Go mod tidy

* Add regression test for relay state lock
* Make connect not hold a lock in openConnVia

agent-network/README.md

@@ -1,47 +1,16 @@
 # NetBird Agent Network
 
-Agent Network is NetBird's access control layer for AI agents and the people who run them. 
-It gives every agent a real identity, tied to an identity provider (IdP), and governs what it can reach: LLM APIs and 
-AI gateways it can call, and the internal resources it can access. Traffic flows only over the encrypted NetBird tunnel, 
-scoped by policy, with no API keys or other credentials to leak. It also gives you control over cost and token usage.
+Agent Network is NetBird's access control layer for AI agents and the people who run
+them. It gives every agent a real identity, tied to your identity provider (IdP), and
+governs what it can reach — the LLM APIs and AI gateways it can call, and the internal
+resources it can access. Traffic flows only over the encrypted NetBird tunnel, scoped by
+policy, with no API keys to leak.
 
-Because every LLM request passes through an
-identity-aware proxy, you can:
-
-- **Set spending and rate limits** per agent, per user, or per team — with hard caps
-  that stop requests once a budget is reached.
-- **Restrict models and providers** so agents can only call approved (and cost-appropriate)
-  endpoints, keeping expensive models off-limits unless explicitly allowed.
-- **Attribute usage** by tracking token consumption and cost per identity, group, or cost center so every
-  request is tied back to the agent and person responsible.
-- **Reuse your existing AI gateway** — point the proxy at a gateway you already run,
-  keeping its routing and config in place while it adds identity on top, so you skip
-  API key distribution.
-
-https://github.com/user-attachments/assets/44d18286-d8ab-49f8-a457-98ccd66f3268
-
-> **Beta.** Agent Network is in beta, but it's stable and already running in
-> production environments. It's fully open source and can be self-hosted on your own
-> infrastructure, with no vendor lock-in and no data leaving your environment.
+> **Beta.** Agent Network is open source and can be self-hosted on your own
+> infrastructure.
 
 ## How it works
 
-Say you have a simple use case: your Engineering or IT team needs access to Claude Code or Codex, and you want visibility into usage plus the ability to enforce budgets.
-How can you do that without creating a dedicated API key for every team?
-
-With Agent Network you get a private endpoint inside your network, for example: https://mirror.netbird.ai
-Teams configure their agents to point to that endpoint instead of using individual API keys directly. 
-
-This endpoint is only reachable when users are connected to your NetBird network and authenticated through your IdP. Otherwise, it is not accessible from the public internet.
-You can then use this private endpoint to configure your AI agents, whether that is Claude Code, Codex, or another tool.
-
-## Quickstart
-
-Full step-by-step setup:
-**https://docs.netbird.io/agent-network/quickstart**
-
-## Architecture 
-
 Agent Network is built on two existing NetBird capabilities:
 
 - **Overlay network** — the encrypted WireGuard mesh between peers.
@@ -53,9 +22,6 @@ LLM traffic is routed through the proxy's identity-aware pipeline, while interna
 resources (databases, internal APIs, self-hosted models) are reached directly over
 peer-to-peer WireGuard tunnels, governed by the same identities and access policies.
 
-<img width="4720" height="2218" alt="image" src="https://github.com/user-attachments/assets/1afa5da1-4b82-4f8a-a7a8-f417efadf1eb" />
-
-
 ## Where the code lives
 
 There is no separate "agent-network" service — it reuses the reverse-proxy and management

client/internal/conn_mgr.go

@@ -109,7 +109,7 @@ func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) er
 			return nil
 		}
 
-		log.Infof("lazy connection manager is enabled by the management feature flag")
+		log.Warnf("lazy connection manager is enabled by management feature flag")
 		e.initLazyManager(ctx)
 		e.statusRecorder.UpdateLazyConnection(true)
 		return e.addPeersToLazyConnManager()

client/internal/netflow/store/event_aggregation_test.go

@@ -175,9 +175,7 @@ func TestFlowAggregationOfUnknownProtocols(t *testing.T) {
 }
 
 func TestResetAggregationWindow(t *testing.T) {
-	now := time.Now()
-	nowFunc := func() time.Time { return now }
-	store := NewAggregatingMemoryStoreWithTimeFunc(nowFunc)
+	store := NewAggregatingMemoryStore()
 	store.StoreEvent(&types.Event{
 		ID:        uuid.New(),
 		Timestamp: time.Now(),
@@ -200,7 +198,6 @@ func TestResetAggregationWindow(t *testing.T) {
 		},
 	})
 
