer connection metrics
 type MetricsRecorder interface {
 	RecordConnectionStages(
@@ -123,9 +118,6 @@ type Conn struct {
 	wgWatcher       *WGWatcher
 	wgWatcherWg     sync.WaitGroup
 	wgWatcherCancel context.CancelFunc
-	// wgTimeouts counts consecutive WireGuard handshake timeouts without a
-	// successful handshake in between. Guarded by mu.
-	wgTimeouts int
 
 	// used to store the remote Rosenpass key for Relayed connection in case of connection update from ice
 	rosenpassRemoteKey []byte
@@ -691,29 +683,6 @@ func (conn *Conn) onWGDisconnected() {
 	default:
 		conn.Log.Debugf("No active connection to close on WG timeout")
 	}
-
-	conn.escalateWGTimeoutLocked()
-}
-
-// escalateWGTimeoutLocked resets the peer's rosenpass state after repeated
-// handshake timeouts. With rosenpass enabled, persistent timeouts mean the
-// preshared keys have desynced; the renewal exchange runs over the dead
-// tunnel and cannot resync them. Reporting the peer disconnected drops its
-// rosenpass state, so the next connection configuration programs the
-// rendezvous key and the tunnel can bootstrap again. Callers must hold mu.
-func (conn *Conn) escalateWGTimeoutLocked() {
-	if conn.config.RosenpassConfig.PubKey == nil {
-		return
-	}
-
-	conn.wgTimeouts++
-	if conn.wgTimeouts < wgTimeoutEscalationThreshold || conn.onDisconnected == nil {
-		return
-	}
-	conn.wgTimeouts = 0
-
-	conn.Log.Warnf("%d consecutive WireGuard handshake timeouts, resetting rosenpass state for peer", wgTimeoutEscalationThreshold)
-	conn.onDisconnected(conn.config.WgConfig.RemoteKey)
 }
 
 func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []byte, updateTime time.Time) {
@@ -843,7 +812,7 @@ func (conn *Conn) enableWgWatcherIfNeeded(enabledTime time.Time) {
 	conn.wgWatcherWg.Add(1)
 	go func() {
 		defer conn.wgWatcherWg.Done()
-		conn.wgWatcher.EnableWgWatcher(wgWatcherCtx, enabledTime, conn.onWGDisconnected, conn.onWGHandshakeSuccess, conn.onWGCheckSuccess)
+		conn.wgWatcher.EnableWgWatcher(wgWatcherCtx, enabledTime, conn.onWGDisconnected, conn.onWGHandshakeSuccess)
 	}()
 }
 
@@ -923,15 +892,6 @@ func (conn *Conn) onWGHandshakeSuccess(when time.Time) {
 	conn.recordConnectionMetrics()
 }
 
-// onWGCheckSuccess is called for every watcher check that observed a fresh
-// handshake, including handshakes of connections that were already up when
-// the watcher started.
-func (conn *Conn) onWGCheckSuccess() {
-	conn.mu.Lock()
-	conn.wgTimeouts = 0
-	conn.mu.Unlock()
-}
-
 // recordConnectionMetrics records connection stage timestamps as metrics
 func (conn *Conn) recordConnectionMetrics() {
 	if conn.metricsRecorder == nil {

client/internal/peer/conn_test.go

@@ -7,7 +7,6 @@ import (
 	"testing"
 	"time"
 
-	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 
 	"github.com/netbirdio/netbird/client/iface"
@@ -305,84 +304,3 @@ func TestConn_presharedKey_RosenpassManaged(t *testing.T) {
 		t.Fatalf("expected non-nil presharedKey before Rosenpass manages PSK")
 	}
 }
-
-func newWGTimeoutTestConn(rosenpassEnabled bool, disconnected *[]string) *Conn {
-	cfg := ConnConfig{
-		Key:      "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
-		LocalKey: "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
-		WgConfig: WgConfig{RemoteKey: "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU="},
-	}
-	if rosenpassEnabled {
-		cfg.RosenpassConfig = RosenpassConfig{PubKey: []byte("dummykey")}
-	}
-
-	conn := &Conn{
-		ctx:           context.Background(),
-		config:        cfg,
-		Log:           log.WithField("peer", cfg.Key),
-		metricsStages: &MetricsStages{},
-	}
-	conn.SetOnDisconnected(func(remotePeer string) {
-		*disconnected = append(*disconnected, remotePeer)
-	})
-	return conn
-}
-
-// TestConn_onWGDisconnected_EscalatesToRosenpassReset: repeated handshake
-// timeouts with rosenpass enabled mean the preshared keys have desynced. The
-// renewal exchange runs over the dead tunnel and cannot resync them, so after
-// wgTimeoutEscalationThreshold consecutive timeouts the conn must report the
-// peer disconnected, dropping its rosenpass state so the next configuration
-// programs the rendezvous key.
-func TestConn_onWGDisconnected_EscalatesToRosenpassReset(t *testing.T) {
-	var disconnected []string
-	conn := newWGTimeoutTestConn(true, &disconnected)
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected()
-	}
-	assert.Empty(t, disconnected, "escalation must not fire below the threshold")
-
-	conn.onWGDisconnected()
-	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
-		"reaching the threshold must report the peer disconnected once")
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected()
-	}
-	assert.Len(t, disconnected, 1, "escalation must restart counting after firing")
-
-	conn.onWGDisconnected()
-	assert.Len(t, disconnected, 2, "continued timeouts must escalate again")
-}
-
-// TestConn_onWGDisconnected_CheckSuccessResetsEscalation: a successful
-// handshake between timeouts means the tunnel recovered; the counter must
-// start over.
-func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
-	var disconnected []string
-	conn := newWGTimeoutTestConn(true, &disconnected)
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected()
-	}
-	conn.onWGCheckSuccess()
-
-	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected()
-	}
-	assert.Empty(t, disconnected, "handshake success must reset the timeout count")
-}
-
-// TestConn_onWGDisconnected_NoEscalationWithoutRosenpass: without rosenpass
-// there is no per-peer key state to reset; repeated timeouts must not report
-// disconnects.
-func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
-	var disconnected []string
-	conn := newWGTimeoutTestConn(false, &disconnected)
-
-	for i := 0; i < wgTimeoutEscalationThreshold*3; i++ {
-		conn.onWGDisconnected()
-	}
-	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
-}

client/internal/peer/status.go

@@ -1335,15 +1335,6 @@ func (d *Status) SubscribeToEvents() *EventSubscription {
 	}
 }
 
-// HasEventSubscribers reports whether any client is currently subscribed
-// to the daemon's SystemEvent stream. Used by the VNC approval broker to
-// fail closed when no UI is connected to prompt the user.
-func (d *Status) HasEventSubscribers() bool {
-	d.eventMux.Lock()
-	defer d.eventMux.Unlock()
-	return len(d.eventStreams) > 0
-}
-
 // UnsubscribeFromEvents removes an event subscription
 func (d *Status) UnsubscribeFromEvents(sub *EventSubscription) {
 	if sub == nil {

client/internal/peer/wg_watcher.go

@@ -71,11 +71,9 @@ func (w *WGWatcher) PrepareInitialHandshake() (ok bool) {
 
 // EnableWgWatcher runs the WireGuard watcher loop using the handshake baseline captured by
 // PrepareInitialHandshake. The watcher runs until ctx is cancelled. Caller is responsible
-// for context lifecycle management. onHandshakeSuccessFn is called only for the first
-// handshake observed by this run, onCheckSuccessFn for every check that observed a fresh
-// handshake, including the first.
-func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func()) {
-	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, onCheckSuccessFn, enabledTime, w.initialHandshake)
+// for context lifecycle management.
+func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time)) {
+	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, enabledTime, w.initialHandshake)
 
 	w.muEnabled.Lock()
 	w.enabled = false
@@ -92,7 +90,7 @@ func (w *WGWatcher) Reset() {
 }
 
 // wgStateCheck help to check the state of the WireGuard handshake and relay connection
-func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func(), enabledTime time.Time, initialHandshake time.Time) {
+func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), enabledTime time.Time, initialHandshake time.Time) {
 	w.log.Infof("WireGuard watcher started")
 
 	timer := time.NewTimer(wgHandshakeOvertime)
@@ -119,10 +117,6 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 				}
 			}
 
-			if onCheckSuccessFn != nil && ctx.Err() == nil {
-				onCheckSuccessFn()
-			}
-
 			lastHandshake = *handshake
 
 			resetTime := time.Until(handshake.Add(checkPeriod))

client/internal/peer/wg_watcher_test.go

@@ -24,72 +24,6 @@ func (m *MocWgIface) disconnect() {
 	m.stop = true
 }
 
-type mockHandshakeStats struct {
-	mu        sync.Mutex
-	handshake time.Time
-}
-
-func (m *mockHandshakeStats) GetStats() (map[string]configurer.WGStats, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return map[string]configurer.WGStats{"": {LastHandshake: m.handshake}}, nil
-}
-
-func (m *mockHandshakeStats) advance() {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.handshake = time.Now()
-}
-
-// TestWGWatcher_CheckSuccessCallback: onCheckSuccessFn must fire for a fresh
-// handshake even when the watcher started with an existing handshake baseline,
-// the case where onHandshakeSuccessFn stays silent.
-func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
-	// checkPeriod bounds how stale a handshake may be before the watcher treats it
-	// as a suspended-machine timeout. The first check fires after wgHandshakeOvertime,
-	// so keep checkPeriod well above any scheduling jitter to avoid a false timeout
-	// converting the expected success into a disconnect on a loaded runner.
-	checkPeriod = 1 * time.Minute
-	wgHandshakeOvertime = 1 * time.Second
-
-	mlog := log.WithField("peer", "tet")
-	// Use an old baseline so advance() yields a strictly newer handshake even on
-	// platforms with coarse clock resolution (Windows), where two time.Now() calls
-	// microseconds apart can return the same instant and read as a timed-out handshake.
-	stats := &mockHandshakeStats{handshake: time.Now().Add(-time.Hour)}
-	watcher := NewWGWatcher(mlog, stats, "", newStateDump("peer", mlog, &Status{}))
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	require.True(t, watcher.PrepareInitialHandshake())
-
-	firstHandshake := make(chan struct{}, 1)
-	checkSuccess := make(chan struct{}, 1)
-	go watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
-		firstHandshake <- struct{}{}
-	}, func() {
-		select {
-		case checkSuccess <- struct{}{}:
-		default:
-		}
-	})
-
-	stats.advance()
-
-	select {
-	case <-checkSuccess:
-	case <-time.After(10 * time.Second):
-		t.Errorf("timeout waiting for check success callback")
-	}
-
-	select {
-	case <-firstHandshake:
-		t.Errorf("first-handshake callback must not fire for a non-zero baseline")
-	default:
-	}
-}
-
 func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 	checkPeriod = 5 * time.Second
 	wgHandshakeOvertime = 1 * time.Second
@@ -110,7 +44,7 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 		onDisconnected <- struct{}{}
 	}, func(when time.Time) {
 		mlog.Infof("onHandshakeSuccess: %v", when)
-	}, nil)
+	})
 
 	// wait for initial reading
 	time.Sleep(2 * time.Second)
@@ -139,7 +73,7 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {}, nil)
+		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {})
 	}()
 	cancel()
 
@@ -155,7 +89,7 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
 		onDisconnected <- struct{}{}
-	}, func(when time.Time) {}, nil)
+	}, func(when time.Time) {})
 
 	time.Sleep(2 * time.Second)
 	mocWgIface.disconnect()

client/internal/profilemanager/config.go

@@ -70,8 +70,6 @@ type ConfigInput struct {
 	StateFilePath                 string
 	PreSharedKey                  *string
 	ServerSSHAllowed              *bool
-	ServerVNCAllowed              *bool
-	DisableVNCApproval            *bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -125,8 +123,6 @@ type Config struct {
 	RosenpassEnabled              bool
 	RosenpassPermissive           bool
 	ServerSSHAllowed              *bool
-	ServerVNCAllowed              *bool
-	DisableVNCApproval            *bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -458,33 +454,6 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.ServerVNCAllowed != nil {
-		if config.ServerVNCAllowed == nil || *input.ServerVNCAllowed != *config.ServerVNCAllowed {
-			if *input.ServerVNCAllowed {
-				log.Infof("enabling VNC server")
-			} else {
-				log.Infof("disabling VNC server")
-			}
-			config.ServerVNCAllowed = input.ServerVNCAllowed
-			updated = true
-		}
-	} else if config.ServerVNCAllowed == nil {
-		config.ServerVNCAllowed = util.False()
-		updated = true
-	}
-
-	if input.DisableVNCApproval != nil {
-		if config.DisableVNCApproval == nil || *input.DisableVNCApproval != *config.DisableVNCApproval {
-			if *input.DisableVNCApproval {
-				log.Infof("disabling VNC connection approval prompt")
-			} else {
-				log.Infof("enabling VNC connection approval prompt")
-			}
-			config.DisableVNCApproval = input.DisableVNCApproval
-			updated = true
-		}
-	}
-
 	if input.EnableSSHRoot != nil && (config.EnableSSHRoot == nil || *input.EnableSSHRoot != *config.EnableSSHRoot) {
 		if *input.EnableSSHRoot {
 			log.Infof("enabling SSH root login")

client/internal/profilemanager/service.go

@@ -11,7 +11,6 @@ import (
 	"runtime"
 	"sort"
 	"strings"
-	"syscall"
 
 	log "github.com/sirupsen/logrus"
 
@@ -440,11 +439,7 @@ func (s *ServiceManager) GetStatePath() string {
 
 	activeProf, err := s.GetActiveProfileState()
 	if err != nil {
-		if errors.Is(err, syscall.ENOSYS) {
-			log.Debugf("active profile state unavailable on this platform: %v", err)
-		} else {
-			log.Warnf("failed to get active profile state: %v", err)
-		}
+		log.Warnf("failed to get active profile state: %v", err)
 		return defaultStatePath
 	}
 

client/internal/rosenpass/manager.go

@@ -39,7 +39,6 @@ type rpServer interface {
 
 type Manager struct {
 	ifaceName    string
-	localWgKey   wgtypes.Key
 	spk          []byte
 	ssk          []byte
 	rpKeyHash    string
@@ -52,9 +51,8 @@ type Manager struct {
 	wgIface      PresharedKeySetter
 }
 
-// NewManager creates a new Rosenpass manager. localWgKey is the local
-// WireGuard public key, used to derive the per-peer rendezvous key.
-func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtypes.Key) (*Manager, error) {
+// NewManager creates a new Rosenpass manager
+func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string) (*Manager, error) {
 	public, secret, err := rp.GenerateKeyPair()
 	if err != nil {
 		return nil, err
@@ -64,7 +62,6 @@ func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtype
 	log.Tracef("generated new rosenpass key pair with public key %s", rpKeyHash)
 	return &Manager{
 		ifaceName:    wgIfaceName,
-		localWgKey:   localWgKey,
 		rpKeyHash:    rpKeyHash,
 		spk:          public,
 		ssk:          secret,
@@ -76,7 +73,7 @@ func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtype
 		// nil receiver in addPeer -> m.rpWgHandler.AddPeer. generateConfig will
 		// replace it with a fresh handler on each Run() to clear stale peer
 		// state from previous engine sessions.
-		rpWgHandler: NewNetbirdHandler((*[32]byte)(preSharedKey), localWgKey),
+		rpWgHandler: NewNetbirdHandler(),
 		lock:        sync.Mutex{},
 	}, nil
 }
@@ -164,7 +161,7 @@ func (m *Manager) generateConfig() (rp.Config, error) {
 	cfg.Peers = []rp.PeerConfig{}
 
 	m.lock.Lock()
-	m.rpWgHandler = NewNetbirdHandler(m.preSharedKey, m.localWgKey)
+	m.rpWgHandler = NewNetbirdHandler()
 	if m.wgIface != nil {
 		m.rpWgHandler.SetInterface(m.wgIface)
 	}

client/internal/rosenpass/manager_test.go

@@ -85,7 +85,7 @@ func newTestManager(spkFirstByte byte, mock *mockServer) *Manager {
 		ssk:         make([]byte, 32),
 		rpKeyHash:   "test-hash",
 		rpPeerIDs:   make(map[string]*rp.PeerID),
-		rpWgHandler: NewNetbirdHandler(nil, wgtypes.Key{0x01}),
+		rpWgHandler: NewNetbirdHandler(),
 		server:      mock,
 	}
 }
@@ -255,7 +255,7 @@ func TestAddPeer_NilServer_ReturnsErrorNoCrash(t *testing.T) {
 // issue #4341 cannot occur in the window between NewManager and Run().
 func TestNewManager_PreInitializesHandler(t *testing.T) {
 	psk := wgtypes.Key{}
-	m, err := NewManager(&psk, "wt0", wgtypes.Key{0x01})
+	m, err := NewManager(&psk, "wt0")
 	require.NoError(t, err)
 	require.NotNil(t, m.rpWgHandler, "rpWgHandler must be initialized in NewManager")
 }
@@ -329,10 +329,10 @@ func TestIsPresharedKeyInitialized_AddedButNotHandshaken_ReturnsFalse(t *testing
 	require.False(t, m.IsPresharedKeyInitialized(wgKey))
 }
 
-// --- NetbirdHandler.applyKey ----------------------------------------------
+// --- NetbirdHandler.outputKey ----------------------------------------------
 
-func TestHandler_ApplyKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -348,8 +348,8 @@ func TestHandler_ApplyKey_FirstCallUsesUpdateOnlyFalse(t *testing.T) {
 	require.Equal(t, wgKey.String(), iface.calls[0].peerKey)
 }
 
-func TestHandler_ApplyKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -364,8 +364,8 @@ func TestHandler_ApplyKey_SubsequentCallsUseUpdateOnlyTrue(t *testing.T) {
 	require.True(t, iface.calls[1].updateOnly, "subsequent rotations must use updateOnly=true")
 }
 
-func TestHandler_ApplyKey_NilInterface_NoCrashNoCall(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_NilInterface_NoCrashNoCall(t *testing.T) {
+	h := NewNetbirdHandler()
 	// no SetInterface — iface remains nil
 	pid := rp.PeerID{0x03}
 	h.AddPeer(pid, "wt0", rp.Key(wgtypes.Key{}))
@@ -374,8 +374,8 @@ func TestHandler_ApplyKey_NilInterface_NoCrashNoCall(t *testing.T) {
 	h.HandshakeCompleted(pid, rp.Key{})
 }
 
-func TestHandler_ApplyKey_UnknownPeer_NoCall(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+func TestHandler_OutputKey_UnknownPeer_NoCall(t *testing.T) {
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -384,7 +384,7 @@ func TestHandler_ApplyKey_UnknownPeer_NoCall(t *testing.T) {
 }
 
 func TestHandler_RemovePeer_ClearsInitializedState(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+	h := NewNetbirdHandler()
 	iface := &mockIface{}
 	h.SetInterface(iface)
 
@@ -398,7 +398,7 @@ func TestHandler_RemovePeer_ClearsInitializedState(t *testing.T) {
 }
 
 func TestHandler_SetInterfaceAfterAddPeer_StillReceivesKey(t *testing.T) {
-	h := NewNetbirdHandler(nil, wgtypes.Key{0x01})
+	h := NewNetbirdHandler()
 	pid := rp.PeerID{0x05}
 	wgKey := wgtypes.Key{0xEE}
 	h.AddPeer(pid, "wt0", rp.Key(wgKey))

client/internal/rosenpass/netbird_handler.go

@@ -18,34 +18,19 @@ type PresharedKeySetter interface {
 type wireGuardPeer struct {
 	Interface string
 	PublicKey rp.Key
-	// initialized is true once a completed exchange has set a
-	// Rosenpass-managed PSK for this peer.
-	initialized bool
-	// chainKey is the key output by the last completed exchange, advanced by
-	// one ratchet step on expiry. Nil until the first exchange completes and
-	// after the peer has fallen back to the rendezvous key.
-	chainKey *wgtypes.Key
-	// expiries counts failed renewals since the last completed exchange.
-	expiries int
 }
 
 type NetbirdHandler struct {
-	mu    sync.Mutex
-	iface PresharedKeySetter
-	// preSharedKey is the account-level preshared key, used as the rendezvous
-	// key when set. Nil means the deterministic seed key is used instead.
-	preSharedKey *[32]byte
-	// localWgKey is the local WireGuard public key, one of the two inputs to
-	// the deterministic seed key.
-	localWgKey wgtypes.Key
-	peers      map[rp.PeerID]*wireGuardPeer
+	mu               sync.Mutex
+	iface            PresharedKeySetter
+	peers            map[rp.PeerID]wireGuardPeer
+	initializedPeers map[rp.PeerID]bool
 }
 
-func NewNetbirdHandler(preSharedKey *[32]byte, localWgKey wgtypes.Key) *NetbirdHandler {
+func NewNetbirdHandler() *NetbirdHandler {
 	return &NetbirdHandler{
-		preSharedKey: preSharedKey,
-		localWgKey:   localWgKey,
-		peers:        map[rp.PeerID]*wireGuardPeer{},
+		peers:            map[rp.PeerID]wireGuardPeer{},
+		initializedPeers: map[rp.PeerID]bool{},
 	}
 }
 
@@ -57,16 +42,10 @@ func (h *NetbirdHandler) SetInterface(iface PresharedKeySetter) {
 	h.iface = iface
 }
 
-// AddPeer registers a peer with the handler. Re-adding a known peer (every
-// reconnection does) keeps its key recovery state.
 func (h *NetbirdHandler) AddPeer(pid rp.PeerID, intf string, pk rp.Key) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	if existing, ok := h.peers[pid]; ok && existing.PublicKey == pk {
-		existing.Interface = intf
-		return
-	}
-	h.peers[pid] = &wireGuardPeer{
+	h.peers[pid] = wireGuardPeer{
 		Interface: intf,
 		PublicKey: pk,
 	}
@@ -76,6 +55,7 @@ func (h *NetbirdHandler) RemovePeer(pid rp.PeerID) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	delete(h.peers, pid)
+	delete(h.initializedPeers, pid)
 }
 
 // IsPeerInitialized returns true if Rosenpass has completed a handshake
@@ -83,120 +63,50 @@ func (h *NetbirdHandler) RemovePeer(pid rp.PeerID) {
 func (h *NetbirdHandler) IsPeerInitialized(pid rp.PeerID) bool {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	peer, ok := h.peers[pid]
-	return ok && peer.initialized
+	return h.initializedPeers[pid]
 }
 
-// HandshakeCompleted programs the freshly exchanged output key and resets the
-// peer's key recovery state.
 func (h *NetbirdHandler) HandshakeCompleted(pid rp.PeerID, key rp.Key) {
-	psk := wgtypes.Key(key)
-
-	h.mu.Lock()
-	defer h.mu.Unlock()
-
-	peer, ok := h.peers[pid]
-	if !ok {
-		return
-	}
-	if peer.expiries > 0 {
-		log.Infof("rosenpass exchange completed for peer %s after %d expired renewals", wgtypes.Key(peer.PublicKey), peer.expiries)
-	}
-	// chainKey tracks the shared exchange output regardless of the local write
-	// outcome, so both ends still converge on the next expiry.
-	peer.chainKey = &psk
-	peer.expiries = 0
-	if !h.applyKeyLocked(pid, psk, peer.initialized) {
-		return
-	}
-	peer.initialized = true
+	h.outputKey(rp.KeyOutputReasonStale, pid, key)
 }
 
-// HandshakeExpired replaces the expired key. The renewal exchange runs over
-// the tunnel keyed by the PSK itself, so the replacement must be derivable on
-// both ends without communication: the first expiry ratchets the last shared
-// key forward, repeated expiries (and expiries without a completed exchange)
-// fall back to the rendezvous key and drop the peer out of the initialized
-// state so connection reconfigurations reprogram the rendezvous key as well.
 func (h *NetbirdHandler) HandshakeExpired(pid rp.PeerID) {
+	key, _ := rp.GeneratePresharedKey()
+	h.outputKey(rp.KeyOutputReasonStale, pid, key)
+}
+
+func (h *NetbirdHandler) outputKey(_ rp.KeyOutputReason, pid rp.PeerID, psk rp.Key) {
 	h.mu.Lock()
-	defer h.mu.Unlock()
+	iface := h.iface
+	wg, ok := h.peers[pid]
+	isInitialized := h.initializedPeers[pid]
+	h.mu.Unlock()
 
-	peer, ok := h.peers[pid]
-	if !ok {
-		return
-	}
-
-	peer.expiries++
-
-	var psk wgtypes.Key
-	if peer.chainKey != nil && peer.expiries == 1 {
-		log.Infof("rosenpass key for peer %s expired without renewal, advancing to ratcheted key", wgtypes.Key(peer.PublicKey))
-		psk = RatchetKey(*peer.chainKey)
-		peer.chainKey = &psk
-	} else {
-		rendezvous, err := h.rendezvousKey(peer)
-		if err != nil {
-			// Fail closed: without a rendezvous key the expired key must
-			// still be rotated out, even if the replacement is unusable.
-			log.Errorf("failed to derive rendezvous key, replacing expired key with a random one: %v", err)
-			h.applyRandomKeyLocked(pid)
-			return
-		}
-		log.Warnf("rosenpass key for peer %s expired %d times without renewal, falling back to the rendezvous key", wgtypes.Key(peer.PublicKey), peer.expiries)
-		psk = rendezvous
-		peer.chainKey = nil
-		peer.initialized = false
-	}
-
-	h.applyKeyLocked(pid, psk, true)
-}
-
-// rendezvousKey returns the key both ends converge on without communication:
-// the account-level preshared key when configured, the deterministic seed key
-// otherwise. It mirrors the key that peer connections program when Rosenpass
-// does not manage the peer yet.
-func (h *NetbirdHandler) rendezvousKey(peer *wireGuardPeer) (wgtypes.Key, error) {
-	if h.preSharedKey != nil {
-		return *h.preSharedKey, nil
-	}
-
-	seed, err := DeterministicSeedKey(h.localWgKey.String(), wgtypes.Key(peer.PublicKey).String())
-	if err != nil {
-		return wgtypes.Key{}, err
-	}
-	return *seed, nil
-}
-
-// applyKeyLocked writes the preshared key for the peer to the WireGuard
-// interface and reports whether the write succeeded. Callers must hold h.mu
-// for the whole state-mutation-plus-write so that a concurrent completion and
-// expiry cannot reorder their writes relative to the in-memory chain key.
-func (h *NetbirdHandler) applyKeyLocked(pid rp.PeerID, psk wgtypes.Key, updateOnly bool) bool {
-	peer, ok := h.peers[pid]
-	if !ok {
-		return false
-	}
-
-	if h.iface == nil {
+	if iface == nil {
 		log.Warn("rosenpass: interface not set, cannot update preshared key")
-		return false
-	}
-
-	peerKey := wgtypes.Key(peer.PublicKey).String()
-	if err := h.iface.SetPresharedKey(peerKey, psk, updateOnly); err != nil {
-		log.Errorf("Failed to apply rosenpass key: %v", err)
-		return false
-	}
-
-	return true
-}
-
-func (h *NetbirdHandler) applyRandomKeyLocked(pid rp.PeerID) {
-	key, err := rp.GeneratePresharedKey()
-	if err != nil {
-		log.Errorf("failed to generate random preshared key: %v", err)
 		return
 	}
-	h.applyKeyLocked(pid, wgtypes.Key(key), true)
+
+	if !ok {
+		return
+	}
+
+	peerKey := wgtypes.Key(wg.PublicKey).String()
+	pskKey := wgtypes.Key(psk)
+
+	// Use updateOnly=true for later rotations (peer already has Rosenpass PSK)
+	// Use updateOnly=false for first rotation (peer has original/empty PSK)
+	if err := iface.SetPresharedKey(peerKey, pskKey, isInitialized); err != nil {
+		log.Errorf("Failed to apply rosenpass key: %v", err)
+		return
+	}
+
+	// Mark peer as isInitialized after the successful first rotation
+	if !isInitialized {
+		h.mu.Lock()
+		if _, exists := h.peers[pid]; exists {
+			h.initializedPeers[pid] = true
+		}
+		h.mu.Unlock()
+	}
 }

client/internal/rosenpass/netbird_handler_test.go

@@ -1,250 +0,0 @@
-package rosenpass
-
-import (
-	"testing"
-
-	rp "cunicu.li/go-rosenpass"
-	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-// handlerTestLink wires two NetbirdHandlers as the two ends of a single
-// tunnel: handler A manages the rosenpass peer B and vice versa, the way two
-// NetBird clients see each other.
-type handlerTestLink struct {
-	handlerA, handlerB *NetbirdHandler
-	ifaceA, ifaceB     *mockIface
-	pidA, pidB         rp.PeerID
-	wgKeyA, wgKeyB     wgtypes.Key
-}
-
-func newHandlerTestLink(t *testing.T, preSharedKey *[32]byte) *handlerTestLink {
-	t.Helper()
-
-	link := &handlerTestLink{
-		ifaceA: &mockIface{},
-		ifaceB: &mockIface{},
-	}
-	link.pidA[0] = 0xaa
-	link.pidB[0] = 0xbb
-	link.wgKeyA[31] = 1
-	link.wgKeyB[31] = 2
-
-	link.handlerA = NewNetbirdHandler(preSharedKey, link.wgKeyA)
-	link.handlerB = NewNetbirdHandler(preSharedKey, link.wgKeyB)
-
-	link.handlerA.SetInterface(link.ifaceA)
-	link.handlerB.SetInterface(link.ifaceB)
-
-	link.handlerA.AddPeer(link.pidB, "wt0", rp.Key(link.wgKeyB))
-	link.handlerB.AddPeer(link.pidA, "wt0", rp.Key(link.wgKeyA))
-
-	return link
-}
-
-// complete simulates a completed rosenpass exchange: both ends derive the
-// same output key.
-func (l *handlerTestLink) complete(osk rp.Key) {
-	l.handlerA.HandshakeCompleted(l.pidB, osk)
-	l.handlerB.HandshakeCompleted(l.pidA, osk)
-}
-
-// expire simulates a failed key renewal on both ends.
-func (l *handlerTestLink) expire() {
-	l.handlerA.HandshakeExpired(l.pidB)
-	l.handlerB.HandshakeExpired(l.pidA)
-}
-
-func lastPSK(t *testing.T, m *mockIface) wgtypes.Key {
-	t.Helper()
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	require.NotEmpty(t, m.calls, "expected at least one SetPresharedKey call")
-	return m.calls[len(m.calls)-1].psk
-}
-
-func TestHandshakeCompleted_SetsKeyAndInitializes(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	require.Equal(t, wgtypes.Key(osk), lastPSK(t, link.ifaceA), "completed exchange must program the osk")
-	require.False(t, link.ifaceA.calls[0].updateOnly, "first rotation must not be update-only")
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB), "peer must be initialized after first completed exchange")
-
-	link.complete(osk)
-	require.True(t, link.ifaceA.calls[1].updateOnly, "later rotations must be update-only")
-}
-
-// TestHandshakeExpired_BothSidesConverge encodes the core recovery invariant:
-// rosenpass renewals run over the tunnel that the PSK itself keys, so when a
-// renewal fails on both ends, both ends must fall back to the same key or the
-// tunnel can never handshake again.
-func TestHandshakeExpired_BothSidesConverge(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	keyA := lastPSK(t, link.ifaceA)
-	keyB := lastPSK(t, link.ifaceB)
-	require.NotEqual(t, wgtypes.Key(osk), keyA, "expired key must be rotated out")
-	require.Equal(t, keyA, keyB, "both ends must converge on the same key after expiry")
-
-	link.expire()
-	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
-		"both ends must still converge after repeated expiries")
-}
-
-// TestHandshakeExpired_ExpiryWithoutCompletionConverges covers the bootstrap
-// case: the initial exchange never completed (the tunnel ran on the rendezvous
-// key), so an expiry must not replace the working key with an unrecoverable
-// one on either end.
-func TestHandshakeExpired_ExpiryWithoutCompletionConverges(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	link.expire()
-	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
-		"both ends must converge when the exchange never completed")
-}
-
-// TestHandshakeExpired_RepeatedExpiryClearsInitialized: once renewals keep
-// failing, the peer must drop out of the initialized state so the next
-// connection reconfiguration reprograms the rendezvous key instead of
-// preserving a poisoned rosenpass-managed key.
-func TestHandshakeExpired_RepeatedExpiryClearsInitialized(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	require.False(t, link.handlerA.IsPeerInitialized(link.pidB),
-		"repeated expiries must clear the initialized state")
-	require.False(t, link.handlerB.IsPeerInitialized(link.pidA),
-		"repeated expiries must clear the initialized state")
-}
-
-// TestHandshakeCompleted_AfterExpiryRecovers: a completed exchange after a
-// desync must fully reset the recovery state.
-func TestHandshakeCompleted_AfterExpiryRecovers(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk1, osk2 rp.Key
-	osk1[0] = 1
-	osk2[0] = 2
-
-	link.complete(osk1)
-	link.expire()
-	link.expire()
-
-	link.complete(osk2)
-	require.Equal(t, wgtypes.Key(osk2), lastPSK(t, link.ifaceA), "new exchange must program the fresh osk")
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB), "peer must be initialized again after recovery")
-
-	link.expire()
-	require.Equal(t, lastPSK(t, link.ifaceA), lastPSK(t, link.ifaceB),
-		"recovered link must converge again on the next expiry")
-	require.NotEqual(t, wgtypes.Key(osk2), lastPSK(t, link.ifaceA), "expired key must be rotated out")
-}
-
-// TestHandshakeExpired_FirstExpiryRatchetsLastKey: the first expiry must
-// derive the replacement from the last shared key, so an attacker who only
-// blocks the renewal exchange gains nothing over the previous key.
-func TestHandshakeExpired_FirstExpiryRatchetsLastKey(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	require.Equal(t, RatchetKey(wgtypes.Key(osk)), lastPSK(t, link.ifaceA),
-		"first expiry must program the ratcheted key")
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB),
-		"ratchet step must keep the peer initialized so reconfigurations preserve the key")
-}
-
-// TestHandshakeExpired_RepeatedExpiryFallsBackToSeed: once the ratchet key
-// also fails, both ends must land on the same key that peer connections
-// program for uninitialized peers, so a reconnect completes the recovery.
-func TestHandshakeExpired_RepeatedExpiryFallsBackToSeed(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	seed, err := DeterministicSeedKey(link.wgKeyA.String(), link.wgKeyB.String())
-	require.NoError(t, err)
-	require.Equal(t, *seed, lastPSK(t, link.ifaceA), "repeated expiry must fall back to the seed key")
-	require.Equal(t, *seed, lastPSK(t, link.ifaceB), "repeated expiry must fall back to the seed key")
-}
-
-// TestHandshakeExpired_ConfiguredPSKUsedAsRendezvous: with an account-level
-// preshared key configured, the fallback must be that key, matching what peer
-// connections program for uninitialized peers.
-func TestHandshakeExpired_ConfiguredPSKUsedAsRendezvous(t *testing.T) {
-	psk := &[32]byte{0x77}
-	link := newHandlerTestLink(t, psk)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	require.Equal(t, wgtypes.Key(*psk), lastPSK(t, link.ifaceA),
-		"fallback must be the configured preshared key")
-	require.Equal(t, wgtypes.Key(*psk), lastPSK(t, link.ifaceB),
-		"fallback must be the configured preshared key on both ends")
-}
-
-// TestHandshakeExpired_ExpiryWritesAreUpdateOnly: expiry replacements must
-// never create a WireGuard peer that connection management has removed.
-func TestHandshakeExpired_ExpiryWritesAreUpdateOnly(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-
-	link.expire()
-	link.expire()
-
-	for _, call := range link.ifaceA.calls[1:] {
-		require.True(t, call.updateOnly, "expiry writes must be update-only")
-	}
-}
-
-// TestAddPeer_ReAddKeepsRecoveryState: reconnections re-add the peer on every
-// OnConnected; that must not reset the expiry chain state.
-func TestAddPeer_ReAddKeepsRecoveryState(t *testing.T) {
-	link := newHandlerTestLink(t, nil)
-
-	var osk rp.Key
-	osk[0] = 0x42
-	link.complete(osk)
-	link.expire()
-
-	link.handlerA.AddPeer(link.pidB, "wt0", rp.Key(link.wgKeyB))
-	require.True(t, link.handlerA.IsPeerInitialized(link.pidB),
-		"re-adding a known peer must keep its state")
-
-	link.expire()
-	seed, err := DeterministicSeedKey(link.wgKeyA.String(), link.wgKeyB.String())
-	require.NoError(t, err)
-	require.Equal(t, *seed, lastPSK(t, link.ifaceA),
-		"second expiry after re-add must continue to the seed fallback")
-}

client/internal/rosenpass/seed.go

@@ -1,28 +1,11 @@
 package rosenpass
 
 import (
-	"crypto/sha256"
 	"fmt"
 
