[management] Expose live model discovery on the provider API

Adds POST /api/agent-network/catalog/providers/models, so the provider
form can offer the models an operator's own credential can reach instead
of only the compiled-in catalog.

A caller names a catalog provider and supplies either the key they are
typing (the record does not exist yet) or the id of a saved record whose
stored credential should be reused — which lets the dashboard refresh a
list without ever holding the key. The two are mutually exclusive:
accepting both would run an arbitrary credential under the identity of a
record the caller may only be permitted to read. When a record id is
given, the catalog id and upstream come from the record too, so the
credential cannot be aimed at a different vendor's endpoint.

Gated on Create rather than Read. This spends the operator's credential
against a third party, which is not something a read-only role should be
able to make the server do.

A provider with no listing endpoint answers 422 rather than 500: the
caller falls back to the catalog's own models on that outcome, so it has
to be distinguishable from a failure.

The region is read back out of the configured upstream by matching it
against the catalog's host template, since a provider record has no
region field and the operator already encoded one when they set up
inference. An upstream matching no template is refused rather than
guessed at — a wrong region would dial another account's endpoint.

AGENTS.md

@@ -1,6 +1,6 @@
 # NetBird Agent Guidelines
 
-**NetBird** is an open source connectivity platform: a WireGuard®-based overlay
+**NetBird** is an open-source connectivity platform: a WireGuard®-based overlay
 network with a control plane. The **agent** (`client/`) runs on user machines as
 a privileged daemon and manages the WireGuard interface, routing, firewall, and
 DNS. **Management** (`management/`) is the control plane and REST/gRPC API,

CONTRIBUTING.md

@@ -479,7 +479,7 @@ go test -race ./client/internal/dns/...
 
 ## Checklist before submitting a PR
 
-As a critical network service and open source project, we must enforce a few
+As a critical network service and open-source project, we must enforce a few
 things before submitting a pull request. The
 [pull request template](/.github/pull_request_template.md) mirrors this list —
 fill it in rather than deleting it.

README.md

@@ -130,7 +130,7 @@ In November 2022, NetBird joined the [StartUpSecure program](https://www.forschu
 ![CISPA_Logo_BLACK_EN_RZ_RGB (1)](https://user-images.githubusercontent.com/700848/203091324-c6d311a0-22b5-4b05-a288-91cbc6cdcc46.png)
 
 ### Acknowledgements
-We build on open source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
+We build on open-source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
 
 ### Legal
 This repository is licensed under the BSD-3-Clause license, which applies to all parts of the repository except for the directories management/, signal/ and relay/.

SECURITY.md

@@ -14,7 +14,7 @@ Report security issues one of these two ways:
   on this repository. This is the preferred route: it keeps the discussion, the draft advisory, and the credit in one place.
 - **Email** — `security@netbird.io`.
 
-If the finding affects NetBird Cloud or our hosted infrastructure rather than the open source code, email us rather than
+If the finding affects NetBird Cloud or our hosted infrastructure rather than the open-source code, email us rather than
 filing a repository report.
 
 ### What to include

agent-network/README.md

@@ -40,6 +40,35 @@ You can then use this private endpoint to configure your AI agents, whether that
 Full step-by-step setup:
 **https://docs.netbird.io/agent-network/quickstart**
 
+## Client settings that don't follow the endpoint
+
+Most of an agent's traffic follows the base URL you hand it, but a few
+client-side checks call their vendor directly and never reach the proxy. On a
+network that blocks direct egress they fail even though inference works, so
+they are worth setting once when you roll the endpoint out.
+
+For Claude Code:
+
+- **Fast mode** checks availability against `api.anthropic.com` rather than the
+  configured base URL. Set `CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK=1` when the
+  agent authenticates with `ANTHROPIC_AUTH_TOKEN` alone (the usual shape when
+  the proxy injects the real provider key) or when a TLS-inspecting proxy
+  answers the check itself. Set
+  `CLAUDE_CODE_SKIP_FAST_MODE_NETWORK_ERRORS=1` when the network refuses the
+  connection outright. Fast mode is an Anthropic-API feature, so it is
+  unavailable on a Bedrock- or Vertex-backed endpoint whatever you set.
+- **Model discovery** is off by default. Set
+  `CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1` for the picker to list the
+  models your policies authorise; the proxy filters the response to that set.
+  The client gives discovery a three-second budget and treats any redirect as
+  a failure, so the endpoint must serve `/v1/models` directly.
+- **The WebFetch domain safety check** also calls `api.anthropic.com` directly
+  and is unaffected by the variables above.
+
+Allowing direct egress to `api.anthropic.com` covers the network cases but not
+the credential one, where the check reaches Anthropic and is rejected because
+the agent presents a proxy-issued key.
+
 ## Architecture 
 
 Agent Network is built on two existing NetBird capabilities:

client/android/client.go

@@ -26,8 +26,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/routemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netstate"
-	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -42,6 +40,11 @@ const (
 	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
 )
 
+// ConnectionListener export internal Listener for mobile
+type ConnectionListener interface {
+	peer.Listener
+}
+
 // TunAdapter export internal TunAdapter for mobile
 type TunAdapter interface {
 	device.TunAdapter
@@ -82,13 +85,6 @@ type Client struct {
 	deviceName            string
 	uiVersion             string
 	networkChangeListener listener.NetworkChangeListener
-	// netState outlives engine restarts: it mirrors the OS connectivity, not
-	// the engine lifecycle. Run and RunWithoutLogin inject it into each new
-	// ConnectClient, which distributes it to every reconnection loop.
-	netState *netstate.State
-
-	// sweeper also outlives engine restarts; NotifyNetworkChange sweeps it.
-	sweeper *netsweep.Sweeper
 
 	stateMu       sync.RWMutex
 	connectClient *internal.ConnectClient
@@ -152,7 +148,6 @@ func NewClient(androidSDKVersion int, deviceName string, uiVersion string, tunAd
 	execWorkaround(androidSDKVersion)
 
 	net.SetAndroidProtectSocketFn(tunAdapter.ProtectSocket)
-	system.SetIFaceDiscover(iFaceDiscover)
 	return &Client{
 		deviceName:            deviceName,
 		uiVersion:             uiVersion,
@@ -161,8 +156,6 @@ func NewClient(androidSDKVersion int, deviceName string, uiVersion string, tunAd
 		recorder:              peer.NewRecorder(""),
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
-		netState:              netstate.New(),
-		sweeper:               netsweep.New(),
 	}
 }
 
@@ -203,8 +196,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	}
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
@@ -245,8 +237,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
@@ -294,24 +285,6 @@ func (c *Client) GetTunSettings() (*TunSettings, error) {
 	}, nil
 }
 
-// SetNetworkAvailable feeds OS-reported network availability into the client.
-// While unavailable, the internal reconnect loops suspend their attempts and
-// the connection listener reports NoNetwork instead of Connecting; when
-// availability returns, the loops resume immediately with a fresh backoff.
-func (c *Client) SetNetworkAvailable(available bool) {
-	c.netState.Set(available)
-	c.recorder.SetNetworkAvailable(available)
-}
-
-// NotifyNetworkChange marks the management, signal and relay connections
-// stale after the OS switched networks and schedules a sweep that cuts
-// whatever has not redialed on the new network by then. The engine and the
-// TUN device stay untouched.
-func (c *Client) NotifyNetworkChange() {
-	c.sweeper.MarkNetworkChange()
-	log.Infof("network change: connections marked stale")
-}
-
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.
 // It works both with and without a running engine. anonymizeLevel is "default"
 // or "strict"; strict also anonymizes internal IP ranges, peer names, and
@@ -552,11 +525,7 @@ func (c *Client) OnUpdatedHostDNS(list *DNSList) error {
 
 // SetConnectionListener set the network connection listener
 func (c *Client) SetConnectionListener(listener ConnectionListener) {
-	if listener == nil {
-		c.recorder.RemoveConnectionListener()
-		return
-	}
-	c.recorder.SetConnectionListener(connectionListenerAdapter{listener})
+	c.recorder.SetConnectionListener(listener)
 }
 
 // RemoveConnectionListener remove connection listener

client/android/connection_listener.go

@@ -1,41 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"github.com/netbirdio/netbird/client/internal/peer"
-)
-
-// Client state values delivered via ConnectionListener.OnStateChanged,
-// re-exported as basic constants so gomobile emits them into the generated
-// Java bindings. They mirror peer.ClientState*: append-only, never reorder.
-const (
-	ClientStateDisconnected  = int(peer.ClientStateDisconnected)
-	ClientStateConnected     = int(peer.ClientStateConnected)
-	ClientStateConnecting    = int(peer.ClientStateConnecting)
-	ClientStateDisconnecting = int(peer.ClientStateDisconnecting)
-	ClientStateNoNetwork     = int(peer.ClientStateNoNetwork)
-)
-
-// ConnectionListener export internal Listener for mobile. It mirrors
-// peer.Listener with OnStateChanged taking a plain int (one of the
-// ClientState* constants), because gomobile cannot bind named types.
-type ConnectionListener interface {
-	OnStateChanged(state int)
-	OnConnected()
-	OnDisconnected()
-	OnConnecting()
-	OnDisconnecting()
-	OnAddressChanged(string, string)
-	OnPeersListChanged(int)
-}
-
-// connectionListenerAdapter adapts the gomobile-facing ConnectionListener to
-// peer.Listener, converting the typed state to the int the binding carries.
-type connectionListenerAdapter struct {
-	ConnectionListener
-}
-
-func (a connectionListenerAdapter) OnStateChanged(state peer.ClientState) {
-	a.ConnectionListener.OnStateChanged(int(state))
-}

client/android/login.go

@@ -191,49 +191,40 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 	return nil
 }
 
+// loginHintSetter is implemented by both concrete flows (PKCE and device code)
+// but absent from the OAuthFlow interface, hence the assertion below — the same
+// way internal/auth wires it in authenticateWithPKCEFlow.
+type loginHintSetter interface {
+	SetLoginHint(hint string)
+}
+
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV, profileLoginHint(a.cfgPath))
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	return runOAuthFlow(a.ctx, oAuthFlow, urlOpener, nil)
-}
-
-// profileLoginHint returns the stored account email for the profile at cfgPath.
-// An empty hint is deliberate, not a fallback: a fresh profile leaves the
-// choice to the IdP. Switching accounts is done by switching or removing
-// profiles, not by logging out — logout keeps the email.
-func profileLoginHint(cfgPath string) string {
-	if cfgPath == "" {
-		return ""
+	// An empty hint is deliberate, not a fallback: a fresh profile leaves the
+	// choice to the IdP. Switching accounts is done by switching or removing
+	// profiles, not by logging out — logout keeps the email.
+	if a.cfgPath != "" {
+		if hint := readProfileEmail(a.cfgPath); hint != "" {
+			if setter, ok := oAuthFlow.(loginHintSetter); ok {
+				setter.SetLoginHint(hint)
+			}
+		}
 	}
-	return readProfileEmail(cfgPath)
-}
 
-// runOAuthFlow drives an already acquired OAuth flow to a token: requests the
-// flow info, presents the verification URL through the opener and waits for
-// the browser round-trip. Open is called synchronously — it is what marks the
-// surface as opened on the client side, and a fast token's OnLoginSuccess is
-// a no-op until it has, so the dismissal would be dropped rather than
-// delayed. Openers must therefore not block: they post their UI work and
-// return. onWaiting, when set, runs after the URL is shown, right before the
-// blocking wait.
-func runOAuthFlow(ctx context.Context, flow auth.OAuthFlow, urlOpener URLOpener, onWaiting func()) (*auth.TokenInfo, error) {
-	flowInfo, err := flow.RequestAuthInfo(ctx)
+	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
-		return nil, fmt.Errorf("request auth info: %w", err)
+		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)
 	}
 
-	urlOpener.Open(flowInfo.VerificationURIComplete, flowInfo.UserCode)
+	go urlOpener.Open(flowInfo.VerificationURIComplete, flowInfo.UserCode)
 
-	if onWaiting != nil {
-		onWaiting()
-	}
-
-	tokenInfo, err := flow.WaitToken(ctx, flowInfo)
+	tokenInfo, err := oAuthFlow.WaitToken(a.ctx, flowInfo)
 	if err != nil {
-		return nil, fmt.Errorf("wait for token: %w", err)
+		return nil, fmt.Errorf("waiting for browser login failed: %v", err)
 	}
 
 	return &tokenInfo, nil

client/android/profile_prefs.go

@@ -1,38 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"fmt"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-)
-
-type prefsStore interface {
-	Get(namespace string, v any) (bool, error)
-	Put(namespace string, v any) error
-}
-
-type profilePrefs struct {
-	prefs *profilemanager.Prefs
-}
-
-func newProfilePrefs(configDir, profileID string) (*profilePrefs, error) {
-	if configDir == "" || profileID == "" {
-		return nil, fmt.Errorf("profile prefs require a config dir and profile ID")
-	}
-	pm := NewProfileManager(configDir)
-	prefs, err := pm.serviceMgr.ProfilePrefs(profilemanager.ID(profileID), androidUsername)
-	if err != nil {
-		return nil, fmt.Errorf("resolve profile prefs: %w", err)
-	}
-	return &profilePrefs{prefs: prefs}, nil
-}
-
-func (p *profilePrefs) Get(namespace string, v any) (bool, error) {
-	return p.prefs.Get(namespace, v)
-}
-
-func (p *profilePrefs) Put(namespace string, v any) error {
-	return p.prefs.Put(namespace, v)
-}