-	now = now.Add(1 * time.Second)
 	reset := store.ResetAggregationWindow()
 	previousEvents, ok := reset.(*AggregatingMemory)
 	assert.True(t, ok)

client/internal/netflow/store/memory.go

@@ -29,7 +29,6 @@ type AggregatingMemory struct {
 	WindowStart time.Time
 	WindowEnd   time.Time
 	rnd         *v2.PCG
-	nowFunc     func() time.Time
 }
 
 func (m *Memory) StoreEvent(event *types.Event) {
@@ -63,19 +62,14 @@ func (m *Memory) DeleteEvents(ids []uuid.UUID) {
 }
 
 func NewAggregatingMemoryStore() *AggregatingMemory {
-	return NewAggregatingMemoryStoreWithTimeFunc(defaultNowFunc)
-}
-
-// used in tests when deterministic (less random) time intervals are required
-func NewAggregatingMemoryStoreWithTimeFunc(nowFunc func() time.Time) *AggregatingMemory {
-	return &AggregatingMemory{WindowStart: nowFunc(), Memory: Memory{events: make(map[uuid.UUID]*types.Event)}, nowFunc: nowFunc, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
+	return &AggregatingMemory{WindowStart: time.Now(), Memory: Memory{events: make(map[uuid.UUID]*types.Event)}, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
 }
 
 func (am *AggregatingMemory) ResetAggregationWindow() types.FlowEventAggregator {
 	am.mux.Lock()
 	defer am.mux.Unlock()
 
-	now := am.nowFunc()
+	now := time.Now()
 	toret := AggregatingMemory{WindowStart: am.WindowStart, WindowEnd: now, Memory: Memory{events: am.events}, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
 
 	am.events = make(map[uuid.UUID]*types.Event)
@@ -158,7 +152,3 @@ func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event {
 
 	return slices.Collect(maps.Values(aggregated)) // could return an iterator instead here
 }
-
-func defaultNowFunc() time.Time {
-	return time.Now()
-}

client/internal/profilemanager/service.go

@@ -11,7 +11,6 @@ import (
 	"runtime"
 	"sort"
 	"strings"
-	"syscall"
 
 	log "github.com/sirupsen/logrus"
 
@@ -440,11 +439,7 @@ func (s *ServiceManager) GetStatePath() string {
 
 	activeProf, err := s.GetActiveProfileState()
 	if err != nil {
-		if errors.Is(err, syscall.ENOSYS) {
-			log.Debugf("active profile state unavailable on this platform: %v", err)
-		} else {
-			log.Warnf("failed to get active profile state: %v", err)
-		}
+		log.Warnf("failed to get active profile state: %v", err)
 		return defaultStatePath
 	}
 

client/internal/routemanager/manager.go

@@ -12,7 +12,6 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
-	"syscall"
 	"time"
 
 	"github.com/google/uuid"
@@ -265,11 +264,7 @@ func (m *DefaultManager) initSelector() *routeselector.RouteSelector {
 
 	// restore selector state if it exists
 	if err := m.stateManager.LoadState(state); err != nil {
-		if errors.Is(err, syscall.ENOSYS) {
-			log.Debugf("route selector state unavailable on this platform: %v", err)
-		} else {
-			log.Warnf("failed to load state: %v", err)
-		}
+		log.Warnf("failed to load state: %v", err)
 		return routeselector.NewRouteSelector()
 	}
 

client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx

@@ -1,13 +1,10 @@
-import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { AlertTriangleIcon, DownloadIcon } from "lucide-react";
 import { Browser } from "@wailsio/runtime";
-import { Version } from "@bindings/services";
 import { Button } from "@/components/buttons/Button";
 import { useStatus } from "@/contexts/StatusContext.tsx";
 
 const RELEASES_URL = "https://github.com/netbirdio/netbird/releases/latest";
-const RC_RELEASES_URL = "https://pkgs.netbird.io/releases/rc";
 
 function openUrl(url: string) {
     Browser.OpenURL(url).catch(() => globalThis.open(url, "_blank"));
@@ -15,26 +12,7 @@ function openUrl(url: string) {
 