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
-// ratchetLabel domain-separates the expiry ratchet from other uses of the
-// rosenpass output key.
-const ratchetLabel = "netbird-rosenpass-expiry-ratchet"
-
-// RatchetKey derives the successor preshared key from the previous Rosenpass
-// output key. When a key expires without a completed renewal, both peers
-// advance their last shared key by one ratchet step: the expired key is
-// rotated out while both ends still converge on an identical, non-public
-// replacement without communicating.
-func RatchetKey(prev wgtypes.Key) wgtypes.Key {
-	input := make([]byte, 0, len(ratchetLabel)+len(prev))
-	input = append(input, ratchetLabel...)
-	input = append(input, prev[:]...)
-	return sha256.Sum256(input)
-}
-
 // DeterministicSeedKey derives a 32-byte WireGuard preshared key from a pair
 // of peer public keys. Both peers, given the same key pair, produce the same
 // output regardless of which side runs the function: the inputs are ordered

client/internal/routemanager/manager.go

@@ -12,7 +12,6 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
-	"syscall"
 	"time"
 
 	"github.com/google/uuid"
@@ -265,11 +264,7 @@ func (m *DefaultManager) initSelector() *routeselector.RouteSelector {
 
 	// restore selector state if it exists
 	if err := m.stateManager.LoadState(state); err != nil {
-		if errors.Is(err, syscall.ENOSYS) {
-			log.Debugf("route selector state unavailable on this platform: %v", err)
-		} else {
-			log.Warnf("failed to load state: %v", err)
-		}
+		log.Warnf("failed to load state: %v", err)
 		return routeselector.NewRouteSelector()
 	}
 

client/internal/statemanager/manager.go

@@ -74,14 +74,6 @@ func New(filePath string) *Manager {
 	}
 }
 
-// FilePath returns the path of the underlying state file.
-func (m *Manager) FilePath() string {
-	if m == nil {
-		return ""
-	}
-	return m.filePath
-}
-
 // Start starts the state manager periodic save routine
 func (m *Manager) Start() {
 	if m == nil {

client/proto/daemon.proto

@@ -152,14 +152,6 @@ service DaemonService {
   // ExposeService exposes a local port via the NetBird reverse proxy
   rpc ExposeService(ExposeServiceRequest) returns (stream ExposeServiceEvent) {}
 
-  // RespondApproval delivers the user's accept/deny decision for a
-  // pending user-approval prompt. The daemon pushes the prompt as a
-  // SystemEvent with category APPROVAL and metadata key "request_id";
-  // the UI calls this RPC with the same request_id to unblock whichever
-  // subsystem (VNC, SSH, ...) is waiting. The "kind" metadata key tells
-  // the UI which subsystem the prompt belongs to.
-  rpc RespondApproval(RespondApprovalRequest) returns (RespondApprovalResponse) {}
-
   // WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
   // only cares whether the daemon implements it: an Unimplemented response
   // means the daemon predates this UI and is too old to drive it.
@@ -250,10 +242,6 @@ message LoginRequest {
   optional bool disableSSHAuth = 38;
   optional int32 sshJWTCacheTTL = 39;
   optional bool disable_ipv6 = 40;
-
-  optional bool serverVNCAllowed = 41;
-
-  optional bool disableVNCApproval = 42;
 }
 
 message LoginResponse {
@@ -374,16 +362,12 @@ message GetConfigResponse {
 
   bool disable_ipv6 = 27;
 
-  bool serverVNCAllowed = 28;
-
-  bool disableVNCApproval = 29;
-
   // mDMManagedFields lists the names of configuration keys whose value is
   // currently enforced by an MDM policy. Names match mdm.Key* constants
   // (e.g. "managementURL", "disableClientRoutes"). UI/CLI clients should
   // render the corresponding inputs as read-only and display a "managed
   // by MDM" indicator.
-  repeated string mDMManagedFields = 30;
+  repeated string mDMManagedFields = 28;
 }
 
 // PeerState contains the latest state of a peer
@@ -468,25 +452,6 @@ message SSHServerState {
   repeated SSHSessionInfo sessions = 2;
 }
 
-// VNCSessionInfo contains information about an active VNC session
-message VNCSessionInfo {
-  string remoteAddress = 1;
-  string mode = 2;
-  string username = 3;
-  // userID is the Noise-verified session identity (hashed user ID from
-  // the ACL session-key entry), empty when auth is disabled.
-  string userID = 4;
-  // initiator is the human-readable display name of the dashboard user
-  // who minted the SessionPubKey, when known.
-  string initiator = 5;
-}
-
-// VNCServerState contains the latest state of the VNC server
-message VNCServerState {
-  bool enabled = 1;
-  repeated VNCSessionInfo sessions = 2;
-}
-
 // FullStatus contains the full state held by the Status instance
 message FullStatus {
   ManagementState managementState = 1;
@@ -507,7 +472,6 @@ message FullStatus {
   // on it to know when to re-fetch ListNetworks via the push stream, instead
   // of polling on every status snapshot.
   uint64 networksRevision = 11;
-  VNCServerState vncServerState = 12;
 }
 
 // Networks
@@ -703,7 +667,6 @@ message SystemEvent {
     AUTHENTICATION = 2;
     CONNECTIVITY = 3;
     SYSTEM = 4;
-    APPROVAL = 5;
   }
 
   string id = 1;
@@ -794,10 +757,6 @@ message SetConfigRequest {
   optional bool disableSSHAuth = 33;
   optional int32 sshJWTCacheTTL = 34;
   optional bool disable_ipv6 = 35;
-
-  optional bool serverVNCAllowed = 36;
-
-  optional bool disableVNCApproval = 37;
 }
 
 message SetConfigResponse{}
@@ -1087,18 +1046,3 @@ message StartBundleCaptureRequest {
 message StartBundleCaptureResponse {}
 message StopBundleCaptureRequest {}
 message StopBundleCaptureResponse {}
-
-message RespondApprovalRequest {
-  // request_id matches the SystemEvent metadata key emitted by the daemon
-  // when a subsystem awaits user approval for an inbound connection.
-  string request_id = 1;
-  // accept is true if the user approved the request, false if they
-  // denied it. A missing or unknown request_id is treated as a no-op.
-  bool accept = 2;
-  // view_only signals that the user granted the connection but withheld
-  // input control. Only meaningful when accept is true; ignored when
-  // accept is false.
-  bool view_only = 3;
-}
-
-message RespondApprovalResponse {}

client/proto/daemon_grpc.pb.go

@@ -64,7 +64,6 @@ const (
 	DaemonService_StopCPUProfile_FullMethodName             = "/daemon.DaemonService/StopCPUProfile"
 	DaemonService_GetInstallerResult_FullMethodName         = "/daemon.DaemonService/GetInstallerResult"
 	DaemonService_ExposeService_FullMethodName              = "/daemon.DaemonService/ExposeService"
-	DaemonService_RespondApproval_FullMethodName            = "/daemon.DaemonService/RespondApproval"
 	DaemonService_WailsUIReady_FullMethodName               = "/daemon.DaemonService/WailsUIReady"
 )
 
@@ -168,13 +167,6 @@ type DaemonServiceClient interface {
 	GetInstallerResult(ctx context.Context, in *InstallerResultRequest, opts ...grpc.CallOption) (*InstallerResultResponse, error)
 	// ExposeService exposes a local port via the NetBird reverse proxy
 	ExposeService(ctx context.Context, in *ExposeServiceRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExposeServiceEvent], error)
-	// RespondApproval delivers the user's accept/deny decision for a
-	// pending user-approval prompt. The daemon pushes the prompt as a
-	// SystemEvent with category APPROVAL and metadata key "request_id";
-	// the UI calls this RPC with the same request_id to unblock whichever
-	// subsystem (VNC, SSH, ...) is waiting. The "kind" metadata key tells
-	// the UI which subsystem the prompt belongs to.
-	RespondApproval(ctx context.Context, in *RespondApprovalRequest, opts ...grpc.CallOption) (*RespondApprovalResponse, error)
 	// WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
 	// only cares whether the daemon implements it: an Unimplemented response
 	// means the daemon predates this UI and is too old to drive it.
@@ -675,16 +667,6 @@ func (c *daemonServiceClient) ExposeService(ctx context.Context, in *ExposeServi
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type DaemonService_ExposeServiceClient = grpc.ServerStreamingClient[ExposeServiceEvent]
 
-func (c *daemonServiceClient) RespondApproval(ctx context.Context, in *RespondApprovalRequest, opts ...grpc.CallOption) (*RespondApprovalResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(RespondApprovalResponse)
-	err := c.cc.Invoke(ctx, DaemonService_RespondApproval_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *daemonServiceClient) WailsUIReady(ctx context.Context, in *WailsUIReadyRequest, opts ...grpc.CallOption) (*WailsUIReadyResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(WailsUIReadyResponse)
@@ -795,13 +777,6 @@ type DaemonServiceServer interface {
 	GetInstallerResult(context.Context, *InstallerResultRequest) (*InstallerResultResponse, error)
 	// ExposeService exposes a local port via the NetBird reverse proxy
 	ExposeService(*ExposeServiceRequest, grpc.ServerStreamingServer[ExposeServiceEvent]) error
-	// RespondApproval delivers the user's accept/deny decision for a
-	// pending user-approval prompt. The daemon pushes the prompt as a
-	// SystemEvent with category APPROVAL and metadata key "request_id";
-	// the UI calls this RPC with the same request_id to unblock whichever
-	// subsystem (VNC, SSH, ...) is waiting. The "kind" metadata key tells
-	// the UI which subsystem the prompt belongs to.
-	RespondApproval(context.Context, *RespondApprovalRequest) (*RespondApprovalResponse, error)
 	// WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
 	// only cares whether the daemon implements it: an Unimplemented response
 	// means the daemon predates this UI and is too old to drive it.
@@ -951,9 +926,6 @@ func (UnimplementedDaemonServiceServer) GetInstallerResult(context.Context, *Ins
 func (UnimplementedDaemonServiceServer) ExposeService(*ExposeServiceRequest, grpc.ServerStreamingServer[ExposeServiceEvent]) error {
 	return status.Error(codes.Unimplemented, "method ExposeService not implemented")
 }
-func (UnimplementedDaemonServiceServer) RespondApproval(context.Context, *RespondApprovalRequest) (*RespondApprovalResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method RespondApproval not implemented")
-}
 func (UnimplementedDaemonServiceServer) WailsUIReady(context.Context, *WailsUIReadyRequest) (*WailsUIReadyResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method WailsUIReady not implemented")
 }
@@ -1760,24 +1732,6 @@ func _DaemonService_ExposeService_Handler(srv interface{}, stream grpc.ServerStr
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type DaemonService_ExposeServiceServer = grpc.ServerStreamingServer[ExposeServiceEvent]
 
-func _DaemonService_RespondApproval_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(RespondApprovalRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(DaemonServiceServer).RespondApproval(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: DaemonService_RespondApproval_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DaemonServiceServer).RespondApproval(ctx, req.(*RespondApprovalRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _DaemonService_WailsUIReady_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(WailsUIReadyRequest)
 	if err := dec(in); err != nil {
@@ -1967,10 +1921,6 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetInstallerResult",
 			Handler:    _DaemonService_GetInstallerResult_Handler,
 		},
-		{
-			MethodName: "RespondApproval",
-			Handler:    _DaemonService_RespondApproval_Handler,
-		},
 		{
 			MethodName: "WailsUIReady",
 			Handler:    _DaemonService_WailsUIReady_Handler,

client/server/capture.go

@@ -111,7 +111,7 @@ func (s *Server) StartCapture(req *proto.StartCaptureRequest, stream proto.Daemo
 		return status.Errorf(codes.Internal, "create capture session: %v", err)
 	}
 
-	engine, err := s.claimCapture(sess, func() { pw.Close() })
+	engine, err := s.claimCapture(sess)
 	if err != nil {
 		sess.Stop()
 		pw.Close()
@@ -190,7 +190,10 @@ func (s *Server) StartBundleCapture(_ context.Context, req *proto.StartBundleCap
 
 	s.stopBundleCaptureLocked()
 	s.cleanupBundleCapture()
-	s.evictActiveCaptureLocked()
+
+	if s.activeCapture != nil {
+		return nil, status.Error(codes.FailedPrecondition, "another capture is already running")
+	}
 
 	engine, err := s.getCaptureEngineLocked()
 	if err != nil {
@@ -301,58 +304,29 @@ func (s *Server) cleanupBundleCapture() {
 	s.bundleCapture = nil
 }
 
-// claimCapture reserves the engine's capture slot for sess. If another
-// capture is already running it is evicted: a previous streaming session
-// whose gRPC client died and never freed the slot stays stuck otherwise,
-// and a bundle capture is just informational state.
-func (s *Server) claimCapture(sess *capture.Session, cancel func()) (*internal.Engine, error) {
+// claimCapture reserves the engine's capture slot for sess. Returns
+// FailedPrecondition if another capture is already active.
+func (s *Server) claimCapture(sess *capture.Session) (*internal.Engine, error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	s.evictActiveCaptureLocked()
+	if s.activeCapture != nil {
+		return nil, status.Error(codes.FailedPrecondition, "another capture is already running")
+	}
 	engine, err := s.getCaptureEngineLocked()
 	if err != nil {
 		return nil, err
 	}
 	s.activeCapture = sess
-	s.activeCaptureCancel = cancel
 	return engine, nil
 }
 
-// evictActiveCaptureLocked tears down whatever capture currently owns
-// the engine slot so a fresh claim can succeed. Caller must hold mutex.
-func (s *Server) evictActiveCaptureLocked() {
-	if s.activeCapture == nil {
-		return
-	}
-	if s.bundleCapture != nil && s.bundleCapture.sess == s.activeCapture {
-		log.Infof("evicting running bundle capture to start a new capture")
-		s.stopBundleCaptureLocked()
-		return
-	}
-	log.Infof("evicting previous streaming capture to start a new one")
-	prev := s.activeCapture
-	cancel := s.activeCaptureCancel
-	if engine, err := s.getCaptureEngineLocked(); err == nil {
-		if err := engine.SetCapture(nil); err != nil {
-			log.Debugf("clear previous capture: %v", err)
-		}
-	}
-	s.activeCapture = nil
-	s.activeCaptureCancel = nil
-	prev.Stop()
-	if cancel != nil {
-		cancel()
-	}
-}
-
 // releaseCapture clears the active-capture owner if it still matches sess.
 func (s *Server) releaseCapture(sess *capture.Session) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 	if s.activeCapture == sess {
 		s.activeCapture = nil
-		s.activeCaptureCancel = nil
 	}
 }
 
@@ -367,7 +341,6 @@ func (s *Server) clearCaptureIfOwner(sess *capture.Session, engine *internal.Eng
 		log.Debugf("clear capture: %v", err)
 	}
 	s.activeCapture = nil
-	s.activeCaptureCancel = nil
 }
 
 func (s *Server) getCaptureEngineLocked() (*internal.Engine, error) {

client/server/server.go

@@ -113,12 +113,8 @@ type Server struct {
 	captureEnabled         bool
 	bundleCapture          *bundleCapture
 	// activeCapture is the session currently installed on the engine; guarded by s.mutex.
-	activeCapture *capture.Session
-	// activeCaptureCancel tears down the streaming pipe/cancel for the
-	// active streaming capture so eviction unblocks the StartCapture RPC
-	// handler. Nil for bundle captures (they own their own context).
-	activeCaptureCancel func()
-	networksDisabled    bool
+	activeCapture    *capture.Session
+	networksDisabled bool
 
 	sleepHandler *sleephandler.SleepHandler
 
@@ -496,8 +492,6 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 	config.RosenpassPermissive = msg.RosenpassPermissive
 	config.DisableAutoConnect = msg.DisableAutoConnect
 	config.ServerSSHAllowed = msg.ServerSSHAllowed
-	config.ServerVNCAllowed = msg.ServerVNCAllowed
-	config.DisableVNCApproval = msg.DisableVNCApproval
 	config.NetworkMonitor = msg.NetworkMonitor
 	config.DisableClientRoutes = msg.DisableClientRoutes
 	config.DisableServerRoutes = msg.DisableServerRoutes
@@ -834,7 +828,6 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 		return nil, err
 	}
 
-	log.Infof("SSO login flow finished, returning success to caller")
 	return &proto.WaitSSOLoginResponse{
 		Email: tokenInfo.Email,
 	}, nil
@@ -842,7 +835,6 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 
 // Up starts engine work in the daemon.
 func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpResponse, error) {
-	log.Infof("up request received")
 	s.mutex.Lock()
 	// clientRunning is the daemon-intent flag (set by previous Up/Start, cleared
 	// by Down). connectionGoroutineRunning() reports whether the previous retry-loop
@@ -1443,7 +1435,6 @@ func (s *Server) buildStatusResponse(ctx context.Context, msg *proto.StatusReque
 		pbFullStatus := fullStatus.ToProto()
 		pbFullStatus.Events = s.statusRecorder.GetEventHistory()
 		pbFullStatus.SshServerState = s.getSSHServerState()
-		pbFullStatus.VncServerState = s.getVNCServerState()
 		pbFullStatus.NetworksRevision = s.statusRecorder.GetNetworksRevision()
 		statusResponse.FullStatus = pbFullStatus
 	}
@@ -1484,38 +1475,6 @@ func (s *Server) getSSHServerState() *proto.SSHServerState {
 	return sshServerState
 }
 
-// getVNCServerState retrieves the current VNC server state.
-func (s *Server) getVNCServerState() *proto.VNCServerState {
-	s.mutex.Lock()
-	connectClient := s.connectClient
-	s.mutex.Unlock()
-
-	if connectClient == nil {
-		return nil
-	}
-
-	engine := connectClient.Engine()
-	if engine == nil {
-		return nil
-	}
-
-	enabled, sessions := engine.GetVNCServerStatus()
-	pbSessions := make([]*proto.VNCSessionInfo, 0, len(sessions))
-	for _, sess := range sessions {
-		pbSessions = append(pbSessions, &proto.VNCSessionInfo{
-			RemoteAddress: sess.RemoteAddress,
-			Mode:          sess.Mode,
-			Username:      sess.Username,
-			UserID:        sess.UserID,
-			Initiator:     sess.Initiator,
-		})
-	}
-	return &proto.VNCServerState{
-		Enabled:  enabled,
-		Sessions: pbSessions,
-	}
-}
-
 // GetPeerSSHHostKey retrieves SSH host key for a specific peer
 func (s *Server) GetPeerSSHHostKey(
 	ctx context.Context,
@@ -1901,27 +1860,6 @@ func (s *Server) ExposeService(req *proto.ExposeServiceRequest, srv proto.Daemon
 	return nil
 }
 
-// RespondApproval relays the user's accept/deny decision for a pending
-// approval prompt to the engine's broker. Unknown or already-resolved
-// request_ids are silently no-op'd so a slow UI cannot deny a prompt the
-// user already handled (or that already timed out).
-func (s *Server) RespondApproval(_ context.Context, msg *proto.RespondApprovalRequest) (*proto.RespondApprovalResponse, error) {
-	s.mutex.Lock()
-	connectClient := s.connectClient
-	s.mutex.Unlock()
-	if connectClient == nil {
-		return nil, gstatus.Errorf(codes.FailedPrecondition, "client not initialized")
-	}
-	engine := connectClient.Engine()
-	if engine == nil {
-		return nil, gstatus.Errorf(codes.FailedPrecondition, "engine not running")
-	}
-	if !engine.RespondApproval(msg.GetRequestId(), msg.GetAccept(), msg.GetViewOnly()) {
-		log.Debugf("approval response for unknown request_id %s", msg.GetRequestId())
-	}
-	return &proto.RespondApprovalResponse{}, nil
-}
-
 func isUnixRunningDesktop() bool {
 	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
 		return false
@@ -2029,8 +1967,6 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		Mtu:                           int64(cfg.MTU),
 		DisableAutoConnect:            cfg.DisableAutoConnect,
 		ServerSSHAllowed:              *cfg.ServerSSHAllowed,
-		ServerVNCAllowed:              cfg.ServerVNCAllowed != nil && *cfg.ServerVNCAllowed,
-		DisableVNCApproval:            cfg.DisableVNCApproval != nil && *cfg.DisableVNCApproval,
 		RosenpassEnabled:              cfg.RosenpassEnabled,
 		RosenpassPermissive:           cfg.RosenpassPermissive,
 		BlockInbound:                  cfg.BlockInbound,

client/server/setconfig_test.go

@@ -58,8 +58,6 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	rosenpassEnabled := true
 	rosenpassPermissive := true
 	serverSSHAllowed := true
-	serverVNCAllowed := true
-	disableVNCApproval := true
 	interfaceName := "utun100"
 	wireguardPort := int64(51820)
 	preSharedKey := "test-psk"
@@ -84,8 +82,6 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 		RosenpassEnabled:     &rosenpassEnabled,
 		RosenpassPermissive:  &rosenpassPermissive,
 		ServerSSHAllowed:     &serverSSHAllowed,
-		ServerVNCAllowed:     &serverVNCAllowed,
-		DisableVNCApproval:   &disableVNCApproval,
 		InterfaceName:        &interfaceName,
 		WireguardPort:        &wireguardPort,
 		OptionalPreSharedKey: &preSharedKey,
@@ -129,10 +125,6 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	require.Equal(t, rosenpassPermissive, cfg.RosenpassPermissive)
 	require.NotNil(t, cfg.ServerSSHAllowed)
 	require.Equal(t, serverSSHAllowed, *cfg.ServerSSHAllowed)
-	require.NotNil(t, cfg.ServerVNCAllowed)
-	require.Equal(t, serverVNCAllowed, *cfg.ServerVNCAllowed)
-	require.NotNil(t, cfg.DisableVNCApproval)
-	require.Equal(t, disableVNCApproval, *cfg.DisableVNCApproval)
 	require.Equal(t, interfaceName, cfg.WgIface)
 	require.Equal(t, int(wireguardPort), cfg.WgPort)
 	require.Equal(t, preSharedKey, cfg.PreSharedKey)
@@ -185,8 +177,6 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 		"RosenpassEnabled":              true,
 		"RosenpassPermissive":           true,
 		"ServerSSHAllowed":              true,
-		"ServerVNCAllowed":              true,
-		"DisableVNCApproval":            true,
 		"InterfaceName":                 true,
 		"WireguardPort":                 true,
 		"OptionalPreSharedKey":          true,
@@ -247,8 +237,6 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 		"enable-rosenpass":                  "RosenpassEnabled",
 		"rosenpass-permissive":              "RosenpassPermissive",
 		"allow-server-ssh":                  "ServerSSHAllowed",
-		"allow-server-vnc":                  "ServerVNCAllowed",
-		"disable-vnc-approval":              "DisableVNCApproval",
 		"interface-name":                    "InterfaceName",
 		"wireguard-port":                    "WireguardPort",
 		"preshared-key":                     "OptionalPreSharedKey",

client/ssh/auth/auth.go

@@ -1,4 +1,4 @@
-package sessionauth
+package auth
 
 import (
 	"errors"
@@ -15,8 +15,6 @@ const (
 	DefaultUserIDClaim = "sub"
 	// Wildcard is a special user ID that matches all users
 	Wildcard = "*"
-	// sessionPubKeyLen is the size of an X25519 static public key in bytes.
-	sessionPubKeyLen = 32
 )
 
 var (
@@ -24,7 +22,6 @@ var (
 	ErrUserNotAuthorized     = errors.New("user is not authorized to access this peer")
 	ErrNoMachineUserMapping  = errors.New("no authorization mapping for OS user")
 	ErrUserNotMappedToOSUser = errors.New("user is not authorized to login as OS user")
-	ErrSessionKeyNotKnown    = errors.New("session pubkey not registered")
 )
 
 // Authorizer handles SSH fine-grained access control authorization
@@ -38,17 +35,6 @@ type Authorizer struct {
 	// machineUsers maps OS login usernames to lists of authorized user indexes
 	machineUsers map[string][]uint32
 
-	// sessionPubKeys maps an X25519 static public key (as map-safe
-	// array) to the hashed user identity that key authenticates as.
-	// Populated from management's temporary-access flow; used by VNC to
-	// authenticate via the Noise_IK handshake.
-	sessionPubKeys map[[sessionPubKeyLen]byte]sshuserhash.UserIDHash
-	// sessionDisplayNames mirrors sessionPubKeys with the optional
-	// human-readable display name management associated with each
-	// session key. Used by the per-connection UI approval prompt; not
-	// consulted by any authorization decision.
-	sessionDisplayNames map[[sessionPubKeyLen]byte]string
-
 	// mu protects the list of users
 	mu sync.RWMutex
 }
@@ -64,29 +50,13 @@ type Config struct {
 	// MachineUsers maps OS login usernames to indexes in AuthorizedUsers
 	// If a user wants to login as a specific OS user, their index must be in the corresponding list
 	MachineUsers map[string][]uint32
-
-	// SessionPubKeys binds ephemeral X25519 static public keys to hashed
-	// user identities. Populated for VNC; ignored on the SSH side.
-	SessionPubKeys []SessionPubKey
-}
-
-// SessionPubKey is a single ephemeral-key entry: the 32-byte X25519
-// static public key plus the hashed user identity it authenticates as,
-// optionally plus a human-readable display name for the UI approval
-// prompt to identify the requester.
-type SessionPubKey struct {
-	PubKey      []byte
-	UserIDHash  sshuserhash.UserIDHash
-	DisplayName string
 }
 
 // NewAuthorizer creates a new SSH authorizer with empty configuration
 func NewAuthorizer() *Authorizer {
 	a := &Authorizer{
-		userIDClaim:         DefaultUserIDClaim,
-		machineUsers:        make(map[string][]uint32),
-		sessionPubKeys:      make(map[[sessionPubKeyLen]byte]sshuserhash.UserIDHash),
-		sessionDisplayNames: make(map[[sessionPubKeyLen]byte]string),
+		userIDClaim:  DefaultUserIDClaim,
+		machineUsers: make(map[string][]uint32),
 	}
 
 	return a
@@ -102,8 +72,6 @@ func (a *Authorizer) Update(config *Config) {
 		a.userIDClaim = DefaultUserIDClaim
 		a.authorizedUsers = []sshuserhash.UserIDHash{}
 		a.machineUsers = make(map[string][]uint32)
-		a.sessionPubKeys = make(map[[sessionPubKeyLen]byte]sshuserhash.UserIDHash)
-		a.sessionDisplayNames = make(map[[sessionPubKeyLen]byte]string)
 		log.Info("SSH authorization cleared")
 		return
 	}
@@ -126,35 +94,8 @@ func (a *Authorizer) Update(config *Config) {
 	}
 	a.machineUsers = machineUsers
 
-	sessionPubKeys := make(map[[sessionPubKeyLen]byte]sshuserhash.UserIDHash, len(config.SessionPubKeys))
-	sessionDisplayNames := make(map[[sessionPubKeyLen]byte]string, len(config.SessionPubKeys))
-	conflicted := make(map[[sessionPubKeyLen]byte]struct{})
-	for _, e := range config.SessionPubKeys {
-		if len(e.PubKey) != sessionPubKeyLen {
-			continue
-		}
-		var key [sessionPubKeyLen]byte
-		copy(key[:], e.PubKey)
-		if _, bad := conflicted[key]; bad {
-			continue
-		}
-		if existing, ok := sessionPubKeys[key]; ok && existing != e.UserIDHash {
-			log.Warnf("SSH auth: session pubkey bound to conflicting user hashes; dropping binding")
-			delete(sessionPubKeys, key)
-			delete(sessionDisplayNames, key)
-			conflicted[key] = struct{}{}
-			continue
-		}
-		sessionPubKeys[key] = e.UserIDHash
-		if e.DisplayName != "" {
-			sessionDisplayNames[key] = e.DisplayName
-		}
-	}
-	a.sessionPubKeys = sessionPubKeys
-	a.sessionDisplayNames = sessionDisplayNames
-
-	log.Debugf("SSH auth: updated with %d authorized users, %d machine user mappings, %d session pubkeys",
-		len(config.AuthorizedUsers), len(machineUsers), len(sessionPubKeys))
+	log.Debugf("SSH auth: updated with %d authorized users, %d machine user mappings",
+		len(config.AuthorizedUsers), len(machineUsers))
 }
 
 // Authorize validates if a user is authorized to login as the specified OS user.
@@ -214,54 +155,6 @@ func (a *Authorizer) GetUserIDClaim() string {
 	return a.userIDClaim
 }
 
-// LookupSessionKey resolves a Noise-verified static public key to the
-// hashed user identity registered with it. Fails closed when the key is
-// unknown.
-func (a *Authorizer) LookupSessionKey(pubKey []byte) (sshuserhash.UserIDHash, error) {
-	var zero sshuserhash.UserIDHash
-	if len(pubKey) != sessionPubKeyLen {
-		return zero, fmt.Errorf("session pubkey wrong length: %d", len(pubKey))
-	}
-	var key [sessionPubKeyLen]byte
-	copy(key[:], pubKey)
-	a.mu.RLock()
-	hash, ok := a.sessionPubKeys[key]
-	a.mu.RUnlock()
-	if !ok {
-		return zero, ErrSessionKeyNotKnown
-	}
-	return hash, nil
-}
-
-// LookupSessionDisplayName returns the human-readable display name
-// management associated with a session pubkey, or empty string when none
-// is recorded. Never returns an error: a missing/unknown key reports as
-// "" and the caller falls back to other identifiers.
-func (a *Authorizer) LookupSessionDisplayName(pubKey []byte) string {
-	if len(pubKey) != sessionPubKeyLen {
-		return ""
-	}
-	var key [sessionPubKeyLen]byte
-	copy(key[:], pubKey)
-	a.mu.RLock()
-	name := a.sessionDisplayNames[key]
-	a.mu.RUnlock()
-	return name
-}
-
-// AuthorizeOSUserBySessionKey resolves the OS-user mapping for a session
-// key. Mirrors Authorize but skips the JWT-hash step since the key has
-// already been verified and the user identity hash is in hand.
-func (a *Authorizer) AuthorizeOSUserBySessionKey(userIDHash sshuserhash.UserIDHash, osUsername string) (string, error) {
-	a.mu.RLock()
-	defer a.mu.RUnlock()
-	userIndex, found := a.findUserIndex(userIDHash)
-	if !found {
-		return "", fmt.Errorf("session user (hash: %s) not in authorized list for OS user %q: %w", userIDHash, osUsername, ErrUserNotAuthorized)
-	}
-	return a.checkMachineUserMapping("session", osUsername, userIndex)
-}
-
 // findUserIndex finds the index of a hashed user ID in the authorized users list
 // Returns the index and true if found, 0 and false if not found
 func (a *Authorizer) findUserIndex(hashedUserID sshuserhash.UserIDHash) (int, bool) {

client/ssh/auth/auth_test.go

@@ -1,7 +1,6 @@
-package sessionauth
+package auth
 
 import (
-	"errors"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -611,61 +610,3 @@ func TestAuthorizer_Wildcard_WithPartialIndexes_AllowsAllUsers(t *testing.T) {
 	assert.Error(t, err)
 	assert.ErrorIs(t, err, ErrUserNotAuthorized, "unauthorized user should be denied")
 }
-
-func TestAuthorizer_LookupSessionKey_Valid(t *testing.T) {
-	pub := bytesRepeat(0x11, sessionPubKeyLen)
-	userHash, err := sshauth.HashUserID("alice")
-	require.NoError(t, err)
-
-	a := NewAuthorizer()
-	a.Update(&Config{
-		AuthorizedUsers: []sshauth.UserIDHash{userHash},
-		MachineUsers:    map[string][]uint32{Wildcard: {0}},
-		SessionPubKeys:  []SessionPubKey{{PubKey: pub, UserIDHash: userHash}},
-	})
-
-	got, err := a.LookupSessionKey(pub)
-	require.NoError(t, err)
-	assert.Equal(t, userHash, got)
-
-	if _, err := a.AuthorizeOSUserBySessionKey(got, "alice"); err != nil {
-		t.Fatalf("AuthorizeOSUserBySessionKey: %v", err)
-	}
-}
-
-func TestAuthorizer_LookupSessionKey_UnknownPub(t *testing.T) {
-	a := NewAuthorizer()
-	a.Update(&Config{})
-	_, err := a.LookupSessionKey(bytesRepeat(0x22, sessionPubKeyLen))
-	require.ErrorIs(t, err, ErrSessionKeyNotKnown)
-}
-
-func TestAuthorizer_LookupSessionKey_WrongLength(t *testing.T) {
-	a := NewAuthorizer()
-	_, err := a.LookupSessionKey([]byte("short"))
-	require.Error(t, err)
-}
-
-func TestAuthorizer_LookupSessionKey_UpdateClears(t *testing.T) {
-	pub := bytesRepeat(0x33, sessionPubKeyLen)
-	userHash, err := sshauth.HashUserID("alice")
-	require.NoError(t, err)
-
-	a := NewAuthorizer()
-	a.Update(&Config{SessionPubKeys: []SessionPubKey{{PubKey: pub, UserIDHash: userHash}}})
-	if _, err := a.LookupSessionKey(pub); err != nil {
-		t.Fatalf("setup lookup: %v", err)
-	}
-	a.Update(&Config{})
-	if _, err := a.LookupSessionKey(pub); !errors.Is(err, ErrSessionKeyNotKnown) {
-		t.Fatalf("expected ErrSessionKeyNotKnown, got %v", err)
-	}
-}
-
-func bytesRepeat(b byte, n int) []byte {
-	out := make([]byte, n)
-	for i := range out {
-		out[i] = b
-	}
-	return out
-}

client/ssh/proxy/proxy_privileged_test.go

@@ -26,10 +26,10 @@ import (
 	cryptossh "golang.org/x/crypto/ssh"
 
 	nbssh "github.com/netbirdio/netbird/client/ssh"
+	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
 	"github.com/netbirdio/netbird/client/ssh/server"
 	"github.com/netbirdio/netbird/client/ssh/testutil"
 	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
-	sshauth "github.com/netbirdio/netbird/shared/sessionauth"
 	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
 )
 

client/ssh/server/jwt_test.go

@@ -23,11 +23,11 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbssh "github.com/netbirdio/netbird/client/ssh"
+	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
 	"github.com/netbirdio/netbird/client/ssh/client"
 	"github.com/netbirdio/netbird/client/ssh/detection"
 	"github.com/netbirdio/netbird/client/ssh/testutil"
 	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
-	sshauth "github.com/netbirdio/netbird/shared/sessionauth"
 	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
 )
 

client/ssh/server/server.go

@@ -23,10 +23,10 @@ import (
 	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
 	"github.com/netbirdio/netbird/client/ssh/detection"
 	"github.com/netbirdio/netbird/shared/auth"
 	"github.com/netbirdio/netbird/shared/auth/jwt"
-	sshauth "github.com/netbirdio/netbird/shared/sessionauth"
 	"github.com/netbirdio/netbird/util/netrelay"
 	"github.com/netbirdio/netbird/version"
 )
@@ -197,14 +197,6 @@ type Config struct {
 