client/android/ssh_client.go

@@ -1,649 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	gossh "golang.org/x/crypto/ssh"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/auth"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbssh "github.com/netbirdio/netbird/client/ssh"
-	"github.com/netbirdio/netbird/client/ssh/detection"
-)
-
-const (
-	sshDialTimeout      = 30 * time.Second
-	sshDetectionTimeout = 5 * time.Second
-)
-
-// PasswordRequiredMarker tells Java to prompt for a password and retry. It is
-// a string because gomobile flattens errors to their message, so a sentinel
-// value would not survive the binding.
-const PasswordRequiredMarker = "netbird-ssh-password-required"
-
-// HostKeyUnknownMarker tells Java to show the fingerprint and, on confirmation,
-// retry with TrustHostKey set. The presented fingerprint is appended after the
-// marker so the prompt can display it and the retry can guard against a key
-// that changed between the two connects. Only regular (non-NetBird) servers
-// reach this: NetBird peers verify against the registry.
-const HostKeyUnknownMarker = "netbird-ssh-hostkey-unknown"
-
-var (
-	errPasswordRequired = errors.New(PasswordRequiredMarker)
-	errClientClosed     = errors.New("ssh client closed")
-)
-
-// errHostKeyUnknown carries the presented fingerprint so Connect can build the
-// marker message the Java side parses.
-type errHostKeyUnknown struct {
-	fingerprint string
-}
-
-func (e *errHostKeyUnknown) Error() string {
-	return HostKeyUnknownMarker + ":" + e.fingerprint
-}
-
-// SSHTerminalListener receives SSH session events. It is implemented in Java.
-//
-// All callbacks are invoked from goroutines and may run concurrently with each
-// other; the implementation must be safe to call from any thread.
-type SSHTerminalListener interface {
-	OnConnected()
-	OnData(data []byte)
-	OnClose(reason string)
-	OnError(message string)
-}
-
-// SSHClient is a NetBird-aware SSH client exposed to Java via gomobile.
-//
-// It dials through the running NetBird tunnel and runs a standard SSH session
-// on top with PTY enabled. Host-key verification uses the NetBird-provided
-// peer SSH host keys, identical to the desktop client.
-type SSHClient struct {
-	nb        *Client
-	mu        sync.Mutex
-	listener  SSHTerminalListener
-	urlOpener URLOpener
-
-	sshClient *gossh.Client
-	session   *gossh.Session
-	stdin     io.WriteCloser
-	closed    bool
-
-	// gen identifies the current connection attempt. Connect and Close bump it,
-	// so an in-flight dial or a reader left over from a previous connection
-	// finds itself stale and stays silent instead of publishing OnConnected or
-	// OnClose for a connection the caller already abandoned.
-	gen        uint64
-	dialCancel context.CancelFunc
-
-	// knownHostsConfigDir and knownHostsProfile locate the TOFU store for
-	// regular SSH servers in the profile's preferences. Java supplies them,
-	// since an overlay IP is a different host under a different profile. Empty
-	// until set: without them a regular server cannot be verified and Connect
-	// refuses one.
-	knownHostsConfigDir string
-	knownHostsProfile   string
-	// trustHostKey carries the fingerprint the user confirmed on a previous
-	// attempt, so the retry accepts exactly that key and persists it.
-	trustHostKey string
-}
-
-// NewSSHClient creates a new SSH client bound to the running NetBird Client.
-func NewSSHClient(c *Client) *SSHClient {
-	return &SSHClient{nb: c}
-}
-
-// SetListener registers the Java listener. Must be called before Connect to
-// receive any events.
-func (s *SSHClient) SetListener(l SSHTerminalListener) {
-	s.mu.Lock()
-	s.listener = l
-	s.mu.Unlock()
-}
-
-// SetURLOpener registers the Java URL opener used to display the device-code
-// authorization page in a Custom Tabs window when the target peer requires
-// JWT authentication. Must be set before Connect to be effective.
-func (s *SSHClient) SetURLOpener(opener URLOpener) {
-	s.mu.Lock()
-	s.urlOpener = opener
-	s.mu.Unlock()
-}
-
-// SetKnownHostsStore points the TOFU host-key store at a profile's preferences.
-// Must be set before connecting to a regular SSH server; without it such a
-// server cannot be verified and Connect refuses one.
-func (s *SSHClient) SetKnownHostsStore(configDir, profileID string) {
-	s.mu.Lock()
-	s.knownHostsConfigDir = configDir
-	s.knownHostsProfile = profileID
-	s.mu.Unlock()
-}
-
-// TrustHostKey records the fingerprint the user confirmed for a regular server,
-// so the next Connect accepts that exact key and adds it to the known-hosts
-// store. Passing a fingerprint that no longer matches makes the connect fail
-// rather than trust a key that changed since the prompt.
-func (s *SSHClient) TrustHostKey(fingerprint string) {
-	s.mu.Lock()
-	s.trustHostKey = fingerprint
-	s.mu.Unlock()
-}
-
-// Connect dials the SSH server through the NetBird tunnel and performs the
-// SSH handshake. It auto-detects the server type via SSH banner inspection
-// and selects the appropriate authentication path:
-//
-//   - NetBird-SSH server requiring JWT: launches the OAuth 2.0 device-code
-//     flow, opens the verification URL through the registered URLOpener, and
-//     uses the resulting token as the SSH password. Host-key verification
-//     uses the NetBird peer registry.
-//   - NetBird-SSH server without JWT: authenticates with the NetBird SSH
-//     private key. Host-key verification uses the NetBird peer registry.
-//   - Regular SSH server (e.g. OpenSSH): authenticates with the NetBird key
-//     first (so a user-installed NetBird public key works), then falls back
-//     to the supplied password if non-empty. Host-key verification is
-//     trust-on-first-use against the per-profile known-hosts store.
-//
-// The password parameter is only consulted for regular SSH servers.
-func (s *SSHClient) Connect(host string, port int, user, password string) error {
-	if port < 1 || port > 65535 {
-		return fmt.Errorf("invalid port: %d", port)
-	}
-
-	cfg, cfgPath, cc := s.nb.authSnapshot()
-	if cc == nil {
-		return errors.New("netbird client not running")
-	}
-	if cfg == nil {
-		return errors.New("netbird config not loaded")
-	}
-	engine := cc.Engine()
-	if engine == nil {
-		return errors.New("netbird engine not available")
-	}
-
-	s.mu.Lock()
-	s.gen++
-	gen := s.gen
-	s.mu.Unlock()
-
-	serverType := detectServerType(host, port)
-	log.Debugf("SSH server type: %s", serverType)
-
-	authMethods, hostKeyCallback, err := s.buildAuth(cfg, cfgPath, engine, serverType, password)
-	if err != nil {
-		return err
-	}
-
-	clientConfig := &gossh.ClientConfig{
-		User:            user,
-		Auth:            authMethods,
-		HostKeyCallback: hostKeyCallback,
-		Timeout:         sshDialTimeout,
-	}
-	err = s.dialAndHandshake(gen, host, port, clientConfig)
-
-	// An unknown host key is a prompt, not a failure: return the marker intact
-	// (rootCause would unwrap it) so Java can show the fingerprint and retry.
-	var unknownHost *errHostKeyUnknown
-	if errors.As(err, &unknownHost) {
-		return errors.New(unknownHost.Error())
-	}
-
-	// A regular server may still accept a password, so let the caller ask for
-	// one instead of failing. NetBird servers never use a password, so a
-	// failure there is genuine.
-	if err != nil && serverType != detection.ServerTypeNetBirdJWT &&
-		serverType != detection.ServerTypeNetBirdNoJWT && isAuthFailure(err) &&
-		passwordCouldHelp(err, password != "") {
-		return errPasswordRequired
-	}
-	if err != nil {
-		return rootCause(err)
-	}
-	return nil
-}
-
-// StartSession requests a PTY and starts an interactive shell. Output from
-// the session is forwarded to the listener via OnData.
-func (s *SSHClient) StartSession(cols, rows int) error {
-	err := s.startSession(cols, rows)
-	if err != nil {
-		log.Infof("SSH: start session failed: %v", err)
-		return rootCause(err)
-	}
-	return nil
-}
-
-// Write sends data to the SSH session stdin.
-func (s *SSHClient) Write(data []byte) error {
-	s.mu.Lock()
-	stdin := s.stdin
-	s.mu.Unlock()
-	if stdin == nil {
-		return errors.New("ssh session not started")
-	}
-	if _, err := stdin.Write(data); err != nil {
-		return fmt.Errorf("write stdin: %w", err)
-	}
-	return nil
-}
-
-// Resize updates the PTY window size.
-func (s *SSHClient) Resize(cols, rows int) error {
-	s.mu.Lock()
-	session := s.session
-	s.mu.Unlock()
-	if session == nil {
-		return errors.New("ssh session not started")
-	}
-	return session.WindowChange(rows, cols)
-}
-
-// Reset makes a closed client usable for another Connect: Close leaves the
-// one-shot guard set, and clearing it lets the same client back a reconnect.
-func (s *SSHClient) Reset() {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.closed = false
-}
-
-// Close terminates the SSH session and underlying connection. Safe to call
-// multiple times.
-func (s *SSHClient) Close() error {
-	s.mu.Lock()
-	s.gen++
-	if s.dialCancel != nil {
-		s.dialCancel()
-		s.dialCancel = nil
-	}
-	sshClient := s.sshClient
-	session := s.session
-	stdin := s.stdin
-	s.sshClient = nil
-	s.session = nil
-	s.stdin = nil
-	notify := !s.closed
-	s.closed = true
-	listener := s.listener
-	s.mu.Unlock()
-
-	if stdin != nil {
-		if err := stdin.Close(); err != nil {
-			log.Debugf("ssh: stdin close: %v", err)
-		}
-	}
-	if session != nil {
-		if err := session.Close(); err != nil && !errors.Is(err, io.EOF) {
-			log.Debugf("ssh: session close: %v", err)
-		}
-	}
-	var firstErr error
-	if sshClient != nil {
-		if err := sshClient.Close(); err != nil {
-			firstErr = err
-		}
-	}
-	if notify && listener != nil {
-		listener.OnClose("closed by client")
-	}
-	return firstErr
-}
-
-func (s *SSHClient) startSession(cols, rows int) error {
-	log.Debugf("SSH: starting session %dx%d", cols, rows)
-	s.mu.Lock()
-	sshClient := s.sshClient
-	gen := s.gen
-	s.mu.Unlock()
-
-	if sshClient == nil {
-		return errors.New("ssh client not connected")
-	}
-
-	pty, err := nbssh.StartPTYSession(sshClient, cols, rows)
-	if err != nil {
-		return err
-	}
-
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		closeQuiet(pty.Session, "stale session")
-		return errClientClosed
-	}
-	s.session = pty.Session
-	s.stdin = pty.Stdin
-	s.mu.Unlock()
-
-	readerDone := make(chan string, 2)
-	go func() { readerDone <- s.readLoop(pty.Stdout, "stdout") }()
-	go func() { readerDone <- s.readLoop(pty.Stderr, "stderr") }()
-	go func() {
-		reason := <-readerDone
-		if second := <-readerDone; reason == "" {
-			reason = second
-		}
-		s.notifyClose(gen, reason)
-	}()
-	log.Debug("SSH: session started, shell running")
-	return nil
-}
-
-func (s *SSHClient) buildAuth(cfg *profilemanager.Config, cfgPath string, engine *internal.Engine,
-	serverType detection.ServerType, password string) ([]gossh.AuthMethod, gossh.HostKeyCallback, error) {
-
-	switch serverType {
-	case detection.ServerTypeNetBirdJWT:
-		token, err := s.requestJWTToken(cfg, cfgPath)
-		if err != nil {
-			return nil, nil, fmt.Errorf("jwt: %w", err)
-		}
-		auths := []gossh.AuthMethod{gossh.Password(token)}
-		return auths, nbssh.CreateHostKeyCallback(nbssh.PeerKeyLookup(engine.GetPeerSSHKey)), nil
-
-	case detection.ServerTypeNetBirdNoJWT:
-		if cfg.SSHKey == "" {
-			return nil, nil, errors.New("no NetBird SSH key available")
-		}
-		signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey))
-		if err != nil {
-			return nil, nil, fmt.Errorf("parse netbird ssh key: %w", err)
-		}
-		auths := []gossh.AuthMethod{gossh.PublicKeys(signer)}
-		return auths, nbssh.CreateHostKeyCallback(nbssh.PeerKeyLookup(engine.GetPeerSSHKey)), nil
-
-	case detection.ServerTypeRegular:
-		var auths []gossh.AuthMethod
-		if cfg.SSHKey != "" {
-			if signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey)); err == nil {
-				auths = append(auths, gossh.PublicKeys(signer))
-			} else {
-				log.Debugf("ssh: parse netbird key for regular auth: %v", err)
-			}
-		}
-		if password != "" {
-			pw := password
-			auths = append(auths, gossh.Password(pw))
-			auths = append(auths, gossh.KeyboardInteractive(func(_, _ string, questions []string, _ []bool) ([]string, error) {
-				answers := make([]string, len(questions))
-				for i := range questions {
-					answers[i] = pw
-				}
-				return answers, nil
-			}))
-		}
-		if len(auths) == 0 {
-			// Nothing to offer at all: ask for a password rather than failing,
-			// so the caller can retry once the user supplies one.
-			return nil, nil, errPasswordRequired
-		}
-		callback, err := s.tofuHostKeyCallback()
-		if err != nil {
-			return nil, nil, err
-		}
-		return auths, callback, nil
-
-	default:
-		return nil, nil, fmt.Errorf("unsupported SSH server type: %v", serverType)
-	}
-}
-
-// tofuHostKeyCallback verifies a regular server's host key against the
-// per-profile known-hosts store. An unknown host returns errHostKeyUnknown so
-// Java can show the fingerprint and, once confirmed, retry with the key
-// trusted; a changed key is rejected outright, as OpenSSH does. When the user
-// has confirmed a fingerprint, the callback accepts exactly that key and
-// appends it to the store.
-func (s *SSHClient) tofuHostKeyCallback() (gossh.HostKeyCallback, error) {
-	s.mu.Lock()
-	configDir := s.knownHostsConfigDir
-	profileID := s.knownHostsProfile
-	trusted := s.trustHostKey
-	s.mu.Unlock()
-
-	if configDir == "" || profileID == "" {
-		return nil, errors.New("no known-hosts store configured for regular SSH")
-	}
-
-	store, err := openKnownHostsStore(configDir, profileID)
-	if err != nil {
-		return nil, fmt.Errorf("load known-hosts store: %w", err)
-	}
-
-	return func(hostname string, remote net.Addr, key gossh.PublicKey) error {
-		verdict, err := store.verify(hostname, remote, key)
-		if err != nil {
-			return err
-		}
-		if verdict == hostKeyMatched {
-			return nil
-		}
-		if verdict == hostKeyChanged {
-			return fmt.Errorf("SSH host key changed for %s (possible attack)", hostname)
-		}
-
-		fingerprint := gossh.FingerprintSHA256(key)
-		if trusted == "" {
-			return &errHostKeyUnknown{fingerprint: fingerprint}
-		}
-		if trusted != fingerprint {
-			return fmt.Errorf("SSH host key changed since it was confirmed for %s", hostname)
-		}
-		if err := store.append(hostname, remote, key); err != nil {
-			return fmt.Errorf("persist trusted host key: %w", err)
-		}
-		// The confirmation is spent: now that the key is stored, a later
-		// reconnect must verify against the file, not re-accept this fingerprint.
-		s.mu.Lock()
-		s.trustHostKey = ""
-		s.mu.Unlock()
-		return nil
-	}, nil
-}
-
-func (s *SSHClient) requestJWTToken(cfg *profilemanager.Config, cfgPath string) (string, error) {
-	s.mu.Lock()
-	urlOpener := s.urlOpener
-	s.mu.Unlock()
-	if urlOpener == nil {
-		return "", errors.New("URL opener not configured for JWT auth")
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	flow, err := auth.NewOAuthFlow(ctx, cfg, false, true, profileLoginHint(cfgPath))
-	if err != nil {
-		return "", fmt.Errorf("create oauth flow: %w", err)
-	}
-
-	// The status callback covers the browser round-trip, which would
-	// otherwise leave the terminal blank.
-	tokenInfo, err := runOAuthFlow(ctx, flow, urlOpener, func() {
-		s.notifyStatus("Waiting for browser authentication...")
-	})
-	if err != nil {
-		return "", err
-	}
-
-	token := tokenInfo.GetTokenToUse()
-	if token == "" {
-		return "", errors.New("empty token returned by IdP")
-	}
-
-	// Tells the client the browser round-trip is over so it can dismiss the
-	// surface it opened, the same way the login and session-extend flows do.
-	// Without it the Custom Tab stays in front of the terminal even though the
-	// token has already been collected.
-	urlOpener.OnLoginSuccess()
-
-	return token, nil
-}
-
-func (s *SSHClient) dialAndHandshake(gen uint64, host string, port int, clientConfig *gossh.ClientConfig) error {
-	addr := net.JoinHostPort(host, strconv.Itoa(port))
-	ctx, cancel := context.WithTimeout(context.Background(), sshDialTimeout)
-	defer cancel()
-
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		return errClientClosed
-	}
-	s.dialCancel = cancel
-	s.mu.Unlock()
-
-	var dialer net.Dialer
-	conn, err := dialer.DialContext(ctx, "tcp", addr)
-	if err != nil {
-		return fmt.Errorf("dial %s: %w", addr, err)
-	}
-
-	client, err := nbssh.Handshake(ctx, conn, addr, clientConfig)
-	if err != nil {
-		return err
-	}
-
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		closeQuiet(client, "stale ssh client")
-		return errClientClosed
-	}
-	s.sshClient = client
-	listener := s.listener
-	s.mu.Unlock()
-
-	if listener != nil {
-		listener.OnConnected()
-	}
-	return nil
-}
-
-func (s *SSHClient) readLoop(r io.Reader, name string) string {
-	buf := make([]byte, 4096)
-	for {
-		n, err := r.Read(buf)
-		if n > 0 {
-			s.mu.Lock()
-			listener := s.listener
-			s.mu.Unlock()
-			if listener != nil {
-				chunk := make([]byte, n)
-				copy(chunk, buf[:n])
-				listener.OnData(chunk)
-			}
-		}
-		if err != nil {
-			// EOF is a normal shell exit, so report it without a reason.
-			if errors.Is(err, io.EOF) {
-				return ""
-			}
-			log.Debugf("ssh %s read: %v", name, err)
-			return rootCause(err).Error()
-		}
-	}
-}
-
-// notifyStatus writes a progress line to the terminal through the normal
-// output path, so long steps are visible while nothing else is arriving.
-func (s *SSHClient) notifyStatus(text string) {
-	s.mu.Lock()
-	listener := s.listener
-	s.mu.Unlock()
-	if listener != nil {
-		listener.OnData([]byte("\r\n\x1b[33m" + text + "\x1b[0m\r\n"))
-	}
-}
-
-func (s *SSHClient) notifyClose(gen uint64, reason string) {
-	s.mu.Lock()
-	if gen != s.gen || s.closed {
-		s.mu.Unlock()
-		return
-	}
-	s.closed = true
-	listener := s.listener
-	s.mu.Unlock()
-	if listener != nil {
-		listener.OnClose(reason)
-	}
-}
-
-func closeQuiet(c io.Closer, label string) {
-	if c == nil {
-		return
-	}
-	if err := c.Close(); err != nil && !errors.Is(err, io.EOF) {
-		log.Debugf("ssh: close %s: %v", label, err)
-	}
-}
-
-func detectServerType(host string, port int) detection.ServerType {
-	ctx, cancel := context.WithTimeout(context.Background(), sshDetectionTimeout)
-	defer cancel()
-
-	dialer := &net.Dialer{}
-	serverType, err := detection.DetectSSHServerType(ctx, dialer, host, port)
-	if err != nil {
-		log.Debugf("ssh: server detection failed: %v (assuming regular SSH)", err)
-		return detection.ServerTypeRegular
-	}
-	return serverType
-}
-
-// rootCause returns the innermost error of a %w chain, so the terminal shows
-// "i/o timeout" rather than every layer that added context on the way up.
-func rootCause(err error) error {
-	for {
-		// A joined error has no single root, so keep it as-is.
-		if _, ok := err.(interface{ Unwrap() []error }); ok {
-			return err
-		}
-		next := errors.Unwrap(err)
-		if next == nil {
-			return err
-		}
-		err = next
-	}
-}
-
-// isAuthFailure distinguishes credential rejection from dial, timeout and
-// host-key errors, which retrying with a password would not fix.
-func isAuthFailure(err error) bool {
-	if errors.Is(err, errPasswordRequired) {
-		return true
-	}
-	var partial *gossh.PartialSuccessError
-	if errors.As(err, &partial) {
-		return true
-	}
-	return strings.Contains(err.Error(), "unable to authenticate")
-}
-
-// passwordCouldHelp reports whether prompting for a password again can change
-// the outcome. gossh lists a method under "attempted methods" only when the
-// server offered it, so a supplied password that was never attempted means the
-// server does not accept passwords and the real error should surface instead.
-func passwordCouldHelp(err error, passwordOffered bool) bool {
-	if !passwordOffered {
-		return true
-	}
-	msg := err.Error()
-	return strings.Contains(msg, "password") || strings.Contains(msg, "keyboard-interactive")
-}

client/android/ssh_known_hosts.go

@@ -1,168 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"bytes"
-	"net"
-	"strconv"
-	"strings"
-	"sync"
-
-	gossh "golang.org/x/crypto/ssh"
-	"golang.org/x/crypto/ssh/knownhosts"
-)
-
-const knownHostsNamespace = "ssh"
-
-const (
-	hostKeyUnknown hostKeyVerdict = iota
-	hostKeyMatched
-	hostKeyChanged
-)
-
-var knownHostsMu sync.Mutex
-
-type hostKeyVerdict uint8
-
-type knownHostsSection struct {
-	KnownHosts []string `json:"knownHosts"`
-}
-
-type knownHostsStore struct {
-	prefs prefsStore
-}
-
-// RemoveKnownHost deletes every known-hosts entry for host:port from the
-// profile's store, so a host trusted for a session that is being deleted does
-// not linger. Java calls this only once no session targets that host, so a
-// shared host stays trusted. A missing entry is not an error: the goal state
-// is "absent".
-func RemoveKnownHost(configDir, profileID, host string, port int) error {
-	store, err := openKnownHostsStore(configDir, profileID)
-	if err != nil {
-		return err
-	}
-	return store.removeHost(host, port)
-}
-
-func openKnownHostsStore(configDir, profileID string) (*knownHostsStore, error) {
-	prefs, err := newProfilePrefs(configDir, profileID)
-	if err != nil {
-		return nil, err
-	}
-	return &knownHostsStore{prefs: prefs}, nil
-}
-
-func (st *knownHostsStore) verify(hostname string, remote net.Addr, key gossh.PublicKey) (hostKeyVerdict, error) {
-	lines, err := st.lines()
-	if err != nil {
-		return hostKeyUnknown, err
-	}
-	targets := knownHostsTargets(hostname, remote)
-
-	verdict := hostKeyUnknown
-	for _, line := range lines {
-		pubKey, ok := knownHostsLineKey(line, targets)
-		if !ok {
-			continue
-		}
-		if pubKey.Type() == key.Type() && bytes.Equal(pubKey.Marshal(), key.Marshal()) {
-			return hostKeyMatched, nil
-		}
-		verdict = hostKeyChanged
-	}
-	return verdict, nil
-}
-
-func (st *knownHostsStore) append(hostname string, remote net.Addr, key gossh.PublicKey) error {
-	line := knownhosts.Line(knownHostsTargets(hostname, remote), key)
-
-	knownHostsMu.Lock()
-	defer knownHostsMu.Unlock()
-
-	lines, err := st.lines()
-	if err != nil {
-		return err
-	}
-	return st.prefs.Put(knownHostsNamespace, knownHostsSection{KnownHosts: append(lines, line)})
-}
-
-func (st *knownHostsStore) removeHost(host string, port int) error {
-	target := knownhosts.Normalize(net.JoinHostPort(host, strconv.Itoa(port)))
-
-	knownHostsMu.Lock()
-	defer knownHostsMu.Unlock()
-
-	lines, err := st.lines()
-	if err != nil {
-		return err
-	}
-	kept := make([]string, 0, len(lines))
-	for _, line := range lines {
-		if knownHostsLineMatches(line, target) {
-			continue
-		}
-		kept = append(kept, line)
-	}
-	if len(kept) == len(lines) {
-		return nil
-	}
-	return st.prefs.Put(knownHostsNamespace, knownHostsSection{KnownHosts: kept})
-}
-
-func (st *knownHostsStore) lines() ([]string, error) {
-	var section knownHostsSection
-	if _, err := st.prefs.Get(knownHostsNamespace, &section); err != nil {
-		return nil, err
-	}
-	return section.KnownHosts, nil
-}
-
-func knownHostsTargets(hostname string, remote net.Addr) []string {
-	targets := []string{knownhosts.Normalize(hostname)}
-	if remote != nil {
-		if normalized := knownhosts.Normalize(remote.String()); normalized != targets[0] {
-			targets = append(targets, normalized)
-		}
-	}
-	return targets
-}
-
-func knownHostsLineKey(line string, targets []string) (gossh.PublicKey, bool) {
-	trimmed := strings.TrimSpace(line)
-	if trimmed == "" || strings.HasPrefix(trimmed, "#") {
-		return nil, false
-	}
-	_, hosts, pubKey, _, _, err := gossh.ParseKnownHosts([]byte(trimmed))
-	if err != nil {
-		return nil, false
-	}
-	for _, host := range hosts {
-		for _, target := range targets {
-			if host == target {
-				return pubKey, true
-			}
-		}
-	}
-	return nil, false
-}
-
-// knownHostsLineMatches reports whether a known-hosts line's address list
-// contains the normalized target. Comment and blank lines never match.
-func knownHostsLineMatches(line, target string) bool {
-	trimmed := strings.TrimSpace(line)
-	if trimmed == "" || strings.HasPrefix(trimmed, "#") {
-		return false
-	}
-	fields := strings.Fields(trimmed)
-	if len(fields) == 0 {
-		return false
-	}
-	for _, addr := range strings.Split(fields[0], ",") {
-		if addr == target {
-			return true
-		}
-	}
-	return false
-}