 export const DaemonOutdatedOverlay = () => {
     const { t } = useTranslation();
-    const { status, isDaemonOutdated } = useStatus();
-
-    const [guiVersion, setGuiVersion] = useState<string>("-");
-    const clientVersion = status?.daemonVersion ?? "—";
-
-    const isRc = /-rc/i.test(guiVersion) || /-rc/i.test(clientVersion);
-    const downloadUrl = isRc ? RC_RELEASES_URL : RELEASES_URL;
-
-    useEffect(() => {
-        if (!isDaemonOutdated) return;
-        let cancelled = false;
-        Version.GUI()
-            .then((v) => {
-                if (!cancelled) setGuiVersion(v);
-            })
-            .catch((err) => console.error("[DaemonOutdatedOverlay] GUI version error", err));
-        return () => {
-            cancelled = true;
-        };
-    }, [isDaemonOutdated]);
+    const { isDaemonOutdated } = useStatus();
 
     if (!isDaemonOutdated) return null;
 
@@ -60,37 +38,10 @@ export const DaemonOutdatedOverlay = () => {
                     <p className={"text-sm text-nb-gray-300"}>{t("daemon.outdated.description")}</p>
                 </div>
 
-                <div className={"flex flex-col items-center gap-0.5 text-center"}>
-                    <p className={"text-sm font-semibold text-nb-gray-100"}>
-                        {clientVersion === "development" ? (
-                            <span>
-                                {t("settings.about.clientName")}{" "}
-                                <span className={"font-mono text-yellow-400"}>
-                                    {t("settings.about.development")}
-                                </span>
-                            </span>
-                        ) : (
-                            t("settings.about.client", { version: clientVersion })
-                        )}
-                    </p>
-                    <p className={"text-sm font-medium text-nb-gray-250"}>
-                        {guiVersion === "development" ? (
-                            <span>
-                                {t("settings.about.guiName")}{" "}
-                                <span className={"font-mono text-yellow-400"}>
-                                    {t("settings.about.development")}
-                                </span>
-                            </span>
-                        ) : (
-                            t("settings.about.gui", { version: guiVersion })
-                        )}
-                    </p>
-                </div>
-
                 <div className={"wails-no-draggable"}>
-                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(downloadUrl)}>
+                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(RELEASES_URL)}>
                         <DownloadIcon size={14} />
-                        {t("daemon.outdated.download")}
+                        {t("update.card.getInstaller")}
                     </Button>
                 </div>
             </div>

client/ui/i18n/locales/de/common.json

@@ -1293,13 +1293,10 @@
         "message": "Dokumentation"
     },
     "daemon.outdated.title": {
-        "message": "NetBird Client ist veraltet"
+        "message": "NetBird-Dienst ist veraltet"
     },
     "daemon.outdated.description": {
-        "message": "Die neue GUI ist nicht mit Ihrem älteren Client kompatibel. Aktualisieren Sie Ihren Client, um die neue Anwendung zu verwenden."
-    },
-    "daemon.outdated.download": {
-        "message": "Neueste Version herunterladen"
+        "message": "Aktualisieren Sie den NetBird-Dienst, um diese App zu verwenden."
     },
     "error.jwt_clock_skew": {
         "message": "Anmeldung fehlgeschlagen: Die Uhr dieses Geräts ist nicht mit dem Server synchron. Bitte synchronisieren Sie die Systemuhr und versuchen Sie es erneut."

client/ui/i18n/locales/en/common.json

@@ -1724,16 +1724,12 @@
         "description": "Documentation link on the daemon-unavailable overlay."
     },
     "daemon.outdated.title": {
-        "message": "NetBird Client Is Outdated",
-        "description": "Title of the overlay shown when the NetBird client (daemon) is too old to drive this UI."
+        "message": "NetBird Service Is Outdated",
+        "description": "Title of the overlay shown when the NetBird background service is too old to drive this UI."
     },
     "daemon.outdated.description": {
-        "message": "The new GUI isn't compatible with the older NetBird client. Update your client to use the new application.",
-        "description": "Body of the daemon-outdated overlay explaining that the GUI is newer than the client and the client must be updated."
-    },
-    "daemon.outdated.download": {
-        "message": "Download Latest",
-        "description": "Button on the daemon-outdated overlay that opens the download page for the latest release."
+        "message": "Update the NetBird service to use this app.",
+        "description": "Body of the daemon-outdated overlay telling the user to upgrade the service."
     },
     "error.jwt_clock_skew": {
         "message": "Sign-in failed: this device's clock is out of sync with the server. Please sync your system clock and try again.",