 	// HostKey is the SSH server host key in PEM format
 	HostKeyPEM []byte
-
-	// NetstackNet, when non-nil, makes the SSH server listen via the
-	// supplied userspace network stack instead of an OS socket.
-	NetstackNet *netstack.Net
-
-	// NetworkValidation, when non-zero, restricts inbound connections to
-	// peers inside the NetBird overlay defined by this WireGuard address.
-	NetworkValidation wgaddr.Address
 }
 
 // SessionInfo contains information about an active SSH session
@@ -216,15 +208,12 @@ type SessionInfo struct {
 	PortForwards  []string
 }
 
-// New creates an SSH server instance from the supplied Config. Fields are
-// read once at construction; mutating Config afterwards has no effect.
-// JWT == nil disables JWT authentication.
+// New creates an SSH server instance with the provided host key and optional JWT configuration
+// If jwtConfig is nil, JWT authentication is disabled
 func New(config *Config) *Server {
 	s := &Server{
 		mu:                     sync.RWMutex{},
 		hostKeyPEM:             config.HostKeyPEM,
-		netstackNet:            config.NetstackNet,
-		wgAddress:              config.NetworkValidation,
 		sessions:               make(map[sessionKey]*sessionState),
 		pendingAuthJWT:         make(map[authKey]string),
 		remoteForwardListeners: make(map[forwardKey]net.Listener),
@@ -445,6 +434,20 @@ func (s *Server) buildSessionInfo(state *sessionState) SessionInfo {
 	return info
 }
 
+// SetNetstackNet sets the netstack network for userspace networking
+func (s *Server) SetNetstackNet(net *netstack.Net) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.netstackNet = net
+}
+
+// SetNetworkValidation configures network-based connection filtering
+func (s *Server) SetNetworkValidation(addr wgaddr.Address) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.wgAddress = addr
+}
+
 // UpdateSSHAuth updates the SSH fine-grained access control configuration
 // This should be called when network map updates include new SSH auth configuration
 func (s *Server) UpdateSSHAuth(config *sshauth.Config) {

client/status/status.go

@@ -136,19 +136,6 @@ type SSHServerStateOutput struct {
 	Sessions []SSHSessionOutput `json:"sessions" yaml:"sessions"`
 }
 
-type VNCSessionOutput struct {
-	RemoteAddress string `json:"remoteAddress" yaml:"remoteAddress"`
-	Mode          string `json:"mode" yaml:"mode"`
-	Username      string `json:"username,omitempty" yaml:"username,omitempty"`
-	UserID        string `json:"userID,omitempty" yaml:"userID,omitempty"`
-	Initiator     string `json:"initiator,omitempty" yaml:"initiator,omitempty"`
-}
-
-type VNCServerStateOutput struct {
-	Enabled  bool               `json:"enabled" yaml:"enabled"`
-	Sessions []VNCSessionOutput `json:"sessions" yaml:"sessions"`
-}
-
 type OutputOverview struct {
 	Peers                   PeersStateOutput           `json:"peers" yaml:"peers"`
 	CliVersion              string                     `json:"cliVersion" yaml:"cliVersion"`
@@ -172,7 +159,6 @@ type OutputOverview struct {
 	LazyConnectionEnabled   bool                       `json:"lazyConnectionEnabled" yaml:"lazyConnectionEnabled"`
 	ProfileName             string                     `json:"profileName" yaml:"profileName"`
 	SSHServerState          SSHServerStateOutput       `json:"sshServer" yaml:"sshServer"`
-	VNCServerState          VNCServerStateOutput       `json:"vncServer" yaml:"vncServer"`
 	// SessionExpiresAt is the absolute UTC instant at which the peer's SSO
 	// session expires. nil when the peer is not SSO-tracked or login
 	// expiration is disabled. Pointer (rather than zero-value time.Time) so
@@ -198,7 +184,6 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 
 	relayOverview := mapRelays(pbFullStatus.GetRelays())
 	sshServerOverview := mapSSHServer(pbFullStatus.GetSshServerState())
-	vncServerOverview := mapVNCServer(pbFullStatus.GetVncServerState())
 	peersOverview := mapPeers(pbFullStatus.GetPeers(), opts.StatusFilter, opts.PrefixNamesFilter, opts.PrefixNamesFilterMap, opts.IPsFilter, opts.ConnectionTypeFilter)
 
 	overview := OutputOverview{
@@ -224,7 +209,6 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 		LazyConnectionEnabled:   pbFullStatus.GetLazyConnectionEnabled(),
 		ProfileName:             opts.ProfileName,
 		SSHServerState:          sshServerOverview,
-		VNCServerState:          vncServerOverview,
 	}
 	if !opts.SessionExpiresAt.IsZero() {
 		t := opts.SessionExpiresAt
@@ -310,26 +294,6 @@ func mapSSHServer(sshServerState *proto.SSHServerState) SSHServerStateOutput {
 	}
 }
 
-func mapVNCServer(state *proto.VNCServerState) VNCServerStateOutput {
-	if state == nil {
-		return VNCServerStateOutput{Sessions: []VNCSessionOutput{}}
-	}
-	sessions := make([]VNCSessionOutput, 0, len(state.GetSessions()))
-	for _, sess := range state.GetSessions() {
-		sessions = append(sessions, VNCSessionOutput{
-			RemoteAddress: sess.GetRemoteAddress(),
-			Mode:          sess.GetMode(),
-			Username:      sess.GetUsername(),
-			UserID:        sess.GetUserID(),
-			Initiator:     sess.GetInitiator(),
-		})
-	}
-	return VNCServerStateOutput{
-		Enabled:  state.GetEnabled(),
-		Sessions: sessions,
-	}
-}
-
 func mapPeers(
 	peers []*proto.PeerState,
 	statusFilter string,
@@ -594,26 +558,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		}
 	}
 
-	vncServerStatus := "Disabled"
-	if o.VNCServerState.Enabled {
-		vncSessionCount := len(o.VNCServerState.Sessions)
-		if vncSessionCount > 0 {
-			sessionWord := "session"
-			if vncSessionCount > 1 {
-				sessionWord = "sessions"
-			}
-			vncServerStatus = fmt.Sprintf("Enabled (%d active %s)", vncSessionCount, sessionWord)
-		} else {
-			vncServerStatus = "Enabled"
-		}
-
-		if showSSHSessions && vncSessionCount > 0 {
-			for _, sess := range o.VNCServerState.Sessions {
-				vncServerStatus += "\n  " + formatVNCSessionLine(sess)
-			}
-		}
-	}
-
 	peersCountString := fmt.Sprintf("%d/%d Connected", o.Peers.Connected, o.Peers.Total)
 
 	var sessionExpiryString string
@@ -669,7 +613,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 			"Quantum resistance: %s\n"+
 			"Lazy connection: %s\n"+
 			"SSH Server: %s\n"+
-			"VNC Server: %s\n"+
 			"Networks: %s\n"+
 			"%s"+
 			"%s"+
@@ -690,7 +633,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		rosenpassEnabledStatus,
 		lazyConnectionEnabledStatus,
 		sshServerStatus,
-		vncServerStatus,
 		networks,
 		forwardingRulesString,
 		sessionExpiryString,
@@ -1051,26 +993,6 @@ func anonymizePeerDetail(a *anonymize.Anonymizer, peer *PeerStateDetailOutput) {
 	}
 }
 
-// formatVNCSessionLine renders a single VNC session row for the detailed
-// status output. The leading slot identifies the initiator (display name
-// when known, hashed UserID otherwise); the post-arrow slot is the OS
-// user the session targets and is omitted in attach mode where the
-// destination is the current console user (unknown to the daemon).
-func formatVNCSessionLine(sess VNCSessionOutput) string {
-	who := sess.Initiator
-	if who == "" {
-		who = sess.UserID
-	}
-	prefix := sess.RemoteAddress
-	if who != "" {
-		prefix = fmt.Sprintf("%s@%s", who, sess.RemoteAddress)
-	}
-	if sess.Username != "" {
-		return fmt.Sprintf("[%s -> %s] mode=%s", prefix, sess.Username, sess.Mode)
-	}
-	return fmt.Sprintf("[%s] mode=%s", prefix, sess.Mode)
-}
-
 func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 	for i, peer := range overview.Peers.Details {
 		peer := peer
@@ -1091,19 +1013,6 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 		overview.Relays.Details[i] = detail
 	}
 
-	anonymizeNSServerGroups(a, overview)
-
-	for i, route := range overview.Networks {
-		overview.Networks[i] = a.AnonymizeRoute(route)
-	}
-
-	overview.FQDN = a.AnonymizeDomain(overview.FQDN)
-
-	anonymizeEvents(a, overview)
-	anonymizeServerSessions(a, overview)
-}
-
-func anonymizeNSServerGroups(a *anonymize.Anonymizer, overview *OutputOverview) {
 	for i, nsGroup := range overview.NSServerGroups {
 		for j, domain := range nsGroup.Domains {
 			overview.NSServerGroups[i].Domains[j] = a.AnonymizeDomain(domain)
@@ -1115,9 +1024,13 @@ func anonymizeNSServerGroups(a *anonymize.Anonymizer, overview *OutputOverview)
 			}
 		}
 	}
-}
 
-func anonymizeEvents(a *anonymize.Anonymizer, overview *OutputOverview) {
+	for i, route := range overview.Networks {
+		overview.Networks[i] = a.AnonymizeRoute(route)
+	}
+
+	overview.FQDN = a.AnonymizeDomain(overview.FQDN)
+
 	for i, event := range overview.Events {
 		overview.Events[i].Message = a.AnonymizeString(event.Message)
 		overview.Events[i].UserMessage = a.AnonymizeString(event.UserMessage)
@@ -1126,26 +1039,15 @@ func anonymizeEvents(a *anonymize.Anonymizer, overview *OutputOverview) {
 			event.Metadata[k] = a.AnonymizeString(v)
 		}
 	}
-}
 
-func anonymizeRemoteAddress(a *anonymize.Anonymizer, addr string) string {
-	if host, port, err := net.SplitHostPort(addr); err == nil {
-		return fmt.Sprintf("%s:%s", a.AnonymizeIPString(host), port)
-	}
-	return a.AnonymizeIPString(addr)
-}
-
-func anonymizeServerSessions(a *anonymize.Anonymizer, overview *OutputOverview) {
 	for i, session := range overview.SSHServerState.Sessions {
-		overview.SSHServerState.Sessions[i].RemoteAddress = anonymizeRemoteAddress(a, session.RemoteAddress)
+		if host, port, err := net.SplitHostPort(session.RemoteAddress); err == nil {
+			overview.SSHServerState.Sessions[i].RemoteAddress = fmt.Sprintf("%s:%s", a.AnonymizeIPString(host), port)
+		} else {
+			overview.SSHServerState.Sessions[i].RemoteAddress = a.AnonymizeIPString(session.RemoteAddress)
+		}
 		overview.SSHServerState.Sessions[i].Command = a.AnonymizeString(session.Command)
 	}
-	for i, sess := range overview.VNCServerState.Sessions {
-		overview.VNCServerState.Sessions[i].RemoteAddress = anonymizeRemoteAddress(a, sess.RemoteAddress)
-		overview.VNCServerState.Sessions[i].Username = a.AnonymizeString(sess.Username)
-		overview.VNCServerState.Sessions[i].UserID = a.AnonymizeString(sess.UserID)
-		overview.VNCServerState.Sessions[i].Initiator = a.AnonymizeString(sess.Initiator)
-	}
 }
 
 // FormatRemainingDuration renders a time.Duration for the "Session expires"

client/status/status_test.go

@@ -242,10 +242,6 @@ var overview = OutputOverview{
 		Enabled:  false,
 		Sessions: []SSHSessionOutput{},
 	},
-	VNCServerState: VNCServerStateOutput{
-		Enabled:  false,
-		Sessions: []VNCSessionOutput{},
-	},
 }
 
 func TestConversionFromFullStatusToOutputOverview(t *testing.T) {
@@ -411,10 +407,6 @@ func TestParsingToJSON(t *testing.T) {
 		  "sshServer":{
 		    "enabled":false,
 			"sessions":[]
-		  },
-		  "vncServer":{
-		    "enabled":false,
-			"sessions":[]
 		  }
         }`
 	// @formatter:on
@@ -525,9 +517,6 @@ profileName: ""
 sshServer:
     enabled: false
     sessions: []
-vncServer:
-    enabled: false
-    sessions: []
 `
 
 	assert.Equal(t, expectedYAML, yaml)
@@ -598,7 +587,6 @@ Wireguard port: %d
 Quantum resistance: false
 Lazy connection: false
 SSH Server: Disabled
-VNC Server: Disabled
 Networks: 10.10.0.0/24
 Peers count: 2/2 Connected
 `, lastConnectionUpdate1, lastHandshake1, lastConnectionUpdate2, lastHandshake2, runtime.GOOS, runtime.GOARCH, overview.CliVersion, overview.WgPort)
@@ -625,7 +613,6 @@ Wireguard port: 51820
 Quantum resistance: false
 Lazy connection: false
 SSH Server: Disabled
-VNC Server: Disabled
 Networks: 10.10.0.0/24
 Peers count: 2/2 Connected
 `

client/system/info.go

@@ -65,7 +65,6 @@ type Info struct {
 	RosenpassEnabled    bool
 	RosenpassPermissive bool
 	ServerSSHAllowed    bool
-	ServerVNCAllowed    bool
 
 	DisableClientRoutes bool
 	DisableServerRoutes bool
@@ -85,7 +84,6 @@ type Info struct {
 func (i *Info) SetFlags(
 	rosenpassEnabled, rosenpassPermissive bool,
 	serverSSHAllowed *bool,
-	serverVNCAllowed *bool,
 	disableClientRoutes, disableServerRoutes,
 	disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6 bool,
 	enableSSHRoot, enableSSHSFTP, enableSSHLocalPortForwarding, enableSSHRemotePortForwarding *bool,
@@ -96,9 +94,6 @@ func (i *Info) SetFlags(
 	if serverSSHAllowed != nil {
 		i.ServerSSHAllowed = *serverSSHAllowed
 	}
-	if serverVNCAllowed != nil {
-		i.ServerVNCAllowed = *serverVNCAllowed
-	}
 
 	i.DisableClientRoutes = disableClientRoutes
 	i.DisableServerRoutes = disableServerRoutes

client/ui/frontend/src/app.tsx

@@ -3,7 +3,6 @@ import ReactDOM from "react-dom/client";
 import "./globals.css";
 import { HashRouter, Navigate, Route, Routes } from "react-router-dom";
 import SessionExpirationDialog from "@/modules/session/SessionExpirationDialog.tsx";
-import ApprovalDialog from "@/modules/approval/ApprovalDialog.tsx";
 import UpdateInProgressDialog from "@/modules/auto-update/UpdateInProgressDialog.tsx";
 import WelcomeDialog from "@/modules/welcome/WelcomeDialog.tsx";
 import ErrorDialog from "@/modules/error/ErrorDialog.tsx";
@@ -17,13 +16,10 @@ import LoginWaitingForBrowserDialog from "@/modules/login/LoginWaitingForBrowser
 import { initI18n } from "@/lib/i18n";
 import { initPlatform } from "@/lib/platform";
 import { initLogForwarding } from "@/lib/logs";
-import { initStallWatch } from "@/lib/stallwatch";
 
 // Must run first so even init-time logs reach the Go log pipeline.
 initLogForwarding();
 
-initStallWatch();
-
 welcome();
 
 Promise.all([
@@ -49,7 +45,6 @@ Promise.all([
                                 path={"session-expiration"}
                                 element={<SessionExpirationDialog />}
                             />
-                            <Route path={"approval"} element={<ApprovalDialog />} />
                             <Route path={"welcome"} element={<WelcomeDialog />} />
                             <Route path={"error"} element={<ErrorDialog />} />
                         </Route>

client/ui/frontend/src/lib/stallwatch.ts

@@ -1,31 +0,0 @@
-// Detects webview suspension (macOS App Nap / hidden-window timer throttling).
-// While the webview is suspended no JS runs at all, so detection happens on
-// resume: a 1s interval measures wall-clock drift and reports how long timers
-// were frozen. Silent unless a stall actually occurred; a stalled webview is
-// what delays promise continuations such as the WaitSSOLogin → Up handoff.
-
-const INTERVAL_MS = 1000;
-const STALL_THRESHOLD_MS = 5000;
-const REPORT_COOLDOWN_MS = 60_000;
-
-let started = false;
-
-export function initStallWatch() {
-    if (started) return;
-    started = true;
-
-    let last = Date.now();
-    let lastReport = 0;
-    setInterval(() => {
-        const now = Date.now();
-        const stall = now - last - INTERVAL_MS;
-        last = now;
-        if (stall < STALL_THRESHOLD_MS) return;
-        if (now - lastReport < REPORT_COOLDOWN_MS) return;
-        lastReport = now;
-        console.warn(
-            `webview timers were suspended for ${(stall / 1000).toFixed(1)}s ` +
-                `(App Nap / hidden-window throttling); pending UI work ran late`,
-        );
-    }, INTERVAL_MS);
-}

client/ui/frontend/src/modules/approval/ApprovalDialog.tsx

@@ -1,170 +0,0 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { useTranslation } from "react-i18next";
-import { useSearchParams } from "react-router-dom";
-import { MonitorIcon } from "lucide-react";
-import { Button } from "@/components/buttons/Button";
-import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
-import { DialogActions } from "@/components/dialog/DialogActions";
-import { DialogHeading } from "@/components/dialog/DialogHeading";
-import { SquareIcon } from "@/components/SquareIcon";
-import { Approval, WindowManager } from "@bindings/services";
-import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
-
-const WINDOW_WIDTH = 360;
-// Fallback window so a missing/unparseable expires_at can't leave the prompt open forever.
-const FALLBACK_SECONDS = 13;
-
-// shortFingerprint groups a hex key as XXXX-XXXX-XXXX-XXXX (16 chars). Mirrors the
-// daemon's approval.ShortKeyFingerprint so the value matches an out-of-band reference.
-function shortFingerprint(hexKey: string): string {
-    if (hexKey.length < 8) return "";
-    const src = hexKey.slice(0, 16);
-    return src.match(/.{1,4}/g)?.join("-") ?? src;
-}
-
-type Row = { label: string; value: string; mono?: boolean };
-
-export default function ApprovalDialog() {
-    const { t } = useTranslation();
-    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH);
-    const [params] = useSearchParams();
-    const [busy, setBusy] = useState(false);
-
-    const requestID = params.get("request_id") ?? "";
-    const kind = params.get("kind") ?? "";
-    const initiator = params.get("initiator") ?? "";
-    const peerName = params.get("peer_name") ?? "";
-    const sourceIP = params.get("source_ip") ?? "";
-    const username = params.get("username") ?? "";
-    const peerPubKey = params.get("peer_pubkey") ?? "";
-    const expiresAt = params.get("expires_at") ?? "";
-
-    const deadline = useMemo(() => {
-        const parsed = Date.parse(expiresAt);
-        return Number.isFinite(parsed) ? parsed : Date.now() + FALLBACK_SECONDS * 1000;
-    }, [expiresAt]);
-
-    const title = useMemo(() => {
-        switch (kind) {
-            case "vnc":
-                return t("approval.title.vnc");
-            case "ssh":
-                return t("approval.title.ssh");
-            default:
-                return t("approval.title.default");
-        }
-    }, [kind, t]);
-
-    const rows = useMemo<Row[]>(() => {
-        const out: Row[] = [];
-        // The display name is dashboard-supplied and not cryptographically
-        // asserted; the key fingerprint below IS, so show both.
-        if (initiator) out.push({ label: t("approval.field.user"), value: initiator });
-        const fp = shortFingerprint(peerPubKey);
-        if (fp) out.push({ label: t("approval.field.keyFingerprint"), value: fp, mono: true });
-        if (peerName) out.push({ label: t("approval.field.peer"), value: peerName });
-        if (sourceIP && sourceIP !== peerName)
-            out.push({ label: t("approval.field.sourceIp"), value: sourceIP, mono: true });
-        if (username) out.push({ label: t("approval.field.osUser"), value: username });
-        return out;
-    }, [initiator, peerPubKey, peerName, sourceIP, username, t]);
-
-    const respond = useCallback(
-        async (accept: boolean, viewOnly: boolean) => {
-            if (busy) return;
-            setBusy(true);
-            try {
-                if (requestID) {
-                    await Approval.Respond(requestID, accept, viewOnly);
-                }
-            } catch (e) {
-                console.error("respond approval failed", e);
-            } finally {
-                WindowManager.CloseApproval().catch(console.error);
-            }
-        },
-        [busy, requestID],
-    );
-
-    const secondsLeft = () => Math.max(0, Math.ceil((deadline - Date.now()) / 1000));
-    const [remaining, setRemaining] = useState(secondsLeft);
-    const closedRef = useRef(false);
-    useEffect(() => {
-        const id = globalThis.setInterval(() => {
-            const left = secondsLeft();
-            setRemaining(left);
-            // On the deadline the daemon auto-denies; just close the prompt.
-            if (left <= 0 && !closedRef.current) {
-                closedRef.current = true;
-                WindowManager.CloseApproval().catch(console.error);
-            }
-        }, 1000);
-        return () => globalThis.clearInterval(id);
-        // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [deadline]);
-
-    const showViewOnly = kind === "vnc";
-
-    return (
-        <ConfirmDialog ref={contentRef} aria-labelledby={"nb-approval-title"}>
-            <SquareIcon icon={MonitorIcon} />
-
-            <DialogHeading id={"nb-approval-title"}>{title}</DialogHeading>
-
-            {rows.length > 0 && (
-                <dl className={"w-full space-y-1 text-left text-sm"}>
-                    {rows.map((row) => (
-                        <div key={row.label} className={"flex justify-between gap-4"}>
-                            <dt className={"shrink-0 text-nb-gray-400"}>{row.label}</dt>
-                            <dd
-                                className={`min-w-0 truncate text-nb-gray-100 ${
-                                    row.mono ? "font-mono" : ""
-                                }`}
-                                title={row.value}
-                            >
-                                {row.value}
-                            </dd>
-                        </div>
-                    ))}
-                </dl>
-            )}
-
-            <div className={"text-sm tabular-nums text-nb-gray-400"} aria-live={"polite"}>
-                {t("approval.countdown", { seconds: remaining })}
-            </div>
-
-            <DialogActions>
-                <Button
-                    autoFocus
-                    variant={"primary"}
-                    size={"md"}
-                    className={"w-full"}
-                    onClick={() => respond(true, false)}
-                    disabled={busy}
-                >
-                    {t("approval.action.allow")}
-                </Button>
-                {showViewOnly && (
-                    <Button
-                        variant={"secondary"}
-                        size={"md"}
-                        className={"w-full"}
-                        onClick={() => respond(true, true)}
-                        disabled={busy}
-                    >
-                        {t("approval.action.allowViewOnly")}
-                    </Button>
-                )}
-                <Button
-                    variant={"danger"}
-                    size={"md"}
-                    className={"w-full"}
-                    onClick={() => respond(false, false)}
-                    disabled={busy}
-                >
-                    {t("approval.action.deny")}
-                </Button>
-            </DialogActions>
-        </ConfirmDialog>
-    );
-}

client/ui/frontend/src/modules/settings/SettingsNavigation.tsx

@@ -8,7 +8,6 @@ import {
     BoltIcon,
     InfoIcon,
     LifeBuoyIcon,
-    MonitorIcon,
     NetworkIcon,
     ShieldIcon,
     SlidersHorizontalIcon,
@@ -64,13 +63,6 @@ export const SettingsNavigation = () => {
                         title={t("settings.tabs.ssh")}
                     />
                 )}
-                {!features.disableUpdateSettings && (
-                    <VerticalTabs.Trigger
-                        value={"vnc"}
-                        icon={MonitorIcon}
-                        title={t("settings.tabs.vnc")}
-                    />
-                )}
                 {!features.disableUpdateSettings && (
                     <VerticalTabs.Trigger
                         value={"advanced"}

client/ui/frontend/src/modules/settings/SettingsPage.tsx

@@ -13,7 +13,6 @@ import { SettingsNetwork } from "@/modules/settings/SettingsNetwork.tsx";
 import { SettingsSecurity } from "@/modules/settings/SettingsSecurity.tsx";
 import { ProfilesTab } from "@/modules/profiles/ProfilesTab.tsx";
 import { SettingsSSH } from "@/modules/settings/SettingsSSH.tsx";
-import { SettingsVNC } from "@/modules/settings/SettingsVNC.tsx";
 import { SettingsAdvanced } from "@/modules/settings/SettingsAdvanced.tsx";
 import { SettingsTroubleshooting } from "@/modules/settings/SettingsTroubleshooting.tsx";
 import { SettingsAbout } from "@/modules/settings/SettingsAbout.tsx";
@@ -27,7 +26,6 @@ const enum Tab {
     Security = "security",
     Profiles = "profiles",
     SSH = "ssh",
-    VNC = "vnc",
     Advanced = "advanced",
     Troubleshooting = "troubleshooting",
     About = "about",
@@ -39,7 +37,6 @@ const TAB_CONTENT: Record<Tab, ReactNode> = {
     [Tab.Security]: <SettingsSecurity />,
     [Tab.Profiles]: <ProfilesTab />,
     [Tab.SSH]: <SettingsSSH />,
-    [Tab.VNC]: <SettingsVNC />,
     [Tab.Advanced]: <SettingsAdvanced />,
     [Tab.Troubleshooting]: <SettingsTroubleshooting />,
     [Tab.About]: <SettingsAbout />,
@@ -58,7 +55,6 @@ export const SettingsPage = () => {
             [Tab.Security]: editable,
             [Tab.Profiles]: !features.disableProfiles,
             [Tab.SSH]: mdm.allowServerSSH ?? editable,
-            [Tab.VNC]: editable,
             [Tab.Advanced]: editable,
             [Tab.Troubleshooting]: true,
             [Tab.About]: true,

client/ui/frontend/src/modules/settings/SettingsVNC.tsx

@@ -1,32 +0,0 @@
-import { useTranslation } from "react-i18next";
-import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
-import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
-import { useSettings } from "@/contexts/SettingsContext.tsx";
-
-export function SettingsVNC() {
-    const { t } = useTranslation();
-    const { config, setField } = useSettings();
-    const isVNCServerEnabled = config.serverVncAllowed;
-
-    return (
-        <>
-            <SectionGroup title={t("settings.vnc.section.server")}>
-                <FancyToggleSwitch
-                    value={config.serverVncAllowed}
-                    onChange={(v) => setField("serverVncAllowed", v)}
-                    label={t("settings.vnc.server.label")}
-                    helpText={t("settings.vnc.server.help")}
-                />
-            </SectionGroup>
-
-            <SectionGroup title={t("settings.vnc.section.approval")} disabled={!isVNCServerEnabled}>
-                <FancyToggleSwitch
-                    value={!config.disableVncApproval}
-                    onChange={(v) => setField("disableVncApproval", !v)}
-                    label={t("settings.vnc.approval.label")}
-                    helpText={t("settings.vnc.approval.help")}
-                />
-            </SectionGroup>
-        </>
-    );
-}

client/ui/i18n/locales/de/common.json

@@ -1321,65 +1321,5 @@
     },
     "error.unknown": {
         "message": "Vorgang fehlgeschlagen."
-    },
-    "settings.tabs.vnc": {
-        "message": "VNC"
-    },
-    "settings.vnc.section.server": {
-        "message": "Server"
-    },
-    "settings.vnc.section.approval": {
-        "message": "Genehmigung"
-    },
-    "settings.vnc.server.label": {
-        "message": "VNC-Server aktivieren"
-    },
-    "settings.vnc.server.help": {
-        "message": "Den NetBird-VNC-Server auf diesem Host ausführen, damit autorisierte Peers den Bildschirm ansehen oder steuern können."
-    },
-    "settings.vnc.approval.label": {
-        "message": "Verbindungsgenehmigung erforderlich"
-    },
-    "settings.vnc.approval.help": {
-        "message": "Auf diesem Host eine Aufforderung anzeigen, die bestätigt werden muss, bevor eine eingehende VNC-Verbindung zugelassen wird."
-    },
-    "window.title.approval": {
-        "message": "Verbindungsanfrage"
-    },
-    "approval.title.vnc": {
-        "message": "VNC-Verbindung zulassen?"
-    },
-    "approval.title.ssh": {
-        "message": "SSH-Verbindung zulassen?"
-    },
-    "approval.title.default": {
-        "message": "Eingehende Verbindung zulassen?"
-    },
-    "approval.field.user": {
-        "message": "Von Benutzer"
-    },
-    "approval.field.keyFingerprint": {
-        "message": "Schlüssel-Fingerabdruck"
-    },
-    "approval.field.peer": {
-        "message": "Über Peer"
-    },
-    "approval.field.sourceIp": {
-        "message": "Quell-IP"
-    },
-    "approval.field.osUser": {
-        "message": "Betriebssystem-Benutzer"
-    },
-    "approval.countdown": {
-        "message": "Automatische Ablehnung in {seconds}s"
-    },
-    "approval.action.allow": {
-        "message": "Zulassen"
-    },
-    "approval.action.allowViewOnly": {
-        "message": "Zulassen (nur ansehen)"
-    },
-    "approval.action.deny": {
-        "message": "Ablehnen"
     }
 }

client/ui/i18n/locales/en/common.json

@@ -683,10 +683,6 @@
         "message": "SSH",
         "description": "Settings tab label: SSH. Acronym — keep as-is."
     },
-    "settings.tabs.vnc": {
-        "message": "VNC",
-        "description": "Settings tab label: VNC. Acronym — keep as-is."
-    },
     "settings.tabs.advanced": {
         "message": "Advanced",
         "description": "Settings tab label: Advanced. Keep short."
@@ -955,30 +951,6 @@
         "message": "Second(s)",
         "description": "Unit suffix shown after the JWT TTL number field. The '(s)' marks an optional plural."
     },
-    "settings.vnc.section.server": {
-        "message": "Server",
-        "description": "Section heading: Server (VNC settings)."
-    },
-    "settings.vnc.section.approval": {
-        "message": "Approval",
-        "description": "Section heading: Approval (VNC connection approval settings)."
-    },
-    "settings.vnc.server.label": {
-        "message": "Enable VNC Server",
-        "description": "Toggle label: enable the embedded VNC server."
-    },
-    "settings.vnc.server.help": {
-        "message": "Run the NetBird VNC server on this host so authorized peers can view or control its screen.",
-        "description": "Helper text for the VNC server toggle."
-    },
-    "settings.vnc.approval.label": {
-        "message": "Require Connection Approval",
-        "description": "Toggle label: prompt for approval before each inbound VNC connection."
-    },
-    "settings.vnc.approval.help": {
-        "message": "Show a prompt on this host that must be accepted before an incoming VNC connection is allowed.",
-        "description": "Helper text for the VNC connection-approval toggle."
-    },
     "settings.advanced.section.interface": {
         "message": "Interface",
         "description": "Section heading: Interface (network-interface settings)."
@@ -1391,58 +1363,6 @@
         "message": "Session Expiring",
         "description": "OS window-chrome title for the session-expiration window."
     },
-    "window.title.approval": {
-        "message": "Connection Request",
-        "description": "OS window-chrome title for the inbound-connection approval window."
-    },
-    "approval.title.vnc": {
-        "message": "Allow VNC Connection?",
-        "description": "Approval dialog heading for an inbound VNC connection."
-    },
-    "approval.title.ssh": {
-        "message": "Allow SSH Connection?",
-        "description": "Approval dialog heading for an inbound SSH connection."
-    },
-    "approval.title.default": {
-        "message": "Allow Incoming Connection?",
-        "description": "Approval dialog heading for an inbound connection of unknown kind."
-    },
-    "approval.field.user": {
-        "message": "From user",
-        "description": "Approval dialog row label: the initiating user's display name."
-    },
-    "approval.field.keyFingerprint": {
-        "message": "Key fingerprint",
-        "description": "Approval dialog row label: the connecting peer's cryptographic key fingerprint."
-    },
-    "approval.field.peer": {
-        "message": "Via peer",
-        "description": "Approval dialog row label: the peer the connection arrives through."
-    },
-    "approval.field.sourceIp": {
-        "message": "Source IP",
-        "description": "Approval dialog row label: the source IP address of the connection."
-    },
-    "approval.field.osUser": {
-        "message": "OS user",
-        "description": "Approval dialog row label: the target operating-system user."
-    },
-    "approval.countdown": {
-        "message": "Auto-deny in {seconds}s",
-        "description": "Approval dialog countdown; {seconds} is the remaining whole seconds before the daemon auto-denies."
-    },
-    "approval.action.allow": {
-        "message": "Allow",
-        "description": "Approval dialog button: allow the connection."
-    },
-    "approval.action.allowViewOnly": {
-        "message": "Allow (view only)",
-        "description": "Approval dialog button: allow the connection in view-only mode."
-    },
-    "approval.action.deny": {
-        "message": "Deny",
-        "description": "Approval dialog button: deny the connection."
-    },
     "window.title.updating": {
         "message": "Updating",
         "description": "OS window-chrome title for the update / install window."