client/android/ssh_sessions.go

@@ -1,104 +0,0 @@
-//go:build android
-
-package android
-
-const (
-	sshSessionsNamespace = "ssh-sessions"
-	maxStoredSSHSessions = 50
-)
-
-type sshSessionRecord struct {
-	ID   string `json:"id"`
-	Host string `json:"host"`
-	Port int    `json:"port"`
-	User string `json:"user"`
-}
-
-type sshSessionsSection struct {
-	Sessions []sshSessionRecord `json:"sessions"`
-}
-
-// SSHSessionEntry is one stored SSH session, without any credential.
-type SSHSessionEntry struct {
-	ID   string
-	Host string
-	Port int
-	User string
-}
-
-// SSHSessionArray wraps stored SSH sessions for gomobile compatibility.
-type SSHSessionArray struct {
-	items []*SSHSessionEntry
-}
-
-// NewSSHSessionArray creates an empty session array to fill via Add.
-func NewSSHSessionArray() *SSHSessionArray {
-	return &SSHSessionArray{}
-}
-
-// Add appends a session entry, oldest first.
-func (a *SSHSessionArray) Add(id, host string, port int, user string) {
-	a.items = append(a.items, &SSHSessionEntry{ID: id, Host: host, Port: port, User: user})
-}
-
-// Length returns the number of entries.
-func (a *SSHSessionArray) Length() int {
-	return len(a.items)
-}
-
-// Get returns the entry at index i, or nil when out of range.
-func (a *SSHSessionArray) Get(i int) *SSHSessionEntry {
-	if i < 0 || i >= len(a.items) {
-		return nil
-	}
-	return a.items[i]
-}
-
-// SSHSessionStore reads and writes a profile's stored SSH sessions.
-type SSHSessionStore struct {
-	prefs prefsStore
-}
-
-// NewSSHSessionStore opens the session store of the given profile.
-func NewSSHSessionStore(configDir, profileID string) (*SSHSessionStore, error) {
-	prefs, err := newProfilePrefs(configDir, profileID)
-	if err != nil {
-		return nil, err
-	}
-	return &SSHSessionStore{prefs: prefs}, nil
-}
-
-// Load returns the stored sessions, oldest first.
-func (s *SSHSessionStore) Load() (*SSHSessionArray, error) {
-	var section sshSessionsSection
-	if _, err := s.prefs.Get(sshSessionsNamespace, &section); err != nil {
-		return nil, err
-	}
-
-	out := NewSSHSessionArray()
-	for _, record := range section.Sessions {
-		if record.ID == "" || record.Host == "" {
-			continue
-		}
-		out.Add(record.ID, record.Host, record.Port, record.User)
-	}
-	return out, nil
-}
-
-// Save replaces the stored sessions, keeping only the newest entries when the
-// list exceeds the storage cap.
-func (s *SSHSessionStore) Save(sessions *SSHSessionArray) error {
-	var items []*SSHSessionEntry
-	if sessions != nil {
-		items = sessions.items
-	}
-	if len(items) > maxStoredSSHSessions {
-		items = items[len(items)-maxStoredSSHSessions:]
-	}
-
-	records := make([]sshSessionRecord, 0, len(items))
-	for _, item := range items {
-		records = append(records, sshSessionRecord{ID: item.ID, Host: item.Host, Port: item.Port, User: item.User})
-	}
-	return s.prefs.Put(sshSessionsNamespace, sshSessionsSection{Sessions: records})
-}

client/cmd/service_controller.go

@@ -45,8 +45,8 @@ func daemonServerOptions(network string) []grpc.ServerOption {
 		return nil
 	}
 
-	creds := ipcauth.NewTransportCredentials() //nolint:staticcheck
-	if creds == nil {                          //nolint:staticcheck // nil only on platforms without a peer-identity primitive
+	creds := ipcauth.NewTransportCredentials()
+	if creds == nil {
 		log.Warnf("daemon IPC has no peer-identity primitive on %s: privileged operations will be denied", runtime.GOOS)
 		return nil
 	}

client/cmd/service_socket.go

@@ -27,8 +27,8 @@ func listenOnAddress(addr string) (*socketListener, error) {
 	}
 
 	if network == "npipe" {
-		listener, path, err := listenNamedPipe(address) //nolint:staticcheck
-		if err != nil {                                 //nolint:staticcheck // always errors on non-Windows builds
+		listener, path, err := listenNamedPipe(address)
+		if err != nil {
 			return nil, err
 		}
 		return &socketListener{Listener: listener, network: network, address: path}, nil

client/cmd/testutil_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
+	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
 	"google.golang.org/grpc"

client/embed/embed.go

@@ -21,7 +21,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbssh "github.com/netbirdio/netbird/client/ssh"
+	sshcommon "github.com/netbirdio/netbird/client/ssh"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
@@ -521,7 +521,12 @@ func (c *Client) VerifySSHHostKey(peerAddress string, key []byte) error {
 		return err
 	}
 
-	return nbssh.PeerKeyLookup(engine.GetPeerSSHKey).VerifySSHHostKey(peerAddress, key)
+	storedKey, found := engine.GetPeerSSHKey(peerAddress)
+	if !found {
+		return sshcommon.ErrPeerNotFound
+	}
+
+	return sshcommon.VerifyHostKey(storedKey, key, peerAddress)
 }
 
 // SetPerformance retunes a running Client. Only PreallocatedBuffersPerPool

client/embed/embed_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
+	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
 

client/firewall/uspfilter/filter_filter_test.go

@@ -5,7 +5,7 @@ import (
 	"net/netip"
 	"testing"
 
-	"go.uber.org/mock/gomock"
+	"github.com/golang/mock/gomock"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 	"github.com/stretchr/testify/require"

client/firewall/uspfilter/filter_routeacl_test.go

@@ -4,7 +4,7 @@ import (
 	"net/netip"
 	"testing"
 
-	"go.uber.org/mock/gomock"
+	"github.com/golang/mock/gomock"
 	"github.com/google/gopacket/layers"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

client/grpc/dialer_generic.go

@@ -16,47 +16,28 @@ import (
 	"google.golang.org/grpc"
 
 	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netsweep"
 )
 
 func WithCustomDialer(_ bool, _ string) grpc.DialOption {
-	return grpc.WithContextDialer(dialContext)
-}
-
-// WithSweeper dials like WithCustomDialer but registers connections and
-// dials with the sweeper. Append it after WithCustomDialer: gRPC applies
-// dial options in order, so the later context dialer wins.
-func WithSweeper(sweeper *netsweep.Sweeper) grpc.DialOption {
 	return grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
-		dial := sweeper.StartDial(ctx)
-		defer dial.Release()
+		if runtime.GOOS == "linux" {
+			currentUser, err := user.Current()
+			if err != nil {
+				return nil, status.Errorf(codes.FailedPrecondition, "failed to get current user: %v", err)
+			}
 
-		conn, err := dialContext(dial.Ctx(), addr)
-		if err != nil {
-			return nil, err
+			// the custom dialer requires root permissions which are not required for use cases run as non-root
+			if currentUser.Uid != "0" {
+				log.Debug("Not running as root, using standard dialer")
+				dialer := &net.Dialer{}
+				return dialer.DialContext(ctx, "tcp", addr)
+			}
 		}
-		return dial.WrapConn(conn)
+
+		conn, err := nbnet.NewDialer().DialContext(ctx, "tcp", addr)
+		if err != nil {
+			return nil, fmt.Errorf("nbnet.NewDialer().DialContext: %w", err)
+		}
+		return conn, nil
 	})
 }
-
-func dialContext(ctx context.Context, addr string) (net.Conn, error) {
-	if runtime.GOOS == "linux" {
-		currentUser, err := user.Current()
-		if err != nil {
-			return nil, status.Errorf(codes.FailedPrecondition, "failed to get current user: %v", err)
-		}
-
-		// the custom dialer requires root permissions which are not required for use cases run as non-root
-		if currentUser.Uid != "0" {
-			log.Debug("Not running as root, using standard dialer")
-			dialer := &net.Dialer{}
-			return dialer.DialContext(ctx, "tcp", addr)
-		}
-	}
-
-	conn, err := nbnet.NewDialer().DialContext(ctx, "tcp", addr)
-	if err != nil {
-		return nil, fmt.Errorf("nbnet.NewDialer().DialContext: %w", err)
-	}
-	return conn, nil
-}

client/grpc/dialer_js.go

@@ -3,7 +3,6 @@ package grpc
 import (
 	"google.golang.org/grpc"
 
-	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/util/wsproxy/client"
 )
 
@@ -12,8 +11,3 @@ import (
 func WithCustomDialer(tlsEnabled bool, component string) grpc.DialOption {
 	return client.WithWebSocketDialer(tlsEnabled, component)
 }
-
-// WithSweeper is a no-op on WASM/JS: there is no network change signal.
-func WithSweeper(_ *netsweep.Sweeper) grpc.DialOption {
-	return grpc.EmptyDialOption{}
-}

client/grpc/retry.go

@@ -1,49 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"errors"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-
-	"github.com/netbirdio/netbird/client/netstate"
-)
-
-// Retry mirrors backoff.Retry, but the sleep between attempts also wakes on
-// OS network availability transitions: an operation cut down by a network
-// change retries the moment the network settles instead of sleeping through
-// the recovery. A nil netState never fires, leaving plain backoff.Retry
-// behavior.
-func Retry(ctx context.Context, operation backoff.Operation, bo backoff.BackOff, netState *netstate.State) error {
-	bo.Reset()
-	for {
-		err := operation()
-		if err == nil {
-			return nil
-		}
-
-		var permanent *backoff.PermanentError
-		if errors.As(err, &permanent) {
-			return permanent.Err
-		}
-
-		next := bo.NextBackOff()
-		if next == backoff.Stop {
-			if cerr := ctx.Err(); cerr != nil {
-				return cerr
-			}
-			return err
-		}
-
-		timer := time.NewTimer(next)
-		select {
-		case <-timer.C:
-		case <-netState.Changed():
-			timer.Stop()
-		case <-ctx.Done():
-			timer.Stop()
-			return ctx.Err()
-		}
-	}
-}

client/grpc/retry_test.go

@@ -1,91 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/netstate"
-)
-
-func TestRetryWakesOnNetworkChange(t *testing.T) {
-	ns := netstate.New()
-	attempts := 0
-	operation := func() error {
-		attempts++
-		if attempts == 1 {
-			return errors.New("cut by network change")
-		}
-		return nil
-	}
-
-	go func() {
-		time.Sleep(20 * time.Millisecond)
-		ns.Set(false)
-	}()
-
-	start := time.Now()
-	err := Retry(context.Background(), operation, backoff.NewConstantBackOff(time.Minute), ns)
-
-	require.NoError(t, err)
-	assert.Equal(t, 2, attempts, "network change must cause one immediate retry")
-	assert.Less(t, time.Since(start), time.Second, "the transition must cut the minute-long sleep short")
-}
-
-func TestRetryPermanentError(t *testing.T) {
-	sentinel := errors.New("permission denied")
-	operation := func() error {
-		return backoff.Permanent(sentinel)
-	}
-
-	err := Retry(context.Background(), operation, backoff.NewConstantBackOff(time.Millisecond), nil)
-	assert.ErrorIs(t, err, sentinel, "permanent errors must stop retries")
-}
-
-func TestRetryNilNetState(t *testing.T) {
-	attempts := 0
-	operation := func() error {
-		attempts++
-		if attempts < 3 {
-			return errors.New("transient")
-		}
-		return nil
-	}
-
-	err := Retry(context.Background(), operation, backoff.NewConstantBackOff(time.Millisecond), nil)
-	require.NoError(t, err)
-	assert.Equal(t, 3, attempts, "nil network state must preserve timed retries")
-}
-
-func TestRetryStops(t *testing.T) {
-	failure := errors.New("still failing")
-	operation := func() error {
-		return failure
-	}
-
-	err := Retry(context.Background(), operation, &backoff.StopBackOff{}, nil)
-	assert.ErrorIs(t, err, failure, "stop backoff must return the operation error")
-}
-
-func TestRetryCtxCancelDuringSleep(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	operation := func() error {
-		return errors.New("failing")
-	}
-
-	go func() {
-		time.Sleep(20 * time.Millisecond)
-		cancel()
-	}()
-
-	start := time.Now()
-	err := Retry(ctx, operation, backoff.NewConstantBackOff(time.Minute), netstate.New())
-
-	assert.ErrorIs(t, err, context.Canceled, "context cancellation must stop the retry loop")
-	assert.Less(t, time.Since(start), time.Second, "context cancellation must interrupt backoff sleep")
-}

client/iface/device/device_filter_test.go

@@ -4,7 +4,7 @@ import (
 	"net"
 	"testing"
 
-	"go.uber.org/mock/gomock"
+	"github.com/golang/mock/gomock"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 

client/iface/mocks/filter.go

@@ -8,7 +8,7 @@ import (
 	"net/netip"
 	reflect "reflect"
 
-	gomock "go.uber.org/mock/gomock"
+	gomock "github.com/golang/mock/gomock"
 )
 
 // MockPacketFilter is a mock of PacketFilter interface.

client/iface/mocks/tun.go

@@ -8,7 +8,7 @@ import (
 	os "os"
 	reflect "reflect"
 
-	gomock "go.uber.org/mock/gomock"
+	gomock "github.com/golang/mock/gomock"
 	tun "golang.zx2c4.com/wireguard/tun"
 )
 

client/iface/wgproxy/bind/proxy.go

@@ -53,15 +53,15 @@ func NewProxyBind(bind Bind, mtu uint16) *ProxyBind {
 	return p
 }
 
-// AddRelayedConn adds a new connection to the bind.
+// AddTurnConn adds a new connection to the bind.
 // endpoint is the NetBird address of the remote peer. The SetEndpoint return with the address what will be used in the
 // WireGuard configuration.
 //
 // Parameters:
 //   - ctx: Context is used for proxyToLocal to avoid unnecessary error messages
 //   - nbAddr: The NetBird UDP address of the remote peer, it required to generate fake address
-//   - remoteConn: The established relayed connection to the remote peer
-func (p *ProxyBind) AddRelayedConn(ctx context.Context, nbAddr *net.UDPAddr, remoteConn net.Conn) error {
+//   - remoteConn: The established TURN connection to the remote peer
+func (p *ProxyBind) AddTurnConn(ctx context.Context, nbAddr *net.UDPAddr, remoteConn net.Conn) error {
 	fakeNetIP, err := fakeAddress(nbAddr)
 	if err != nil {
 		return err

client/iface/wgproxy/ebpf/proxy.go

@@ -30,9 +30,9 @@ type WGEBPFProxy struct {
 	proxyPort         int
 	mtu               uint16
 
-	ebpfManager      ebpfMgr.Manager
-	relayedConnStore map[uint16]net.Conn
-	relayedConnMutex sync.Mutex
+	ebpfManager   ebpfMgr.Manager
+	turnConnStore map[uint16]net.Conn
+	turnConnMutex sync.Mutex
 
 	lastUsedPort uint16
 	rawConnIPv4  net.PacketConn
@@ -50,7 +50,7 @@ func NewWGEBPFProxy(wgPort int, mtu uint16) *WGEBPFProxy {
 		localWGListenPort: wgPort,
 		mtu:               mtu,
 		ebpfManager:       ebpf.GetEbpfManagerInstance(),
-		relayedConnStore:  make(map[uint16]net.Conn),
+		turnConnStore:     make(map[uint16]net.Conn),
 	}
 	return wgProxy
 }
@@ -110,14 +110,14 @@ func (p *WGEBPFProxy) Listen() error {
 	return nil
 }
 
-// AddRelayedConn add new relayed connection for the proxy
-func (p *WGEBPFProxy) AddRelayedConn(relayedConn net.Conn) (*net.UDPAddr, error) {
-	wgEndpointPort, err := p.storeRelayedConn(relayedConn)
+// AddTurnConn add new turn connection for the proxy
+func (p *WGEBPFProxy) AddTurnConn(turnConn net.Conn) (*net.UDPAddr, error) {
+	wgEndpointPort, err := p.storeTurnConn(turnConn)
 	if err != nil {
 		return nil, err
 	}
 
-	log.Infof("relayed conn added to wg proxy store: %s, endpoint port: :%d", relayedConn.RemoteAddr(), wgEndpointPort)
+	log.Infof("turn conn added to wg proxy store: %s, endpoint port: :%d", turnConn.RemoteAddr(), wgEndpointPort)
 
 	wgEndpoint := &net.UDPAddr{
 		IP:   net.ParseIP(loopbackAddr),
@@ -186,48 +186,48 @@ func (p *WGEBPFProxy) readAndForwardPacket(buf []byte) error {
 		return fmt.Errorf("failed to read UDP packet from WG: %w", err)
 	}
 
-	p.relayedConnMutex.Lock()
-	conn, ok := p.relayedConnStore[uint16(addr.Port)]
-	p.relayedConnMutex.Unlock()
+	p.turnConnMutex.Lock()
+	conn, ok := p.turnConnStore[uint16(addr.Port)]
+	p.turnConnMutex.Unlock()
 	if !ok {
 		if p.ctx.Err() == nil {
-			log.Debugf("relayed conn not found by port because conn already has been closed: %d", addr.Port)
+			log.Debugf("turn conn not found by port because conn already has been closed: %d", addr.Port)
 		}
 		return nil
 	}
 
 	if _, err := conn.Write(buf[:n]); err != nil {
-		return fmt.Errorf("forward local WG packet (%d) to remote relayed conn: %w", addr.Port, err)
+		return fmt.Errorf("failed to forward local WG packet (%d) to remote turn conn: %w", addr.Port, err)
 	}
 	return nil
 }
 
-func (p *WGEBPFProxy) storeRelayedConn(relayedConn net.Conn) (uint16, error) {
-	p.relayedConnMutex.Lock()
-	defer p.relayedConnMutex.Unlock()
+func (p *WGEBPFProxy) storeTurnConn(turnConn net.Conn) (uint16, error) {
+	p.turnConnMutex.Lock()
+	defer p.turnConnMutex.Unlock()
 
 	np, err := p.nextFreePort()
 	if err != nil {
 		return np, err
 	}
-	p.relayedConnStore[np] = relayedConn
+	p.turnConnStore[np] = turnConn
 	return np, nil
 }
 
-func (p *WGEBPFProxy) removeRelayedConn(relayedConnID uint16) {
-	p.relayedConnMutex.Lock()
-	defer p.relayedConnMutex.Unlock()
+func (p *WGEBPFProxy) removeTurnConn(turnConnID uint16) {
+	p.turnConnMutex.Lock()
+	defer p.turnConnMutex.Unlock()
 
-	_, ok := p.relayedConnStore[relayedConnID]
+	_, ok := p.turnConnStore[turnConnID]
 	if ok {
-		log.Debugf("remove relayed conn from store by port: %d", relayedConnID)
+		log.Debugf("remove turn conn from store by port: %d", turnConnID)
 	}
-	delete(p.relayedConnStore, relayedConnID)
+	delete(p.turnConnStore, turnConnID)
 }
 
 func (p *WGEBPFProxy) nextFreePort() (uint16, error) {
-	if len(p.relayedConnStore) == 65535 {
-		return 0, fmt.Errorf("reached maximum relayed connection numbers")
+	if len(p.turnConnStore) == 65535 {
+		return 0, fmt.Errorf("reached maximum turn connection numbers")
 	}
 generatePort:
 	if p.lastUsedPort == 65535 {
@@ -236,7 +236,7 @@ generatePort:
 		p.lastUsedPort++
 	}
 