client/ui/i18n/locales/es/common.json

@@ -1293,13 +1293,10 @@
         "message": "Documentación"
     },
     "daemon.outdated.title": {
-        "message": "NetBird Client está desactualizado"
+        "message": "El servicio de NetBird está desactualizado"
     },
     "daemon.outdated.description": {
-        "message": "La nueva GUI no es compatible con su cliente anterior. Actualice su cliente para usar la nueva aplicación."
-    },
-    "daemon.outdated.download": {
-        "message": "Descargar la última versión"
+        "message": "Actualice el servicio de NetBird para usar esta aplicación."
     },
     "error.jwt_clock_skew": {
         "message": "Error al iniciar sesión: el reloj de este dispositivo no está sincronizado con el servidor. Sincronice el reloj del sistema e inténtelo de nuevo."

client/ui/i18n/locales/fr/common.json

@@ -1293,13 +1293,10 @@
         "message": "Documentation"
     },
     "daemon.outdated.title": {
-        "message": "Le Client NetBird est obsolète"
+        "message": "Le service NetBird est obsolète"
     },
     "daemon.outdated.description": {
-        "message": "La nouvelle GUI n'est pas compatible avec votre ancien client. Mettez à jour votre client pour utiliser la nouvelle application."
-    },
-    "daemon.outdated.download": {
-        "message": "Télécharger la dernière version"
+        "message": "Mettez à jour le service NetBird pour utiliser cette application."
     },
     "error.jwt_clock_skew": {
         "message": "Échec de la connexion : l’horloge de cet appareil n’est pas synchronisée avec le serveur. Veuillez synchroniser l’horloge de votre système et réessayer."

client/ui/i18n/locales/hu/common.json

@@ -1293,13 +1293,10 @@
         "message": "Dokumentáció"
     },
     "daemon.outdated.title": {
-        "message": "A NetBird Kliens elavult"
+        "message": "A NetBird szolgáltatás elavult"
     },
     "daemon.outdated.description": {
-        "message": "Az új GUI nem kompatibilis a régebbi klienseddel. Frissítsd a klienst az új alkalmazás használatához."
-    },
-    "daemon.outdated.download": {
-        "message": "Legújabb letöltése"
+        "message": "Frissítsd a NetBird szolgáltatást az alkalmazás használatához."
     },
     "error.jwt_clock_skew": {
         "message": "A bejelentkezés sikertelen: az eszköz órája eltér a szerverétől. Kérjük, szinkronizálja a rendszer óráját, majd próbálja újra."

client/ui/i18n/locales/it/common.json

@@ -1293,13 +1293,10 @@
         "message": "Documentazione"
     },
     "daemon.outdated.title": {
-        "message": "NetBird Client è obsoleto"
+        "message": "Il servizio NetBird è obsoleto"
     },
     "daemon.outdated.description": {
-        "message": "La nuova GUI non è compatibile con il tuo client precedente. Aggiorna il client per usare la nuova applicazione."
-    },
-    "daemon.outdated.download": {
-        "message": "Scarica l'ultima versione"
+        "message": "Aggiorna il servizio NetBird per usare questa app."
     },
     "error.jwt_clock_skew": {
         "message": "Accesso non riuscito: l'orologio di questo dispositivo non è sincronizzato con il server. Sincronizzi l'orologio di sistema e riprovi."

client/ui/i18n/locales/pt/common.json

@@ -1293,13 +1293,10 @@
         "message": "Documentação"
     },
     "daemon.outdated.title": {
-        "message": "O NetBird Client está desatualizado"
+        "message": "O serviço NetBird está desatualizado"
     },
     "daemon.outdated.description": {
-        "message": "A nova GUI não é compatível com o seu cliente mais antigo. Atualize o seu cliente para usar o novo aplicativo."
-    },
-    "daemon.outdated.download": {
-        "message": "Baixar a versão mais recente"
+        "message": "Atualize o serviço NetBird para usar este aplicativo."
     },
     "error.jwt_clock_skew": {
         "message": "Falha no login: o relógio deste dispositivo está fora de sincronia com o servidor. Sincronize o relógio do sistema e tente novamente."