client/ui/i18n/locales/es/common.json

@@ -1321,65 +1321,5 @@
     },
     "error.unknown": {
         "message": "La operación falló."
-    },
-    "settings.tabs.vnc": {
-        "message": "VNC"
-    },
-    "settings.vnc.section.server": {
-        "message": "Servidor"
-    },
-    "settings.vnc.section.approval": {
-        "message": "Aprobación"
-    },
-    "settings.vnc.server.label": {
-        "message": "Habilitar el servidor VNC"
-    },
-    "settings.vnc.server.help": {
-        "message": "Ejecuta el servidor VNC de NetBird en este host para que los peers autorizados puedan ver o controlar su pantalla."
-    },
-    "settings.vnc.approval.label": {
-        "message": "Requerir aprobación de conexión"
-    },
-    "settings.vnc.approval.help": {
-        "message": "Mostrar en este host una solicitud que debe aceptarse antes de permitir una conexión VNC entrante."
-    },
-    "window.title.approval": {
-        "message": "Solicitud de conexión"
-    },
-    "approval.title.vnc": {
-        "message": "¿Permitir la conexión VNC?"
-    },
-    "approval.title.ssh": {
-        "message": "¿Permitir la conexión SSH?"
-    },
-    "approval.title.default": {
-        "message": "¿Permitir la conexión entrante?"
-    },
-    "approval.field.user": {
-        "message": "Del usuario"
-    },
-    "approval.field.keyFingerprint": {
-        "message": "Huella de la clave"
-    },
-    "approval.field.peer": {
-        "message": "A través del peer"
-    },
-    "approval.field.sourceIp": {
-        "message": "IP de origen"
-    },
-    "approval.field.osUser": {
-        "message": "Usuario del SO"
-    },
-    "approval.countdown": {
-        "message": "Rechazo automático en {seconds}s"
-    },
-    "approval.action.allow": {
-        "message": "Permitir"
-    },
-    "approval.action.allowViewOnly": {
-        "message": "Permitir (solo ver)"
-    },
-    "approval.action.deny": {
-        "message": "Denegar"
     }
 }

client/ui/i18n/locales/fr/common.json

@@ -1321,65 +1321,5 @@
     },
     "error.unknown": {
         "message": "L’opération a échoué."
-    },
-    "settings.tabs.vnc": {
-        "message": "VNC"
-    },
-    "settings.vnc.section.server": {
-        "message": "Serveur"
-    },
-    "settings.vnc.section.approval": {
-        "message": "Approbation"
-    },
-    "settings.vnc.server.label": {
-        "message": "Activer le serveur VNC"
-    },
-    "settings.vnc.server.help": {
-        "message": "Exécuter le serveur VNC de NetBird sur cet hôte afin que les pairs autorisés puissent voir ou contrôler son écran."
-    },
-    "settings.vnc.approval.label": {
-        "message": "Exiger l'approbation des connexions"
-    },
-    "settings.vnc.approval.help": {
-        "message": "Afficher sur cet hôte une invite qui doit être acceptée avant d'autoriser une connexion VNC entrante."
-    },
-    "window.title.approval": {
-        "message": "Demande de connexion"
-    },
-    "approval.title.vnc": {
-        "message": "Autoriser la connexion VNC ?"
-    },
-    "approval.title.ssh": {
-        "message": "Autoriser la connexion SSH ?"
-    },
-    "approval.title.default": {
-        "message": "Autoriser la connexion entrante ?"
-    },
-    "approval.field.user": {
-        "message": "De l'utilisateur"
-    },
-    "approval.field.keyFingerprint": {
-        "message": "Empreinte de clé"
-    },
-    "approval.field.peer": {
-        "message": "Via le pair"
-    },
-    "approval.field.sourceIp": {
-        "message": "IP source"
-    },
-    "approval.field.osUser": {
-        "message": "Utilisateur du système"
-    },
-    "approval.countdown": {
-        "message": "Refus automatique dans {seconds}s"
-    },
-    "approval.action.allow": {
-        "message": "Autoriser"
-    },
-    "approval.action.allowViewOnly": {
-        "message": "Autoriser (lecture seule)"
-    },
-    "approval.action.deny": {
-        "message": "Refuser"
     }
 }

client/ui/i18n/locales/hu/common.json

@@ -1321,65 +1321,5 @@
     },
     "error.unknown": {
         "message": "A művelet meghiúsult."
-    },
-    "settings.tabs.vnc": {
-        "message": "VNC"
-    },
-    "settings.vnc.section.server": {
-        "message": "Szerver"
-    },
-    "settings.vnc.section.approval": {
-        "message": "Jóváhagyás"
-    },
-    "settings.vnc.server.label": {
-        "message": "VNC szerver engedélyezése"
-    },
-    "settings.vnc.server.help": {
-        "message": "A NetBird VNC szerver futtatása ezen a gépen, hogy az arra jogosult partnerek megtekinthessék vagy vezérelhessék a képernyőjét."
-    },
-    "settings.vnc.approval.label": {
-        "message": "Kapcsolat jóváhagyásának megkövetelése"
-    },
-    "settings.vnc.approval.help": {
-        "message": "Megerősítést kérő ablak megjelenítése ezen a gépen, amelyet el kell fogadni a bejövő VNC-kapcsolat engedélyezése előtt."
-    },
-    "window.title.approval": {
-        "message": "Kapcsolódási kérés"
-    },
-    "approval.title.vnc": {
-        "message": "Engedélyezi a VNC-kapcsolatot?"
-    },
-    "approval.title.ssh": {
-        "message": "Engedélyezi az SSH-kapcsolatot?"
-    },
-    "approval.title.default": {
-        "message": "Engedélyezi a bejövő kapcsolatot?"
-    },
-    "approval.field.user": {
-        "message": "Felhasználótól"
-    },
-    "approval.field.keyFingerprint": {
-        "message": "Kulcs ujjlenyomata"
-    },
-    "approval.field.peer": {
-        "message": "Partneren keresztül"
-    },
-    "approval.field.sourceIp": {
-        "message": "Forrás IP"
-    },
-    "approval.field.osUser": {
-        "message": "OS-felhasználó"
-    },
-    "approval.countdown": {
-        "message": "Automatikus elutasítás {seconds} mp múlva"
-    },
-    "approval.action.allow": {
-        "message": "Engedélyezés"
-    },
-    "approval.action.allowViewOnly": {
-        "message": "Engedélyezés (csak megtekintés)"
-    },
-    "approval.action.deny": {
-        "message": "Elutasítás"
     }
 }

client/ui/i18n/locales/it/common.json

@@ -1321,65 +1321,5 @@
     },
     "error.unknown": {
         "message": "Operazione non riuscita."
-    },
-    "settings.tabs.vnc": {
-        "message": "VNC"
-    },
-    "settings.vnc.section.server": {
-        "message": "Server"
-    },
-    "settings.vnc.section.approval": {
-        "message": "Approvazione"
-    },
-    "settings.vnc.server.label": {
-        "message": "Abilita server VNC"
-    },
-    "settings.vnc.server.help": {
-        "message": "Esegui il server VNC di NetBird su questo host in modo che i peer autorizzati possano visualizzarne o controllarne lo schermo."
-    },
-    "settings.vnc.approval.label": {
-        "message": "Richiedi l'approvazione della connessione"
-    },
-    "settings.vnc.approval.help": {
-        "message": "Mostra su questo host una richiesta che deve essere accettata prima di consentire una connessione VNC in entrata."
-    },
-    "window.title.approval": {
-        "message": "Richiesta di connessione"
-    },
-    "approval.title.vnc": {
-        "message": "Consentire la connessione VNC?"
-    },
-    "approval.title.ssh": {
-        "message": "Consentire la connessione SSH?"
-    },
-    "approval.title.default": {
-        "message": "Consentire la connessione in entrata?"
-    },
-    "approval.field.user": {
-        "message": "Dall'utente"
-    },
-    "approval.field.keyFingerprint": {
-        "message": "Impronta della chiave"
-    },
-    "approval.field.peer": {
-        "message": "Tramite peer"
-    },
-    "approval.field.sourceIp": {
-        "message": "IP di origine"
-    },
-    "approval.field.osUser": {
-        "message": "Utente del sistema"
-    },
-    "approval.countdown": {
-        "message": "Rifiuto automatico tra {seconds}s"
-    },
-    "approval.action.allow": {
-        "message": "Consenti"
-    },
-    "approval.action.allowViewOnly": {
-        "message": "Consenti (sola visualizzazione)"
-    },
-    "approval.action.deny": {
-        "message": "Rifiuta"
     }
 }

client/ui/i18n/locales/pt/common.json

@@ -1321,65 +1321,5 @@
     },
     "error.unknown": {
         "message": "A operação falhou."
-    },
-    "settings.tabs.vnc": {
-        "message": "VNC"
-    },
-    "settings.vnc.section.server": {
-        "message": "Servidor"
-    },
-    "settings.vnc.section.approval": {
-        "message": "Aprovação"
-    },
-    "settings.vnc.server.label": {
-        "message": "Ativar servidor VNC"
-    },
-    "settings.vnc.server.help": {
-        "message": "Execute o servidor VNC do NetBird neste host para que os peers autorizados possam ver ou controlar a sua tela."
-    },
-    "settings.vnc.approval.label": {
-        "message": "Exigir aprovação de conexão"
-    },
-    "settings.vnc.approval.help": {
-        "message": "Mostrar neste host um aviso que precisa ser aceito antes de permitir uma conexão VNC de entrada."
-    },
-    "window.title.approval": {
-        "message": "Solicitação de conexão"
-    },
-    "approval.title.vnc": {
-        "message": "Permitir a conexão VNC?"
-    },
-    "approval.title.ssh": {
-        "message": "Permitir a conexão SSH?"
-    },
-    "approval.title.default": {
-        "message": "Permitir a conexão de entrada?"
-    },
-    "approval.field.user": {
-        "message": "Do usuário"
-    },
-    "approval.field.keyFingerprint": {
-        "message": "Impressão digital da chave"
-    },
-    "approval.field.peer": {
-        "message": "Via peer"
-    },
-    "approval.field.sourceIp": {
-        "message": "IP de origem"
-    },
-    "approval.field.osUser": {
-        "message": "Usuário do SO"
-    },
-    "approval.countdown": {
-        "message": "Negação automática em {seconds}s"
-    },
-    "approval.action.allow": {
-        "message": "Permitir"
-    },
-    "approval.action.allowViewOnly": {
-        "message": "Permitir (somente visualização)"
-    },
-    "approval.action.deny": {
-        "message": "Negar"
     }
 }

client/ui/i18n/locales/ru/common.json

@@ -1321,65 +1321,5 @@
     },
     "error.unknown": {
         "message": "Не удалось выполнить операцию."
-    },
-    "settings.tabs.vnc": {
-        "message": "VNC"
-    },
-    "settings.vnc.section.server": {
-        "message": "Сервер"
-    },
-    "settings.vnc.section.approval": {
-        "message": "Подтверждение"
-    },
-    "settings.vnc.server.label": {
-        "message": "Включить VNC-сервер"
-    },
-    "settings.vnc.server.help": {
-        "message": "Запустить VNC-сервер NetBird на этом хосте, чтобы авторизованные пиры могли просматривать его экран или управлять им."
-    },
-    "settings.vnc.approval.label": {
-        "message": "Требовать подтверждение подключения"
-    },
-    "settings.vnc.approval.help": {
-        "message": "Показывать на этом хосте запрос, который нужно принять перед разрешением входящего VNC-подключения."
-    },
-    "window.title.approval": {
-        "message": "Запрос на подключение"
-    },
-    "approval.title.vnc": {
-        "message": "Разрешить VNC-подключение?"
-    },
-    "approval.title.ssh": {
-        "message": "Разрешить SSH-подключение?"
-    },
-    "approval.title.default": {
-        "message": "Разрешить входящее подключение?"
-    },
-    "approval.field.user": {
-        "message": "От пользователя"
-    },
-    "approval.field.keyFingerprint": {
-        "message": "Отпечаток ключа"
-    },
-    "approval.field.peer": {
-        "message": "Через пир"
-    },
-    "approval.field.sourceIp": {
-        "message": "IP-адрес источника"
-    },
-    "approval.field.osUser": {
-        "message": "Пользователь ОС"
-    },
-    "approval.countdown": {
-        "message": "Автоотклонение через {seconds} с"
-    },
-    "approval.action.allow": {
-        "message": "Разрешить"
-    },
-    "approval.action.allowViewOnly": {
-        "message": "Разрешить (только просмотр)"
-    },
-    "approval.action.deny": {
-        "message": "Отклонить"
     }
 }

client/ui/i18n/locales/zh-CN/common.json

@@ -1321,65 +1321,5 @@
     },
     "error.unknown": {
         "message": "操作失败。"
-    },
-    "settings.tabs.vnc": {
-        "message": "VNC"
-    },
-    "settings.vnc.section.server": {
-        "message": "服务器"
-    },
-    "settings.vnc.section.approval": {
-        "message": "批准"
-    },
-    "settings.vnc.server.label": {
-        "message": "启用 VNC 服务器"
-    },
-    "settings.vnc.server.help": {
-        "message": "在此主机上运行 NetBird VNC 服务器，以便授权的对端可以查看或控制其屏幕。"
-    },
-    "settings.vnc.approval.label": {
-        "message": "要求连接批准"
-    },
-    "settings.vnc.approval.help": {
-        "message": "在此主机上显示一个提示，必须先接受该提示才能允许传入的 VNC 连接。"
-    },
-    "window.title.approval": {
-        "message": "连接请求"
-    },
-    "approval.title.vnc": {
-        "message": "允许 VNC 连接？"
-    },
-    "approval.title.ssh": {
-        "message": "允许 SSH 连接？"
-    },
-    "approval.title.default": {
-        "message": "允许传入连接？"
-    },
-    "approval.field.user": {
-        "message": "来自用户"
-    },
-    "approval.field.keyFingerprint": {
-        "message": "密钥指纹"
-    },
-    "approval.field.peer": {
-        "message": "经由对端"
-    },
-    "approval.field.sourceIp": {
-        "message": "源 IP"
-    },
-    "approval.field.osUser": {
-        "message": "操作系统用户"
-    },
-    "approval.countdown": {
-        "message": "{seconds} 秒后自动拒绝"
-    },
-    "approval.action.allow": {
-        "message": "允许"
-    },
-    "approval.action.allowViewOnly": {
-        "message": "允许（仅查看）"
-    },
-    "approval.action.deny": {
-        "message": "拒绝"
     }
 }

client/ui/main.go

@@ -318,7 +318,6 @@ func registerServices(app *application.App, conn *Conn, s registeredServices) {
 	app.RegisterService(application.NewService(s.settings))
 	app.RegisterService(application.NewService(s.networks))
 	app.RegisterService(application.NewService(services.NewForwarding(conn)))
-	app.RegisterService(application.NewService(services.NewApproval(conn)))
 	app.RegisterService(application.NewService(s.profiles))
 	app.RegisterService(application.NewService(services.NewDebug(conn)))
 	app.RegisterService(application.NewService(s.update))

client/ui/services/approval.go

@@ -1,36 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"context"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// Approval forwards the user's decision on a pending inbound-connection
-// approval prompt to the daemon. The daemon pushes the prompt as a SystemEvent
-// with category APPROVAL; the dialog calls Respond with the same request id to
-// unblock whichever subsystem (VNC, SSH, ...) is waiting.
-type Approval struct {
-	conn DaemonConn
-}
-
-func NewApproval(conn DaemonConn) *Approval {
-	return &Approval{conn: conn}
-}
-
-// Respond delivers the accept/deny decision for requestID. viewOnly is only
-// meaningful when accept is true and the subsystem supports a read-only grant.
-func (a *Approval) Respond(ctx context.Context, requestID string, accept, viewOnly bool) error {
-	cli, err := a.conn.Client()
-	if err != nil {
-		return err
-	}
-	_, err = cli.RespondApproval(ctx, &proto.RespondApprovalRequest{
-		RequestId: requestID,
-		Accept:    accept,
-		ViewOnly:  viewOnly,
-	})
-	return err
-}

client/ui/services/connection.go

@@ -116,7 +116,6 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	if err != nil {
 		return LoginResult{}, s.classifyDaemonError(err)
 	}
-	log.Infof("daemon login response received, needs SSO login: %v", resp.GetNeedsSSOLogin())
 	return LoginResult{
 		NeedsSSOLogin:           resp.GetNeedsSSOLogin(),
 		UserCode:                resp.GetUserCode(),
@@ -130,7 +129,6 @@ func (s *Connection) WaitSSOLogin(ctx context.Context, p WaitSSOParams) (string,
 	if err != nil {
 		return "", err
 	}
-	log.Infof("waiting for SSO login to complete")
 	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
 		UserCode: p.UserCode,
 		Hostname: p.Hostname,
@@ -138,7 +136,6 @@ func (s *Connection) WaitSSOLogin(ctx context.Context, p WaitSSOParams) (string,
 	if err != nil {
 		return "", s.classifyDaemonError(err)
 	}
-	log.Infof("SSO login completed, daemon reported success")
 	return resp.GetEmail(), nil
 }
 
@@ -147,7 +144,6 @@ func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	if err != nil {
 		return err
 	}
-	log.Infof("sending up request to daemon")
 	// Always async: status updates flow via SubscribeStatus.
 	req := &proto.UpRequest{Async: true}
 	if p.ProfileName != "" {

client/ui/services/settings.go

@@ -24,7 +24,7 @@ type MDMFields struct {
 	DisableMetricsCollection bool   `json:"disableMetricsCollection"`
 	SplitTunnelMode          bool   `json:"splitTunnelMode"`
 	SplitTunnelApps          bool   `json:"splitTunnelApps"`
-	DisableAdvancedView      bool   `json:"disableAdvancedView"`
+	DisableAdvancedView bool `json:"disableAdvancedView"`
 }
 
 type Features struct {
@@ -54,8 +54,6 @@ type Config struct {
 	MTU                           int64  `json:"mtu"`
 	DisableAutoConnect            bool   `json:"disableAutoConnect"`
 	ServerSSHAllowed              bool   `json:"serverSshAllowed"`
-	ServerVNCAllowed              bool   `json:"serverVncAllowed"`
-	DisableVNCApproval            bool   `json:"disableVncApproval"`
 	RosenpassEnabled              bool   `json:"rosenpassEnabled"`
 	RosenpassPermissive           bool   `json:"rosenpassPermissive"`
 	DisableNotifications          bool   `json:"disableNotifications"`
@@ -87,8 +85,6 @@ type SetConfigParams struct {
 	PreSharedKey                  *string `json:"preSharedKey,omitempty"`
 	DisableAutoConnect            *bool   `json:"disableAutoConnect,omitempty"`
 	ServerSSHAllowed              *bool   `json:"serverSshAllowed,omitempty"`
-	ServerVNCAllowed              *bool   `json:"serverVncAllowed,omitempty"`
-	DisableVNCApproval            *bool   `json:"disableVncApproval,omitempty"`
 	RosenpassEnabled              *bool   `json:"rosenpassEnabled,omitempty"`
 	RosenpassPermissive           *bool   `json:"rosenpassPermissive,omitempty"`
 	DisableNotifications          *bool   `json:"disableNotifications,omitempty"`
@@ -139,8 +135,6 @@ func (s *Settings) GetConfig(ctx context.Context, p ConfigParams) (Config, error
 		MTU:                           resp.GetMtu(),
 		DisableAutoConnect:            resp.GetDisableAutoConnect(),
 		ServerSSHAllowed:              resp.GetServerSSHAllowed(),
-		ServerVNCAllowed:              resp.GetServerVNCAllowed(),
-		DisableVNCApproval:            resp.GetDisableVNCApproval(),
 		RosenpassEnabled:              resp.GetRosenpassEnabled(),
 		RosenpassPermissive:           resp.GetRosenpassPermissive(),
 		DisableNotifications:          resp.GetDisableNotifications(),
@@ -176,8 +170,6 @@ func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) error {
 		OptionalPreSharedKey:          p.PreSharedKey,
 		DisableAutoConnect:            p.DisableAutoConnect,
 		ServerSSHAllowed:              p.ServerSSHAllowed,
-		ServerVNCAllowed:              p.ServerVNCAllowed,
-		DisableVNCApproval:            p.DisableVNCApproval,
 		RosenpassEnabled:              p.RosenpassEnabled,
 		RosenpassPermissive:           p.RosenpassPermissive,
 		DisableNotifications:          p.DisableNotifications,

client/ui/services/windowmanager.go

@@ -106,7 +106,6 @@ type WindowManager struct {
 	settings          *application.WebviewWindow
 	browserLogin      *application.WebviewWindow
 	sessionExpiration *application.WebviewWindow
-	approval          *application.WebviewWindow
 	installProgress   *application.WebviewWindow
 	welcome           *application.WebviewWindow
 	errorDialog       *application.WebviewWindow
@@ -280,58 +279,6 @@ func (s *WindowManager) CloseSessionExpiration() {
 	}
 }
 
-// ApprovalRequest carries the daemon-supplied metadata for an inbound-connection
-// approval prompt to the dialog window as query params. Kind, RequestID and
-// ExpiresAt are daemon-issued; the rest are remote-influenced and shown so the
-// user can vet who is connecting.
-type ApprovalRequest struct {
-	RequestID  string
-	Kind       string
-	Initiator  string
-	PeerName   string
-	SourceIP   string
-	Username   string
-	PeerPubKey string
-	ExpiresAt  string
-}
-
-// OpenApproval shows the inbound-connection approval prompt on the cursor's
-// display. Singleton, destroyed on close: a second request replaces the window,
-// and the superseded request auto-denies on the daemon's deadline.
-func (s *WindowManager) OpenApproval(req ApprovalRequest) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	startURL := approvalDialogURL(req)
-	if s.approval == nil {
-		opts := DialogWindowOptions("approval", s.title("window.title.approval"), startURL, s.linuxIcon)
-		opts.Height = 380
-		opts.Screen = s.getScreenBasedOnCursorPosition()
-		opts.InitialPosition = application.WindowCentered
-		s.approval = s.app.Window.NewWithOptions(opts)
-		s.approval.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
-			s.mu.Lock()
-			s.approval = nil
-			s.mu.Unlock()
-		})
-		s.centerOnCursorScreen(s.approval)
-		return
-	}
-	s.approval.SetURL(startURL)
-	s.centerOnCursorScreen(s.approval)
-	s.approval.Show()
-	s.approval.Focus()
-}
-
-func (s *WindowManager) CloseApproval() {
-	s.mu.Lock()
-	w := s.approval
-	s.approval = nil
-	s.mu.Unlock()
-	if w != nil {
-		w.Close()
-	}
-}
-
 // OpenInstallProgress shows the install-progress window and hides the rest for the duration
 // (restored on close). It owns its own result polling since the daemon restarts mid-install.
 func (s *WindowManager) OpenInstallProgress(version string) {
@@ -625,30 +572,5 @@ func errorDialogURL(title, message string) string {
 	return startURL
 }
 
-// approvalDialogURL builds the approval window's start URL with the request
-// metadata as escaped query params. Empty fields are omitted so the dialog
-// renders only the rows it has values for.
-func approvalDialogURL(req ApprovalRequest) string {
-	q := url.Values{}
-	set := func(k, v string) {
-		if v != "" {
-			q.Set(k, v)
-		}
-	}
-	set("request_id", req.RequestID)
-	set("kind", req.Kind)
-	set("initiator", req.Initiator)
-	set("peer_name", req.PeerName)
-	set("source_ip", req.SourceIP)
-	set("username", req.Username)
-	set("peer_pubkey", req.PeerPubKey)
-	set("expires_at", req.ExpiresAt)
-	startURL := "/#/dialog/approval"
-	if enc := q.Encode(); enc != "" {
-		startURL += "?" + enc
-	}
-	return startURL
-}
-
 // u32ptr returns a pointer to v, for the optional *uint32 Wails theme fields.
 func u32ptr(v uint32) *uint32 { return &v }

client/ui/tray_events.go

@@ -42,14 +42,6 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 		}
 		return
 	}
-	// Inbound-connection approval prompts open a dedicated dialog instead of a
-	// toast. Handle before the message gate: the daemon auto-denies on its
-	// deadline, so a missing WindowManager fails closed.
-	if se.Category == "approval" {
-		t.openApproval(se)
-		return
-	}
-
 	// Session-warning and deadline-rejected events build their body locally from
 	// metadata; every other event needs a UserMessage.
 	isSessionWarning := se.Metadata[authsession.MetaWarning] == "true"
@@ -101,30 +93,6 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 	t.notify(eventTitle(se), body, notifyIDEvent+se.ID)
 }
 
-// openApproval opens the inbound-connection approval dialog from an APPROVAL
-// SystemEvent. request_id is daemon-issued; without it the prompt can't be
-// answered, so it's dropped and the daemon auto-denies on its deadline.
-func (t *Tray) openApproval(se services.SystemEvent) {
-	if t.svc.WindowManager == nil {
-		return
-	}
-	requestID := se.Metadata["request_id"]
-	if requestID == "" {
-		log.Warnf("approval event missing request_id: %v", se.Metadata)
-		return
-	}
-	t.svc.WindowManager.OpenApproval(services.ApprovalRequest{
-		RequestID:  requestID,
-		Kind:       se.Metadata["kind"],
-		Initiator:  se.Metadata["initiator"],
-		PeerName:   se.Metadata["peer_name"],
-		SourceIP:   se.Metadata["source_ip"],
-		Username:   se.Metadata["username"],
-		PeerPubKey: se.Metadata["peer_pubkey"],
-		ExpiresAt:  se.Metadata["expires_at"],
-	})
-}
-
 // eventTitle composes a notification title, e.g. "Critical: DNS", "Warning: Authentication".
 func eventTitle(e services.SystemEvent) string {
 	prefix := titleCase(e.Severity)

client/vnc/ports.go

@@ -1,31 +0,0 @@
-// Package vnc holds shared constants for the NetBird embedded VNC stack
-// so non-server consumers (CLI capture, debug tooling) can refer to the
-// well-known ports without depending on internal engine packages.
-package vnc
-
-// External and internal listen ports for the embedded VNC server.
-// ExternalPort is what dashboard / browser clients see; the daemon
-// DNATs it to InternalPort, where the in-process VNC server actually
-// listens. Both flow over the WireGuard interface. AgentLegacyPort is
-// the TCP port the per-session agent used before it switched to Unix
-// sockets; kept here so packet captures from older builds still get
-// tagged, and so any future on-wire agent variant has a reserved port.
-const (
-	ExternalPort    uint16 = 5900
-	InternalPort    uint16 = 25900
-	AgentLegacyPort uint16 = 15900
-)
-
-// WellKnownPorts is the unordered set of ports a packet capture should
-// treat as carrying NetBird VNC traffic.
-var WellKnownPorts = [...]uint16{ExternalPort, InternalPort, AgentLegacyPort}
-
-// IsWellKnownPort reports whether port matches any of WellKnownPorts.
-func IsWellKnownPort(port uint16) bool {
-	for _, p := range WellKnownPorts {
-		if port == p {
-			return true
-		}
-	}
-	return false
-}

client/vnc/server/agent_darwin.go

@@ -1,434 +0,0 @@
-//go:build darwin && !ios
-
-package server
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"os"
-	"os/exec"
-	"strconv"
-	"sync"
-	"syscall"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
-
-	"github.com/netbirdio/netbird/client/configs"
-)
-
-// darwinAgentManager spawns a per-user VNC agent on demand and keeps it
-// alive across multiple client connections within the same console-user
-// session. A new agent is spawned the first time a client connects, or
-// whenever the console user changes underneath us.
-//
-// Lifecycle is lazy by design: a daemon that never receives a VNC
-// connection never spawns anything. The trade-off versus an eager spawn
-// (the Windows model) is that the first VNC client pays the launchctl
-// asuser + listen-readiness wait, ~hundreds of milliseconds in practice.
-// That cost only repeats on user switch.
-type darwinAgentManager struct {
-	mu         sync.Mutex
-	authToken  string
-	socketPath string
-	uid        uint32
-	running    bool
-}
-
-func newDarwinAgentManager(ctx context.Context) *darwinAgentManager {
-	m := &darwinAgentManager{}
-	go m.watchConsoleUser(ctx)
-	return m
-}
-
-// agentSocketName is the file name inside the per-uid socket directory
-// the agent binds. The directory itself is created and chowned by the
-// daemon (see prepareAgentSocketDir) so a non-root local user cannot
-// pre-create or symlink the path before the agent listens.
-const agentSocketName = "agent.sock"
-
-// watchConsoleUser kills the cached agent whenever the console user
-// changes (logout, fast user switch, login window). Without it the daemon
-// keeps proxying to an agent whose TCC grant and WindowServer access
-// belong to a user who is no longer at the screen, so the new user only
-// ever sees the locked-screen wallpaper. Killing the agent breaks the
-// loopback TCP that the daemon proxies into, the client disconnects, and
-// the next reconnect runs ensure() against the new console uid.
-func (m *darwinAgentManager) watchConsoleUser(ctx context.Context) {
-	t := time.NewTicker(2 * time.Second)
-	defer t.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-t.C:
-			uid, err := consoleUserID()
-			m.mu.Lock()
-			if !m.running {
-				m.mu.Unlock()
-				continue
-			}
-			if err != nil || uid != m.uid {
-				prev := m.uid
-				m.killLocked()
-				m.mu.Unlock()
-				if err != nil {
-					log.Infof("console user gone (was uid=%d): %v; agent stopped", prev, err)
-				} else {
-					log.Infof("console user changed %d -> %d; agent stopped, will respawn on next connect", prev, uid)
-				}
-				continue
-			}
-			m.mu.Unlock()
-		}
-	}
-}
-
-// Resolve spawns or respawns the per-user agent process as needed and
-// returns its Unix-socket path, shared token, and the uid the agent was
-// spawned under (so the daemon can validate peer credentials before
-// dispatching the token). Each call is serialized so concurrent VNC
-// clients share the same agent.
-func (m *darwinAgentManager) Resolve(ctx context.Context) (string, string, uint32, error) {
-	consoleUID, err := consoleUserID()
-	if err != nil {
-		return "", "", 0, fmt.Errorf("no console user: %w", err)
-	}
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if m.running && m.uid == consoleUID && vncAgentRunning() {
-		return m.socketPath, m.authToken, m.uid, nil
-	}
-	m.killLocked()
-	// Reap stray agents so the new token is the only accepted one.
-	killAllVNCAgents()
-
-	socketDir, err := prepareAgentSocketDir(consoleUID)
-	if err != nil {
-		return "", "", 0, fmt.Errorf("prepare agent socket dir: %w", err)
-	}
-	socketPath := socketDir + "/" + agentSocketName
-	if err := os.Remove(socketPath); err != nil && !errors.Is(err, os.ErrNotExist) {
-		log.Debugf("clear stale agent socket %s: %v", socketPath, err)
-	}
-
-	token, err := generateAuthToken()
-	if err != nil {
-		return "", "", 0, fmt.Errorf("generate agent auth token: %w", err)
-	}
-	if err := spawnAgentForUser(consoleUID, socketPath, token); err != nil {
-		return "", "", 0, err
-	}
-	if err := waitForAgent(ctx, socketPath, 5*time.Second); err != nil {
-		killAllVNCAgents()
-		return "", "", 0, fmt.Errorf("agent did not start listening: %w", err)
-	}
-	m.authToken = token
-	m.socketPath = socketPath
-	m.uid = consoleUID
-	m.running = true
-	log.Infof("spawned VNC agent for console uid=%d on %s", consoleUID, socketPath)
-	return socketPath, token, consoleUID, nil
-}
-
-// prepareAgentSocketDir creates a per-uid subdirectory under the netbird
-// runtime directory where the agent will bind its Unix socket. The leaf is
-// owned by uid with mode 0700, so only the target user and root can write
-// there. The parent is created root-owned with mode 0755 if missing.
-// Symlinks at the per-uid level are refused (replaced with a fresh
-// directory) so a low-priv user cannot redirect the chown that follows.
-func prepareAgentSocketDir(uid uint32) (string, error) {
-	parent := configs.RuntimeDir
-	if err := ensureAgentSocketParent(parent); err != nil {
-		return "", err
-	}
-	subdir := fmt.Sprintf("%s/vnc-%d", parent, uid)
-	if err := purgeStaleAgentSubdir(subdir, uid); err != nil {
-		return "", err
-	}
-	if err := os.Mkdir(subdir, 0o700); err != nil && !errors.Is(err, os.ErrExist) {
-		return "", fmt.Errorf("mkdir %s: %w", subdir, err)
-	}
-	if err := os.Chmod(subdir, 0o700); err != nil {
-		return "", fmt.Errorf("chmod %s: %w", subdir, err)
-	}
-	if err := os.Chown(subdir, int(uid), -1); err != nil {
-		return "", fmt.Errorf("chown %s -> uid %d: %w", subdir, uid, err)
-	}
-	return subdir, nil
-}
-
-// ensureAgentSocketParent verifies the runtime parent dir exists, is not a
-// symlink, and is owned by root.
-func ensureAgentSocketParent(parent string) error {
-	if parent == "" {
-		return fmt.Errorf("no runtime directory configured for this platform")
-	}
-	if err := os.MkdirAll(parent, 0o755); err != nil {
-		return fmt.Errorf("mkdir %s: %w", parent, err)
-	}
-	info, err := os.Lstat(parent)
-	if err != nil {
-		return fmt.Errorf("lstat %s: %w", parent, err)
-	}
-	if info.Mode()&os.ModeSymlink != 0 {
-		return fmt.Errorf("%s is a symlink", parent)
-	}
-	if st, ok := info.Sys().(*syscall.Stat_t); ok && st.Uid != 0 {
-		return fmt.Errorf("%s not owned by root (uid=%d)", parent, st.Uid)
-	}
-	return nil
-}
-
-// purgeStaleAgentSubdir removes a leftover subdir unless it is a real dir
-// owned by uid with mode 0700. Lstat (not Stat) so a symlink is detected.
-func purgeStaleAgentSubdir(subdir string, uid uint32) error {
-	info, err := os.Lstat(subdir)
-	if errors.Is(err, os.ErrNotExist) {
-		return nil
-	}
-	if err != nil {
-		return fmt.Errorf("lstat %s: %w", subdir, err)
-	}
-	if agentSubdirOK(info, uid) {
-		return nil
-	}
-	if err := os.RemoveAll(subdir); err != nil {
-		return fmt.Errorf("remove stale %s: %w", subdir, err)
-	}
-	return nil
-}
-
-func agentSubdirOK(info os.FileInfo, uid uint32) bool {
-	if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
-		return false
-	}
-	st, ok := info.Sys().(*syscall.Stat_t)
-	if !ok {
-		return false
-	}
-	return st.Uid == uid && info.Mode().Perm() == 0o700
-}
-
-// stop terminates the spawned agent, if any. Intended for daemon shutdown.
-func (m *darwinAgentManager) stop() {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.killLocked()
-}
-
-func (m *darwinAgentManager) killLocked() {
-	if !m.running {
-		return
-	}
-	killAllVNCAgents()
-	if m.socketPath != "" {
-		if err := os.Remove(m.socketPath); err != nil && !errors.Is(err, os.ErrNotExist) {
-			log.Debugf("remove agent socket %s: %v", m.socketPath, err)
-		}
-	}
-	m.running = false
-	m.authToken = ""
-	m.socketPath = ""
-	m.uid = 0
-}
-
-// consoleUserID returns the uid of the user currently sitting at the
-// console (the one whose Aqua session is active). Returns
-// errNoConsoleUser when nobody is logged in: at the login window
-// /dev/console is owned by root.
-func consoleUserID() (uint32, error) {
-	info, err := os.Stat("/dev/console")
-	if err != nil {
-		return 0, fmt.Errorf("stat /dev/console: %w", err)
-	}
-	st, ok := info.Sys().(*syscall.Stat_t)
-	if !ok {
-		return 0, fmt.Errorf("/dev/console stat has unexpected type")
-	}
-	if st.Uid == 0 {
-		return 0, errNoConsoleUser
-	}
-	return st.Uid, nil
-}
-
-// spawnAgentForUser uses launchctl asuser to start a netbird vnc-agent
-// process inside the target user's launchd bootstrap namespace. That is
-// the only spawn mode on macOS that gives the child access to the user's
-// WindowServer. The agent's stderr is relogged into the daemon log so
-// startup failures are not silently lost when the readiness check times
-// out.
-func spawnAgentForUser(uid uint32, socketPath, token string) error {
-	exe, err := os.Executable()
-	if err != nil {
-		return fmt.Errorf("resolve own executable: %w", err)
-	}
-	cmd := exec.Command(
-		"/bin/launchctl", "asuser", strconv.FormatUint(uint64(uid), 10),
-		exe, vncAgentSubcommand,
-		"--socket", socketPath,
-		// Drop privs inside the agent: launchctl asuser preserves the
-		// daemon's uid (root), so without this the capture/input/
-		// encoder paths would run as root for the lifetime of the
-		// session. validateAgentPeer on the daemon side also relies on
-		// the agent's effective uid matching consoleUID.
-		"--target-uid", strconv.FormatUint(uint64(uid), 10),
-	)
-	cmd.Env = append(os.Environ(), agentTokenEnvVar+"="+token)
-	stderr, err := cmd.StderrPipe()
-	if err != nil {
-		return fmt.Errorf("agent stderr pipe: %w", err)
-	}
-	if err := cmd.Start(); err != nil {
-		return fmt.Errorf("launchctl asuser: %w", err)
-	}
-	go func() {
-		defer stderr.Close()
-		relogAgentStream(stderr)
-	}()
-	go func() { _ = cmd.Wait() }()
-	return nil
-}
-
-// waitForAgent dials the agent's Unix socket until it answers. Used to
-// gate proxy attempts until the spawned process has finished its Start.
-func waitForAgent(ctx context.Context, socketPath string, wait time.Duration) error {
-	var d net.Dialer
-	deadline := time.Now().Add(wait)
-	for time.Now().Before(deadline) {
-		if ctx.Err() != nil {
-			return ctx.Err()
-		}
-		dialCtx, cancel := context.WithTimeout(ctx, 200*time.Millisecond)
-		c, err := d.DialContext(dialCtx, "unix", socketPath)
-		cancel()
-		if err == nil {
-			_ = c.Close()
-			return nil
-		}
-		time.Sleep(100 * time.Millisecond)
-	}
-	return fmt.Errorf("timeout dialing %s", socketPath)
-}
-
-// vncAgentRunning reports whether any vnc-agent process exists on the
-// system. There is at most one agent per machine, so any match is "the"
-// agent.
-func vncAgentRunning() bool {
-	pids, err := vncAgentPIDs()
-	if err != nil {
-		log.Debugf("scan for vnc-agent: %v", err)
-		return false
-	}
-	return len(pids) > 0
-}
-
-// killAllVNCAgents sends SIGTERM to every process whose argv contains
-// "vnc-agent", waits briefly for them to exit, and escalates to SIGKILL
-// for any that remain. We enumerate kern.proc.all rather than
-// kern.proc.uid because launchctl asuser preserves the caller's uid
-// (root) on the spawned child, so a uid-scoped filter would never match.
-func killAllVNCAgents() {
-	pids, err := vncAgentPIDs()
-	if err != nil {
-		log.Debugf("scan for vnc-agent: %v", err)
-		return
-	}
-	for _, pid := range pids {
-		_ = syscall.Kill(pid, syscall.SIGTERM)
-	}
-	if len(pids) == 0 {
-		return
-	}
-	deadline := time.Now().Add(2 * time.Second)
-	for time.Now().Before(deadline) {
-		remaining, _ := vncAgentPIDs()
-		if len(remaining) == 0 {
-			return
-		}
-		time.Sleep(100 * time.Millisecond)
-	}
-	leftover, _ := vncAgentPIDs()
-	for _, pid := range leftover {
-		_ = syscall.Kill(pid, syscall.SIGKILL)
-	}
-}
-
-// vncAgentPIDs returns the pids of vnc-agent subprocesses spawned from
-// this binary. Matches exactly on argv[0] == our own executable path
-// AND argv[1] == "vnc-agent" so unrelated processes that happen to have
-// the same name elsewhere in argv are not targeted. Skips pid 0 and 1
-// defensively.
-func vncAgentPIDs() ([]int, error) {
-	procs, err := unix.SysctlKinfoProcSlice("kern.proc.all")
-	if err != nil {
-		return nil, fmt.Errorf("sysctl kern.proc.all: %w", err)
-	}
-	ownExe, err := os.Executable()
-	if err != nil {
-		return nil, fmt.Errorf("resolve own executable: %w", err)
-	}
-	var out []int
-	for i := range procs {
-		pid := int(procs[i].Proc.P_pid)
-		if pid <= 1 {
-			continue
-		}
-		argv, err := procArgv(pid)
-		if err != nil || !argvIsVNCAgent(argv, ownExe) {
-			continue
-		}
-		out = append(out, pid)
-	}
-	return out, nil
-}
-
-// procArgv reads the kernel's stored argv for pid via the kern.procargs2
-// sysctl. Format: 4-byte argc, then argv[0..argc) each NUL-terminated,
-// then envp, then padding. We only need argv so we stop after argc.
-func procArgv(pid int) ([]string, error) {
-	raw, err := unix.SysctlRaw("kern.procargs2", pid)
-	if err != nil {
-		return nil, err
-	}
-	if len(raw) < 4 {
-		return nil, fmt.Errorf("procargs2 truncated")
-	}
-	argc := int(raw[0]) | int(raw[1])<<8 | int(raw[2])<<16 | int(raw[3])<<24
-	body := raw[4:]
-	// Skip the executable path (NUL-terminated) and any zero padding that
-	// follows before argv[0].
-	end := bytes.IndexByte(body, 0)
-	if end < 0 {
-		return nil, fmt.Errorf("procargs2 path unterminated")
-	}
-	body = body[end+1:]
-	for len(body) > 0 && body[0] == 0 {
-		body = body[1:]
-	}
-	args := make([]string, 0, argc)
-	for i := 0; i < argc; i++ {
-		end := bytes.IndexByte(body, 0)
-		if end < 0 {
-			break
-		}
-		args = append(args, string(body[:end]))
-		body = body[end+1:]
-	}
-	return args, nil
-}
-
-// argvIsVNCAgent reports whether argv belongs to a vnc-agent subprocess
-// spawned from our binary. Requires argv[0] to match ownExe exactly and
-// argv[1] to be the vnc-agent subcommand. Matches the spawn shape in
-// spawnAgentForUser and rejects anything else.
-func argvIsVNCAgent(argv []string, ownExe string) bool {
-	if len(argv) < 2 || ownExe == "" {
-		return false
-	}
-	return argv[0] == ownExe && argv[1] == vncAgentSubcommand
-}