-	if _, ok := p.relayedConnStore[p.lastUsedPort]; ok {
+	if _, ok := p.turnConnStore[p.lastUsedPort]; ok {
 		goto generatePort
 	}
 	return p.lastUsedPort, nil

client/iface/wgproxy/ebpf/proxy_test.go

@@ -9,32 +9,32 @@ import (
 func TestWGEBPFProxy_connStore(t *testing.T) {
 	wgProxy := NewWGEBPFProxy(1, 1280)
 
-	p, _ := wgProxy.storeRelayedConn(nil)
+	p, _ := wgProxy.storeTurnConn(nil)
 	if p != 1 {
 		t.Errorf("invalid initial port: %d", wgProxy.lastUsedPort)
 	}
 
 	numOfConns := 10
 	for i := 0; i < numOfConns; i++ {
-		p, _ = wgProxy.storeRelayedConn(nil)
+		p, _ = wgProxy.storeTurnConn(nil)
 	}
 	if p != uint16(numOfConns)+1 {
 		t.Errorf("invalid last used port: %d, expected: %d", p, numOfConns+1)
 	}
-	if len(wgProxy.relayedConnStore) != numOfConns+1 {
-		t.Errorf("invalid store size: %d, expected: %d", len(wgProxy.relayedConnStore), numOfConns+1)
+	if len(wgProxy.turnConnStore) != numOfConns+1 {
+		t.Errorf("invalid store size: %d, expected: %d", len(wgProxy.turnConnStore), numOfConns+1)
 	}
 }
 
 func TestWGEBPFProxy_portCalculation_overflow(t *testing.T) {
 	wgProxy := NewWGEBPFProxy(1, 1280)
 
-	_, _ = wgProxy.storeRelayedConn(nil)
+	_, _ = wgProxy.storeTurnConn(nil)
 	wgProxy.lastUsedPort = 65535
-	p, _ := wgProxy.storeRelayedConn(nil)
+	p, _ := wgProxy.storeTurnConn(nil)
 
-	if len(wgProxy.relayedConnStore) != 2 {
-		t.Errorf("invalid store size: %d, expected: %d", len(wgProxy.relayedConnStore), 2)
+	if len(wgProxy.turnConnStore) != 2 {
+		t.Errorf("invalid store size: %d, expected: %d", len(wgProxy.turnConnStore), 2)
 	}
 
 	if p != 2 {
@@ -46,11 +46,11 @@ func TestWGEBPFProxy_portCalculation_maxConn(t *testing.T) {
 	wgProxy := NewWGEBPFProxy(1, 1280)
 
 	for i := 0; i < 65535; i++ {
-		_, _ = wgProxy.storeRelayedConn(nil)
+		_, _ = wgProxy.storeTurnConn(nil)
 	}
 
-	_, err := wgProxy.storeRelayedConn(nil)
+	_, err := wgProxy.storeTurnConn(nil)
 	if err == nil {
-		t.Errorf("invalid relayed conn store calculation")
+		t.Errorf("invalid turn conn store calculation")
 	}
 }

client/iface/wgproxy/ebpf/wrapper.go

@@ -121,10 +121,10 @@ func NewProxyWrapper(proxy *WGEBPFProxy) *ProxyWrapper {
 	}
 }
 
-func (p *ProxyWrapper) AddRelayedConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
-	addr, err := p.wgeBPFProxy.AddRelayedConn(remoteConn)
+func (p *ProxyWrapper) AddTurnConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
+	addr, err := p.wgeBPFProxy.AddTurnConn(remoteConn)
 	if err != nil {
-		return fmt.Errorf("add relayed conn: %w", err)
+		return fmt.Errorf("add turn conn: %w", err)
 	}
 
 	headers, err := NewPacketHeaders(p.wgeBPFProxy.localWGListenPort, addr)
@@ -252,7 +252,7 @@ func (p *ProxyWrapper) CloseConn() error {
 }
 
 func (p *ProxyWrapper) proxyToLocal(ctx context.Context) {
-	defer p.wgeBPFProxy.removeRelayedConn(uint16(p.wgRelayedEndpointAddr.Port))
+	defer p.wgeBPFProxy.removeTurnConn(uint16(p.wgRelayedEndpointAddr.Port))
 
 	buf := make([]byte, p.wgeBPFProxy.mtu+bufsize.WGBufferOverhead)
 	for {
@@ -273,7 +273,7 @@ func (p *ProxyWrapper) proxyToLocal(ctx context.Context) {
 			if ctx.Err() != nil {
 				return
 			}
-			log.Errorf("failed to write out relayed pkg to local conn: %v", err)
+			log.Errorf("failed to write out turn pkg to local conn: %v", err)
 		}
 	}
 }
@@ -286,7 +286,7 @@ func (p *ProxyWrapper) readFromRemote(ctx context.Context, buf []byte) (int, err
 		}
 		p.closeListener.Notify()
 		if !errors.Is(err, io.EOF) {
-			log.Errorf("failed to read from relayed conn (endpoint: :%d): %s", p.wgRelayedEndpointAddr.Port, err)
+			log.Errorf("failed to read from turn conn (endpoint: :%d): %s", p.wgRelayedEndpointAddr.Port, err)
 		}
 		return 0, err
 	}

client/iface/wgproxy/proxy.go

@@ -7,7 +7,7 @@ import (
 
 // Proxy is a transfer layer between the relayed connection and the WireGuard
 type Proxy interface {
-	AddRelayedConn(ctx context.Context, endpoint *net.UDPAddr, remoteConn net.Conn) error
+	AddTurnConn(ctx context.Context, endpoint *net.UDPAddr, remoteConn net.Conn) error
 	EndpointAddr() *net.UDPAddr // EndpointAddr returns the address of the WireGuard peer endpoint
 	Work()                      // Work start or resume the proxy
 	Pause()                     // Pause to forward the packages from remote connection to WireGuard. The opposite way still works.

client/iface/wgproxy/proxy_test.go

@@ -95,7 +95,7 @@ func TestProxyCloseByRemoteConn(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			addr, _ := net.ResolveUDPAddr("udp", "100.108.135.221:51892")
 			relayedConn := newMockConn()
-			err := tt.proxy.AddRelayedConn(ctx, addr, relayedConn)
+			err := tt.proxy.AddTurnConn(ctx, addr, relayedConn)
 			if err != nil {
 				t.Errorf("error: %v", err)
 			}
@@ -157,7 +157,7 @@ func redirectTraffic(t *testing.T, proxy Proxy, wgPort int, endPointAddr *net.UD
 		_ = relayedServer.Close()
 	}()
 
-	if err := proxy.AddRelayedConn(context.Background(), endPointAddr, relayedConn); err != nil {
+	if err := proxy.AddTurnConn(context.Background(), endPointAddr, relayedConn); err != nil {
 		t.Errorf("error: %v", err)
 	}
 	defer func() {

client/iface/wgproxy/redirect_test.go

@@ -119,9 +119,9 @@ func testRedirectAs(t *testing.T, proxy Proxy, wgPort int, nbAddr, p2pEndpoint *
 	}
 	defer relayConn.Close()
 
-	// Add relayed connection to proxy
-	if err := proxy.AddRelayedConn(ctx, nbAddr, relayConn); err != nil {
-		t.Fatalf("failed to add relayed connection: %v", err)
+	// Add TURN connection to proxy
+	if err := proxy.AddTurnConn(ctx, nbAddr, relayConn); err != nil {
+		t.Fatalf("failed to add TURN connection: %v", err)
 	}
 	defer func() {
 		if err := proxy.CloseConn(); err != nil {
@@ -304,8 +304,8 @@ func TestRedirectAs_Multiple_Switches(t *testing.T) {
 		Port: 38746,
 	}
 
-	if err := proxy.AddRelayedConn(ctx, nbAddr, relayConn); err != nil {
-		t.Fatalf("failed to add relayed connection: %v", err)
+	if err := proxy.AddTurnConn(ctx, nbAddr, relayConn); err != nil {
+		t.Fatalf("failed to add TURN connection: %v", err)
 	}
 	defer func() {
 		if err := proxy.CloseConn(); err != nil {

client/iface/wgproxy/udp/proxy.go

@@ -51,12 +51,12 @@ func NewWGUDPProxy(wgPort int, mtu uint16) *WGUDPProxy {
 	return p
 }
 
-// AddRelayedConn dials the local WireGuard port and stores the relayed connection.
+// AddTurnConn
 // The provided Context must be non-nil. If the context expires before
 // the connection is complete, an error is returned. Once successfully
 // connected, any expiration of the context will not affect the
 // connection.
-func (p *WGUDPProxy) AddRelayedConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
+func (p *WGUDPProxy) AddTurnConn(ctx context.Context, _ *net.UDPAddr, remoteConn net.Conn) error {
 	dialer := net.Dialer{}
 	localConn, err := dialer.DialContext(ctx, "udp", fmt.Sprintf(":%d", p.localWGListenPort))
 	if err != nil {

client/internal/acl/manager.go

@@ -116,11 +116,11 @@ func (d *DefaultManager) ApplyFiltering(networkMap *mgmProto.NetworkMap, dnsRout
 // firewall state, so an identical hash means an identical resulting ruleset.
 func (d *DefaultManager) firewallConfigHash(networkMap *mgmProto.NetworkMap, dnsRouteFeatureFlag bool) (uint64, error) {
 	return hashstructure.Hash(struct {
-		PeerRules           []*mgmProto.FirewallRule
-		PeerRulesIsEmpty    bool
-		RouteRules          []*mgmProto.RouteFirewallRule
-		RouteRulesIsEmpty   bool
-		DNSRouteFeatureFlag bool
+		PeerRules            []*mgmProto.FirewallRule
+		PeerRulesIsEmpty     bool
+		RouteRules           []*mgmProto.RouteFirewallRule
+		RouteRulesIsEmpty    bool
+		DNSRouteFeatureFlag  bool
 	}{
 		PeerRules:           networkMap.GetFirewallRules(),
 		PeerRulesIsEmpty:    networkMap.GetFirewallRulesIsEmpty(),
@@ -144,13 +144,13 @@ func (d *DefaultManager) applyPeerACLs(networkMap *mgmProto.NetworkMap) {
 		log.Warn("this peer is connected to a NetBird Management service with an older version. Allowing all traffic from connected peers")
 		rules = append(rules,
 			&mgmProto.FirewallRule{
-				PeerIP:    "0.0.0.0", //nolint:staticcheck
+				PeerIP:    "0.0.0.0",
 				Direction: mgmProto.RuleDirection_IN,
 				Action:    mgmProto.RuleAction_ACCEPT,
 				Protocol:  mgmProto.RuleProtocol_ALL,
 			},
 			&mgmProto.FirewallRule{
-				PeerIP:    "0.0.0.0", //nolint:staticcheck
+				PeerIP:    "0.0.0.0",
 				Direction: mgmProto.RuleDirection_OUT,
 				Action:    mgmProto.RuleAction_ACCEPT,
 				Protocol:  mgmProto.RuleProtocol_ALL,
@@ -407,6 +407,7 @@ func (d *DefaultManager) getRuleGroupingSelector(rule *mgmProto.FirewallRule) st
 	return fmt.Sprintf("%v:%v:%v:%s:%v", strconv.Itoa(int(rule.Direction)), rule.Action, rule.Protocol, rule.Port, rule.PortInfo)
 }
 
+
 // extractRuleIP extracts the peer IP from a firewall rule.
 // If sourcePrefixes is populated (new management), decode the first entry and use its address.
 // Otherwise fall back to the deprecated PeerIP string field (old management).

client/internal/acl/manager_test.go

@@ -5,9 +5,9 @@ import (
 	"net/netip"
 	"testing"
 
+	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.uber.org/mock/gomock"
 
 	"github.com/netbirdio/netbird/client/firewall"
 	"github.com/netbirdio/netbird/client/iface"
@@ -87,7 +87,7 @@ func TestDefaultManager(t *testing.T) {
 		networkMap.FirewallRules = append(
 			networkMap.FirewallRules,
 			&mgmProto.FirewallRule{
-				PeerIP:    "10.93.0.3", //nolint:staticcheck
+				PeerIP:    "10.93.0.3",
 				Direction: mgmProto.RuleDirection_IN,
 				Action:    mgmProto.RuleAction_DROP,
 				Protocol:  mgmProto.RuleProtocol_ICMP,
@@ -556,12 +556,12 @@ func TestApplyFilteringSkipsUnchangedConfig(t *testing.T) {
 
 func buildNetworkMap(peerRules, routeRules int) *mgmProto.NetworkMap {
 	nm := &mgmProto.NetworkMap{
-		FirewallRulesIsEmpty:       peerRules == 0,
+		FirewallRulesIsEmpty:      peerRules == 0,
 		RoutesFirewallRulesIsEmpty: routeRules == 0,
 	}
 	for i := range peerRules {
 		nm.FirewallRules = append(nm.FirewallRules, &mgmProto.FirewallRule{
-			PeerIP:    fmt.Sprintf("10.%d.%d.%d", i>>16&0xff, i>>8&0xff, i&0xff), //nolint:staticcheck
+			PeerIP:    fmt.Sprintf("10.%d.%d.%d", i>>16&0xff, i>>8&0xff, i&0xff),
 			Direction: mgmProto.RuleDirection_IN,
 			Action:    mgmProto.RuleAction_ACCEPT,
 			Protocol:  mgmProto.RuleProtocol_TCP,

client/internal/acl/mocks/iface_mapper.go

@@ -7,7 +7,7 @@ package mocks
 import (
 	reflect "reflect"
 
-	gomock "go.uber.org/mock/gomock"
+	gomock "github.com/golang/mock/gomock"
 	wgdevice "golang.zx2c4.com/wireguard/device"
 
 	"github.com/netbirdio/netbird/client/iface/device"

client/internal/auth/auth.go

@@ -138,37 +138,26 @@ func (a *Auth) IsSSOSupported(ctx context.Context) (bool, error) {
 
 // GetOAuthFlow returns an OAuth flow (PKCE or Device) using the existing management connection
 // This avoids creating a new connection to the management server
-func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool, hint string) (OAuthFlow, error) {
+func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool) (OAuthFlow, error) {
 	var flow OAuthFlow
+	var err error
 
-	err := a.withRetry(ctx, func(client *mgm.GrpcClient) error {
+	err = a.withRetry(ctx, func(client *mgm.GrpcClient) error {
 		if forceDeviceAuth {
-			deviceFlow, err := a.getDeviceFlow(client)
-			if err != nil {
-				return err
-			}
-			deviceFlow.SetLoginHint(hint)
-			flow = deviceFlow
-			return nil
+			flow, err = a.getDeviceFlow(client)
+			return err
 		}
 
 		// Try PKCE flow first
-		pkceFlow, err := a.getPKCEFlow(client)
+		flow, err = a.getPKCEFlow(client)
 		if err != nil {
 			// If PKCE not supported, try Device flow
 			if s, ok := status.FromError(err); ok && (s.Code() == codes.NotFound || s.Code() == codes.Unimplemented) {
-				deviceFlow, err := a.getDeviceFlow(client)
-				if err != nil {
-					return err
-				}
-				deviceFlow.SetLoginHint(hint)
-				flow = deviceFlow
-				return nil
+				flow, err = a.getDeviceFlow(client)
+				return err
 			}
 			return err
 		}
-		pkceFlow.SetLoginHint(hint)
-		flow = pkceFlow
 		return nil
 	})
 

client/internal/auth/oauth.go

@@ -97,7 +97,9 @@ func authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config
 		return nil, fmt.Errorf("getting pkce authorization flow info failed with error: %v", err)
 	}
 
-	pkceFlowInfo.SetLoginHint(hint)
+	if hint != "" {
+		pkceFlowInfo.SetLoginHint(hint)
+	}
 
 	return pkceFlowInfo, nil
 }
@@ -125,7 +127,9 @@ func authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.
 		}
 	}
 
-	deviceFlowInfo.SetLoginHint(hint)
+	if hint != "" {
+		deviceFlowInfo.SetLoginHint(hint)
+	}
 
 	return deviceFlowInfo, nil
 }

client/internal/connect.go

@@ -38,8 +38,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/internal/updater/installer"
 	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netstate"
-	"github.com/netbirdio/netbird/client/netsweep"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ssh"
 	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
@@ -72,42 +70,18 @@ type ConnectClient struct {
 	updateManager *updater.Manager
 
 	persistSyncResponse bool
-
-	// netState gates every reconnection loop on OS-reported network
-	// availability. Nil (the default) disables gating; mobile platforms
-	// inject it via WithNetworkState.
-	netState *netstate.State
-
-	// sweeper cuts the management, signal and relay connections on network
-	// change; nil disables it.
-	sweeper *netsweep.Sweeper
-}
-
-// ConnectClientOption configures optional ConnectClient behavior.
-type ConnectClientOption func(*ConnectClient)
-
-// WithNetworkState injects the OS network availability state that gates every
-// reconnection loop; without it gating is disabled.
-func WithNetworkState(netState *netstate.State) ConnectClientOption {
-	return func(c *ConnectClient) { c.netState = netState }
-}
-
-// WithSweeper injects the network change sweeper.
-func WithSweeper(sweeper *netsweep.Sweeper) ConnectClientOption {
-	return func(c *ConnectClient) { c.sweeper = sweeper }
 }
 
 func NewConnectClient(
 	ctx context.Context,
 	config *profilemanager.Config,
 	statusRecorder *peer.Status,
-	opts ...ConnectClientOption,
 ) *ConnectClient {
 	// Derive the run context here so Stop owns the cancel that unblocks the run
 	// loop. runCancel is set once at construction, so Stop can call it without
 	// racing the run loop's startup. Callers therefore need not cancel before Stop.
 	runCtx, runCancel := context.WithCancel(ctx)
-	c := &ConnectClient{
+	return &ConnectClient{
 		ctx:            runCtx,
 		runCancel:      runCancel,
 		runExited:      make(chan struct{}),
@@ -115,10 +89,6 @@ func NewConnectClient(
 		statusRecorder: statusRecorder,
 		engineMutex:    sync.Mutex{},
 	}
-	for _, opt := range opts {
-		opt(c)
-	}
-	return c
 }
 
 func (c *ConnectClient) SetUpdateManager(um *updater.Manager) {
@@ -304,13 +274,6 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			return nil
 		}
 
-		// suspend connection attempts while the OS reports no usable network
-		if waited, err := c.netState.Wait(c.ctx); err != nil {
-			return nil
-		} else if waited {
-			backOff.Reset()
-		}
-
 		state.Set(StatusConnecting)
 
 		engineCtx, cancel := context.WithCancel(c.ctx)
@@ -322,8 +285,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}()
 
 		log.Debugf("connecting to the Management service %s", c.config.ManagementURL.Host)
-		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled,
-			mgm.WithNetworkState(c.netState), mgm.WithSweeper(c.sweeper))
+		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled)
 		if err != nil {
 			// On daemon shutdown / Down() the parent context is cancelled
 			// and the dial fails with "context canceled". Wrapping that
@@ -398,7 +360,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}()
 
 		// with the global Netbird config in hand connect (just a connection, no stream yet) Signal
-		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey, c.netState, c.sweeper)
+		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey)
 		if err != nil {
 			log.Error(err)
 			return wrapErr(err)
@@ -434,8 +396,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			engineConfig.StateDir = filepath.Dir(path)
 		}
 