client/ui/i18n/locales/ru/common.json

@@ -1293,13 +1293,10 @@
         "message": "Документация"
     },
     "daemon.outdated.title": {
-        "message": "Клиент NetBird устарел"
+        "message": "Служба NetBird устарела"
     },
     "daemon.outdated.description": {
-        "message": "Новый GUI несовместим с вашим более старым клиентом. Обновите клиент, чтобы использовать новое приложение."
-    },
-    "daemon.outdated.download": {
-        "message": "Скачать последнюю версию"
+        "message": "Обновите службу NetBird, чтобы использовать это приложение."
     },
     "error.jwt_clock_skew": {
         "message": "Не удалось войти: часы этого устройства рассинхронизированы с сервером. Синхронизируйте системные часы и повторите попытку."

client/ui/i18n/locales/zh-CN/common.json

@@ -1293,13 +1293,10 @@
         "message": "文档"
     },
     "daemon.outdated.title": {
-        "message": "NetBird 客户端版本过旧"
+        "message": "NetBird 服务版本过旧"
     },
     "daemon.outdated.description": {
-        "message": "新版 GUI 与您较旧的客户端不兼容。请更新客户端以使用新应用。"
-    },
-    "daemon.outdated.download": {
-        "message": "下载最新版本"
+        "message": "请更新 NetBird 服务以使用此应用。"
     },
     "error.jwt_clock_skew": {
         "message": "登录失败：此设备的时钟与服务器不同步。请同步您的系统时钟后重试。"

client/wasm/internal/rdp/rdcleanpath.go

@@ -23,7 +23,7 @@ const (
 	RDCleanPathProxyHost   = "rdcleanpath.proxy.local"
 	RDCleanPathProxyScheme = "ws"
 
-	rdpDialTimeout = 30 * time.Second
+	rdpDialTimeout = 15 * time.Second
 
 	GeneralErrorCode = 1
 	WSAETimedOut     = 10060

shared/management/http/api/openapi.yml

@@ -9327,18 +9327,6 @@ paths:
           required: false
           schema:
             type: string
-        - name: source_id
-          in: query
-          description: Filter by source endpoint ID
-          required: false
-          schema:
-            type: string
-        - name: destination_id
-          in: query
-          description: Filter by destination endpoint ID
-          required: false
-          schema:
-            type: string
         - name: protocol
           in: query
           description: Filter by protocol

shared/management/http/api/types.gen.go

@@ -5857,12 +5857,6 @@ type GetApiEventsNetworkTrafficParams struct {
 	// ReporterId Filter by reporter ID
 	ReporterId *string `form:"reporter_id,omitempty" json:"reporter_id,omitempty"`
 
-	// SourceId Filter by source endpoint ID
-	SourceId *string `form:"source_id,omitempty" json:"source_id,omitempty"`
-
-	// DestinationId Filter by destination endpoint ID
-	DestinationId *string `form:"destination_id,omitempty" json:"destination_id,omitempty"`
-
 	// Protocol Filter by protocol
 	Protocol *int `form:"protocol,omitempty" json:"protocol,omitempty"`
 

shared/relay/client/dialer/ws/close_generic.go

@@ -1,9 +0,0 @@
-//go:build !js
-
-package ws
-
-// closeConn closes the underlying WebSocket immediately, skipping the close
-// handshake.
-func (c *Conn) closeConn() error {
-	return c.Conn.CloseNow()
-}

shared/relay/client/dialer/ws/close_js.go

@@ -1,25 +0,0 @@
-//go:build js
-
-package ws
-
-import (
-	"github.com/coder/websocket"
-	log "github.com/sirupsen/logrus"
-)
-
-// closeConn closes the browser WebSocket without blocking the caller.
-//
-// The browser close API only accepts codes 1000 and 3000-4999, so CloseNow's
-// 1001 (going away) throws an InvalidAccessError. Close with a valid code
-// waits for the browser close event before returning, which can park the
-// calling goroutine (the relay teardown path holds its mutexes while closing)
-// until the close handshake finishes. Run the close in the background and
-// report success; a teardown close error is not actionable.
-func (c *Conn) closeConn() error {
-	go func() {
-		if err := c.Conn.Close(websocket.StatusNormalClosure, ""); err != nil {
-			log.Debugf("failed to close relay websocket: %v", err)
-		}
-	}()
-	return nil
-}

shared/relay/client/dialer/ws/conn.go

@@ -77,5 +77,5 @@ func (c *Conn) SetDeadline(t time.Time) error {
 }
 
 func (c *Conn) Close() error {
-	return c.closeConn()
+	return c.Conn.CloseNow()
 }