client/vnc/server/agent_ipc.go

@@ -1,305 +0,0 @@
-//go:build darwin || windows
-
-package server
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	crand "crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// errNoConsoleUser is the sentinel returned by sessionAgent.Resolve when
-// the platform has no interactive user to attach a capture agent to (the
-// macOS loginwindow state). Mapped to a distinct RFB reject code so the
-// browser can show a meaningful message.
-var errNoConsoleUser = errors.New("no user logged into console")
-
-// sessionAgent abstracts the per-platform manager that spawns and tracks
-// the user-session VNC agent. Resolve returns the agent's Unix-socket
-// path, the shared per-spawn token, and the uid the agent was spawned
-// under (used to validate peer credentials before the daemon hands the
-// token to whoever is on the other end of the socket). Resolve may spawn
-// the agent lazily.
-type sessionAgent interface {
-	Resolve(ctx context.Context) (socketPath, token string, peerUID uint32, err error)
-}
-
-// prefixConn replays already-consumed header bytes ahead of the proxy
-// stream by swapping in a different Reader on the same underlying Conn.
-type prefixConn struct {
-	io.Reader
-	net.Conn
-}
-
-func (p *prefixConn) Read(b []byte) (int, error) { return p.Reader.Read(b) }
-
-// handleServiceConnection runs the connection-header handshake (source
-// check, Noise_IK auth) on conn, resolves the right per-session agent
-// via sa, and proxies to it. Every accepted connection emits exactly one
-// outcome line on the daemon log.
-func (s *Server) handleServiceConnection(conn net.Conn, sa sessionAgent) {
-	start := time.Now()
-	connLog := s.log.WithField("remote", conn.RemoteAddr().String())
-
-	if !s.isAllowedSource(conn.RemoteAddr()) {
-		connLog.Info("VNC connection rejected: source not allowed")
-		_ = conn.Close()
-		return
-	}
-
-	var headerBuf bytes.Buffer
-	tee := io.TeeReader(conn, &headerBuf)
-	teeConn := &prefixConn{Reader: tee, Conn: conn}
-
-	header, err := s.readConnectionHeader(teeConn)
-	if err != nil {
-		connLog.Infof("VNC connection rejected: header read failed: %v", err)
-		_ = conn.Close()
-		return
-	}
-
-	authedLog, sessionUserID, ok := s.authorizeSession(conn, header, connLog)
-	if !ok {
-		authedLog.Info("VNC connection rejected: auth failed")
-		return
-	}
-	if err := s.registerConnAuth(conn, header); err != nil {
-		rejectConnection(conn, codeMessage(RejectCodeAuthForbidden, err.Error()))
-		authedLog.Warnf("VNC connection rejected: %v", err)
-		return
-	}
-
-	decision, err := s.gateApproval(conn, header)
-	if err != nil {
-		authedLog.Infof("VNC connection rejected: %v", err)
-		return
-	}
-	if decision.ViewOnly {
-		authedLog.Info("VNC connection approved by user (view-only)")
-	} else if s.requireApproval {
-		authedLog.Info("VNC connection approved by user")
-	}
-
-	socketPath, token, peerUID, err := sa.Resolve(s.ctx)
-	if err != nil {
-		code := RejectCodeCapturerError
-		if errors.Is(err, errNoConsoleUser) {
-			code = RejectCodeNoConsoleUser
-		}
-		rejectConnection(conn, codeMessage(code, err.Error()))
-		authedLog.Warnf("VNC connection rejected: agent unavailable: %v", err)
-		return
-	}
-
-	var initiator string
-	if s.authorizer != nil {
-		initiator = s.authorizer.LookupSessionDisplayName(header.clientStatic)
-	}
-	sessionID := s.addSession(ActiveSessionInfo{
-		RemoteAddress: conn.RemoteAddr().String(),
-		Mode:          modeString(header.mode),
-		Username:      header.username,
-		UserID:        sessionUserID,
-		Initiator:     initiator,
-	}, conn)
-	defer s.removeSession(sessionID)
-
-	replayConn := &prefixConn{
-		Reader: io.MultiReader(&headerBuf, conn),
-		Conn:   conn,
-	}
-	if err := proxyToAgent(s.ctx, replayConn, socketPath, token, peerUID, decision.ViewOnly, authedLog); err != nil {
-		rejectConnection(conn, codeMessage(RejectCodeCapturerError, err.Error()))
-		authedLog.Warnf("VNC connection rejected: agent unreachable: %v", err)
-		return
-	}
-	authedLog.Infof("VNC connection closed (%dms)", time.Since(start).Milliseconds())
-}
-
-const (
-	// agentTokenLen is the size of the random per-spawn token in bytes.
-	agentTokenLen = 32
-
-	// agentTokenEnvVar names the environment variable the daemon uses to
-	// hand the per-spawn token to the agent child. Out-of-band channels
-	// like this keep the secret out of the command line, where listings
-	// such as `ps` or Windows tasklist would expose it.
-	agentTokenEnvVar = "NB_VNC_AGENT_TOKEN" // #nosec G101 -- env var name, not a credential
-
-	// vncAgentSubcommand is the CLI subcommand the daemon invokes to start
-	// the per-session agent process. Must match cmd.vncAgentCmd.Use in
-	// client/cmd/vnc_agent.go.
-	vncAgentSubcommand = "vnc-agent"
-)
-
-// generateAuthToken returns a fresh hex-encoded random token for one
-// daemon→agent session. The daemon hands this to the spawned agent
-// out-of-band (env var on Windows) and verifies it on every connection
-// the agent accepts.
-func generateAuthToken() (string, error) {
-	b := make([]byte, agentTokenLen)
-	if _, err := crand.Read(b); err != nil {
-		return "", fmt.Errorf("read random: %w", err)
-	}
-	return hex.EncodeToString(b), nil
-}
-
-// proxyToAgent dials the per-session agent's Unix socket, validates the
-// peer's kernel-asserted uid (so the daemon never hands its per-spawn
-// token to an impostor that won the listen race), writes the raw token
-// bytes plus a single view-only flag byte, then copies bytes both ways
-// until either side closes. The token + flag prefix must precede any RFB
-// byte so the agent's verifyAgentToken can run first. Returns nil once a
-// stream is established; the caller is responsible for sending an
-// RFB-level rejection on error so the client sees a reason instead of a
-// bare timeout. authedLog receives one audit line per dispatched
-// preamble so an operator can correlate daemon→agent traffic with the
-// remote session that triggered it.
-func proxyToAgent(ctx context.Context, client net.Conn, socketPath, authToken string, peerUID uint32, viewOnly bool, authedLog *log.Entry) error {
-	tokenBytes, err := hex.DecodeString(authToken)
-	if err != nil || len(tokenBytes) != agentTokenLen {
-		return fmt.Errorf("invalid auth token (len=%d): %w", len(tokenBytes), err)
-	}
-
-	agentConn, err := dialAgentWithRetry(ctx, socketPath)
-	if err != nil {
-		return fmt.Errorf("dial agent at %s: %w", socketPath, err)
-	}
-
-	if err := validateAgentPeer(agentConn, peerUID); err != nil {
-		_ = agentConn.Close()
-		return fmt.Errorf("agent peer validation failed: %w", err)
-	}
-
-	preamble := make([]byte, len(tokenBytes)+1)
-	copy(preamble, tokenBytes)
-	if viewOnly {
-		preamble[len(tokenBytes)] = 1
-	}
-	if _, err := agentConn.Write(preamble); err != nil {
-		_ = agentConn.Close()
-		return fmt.Errorf("send auth preamble to agent: %w", err)
-	}
-
-	// Audit: one line per successfully-dispatched daemon→agent preamble.
-	// Token printed as its first 8 hex chars (enough to correlate, not
-	// enough to use). Kept at Info so the default deployment captures it.
-	tokenFp := authToken
-	if len(tokenFp) > 8 {
-		tokenFp = tokenFp[:8]
-	}
-	if authedLog != nil {
-		authedLog.Infof("VNC IPC: dispatched preamble to agent socket=%s peer_uid=%d view_only=%v token_fp=%s", socketPath, peerUID, viewOnly, tokenFp)
-	}
-
-	defer client.Close()
-	defer agentConn.Close()
-	log.Debugf("proxy connected to agent, starting bidirectional copy")
-	done := make(chan struct{}, 2)
-	cp := func(label string, dst, src net.Conn) {
-		n, err := io.Copy(dst, src)
-		log.Debugf("proxy %s: %d bytes, err=%v", label, n, err)
-		done <- struct{}{}
-	}
-	go cp("client->agent", agentConn, client)
-	go cp("agent->client", client, agentConn)
-	<-done
-	return nil
-}
-
-// relogAgentStream reads log lines from the agent's stderr and re-emits
-// them through the daemon's logrus, so the merged log keeps a single
-// format. JSON lines (the agent's normal output) are parsed and dispatched
-// by level; plain-text lines (cobra errors, panic traces) are forwarded
-// verbatim so early-startup failures stay visible.
-func relogAgentStream(r io.Reader) {
-	entry := log.WithField("component", "vnc-agent")
-	scanner := bufio.NewScanner(r)
-	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024)
-	for scanner.Scan() {
-		line := scanner.Bytes()
-		if len(line) == 0 {
-			continue
-		}
-		if line[0] != '{' {
-			entry.Warn(string(line))
-			continue
-		}
-		var m map[string]any
-		if err := json.Unmarshal(line, &m); err != nil {
-			entry.Warn(string(line))
-			continue
-		}
-		msg, _ := m["msg"].(string)
-		if msg == "" {
-			continue
-		}
-		fields := make(log.Fields)
-		for k, v := range m {
-			switch k {
-			case "msg", "level", "time", "func":
-				continue
-			case "caller":
-				fields["source"] = v
-			default:
-				fields[k] = v
-			}
-		}
-		e := entry.WithFields(fields)
-		switch m["level"] {
-		case "error":
-			e.Error(msg)
-		case "warning":
-			e.Warn(msg)
-		case "debug":
-			e.Debug(msg)
-		case "trace":
-			e.Trace(msg)
-		default:
-			e.Info(msg)
-		}
-	}
-}
-
-// dialAgentWithRetry retries the loopback connect for up to ~10 s so the
-// daemon does not race the agent's first listen. Returns the live conn or
-// the final error. Aborts early when ctx is cancelled so a Stop() during
-// service-mode startup doesn't leave a goroutine sleeping for 10 s.
-func dialAgentWithRetry(ctx context.Context, addr string) (net.Conn, error) {
-	var d net.Dialer
-	var lastErr error
-	for range 50 {
-		if err := ctx.Err(); err != nil {
-			if lastErr == nil {
-				lastErr = err
-			}
-			return nil, lastErr
-		}
-		dialCtx, cancel := context.WithTimeout(ctx, time.Second)
-		c, err := d.DialContext(dialCtx, "unix", addr)
-		cancel()
-		if err == nil {
-			return c, nil
-		}
-		lastErr = err
-		select {
-		case <-ctx.Done():
-			if errors.Is(lastErr, context.Canceled) || errors.Is(lastErr, context.DeadlineExceeded) {
-				lastErr = ctx.Err()
-			}
-			return nil, lastErr
-		case <-time.After(200 * time.Millisecond):
-		}
-	}
-	return nil, lastErr
-}

client/vnc/server/agent_peercred_darwin.go

@@ -1,46 +0,0 @@
-//go:build darwin && !ios
-
-package server
-
-import (
-	"fmt"
-	"net"
-
-	"golang.org/x/sys/unix"
-)
-
-// validateAgentPeer enforces that the peer behind the just-connected Unix
-// socket is the agent we expect it to be: a process running under
-// expectedUID, with the right effective uid stamped by the kernel on the
-// socket. Refuses (with a non-nil error) if anything else is listening on
-// the path (an unrelated local process that won the listen race or
-// squatted the path before us). Defends against the daemon shipping its
-// per-spawn auth token to a process that isn't the spawned agent.
-func validateAgentPeer(conn net.Conn, expectedUID uint32) error {
-	uconn, ok := conn.(*net.UnixConn)
-	if !ok {
-		return fmt.Errorf("peer cred: expected *net.UnixConn, got %T", conn)
-	}
-	raw, err := uconn.SyscallConn()
-	if err != nil {
-		return fmt.Errorf("peer cred: syscall conn: %w", err)
-	}
-	var cred *unix.Xucred
-	var inner error
-	ctlErr := raw.Control(func(fd uintptr) {
-		cred, inner = unix.GetsockoptXucred(int(fd), unix.SOL_LOCAL, unix.LOCAL_PEERCRED)
-	})
-	if ctlErr != nil {
-		return fmt.Errorf("peer cred: control: %w", ctlErr)
-	}
-	if inner != nil {
-		return fmt.Errorf("peer cred: getsockopt LOCAL_PEERCRED: %w", inner)
-	}
-	if cred == nil {
-		return fmt.Errorf("peer cred: nil xucred")
-	}
-	if cred.Uid != expectedUID {
-		return fmt.Errorf("peer cred: agent uid %d does not match expected %d", cred.Uid, expectedUID)
-	}
-	return nil
-}

client/vnc/server/agent_peercred_darwin_test.go

@@ -1,115 +0,0 @@
-//go:build darwin && !ios
-
-package server
-
-import (
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-)
-
-// TestValidateAgentPeerAcceptsOwnUID confirms the happy path: a Unix
-// socket whose peer is the current process must validate when the
-// expected uid matches the process's own. Both sides of a unix-socket
-// pair share the same kernel cred, so this exercises the real getsockopt
-// LOCAL_PEERCRED path.
-func TestValidateAgentPeerAcceptsOwnUID(t *testing.T) {
-	dir := t.TempDir()
-	sockPath := filepath.Join(dir, "test.sock")
-	ln, err := net.Listen("unix", sockPath)
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	defer ln.Close()
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		c, err := ln.Accept()
-		if err == nil {
-			_ = c.Close()
-		}
-	}()
-	c, err := net.Dial("unix", sockPath)
-	if err != nil {
-		t.Fatalf("dial: %v", err)
-	}
-	defer c.Close()
-
-	if err := validateAgentPeer(c, uint32(os.Getuid())); err != nil {
-		t.Fatalf("validateAgentPeer rejected own uid: %v", err)
-	}
-	wg.Wait()
-}
-
-// TestValidateAgentPeerRejectsWrongUID ensures the validator fails when
-// the expected uid differs from the kernel-reported peer uid. This is
-// the path that catches a hostile process that won the listen race.
-func TestValidateAgentPeerRejectsWrongUID(t *testing.T) {
-	dir := t.TempDir()
-	sockPath := filepath.Join(dir, "test.sock")
-	ln, err := net.Listen("unix", sockPath)
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	defer ln.Close()
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		c, err := ln.Accept()
-		if err == nil {
-			_ = c.Close()
-		}
-	}()
-	c, err := net.Dial("unix", sockPath)
-	if err != nil {
-		t.Fatalf("dial: %v", err)
-	}
-	defer c.Close()
-
-	// Pick a uid the test process certainly isn't running as.
-	wrongUID := uint32(os.Getuid()) + 1
-	err = validateAgentPeer(c, wrongUID)
-	if err == nil {
-		t.Fatal("expected mismatch error, got nil")
-	}
-	if !strings.Contains(err.Error(), "does not match expected") {
-		t.Fatalf("error should mention uid mismatch, got: %v", err)
-	}
-	wg.Wait()
-}
-
-// TestValidateAgentPeerRejectsNonUnix protects against being handed a
-// non-Unix-socket connection (the validator can't enforce anything on
-// e.g. a *net.TCPConn so it must refuse rather than silently pass).
-func TestValidateAgentPeerRejectsNonUnix(t *testing.T) {
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen tcp: %v", err)
-	}
-	defer ln.Close()
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		c, err := ln.Accept()
-		if err == nil {
-			_ = c.Close()
-		}
-	}()
-	c, err := net.Dial("tcp", ln.Addr().String())
-	if err != nil {
-		t.Fatalf("dial tcp: %v", err)
-	}
-	defer c.Close()
-	if err := validateAgentPeer(c, 0); err == nil {
-		t.Fatal("expected refusal on non-unix conn, got nil")
-	}
-	wg.Wait()
-}

client/vnc/server/agent_peercred_windows.go

@@ -1,31 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"net"
-)
-
-// validateAgentPeer is a documented no-op on Windows. AF_UNIX on Windows
-// exposes no SO_PEERCRED equivalent and no supported API to recover the
-// peer process from an accepted AF_UNIX connection, so the daemon cannot
-// match the connected peer against the agent PID it spawned the way the
-// darwin path does via LOCAL_PEERCRED. The Windows trust model therefore
-// rests on three other measures, none of which assume the socket path is
-// secret:
-//
-//   - the socket lives in a dedicated directory (agentSocketDir) created
-//     with a DACL granting only SYSTEM and Administrators, so an
-//     unprivileged local user cannot create or squat a socket there;
-//   - each spawn uses a cryptographically random socket name, so the path
-//     is unguessable before the agent binds it;
-//   - the daemon publishes the path only after confirming the spawned
-//     agent is listening (see waitForAgentListening), and gates every
-//     connection on the per-spawn auth-token preamble that follows this
-//     call.
-//
-// If a future Windows release exposes peer-PID retrieval for AF_UNIX,
-// this function should verify the peer against the spawned agent PID.
-func validateAgentPeer(_ net.Conn, _ uint32) error {
-	return nil
-}