-		relayManager := relayClient.NewManager(engineCtx, relayURLs, myPrivateKey.PublicKey().String(), engineConfig.MTU,
-			relayClient.WithNetworkState(c.netState), relayClient.WithSweeper(c.sweeper))
+		relayManager := relayClient.NewManager(engineCtx, relayURLs, myPrivateKey.PublicKey().String(), engineConfig.MTU)
 		c.statusRecorder.SetRelayMgr(relayManager)
 		if len(relayURLs) > 0 {
 			if token != nil {
@@ -463,7 +424,6 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			UpdateManager:  c.updateManager,
 			ClientMetrics:  c.clientMetrics,
 			MetricsCtx:     c.ctx,
-			NetState:       c.netState,
 		}, mobileDependency)
 		engine.SetSyncResponsePersistence(c.persistSyncResponse)
 		c.engine = engine
@@ -520,16 +480,6 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 	// status stream stuck at Connecting.
 	err = backoff.Retry(operation, backoff.WithContext(backOff, c.ctx))
 	if err != nil {
-		// Once the client context is cancelled backoff.WithContext surfaces the
-		// bare context error, and any attempt torn down mid-flight reports the
-		// same. That cancellation is the caller asking us to stop (Stop, Down or
-		// an engine restart), so exit cleanly instead of handing back a failure
-		// the caller would have to distinguish from a real one.
-		if c.ctx.Err() != nil && errors.Is(err, context.Canceled) {
-			log.Info("exiting client retry loop, context cancelled")
-			return nil
-		}
-
 		log.Debugf("exiting client retry loop due to unrecoverable error: %s", err)
 		if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.PermissionDenied) {
 			state.Set(StatusNeedsLogin)
@@ -723,7 +673,7 @@ func selectMTU(localMTU uint16, peerMTU int32) uint16 {
 }
 
 // connectToSignal creates Signal Service client and established a connection
-func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key, netState *netstate.State, sweeper *netsweep.Sweeper) (*signal.GrpcClient, error) {
+func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key) (*signal.GrpcClient, error) {
 	var sigTLSEnabled bool
 	if wtConfig.Signal.Protocol == mgmProto.HostConfig_HTTPS {
 		sigTLSEnabled = true
@@ -731,8 +681,7 @@ func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourP
 		sigTLSEnabled = false
 	}
 
-	signalClient, err := signal.NewClient(ctx, wtConfig.Signal.Uri, ourPrivateKey, sigTLSEnabled,
-		signal.WithNetworkState(netState), signal.WithSweeper(sweeper))
+	signalClient, err := signal.NewClient(ctx, wtConfig.Signal.Uri, ourPrivateKey, sigTLSEnabled)
 	if err != nil {
 		log.Errorf("error while connecting to the Signal Exchange Service %s: %s", wtConfig.Signal.Uri, err)
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "failed connecting to Signal Service : %s", err)

client/internal/dns/host_windows.go

@@ -35,8 +35,6 @@ var (
 // exported so a diagnostic reader reports the same locations that are written.
 const (
 	// NRPTKeyPrefix starts the name of every NRPT rule key this client creates.
-	// Older versions used different layouts under the same prefix: a single
-	// unsuffixed key, then one key per domain, now one key per batch of domains.
 	NRPTKeyPrefix = "NetBird-Match"
 
 	// DNSPolicyConfigRoot holds the NRPT rules of the local policy store.
@@ -91,6 +89,7 @@ type registryConfigurator struct {
 	guid            string
 	routingAll      bool
 	gpo             bool
+	nrptEntryCount  int
 	origNameservers []netip.Addr
 }
 
@@ -323,9 +322,14 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 	}
 
 	if len(matchDomains) != 0 {
-		if err := r.addDNSMatchPolicy(matchDomains, config.ServerIP); err != nil {
+		count, err := r.addDNSMatchPolicy(matchDomains, config.ServerIP)
+		// Update count even on error to ensure cleanup covers partially created rules
+		r.nrptEntryCount = count
+		if err != nil {
 			return fmt.Errorf("add dns match policy: %w", err)
 		}
+	} else {
+		r.nrptEntryCount = 0
 	}
 
 	r.updateState(stateManager)
@@ -341,8 +345,9 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 
 func (r *registryConfigurator) updateState(stateManager *statemanager.Manager) {
 	if err := stateManager.UpdateState(&ShutdownState{
-		Guid: r.guid,
-		GPO:  r.gpo,
+		Guid:           r.guid,
+		GPO:            r.gpo,
+		NRPTEntryCount: r.nrptEntryCount,
 	}); err != nil {
 		log.Errorf("failed to update shutdown state: %s", err)
 	}
@@ -357,7 +362,7 @@ func (r *registryConfigurator) addDNSSetupForAll(ip netip.Addr) error {
 	return nil
 }
 
-func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) error {
+func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) (int, error) {
 	// if the gpo key is present, we need to put our DNS settings there, otherwise our config might be ignored
 	// see https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/8cc31cb9-20cb-4140-9e85-3e08703b4745
 
@@ -374,17 +379,19 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, ruleIndex)
 
 		if err := r.configureDNSPolicy(localPath, batchDomains, ip); err != nil {
-			return fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
+			return ruleIndex, fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
 		}
 
+		// Increment immediately so the caller's cleanup path knows about this rule
+		ruleIndex++
+
 		if r.gpo {
 			if err := r.configureDNSPolicy(gpoPath, batchDomains, ip); err != nil {
-				return fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex, err)
+				return ruleIndex, fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex-1, err)
 			}
 		}
 
-		log.Debugf("added NRPT rule %d with %d domains", ruleIndex, len(batchDomains))
-		ruleIndex++
+		log.Debugf("added NRPT rule %d with %d domains", ruleIndex-1, len(batchDomains))
 	}
 
 	if r.gpo {
@@ -394,7 +401,7 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 	}
 
 	log.Infof("added %d NRPT rules for %d domains", ruleIndex, len(domains))
-	return nil
+	return ruleIndex, nil
 }
 
 func (r *registryConfigurator) configureDNSPolicy(policyPath string, domains []string, ip netip.Addr) error {
@@ -459,7 +466,7 @@ func (r *registryConfigurator) flushDNSCache() {
 
 	ret, _, err := dnsFlushResolverCacheFn.Call()
 	if ret == 0 {
-		if !errors.Is(err, syscall.Errno(0)) {
+		if err != nil && !errors.Is(err, syscall.Errno(0)) {
 			log.Errorf("DnsFlushResolverCache failed: %v", err)
 			return
 		}
@@ -527,28 +534,28 @@ func (r *registryConfigurator) restoreHostDNS() error {
 	return nil
 }
 
-// removeDNSMatchPolicies deletes every NRPT rule this client may have created,
-// from the local and the GPO policy store. The rules are found by enumerating
-// the registry, the only authoritative record of what was written. Cleanup must
-// not depend on a rule count: the in-memory one is scoped to a single
-// registryConfigurator and the persisted one is deleted on every clean
-// disconnect, and a rule left behind keeps resolving names over an interface
-// that is gone, until reboot discards the volatile key.
 func (r *registryConfigurator) removeDNSMatchPolicies() error {
 	var merr *multierror.Error
 
-	for _, root := range []string{DNSPolicyConfigRoot, GPODNSPolicyConfigRoot} {
-		names, err := listNRPTRuleKeys(root)
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("list rule keys under %s: %w", root, err))
-			continue
+	// Try to remove the base entries (for backward compatibility)
+	if err := removeRegistryKeyFromDNSPolicyConfig(dnsPolicyConfigMatchPath); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove local base entry: %w", err))
+	}
+
+	if err := removeRegistryKeyFromDNSPolicyConfig(gpoDnsPolicyConfigMatchPath); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove GPO base entry: %w", err))
+	}
+
+	for i := 0; i < r.nrptEntryCount; i++ {
+		localPath := fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i)
+		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, i)
+
+		if err := removeRegistryKeyFromDNSPolicyConfig(localPath); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove local entry %d: %w", i, err))
 		}
 
-		for _, name := range names {
-			path := root + `\` + name
-			if err := removeRegistryKeyFromDNSPolicyConfig(path); err != nil {
-				merr = multierror.Append(merr, fmt.Errorf("remove entry %s: %w", path, err))
-			}
+		if err := removeRegistryKeyFromDNSPolicyConfig(gpoPath); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove GPO entry %d: %w", i, err))
 		}
 	}
 
@@ -563,39 +570,6 @@ func (r *registryConfigurator) restoreUncleanShutdownDNS() error {
 	return r.restoreHostDNS()
 }
 
-// listNRPTRuleKeys returns the names of our NRPT rule keys under a policy store
-// root. An absent root holds nothing to clean up, which is the normal state of
-// the GPO store on a machine without DNS Client policy.
-func listNRPTRuleKeys(root string) ([]string, error) {
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, root, registry.ENUMERATE_SUB_KEYS)
-	switch {
-	case errors.Is(err, registry.ErrNotExist), errors.Is(err, syscall.ERROR_PATH_NOT_FOUND):
-		// the GPO store is absent on a machine without DNS client policy
-		log.Debugf("HKEY_LOCAL_MACHINE\\%s does not exist", root)
-		return nil, nil
-	case err != nil:
-		// any other failure has to reach the caller: reporting no rules would
-		// report a successful cleanup while leaving the rules in place
-		return nil, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", root, err)
-	}
-	defer closer(k)
-
-	names, err := k.ReadSubKeyNames(-1)
-	if err != nil {
-		return nil, fmt.Errorf("read subkey names: %w", err)
-	}
-
-	var ruleKeys []string
-	for _, name := range names {
-		// registry key names are case insensitive
-		if strings.HasPrefix(strings.ToLower(name), strings.ToLower(NRPTKeyPrefix)) {
-			ruleKeys = append(ruleKeys, name)
-		}
-	}
-
-	return ruleKeys, nil
-}
-
 func removeRegistryKeyFromDNSPolicyConfig(regKeyPath string) error {
 	k, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.QUERY_VALUE)
 	if err != nil {
@@ -627,7 +601,7 @@ func refreshGroupPolicy() error {
 	)
 
 	if ret == 0 {
-		if !errors.Is(err, syscall.Errno(0)) {
+		if err != nil && !errors.Is(err, syscall.Errno(0)) {
 			return fmt.Errorf("RefreshPolicyEx failed: %w", err)
 		}
 		return fmt.Errorf("RefreshPolicyEx failed")

client/internal/dns/host_windows_test.go

@@ -25,7 +25,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := InterfaceConfigPath + `\` + testGUID
+	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -56,7 +56,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify 3 NRPT rules exist
-	assert.Equal(t, 3, countNRPTRuleKeys(t), "Should create 3 NRPT rules for 125 domains")
+	assert.Equal(t, 3, cfg.nrptEntryCount, "Should create 3 NRPT rules for 125 domains")
 	for i := 0; i < 3; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -81,7 +81,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify first 2 NRPT rules exist
-	assert.Equal(t, 2, countNRPTRuleKeys(t), "Should create 2 NRPT rules for 75 domains")
+	assert.Equal(t, 2, cfg.nrptEntryCount, "Should create 2 NRPT rules for 75 domains")
 	for i := 0; i < 2; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -106,65 +106,9 @@ func registryKeyExists(path string) (bool, error) {
 	return true, nil
 }
 
-// TestNRPTCleanupWithoutRuleCount verifies that rules written by a previous run
-// are removed by a configurator that has no record of how many there are: an
-// unclean exit loses the in-memory count and a clean disconnect deletes the
-// persisted one, so cleanup cannot depend on either.
-func TestNRPTCleanupWithoutRuleCount(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping registry integration test in short mode")
-	}
-
-	defer cleanupRegistryKeys(t)
-	cleanupRegistryKeys(t)
-
-	testIP := netip.MustParseAddr("100.64.0.1")
-
-	// 75 domains produce two indexed rules, as the current layout does
-	domains := make([]string, 75)
-	for i := range domains {
-		domains[i] = fmt.Sprintf(".domain%d.com", i+1)
-	}
-
-	previousRun := &registryConfigurator{}
-	require.NoError(t, previousRun.addDNSMatchPolicy(domains, testIP))
-
-	// the unsuffixed key an older version would have written
-	require.NoError(t, previousRun.configureDNSPolicy(dnsPolicyConfigMatchPath, []string{".legacy.example.com"}, testIP))
-
-	// a policy owned by someone else, which cleanup must not touch
-	foreignPath := DNSPolicyConfigRoot + `\DnsPolicyConfigTestForeign`
-	foreignKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, foreignPath, registry.SET_VALUE)
-	require.NoError(t, err, "Should create foreign policy key")
-	foreignKey.Close()
-	defer func() {
-		_ = registry.DeleteKey(registry.LOCAL_MACHINE, foreignPath)
-	}()
-
-	require.Equal(t, 3, countNRPTRuleKeys(t), "Should have two indexed rules and the legacy one")
-
-	// a configurator that never applied a DNS config, as one built after a
-	// restart or from a shutdown state without a count is
-	freshRun := &registryConfigurator{}
-	require.NoError(t, freshRun.removeDNSMatchPolicies())
-
-	assert.Equal(t, 0, countNRPTRuleKeys(t), "Should remove every rule left by the previous run")
-
-	exists, err := registryKeyExists(foreignPath)
-	require.NoError(t, err)
-	assert.True(t, exists, "Should not remove a policy that is not ours")
-}
-
-func countNRPTRuleKeys(t *testing.T) int {
-	t.Helper()
-
-	names, err := listNRPTRuleKeys(DNSPolicyConfigRoot)
-	require.NoError(t, err, "Should list NRPT rule keys")
-	return len(names)
-}
-
 func cleanupRegistryKeys(*testing.T) {
-	cfg := &registryConfigurator{}
+	// Clean up more entries to account for batching tests with many domains
+	cfg := &registryConfigurator{nrptEntryCount: 20}
 	_ = cfg.removeDNSMatchPolicies()
 }
 
@@ -181,7 +125,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := InterfaceConfigPath + `\` + testGUID
+	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -249,7 +193,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 			require.NoError(t, err)
 
 			// Verify that exactly expectedRuleCount rules were created
-			assert.Equal(t, tc.expectedRuleCount, countNRPTRuleKeys(t),
+			assert.Equal(t, tc.expectedRuleCount, cfg.nrptEntryCount,
 				"Should create %d NRPT rules for %d domains", tc.expectedRuleCount, tc.domainCount)
 
 			// Verify all expected rules exist

client/internal/dns/response_writer_test.go

@@ -4,7 +4,7 @@ import (
 	"net"
 	"testing"
 
-	"go.uber.org/mock/gomock"
+	"github.com/golang/mock/gomock"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 	"github.com/miekg/dns"

client/internal/dns/server_privileged_test.go

@@ -9,7 +9,7 @@ import (
 	"os"
 	"testing"
 
-	"go.uber.org/mock/gomock"
+	"github.com/golang/mock/gomock"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"

client/internal/dns/unclean_shutdown_windows.go

@@ -5,8 +5,9 @@ import (
 )
 
 type ShutdownState struct {
-	Guid string
-	GPO  bool
+	Guid           string
+	GPO            bool
+	NRPTEntryCount int
 }
 
 func (s *ShutdownState) Name() string {
@@ -15,8 +16,9 @@ func (s *ShutdownState) Name() string {
 
 func (s *ShutdownState) Cleanup() error {
 	manager := &registryConfigurator{
-		guid: s.Guid,
-		gpo:  s.GPO,
+		guid:           s.Guid,
+		gpo:            s.GPO,
+		nrptEntryCount: s.NRPTEntryCount,
 	}
 
 	if err := manager.restoreUncleanShutdownDNS(); err != nil {

client/internal/dnsfwd/manager.go

@@ -101,7 +101,7 @@ func (m *Manager) Start(fwdEntries []*ForwarderEntry) error {
 	m.dnsForwarder = NewDNSForwarder(listenAddress, dnsTTL, m.firewall, m.statusRecorder, m.wgIface)
 
 	go func() {
-		if err := m.dnsForwarder.Listen(fwdEntries); err != nil { //nolint:staticcheck
+		if err := m.dnsForwarder.Listen(fwdEntries); err != nil {
 			// todo handle close error if it is exists
 			log.Errorf("failed to start DNS forwarder, err: %v", err)
 		}

client/internal/ebpf/ebpf/manager_linux.go

@@ -2,21 +2,17 @@ package ebpf
 
 import (
 	_ "embed"
-	"fmt"
 	"net"
 	"sync"
 
 	"github.com/cilium/ebpf/link"
 	"github.com/cilium/ebpf/rlimit"
 	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
 
 	"github.com/netbirdio/netbird/client/internal/ebpf/manager"
 )
 
 const (
-	xdpProgName = "nb_xdp_prog"
-
 	mapKeyFeatures uint32 = 0
 
 	featureFlagWGProxy      = 0b00000001
@@ -72,50 +68,21 @@ func (tf *GeneralManager) loadXdp() error {
 		return err
 	}
 
-	// lo has no native XDP, so the program runs in generic mode. Unless it
-	// declares multi-buffer support the kernel must linearize every non-linear
-	// skb before running it. Loopback packets are up to 64 KB, so that is a
-	// contiguous GFP_ATOMIC allocation per packet, and when it fails the packet
-	// is dropped before the program runs, stalling local TCP connections.
-	// Multi-buffer XDP in generic mode requires kernel 6.3, so fall back to a
-	// plain attach when the kernel rejects it.
-	err = tf.attachXdp(iFace.Index, true)
-	if err == nil {
-		return nil
-	}
-	log.Debugf("failed to attach multi-buffer xdp program, retrying without it: %s", err)
-
-	return tf.attachXdp(iFace.Index, false)
-}
-
-func (tf *GeneralManager) attachXdp(iFaceIndex int, multiBuffer bool) error {
-	spec, err := loadBpf()
+	// load pre-compiled programs into the kernel.
+	err = loadBpfObjects(&tf.bpfObjs, nil)
 	if err != nil {
-		return fmt.Errorf("load bpf spec: %w", err)
-	}
-
-	if multiBuffer {
-		prog, ok := spec.Programs[xdpProgName]
-		if !ok {
-			return fmt.Errorf("program %s not found in bpf spec", xdpProgName)
-		}
-		prog.Flags |= unix.BPF_F_XDP_HAS_FRAGS
-	}
-
-	if err := spec.LoadAndAssign(&tf.bpfObjs, nil); err != nil {
-		return fmt.Errorf("load bpf objects: %w", err)
+		return err
 	}
 
 	tf.link, err = link.AttachXDP(link.XDPOptions{
 		Program:   tf.bpfObjs.NbXdpProg,
-		Interface: iFaceIndex,
+		Interface: iFace.Index,
 	})
+
 	if err != nil {
-		if closeErr := tf.bpfObjs.Close(); closeErr != nil {
-			log.Debugf("failed to close bpf objects after xdp attach error: %s", closeErr)
-		}
+		_ = tf.bpfObjs.Close()
 		tf.link = nil
-		return fmt.Errorf("attach xdp: %w", err)
+		return err
 	}
 	return nil
 }

client/internal/engine.go

@@ -59,7 +59,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/syncstore"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/jobexec"
-	"github.com/netbirdio/netbird/client/netstate"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/system"
 	nbdns "github.com/netbirdio/netbird/dns"
@@ -182,9 +181,6 @@ type EngineServices struct {
 	UpdateManager  *updater.Manager
 	ClientMetrics  *metrics.ClientMetrics
 	MetricsCtx     context.Context
-	// NetState gates the reconnection loops on OS-reported network
-	// availability; nil disables gating.
-	NetState *netstate.State
 }
 
 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -208,10 +204,6 @@ type Engine struct {
 	config    *EngineConfig
 	mobileDep MobileDependency
 