client/vnc/server/agent_windows.go

@@ -1,747 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"context"
-	crand "crypto/rand"
-	"encoding/binary"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"net"
-	"os"
-	"path/filepath"
-	"runtime"
-	"sync"
-	"time"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-)
-
-const (
-	stillActive = 259
-
-	tokenPrimary          = 1
-	securityImpersonation = 2
-	tokenSessionID        = 12
-
-	createUnicodeEnvironment = 0x00000400
-	createNoWindow           = 0x08000000
-	createSuspended          = 0x00000004
-	createBreakawayFromJob   = 0x01000000
-)
-
-var (
-	kernel32 = windows.NewLazySystemDLL("kernel32.dll")
-	advapi32 = windows.NewLazySystemDLL("advapi32.dll")
-	userenv  = windows.NewLazySystemDLL("userenv.dll")
-
-	procWTSGetActiveConsoleSessionId = kernel32.NewProc("WTSGetActiveConsoleSessionId")
-	procCreateJobObjectW             = kernel32.NewProc("CreateJobObjectW")
-	procSetInformationJobObject      = kernel32.NewProc("SetInformationJobObject")
-	procAssignProcessToJobObject     = kernel32.NewProc("AssignProcessToJobObject")
-	procSetTokenInformation          = advapi32.NewProc("SetTokenInformation")
-	procCreateEnvironmentBlock       = userenv.NewProc("CreateEnvironmentBlock")
-	procDestroyEnvironmentBlock      = userenv.NewProc("DestroyEnvironmentBlock")
-
-	wtsapi32                       = windows.NewLazySystemDLL("wtsapi32.dll")
-	procWTSEnumerateSessionsW      = wtsapi32.NewProc("WTSEnumerateSessionsW")
-	procWTSFreeMemory              = wtsapi32.NewProc("WTSFreeMemory")
-	procWTSQuerySessionInformation = wtsapi32.NewProc("WTSQuerySessionInformationW")
-)
-
-// GetCurrentSessionID returns the session ID of the current process.
-func GetCurrentSessionID() uint32 {
-	var token windows.Token
-	if err := windows.OpenProcessToken(windows.CurrentProcess(),
-		windows.TOKEN_QUERY, &token); err != nil {
-		return 0
-	}
-	defer token.Close()
-	var id uint32
-	var ret uint32
-	_ = windows.GetTokenInformation(token, windows.TokenSessionId,
-		(*byte)(unsafe.Pointer(&id)), 4, &ret)
-	return id
-}
-
-func getConsoleSessionID() uint32 {
-	r, _, _ := procWTSGetActiveConsoleSessionId.Call()
-	return uint32(r)
-}
-
-const (
-	wtsActive       = 0
-	wtsConnected    = 1
-	wtsDisconnected = 4
-)
-
-// getActiveSessionID returns the session ID of the best session to attach to.
-// On a Windows Server with no console display attached, session 1 still
-// reports WTSActive (login screen "owns" the console), so a naive
-// first-active-wins pick lands on a session with no actual rendering.
-// Preference order:
-//  1. Active session with a user logged in (RDP user in session ≥2)
-//  2. Active session without a user (console at login screen)
-//  3. Console session ID
-func getActiveSessionID() uint32 {
-	var sessionInfo uintptr
-	var count uint32
-
-	r, _, _ := procWTSEnumerateSessionsW.Call(
-		0, // WTS_CURRENT_SERVER_HANDLE
-		0, // reserved
-		1, // version
-		uintptr(unsafe.Pointer(&sessionInfo)),
-		uintptr(unsafe.Pointer(&count)),
-	)
-	if r == 0 || count == 0 {
-		return getConsoleSessionID()
-	}
-	defer func() { _, _, _ = procWTSFreeMemory.Call(sessionInfo) }()
-
-	type wtsSession struct {
-		SessionID uint32
-		Station   *uint16
-		State     uint32
-	}
-	sessions := unsafe.Slice((*wtsSession)(unsafe.Pointer(sessionInfo)), count)
-
-	var withUser uint32
-	var withUserFound bool
-	var anyActive uint32
-	var anyActiveFound bool
-	for _, s := range sessions {
-		if s.SessionID == 0 {
-			continue
-		}
-		if s.State != wtsActive {
-			continue
-		}
-		if !anyActiveFound {
-			anyActive = s.SessionID
-			anyActiveFound = true
-		}
-		if !withUserFound && wtsSessionHasUser(s.SessionID) {
-			withUser = s.SessionID
-			withUserFound = true
-		}
-	}
-	if withUserFound {
-		return withUser
-	}
-	if anyActiveFound {
-		return anyActive
-	}
-	return getConsoleSessionID()
-}
-
-// wtsSessionHasUser returns true if the session has a non-empty user name,
-// i.e. someone is logged in (vs. the login/Welcome screen). The console
-// session at the lock screen has WTSUserName == "".
-const wtsUserName = 5
-
-func wtsSessionHasUser(sessionID uint32) bool {
-	var buf uintptr
-	var bytesReturned uint32
-	r, _, _ := procWTSQuerySessionInformation.Call(
-		0, // WTS_CURRENT_SERVER_HANDLE
-		uintptr(sessionID),
-		uintptr(wtsUserName),
-		uintptr(unsafe.Pointer(&buf)),
-		uintptr(unsafe.Pointer(&bytesReturned)),
-	)
-	if r == 0 || buf == 0 {
-		return false
-	}
-	defer func() { _, _, _ = procWTSFreeMemory.Call(buf) }()
-	// First UTF-16 code unit non-zero ⇒ non-empty username.
-	return *(*uint16)(unsafe.Pointer(buf)) != 0
-}
-
-// getSystemTokenForSession duplicates the current SYSTEM token and sets its
-// session ID so the spawned process runs in the target session. Using a SYSTEM
-// token gives access to both Default and Winlogon desktops plus UIPI bypass.
-func getSystemTokenForSession(sessionID uint32) (windows.Token, error) {
-	var cur windows.Token
-	if err := windows.OpenProcessToken(windows.CurrentProcess(),
-		windows.MAXIMUM_ALLOWED, &cur); err != nil {
-		return 0, fmt.Errorf("OpenProcessToken: %w", err)
-	}
-	defer cur.Close()
-
-	var dup windows.Token
-	if err := windows.DuplicateTokenEx(cur, windows.MAXIMUM_ALLOWED, nil,
-		securityImpersonation, tokenPrimary, &dup); err != nil {
-		return 0, fmt.Errorf("DuplicateTokenEx: %w", err)
-	}
-
-	sid := sessionID
-	r, _, err := procSetTokenInformation.Call(
-		uintptr(dup),
-		uintptr(tokenSessionID),
-		uintptr(unsafe.Pointer(&sid)),
-		unsafe.Sizeof(sid),
-	)
-	if r == 0 {
-		dup.Close()
-		return 0, fmt.Errorf("SetTokenInformation(SessionId=%d): %w", sessionID, err)
-	}
-	return dup, nil
-}
-
-// injectEnvVar appends a KEY=VALUE entry to a Unicode environment block.
-// The block is a sequence of null-terminated UTF-16 strings, terminated by
-// an extra null. Returns the new []uint16 backing slice; the caller must
-// hold the returned slice alive until CreateProcessAsUser completes.
-func injectEnvVar(envBlock uintptr, key, value string) []uint16 {
-	entry := key + "=" + value
-
-	// Walk the existing block to find its total length.
-	ptr := (*uint16)(unsafe.Pointer(envBlock))
-	var totalChars int
-	for {
-		ch := *(*uint16)(unsafe.Pointer(uintptr(unsafe.Pointer(ptr)) + uintptr(totalChars)*2))
-		if ch == 0 {
-			// Check for double-null terminator.
-			next := *(*uint16)(unsafe.Pointer(uintptr(unsafe.Pointer(ptr)) + uintptr(totalChars+1)*2))
-			totalChars++
-			if next == 0 {
-				// End of block (don't count the final null yet, we'll rebuild).
-				break
-			}
-		} else {
-			totalChars++
-		}
-	}
-
-	entryUTF16, _ := windows.UTF16FromString(entry)
-	// New block: existing entries + new entry (null-terminated) + final null.
-	newLen := totalChars + len(entryUTF16) + 1
-	newBlock := make([]uint16, newLen)
-	// Copy existing entries (up to but not including the final null).
-	for i := range totalChars {
-		newBlock[i] = *(*uint16)(unsafe.Pointer(uintptr(unsafe.Pointer(ptr)) + uintptr(i)*2))
-	}
-	copy(newBlock[totalChars:], entryUTF16)
-	newBlock[newLen-1] = 0 // final null terminator
-
-	return newBlock
-}
-
-func spawnAgentInSession(sessionID uint32, socketPath, authToken string, jobHandle windows.Handle) (windows.Handle, error) {
-	token, err := getSystemTokenForSession(sessionID)
-	if err != nil {
-		return 0, fmt.Errorf("get SYSTEM token for session %d: %w", sessionID, err)
-	}
-	defer token.Close()
-
-	var envBlock uintptr
-	r, _, e := procCreateEnvironmentBlock.Call(
-		uintptr(unsafe.Pointer(&envBlock)),
-		uintptr(token),
-		0,
-	)
-	if r == 0 {
-		// Without an environment block we cannot inject NB_VNC_AGENT_TOKEN;
-		// the agent would start unauthenticated. Abort instead of launching.
-		return 0, fmt.Errorf("CreateEnvironmentBlock: %w", e)
-	}
-	defer func() { _, _, _ = procDestroyEnvironmentBlock.Call(envBlock) }()
-
-	// Inject the auth token into the environment block so it doesn't appear
-	// in the process command line (visible via tasklist/wmic). injectedBlock
-	// must stay alive until CreateProcessAsUser returns.
-	injectedBlock := injectEnvVar(envBlock, agentTokenEnvVar, authToken)
-
-	exePath, err := os.Executable()
-	if err != nil {
-		return 0, fmt.Errorf("get executable path: %w", err)
-	}
-
-	cmdLine := fmt.Sprintf(`"%s" %s --socket %q`, exePath, vncAgentSubcommand, socketPath)
-	cmdLineW, err := windows.UTF16PtrFromString(cmdLine)
-	if err != nil {
-		return 0, fmt.Errorf("UTF16 cmdline: %w", err)
-	}
-
-	// Create an inheritable pipe for the agent's stderr so we can relog
-	// its output in the service process.
-	var sa windows.SecurityAttributes
-	sa.Length = uint32(unsafe.Sizeof(sa))
-	sa.InheritHandle = 1
-
-	var stderrRead, stderrWrite windows.Handle
-	if err := windows.CreatePipe(&stderrRead, &stderrWrite, &sa, 0); err != nil {
-		return 0, fmt.Errorf("create stderr pipe: %w", err)
-	}
-	// The read end must NOT be inherited by the child.
-	_ = windows.SetHandleInformation(stderrRead, windows.HANDLE_FLAG_INHERIT, 0)
-
-	desktop, _ := windows.UTF16PtrFromString(`WinSta0\Default`)
-	si := windows.StartupInfo{
-		Cb:         uint32(unsafe.Sizeof(windows.StartupInfo{})),
-		Desktop:    desktop,
-		Flags:      windows.STARTF_USESHOWWINDOW | windows.STARTF_USESTDHANDLES,
-		ShowWindow: 0,
-		StdErr:     stderrWrite,
-		StdOutput:  stderrWrite,
-	}
-	var pi windows.ProcessInformation
-
-	var envPtr *uint16
-	if len(injectedBlock) > 0 {
-		envPtr = &injectedBlock[0]
-	} else if envBlock != 0 {
-		envPtr = (*uint16)(unsafe.Pointer(envBlock))
-	}
-
-	// CREATE_SUSPENDED so we can assign the process to our Job Object
-	// before it executes. Without this the agent could spawn its own child
-	// processes and have them inherit the SCM service-job (not ours), or
-	// briefly listen on the agent port before we tear it down on rollback.
-	// CREATE_BREAKAWAY_FROM_JOB lets the child leave the SCM-managed
-	// service job; harmless if that job allows breakaway, and is required
-	// before AssignProcessToJobObject can succeed in the no-nested-jobs case.
-	err = windows.CreateProcessAsUser(
-		token, nil, cmdLineW,
-		nil, nil, true, // inheritHandles=true for the pipe
-		createUnicodeEnvironment|createNoWindow|createSuspended|createBreakawayFromJob,
-		envPtr, nil, &si, &pi,
-	)
-	runtime.KeepAlive(injectedBlock)
-	// Close the write end in the parent so reads will get EOF when the child exits.
-	_ = windows.CloseHandle(stderrWrite)
-	if err != nil {
-		_ = windows.CloseHandle(stderrRead)
-		return 0, fmt.Errorf("CreateProcessAsUser: %w", err)
-	}
-
-	if jobHandle != 0 {
-		r, _, e := procAssignProcessToJobObject.Call(uintptr(jobHandle), uintptr(pi.Process))
-		if r == 0 {
-			log.Warnf("assign agent to job object: %v (orphan possible on service crash)", e)
-		}
-	}
-
-	if _, err := windows.ResumeThread(pi.Thread); err != nil {
-		_ = windows.CloseHandle(pi.Thread)
-		_ = windows.TerminateProcess(pi.Process, 1)
-		_ = windows.CloseHandle(pi.Process)
-		_ = windows.CloseHandle(stderrRead)
-		return 0, fmt.Errorf("ResumeThread: %w", err)
-	}
-	_ = windows.CloseHandle(pi.Thread)
-
-	// Relog agent output in the service with a [vnc-agent] prefix.
-	go relogAgentOutput(stderrRead)
-
-	log.Infof("spawned agent PID=%d in session %d on %s", pi.ProcessId, sessionID, socketPath)
-	return pi.Process, nil
-}
-
-// sessionManager monitors the active console session and ensures a VNC agent
-// process is running in it. When the session changes (e.g., user switch, RDP
-// connect/disconnect), it kills the old agent and spawns a new one. Each
-// spawn picks a per-session Unix-socket path the agent binds and the
-// daemon dials over local IPC.
-type sessionManager struct {
-	mu             sync.Mutex
-	agentProc      windows.Handle
-	everSpawned    bool
-	agentStartedAt time.Time
-	spawnFailures  int
-	nextSpawnAt    time.Time
-	sessionID      uint32
-	authToken      string
-	socketPath     string
-	done           chan struct{}
-	// jobHandle owns the agent processes via a Windows Job Object with
-	// JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE. When the service exits or crashes,
-	// the OS closes the handle and terminates every assigned agent: no
-	// orphaned agent processes holding a socket across restarts.
-	jobHandle windows.Handle
-}
-
-const (
-	// agentSocketDir is a dedicated subdirectory under C:\Windows\Temp that
-	// the daemon creates with a restrictive DACL (SYSTEM + Administrators
-	// only). The default ACL on C:\Windows\Temp grants BUILTIN\Users
-	// create-file rights, so the agent socket must not live directly there:
-	// an unprivileged local user could pre-create a predictable path and
-	// intercept the daemon→agent stream. Both the daemon and the agent run
-	// as SYSTEM, so a SYSTEM-write-only directory is sufficient.
-	agentSocketDir = `C:\Windows\Temp\netbird-vnc`
-
-	// agentSocketDirSDDL grants full access to Local System (SY) and the
-	// Builtin Administrators group (BA) only, with the DACL protected
-	// (P) from inheritance so the parent's BUILTIN\Users grant does not
-	// flow in. AI is omitted; PAI marks the DACL protected and auto-
-	// inherited entries cleared.
-	agentSocketDirSDDL = "D:PAI(A;;FA;;;SY)(A;;FA;;;BA)"
-
-	// agentSocketRandomLen is the number of random bytes mixed into each
-	// per-spawn socket name so the path is unguessable before the agent
-	// owns it.
-	agentSocketRandomLen = 16
-
-	// agentReadyTimeout bounds how long the daemon waits for the freshly
-	// spawned agent to bind and accept on its socket before treating the
-	// spawn as failed.
-	agentReadyTimeout = 5 * time.Second
-)
-
-func newSessionManager() *sessionManager {
-	m := &sessionManager{sessionID: ^uint32(0), done: make(chan struct{})}
-	if h, err := createKillOnCloseJob(); err != nil {
-		log.Warnf("create job object for vnc-agent (orphan agents possible after crash): %v", err)
-	} else {
-		m.jobHandle = h
-	}
-	return m
-}
-
-// createKillOnCloseJob returns a Job Object configured so that closing its
-// handle (process exit or explicit Close) terminates every process assigned
-// to it. Used to keep orphaned vnc-agent processes from outliving the service.
-func createKillOnCloseJob() (windows.Handle, error) {
-	r, _, e := procCreateJobObjectW.Call(0, 0)
-	if r == 0 {
-		return 0, fmt.Errorf("CreateJobObject: %w", e)
-	}
-	job := windows.Handle(r)
-
-	// JOBOBJECT_EXTENDED_LIMIT_INFORMATION on amd64 = 144 bytes.
-	//
-	//  JOBOBJECT_BASIC_LIMIT_INFORMATION  (64 bytes with alignment padding)
-	//    PerProcessUserTimeLimit  LARGE_INTEGER  off  0
-	//    PerJobUserTimeLimit      LARGE_INTEGER  off  8
-	//    LimitFlags               DWORD          off 16
-	//    [4 byte pad to align SIZE_T]
-	//    MinimumWorkingSetSize    SIZE_T         off 24
-	//    MaximumWorkingSetSize    SIZE_T         off 32
-	//    ActiveProcessLimit       DWORD          off 40
-	//    [4 byte pad to align ULONG_PTR]
-	//    Affinity                 ULONG_PTR      off 48
-	//    PriorityClass            DWORD          off 56
-	//    SchedulingClass          DWORD          off 60
-	//  IO_COUNTERS (48)  +  4 * SIZE_T (32)  =  144 total.
-	//
-	// We only set LimitFlags; the rest stays zero.
-	const sizeofExtended = 144
-	const offsetLimitFlags = 16
-	const jobObjectExtendedLimitInformation = 9
-	const jobObjectLimitKillOnJobClose = 0x00002000
-
-	var info [sizeofExtended]byte
-	binary.LittleEndian.PutUint32(info[offsetLimitFlags:offsetLimitFlags+4], jobObjectLimitKillOnJobClose)
-
-	r, _, e = procSetInformationJobObject.Call(
-		uintptr(job),
-		uintptr(jobObjectExtendedLimitInformation),
-		uintptr(unsafe.Pointer(&info[0])),
-		uintptr(sizeofExtended),
-	)
-	if r == 0 {
-		_ = windows.CloseHandle(job)
-		return 0, fmt.Errorf("SetInformationJobObject(KILL_ON_JOB_CLOSE): %w", e)
-	}
-	return job, nil
-}
-
-// Resolve returns the current agent socket path, shared token, and the
-// uid the agent runs under (0 on Windows since the agent runs as
-// SYSTEM in the interactive session; see validateAgentPeer for the
-// Windows trust model). The path is only published after the spawned
-// agent is confirmed listening, so a caller never receives a socket a
-// squatter could be holding. When no agent is spawned yet (initial
-// boot, between session switches, or permanently disabled when
-// SE_TCB_NAME is missing) it surfaces a distinct error so the daemon
-// can reject the connection with a meaningful message instead of timing
-// out the proxy dial.
-func (m *sessionManager) Resolve(_ context.Context) (string, string, uint32, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if m.socketPath == "" {
-		return "", "", 0, errAgentNotReady
-	}
-	return m.socketPath, m.authToken, 0, nil
-}
-
-var errAgentNotReady = errors.New("VNC agent not running yet")
-
-// Stop signals the session manager to exit its polling loop and closes the
-// Job Object handle, which Windows uses as the trigger to terminate every
-// agent process this manager spawned.
-func (m *sessionManager) Stop() {
-	select {
-	case <-m.done:
-	default:
-		close(m.done)
-	}
-	m.mu.Lock()
-	if m.jobHandle != 0 {
-		_ = windows.CloseHandle(m.jobHandle)
-		m.jobHandle = 0
-	}
-	m.mu.Unlock()
-}
-
-func (m *sessionManager) run() {
-	ticker := time.NewTicker(2 * time.Second)
-	defer ticker.Stop()
-
-	for {
-		if !m.tick() {
-			return
-		}
-		select {
-		case <-m.done:
-			m.mu.Lock()
-			m.killAgent()
-			m.mu.Unlock()
-			return
-		case <-ticker.C:
-		}
-	}
-}
-
-// tick performs one session/agent-state update. Returns false if the manager
-// should permanently stop (e.g. missing SYSTEM privileges).
-func (m *sessionManager) tick() bool {
-	sid := getActiveSessionID()
-
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	m.handleSessionChange(sid)
-	m.reapExitedAgent()
-	return m.maybeSpawnAgent(sid)
-}
-
-func (m *sessionManager) handleSessionChange(sid uint32) {
-	if sid == m.sessionID {
-		return
-	}
-	log.Infof("active session changed: %d -> %d", m.sessionID, sid)
-	m.killAgent()
-	m.sessionID = sid
-}
-
-func (m *sessionManager) reapExitedAgent() {
-	if m.agentProc == 0 {
-		return
-	}
-	var code uint32
-	if err := windows.GetExitCodeProcess(m.agentProc, &code); err != nil {
-		log.Debugf("GetExitCodeProcess: %v", err)
-		return
-	}
-	if code == stillActive {
-		return
-	}
-	m.scheduleNextSpawn(code, time.Since(m.agentStartedAt))
-	if err := windows.CloseHandle(m.agentProc); err != nil {
-		log.Debugf("close agent handle: %v", err)
-	}
-	m.agentProc = 0
-	m.authToken = ""
-	m.socketPath = ""
-}
-
-// scheduleNextSpawn applies an exponential backoff on fast crashes (<5s) and
-// resets immediately otherwise.
-func (m *sessionManager) scheduleNextSpawn(exitCode uint32, lifetime time.Duration) {
-	if lifetime < 5*time.Second {
-		m.spawnFailures++
-		backoff := time.Duration(1<<min(m.spawnFailures, 5)) * time.Second
-		if backoff > 30*time.Second {
-			backoff = 30 * time.Second
-		}
-		m.nextSpawnAt = time.Now().Add(backoff)
-		log.Warnf("agent exited (code=%d) after %v, retrying in %v (failures=%d)", exitCode, lifetime.Round(time.Millisecond), backoff, m.spawnFailures)
-		return
-	}
-	m.spawnFailures = 0
-	m.nextSpawnAt = time.Time{}
-	log.Infof("agent exited (code=%d) after %v, respawning", exitCode, lifetime.Round(time.Second))
-}
-
-// maybeSpawnAgent spawns a new agent if there's no current one and the backoff
-// window has elapsed. Returns false to permanently stop the manager when the
-// service lacks the privileges needed to spawn cross-session.
-func (m *sessionManager) maybeSpawnAgent(sid uint32) bool {
-	if m.agentProc != 0 || sid == 0xFFFFFFFF || !time.Now().After(m.nextSpawnAt) {
-		return true
-	}
-
-	if err := ensureAgentSocketDir(); err != nil {
-		log.Warnf("prepare agent socket dir: %v", err)
-		m.nextSpawnAt = time.Now().Add(5 * time.Second)
-		return true
-	}
-
-	// The leaf name carries a cryptographically random component so a local
-	// user cannot pre-create the path at a guessable location. The session
-	// id is kept for diagnostics only; security does not rely on it.
-	socketPath, err := newAgentSocketPath(sid)
-	if err != nil {
-		log.Warnf("generate agent socket path: %v", err)
-		return true
-	}
-	// Covers a previous-run crash that escaped Job Object kill-on-close.
-	if err := os.Remove(socketPath); err != nil && !os.IsNotExist(err) {
-		log.Debugf("clear stale agent socket %s: %v", socketPath, err)
-	}
-	token, err := generateAuthToken()
-	if err != nil {
-		log.Warnf("generate agent auth token: %v", err)
-		return true
-	}
-	h, err := spawnAgentInSession(sid, socketPath, token, m.jobHandle)
-	if err != nil {
-		if errors.Is(err, windows.ERROR_PRIVILEGE_NOT_HELD) {
-			// SE_TCB_NAME (token-impersonation across sessions) is only
-			// granted to SYSTEM. Without it spawnAgent will fail every 2
-			// seconds forever: log once and give up.
-			log.Warnf("VNC service mode disabled: agent spawn requires SYSTEM privileges (got: %v)", err)
-			return false
-		}
-		log.Warnf("spawn agent in session %d: %v", sid, err)
-		return true
-	}
-
-	// Gate on listen-readiness before publishing the path: do not hand a
-	// caller a socket the agent has not bound yet. On timeout, fail closed
-	// by killing the agent and leaving socketPath/authToken unset so
-	// Resolve keeps returning errAgentNotReady.
-	if err := waitForAgentListening(socketPath, agentReadyTimeout); err != nil {
-		log.Warnf("agent in session %d did not start listening: %v", sid, err)
-		_ = windows.TerminateProcess(h, 1)
-		_ = windows.CloseHandle(h)
-		if rmErr := os.Remove(socketPath); rmErr != nil && !os.IsNotExist(rmErr) {
-			log.Debugf("clear unready agent socket %s: %v", socketPath, rmErr)
-		}
-		m.scheduleNextSpawn(0, 0)
-		return true
-	}
-
-	m.authToken = token
-	m.socketPath = socketPath
-	m.agentProc = h
-	m.agentStartedAt = time.Now()
-	m.everSpawned = true
-	return true
-}
-
-// ensureAgentSocketDir creates the dedicated socket directory with a
-// restrictive DACL (SYSTEM + Administrators only). A pre-existing directory
-// is torn down and recreated rather than reused: it may have been created by
-// an unprivileged user with a permissive ACL, and it only ever holds our
-// transient sockets, so removing it loses nothing. Fails closed: returns an
-// error if the directory cannot be created with the intended security.
-func ensureAgentSocketDir() error {
-	sd, err := windows.SecurityDescriptorFromString(agentSocketDirSDDL)
-	if err != nil {
-		return fmt.Errorf("parse socket dir SDDL: %w", err)
-	}
-	var sa windows.SecurityAttributes
-	sa.Length = uint32(unsafe.Sizeof(sa))
-	sa.SecurityDescriptor = sd
-
-	dirW, err := windows.UTF16PtrFromString(agentSocketDir)
-	if err != nil {
-		return fmt.Errorf("encode socket dir path: %w", err)
-	}
-	err = windows.CreateDirectory(dirW, &sa)
-	if errors.Is(err, windows.ERROR_ALREADY_EXISTS) {
-		if rmErr := os.RemoveAll(agentSocketDir); rmErr != nil {
-			return fmt.Errorf("remove pre-existing socket dir %s: %w", agentSocketDir, rmErr)
-		}
-		err = windows.CreateDirectory(dirW, &sa)
-	}
-	if err != nil {
-		return fmt.Errorf("create socket dir %s: %w", agentSocketDir, err)
-	}
-	return nil
-}
-
-// newAgentSocketPath returns a per-spawn socket path inside the secured
-// socket directory. The leaf name mixes a cryptographically random component
-// with the session id (for diagnostics) so the path is unguessable before the
-// agent binds it.
-func newAgentSocketPath(sessionID uint32) (string, error) {
-	b := make([]byte, agentSocketRandomLen)
-	if _, err := crand.Read(b); err != nil {
-		return "", fmt.Errorf("read random: %w", err)
-	}
-	name := fmt.Sprintf("netbird-vnc-%d-%s.sock", sessionID, hex.EncodeToString(b))
-	return filepath.Join(agentSocketDir, name), nil
-}
-
-// waitForAgentListening dials the agent's Unix socket until it answers or the
-// timeout elapses. Mirrors the darwin readiness gate so the daemon never
-// exposes a socket path before the legitimate agent owns it.
-func waitForAgentListening(socketPath string, wait time.Duration) error {
-	var d net.Dialer
-	deadline := time.Now().Add(wait)
-	var lastErr error
-	for time.Now().Before(deadline) {
-		c, err := d.Dial("unix", socketPath)
-		if err == nil {
-			_ = c.Close()
-			return nil
-		}
-		lastErr = err
-		time.Sleep(100 * time.Millisecond)
-	}
-	if lastErr == nil {
-		lastErr = fmt.Errorf("timeout")
-	}
-	return fmt.Errorf("dial %s: %w", socketPath, lastErr)
-}
-
-func (m *sessionManager) killAgent() {
-	if m.agentProc == 0 {
-		return
-	}
-	_ = windows.TerminateProcess(m.agentProc, 0)
-	_ = windows.CloseHandle(m.agentProc)
-	m.agentProc = 0
-	m.authToken = ""
-	m.socketPath = ""
-	log.Info("killed old agent")
-}
-
-// relogAgentOutput reads log lines from the agent's stderr pipe and
-// relogs them with the service's formatter. The *os.File owns the
-// underlying handle, so closing it suffices.
-func relogAgentOutput(pipe windows.Handle) {
-	f := os.NewFile(uintptr(pipe), "vnc-agent-stderr")
-	defer func() { _ = f.Close() }()
-	relogAgentStream(f)
-}
-
-// logCleanupCall invokes a Windows syscall used solely as a cleanup primitive
-// (CloseClipboard, ReleaseDC, etc.) and logs failures at trace level. The
-// indirection lets us satisfy errcheck without scattering ignored returns at
-// each call site, while still capturing diagnostic info when the OS reports
-// a failure.
-func logCleanupCall(name string, proc *windows.LazyProc) {
-	r, _, err := proc.Call()
-	if r == 0 && err != nil && err != windows.NTE_OP_OK {
-		log.Tracef("%s: %v", name, err)
-	}
-}
-
-// logCleanupCallArgs is logCleanupCall with one argument; common pattern for
-// release-by-handle syscalls.
-func logCleanupCallArgs(name string, proc *windows.LazyProc, args ...uintptr) {
-	r, _, err := proc.Call(args...)
-	if r == 0 && err != nil && err != windows.NTE_OP_OK {
-		log.Tracef("%s: %v", name, err)
-	}
-}

client/vnc/server/capture_darwin.go

@@ -1,631 +0,0 @@
-//go:build darwin && !ios
-
-package server
-
-import (
-	"errors"
-	"fmt"
-	"hash/maphash"
-	"image"
-	"os"
-	"runtime"
-	"strconv"
-	"sync"
-	"sync/atomic"
-	"time"
-	"unsafe"
-
-	"github.com/ebitengine/purego"
-	log "github.com/sirupsen/logrus"
-)
-
-var darwinCaptureOnce sync.Once
-
-var (
-	cgMainDisplayID              func() uint32
-	cgDisplayPixelsWide          func(uint32) uintptr
-	cgDisplayPixelsHigh          func(uint32) uintptr
-	cgDisplayCreateImage         func(uint32) uintptr
-	cgImageGetWidth              func(uintptr) uintptr
-	cgImageGetHeight             func(uintptr) uintptr
-	cgImageGetBytesPerRow        func(uintptr) uintptr
-	cgImageGetBitsPerPixel       func(uintptr) uintptr
-	cgImageGetDataProvider       func(uintptr) uintptr
-	cgDataProviderCopyData       func(uintptr) uintptr
-	cgImageRelease               func(uintptr)
-	cfDataGetLength              func(uintptr) int64
-	cfDataGetBytePtr             func(uintptr) uintptr
-	cfRelease                    func(uintptr)
-	cgRequestScreenCaptureAccess func() bool
-	cgEventCreate                func(uintptr) uintptr
-	cgEventGetLocation           func(uintptr) cgPoint
-	darwinCaptureReady           bool
-)
-
-// cgPoint mirrors CoreGraphics CGPoint: two doubles, 16 bytes, returned
-// in registers on Darwin amd64/arm64. Used to receive cursor coordinates
-// from CGEventGetLocation via purego.
-type cgPoint struct {
-	X, Y float64
-}
-
-func initDarwinCapture() {
-	darwinCaptureOnce.Do(func() {
-		cg, err := purego.Dlopen("/System/Library/Frameworks/CoreGraphics.framework/CoreGraphics", purego.RTLD_NOW|purego.RTLD_GLOBAL)
-		if err != nil {
-			log.Debugf("load CoreGraphics: %v", err)
-			return
-		}
-		cf, err := purego.Dlopen("/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation", purego.RTLD_NOW|purego.RTLD_GLOBAL)
-		if err != nil {
-			log.Debugf("load CoreFoundation: %v", err)
-			return
-		}
-
-		purego.RegisterLibFunc(&cgMainDisplayID, cg, "CGMainDisplayID")
-		purego.RegisterLibFunc(&cgDisplayPixelsWide, cg, "CGDisplayPixelsWide")
-		purego.RegisterLibFunc(&cgDisplayPixelsHigh, cg, "CGDisplayPixelsHigh")
-		purego.RegisterLibFunc(&cgDisplayCreateImage, cg, "CGDisplayCreateImage")
-		purego.RegisterLibFunc(&cgImageGetWidth, cg, "CGImageGetWidth")
-		purego.RegisterLibFunc(&cgImageGetHeight, cg, "CGImageGetHeight")
-		purego.RegisterLibFunc(&cgImageGetBytesPerRow, cg, "CGImageGetBytesPerRow")
-		purego.RegisterLibFunc(&cgImageGetBitsPerPixel, cg, "CGImageGetBitsPerPixel")
-		purego.RegisterLibFunc(&cgImageGetDataProvider, cg, "CGImageGetDataProvider")
-		purego.RegisterLibFunc(&cgDataProviderCopyData, cg, "CGDataProviderCopyData")
-		purego.RegisterLibFunc(&cgImageRelease, cg, "CGImageRelease")
-		purego.RegisterLibFunc(&cfDataGetLength, cf, "CFDataGetLength")
-		purego.RegisterLibFunc(&cfDataGetBytePtr, cf, "CFDataGetBytePtr")
-		purego.RegisterLibFunc(&cfRelease, cf, "CFRelease")
-
-		// CGRequestScreenCaptureAccess (macOS 11+) prompts on first call and
-		// is a cheap no-op once granted. The Preflight companion is unreliable
-		// on Sequoia (returns false even when access is granted), so we drive
-		// the permission flow from actual capture failures instead.
-		if sym, err := purego.Dlsym(cg, "CGRequestScreenCaptureAccess"); err == nil {
-			purego.RegisterFunc(&cgRequestScreenCaptureAccess, sym)
-		}
-		// CGEventCreate / CGEventGetLocation feed the cursor position used
-		// by remote-cursor compositing. Optional; absence reports as a
-		// position-source error and disables that feature on this host.
-		if sym, err := purego.Dlsym(cg, "CGEventCreate"); err == nil {
-			purego.RegisterFunc(&cgEventCreate, sym)
-		}
-		if sym, err := purego.Dlsym(cg, "CGEventGetLocation"); err == nil {
-			purego.RegisterFunc(&cgEventGetLocation, sym)
-		}
-
-		darwinCaptureReady = true
-	})
-}
-
-// CGCapturer captures the macOS main display using Core Graphics.
-type CGCapturer struct {
-	displayID uint32
-	w, h      int
-	// downscale is 1 for pixel-perfect, 2 for Retina 2:1 box-filter downscale.
-	downscale int
-	hashSeed  maphash.Seed
-	lastHash  uint64
-	hasHash   bool
-	// cursor lazily binds the private CGSCreateCurrentCursorImage symbol
-	// so we can emit the Cursor pseudo-encoding without a per-frame cost
-	// on builds that never query it.
-	cursorOnce sync.Once
-	cursor     *cgCursor
-}
-
-// PrimeScreenCapturePermission triggers the macOS Screen Recording
-// permission prompt without creating a full capturer. The platform wiring
-// calls this at VNC-server enable time so the user sees the prompt the
-// moment they turn the feature on. CGRequestScreenCaptureAccess is a
-// no-op when the grant already exists, so calling it on every enable is
-// cheap and safe.
-func PrimeScreenCapturePermission() {
-	initDarwinCapture()
-	if !darwinCaptureReady {
-		return
-	}
-	if cgRequestScreenCaptureAccess != nil {
-		cgRequestScreenCaptureAccess()
-	}
-}
-
-// notifyScreenRecordingMissing nudges the user once per agent process to
-// approve Screen Recording. The capturer init retries on backoff when the
-// grant is missing; without the sync.Once we would reopen System Settings
-// every tick and flood the daemon log with the same warning.
-var screenRecordingNotifyOnce sync.Once
-
-func notifyScreenRecordingMissing() {
-	screenRecordingNotifyOnce.Do(func() {
-		if cgRequestScreenCaptureAccess != nil {
-			cgRequestScreenCaptureAccess()
-		}
-		openPrivacyPane("Privacy_ScreenCapture")
-		log.Warn("Screen Recording permission not granted. " +
-			"Opened System Settings > Privacy & Security > Screen Recording; enable netbird and restart.")
-	})
-}
-
-// NewCGCapturer creates a screen capturer for the main display.
-func NewCGCapturer() (*CGCapturer, error) {
-	initDarwinCapture()
-	if !darwinCaptureReady {
-		return nil, fmt.Errorf("CoreGraphics not available")
-	}
-
-	displayID := cgMainDisplayID()
-	c := &CGCapturer{displayID: displayID, downscale: 1, hashSeed: maphash.MakeSeed()}
-
-	img, err := c.Capture()
-	if err != nil {
-		notifyScreenRecordingMissing()
-		return nil, fmt.Errorf("probe capture: %w", err)
-	}
-	nativeW := img.Rect.Dx()
-	nativeH := img.Rect.Dy()
-	c.hasHash = false
-	if nativeW == 0 || nativeH == 0 {
-		return nil, errors.New("display dimensions are zero")
-	}
-
-	logicalW := int(cgDisplayPixelsWide(displayID))
-	logicalH := int(cgDisplayPixelsHigh(displayID))
-
-	// Enable 2:1 downscale on Retina unless explicitly disabled. Cuts pixel
-	// count 4x, shrinking convert, diff, and wire data proportionally.
-	if !retinaDownscaleDisabled() && nativeW >= 2*logicalW && nativeH >= 2*logicalH && nativeW%2 == 0 && nativeH%2 == 0 {
-		c.downscale = 2
-	}
-	c.w = nativeW / c.downscale
-	c.h = nativeH / c.downscale
-
-	log.Infof("macOS capturer ready: %dx%d (native %dx%d, logical %dx%d, downscale=%d, display=%d)",
-		c.w, c.h, nativeW, nativeH, logicalW, logicalH, c.downscale, displayID)
-	return c, nil
-}
-
-func retinaDownscaleDisabled() bool {
-	v := os.Getenv(EnvVNCDisableDownscale)
-	if v == "" {
-		return false
-	}
-	disabled, err := strconv.ParseBool(v)
-	if err != nil {
-		log.Warnf("parse %s: %v", EnvVNCDisableDownscale, err)
-		return false
-	}
-	return disabled
-}
-
-// Width returns the screen width.
-func (c *CGCapturer) Width() int { return c.w }
-
-// Height returns the screen height.
-func (c *CGCapturer) Height() int { return c.h }
-
-// CaptureInto writes a fresh frame directly into dst, skipping the
-// per-frame image.RGBA allocation that Capture() does. It always fills
-// dst: the capturer is shared across all sessions, so dedup here would
-// starve every consumer but the first one to poll after a change.
-// Per-session prevFrame diffing in the session layer handles no-op frames.
-func (c *CGCapturer) CaptureInto(dst *image.RGBA) error {
-	cgImage := cgDisplayCreateImage(c.displayID)
-	if cgImage == 0 {
-		return fmt.Errorf("CGDisplayCreateImage returned nil (screen recording permission?)")
-	}
-	defer cgImageRelease(cgImage)
-	w := int(cgImageGetWidth(cgImage))
-	h := int(cgImageGetHeight(cgImage))
-	bytesPerRow := int(cgImageGetBytesPerRow(cgImage))
-	bpp := int(cgImageGetBitsPerPixel(cgImage))
-	provider := cgImageGetDataProvider(cgImage)
-	if provider == 0 {
-		return fmt.Errorf("CGImageGetDataProvider returned nil")
-	}
-	cfData := cgDataProviderCopyData(provider)
-	if cfData == 0 {
-		return fmt.Errorf("CGDataProviderCopyData returned nil")
-	}
-	defer cfRelease(cfData)
-	dataLen := int(cfDataGetLength(cfData))
-	dataPtr := cfDataGetBytePtr(cfData)
-	if dataPtr == 0 || dataLen == 0 {
-		return fmt.Errorf("empty image data")
-	}
-	src := unsafe.Slice((*byte)(unsafe.Pointer(dataPtr)), dataLen)
-
-	ds := c.downscale
-	if ds < 1 {
-		ds = 1
-	}
-	outW := w / ds
-	outH := h / ds
-	if dst.Rect.Dx() != outW || dst.Rect.Dy() != outH {
-		return fmt.Errorf("dst size mismatch: dst=%dx%d capturer=%dx%d",
-			dst.Rect.Dx(), dst.Rect.Dy(), outW, outH)
-	}
-	bytesPerPixel := bpp / 8
-	if bytesPerPixel == 4 && ds == 1 {
-		convertBGRAToRGBA(dst.Pix, dst.Stride, src, bytesPerRow, w, h)
-		return nil
-	}
-	if bytesPerPixel == 4 && ds == 2 {
-		convertBGRAToRGBADownscale2(dst.Pix, dst.Stride, src, bytesPerRow, outW, outH)
-		return nil
-	}
-	for row := 0; row < outH; row++ {
-		srcOff := row * ds * bytesPerRow
-		dstOff := row * dst.Stride
-		for col := 0; col < outW; col++ {
-			si := srcOff + col*ds*bytesPerPixel
-			di := dstOff + col*4
-			dst.Pix[di+0] = src[si+2]
-			dst.Pix[di+1] = src[si+1]
-			dst.Pix[di+2] = src[si+0]
-			dst.Pix[di+3] = 0xff
-		}
-	}
-	return nil
-}
-
-func (c *CGCapturer) Capture() (*image.RGBA, error) {
-	cgImage := cgDisplayCreateImage(c.displayID)
-	if cgImage == 0 {
-		return nil, fmt.Errorf("CGDisplayCreateImage returned nil (screen recording permission?)")
-	}
-	defer cgImageRelease(cgImage)
-
-	w := int(cgImageGetWidth(cgImage))
-	h := int(cgImageGetHeight(cgImage))
-	bytesPerRow := int(cgImageGetBytesPerRow(cgImage))
-	bpp := int(cgImageGetBitsPerPixel(cgImage))
-
-	provider := cgImageGetDataProvider(cgImage)
-	if provider == 0 {
-		return nil, fmt.Errorf("CGImageGetDataProvider returned nil")
-	}
-
-	cfData := cgDataProviderCopyData(provider)
-	if cfData == 0 {
-		return nil, fmt.Errorf("CGDataProviderCopyData returned nil")
-	}
-	defer cfRelease(cfData)
-
-	dataLen := int(cfDataGetLength(cfData))
-	dataPtr := cfDataGetBytePtr(cfData)
-	if dataPtr == 0 || dataLen == 0 {
-		return nil, fmt.Errorf("empty image data")
-	}
-
-	src := unsafe.Slice((*byte)(unsafe.Pointer(dataPtr)), dataLen)
-
-	hash := maphash.Bytes(c.hashSeed, src)
-	if c.hasHash && hash == c.lastHash {
-		return nil, errFrameUnchanged
-	}
-	c.lastHash = hash
-	c.hasHash = true
-
-	ds := c.downscale
-	if ds < 1 {
-		ds = 1
-	}
-	outW := w / ds
-	outH := h / ds
-	img := image.NewRGBA(image.Rect(0, 0, outW, outH))
-
-	bytesPerPixel := bpp / 8
-	switch {
-	case bytesPerPixel == 4 && ds == 1:
-		convertBGRAToRGBA(img.Pix, img.Stride, src, bytesPerRow, w, h)
-	case bytesPerPixel == 4 && ds == 2:
-		convertBGRAToRGBADownscale2(img.Pix, img.Stride, src, bytesPerRow, outW, outH)
-	default:
-		convertBGRAToRGBAGeneric(img.Pix, img.Stride, src, bytesPerRow, bgraDownscaleParams{outW: outW, outH: outH, bytesPerPixel: bytesPerPixel, ds: ds})
-	}
-
-	return img, nil
-}
-
-type bgraDownscaleParams struct {
-	outW, outH, bytesPerPixel, ds int
-}
-
-// convertBGRAToRGBAGeneric is the slow per-pixel fallback for non-4-bytes
-// or non-1/2 downscale formats. Always available regardless of the source
-// format quirks the fast paths optimize for.
-func convertBGRAToRGBAGeneric(dst []byte, dstStride int, src []byte, srcStride int, p bgraDownscaleParams) {
-	for row := 0; row < p.outH; row++ {
-		srcOff := row * p.ds * srcStride
-		dstOff := row * dstStride
-		for col := 0; col < p.outW; col++ {
-			si := srcOff + col*p.ds*p.bytesPerPixel
-			di := dstOff + col*4
-			dst[di+0] = src[si+2]
-			dst[di+1] = src[si+1]
-			dst[di+2] = src[si+0]
-			dst[di+3] = 0xff
-		}
-	}
-}
-
-// convertBGRAToRGBADownscale2 averages every 2x2 BGRA block into one RGBA
-// output pixel, parallelised across GOMAXPROCS cores. outW and outH are the
-// destination dimensions (source is 2*outW by 2*outH).
-func convertBGRAToRGBADownscale2(dst []byte, dstStride int, src []byte, srcStride, outW, outH int) {
-	workers := runtime.GOMAXPROCS(0)
-	if workers > outH {
-		workers = outH
-	}
-	if workers < 1 || outH < 32 {
-		workers = 1
-	}
-
-	convertRows := func(y0, y1 int) {
-		for row := y0; row < y1; row++ {
-			srcRow0 := 2 * row * srcStride
-			srcRow1 := srcRow0 + srcStride
-			dstOff := row * dstStride
-			for col := 0; col < outW; col++ {
-				s0 := srcRow0 + col*8
-				s1 := srcRow1 + col*8
-				b := (uint32(src[s0]) + uint32(src[s0+4]) + uint32(src[s1]) + uint32(src[s1+4])) >> 2
-				g := (uint32(src[s0+1]) + uint32(src[s0+5]) + uint32(src[s1+1]) + uint32(src[s1+5])) >> 2
-				r := (uint32(src[s0+2]) + uint32(src[s0+6]) + uint32(src[s1+2]) + uint32(src[s1+6])) >> 2
-				di := dstOff + col*4
-				dst[di+0] = byte(r)
-				dst[di+1] = byte(g)
-				dst[di+2] = byte(b)
-				dst[di+3] = 0xff
-			}
-		}
-	}
-
-	if workers == 1 {
-		convertRows(0, outH)
-		return
-	}
-
-	var wg sync.WaitGroup
-	chunk := (outH + workers - 1) / workers
-	for i := 0; i < workers; i++ {
-		y0 := i * chunk
-		y1 := y0 + chunk
-		if y1 > outH {
-			y1 = outH
-		}
-		if y0 >= y1 {
-			break
-		}
-		wg.Add(1)
-		go func(y0, y1 int) {
-			defer wg.Done()
-			convertRows(y0, y1)
-		}(y0, y1)
-	}
-	wg.Wait()
-}
-
-// convertBGRAToRGBA swaps R/B channels using uint32 word operations, and
-// parallelises across GOMAXPROCS cores for large images.
-func convertBGRAToRGBA(dst []byte, dstStride int, src []byte, srcStride, w, h int) {
-	workers := runtime.GOMAXPROCS(0)
-	if workers > h {
-		workers = h
-	}
-	if workers < 1 || h < 64 {
-		workers = 1
-	}
-
-	convertRows := func(y0, y1 int) {
-		rowBytes := w * 4
-		for row := y0; row < y1; row++ {
-			dstRow := dst[row*dstStride : row*dstStride+rowBytes]
-			srcRow := src[row*srcStride : row*srcStride+rowBytes]
-			dstU := unsafe.Slice((*uint32)(unsafe.Pointer(&dstRow[0])), w)
-			srcU := unsafe.Slice((*uint32)(unsafe.Pointer(&srcRow[0])), w)
-			for i, p := range srcU {
-				dstU[i] = (p & 0xff00ff00) | ((p & 0x000000ff) << 16) | ((p & 0x00ff0000) >> 16) | 0xff000000
-			}
-		}
-	}
-
-	if workers == 1 {
-		convertRows(0, h)
-		return
-	}
-
-	var wg sync.WaitGroup
-	chunk := (h + workers - 1) / workers
-	for i := 0; i < workers; i++ {
-		y0 := i * chunk
-		y1 := y0 + chunk
-		if y1 > h {
-			y1 = h
-		}
-		if y0 >= y1 {
-			break
-		}
-		wg.Add(1)
-		go func(y0, y1 int) {
-			defer wg.Done()
-			convertRows(y0, y1)
-		}(y0, y1)
-	}
-	wg.Wait()
-}
-
-// MacPoller wraps CGCapturer with a staleness-cached on-demand Capture:
-// sessions drive captures themselves from their encoder goroutine, so we
-// don't need a background ticker. The last result is cached for a short
-// window so concurrent sessions coalesce into one capture.
-//
-// The capturer is allocated lazily on first use and released when all
-// clients disconnect. Init is retried with backoff because the user may
-// grant Screen Recording permission while the server is already running.
-type MacPoller struct {
-	mu sync.Mutex
-
-	capturer *CGCapturer
-	w, h     int
-
-	lastFrame *image.RGBA
-	lastAt    time.Time
-
-	clients          atomic.Int32
-	initFails        int
-	initBackoffUntil time.Time
-	closed           bool
-}
-
-// macInitRetryBackoffFor returns the delay we wait between init attempts
-// after consecutive failures. Screen Recording permission is a one-shot
-// user grant, so after several failures we back off aggressively.
-func macInitRetryBackoffFor(fails int) time.Duration {
-	switch {
-	case fails > 15:
-		return 30 * time.Second
-	case fails > 5:
-		return 10 * time.Second
-	default:
-		return 2 * time.Second
-	}
-}
-
-// NewMacPoller creates a lazy on-demand capturer for the macOS display.
-func NewMacPoller() *MacPoller {
-	return &MacPoller{}
-}
-
-// Wake is a no-op retained for API compatibility. With on-demand capture
-// there is no background retry loop to kick: init happens on the next
-// Capture/ClientConnect call.
-func (p *MacPoller) Wake() {
-	// intentional no-op
-}
-
-// ClientConnect increments the active client count and eagerly initialises
-// the capturer so the first FBUpdateRequest doesn't pay the init cost.
-func (p *MacPoller) ClientConnect() {
-	if p.clients.Add(1) == 1 {
-		p.mu.Lock()
-		_ = p.ensureCapturerLocked()
-		p.mu.Unlock()
-	}
-}
-
-// ClientDisconnect decrements the active client count. On the last
-// disconnect the capturer is released.
-func (p *MacPoller) ClientDisconnect() {
-	if p.clients.Add(-1) == 0 {
-		p.mu.Lock()
-		p.capturer = nil
-		p.lastFrame = nil
-		p.mu.Unlock()
-	}
-}
-
-// Close releases all resources.
-func (p *MacPoller) Close() {
-	p.mu.Lock()
-	p.closed = true
-	p.capturer = nil
-	p.lastFrame = nil
-	p.mu.Unlock()
-}
-
-// Width returns the screen width. Triggers lazy init if needed.
-func (p *MacPoller) Width() int {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	_ = p.ensureCapturerLocked()
-	return p.w
-}
-
-// Height returns the screen height. Triggers lazy init if needed.
-func (p *MacPoller) Height() int {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	_ = p.ensureCapturerLocked()
-	return p.h
-}
-
-// CaptureInto fills dst directly via the underlying capturer, bypassing
-// the freshness cache.
-func (p *MacPoller) CaptureInto(dst *image.RGBA) error {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	if err := p.ensureCapturerLocked(); err != nil {
-		return err
-	}
-	if err := p.capturer.CaptureInto(dst); err != nil {
-		p.capturer = nil
-		return fmt.Errorf("macos capture: %w", err)
-	}
-	return nil
-}
-
-// Capture returns a fresh frame, serving from the short-lived cache if a
-// previous caller captured within freshWindow. Handles the
-// errFrameUnchanged return from CGCapturer by reusing the cached frame.
-func (p *MacPoller) Capture() (*image.RGBA, error) {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	if p.lastFrame != nil && time.Since(p.lastAt) < freshWindow {
-		return p.lastFrame, nil
-	}
-	if err := p.ensureCapturerLocked(); err != nil {
-		return nil, err
-	}
-	img, err := p.capturer.Capture()
-	if errors.Is(err, errFrameUnchanged) {
-		if p.lastFrame != nil {
-			p.lastAt = time.Now()
-			return p.lastFrame, nil
-		}
-		return nil, err
-	}
-	if err != nil {
-		// Drop the capturer so the next call retries init; the display stream
-		// can die if the session changes or permissions are revoked.
-		p.capturer = nil
-		return nil, fmt.Errorf("macos capture: %w", err)
-	}
-	p.lastFrame = img
-	p.lastAt = time.Now()
-	return img, nil
-}
-
-// ensureCapturerLocked initialises the underlying CGCapturer if needed.
-// Caller must hold p.mu.
-func (p *MacPoller) ensureCapturerLocked() error {
-	if p.closed {
-		return fmt.Errorf("poller closed")
-	}
-	if p.capturer != nil {
-		return nil
-	}
-	if time.Now().Before(p.initBackoffUntil) {
-		return fmt.Errorf("macOS capturer unavailable (retry scheduled)")
-	}
-	c, err := NewCGCapturer()
-	if err != nil {
-		p.initFails++
-		p.initBackoffUntil = time.Now().Add(macInitRetryBackoffFor(p.initFails))
-		if p.initFails == 1 || p.initFails%10 == 0 {
-			log.Warnf("macOS capturer: %v (attempt %d)", err, p.initFails)
-		} else {
-			log.Debugf("macOS capturer: %v (attempt %d)", err, p.initFails)
-		}
-		return err
-	}
-	p.initFails = 0
-	p.capturer = c
-	p.w, p.h = c.Width(), c.Height()
-	return nil
-}
-
-var _ ScreenCapturer = (*MacPoller)(nil)