-	// netState gates the peer reconnection guards on OS-reported network
-	// availability; nil disables gating.
-	netState *netstate.State
-
 	// STUNs is a list of STUN servers used by ICE
 	STUNs []*stun.URI
 	// TURNs is a list of STUN servers used by ICE
@@ -345,7 +337,6 @@ func NewEngine(
 		syncMsgMux:         &sync.Mutex{},
 		config:             config,
 		mobileDep:          mobileDep,
-		netState:           services.NetState,
 		STUNs:              []*stun.URI{},
 		TURNs:              []*stun.URI{},
 		networkSerial:      0,
@@ -1902,8 +1893,7 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 			Addr:           e.getRosenpassAddr(),
 			PermissiveMode: e.config.RosenpassPermissive,
 		},
-		ICEConfig:    e.createICEConfig(),
-		NetworkState: e.netState,
+		ICEConfig: e.createICEConfig(),
 	}
 
 	serviceDependencies := peer.ServiceDependencies{
@@ -2572,7 +2562,7 @@ func (e *Engine) SetCapture(pc device.PacketCapture) error {
 	}
 
 	afc := capture.NewAFPacketCapture(intf.Name(), sess)
-	if err := afc.Start(); err != nil { //nolint:staticcheck // always errors on non-Linux builds
+	if err := afc.Start(); err != nil {
 		return fmt.Errorf("start AF_PACKET capture on %s: %w", intf.Name(), err)
 	}
 	e.afpacketCapture = afc

client/internal/engine_privileged_test.go

@@ -12,7 +12,7 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
+	"github.com/golang/mock/gomock"
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"

client/internal/peer/conn.go

@@ -26,7 +26,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/client/netstate"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
@@ -94,10 +93,6 @@ type ConnConfig struct {
 
 	// ICEConfig ICE protocol configuration
 	ICEConfig icemaker.Config
-
-	// NetworkState gates the reconnection guard on OS-reported network
-	// availability; nil disables gating.
-	NetworkState *netstate.State
 }
 
 type Conn struct {
@@ -259,7 +254,7 @@ func (conn *Conn) open(engineCtx context.Context, firstPacket []byte) error {
 		conn.handshaker.AddICEListener(conn.workerICE.OnNewOffer)
 	}
 
-	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher, conn.config.NetworkState)
+	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher)
 
 	conn.wg.Add(1)
 	go func() {
@@ -445,7 +440,7 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 		conn.dumpState.NewLocalProxy()
 		wgProxy, err = conn.newProxy(iceConnInfo.RemoteConn)
 		if err != nil {
-			conn.Log.Errorf("failed to add relayed net.Conn to local proxy: %v", err)
+			conn.Log.Errorf("failed to add turn net.Conn to local proxy: %v", err)
 			return
 		}
 		ep = wgProxy.EndpointAddr()
@@ -883,8 +878,9 @@ func (conn *Conn) newProxy(remoteConn net.Conn) (wgproxy.Proxy, error) {
 	}
 
 	wgProxy := conn.config.WgConfig.WgInterface.GetProxy()
-	if err := wgProxy.AddRelayedConn(conn.ctx, udpAddr, remoteConn); err != nil {
-		return nil, fmt.Errorf("add relayed conn to proxy: %w", err)
+	if err := wgProxy.AddTurnConn(conn.ctx, udpAddr, remoteConn); err != nil {
+		conn.Log.Errorf("failed to add turn net.Conn to local proxy: %v", err)
+		return nil, err
 	}
 	return wgProxy, nil
 }

client/internal/peer/guard/guard.go

@@ -6,8 +6,6 @@ import (
 
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/netstate"
 )
 
 // ConnStatus represents the connection state as seen by the guard.
@@ -33,26 +31,20 @@ type connStatusFunc func() ConnStatus
 // - Relayed connection disconnected
 // - ICE candidate changes
 type Guard struct {
-	log                 *log.Entry
-	isConnectedOnAllWay connStatusFunc
-	timeout             time.Duration
-	srWatcher           *SRWatcher
-	// netState gates reconnect attempts on OS-reported network availability;
-	// nil disables gating.
-	netState                *netstate.State
+	log                     *log.Entry
+	isConnectedOnAllWay     connStatusFunc
+	timeout                 time.Duration
+	srWatcher               *SRWatcher
 	relayedConnDisconnected chan struct{}
 	iCEConnDisconnected     chan struct{}
 }
 
-// NewGuard creates a reconnection guard for a peer connection. A nil netState
-// disables network availability gating.
-func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher, netState *netstate.State) *Guard {
+func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher) *Guard {
 	return &Guard{
 		log:                     log,
 		isConnectedOnAllWay:     isConnectedFn,
 		timeout:                 timeout,
 		srWatcher:               srWatcher,
-		netState:                netState,
 		relayedConnDisconnected: make(chan struct{}, 1),
 		iCEConnDisconnected:     make(chan struct{}, 1),
 	}
@@ -104,16 +96,9 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 	iceState := &iceRetryState{log: g.log}
 	defer iceState.reset()
 
-	netChanged := g.netState.Changed()
-
 	for {
 		select {
 		case <-tickerChannel:
-			// skip attempts while the OS reports no usable network; the
-			// netChanged case below resumes the loop once it returns
-			if !g.netState.IsOnline() {
-				continue
-			}
 			switch g.isConnectedOnAllWay() {
 			case ConnStatusConnected:
 				// all good, nothing to do
@@ -150,23 +135,6 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 			tickerChannel = ticker.C
 			iceState.reset()
 
-		case <-netChanged:
-			// Re-arm for the next transition before acting on this one.
-			netChanged = g.netState.Changed()
-			if !g.netState.IsOnline() {
-				continue
-			}
-			// Ticks skipped while offline drove the backoff towards its
-			// maximum without ever attempting, and left the ICE budget
-			// frozen — possibly in hourly mode. Recover on our own so the
-			// peer does not depend on a signal or relay event that never
-			// comes when both stayed up across the outage.
-			g.log.Debugf("network is back, reset reconnection ticker")
-			ticker.Stop()
-			ticker = g.newReconnectTicker(ctx)
-			tickerChannel = ticker.C
-			iceState.reset()
-
 		case <-ctx.Done():
 			g.log.Debugf("context is done, stop reconnect loop")
 			return

client/internal/peer/guard/guard_leak_test.go

@@ -15,7 +15,7 @@ import (
 
 func newTestGuard(status connStatusFunc) *Guard {
 	srw := NewSRWatcher(nil, nil, nil, ice.Config{})
-	return NewGuard(log.WithField("test", "guard"), status, 50*time.Millisecond, srw, nil)
+	return NewGuard(log.WithField("test", "guard"), status, 50*time.Millisecond, srw)
 }
 
 // countBackoffTickerGoroutines returns how many goroutines are currently sitting

client/internal/peer/guard/guard_netstate_test.go

@@ -1,107 +0,0 @@
-package guard
-
-import (
-	"context"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/netstate"
-)
-
-// newTestGuardWithNetState builds a guard with a realistic MaxInterval: the
-// backoff must be able to grow well past the outage, as it does in production
-// where the timeout is seconds to minutes.
-func newTestGuardWithNetState(status connStatusFunc, netState *netstate.State) *Guard {
-	srw := NewSRWatcher(nil, nil, nil, ice.Config{})
-	return NewGuard(log.WithField("test", "guard"), status, 30*time.Second, srw, netState)
-}
-
-// TestGuard_RecoversAfterOfflineToOnline covers a peer that stays disconnected
-// across a network outage while neither signal nor relay reports an event —
-// both stayed up, as on a short airplane mode toggle over Wi-Fi.
-//
-// Every tick taken while offline is skipped, but it still advances the
-// exponential backoff, so by the time the network returns the next tick can be
-// tens of seconds away. Without an explicit reaction to the transition the
-// peer waits out that interval for a recovery that could start immediately.
-func TestGuard_RecoversAfterOfflineToOnline(t *testing.T) {
-	netState := netstate.New()
-
-	var attempts atomic.Int32
-	g := newTestGuardWithNetState(func() ConnStatus { return ConnStatusDisconnected }, netState)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	// Start from the reconnect ticker (800ms initial interval), the state a
-	// peer is in after it loses its connection.
-	go g.Start(ctx, func() { attempts.Add(1) })
-	g.SetRelayedConnDisconnected()
-
-	// Let the backoff climb: 0.8s, 1.6s, 3.2s, 6.4s ... every tick is skipped
-	// while offline, but each one doubles the wait for the next.
-	netState.Set(false)
-	time.Sleep(8 * time.Second)
-
-	offlineAttempts := attempts.Load()
-	if offlineAttempts != 0 {
-		t.Fatalf("callback ran %d times while offline, want 0", offlineAttempts)
-	}
-
-	netState.Set(true)
-
-	// The next organic tick is now several seconds out, so anything within
-	// this window can only come from reacting to the transition itself.
-	pollCtx, stopPolling := context.WithTimeout(ctx, 2*time.Second)
-	defer stopPolling()
-
-	select {
-	case <-pollCtx.Done():
-		t.Fatal("peer was not retried within 2s of the network coming back, " +
-			"with neither a signal nor a relay event to fall back on")
-	case <-pollUntil(pollCtx, func() bool { return attempts.Load() > 0 }):
-	}
-}
-
-// TestGuard_OfflineTransitionDoesNotRetry checks the other direction: going
-// offline must not itself trigger an attempt.
-func TestGuard_OfflineTransitionDoesNotRetry(t *testing.T) {
-	netState := netstate.New()
-
-	var attempts atomic.Int32
-	g := newTestGuardWithNetState(func() ConnStatus { return ConnStatusDisconnected }, netState)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go g.Start(ctx, func() { attempts.Add(1) })
-
-	netState.Set(false)
-	time.Sleep(5 * time.Second)
-
-	if got := attempts.Load(); got != 0 {
-		t.Fatalf("callback ran %d times after going offline, want 0", got)
-	}
-}
-
-// pollUntil closes the returned channel once cond holds. It gives up when ctx
-// is done, so the polling goroutine never outlives the test that started it.
-func pollUntil(ctx context.Context, cond func() bool) <-chan struct{} {
-	done := make(chan struct{})
-	go func() {
-		for {
-			if cond() {
-				close(done)
-				return
-			}
-			select {
-			case <-ctx.Done():
-				return
-			case <-time.After(10 * time.Millisecond):
-			}
-		}
-	}()
-	return done
-}

client/internal/peer/listener.go

@@ -1,40 +1,11 @@
 package peer
 
-// ClientState identifies the client connection state delivered via
-// Listener.OnStateChanged.
-type ClientState int
-
-// Client states. The numeric values cross the gomobile boundary (the mobile
-// bindings re-export them as integer constants), so they are a wire format:
-// append new states at the end, never reorder or insert.
-const (
-	ClientStateDisconnected ClientState = iota
-	ClientStateConnected
-	ClientStateConnecting
-	ClientStateDisconnecting
-	// ClientStateNoNetwork is an overlay state: it is never stored as the
-	// last notification, only derived from ClientStateConnecting while the
-	// OS reports no usable network (see notifier.effectiveState).
-	ClientStateNoNetwork
-)
-
 // Listener is a callback type about the NetBird network connection state
 type Listener interface {
-	// OnStateChanged reports every client state transition. New states are
-	// delivered only through this callback; the per-state callbacks below
-	// are kept for compatibility and will be removed once all consumers
-	// have migrated.
-	OnStateChanged(state ClientState)
-
-	// Deprecated: consume OnStateChanged instead.
 	OnConnected()
-	// Deprecated: consume OnStateChanged instead.
 	OnDisconnected()
-	// Deprecated: consume OnStateChanged instead.
 	OnConnecting()
-	// Deprecated: consume OnStateChanged instead.
 	OnDisconnecting()
-
 	OnAddressChanged(string, string)
 	OnPeersListChanged(int)
 }

client/internal/peer/notifier.go

@@ -4,64 +4,31 @@ import (
 	"sync"
 )
 
+const (
+	stateDisconnected = iota
+	stateConnected
+	stateConnecting
+	stateDisconnecting
+)
+
 type notifier struct {
-	// publishLock orders state publication: it is held across computing the
-	// effective state and handing it to the listener, so a transition cannot
-	// overtake a newer one and leave the listener on a stale state.
-	publishLock        sync.Mutex
 	serverStateLock    sync.Mutex
 	listenersLock      sync.Mutex
 	listener           Listener
 	currentClientState bool
-	lastNotification   ClientState
+	lastNotification   int
 	lastNumberOfPeers  int
 	lastFqdnAddress    string
 	lastIPAddress      string
-	networkAvailable   bool
 }
 
 func newNotifier() *notifier {
-	return &notifier{
-		networkAvailable: true,
-	}
-}
-
-// effectiveState maps the computed state to what listeners should see:
-// while the OS reports no usable network, "Connecting" would be a lie —
-// connection attempts are suspended — so it is reported as NoNetwork.
-// Caller must hold serverStateLock.
-func (n *notifier) effectiveState(state ClientState) ClientState {
-	if !n.networkAvailable && state == ClientStateConnecting {
-		return ClientStateNoNetwork
-	}
-	return state
-}
-
-// setNetworkAvailable records the OS network availability and re-notifies
-// the listener when the flag flips the effective state (Connecting <->
-// NoNetwork).
-func (n *notifier) setNetworkAvailable(available bool) {
-	n.publishLock.Lock()
-	defer n.publishLock.Unlock()
-
-	n.serverStateLock.Lock()
-	if n.networkAvailable == available {
-		n.serverStateLock.Unlock()
-		return
-	}
-	previous := n.effectiveState(n.lastNotification)
-	n.networkAvailable = available
-	current := n.effectiveState(n.lastNotification)
-	n.serverStateLock.Unlock()
-
-	if previous != current {
-		n.notify(current)
-	}
+	return &notifier{}
 }
 
 func (n *notifier) setListener(listener Listener) {
 	n.serverStateLock.Lock()
-	lastNotification := n.effectiveState(n.lastNotification)
+	lastNotification := n.lastNotification
 	numOfPeers := n.lastNumberOfPeers
 	fqdnAddress := n.lastFqdnAddress
 	address := n.lastIPAddress
@@ -85,9 +52,6 @@ func (n *notifier) removeListener() {
 }
 
 func (n *notifier) updateServerStates(mgmState bool, signalState bool) {
-	n.publishLock.Lock()
-	defer n.publishLock.Unlock()
-
 	n.serverStateLock.Lock()
 	calculatedState := n.calculateState(mgmState, signalState)
 
@@ -97,54 +61,43 @@ func (n *notifier) updateServerStates(mgmState bool, signalState bool) {
 	}
 
 	n.lastNotification = calculatedState
-	effective := n.effectiveState(calculatedState)
 	n.serverStateLock.Unlock()
 
-	n.notify(effective)
+	n.notify(calculatedState)
 }
 
 func (n *notifier) clientStart() {
-	n.publishLock.Lock()
-	defer n.publishLock.Unlock()
-
 	n.serverStateLock.Lock()
 	n.currentClientState = true
-	n.lastNotification = ClientStateConnecting
-	effective := n.effectiveState(ClientStateConnecting)
+	n.lastNotification = stateConnecting
 	n.serverStateLock.Unlock()
 
-	n.notify(effective)
+	n.notify(stateConnecting)
 }
 
 func (n *notifier) clientStop() {
-	n.publishLock.Lock()
-	defer n.publishLock.Unlock()
-
 	n.serverStateLock.Lock()
 	n.currentClientState = false
-	n.lastNotification = ClientStateDisconnected
+	n.lastNotification = stateDisconnected
 	n.serverStateLock.Unlock()
 
-	n.notify(ClientStateDisconnected)
+	n.notify(stateDisconnected)
 }
 
 func (n *notifier) clientTearDown() {
-	n.publishLock.Lock()
-	defer n.publishLock.Unlock()
-
 	n.serverStateLock.Lock()
 	n.currentClientState = false
-	n.lastNotification = ClientStateDisconnecting
+	n.lastNotification = stateDisconnecting
 	n.serverStateLock.Unlock()
 
-	n.notify(ClientStateDisconnecting)
+	n.notify(stateDisconnecting)
 }
 
-func (n *notifier) isServerStateChanged(newState ClientState) bool {
+func (n *notifier) isServerStateChanged(newState int) bool {
 	return n.lastNotification != newState
 }
 
-func (n *notifier) notify(state ClientState) {
+func (n *notifier) notify(state int) {
 	n.listenersLock.Lock()
 	listener := n.listener
 	n.listenersLock.Unlock()
@@ -156,20 +109,20 @@ func (n *notifier) notify(state ClientState) {
 	notifyListener(listener, state)
 }
 
-func (n *notifier) calculateState(managementConn, signalConn bool) ClientState {
+func (n *notifier) calculateState(managementConn, signalConn bool) int {
 	if managementConn && signalConn {
-		return ClientStateConnected
+		return stateConnected
 	}
 
 	if !managementConn && !signalConn && !n.currentClientState {
-		return ClientStateDisconnected
+		return stateDisconnected
 	}
 
-	if n.lastNotification == ClientStateDisconnecting {
-		return ClientStateDisconnecting
+	if n.lastNotification == stateDisconnecting {
+		return stateDisconnecting
 	}
 
-	return ClientStateConnecting
+	return stateConnecting
 }
 
 func (n *notifier) peerListChanged(numOfPeers int) {
@@ -206,19 +159,15 @@ func (n *notifier) localAddressChanged(fqdn, address string) {
 	listener.OnAddressChanged(fqdn, address)
 }
 
-func notifyListener(l Listener, state ClientState) {
-	// legacy per-state callbacks; NoNetwork is delivered only via
-	// OnStateChanged below
+func notifyListener(l Listener, state int) {
 	switch state {
-	case ClientStateDisconnected:
+	case stateDisconnected:
 		l.OnDisconnected()
-	case ClientStateConnected:
+	case stateConnected:
 		l.OnConnected()
-	case ClientStateConnecting:
+	case stateConnecting:
 		l.OnConnecting()
-	case ClientStateDisconnecting:
+	case stateDisconnecting:
 		l.OnDisconnecting()
 	}
-
-	l.OnStateChanged(state)
 }

client/internal/peer/notifier_concurrent_test.go

@@ -1,108 +0,0 @@
-package peer
-
-import (
-	"sync"
-	"testing"
-	"time"
-)
-
-type recordingListener struct {
-	mu      sync.Mutex
-	states  []ClientState
-	onState func(ClientState)
-}
-
-func (l *recordingListener) OnStateChanged(state ClientState) {
-	l.mu.Lock()
-	l.states = append(l.states, state)
-	hook := l.onState
-	l.mu.Unlock()
-
-	if hook != nil {
-		hook(state)
-	}
-}
-
-func (l *recordingListener) last() (ClientState, bool) {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	if len(l.states) == 0 {
-		return 0, false
-	}
-	return l.states[len(l.states)-1], true
-}
-
-func (l *recordingListener) snapshot() []ClientState {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	return append([]ClientState(nil), l.states...)
-}
-
-func (l *recordingListener) OnConnected()                    {}
-func (l *recordingListener) OnDisconnected()                 {}
-func (l *recordingListener) OnConnecting()                   {}
-func (l *recordingListener) OnDisconnecting()                {}
-func (l *recordingListener) OnAddressChanged(string, string) {}
-func (l *recordingListener) OnPeersListChanged(int)          {}
-
-// TestNotifier_ConcurrentAvailabilityFlipOrdersPublication holds the first
-// transition inside the listener callback and flips availability again from
-// another goroutine while it is parked. The second flip must not publish
-// ahead of the one in flight, otherwise the listener ends up on a state the
-// notifier already superseded.
-func TestNotifier_ConcurrentAvailabilityFlipOrdersPublication(t *testing.T) {
-	n := newNotifier()
-	n.currentClientState = true
-	n.lastNotification = ClientStateConnecting
-
-	entered := make(chan struct{})
-	release := make(chan struct{})
-
-	l := &recordingListener{}
-	l.onState = func(state ClientState) {
-		if state != ClientStateNoNetwork {
-			return
-		}
-		l.mu.Lock()
-		l.onState = nil
-		l.mu.Unlock()
-		close(entered)
-		<-release
-	}
-	n.listener = l
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		n.setNetworkAvailable(false)
-	}()
-
-	<-entered
-
-	flipped := make(chan struct{})
-	go func() {
-		defer close(flipped)
-		n.setNetworkAvailable(true)
-	}()
-
-	select {
-	case <-flipped:
-		t.Fatal("the online transition published while the offline one was " +
-			"still in flight; publication is not serialized")
-	case <-time.After(200 * time.Millisecond):
-	}
-
-	close(release)
-	<-flipped
-	wg.Wait()
-
-	got, ok := l.last()
-	if !ok {
-		t.Fatal("listener never observed a state")
-	}
-	if got != ClientStateConnecting {
-		t.Fatalf("listener holds %v after the network came back, want Connecting; sequence: %v",
-			got, l.snapshot())
-	}
-}

client/internal/peer/notifier_test.go

@@ -6,32 +6,29 @@ import (
 )
 
 type mocListener struct {
-	lastState ClientState
+	lastState int
 	wg        sync.WaitGroup
 	peersWg   sync.WaitGroup
 	peers     int
 }
 
 func (l *mocListener) OnConnected() {
-	l.lastState = ClientStateConnected
+	l.lastState = stateConnected
 	l.wg.Done()
 }
 func (l *mocListener) OnDisconnected() {
-	l.lastState = ClientStateDisconnected
+	l.lastState = stateDisconnected
 	l.wg.Done()
 }
 func (l *mocListener) OnConnecting() {
-	l.lastState = ClientStateConnecting
+	l.lastState = stateConnecting
 	l.wg.Done()
 }
 func (l *mocListener) OnDisconnecting() {
-	l.lastState = ClientStateDisconnecting
+	l.lastState = stateDisconnecting
 	l.wg.Done()
 }
 
-func (l *mocListener) OnStateChanged(state ClientState) {
-
-}
 func (l *mocListener) OnAddressChanged(host, addr string) {
 
 }
@@ -60,15 +57,15 @@ func Test_notifier_serverState(t *testing.T) {
 
 	type scenario struct {
 		name        string
-		expected    ClientState
+		expected    int
 		mgmState    bool
 		signalState bool
 	}
 	scenarios := []scenario{
-		{"connected", ClientStateConnected, true, true},
-		{"mgm down", ClientStateConnecting, false, true},
-		{"signal down", ClientStateConnecting, true, false},
-		{"disconnected", ClientStateDisconnected, false, false},
+		{"connected", stateConnected, true, true},
+		{"mgm down", stateConnecting, false, true},
+		{"signal down", stateConnecting, true, false},
+		{"disconnected", stateDisconnected, false, false},
 	}
 
 	for _, tt := range scenarios {
@@ -88,7 +85,7 @@ func Test_notifier_SetListener(t *testing.T) {
 	listener.setPeersWaiter()
 
 	n := newNotifier()
-	n.lastNotification = ClientStateConnecting
+	n.lastNotification = stateConnecting
 	n.setListener(listener)
 	listener.wait()
 	listener.waitPeers()
@@ -102,7 +99,7 @@ func Test_notifier_RemoveListener(t *testing.T) {
 	listener.setWaiter()
 	listener.setPeersWaiter()
 	n := newNotifier()
-	n.lastNotification = ClientStateConnecting
+	n.lastNotification = stateConnecting
 	n.setListener(listener)
 	// setListener replays cached state on a goroutine; wait for both the state
 	// and peers callbacks to finish so we don't race on listener.peers.

client/internal/peer/status.go

@@ -1211,12 +1211,6 @@ func (d *Status) ClientTeardown() {
 	d.notifyStateChange()
 }
 
-// SetNetworkAvailable records the OS-reported network availability; while
-// unavailable, listeners see NoNetwork instead of Connecting.
-func (d *Status) SetNetworkAvailable(available bool) {
-	d.notifier.setNetworkAvailable(available)
-}
-
 // SetConnectionListener set a listener to the notifier
 func (d *Status) SetConnectionListener(listener Listener) {
 	d.notifier.setListener(listener)

client/internal/peer/worker_ice.go

@@ -255,8 +255,8 @@ func (w *WorkerICE) connect(ctx context.Context, agent *icemaker.ThreadSafeAgent
 		return
 	}
 
-	w.log.Debugf("agent dial")
-	remoteConn, err := w.agentDial(ctx, agent, remoteOfferAnswer)
+	w.log.Debugf("turn agent dial")
+	remoteConn, err := w.turnAgentDial(ctx, agent, remoteOfferAnswer)
 	if err != nil {
 		w.log.Debugf("failed to dial the remote peer: %s", err)
 		w.closeAgent(agent, w.agentDialerCancel)
@@ -517,8 +517,8 @@ func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dia
 			w.logSuccessfulPaths(agent)
 			return
 		case ice.ConnectionStateFailed, ice.ConnectionStateDisconnected, ice.ConnectionStateClosed:
-			// ice.ConnectionStateClosed happens when we recreate the agent. The P2P to relay switch requires
-			// notifying conn.onICEStateDisconnected so it can update the currently used priority.
+			// ice.ConnectionStateClosed happens when we recreate the agent. For the P2P to TURN switch important to
+			// notify the conn.onICEStateDisconnected changes to update the current used priority
 
 			sessionChanged := w.closeAgent(agent, dialerCancel)
 
@@ -532,7 +532,7 @@ func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dia
 	}
 }
 
-func (w *WorkerICE) agentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (*ice.Conn, error) {
+func (w *WorkerICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (*ice.Conn, error) {
 	if isController(w.config) {
 		return agent.Dial(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
 	} else {

client/internal/profilemanager/prefs.go

@@ -1,130 +0,0 @@
-package profilemanager
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sync"
-
-	"github.com/netbirdio/netbird/util"
-)
-
-const prefsFileSuffix = ".prefs.json"
-
-var prefsMu sync.Mutex
-
-// Prefs is a namespaced per-profile preference store backed by a single JSON
-// file next to the profile config; it is deleted together with the profile.
-type Prefs struct {
-	path string
-}
-
-// ProfilePrefs returns the preference store of the profile identified by id.
-func (s *ServiceManager) ProfilePrefs(id ID, username string) (*Prefs, error) {
-	if !IsValidProfileFilenameStem(id) {
-		return nil, fmt.Errorf("invalid profile ID: %q", id)
-	}
-	if id == defaultProfileName {
-		return &Prefs{path: filepath.Join(filepath.Dir(DefaultConfigPath), id.String()+prefsFileSuffix)}, nil
-	}
-	configDir, err := s.getConfigDir(username)
-	if err != nil {
-		return nil, fmt.Errorf("get config directory for user %s: %w", username, err)
-	}
-	return &Prefs{path: filepath.Join(configDir, id.String()+prefsFileSuffix)}, nil
-}
-
-// Get unmarshals the namespace section into v and reports whether it exists.
-func (p *Prefs) Get(namespace string, v any) (bool, error) {
-	if namespace == "" {
-		return false, fmt.Errorf("empty prefs namespace")
-	}
-
-	prefsMu.Lock()
-	defer prefsMu.Unlock()
-
-	sections, err := readPrefsFile(p.path)
-	if err != nil {
-		return false, err
-	}
-	raw, ok := sections[namespace]
-	if !ok {
-		return false, nil
-	}
-	if err := json.Unmarshal(raw, v); err != nil {
-		return false, fmt.Errorf("decode prefs namespace %q: %w", namespace, err)
-	}
-	return true, nil
-}
-
-// Put stores v as the namespace section, replacing any previous value.
-func (p *Prefs) Put(namespace string, v any) error {
-	if namespace == "" {
-		return fmt.Errorf("empty prefs namespace")
-	}
-	raw, err := json.Marshal(v)
-	if err != nil {
-		return fmt.Errorf("encode prefs namespace %q: %w", namespace, err)
-	}
-
-	prefsMu.Lock()
-	defer prefsMu.Unlock()
-
-	sections, err := readPrefsFile(p.path)
-	if err != nil {
-		return err
-	}
-	sections[namespace] = raw
-	return writePrefsFile(p.path, sections)
-}
-
-// Remove deletes the namespace section; a missing one is not an error.
-func (p *Prefs) Remove(namespace string) error {
-	if namespace == "" {
-		return fmt.Errorf("empty prefs namespace")
-	}
-
-	prefsMu.Lock()
-	defer prefsMu.Unlock()
-
-	sections, err := readPrefsFile(p.path)
-	if err != nil {
-		return err
-	}
-	if _, ok := sections[namespace]; !ok {
-		return nil
-	}
-	delete(sections, namespace)
-	return writePrefsFile(p.path, sections)
-}
-
-func removePrefsFile(path string) error {
-	prefsMu.Lock()
-	defer prefsMu.Unlock()
-	return os.Remove(path)
-}
-
-func readPrefsFile(path string) (map[string]json.RawMessage, error) {
-	data, err := os.ReadFile(path)
-	if os.IsNotExist(err) {
-		return map[string]json.RawMessage{}, nil
-	}
-	if err != nil {
-		return nil, fmt.Errorf("read prefs: %w", err)
-	}
-
-	sections := map[string]json.RawMessage{}
-	if err := json.Unmarshal(data, &sections); err != nil {
-		return nil, fmt.Errorf("decode prefs: %w", err)
-	}
-	return sections, nil
-}
-
-func writePrefsFile(path string, sections map[string]json.RawMessage) error {
-	if err := util.WriteJsonWithRestrictedPermission(context.Background(), path, sections); err != nil {
-		return fmt.Errorf("write prefs: %w", err)
-	}
-	return nil
-}

client/internal/profilemanager/prefs_test.go

@@ -1,138 +0,0 @@
-package profilemanager
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type testPrefsSection struct {
-	Mode uint8  `json:"mode"`
-	Dest string `json:"dest"`
-}
-
-func TestProfilePrefs_RoundTrip(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
-		require.NoError(t, err)
-
-		prefs, err := sm.ProfilePrefs(created.ID, username)
-		require.NoError(t, err)
-
-		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 2, Dest: "/tmp/x"}))
-		require.NoError(t, prefs.Put("other", map[string]int{"n": 1}))
-
-		var got testPrefsSection
-		found, err := prefs.Get("filedrop", &got)
-		require.NoError(t, err)
-		assert.True(t, found)
-		assert.Equal(t, testPrefsSection{Mode: 2, Dest: "/tmp/x"}, got)
-
-		var other map[string]int
-		found, err = prefs.Get("other", &other)
-		require.NoError(t, err)
-		assert.True(t, found)
-		assert.Equal(t, map[string]int{"n": 1}, other)
-	})
-}
-
-func TestProfilePrefs_GetMissingNamespace(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
-		require.NoError(t, err)
-
-		prefs, err := sm.ProfilePrefs(created.ID, username)
-		require.NoError(t, err)
-
-		var got testPrefsSection
-		found, err := prefs.Get("filedrop", &got)
-		require.NoError(t, err)
-		assert.False(t, found)
-	})
-}
-
-func TestProfilePrefs_RemoveNamespace(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
-		require.NoError(t, err)
-
-		prefs, err := sm.ProfilePrefs(created.ID, username)
-		require.NoError(t, err)
-
-		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 1}))
-		require.NoError(t, prefs.Put("other", map[string]int{"n": 1}))
-		require.NoError(t, prefs.Remove("filedrop"))
-		require.NoError(t, prefs.Remove("missing"))
-
-		var got testPrefsSection
-		found, err := prefs.Get("filedrop", &got)
-		require.NoError(t, err)
-		assert.False(t, found)
-
-		var other map[string]int
-		found, err = prefs.Get("other", &other)
-		require.NoError(t, err)
-		assert.True(t, found)
-		assert.Equal(t, map[string]int{"n": 1}, other)
-	})
-}
-
-func TestProfilePrefs_RejectsInvalidID(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		_, err := sm.ProfilePrefs("../escape", username)
-		assert.Error(t, err)
-	})
-}
-
-func TestProfilePrefs_RejectsEmptyNamespace(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
-		require.NoError(t, err)
-
-		prefs, err := sm.ProfilePrefs(created.ID, username)
-		require.NoError(t, err)
-
-		_, err = prefs.Get("", &testPrefsSection{})
-		assert.Error(t, err)
-		assert.Error(t, prefs.Put("", testPrefsSection{}))
-		assert.Error(t, prefs.Remove(""))
-	})
-}
-
-func TestProfilePrefs_DefaultProfile(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		prefs, err := sm.ProfilePrefs(defaultProfileName, username)
-		require.NoError(t, err)
-
-		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 1}))
-
-		expected := filepath.Join(filepath.Dir(DefaultConfigPath), "default"+prefsFileSuffix)
-		_, err = os.Stat(expected)
-		require.NoError(t, err)
-	})
-}
-
-func TestRemoveProfile_DeletesPrefsFile(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
-		require.NoError(t, err)
-
-		prefs, err := sm.ProfilePrefs(created.ID, username)
-		require.NoError(t, err)
-		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 2}))
-
-		configDir, err := sm.getConfigDir(username)
-		require.NoError(t, err)
-		prefsPath := filepath.Join(configDir, created.ID.String()+prefsFileSuffix)
-		_, err = os.Stat(prefsPath)
-		require.NoError(t, err)
-
-		require.NoError(t, sm.RemoveProfile(created.ID, username))
-		_, err = os.Stat(prefsPath)
-		assert.True(t, errors.Is(err, os.ErrNotExist), "prefs file should be removed")
-	})
-}

client/internal/profilemanager/service.go

@@ -420,11 +420,6 @@ func (s *ServiceManager) RemoveProfile(id ID, username string) error {
 		log.Warnf("failed to remove profile state file %s: %v", stateFile, err)
 	}
 
-	prefsFile := filepath.Join(filepath.Dir(target.Path), id.String()+prefsFileSuffix)
-	if err := removePrefsFile(prefsFile); err != nil && !os.IsNotExist(err) {
-		log.Warnf("failed to remove profile prefs file %s: %v", prefsFile, err)
-	}
-
 	return nil
 }
 

client/internal/sleep/service.go

@@ -18,8 +18,8 @@ type Service struct {
 }
 
 func New() (*Service, error) {
-	d, err := NewDetector() //nolint:staticcheck
-	if err != nil {         //nolint:staticcheck // always errors on platforms without a sleep detector
+	d, err := NewDetector()
+	if err != nil {
 		return nil, err
 	}
 

client/internal/updater/installer/doc.go

@@ -37,32 +37,23 @@
 // Updater Process (Setup):
 //
 //  1. Receives parameters from service via command-line arguments
-//  2. Terminates the UI so the installer does not have to replace a locked image
-//     file, which would otherwise leave the install needing a reboot
-//  3. Runs installer with appropriate silent/quiet flags:
+//  2. Runs installer with appropriate silent/quiet flags:
 //     - Windows EXE: installer.exe /S
-//     - Windows MSI: msiexec.exe /i installer.msi /qn /norestart REBOOT=ReallySuppress /l*v msi.log
+//     - Windows MSI: msiexec.exe /i installer.msi /quiet /qn /l*v msi.log
 //     - macOS PKG: installer -pkg installer.pkg -target /
 //     - macOS Homebrew: brew upgrade netbirdio/tap/netbird
-//  4. Installer terminates the daemon
-//  5. Installer replaces binaries with new version
-//  6. Updater waits for installer to complete. On Windows, MSI exit codes 3010
-//     (ERROR_SUCCESS_REBOOT_REQUIRED) and 1641 (ERROR_SUCCESS_REBOOT_INITIATED)
-//     are a pending-reboot outcome, not a failure: the install succeeded, but
-//     some files are only replaced on the next restart (the reboot itself is
-//     suppressed via /norestart and REBOOT=ReallySuppress), and the flow
-//     continues as on success
-//  7. Updater restarts daemon:
+//  3. Installer terminates daemon and UI processes
+//  4. Installer replaces binaries with new version
+//  5. Updater waits for installer to complete
+//  6. Updater restarts daemon:
 //     - Windows: netbird.exe service start
 //     - macOS/Linux: netbird service start
-//  8. Updater restarts UI:
-//     - Windows: Launches netbird-ui.exe using CreateProcessAsUser in every
-//     session it was terminated in, falling back to the active console session
+//  7. Updater restarts UI:
+//     - Windows: Launches netbird-ui.exe as active console user using CreateProcessAsUser
 //     - macOS: Uses launchctl asuser to launch NetBird.app for console user
 //     - Linux: Not implemented (UI typically auto-starts)
-//  9. Updater writes result.json with success/error status (a pending reboot is
-//     recorded as success)
-//  10. Updater process exits
+//  8. Updater writes result.json with success/error status
+//  9. Updater process exits
 //
 // # Result Communication
 //

client/internal/updater/installer/installer_common.go

@@ -42,9 +42,6 @@ func NewWithDir(tempDir string) *Installer {
 // This will run by the original service process
 func (u *Installer) RunInstallation(ctx context.Context, targetVersion string) (err error) {
 	resultHandler := NewResultHandler(u.tempDir)
-	if err := resultHandler.ClearStaleResult(); err != nil {
-		log.Warnf("clear stale installer result: %v", err)
-	}
 
 	defer func() {
 		if err != nil {

client/internal/updater/installer/installer_run_windows.go

@@ -2,7 +2,6 @@ package installer
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"os"
 	"os/exec"
@@ -23,12 +22,6 @@ const (
 
 	msiLogFile = "msi.log"
 
-	// ERROR_SUCCESS_REBOOT_REQUIRED and ERROR_SUCCESS_REBOOT_INITIATED
-	msiRebootRequired  = 3010
-	msiRebootInitiated = 1641
-
-	processExitWait = 10 * time.Second
-
 	msiDownloadURL = "https://github.com/netbirdio/netbird/releases/download/v%version/netbird_installer_%version_windows_%arch.msi"
 	exeDownloadURL = "https://github.com/netbirdio/netbird/releases/download/v%version/netbird_installer_%version_windows_%arch.exe"
 )
@@ -45,8 +38,6 @@ var (
 func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string, daemonFolder string) (resultErr error) {
 	resultHandler := NewResultHandler(u.tempDir)
 
-	var uiSessions []uint32
-
 	// Always ensure daemon and UI are restarted after setup
 	defer func() {
 		log.Infof("starting daemon back")
@@ -55,7 +46,7 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 		}
 
 		log.Infof("starting UI back")
-		if err := u.startUI(daemonFolder, uiSessions); err != nil {
+		if err := u.startUIAsUser(daemonFolder); err != nil {
 			log.Errorf("failed to start UI: %v", err)
 		}
 
@@ -84,14 +75,6 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 		return
 	}
 