client/vnc/server/capture_dxgi_windows.go

@@ -1,99 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"errors"
-	"fmt"
-	"image"
-
-	"github.com/kirides/go-d3d/d3d11"
-	"github.com/kirides/go-d3d/outputduplication"
-)
-
-// dxgiCapturer captures the desktop using DXGI Desktop Duplication.
-// Provides GPU-accelerated capture with native dirty rect tracking.
-// Only works from the interactive user session, not Session 0.
-//
-// Uses a double-buffer: DXGI writes into img, then we copy to the current
-// output buffer and hand it out. Alternating between two output buffers
-// avoids allocating a new image.RGBA per frame (~8MB at 1080p, 30fps).
-type dxgiCapturer struct {
-	dup    *outputduplication.OutputDuplicator
-	device *d3d11.ID3D11Device
-	ctx    *d3d11.ID3D11DeviceContext
-	img    *image.RGBA
-	out    [2]*image.RGBA
-	outIdx int
-	width  int
-	height int
-}
-
-func newDXGICapturer() (*dxgiCapturer, error) {
-	device, deviceCtx, err := d3d11.NewD3D11Device()
-	if err != nil {
-		return nil, fmt.Errorf("create D3D11 device: %w", err)
-	}
-
-	dup, err := outputduplication.NewIDXGIOutputDuplication(device, deviceCtx, 0)
-	if err != nil {
-		device.Release()
-		deviceCtx.Release()
-		return nil, fmt.Errorf("create output duplication: %w", err)
-	}
-
-	w, h := screenSize()
-	if w == 0 || h == 0 {
-		dup.Release()
-		device.Release()
-		deviceCtx.Release()
-		return nil, fmt.Errorf("screen dimensions are zero")
-	}
-
-	rect := image.Rect(0, 0, w, h)
-	c := &dxgiCapturer{
-		dup:    dup,
-		device: device,
-		ctx:    deviceCtx,
-		img:    image.NewRGBA(rect),
-		out:    [2]*image.RGBA{image.NewRGBA(rect), image.NewRGBA(rect)},
-		width:  w,
-		height: h,
-	}
-
-	// Grab the initial frame with a longer timeout to ensure we have
-	// a valid image before returning.
-	_ = dup.GetImage(c.img, 2000)
-
-	return c, nil
-}
-
-func (c *dxgiCapturer) capture() (*image.RGBA, error) {
-	err := c.dup.GetImage(c.img, 100)
-	if err != nil && !errors.Is(err, outputduplication.ErrNoImageYet) {
-		return nil, err
-	}
-
-	// Copy into the next output buffer. The DesktopCapturer hands out the
-	// returned pointer to VNC sessions that read pixels concurrently, so we
-	// alternate between two pre-allocated buffers instead of allocating per frame.
-	out := c.out[c.outIdx]
-	c.outIdx ^= 1
-	copy(out.Pix, c.img.Pix)
-	return out, nil
-}
-
-func (c *dxgiCapturer) close() {
-	if c.dup != nil {
-		c.dup.Release()
-		c.dup = nil
-	}
-	if c.ctx != nil {
-		c.ctx.Release()
-		c.ctx = nil
-	}
-	if c.device != nil {
-		c.device.Release()
-		c.device = nil
-	}
-}

client/vnc/server/capture_fb_freebsd.go

@@ -1,148 +0,0 @@
-//go:build freebsd
-
-package server
-
-import (
-	"fmt"
-	"image"
-	"sync"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
-)
-
-// FreeBSD vt(4) framebuffer ioctl numbers from sys/fbio.h.
-//
-//	#define FBIOGTYPE _IOR('F', 0, struct fbtype)
-//
-// _IOR(g, n, t) on FreeBSD: dir=2 (read) <<30 | (sizeof(t) & 0x1fff)<<16
-// | (g<<8) | n.  sizeof(struct fbtype)=24 → 0x40184600.
-const fbioGType = 0x40184600
-
-func defaultFBPath() string { return "/dev/ttyv0" }
-
-// fbType mirrors FreeBSD's struct fbtype.
-type fbType struct {
-	FbType   int32
-	FbHeight int32
-	FbWidth  int32
-	FbDepth  int32
-	FbCMSize int32
-	FbSize   int32
-}
-
-// FBCapturer reads pixels from FreeBSD's vt(4) framebuffer device. The
-// vt(4) console exposes the active framebuffer via ttyv0 with FBIOGTYPE
-// for geometry and mmap for backing memory. Pixel layout is assumed to
-// be 32bpp BGRA (the common case for KMS-backed vt); fbtype doesn't
-// expose channel offsets, so we don't try to handle exotic layouts here.
-type FBCapturer struct {
-	mu        sync.Mutex
-	path      string
-	fd        int
-	mmap      []byte
-	w, h      int
-	bpp       int
-	stride    int
-	closeOnce sync.Once
-}
-
-// NewFBCapturer opens the given vt(4) device and queries its geometry.
-func NewFBCapturer(path string) (*FBCapturer, error) {
-	if path == "" {
-		path = defaultFBPath()
-	}
-	fd, err := unix.Open(path, unix.O_RDWR, 0)
-	if err != nil {
-		return nil, fmt.Errorf("open %s: %w", path, err)
-	}
-
-	var fbt fbType
-	if _, _, e := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), fbioGType, uintptr(unsafe.Pointer(&fbt))); e != 0 {
-		unix.Close(fd)
-		return nil, fmt.Errorf("FBIOGTYPE: %v", e)
-	}
-	if fbt.FbDepth != 16 && fbt.FbDepth != 24 && fbt.FbDepth != 32 {
-		unix.Close(fd)
-		return nil, fmt.Errorf("unsupported framebuffer depth: %d", fbt.FbDepth)
-	}
-	if fbt.FbWidth <= 0 || fbt.FbHeight <= 0 || fbt.FbSize <= 0 {
-		unix.Close(fd)
-		return nil, fmt.Errorf("invalid framebuffer geometry: %dx%d size=%d", fbt.FbWidth, fbt.FbHeight, fbt.FbSize)
-	}
-
-	mm, err := unix.Mmap(fd, 0, int(fbt.FbSize), unix.PROT_READ, unix.MAP_SHARED)
-	if err != nil {
-		unix.Close(fd)
-		return nil, fmt.Errorf("mmap %s: %w (vt may not support mmap on this driver, e.g. virtio_gpu)", path, err)
-	}
-
-	bpp := int(fbt.FbDepth)
-	stride := int(fbt.FbWidth) * (bpp / 8)
-	c := &FBCapturer{
-		path:   path,
-		fd:     fd, // valid fd >= 0; we use -1 as the closed sentinel
-		mmap:   mm,
-		w:      int(fbt.FbWidth),
-		h:      int(fbt.FbHeight),
-		bpp:    bpp,
-		stride: stride,
-	}
-	log.Infof("framebuffer capturer ready: %s %dx%d bpp=%d (freebsd vt)", path, c.w, c.h, c.bpp)
-	return c, nil
-}
-
-// Width returns the framebuffer width.
-func (c *FBCapturer) Width() int { return c.w }
-
-// Height returns the framebuffer height.
-func (c *FBCapturer) Height() int { return c.h }
-
-// Capture allocates a fresh image and fills it with the current
-// framebuffer contents.
-func (c *FBCapturer) Capture() (*image.RGBA, error) {
-	img := image.NewRGBA(image.Rect(0, 0, c.w, c.h))
-	if err := c.CaptureInto(img); err != nil {
-		return nil, err
-	}
-	return img, nil
-}
-
-// CaptureInto reads the framebuffer directly into dst.Pix. Assumes BGRA
-// for 32bpp; the FreeBSD fbtype struct doesn't expose channel offsets.
-func (c *FBCapturer) CaptureInto(dst *image.RGBA) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	if dst.Rect.Dx() != c.w || dst.Rect.Dy() != c.h {
-		return fmt.Errorf("dst size mismatch: dst=%dx%d fb=%dx%d",
-			dst.Rect.Dx(), dst.Rect.Dy(), c.w, c.h)
-	}
-	switch c.bpp {
-	case 32:
-		// vt(4) on KMS framebuffers is BGRA: byte 0=B, 1=G, 2=R.
-		swizzleBGRAtoRGBA(dst.Pix, c.mmap[:c.h*c.stride])
-	case 24:
-		swizzleFB24(dst.Pix, dst.Stride, c.mmap, c.stride, c.w, c.h)
-	case 16:
-		swizzleFB16RGB565(dst.Pix, dst.Stride, c.mmap, c.stride, c.w, c.h)
-	}
-	return nil
-}
-
-// Close releases the framebuffer mmap and file descriptor. Serialized with
-// CaptureInto via c.mu so an in-flight capture can't read freed memory.
-func (c *FBCapturer) Close() {
-	c.closeOnce.Do(func() {
-		c.mu.Lock()
-		defer c.mu.Unlock()
-		if c.mmap != nil {
-			_ = unix.Munmap(c.mmap)
-			c.mmap = nil
-		}
-		if c.fd >= 0 {
-			_ = unix.Close(c.fd)
-			c.fd = -1
-		}
-	})
-}

client/vnc/server/capture_fb_linux.go

@@ -1,229 +0,0 @@
-//go:build linux && !android
-
-package server
-
-import (
-	"encoding/binary"
-	"fmt"
-	"image"
-	"sync"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
-)
-
-// Linux framebuffer ioctls (linux/fb.h).
-const (
-	fbioGetVScreenInfo = 0x4600
-	fbioGetFScreenInfo = 0x4602
-)
-
-func defaultFBPath() string { return "/dev/fb0" }
-
-// fbVarScreenInfo mirrors the kernel's fb_var_screeninfo. Only the
-// fields we use are mapped; the rest are absorbed into _padN.
-type fbVarScreenInfo struct {
-	Xres, Yres                       uint32
-	XresVirtual, YresVirtual         uint32
-	XOffset, YOffset                 uint32
-	BitsPerPixel                     uint32
-	Grayscale                        uint32
-	RedOffset, RedLen, RedMSBR       uint32
-	GreenOffset, GreenLen, GreenMSBR uint32
-	BlueOffset, BlueLen, BlueMSBR    uint32
-	TranspOffset, TranspLen, TranspM uint32
-	NonStd                           uint32
-	Activate                         uint32
-	Height, Width                    uint32
-	AccelFlags                       uint32
-	PixClock                         uint32
-	LeftMargin, RightMargin          uint32
-	UpperMargin, LowerMargin         uint32
-	HsyncLen, VsyncLen               uint32
-	Sync                             uint32
-	Vmode                            uint32
-	Rotate                           uint32
-	Colorspace                       uint32
-	_pad                             [4]uint32
-}
-
-// fbFixScreenInfo mirrors fb_fix_screeninfo. We only need LineLength.
-type fbFixScreenInfo struct {
-	IDStr        [16]byte
-	SmemStart    uint64
-	SmemLen      uint32
-	Type         uint32
-	TypeAux      uint32
-	Visual       uint32
-	XPanStep     uint16
-	YPanStep     uint16
-	YWrapStep    uint16
-	_pad0        uint16
-	LineLength   uint32
-	MmioStart    uint64
-	MmioLen      uint32
-	Accel        uint32
-	Capabilities uint16
-	_reserved    [2]uint16
-}
-
-// FBCapturer reads pixels straight from the Linux framebuffer device.
-// Used as a fallback when X11 isn't available, e.g. on a headless box at
-// the kernel console or the display manager's pre-login screen on machines
-// without an Xorg server. The framebuffer must be mmap()-able under our
-// process privileges (typically the netbird service runs as root).
-type FBCapturer struct {
-	mu        sync.Mutex
-	path      string
-	fd        int
-	mmap      []byte
-	w, h      int
-	bpp       int
-	stride    int
-	rOff      uint32
-	gOff      uint32
-	bOff      uint32
-	rLen      uint32
-	gLen      uint32
-	bLen      uint32
-	closeOnce sync.Once
-}
-
-// NewFBCapturer opens the given framebuffer device (/dev/fbN) and
-// queries its current geometry + pixel format.
-func NewFBCapturer(path string) (*FBCapturer, error) {
-	if path == "" {
-		path = "/dev/fb0"
-	}
-	fd, err := unix.Open(path, unix.O_RDONLY, 0)
-	if err != nil {
-		return nil, fmt.Errorf("open %s: %w", path, err)
-	}
-
-	var vinfo fbVarScreenInfo
-	if _, _, e := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), fbioGetVScreenInfo, uintptr(unsafe.Pointer(&vinfo))); e != 0 {
-		unix.Close(fd)
-		return nil, fmt.Errorf("FBIOGET_VSCREENINFO: %v", e)
-	}
-	var finfo fbFixScreenInfo
-	if _, _, e := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), fbioGetFScreenInfo, uintptr(unsafe.Pointer(&finfo))); e != 0 {
-		unix.Close(fd)
-		return nil, fmt.Errorf("FBIOGET_FSCREENINFO: %v", e)
-	}
-
-	bpp := int(vinfo.BitsPerPixel)
-	if bpp != 16 && bpp != 24 && bpp != 32 {
-		unix.Close(fd)
-		return nil, fmt.Errorf("unsupported framebuffer bpp: %d", bpp)
-	}
-
-	size := int(finfo.LineLength) * int(vinfo.Yres)
-	if size <= 0 {
-		unix.Close(fd)
-		return nil, fmt.Errorf("invalid framebuffer dimensions: stride=%d h=%d", finfo.LineLength, vinfo.Yres)
-	}
-
-	mm, err := unix.Mmap(fd, 0, size, unix.PROT_READ, unix.MAP_SHARED)
-	if err != nil {
-		unix.Close(fd)
-		return nil, fmt.Errorf("mmap %s: %w", path, err)
-	}
-
-	c := &FBCapturer{
-		path:   path,
-		fd:     fd,
-		mmap:   mm,
-		w:      int(vinfo.Xres),
-		h:      int(vinfo.Yres),
-		bpp:    bpp,
-		stride: int(finfo.LineLength),
-		rOff:   vinfo.RedOffset,
-		gOff:   vinfo.GreenOffset,
-		bOff:   vinfo.BlueOffset,
-		rLen:   vinfo.RedLen,
-		gLen:   vinfo.GreenLen,
-		bLen:   vinfo.BlueLen,
-	}
-	log.Infof("framebuffer capturer ready: %s %dx%d bpp=%d r=%d/%d g=%d/%d b=%d/%d",
-		path, c.w, c.h, c.bpp, c.rOff, c.rLen, c.gOff, c.gLen, c.bOff, c.bLen)
-	return c, nil
-}
-
-// Width returns the framebuffer width in pixels.
-func (c *FBCapturer) Width() int { return c.w }
-
-// Height returns the framebuffer height in pixels.
-func (c *FBCapturer) Height() int { return c.h }
-
-// Capture allocates a fresh image and fills it with the current
-// framebuffer contents.
-func (c *FBCapturer) Capture() (*image.RGBA, error) {
-	img := image.NewRGBA(image.Rect(0, 0, c.w, c.h))
-	if err := c.CaptureInto(img); err != nil {
-		return nil, err
-	}
-	return img, nil
-}
-
-// CaptureInto reads the framebuffer directly into dst.Pix.
-func (c *FBCapturer) CaptureInto(dst *image.RGBA) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if dst.Rect.Dx() != c.w || dst.Rect.Dy() != c.h {
-		return fmt.Errorf("dst size mismatch: dst=%dx%d fb=%dx%d",
-			dst.Rect.Dx(), dst.Rect.Dy(), c.w, c.h)
-	}
-
-	switch c.bpp {
-	case 32:
-		swizzleFB32(dst.Pix, dst.Stride, c.mmap, c.stride, c.w, c.h, channelShifts{R: c.rOff, G: c.gOff, B: c.bOff})
-	case 24:
-		swizzleFB24(dst.Pix, dst.Stride, c.mmap, c.stride, c.w, c.h)
-	case 16:
-		swizzleFB16RGB565(dst.Pix, dst.Stride, c.mmap, c.stride, c.w, c.h)
-	}
-	return nil
-}
-
-// Close releases the framebuffer mmap and file descriptor. Serialized with
-// CaptureInto via c.mu so an in-flight capture can't read freed memory.
-func (c *FBCapturer) Close() {
-	c.closeOnce.Do(func() {
-		c.mu.Lock()
-		defer c.mu.Unlock()
-		if c.mmap != nil {
-			_ = unix.Munmap(c.mmap)
-			c.mmap = nil
-		}
-		if c.fd >= 0 {
-			_ = unix.Close(c.fd)
-			c.fd = -1
-		}
-	})
-}
-
-// channelShifts groups the bit offsets for the R/G/B channels in a packed
-// uint32 framebuffer pixel. Bundling avoids drowning per-row callers in a
-// 9-parameter signature.
-type channelShifts struct {
-	R, G, B uint32
-}
-
-// swizzleFB32 handles 32-bit framebuffers with arbitrary R/G/B channel
-// offsets. Pulls one pixel per uint32, then masks each channel into the
-// destination RGBA byte order.
-func swizzleFB32(dst []byte, dstStride int, src []byte, srcStride, w, h int, shifts channelShifts) {
-	for y := 0; y < h; y++ {
-		srcRow := src[y*srcStride : y*srcStride+w*4]
-		dstRow := dst[y*dstStride:]
-		for x := 0; x < w; x++ {
-			pix := binary.LittleEndian.Uint32(srcRow[x*4 : x*4+4])
-			dstRow[x*4+0] = byte(pix >> shifts.R)
-			dstRow[x*4+1] = byte(pix >> shifts.G)
-			dstRow[x*4+2] = byte(pix >> shifts.B)
-			dstRow[x*4+3] = 0xff
-		}
-	}
-}

client/vnc/server/capture_fb_unix.go

@@ -1,149 +0,0 @@
-//go:build (linux && !android) || freebsd
-
-package server
-
-import (
-	"image"
-	"sync"
-)
-
-// FBPoller wraps FBCapturer with the same lifecycle (ClientConnect /
-// ClientDisconnect, lazy init) as X11Poller, so it slots into the same
-// session plumbing without code changes upstream. The concrete
-// FBCapturer is platform-specific (capture_fb_linux.go / _freebsd.go);
-// this file owns the cross-platform glue.
-type FBPoller struct {
-	mu       sync.Mutex
-	path     string
-	capturer *FBCapturer
-	w, h     int
-	clients  int32
-}
-
-// NewFBPoller returns a poller that opens path on first use. Empty path
-// defaults to /dev/fb0 on Linux and /dev/ttyv0 on FreeBSD.
-func NewFBPoller(path string) *FBPoller {
-	if path == "" {
-		path = defaultFBPath()
-	}
-	return &FBPoller{path: path}
-}
-
-// ClientConnect eagerly initialises the capturer on first connect.
-func (p *FBPoller) ClientConnect() {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	p.clients++
-	if p.clients == 1 {
-		_ = p.ensureCapturerLocked()
-	}
-}
-
-// ClientDisconnect closes the capturer when the last client leaves.
-func (p *FBPoller) ClientDisconnect() {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	p.clients--
-	if p.clients <= 0 && p.capturer != nil {
-		p.capturer.Close()
-		p.capturer = nil
-	}
-}
-
-// Width returns the framebuffer width, doing lazy init if needed.
-func (p *FBPoller) Width() int {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	_ = p.ensureCapturerLocked()
-	return p.w
-}
-
-// Height returns the framebuffer height, doing lazy init if needed.
-func (p *FBPoller) Height() int {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	_ = p.ensureCapturerLocked()
-	return p.h
-}
-
-// Capture takes a fresh frame.
-func (p *FBPoller) Capture() (*image.RGBA, error) {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if err := p.ensureCapturerLocked(); err != nil {
-		return nil, err
-	}
-	return p.capturer.Capture()
-}
-
-// CaptureInto fills dst directly.
-func (p *FBPoller) CaptureInto(dst *image.RGBA) error {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if err := p.ensureCapturerLocked(); err != nil {
-		return err
-	}
-	return p.capturer.CaptureInto(dst)
-}
-
-// Close releases all framebuffer resources.
-func (p *FBPoller) Close() {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if p.capturer != nil {
-		p.capturer.Close()
-		p.capturer = nil
-	}
-}
-
-func (p *FBPoller) ensureCapturerLocked() error {
-	if p.capturer != nil {
-		return nil
-	}
-	c, err := NewFBCapturer(p.path)
-	if err != nil {
-		return err
-	}
-	p.capturer = c
-	p.w, p.h = c.Width(), c.Height()
-	return nil
-}
-
-var _ ScreenCapturer = (*FBPoller)(nil)
-var _ captureIntoer = (*FBPoller)(nil)
-
-// swizzleFB24 handles 24-bit packed framebuffers (B,G,R triplets).
-// Shared between Linux and FreeBSD framebuffer paths.
-func swizzleFB24(dst []byte, dstStride int, src []byte, srcStride, w, h int) {
-	for y := 0; y < h; y++ {
-		srcRow := src[y*srcStride : y*srcStride+w*3]
-		dstRow := dst[y*dstStride:]
-		for x := 0; x < w; x++ {
-			b := srcRow[x*3+0]
-			g := srcRow[x*3+1]
-			r := srcRow[x*3+2]
-			dstRow[x*4+0] = r
-			dstRow[x*4+1] = g
-			dstRow[x*4+2] = b
-			dstRow[x*4+3] = 0xff
-		}
-	}
-}
-
-// swizzleFB16RGB565 handles 16bpp RGB 565 framebuffers.
-func swizzleFB16RGB565(dst []byte, dstStride int, src []byte, srcStride, w, h int) {
-	for y := 0; y < h; y++ {
-		srcRow := src[y*srcStride : y*srcStride+w*2]
-		dstRow := dst[y*dstStride:]
-		for x := 0; x < w; x++ {
-			pix := uint16(srcRow[x*2]) | uint16(srcRow[x*2+1])<<8
-			r := byte((pix >> 11) & 0x1f)
-			g := byte((pix >> 5) & 0x3f)
-			b := byte(pix & 0x1f)
-			dstRow[x*4+0] = (r << 3) | (r >> 2)
-			dstRow[x*4+1] = (g << 2) | (g >> 4)
-			dstRow[x*4+2] = (b << 3) | (b >> 2)
-			dstRow[x*4+3] = 0xff
-		}
-	}
-}

client/vnc/server/capture_windows.go

@@ -1,586 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"fmt"
-	"image"
-	"runtime"
-	"sync"
-	"sync/atomic"
-	"time"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-)
-
-var (
-	gdi32  = windows.NewLazySystemDLL("gdi32.dll")
-	user32 = windows.NewLazySystemDLL("user32.dll")
-
-	procGetDC            = user32.NewProc("GetDC")
-	procReleaseDC        = user32.NewProc("ReleaseDC")
-	procCreateCompatDC   = gdi32.NewProc("CreateCompatibleDC")
-	procCreateDIBSection = gdi32.NewProc("CreateDIBSection")
-	procSelectObject     = gdi32.NewProc("SelectObject")
-	procDeleteObject     = gdi32.NewProc("DeleteObject")
-	procDeleteDC         = gdi32.NewProc("DeleteDC")
-	procBitBlt           = gdi32.NewProc("BitBlt")
-	procGetSystemMetrics = user32.NewProc("GetSystemMetrics")
-
-	// Desktop switching for service/Session 0 capture.
-	procOpenInputDesktop          = user32.NewProc("OpenInputDesktop")
-	procSetThreadDesktop          = user32.NewProc("SetThreadDesktop")
-	procCloseDesktop              = user32.NewProc("CloseDesktop")
-	procOpenWindowStation         = user32.NewProc("OpenWindowStationW")
-	procSetProcessWindowStation   = user32.NewProc("SetProcessWindowStation")
-	procCloseWindowStation        = user32.NewProc("CloseWindowStation")
-	procGetUserObjectInformationW = user32.NewProc("GetUserObjectInformationW")
-)
-
-const uoiName = 2
-
-const (
-	smCxScreen   = 0
-	smCyScreen   = 1
-	srccopy      = 0x00CC0020
-	captureBlt   = 0x40000000
-	dibRgbColors = 0
-)
-
-type bitmapInfoHeader struct {
-	Size          uint32
-	Width         int32
-	Height        int32
-	Planes        uint16
-	BitCount      uint16
-	Compression   uint32
-	SizeImage     uint32
-	XPelsPerMeter int32
-	YPelsPerMeter int32
-	ClrUsed       uint32
-	ClrImportant  uint32
-}
-
-type bitmapInfo struct {
-	Header bitmapInfoHeader
-}
-
-// setupInteractiveWindowStation associates the current process with WinSta0,
-// the interactive window station. This is required for a SYSTEM service in
-// Session 0 to call OpenInputDesktop for screen capture and input injection.
-func setupInteractiveWindowStation() error {
-	name, err := windows.UTF16PtrFromString("WinSta0")
-	if err != nil {
-		return fmt.Errorf("UTF16 WinSta0: %w", err)
-	}
-	hWinSta, _, err := procOpenWindowStation.Call(
-		uintptr(unsafe.Pointer(name)),
-		0,
-		uintptr(windows.MAXIMUM_ALLOWED),
-	)
-	if hWinSta == 0 {
-		return fmt.Errorf("OpenWindowStation(WinSta0): %w", err)
-	}
-	r, _, err := procSetProcessWindowStation.Call(hWinSta)
-	if r == 0 {
-		_, _, _ = procCloseWindowStation.Call(hWinSta)
-		return fmt.Errorf("SetProcessWindowStation: %w", err)
-	}
-	log.Info("process window station set to WinSta0 (interactive)")
-	return nil
-}
-
-func screenSize() (int, int) {
-	w, _, _ := procGetSystemMetrics.Call(uintptr(smCxScreen))
-	h, _, _ := procGetSystemMetrics.Call(uintptr(smCyScreen))
-	return int(w), int(h)
-}
-
-func getDesktopName(hDesk uintptr) string {
-	var buf [256]uint16
-	var needed uint32
-	_, _, _ = procGetUserObjectInformationW.Call(hDesk, uoiName,
-		uintptr(unsafe.Pointer(&buf[0])), 512,
-		uintptr(unsafe.Pointer(&needed)))
-	return windows.UTF16ToString(buf[:])
-}
-
-// switchToInputDesktop opens the desktop currently receiving user input
-// and sets it as the calling OS thread's desktop. Must be called from a
-// goroutine locked to its OS thread via runtime.LockOSThread().
-func switchToInputDesktop() (bool, string) {
-	hDesk, _, _ := procOpenInputDesktop.Call(0, 0, uintptr(windows.MAXIMUM_ALLOWED))
-	if hDesk == 0 {
-		return false, ""
-	}
-	name := getDesktopName(hDesk)
-	ret, _, _ := procSetThreadDesktop.Call(hDesk)
-	_, _, _ = procCloseDesktop.Call(hDesk)
-	return ret != 0, name
-}
-
-// gdiCapturer captures the desktop screen using GDI BitBlt.
-// GDI objects (DC, DIBSection) are allocated once and reused across frames.
-type gdiCapturer struct {
-	mu     sync.Mutex
-	width  int
-	height int
-
-	// Pre-allocated GDI resources, reused across captures.
-	memDC uintptr
-	bmp   uintptr
-	bits  uintptr
-}
-
-func newGDICapturer() (*gdiCapturer, error) {
-	w, h := screenSize()
-	if w == 0 || h == 0 {
-		return nil, fmt.Errorf("screen dimensions are zero")
-	}
-	c := &gdiCapturer{width: w, height: h}
-	if err := c.allocGDI(); err != nil {
-		return nil, err
-	}
-	return c, nil
-}
-
-// allocGDI pre-allocates the compatible DC and DIB section for reuse.
-func (c *gdiCapturer) allocGDI() error {
-	screenDC, _, _ := procGetDC.Call(0)
-	if screenDC == 0 {
-		return fmt.Errorf("GetDC returned 0")
-	}
-	defer func() { _, _, _ = procReleaseDC.Call(0, screenDC) }()
-
-	memDC, _, _ := procCreateCompatDC.Call(screenDC)
-	if memDC == 0 {
-		return fmt.Errorf("CreateCompatibleDC returned 0")
-	}
-
-	bi := bitmapInfo{
-		Header: bitmapInfoHeader{
-			Size:     uint32(unsafe.Sizeof(bitmapInfoHeader{})),
-			Width:    int32(c.width),
-			Height:   -int32(c.height), // negative = top-down DIB
-			Planes:   1,
-			BitCount: 32,
-		},
-	}
-
-	var bits uintptr
-	bmp, _, _ := procCreateDIBSection.Call(
-		screenDC,
-		uintptr(unsafe.Pointer(&bi)),
-		dibRgbColors,
-		uintptr(unsafe.Pointer(&bits)),
-		0, 0,
-	)
-	if bmp == 0 || bits == 0 {
-		_, _, _ = procDeleteDC.Call(memDC)
-		return fmt.Errorf("CreateDIBSection returned 0")
-	}
-
-	_, _, _ = procSelectObject.Call(memDC, bmp)
-
-	c.memDC = memDC
-	c.bmp = bmp
-	c.bits = bits
-	return nil
-}
-
-func (c *gdiCapturer) close() { c.freeGDI() }
-
-// freeGDI releases pre-allocated GDI resources.
-func (c *gdiCapturer) freeGDI() {
-	if c.bmp != 0 {
-		_, _, _ = procDeleteObject.Call(c.bmp)
-		c.bmp = 0
-	}
-	if c.memDC != 0 {
-		_, _, _ = procDeleteDC.Call(c.memDC)
-		c.memDC = 0
-	}
-	c.bits = 0
-}
-
-func (c *gdiCapturer) capture() (*image.RGBA, error) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if c.memDC == 0 {
-		return nil, fmt.Errorf("GDI resources not allocated")
-	}
-
-	screenDC, _, _ := procGetDC.Call(0)
-	if screenDC == 0 {
-		return nil, fmt.Errorf("GetDC returned 0")
-	}
-	defer func() { _, _, _ = procReleaseDC.Call(0, screenDC) }()
-
-	// SRCCOPY|CAPTUREBLT: CAPTUREBLT forces inclusion of layered/topmost
-	// windows in the capture and is required for GDI BitBlt to return live
-	// pixels when the session is rendered through RDP / DWM-composited
-	// surfaces. Without it BitBlt reads the backing-store DIB which is
-	// often empty (all-black) on RDP and headless sessions.
-	ret, _, _ := procBitBlt.Call(c.memDC, 0, 0, uintptr(c.width), uintptr(c.height),
-		screenDC, 0, 0, srccopy|captureBlt)
-	if ret == 0 {
-		return nil, fmt.Errorf("BitBlt returned 0")
-	}
-
-	n := c.width * c.height * 4
-	raw := unsafe.Slice((*byte)(unsafe.Pointer(c.bits)), n)
-
-	// GDI gives BGRA, the RFB encoder expects RGBA (img.Pix layout).
-	// Swap R and B in bulk using uint32 operations (one load + mask + shift
-	// per pixel instead of three separate byte assignments).
-	img := image.NewRGBA(image.Rect(0, 0, c.width, c.height))
-	swizzleBGRAtoRGBA(img.Pix, raw)
-	return img, nil
-}
-
-// DesktopCapturer captures the interactive desktop, handling desktop transitions
-// (login screen, UAC prompts). A dedicated OS-locked goroutine continuously
-// captures frames on demand via a dedicated OS-locked goroutine (required
-// because DXGI's D3D11 device context is not thread-safe). Sessions drive
-// timing by calling Capture(); a short staleness cache coalesces concurrent
-// requests. Capture pauses automatically when no clients are connected.
-type DesktopCapturer struct {
-	mu   sync.Mutex
-	w, h int
-
-	// lastFrame/lastAt implement a small staleness cache so multiple
-	// near-simultaneous Capture calls share one DXGI round-trip.
-	lastFrame *image.RGBA
-	lastAt    time.Time
-
-	// clients tracks the number of active VNC sessions. When zero, the
-	// worker goroutine releases the underlying capturer.
-	clients atomic.Int32
-
-	// reqCh carries capture requests from sessions to the OS-locked worker.
-	reqCh chan captureReq
-	// wake is signaled when a client connects and the worker should resume.
-	wake chan struct{}
-	// done is closed when Close is called, terminating the worker.
-	done chan struct{}
-
-	// cursorState holds the latest cursor sprite sampled by the worker.
-	// The worker calls GetCursorInfo every capture and decodes a new
-	// sprite only when the HCURSOR changes.
-	cursorState cursorState
-}
-
-// captureReq is a single capture request awaiting a reply. Reply channel is
-// buffered to size 1 so the worker never blocks on a sender that's gone.
-type captureReq struct {
-	reply chan captureReply
-}
-
-type captureReply struct {
-	img *image.RGBA
-	err error
-}
-
-// NewDesktopCapturer creates an on-demand capturer for the active desktop.
-func NewDesktopCapturer() *DesktopCapturer {
-	c := &DesktopCapturer{
-		wake:  make(chan struct{}, 1),
-		done:  make(chan struct{}),
-		reqCh: make(chan captureReq),
-	}
-	go c.worker()
-	return c
-}
-
-// ClientConnect increments the active client count, resuming capture if needed.
-func (c *DesktopCapturer) ClientConnect() {
-	c.clients.Add(1)
-	select {
-	case c.wake <- struct{}{}:
-	default:
-	}
-}
-
-// ClientDisconnect decrements the active client count.
-func (c *DesktopCapturer) ClientDisconnect() {
-	c.clients.Add(-1)
-}
-
-// Close stops the capture loop and releases resources.
-func (c *DesktopCapturer) Close() {
-	select {
-	case <-c.done:
-	default:
-		close(c.done)
-	}
-}
-
-// Width returns the current screen width, triggering a capture if the
-// worker hasn't initialised yet. validateCapturer depends on Width/Height
-// becoming non-zero promptly after ClientConnect so it doesn't reject
-// brand-new sessions.
-func (c *DesktopCapturer) Width() int {
-	c.mu.Lock()
-	w := c.w
-	c.mu.Unlock()
-	if w == 0 && c.clients.Load() > 0 {
-		_, _ = c.Capture()
-		c.mu.Lock()
-		w = c.w
-		c.mu.Unlock()
-	}
-	return w
-}
-
-// Height returns the current screen height, triggering a capture if the
-// worker hasn't initialised yet (see Width). Returns 0 while no client is
-// connected so callers don't deadlock against a parked worker.
-func (c *DesktopCapturer) Height() int {
-	c.mu.Lock()
-	h := c.h
-	c.mu.Unlock()
-	if h == 0 && c.clients.Load() > 0 {
-		_, _ = c.Capture()
-		c.mu.Lock()
-		h = c.h
-		c.mu.Unlock()
-	}
-	return h
-}
-
-// Capture returns a freshly captured frame, serving from a short staleness
-// cache when multiple sessions ask within freshWindow of each other. All
-// real DXGI/GDI work happens on the OS-locked worker goroutine.
-func (c *DesktopCapturer) Capture() (*image.RGBA, error) {
-	c.mu.Lock()
-	if c.lastFrame != nil && time.Since(c.lastAt) < freshWindow {
-		img := c.lastFrame
-		c.mu.Unlock()
-		return img, nil
-	}
-	c.mu.Unlock()
-
-	reply := make(chan captureReply, 1)
-	select {
-	case c.reqCh <- captureReq{reply: reply}:
-	case <-c.done:
-		return nil, fmt.Errorf("capturer closed")
-	}
-	select {
-	case r := <-reply:
-		if r.err != nil {
-			return nil, r.err
-		}
-		c.mu.Lock()
-		c.lastFrame = r.img
-		c.lastAt = time.Now()
-		c.mu.Unlock()
-		return r.img, nil
-	case <-c.done:
-		return nil, fmt.Errorf("capturer closed")
-	}
-}
-
-// waitForClient blocks until a client connects or the capturer is closed.
-func (c *DesktopCapturer) waitForClient() bool {
-	if c.clients.Load() > 0 {
-		return true
-	}
-	select {
-	case <-c.wake:
-		return true
-	case <-c.done:
-		return false
-	}
-}
-
-// worker owns DXGI/GDI state on its OS-locked thread and services capture
-// requests from sessions. No background ticker: a capture happens only when
-// a session asks for one (throttled by Capture()'s staleness cache).
-func (c *DesktopCapturer) worker() {
-	runtime.LockOSThread()
-
-	// When running as a Windows service (Session 0), we need to attach to the
-	// interactive window station before OpenInputDesktop will succeed.
-	if err := setupInteractiveWindowStation(); err != nil {
-		log.Warnf("attach to interactive window station: %v", err)
-	}
-
-	w := &captureWorker{c: c}
-	defer w.closeCapturer()
-
-	for {
-		if !c.waitForClient() {
-			return
-		}
-		// Drop the capturer when all clients have disconnected so we don't
-		// hold the DXGI duplication or GDI DC on an idle peer.
-		if c.clients.Load() <= 0 {
-			w.closeCapturer()
-			continue
-		}
-		if !w.handleNextRequest() {
-			return
-		}
-	}
-}
-
-// frameCapturer is the per-backend interface used by the worker. DXGI and
-// GDI implementations both satisfy it.
-type frameCapturer interface {
-	capture() (*image.RGBA, error)
-	close()
-}
-
-// captureWorker owns the worker goroutine's mutable state. Extracted into a
-// struct so the request/desktop/init logic can live on small methods and the
-// outer worker() stays a thin loop.
-type captureWorker struct {
-	c             *DesktopCapturer
-	cap           frameCapturer
-	desktopFails  int
-	lastDesktop   string
-	nextInitRetry time.Time
-	cursor        cursorSampler
-	// lastBackend records the last capturer kind that came out of
-	// createCapturer ("dxgi" or "gdi"); used to demote repeat "using X"
-	// and DXGI-unavailable logs to debug when nothing changed.
-	lastBackend string
-	// lastDXGIErr is the textual DXGI failure printed in the most recent
-	// fallback warning; suppresses repeat warns when DXGI keeps failing
-	// the same way across desktop changes (login -> lock -> login).
-	lastDXGIErr string
-}
-
-// handleNextRequest waits for either shutdown or a capture request and runs
-// the request through prepCapturer/capture. Returns false when the worker
-// should exit.
-func (w *captureWorker) handleNextRequest() bool {
-	select {
-	case <-w.c.done:
-		return false
-	case req := <-w.c.reqCh:
-		w.serveRequest(req)
-		return true
-	}
-}
-
-func (w *captureWorker) serveRequest(req captureReq) {
-	fc, err := w.prepCapturer()
-	if err != nil {
-		req.reply <- captureReply{err: err}
-		return
-	}
-	img, err := fc.capture()
-	if err != nil {
-		log.Debugf("capture: %v", err)
-		w.closeCapturer()
-		w.nextInitRetry = time.Now().Add(100 * time.Millisecond)
-		req.reply <- captureReply{err: err}
-		return
-	}
-	if snap, err := w.cursor.sample(); err != nil {
-		w.c.cursorState.store(&cursorSnapshot{err: err})
-	} else {
-		w.c.cursorState.store(snap)
-	}
-	req.reply <- captureReply{img: img}
-}
-
-// prepCapturer switches to the input desktop, handles desktop-change
-// teardown, and creates the underlying capturer on demand. Backoff state is
-// tracked across calls via w.nextInitRetry.
-func (w *captureWorker) prepCapturer() (frameCapturer, error) {
-	if err := w.refreshDesktop(); err != nil {
-		return nil, err
-	}
-	if w.cap != nil {
-		return w.cap, nil
-	}
-	if time.Now().Before(w.nextInitRetry) {
-		return nil, fmt.Errorf("capturer init backing off")
-	}
-	fc, err := w.createCapturer()
-	if err != nil {
-		w.nextInitRetry = time.Now().Add(500 * time.Millisecond)
-		return nil, err
-	}
-	w.cap = fc
-	sw, sh := screenSize()
-	w.c.mu.Lock()
-	sizeChanged := w.c.w != sw || w.c.h != sh
-	w.c.w, w.c.h = sw, sh
-	w.c.mu.Unlock()
-	if sizeChanged {
-		log.Infof("screen capturer ready: %dx%d", sw, sh)
-	} else {
-		log.Debugf("screen capturer ready: %dx%d", sw, sh)
-	}
-	return w.cap, nil
-}
-
-// refreshDesktop tracks the active input desktop. When it changes (lock
-// screen, fast-user-switch) the existing capturer is dropped so the next
-// call rebuilds one against the new desktop.
-func (w *captureWorker) refreshDesktop() error {
-	ok, desk := switchToInputDesktop()
-	if !ok {
-		w.desktopFails++
-		if w.desktopFails == 1 || w.desktopFails%100 == 0 {
-			log.Warnf("switchToInputDesktop failed (count=%d), no interactive desktop session?", w.desktopFails)
-		}
-		return fmt.Errorf("no interactive desktop")
-	}
-	if w.desktopFails > 0 {
-		log.Infof("switchToInputDesktop recovered after %d failures, desktop=%q", w.desktopFails, desk)
-		w.desktopFails = 0
-	}
-	if desk != w.lastDesktop {
-		log.Infof("desktop changed: %q -> %q", w.lastDesktop, desk)
-		w.lastDesktop = desk
-		w.closeCapturer()
-	}
-	return nil
-}
-
-func (w *captureWorker) createCapturer() (frameCapturer, error) {
-	dc, err := newDXGICapturer()
-	if err == nil {
-		if w.lastBackend != "dxgi" {
-			log.Info("using DXGI Desktop Duplication for capture")
-		} else {
-			log.Debug("using DXGI Desktop Duplication for capture")
-		}
-		w.lastBackend = "dxgi"
-		w.lastDXGIErr = ""
-		return dc, nil
-	}
-	errStr := err.Error()
-	if errStr != w.lastDXGIErr {
-		log.Warnf("DXGI Desktop Duplication unavailable, falling back to slower GDI BitBlt: %v", err)
-		w.lastDXGIErr = errStr
-	} else {
-		log.Debugf("DXGI Desktop Duplication still unavailable, falling back to slower GDI BitBlt: %v", err)
-	}
-	gc, err := newGDICapturer()
-	if err != nil {
-		return nil, err
-	}
-	if w.lastBackend != "gdi" {
-		log.Info("using GDI BitBlt for capture")
-	} else {
-		log.Debug("using GDI BitBlt for capture")
-	}
-	w.lastBackend = "gdi"
-	return gc, nil
-}
-
-func (w *captureWorker) closeCapturer() {
-	if w.cap != nil {
-		w.cap.close()
-		w.cap = nil
-	}
-}

client/vnc/server/capture_x11.go

@@ -1,544 +0,0 @@
-//go:build (linux && !android) || freebsd
-
-package server
-
-import (
-	"fmt"
-	"image"
-	"os"
-	"os/exec"
-	"strconv"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/jezek/xgb"
-	"github.com/jezek/xgb/xproto"
-)
-
-const (
-	// x11SocketDir is the well-known directory where X servers create
-	// their abstract UNIX-domain sockets, named "X<display>". Used both
-	// for auto-detecting an existing display and for placing/probing
-	// sockets of virtual sessions we spawn.
-	x11SocketDir = "/tmp/.X11-unix"
-
-	// envDisplay is the X11 display selector environment variable.
-	envDisplay = "DISPLAY"
-	// envXAuthority points X clients at the cookie file used to
-	// authenticate against the running X server.
-	envXAuthority = "XAUTHORITY"
-)
-
-// X11Capturer captures the screen from an X11 display using the MIT-SHM extension.
-type X11Capturer struct {
-	mu      sync.Mutex
-	conn    *xgb.Conn
-	screen  *xproto.ScreenInfo
-	w, h    int
-	shmID   int
-	shmAddr []byte
-	shmSeg  uint32
-	useSHM  bool
-	// bufs double-buffers output images so the X11Poller's capture loop can
-	// overwrite one while the session is still encoding the other. Before
-	// this, a single reused buffer would race with the reader. Allocation
-	// happens on first use and on geometry change.
-	bufs [2]*image.RGBA
-	cur  int
-	// cursor is the XFixes binding used to report the current sprite.
-	// Allocated lazily on the first Cursor call. cursorInitErr latches
-	// a permanent init failure so we stop retrying every frame.
-	cursor        *xfixesCursor
-	cursorInitErr error
-}
-
-// detectX11Display finds the active X11 display and sets DISPLAY/XAUTHORITY
-// environment variables if needed. This is required when running as a system
-// service where these vars aren't set.
-func detectX11Display() {
-	if os.Getenv(envDisplay) != "" {
-		return
-	}
-
-	// Try /proc first (Linux), then ps fallback (FreeBSD and others).
-	if detectX11FromProc() {
-		return
-	}
-	if detectX11FromSockets() {
-		return
-	}
-}
-
-// detectX11FromProc scans /proc/*/cmdline for Xorg (Linux).
-func detectX11FromProc() bool {
-	entries, err := os.ReadDir("/proc")
-	if err != nil {
-		return false
-	}
-	for _, e := range entries {
-		if !e.IsDir() {
-			continue
-		}
-		cmdline, err := os.ReadFile("/proc/" + e.Name() + "/cmdline")
-		if err != nil {
-			continue
-		}
-		if display, auth := parseXorgArgs(splitCmdline(cmdline)); display != "" {
-			setDisplayEnv(display, auth)
-			return true
-		}
-	}
-	return false
-}
-
-// detectX11FromSockets checks /tmp/.X11-unix/ for X sockets and uses ps
-// to find the auth file. Works on FreeBSD and other systems without /proc.
-func detectX11FromSockets() bool {
-	entries, err := os.ReadDir(x11SocketDir)
-	if err != nil {
-		return false
-	}
-
-	// Pick the lowest numeric display rather than the lexically first
-	// entry, so X10 doesn't win over X2.
-	minDisplay := -1
-	for _, e := range entries {
-		name := e.Name()
-		if len(name) < 2 || name[0] != 'X' {
-			continue
-		}
-		n, err := strconv.Atoi(name[1:])
-		if err != nil {
-			continue
-		}
-		if minDisplay < 0 || n < minDisplay {
-			minDisplay = n
-		}
-	}
-	if minDisplay < 0 {
-		return false
-	}
-	display := ":" + strconv.Itoa(minDisplay)
-	os.Setenv(envDisplay, display)
-	auth := findXorgAuthFromPS()
-	if auth != "" {
-		os.Setenv(envXAuthority, auth)
-		log.Infof("auto-detected DISPLAY=%s (from socket) XAUTHORITY=%s (from ps)", display, auth)
-	} else {
-		log.Infof("auto-detected DISPLAY=%s (from socket)", display)
-	}
-	return true
-}
-
-// findXorgAuthFromPS runs ps to find Xorg and extract its -auth argument.
-func findXorgAuthFromPS() string {
-	out, err := exec.Command("ps", "auxww").Output()
-	if err != nil {
-		return ""
-	}
-	for _, line := range strings.Split(string(out), "\n") {
-		if !strings.Contains(line, "Xorg") && !strings.Contains(line, "/X ") {
-			continue
-		}
-		fields := strings.Fields(line)
-		for i, f := range fields {
-			if f == "-auth" && i+1 < len(fields) {
-				return fields[i+1]
-			}
-		}
-	}
-	return ""
-}
-
-func parseXorgArgs(args []string) (display, auth string) {
-	if len(args) == 0 {
-		return "", ""
-	}
-	base := args[0]
-	if !(base == "Xorg" || base == "X" || len(base) > 0 && base[len(base)-1] == 'X' ||
-		strings.Contains(base, "/Xorg") || strings.Contains(base, "/X")) {
-		return "", ""
-	}
-	for i, arg := range args[1:] {
-		if len(arg) > 0 && arg[0] == ':' {
-			display = arg
-		}
-		if arg == "-auth" && i+2 < len(args) {
-			auth = args[i+2]
-		}
-	}
-	return display, auth
-}
-
-func setDisplayEnv(display, auth string) {
-	os.Setenv(envDisplay, display)
-	if auth != "" {
-		os.Setenv(envXAuthority, auth)
-		log.Infof("auto-detected DISPLAY=%s XAUTHORITY=%s", display, auth)
-		return
-	}
-	log.Infof("auto-detected DISPLAY=%s", display)
-}
-
-func splitCmdline(data []byte) []string {
-	var args []string
-	for _, b := range splitNull(data) {
-		if len(b) > 0 {
-			args = append(args, string(b))
-		}
-	}
-	return args
-}
-
-func splitNull(data []byte) [][]byte {
-	var parts [][]byte
-	start := 0
-	for i, b := range data {
-		if b == 0 {
-			parts = append(parts, data[start:i])
-			start = i + 1
-		}
-	}
-	if start < len(data) {
-		parts = append(parts, data[start:])
-	}
-	return parts
-}
-
-// NewX11Capturer connects to the X11 display and sets up shared memory capture.
-// Empty cookieHex falls back to XAUTHORITY env lookup.
-func NewX11Capturer(display, cookieHex string) (*X11Capturer, error) {
-	if display == "" {
-		detectX11Display()
-		display = os.Getenv(envDisplay)
-	}
-	if display == "" {
-		return nil, fmt.Errorf("DISPLAY not set and no Xorg process found")
-	}
-
-	var conn *xgb.Conn
-	var err error
-	if cookieHex != "" {
-		conn, err = dialXUnixWithCookie(display, cookieHex)
-	} else {
-		conn, err = xgb.NewConnDisplay(display)
-	}
-	if err != nil {
-		return nil, fmt.Errorf("connect to X11 display %s: %w", display, err)
-	}
-
-	setup := xproto.Setup(conn)
-	if len(setup.Roots) == 0 {
-		conn.Close()
-		return nil, fmt.Errorf("no X11 screens")
-	}
-	screen := setup.Roots[0]
-
-	c := &X11Capturer{
-		conn:   conn,
-		screen: &screen,
-		w:      int(screen.WidthInPixels),
-		h:      int(screen.HeightInPixels),
-	}
-
-	if err := c.initSHM(); err != nil {
-		log.Debugf("X11 SHM not available, using slow GetImage: %v", err)
-	}
-
-	log.Infof("X11 capturer ready: %dx%d (display=%s, shm=%v)", c.w, c.h, display, c.useSHM)
-	return c, nil
-}
-
-// initSHM is implemented in capture_x11_shm_linux.go (requires SysV SHM).
-// On platforms without SysV SHM (FreeBSD), a stub returns an error and
-// the capturer falls back to GetImage.
-
-// Width returns the screen width.
-func (c *X11Capturer) Width() int { return c.w }
-
-// Height returns the screen height.
-func (c *X11Capturer) Height() int { return c.h }
-
-// Capture returns the current screen as an RGBA image.
-func (c *X11Capturer) Capture() (*image.RGBA, error) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if c.useSHM {
-		return c.captureSHM()
-	}
-	return c.captureGetImage()
-}
-
-// CaptureInto fills the caller's destination buffer in one pass. The
-// source path (SHM or fallback GetImage) writes directly into dst.Pix
-// instead of going through the X11Capturer's internal double-buffer,
-// saving one full-frame memcpy per capture.
-func (c *X11Capturer) CaptureInto(dst *image.RGBA) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	if dst.Rect.Dx() != c.w || dst.Rect.Dy() != c.h {
-		return fmt.Errorf("dst size mismatch: dst=%dx%d capturer=%dx%d",
-			dst.Rect.Dx(), dst.Rect.Dy(), c.w, c.h)
-	}
-	if c.useSHM {
-		return c.captureSHMInto(dst)
-	}
-	return c.captureGetImageInto(dst)
-}
-
-func (c *X11Capturer) captureGetImageInto(dst *image.RGBA) error {
-	cookie := xproto.GetImage(c.conn, xproto.ImageFormatZPixmap,
-		xproto.Drawable(c.screen.Root),
-		0, 0, uint16(c.w), uint16(c.h), 0xFFFFFFFF)
-	reply, err := cookie.Reply()
-	if err != nil {
-		return fmt.Errorf("GetImage: %w", err)
-	}
-	n := c.w * c.h * 4
-	if len(reply.Data) < n {
-		return fmt.Errorf("GetImage returned %d bytes, expected %d", len(reply.Data), n)
-	}
-	swizzleBGRAtoRGBA(dst.Pix, reply.Data)
-	return nil
-}
-
-// captureSHM is implemented in capture_x11_shm_linux.go.
-
-func (c *X11Capturer) captureGetImage() (*image.RGBA, error) {
-	cookie := xproto.GetImage(c.conn, xproto.ImageFormatZPixmap,
-		xproto.Drawable(c.screen.Root),
-		0, 0, uint16(c.w), uint16(c.h), 0xFFFFFFFF)
-
-	reply, err := cookie.Reply()
-	if err != nil {
-		return nil, fmt.Errorf("GetImage: %w", err)
-	}
-
-	data := reply.Data
-	n := c.w * c.h * 4
-	if len(data) < n {
-		return nil, fmt.Errorf("GetImage returned %d bytes, expected %d", len(data), n)
-	}
-
-	img := c.nextBuffer()
-	swizzleBGRAtoRGBA(img.Pix, data)
-	return img, nil
-}
-
-// nextBuffer returns the *image.RGBA the next capture should fill, advancing
-// the double-buffer index. Reallocates on geometry change.
-func (c *X11Capturer) nextBuffer() *image.RGBA {
-	c.cur ^= 1
-	b := c.bufs[c.cur]
-	if b == nil || b.Rect.Dx() != c.w || b.Rect.Dy() != c.h {
-		b = image.NewRGBA(image.Rect(0, 0, c.w, c.h))
-		c.bufs[c.cur] = b
-	}
-	return b
-}
-
-// Close releases X11 resources.
-func (c *X11Capturer) Close() {
-	c.closeSHM()
-	c.conn.Close()
-}
-
-// closeSHM is implemented in capture_x11_shm_linux.go.
-
-// X11Poller wraps X11Capturer with a staleness-cached on-demand Capture:
-// sessions drive captures themselves through the encoder goroutine, so we
-// don't need a background ticker. The last result is cached for a short
-// window so concurrent sessions coalesce into one capture.
-//
-// The capturer is allocated lazily on first use and released when all
-// clients disconnect, so an idle peer holds no X connection or SHM segment.
-type X11Poller struct {
-	mu sync.Mutex
-
-	capturer *X11Capturer
-	w, h     int
-	// closed at Close so callers can stop waiting on retry backoff.
-	done chan struct{}
-
-	// lastFrame/lastAt implement a small cache: multiple near-simultaneous
-	// Capture calls (multi-client, or input-coalesced) return the same
-	// frame instead of hammering the X server.
-	lastFrame *image.RGBA
-	lastAt    time.Time
-
-	// initBackoffUntil throttles capturer re-init when the X server is
-	// unavailable or flapping.
-	initBackoffUntil time.Time
-
-	clients atomic.Int32
-	display string
-	// cookieHex authenticates the X11 connection; empty falls back to XAUTHORITY env.
-	cookieHex string
-}
-
-// initRetryBackoff gates capturer re-init attempts after a failure so we
-// don't spin on X server errors.
-const initRetryBackoff = 2 * time.Second
-
-// NewX11Poller creates a lazy on-demand capturer for the given X display.
-// Empty cookieHex falls back to XAUTHORITY env lookup.
-func NewX11Poller(display, cookieHex string) *X11Poller {
-	return &X11Poller{
-		display:   display,
-		cookieHex: cookieHex,
-		done:      make(chan struct{}),
-	}
-}
-
-// ClientConnect increments the active client count. The first client triggers
-// eager capturer initialisation so that the first FBUpdateRequest doesn't
-// pay the X11 connect + SHM attach latency.
-func (p *X11Poller) ClientConnect() {
-	if p.clients.Add(1) == 1 {
-		p.mu.Lock()
-		_ = p.ensureCapturerLocked()
-		p.mu.Unlock()
-	}
-}
-
-// ClientDisconnect decrements the active client count. On the last
-// disconnect we close the underlying capturer so idle peers cost nothing.
-func (p *X11Poller) ClientDisconnect() {
-	if p.clients.Add(-1) == 0 {
-		p.mu.Lock()
-		if p.capturer != nil {
-			p.capturer.Close()
-			p.capturer = nil
-			p.lastFrame = nil
-		}
-		p.mu.Unlock()
-	}
-}
-
-// Close releases all resources. Subsequent Capture calls will fail.
-func (p *X11Poller) Close() {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	select {
-	case <-p.done:
-	default:
-		close(p.done)
-	}
-	if p.capturer != nil {
-		p.capturer.Close()
-		p.capturer = nil
-	}
-}
-
-// Width returns the screen width. Triggers lazy init if needed.
-func (p *X11Poller) Width() int {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	_ = p.ensureCapturerLocked()
-	return p.w
-}
-
-// Height returns the screen height. Triggers lazy init if needed.
-func (p *X11Poller) Height() int {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	_ = p.ensureCapturerLocked()
-	return p.h
-}
-
-// Cursor satisfies cursorSource by forwarding to the lazily-initialised
-// X11Capturer. Asking for the cursor on an idle poller triggers the same
-// lazy X11 connection setup as a capture would.
-func (p *X11Poller) Cursor() (*image.RGBA, int, int, uint64, error) {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if err := p.ensureCapturerLocked(); err != nil {
-		return nil, 0, 0, 0, err
-	}
-	return p.capturer.Cursor()
-}
-
-// CursorPos satisfies cursorPositionSource by forwarding to the X11Capturer.
-func (p *X11Poller) CursorPos() (int, int, error) {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if err := p.ensureCapturerLocked(); err != nil {
-		return 0, 0, err
-	}
-	return p.capturer.CursorPos()
-}
-
-// Capture returns a fresh frame, serving from the short-lived cache if a
-// previous caller captured within freshWindow.
-func (p *X11Poller) Capture() (*image.RGBA, error) {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	if p.lastFrame != nil && time.Since(p.lastAt) < freshWindow {
-		return p.lastFrame, nil
-	}
-	if err := p.ensureCapturerLocked(); err != nil {
-		return nil, err
-	}
-	img, err := p.capturer.Capture()
-	if err != nil {
-		// Drop the capturer so the next call re-inits; the X connection may
-		// have died (e.g. Xorg restart).
-		p.capturer.Close()
-		p.capturer = nil
-		p.initBackoffUntil = time.Now().Add(initRetryBackoff)
-		return nil, fmt.Errorf("x11 capture: %w", err)
-	}
-	p.lastFrame = img
-	p.lastAt = time.Now()
-	return img, nil
-}
-
-// CaptureInto fills dst directly via the underlying capturer, bypassing
-// the freshness cache. The session's prevFrame/curFrame swap means each
-// session needs its own buffer anyway, so caching wouldn't help.
-func (p *X11Poller) CaptureInto(dst *image.RGBA) error {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	if err := p.ensureCapturerLocked(); err != nil {
-		return err
-	}
-	if err := p.capturer.CaptureInto(dst); err != nil {
-		p.capturer.Close()
-		p.capturer = nil
-		p.initBackoffUntil = time.Now().Add(initRetryBackoff)
-		return fmt.Errorf("x11 capture: %w", err)
-	}
-	return nil
-}
-
-// ensureCapturerLocked initialises the underlying X11Capturer if not
-// already open. Caller must hold p.mu.
-func (p *X11Poller) ensureCapturerLocked() error {
-	if p.capturer != nil {
-		return nil
-	}
-	select {
-	case <-p.done:
-		return fmt.Errorf("x11 capturer closed")
-	default:
-	}
-	if time.Now().Before(p.initBackoffUntil) {
-		return fmt.Errorf("x11 capturer unavailable (retry scheduled)")
-	}
-	c, err := NewX11Capturer(p.display, p.cookieHex)
-	if err != nil {
-		p.initBackoffUntil = time.Now().Add(initRetryBackoff)
-		log.Debugf("X11 capturer: %v", err)
-		return err
-	}
-	p.capturer = c
-	p.w, p.h = c.Width(), c.Height()
-	return nil
-}

client/vnc/server/capture_x11_shm_linux.go

@@ -1,96 +0,0 @@
-//go:build linux && !android
-
-package server
-
-import (
-	"fmt"
-	"image"
-
-	"github.com/jezek/xgb/shm"
-	"github.com/jezek/xgb/xproto"
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
-)
-
-func (c *X11Capturer) initSHM() error {
-	if err := shm.Init(c.conn); err != nil {
-		return fmt.Errorf("init SHM extension: %w", err)
-	}
-
-	size := c.w * c.h * 4
-	id, err := unix.SysvShmGet(unix.IPC_PRIVATE, size, unix.IPC_CREAT|0600)
-	if err != nil {
-		return fmt.Errorf("shmget: %w", err)
-	}
-
-	addr, err := unix.SysvShmAttach(id, 0, 0)
-	if err != nil {
-		if _, ctlErr := unix.SysvShmCtl(id, unix.IPC_RMID, nil); ctlErr != nil {
-			log.Debugf("shmctl IPC_RMID on attach failure: %v", ctlErr)
-		}
-		return fmt.Errorf("shmat: %w", err)
-	}
-
-	if _, err := unix.SysvShmCtl(id, unix.IPC_RMID, nil); err != nil {
-		log.Debugf("shmctl IPC_RMID: %v", err)
-	}
-
-	seg, err := shm.NewSegId(c.conn)
-	if err != nil {
-		if detachErr := unix.SysvShmDetach(addr); detachErr != nil {
-			log.Debugf("shmdt on new-seg failure: %v", detachErr)
-		}
-		return fmt.Errorf("new SHM seg: %w", err)
-	}
-
-	if err := shm.AttachChecked(c.conn, seg, uint32(id), false).Check(); err != nil {
-		if detachErr := unix.SysvShmDetach(addr); detachErr != nil {
-			log.Debugf("shmdt on attach-checked failure: %v", detachErr)
-		}
-		return fmt.Errorf("SHM attach to X: %w", err)
-	}
-
-	c.shmID = id
-	c.shmAddr = addr
-	c.shmSeg = uint32(seg)
-	c.useSHM = true
-	return nil
-}
-
-func (c *X11Capturer) captureSHM() (*image.RGBA, error) {
-	if err := c.fillSHM(); err != nil {
-		return nil, err
-	}
-	img := c.nextBuffer()
-	swizzleBGRAtoRGBA(img.Pix, c.shmAddr[:c.w*c.h*4])
-	return img, nil
-}
-
-// captureSHMInto runs a single SHM GetImage and swizzles directly into the
-// caller-provided destination, skipping the internal double-buffer.
-func (c *X11Capturer) captureSHMInto(dst *image.RGBA) error {
-	if err := c.fillSHM(); err != nil {
-		return err
-	}
-	swizzleBGRAtoRGBA(dst.Pix, c.shmAddr[:c.w*c.h*4])
-	return nil
-}
-
-func (c *X11Capturer) fillSHM() error {
-	cookie := shm.GetImage(c.conn, xproto.Drawable(c.screen.Root),
-		0, 0, uint16(c.w), uint16(c.h), 0xFFFFFFFF,
-		xproto.ImageFormatZPixmap, shm.Seg(c.shmSeg), 0)
-	if _, err := cookie.Reply(); err != nil {
-		return fmt.Errorf("SHM GetImage: %w", err)
-	}
-	return nil
-}
-
-func (c *X11Capturer) closeSHM() {
-	if c.useSHM {
-		shm.Detach(c.conn, shm.Seg(c.shmSeg))
-		if err := unix.SysvShmDetach(c.shmAddr); err != nil {
-			log.Debugf("shmdt on close: %v", err)
-		}
-	}
-}

client/vnc/server/capture_x11_shm_stub.go

@@ -1,24 +0,0 @@
-//go:build freebsd
-
-package server
-
-import (
-	"fmt"
-	"image"
-)
-
-func (c *X11Capturer) initSHM() error {
-	return fmt.Errorf("SysV SHM not available on this platform")
-}
-
-func (c *X11Capturer) captureSHM() (*image.RGBA, error) {
-	return nil, fmt.Errorf("SHM capture not available on this platform")
-}
-
-func (c *X11Capturer) captureSHMInto(_ *image.RGBA) error {
-	return fmt.Errorf("SHM capture not available on this platform")
-}
-
-func (c *X11Capturer) closeSHM() {
-	// no SHM to close on this platform
-}