-	// The UI holds an open handle on its own image. Left running, Restart Manager
-	// cannot shut it down (msiexec runs as LocalSystem here, the UI as the
-	// interactive user), so the MSI falls back to replacing the file on reboot and
-	// marks the install as restart-required. The deferred close-application action
-	// in the package runs too late to prevent that, it happens after
-	// InstallValidate has already registered the file as in use.
-	uiSessions = killUI()
-
 	var cmd *exec.Cmd
 	switch installerType {
 	case TypeExe:
@@ -101,9 +84,7 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 		installerDir := filepath.Dir(installerFile)
 		logPath := filepath.Join(installerDir, msiLogFile)
 		log.Infof("run msi installer: %s", installerFile)
-		// REBOOT=ReallySuppress: a silent install has no way to ask, so without it
-		// msiexec reboots the machine on its own if it decides one is needed.
-		cmd = exec.CommandContext(ctx, "msiexec.exe", "/i", filepath.Base(installerFile), "/qn", "/norestart", "REBOOT=ReallySuppress", "/l*v", logPath)
+		cmd = exec.CommandContext(ctx, "msiexec.exe", "/i", filepath.Base(installerFile), "/quiet", "/qn", "/l*v", logPath)
 	}
 
 	cmd.Dir = filepath.Dir(installerFile)
@@ -114,13 +95,9 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 	}
 
 	log.Infof("installer started with PID %d", cmd.Process.Pid)
-	if err := cmd.Wait(); err != nil {
-		if !isRebootPending(err) {
-			resultErr = err
-			log.Errorf("installer process finished with error: %v", err)
-			return
-		}
-		log.Warnf("installer completed but reported a pending reboot, some files will be replaced on the next restart")
+	if resultErr = cmd.Wait(); resultErr != nil {
+		log.Errorf("installer process finished with error: %v", resultErr)
+		return
 	}
 
 	return nil
@@ -140,142 +117,16 @@ func (u *Installer) startDaemon(daemonFolder string) error {
 	return nil
 }
 
-func (u *Installer) startUI(daemonFolder string, sessionIDs []uint32) error {
+func (u *Installer) startUIAsUser(daemonFolder string) error {
 	uiPath := filepath.Join(daemonFolder, uiName)
 	log.Infof("starting netbird-ui: %s", uiPath)
 
-	if len(sessionIDs) == 0 {
-		sessionID := windows.WTSGetActiveConsoleSessionId()
-		if sessionID == 0xFFFFFFFF {
-			return fmt.Errorf("no active user session found")
-		}
-		sessionIDs = []uint32{sessionID}
+	// Get the active console session ID
+	sessionID := windows.WTSGetActiveConsoleSessionId()
+	if sessionID == 0xFFFFFFFF {
+		return fmt.Errorf("no active user session found")
 	}
 
-	var errs []error
-	for _, sessionID := range sessionIDs {
-		if err := startUIInSession(uiPath, sessionID); err != nil {
-			errs = append(errs, fmt.Errorf("session %d: %w", sessionID, err))
-			continue
-		}
-		log.Infof("netbird-ui started successfully in session %d", sessionID)
-	}
-	return errors.Join(errs...)
-}
-
-// isRebootPending reports whether the installer exit code means it succeeded but
-// left work for the next restart. The reboot itself is suppressed, so this is not
-// a failure.
-func isRebootPending(err error) bool {
-	var exitErr *exec.ExitError
-	if !errors.As(err, &exitErr) {
-		return false
-	}
-
-	switch exitErr.ExitCode() {
-	case msiRebootRequired, msiRebootInitiated:
-		return true
-	default:
-		return false
-	}
-}
-
-// killUI terminates any running netbird-ui process and returns the IDs of the
-// interactive sessions the terminated processes belonged to. Setup starts the
-// UI again in those sessions once the installer is done.
-func killUI() []uint32 {
-	pids, err := processIDsByName(uiName)
-	if err != nil {
-		log.Warnf("failed to look up %s processes: %v", uiName, err)
-		return nil
-	}
-
-	sessions := make(map[uint32]struct{})
-	for _, pid := range pids {
-		var sessionID uint32
-		if err := windows.ProcessIdToSessionId(pid, &sessionID); err != nil {
-			log.Warnf("failed to look up session of %s (PID %d): %v", uiName, pid, err)
-		}
-
-		if err := terminateProcess(pid); err != nil {
-			log.Warnf("failed to terminate %s (PID %d): %v", uiName, pid, err)
-			continue
-		}
-		log.Infof("terminated %s (PID %d) in session %d", uiName, pid, sessionID)
-
-		if sessionID != 0 {
-			sessions[sessionID] = struct{}{}
-		}
-	}
-
-	sessionIDs := make([]uint32, 0, len(sessions))
-	for sessionID := range sessions {
-		sessionIDs = append(sessionIDs, sessionID)
-	}
-	return sessionIDs
-}
-
-func processIDsByName(name string) ([]uint32, error) {
-	snapshot, err := windows.CreateToolhelp32Snapshot(windows.TH32CS_SNAPPROCESS, 0)
-	if err != nil {
-		return nil, fmt.Errorf("create process snapshot: %w", err)
-	}
-	defer func() {
-		if err := windows.CloseHandle(snapshot); err != nil {
-			log.Warnf("failed to close process snapshot: %v", err)
-		}
-	}()
-
-	var entry windows.ProcessEntry32
-	entry.Size = uint32(unsafe.Sizeof(entry))
-
-	var pids []uint32
-	for err = windows.Process32First(snapshot, &entry); err == nil; err = windows.Process32Next(snapshot, &entry) {
-		if strings.EqualFold(windows.UTF16ToString(entry.ExeFile[:]), name) {
-			pids = append(pids, entry.ProcessID)
-		}
-	}
-	if !errors.Is(err, windows.ERROR_NO_MORE_FILES) {
-		return nil, fmt.Errorf("enumerate processes: %w", err)
-	}
-
-	return pids, nil
-}
-
-func terminateProcess(pid uint32) error {
-	handle, err := windows.OpenProcess(windows.PROCESS_TERMINATE|windows.SYNCHRONIZE, false, pid)
-	if err != nil {
-		// The process may have exited between enumeration and now.
-		if errors.Is(err, windows.ERROR_INVALID_PARAMETER) {
-			return nil
-		}
-		return fmt.Errorf("open process: %w", err)
-	}
-	defer func() {
-		if err := windows.CloseHandle(handle); err != nil {
-			log.Warnf("failed to close process handle: %v", err)
-		}
-	}()
-
-	if err := windows.TerminateProcess(handle, 0); err != nil {
-		return fmt.Errorf("terminate process: %w", err)
-	}
-
-	// Wait for the handle to signal so the image file is released before the
-	// installer tries to overwrite it. A timeout is reported through the returned
-	// event, not through err, which stays nil unless the wait itself failed.
-	event, err := windows.WaitForSingleObject(handle, uint32(processExitWait.Milliseconds()))
-	if err != nil {
-		return fmt.Errorf("wait for process exit: %w", err)
-	}
-	if event != windows.WAIT_OBJECT_0 {
-		return fmt.Errorf("wait for process exit: unexpected wait result %#x", event)
-	}
-
-	return nil
-}
-
-func startUIInSession(uiPath string, sessionID uint32) error {
 	// Get the user token for that session
 	var userToken windows.Token
 	err := windows.WTSQueryUserToken(sessionID, &userToken)
@@ -307,16 +158,6 @@ func startUIInSession(uiPath string, sessionID uint32) error {
 		}
 	}()
 
-	var env *uint16
-	if err := windows.CreateEnvironmentBlock(&env, primaryToken, false); err != nil {
-		return fmt.Errorf("create environment block: %w", err)
-	}
-	defer func() {
-		if err := windows.DestroyEnvironmentBlock(env); err != nil {
-			log.Warnf("failed to destroy environment block: %v", err)
-		}
-	}()
-
 	// Prepare startup info
 	var si windows.StartupInfo
 	si.Cb = uint32(unsafe.Sizeof(si))
@@ -339,7 +180,7 @@ func startUIInSession(uiPath string, sessionID uint32) error {
 		nil,
 		false,
 		creationFlags,
-		env,
+		nil,
 		nil,
 		&si,
 		&pi,
@@ -356,6 +197,7 @@ func startUIInSession(uiPath string, sessionID uint32) error {
 		log.Warnf("failed to close thread handle: %v", err)
 	}
 
+	log.Infof("netbird-ui started successfully in session %d", sessionID)
 	return nil
 }
 

client/internal/updater/installer/installer_run_windows_test.go

@@ -1,108 +0,0 @@
-package installer
-
-import (
-	"errors"
-	"os/exec"
-	"slices"
-	"strconv"
-	"testing"
-)
-
-// exitErrorWithCode returns a real *exec.ExitError carrying the given exit code.
-func exitErrorWithCode(t *testing.T, code int) error {
-	t.Helper()
-
-	err := exec.Command("cmd.exe", "/c", "exit "+strconv.Itoa(code)).Run()
-	if err == nil {
-		t.Fatalf("expected a non-zero exit for code %d", code)
-	}
-	return err
-}
-
-func TestIsRebootPending(t *testing.T) {
-	tests := []struct {
-		name string
-		code int
-		want bool
-	}{
-		{name: "reboot required", code: msiRebootRequired, want: true},
-		{name: "reboot initiated", code: msiRebootInitiated, want: true},
-		{name: "generic failure", code: 1603, want: false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := isRebootPending(exitErrorWithCode(t, tt.code)); got != tt.want {
-				t.Errorf("isRebootPending(exit %d) = %v, want %v", tt.code, got, tt.want)
-			}
-		})
-	}
-}
-
-// TestProcessIDsByNameAndTerminate spawns a long-running system process, finds it
-// by name and terminates it, covering the path the updater uses to release the UI
-// image file before the installer replaces it.
-func TestProcessIDsByNameAndTerminate(t *testing.T) {
-	cmd := exec.Command("ping.exe", "-n", "60", "127.0.0.1")
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start ping: %v", err)
-	}
-
-	pid := uint32(cmd.Process.Pid)
-	killed := false
-	t.Cleanup(func() {
-		if !killed {
-			_ = cmd.Process.Kill()
-		}
-		_ = cmd.Wait()
-	})
-
-	// Name matching must be case-insensitive: the snapshot reports PING.EXE.
-	pids, err := processIDsByName("ping.exe")
-	if err != nil {
-		t.Fatalf("processIDsByName: %v", err)
-	}
-
-	if !slices.Contains(pids, pid) {
-		t.Fatalf("PID %d not among the ping.exe processes found: %v", pid, pids)
-	}
-
-	if err := terminateProcess(pid); err != nil {
-		t.Fatalf("terminateProcess: %v", err)
-	}
-	killed = true
-
-	// terminateProcess only returns once the handle has signalled, so the process
-	// is already gone and Wait must not block. It exits with the code passed to
-	// TerminateProcess, which is 0, so Wait reports no error.
-	if err := cmd.Wait(); err != nil {
-		t.Fatalf("wait for terminated ping: %v", err)
-	}
-	if !cmd.ProcessState.Exited() {
-		t.Error("process did not exit after terminateProcess")
-	}
-
-	remaining, err := processIDsByName("ping.exe")
-	if err != nil {
-		t.Fatalf("processIDsByName after terminate: %v", err)
-	}
-	if slices.Contains(remaining, pid) {
-		t.Errorf("PID %d still listed after terminateProcess", pid)
-	}
-}
-
-func TestProcessIDsByNameNoMatch(t *testing.T) {
-	pids, err := processIDsByName("netbird-nonexistent-process.exe")
-	if err != nil {
-		t.Fatalf("processIDsByName: %v", err)
-	}
-	if len(pids) != 0 {
-		t.Errorf("expected no matches, got %v", pids)
-	}
-}
-
-func TestIsRebootPendingNonExitError(t *testing.T) {
-	if isRebootPending(errors.New("start installer: file not found")) {
-		t.Error("a non-exit error must not be treated as a pending reboot")
-	}
-}

client/internal/updater/installer/result.go

@@ -54,12 +54,6 @@ func (rh *ResultHandler) GetErrorResultReason() string {
 	return ""
 }
 
-// ClearStaleResult removes a result file left over from a previous installation
-// attempt so result watchers cannot read an outdated outcome for the current attempt.
-func (rh *ResultHandler) ClearStaleResult() error {
-	return rh.cleanup()
-}
-
 func (rh *ResultHandler) WriteSuccess() error {
 	result := Result{
 		Success:    true,

client/internal/updater/manager.go

@@ -435,7 +435,7 @@ func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error
 	}
 
 	inst := installer.New()
-	if err := inst.RunInstallation(ctx, pendingVersion.String()); err != nil { //nolint:staticcheck // always errors on platforms without an installer
+	if err := inst.RunInstallation(ctx, pendingVersion.String()); err != nil {
 		log.Errorf("error triggering update: %v", err)
 		m.statusRecorder.PublishEvent(
 			cProto.SystemEvent_ERROR,

client/ios/NetBirdSDK/client.go

@@ -22,8 +22,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/netstate"
-	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -38,6 +36,11 @@ const (
 	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
 )
 
+// ConnectionListener export internal Listener for mobile
+type ConnectionListener interface {
+	peer.Listener
+}
+
 // RouteListener export internal RouteListener for mobile
 type NetworkChangeListener interface {
 	listener.NetworkChangeListener
@@ -84,12 +87,6 @@ type Client struct {
 	onHostDnsFn           func([]string)
 	dnsManager            dns.IosDnsManager
 	loginComplete         bool
-	// netState outlives engine restarts: it mirrors the OS connectivity, not
-	// the engine lifecycle. Run injects it into each new ConnectClient, which
-	// distributes it to every reconnection loop.
-	netState *netstate.State
-	// sweeper also outlives engine restarts; NotifyNetworkChange sweeps it.
-	sweeper *netsweep.Sweeper
 	// preloadedConfig holds config loaded from JSON (used on tvOS where file writes are blocked)
 	preloadedConfig *profilemanager.Config
 
@@ -112,8 +109,6 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
 		dnsManager:            dnsManager,
-		netState:              netstate.New(),
-		sweeper:               netsweep.New(),
 	}
 }
 
@@ -189,8 +184,7 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	c.onHostDnsFn = func([]string) {}
 	cfg.WgIface = interfaceName
 
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
 	c.setState(cfg, connectClient)
 	// Persist the latest sync response so DebugBundle can include the network
 	// map. On iOS this is backed by disk to keep it out of the constrained
@@ -199,25 +193,6 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	return connectClient.RunOniOS(fd, c.networkChangeListener, c.dnsManager, c.stateFile, c.cacheDir, c.logFilePath)
 }
 
-// SetNetworkAvailable feeds OS-reported network availability into the client
-// (e.g. from NWPathMonitor). While unavailable, the internal reconnect loops
-// suspend their attempts and the connection listener reports NoNetwork
-// instead of Connecting; when availability returns, the loops resume
-// immediately with a fresh backoff.
-func (c *Client) SetNetworkAvailable(available bool) {
-	c.netState.Set(available)
-	c.recorder.SetNetworkAvailable(available)
-}
-
-// NotifyNetworkChange marks the management, signal and relay connections
-// stale after the OS switched networks and schedules a sweep that cuts
-// whatever has not redialed on the new network by then. The engine and the
-// TUN device stay untouched.
-func (c *Client) NotifyNetworkChange() {
-	c.sweeper.MarkNetworkChange()
-	log.Infof("network change: connections marked stale")
-}
-
 // Stop the internal client and free the resources
 func (c *Client) Stop() {
 	c.ctxCancelLock.Lock()
@@ -356,11 +331,7 @@ func (c *Client) GetStatusDetails() *StatusDetails {
 
 // SetConnectionListener set the network connection listener
 func (c *Client) SetConnectionListener(listener ConnectionListener) {
-	if listener == nil {
-		c.recorder.RemoveConnectionListener()
-		return
-	}
-	c.recorder.SetConnectionListener(connectionListenerAdapter{listener})
+	c.recorder.SetConnectionListener(listener)
 }
 
 // RemoveConnectionListener remove connection listener

client/ios/NetBirdSDK/connection_listener.go

@@ -1,43 +0,0 @@
-//go:build ios
-
-package NetBirdSDK
-
-import (
-	"github.com/netbirdio/netbird/client/internal/peer"
-)
-
-// Client state values, re-exported as basic constants so gomobile emits them
-// into the generated bindings. They mirror peer.ClientState*: append-only,
-// never reorder.
-const (
-	ClientStateDisconnected  = int(peer.ClientStateDisconnected)
-	ClientStateConnected     = int(peer.ClientStateConnected)
-	ClientStateConnecting    = int(peer.ClientStateConnecting)
-	ClientStateDisconnecting = int(peer.ClientStateDisconnecting)
-	ClientStateNoNetwork     = int(peer.ClientStateNoNetwork)
-)
-
-// ConnectionListener export internal Listener for mobile.
-//
-// It intentionally lacks OnStateChanged for now: adding a method to a gomobile
-// interface breaks every Swift implementation, so the iOS app keeps building
-// against the legacy per-state callbacks. A follow-up will extend it together
-// with the app.
-type ConnectionListener interface {
-	OnConnected()
-	OnDisconnected()
-	OnConnecting()
-	OnDisconnecting()
-	OnAddressChanged(string, string)
-	OnPeersListChanged(int)
-}
-
-// connectionListenerAdapter adapts the gomobile-facing ConnectionListener to
-// peer.Listener.
-type connectionListenerAdapter struct {
-	ConnectionListener
-}
-
-// OnStateChanged is dropped on iOS until the app adopts the state callback;
-// the legacy per-state callbacks continue to fire.
-func (a connectionListenerAdapter) OnStateChanged(peer.ClientState) {}

client/ios/NetBirdSDK/login.go

@@ -323,7 +323,7 @@ func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName strin
 const authInfoRequestTimeout = 30 * time.Second
 
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, forceDeviceAuth bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth, "")
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}

client/netstate/netstate.go

@@ -1,110 +0,0 @@
-// Package netstate tracks OS-reported network availability for the client.
-//
-// A State instance is owned by the platform integration (e.g. the Android or
-// iOS bindings, fed from ConnectivityManager callbacks or NWPathMonitor) and
-// is injected into the connection retry loops (management, signal, relay,
-// peer guards and the top-level connect loop), which consult it to avoid
-// burning CPU and battery on reconnect attempts while the device has no
-// network at all (e.g. airplane mode), and to reset their backoff as soon as
-// the network returns.
-//
-// Consumers hold a *State that may be nil — every non-mobile platform leaves
-// it unset. The read methods are safe on a nil receiver: they report online
-// and never block, so consumers behave as if this package did not exist.
-package netstate
-
-import (
-	"context"
-	"sync"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// State holds the OS-reported network availability. The zero value is not
-// usable; create instances with New.
-type State struct {
-	mu      sync.Mutex
-	online  bool
-	changed chan struct{}
-}
-
-// New creates a State that starts online. Platforms without network tracking
-// pass a nil *State instead: the read methods treat nil as always online and
-// never block, so consumers need no nil guards.
-func New() *State {
-	return &State{
-		online:  true,
-		changed: make(chan struct{}),
-	}
-}
-
-// Set records whether the OS reports any usable network. Transitions wake up
-// all Wait callers immediately. Unlike the read methods, Set is not nil-safe:
-// it is only for the platform owner that created the State with New.
-func (s *State) Set(online bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if s.online == online {
-		return
-	}
-	s.online = online
-	close(s.changed)
-	s.changed = make(chan struct{})
-	log.Infof("OS network availability changed: online=%t", online)
-}
-
-// IsOnline reports whether the OS reports at least one usable network. On a
-// nil receiver — no State injected — it reports online.
-func (s *State) IsOnline() bool {
-	if s == nil {
-		return true
-	}
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.online
-}
-
-// Changed returns a channel closed on the next availability transition, for
-// callers that already own a select loop and cannot block in Wait. Re-read it
-// after every fire: each transition installs a fresh channel. On a nil
-// receiver — no State injected — it returns nil, which blocks forever in a
-// select, so the caller simply never observes a transition.
-func (s *State) Changed() <-chan struct{} {
-	if s == nil {
-		return nil
-	}
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.changed
-}
-
-// Wait blocks while the network is offline. It reports whether it had to
-// wait, so callers can reset their backoff after an outage. It returns early
-// with the context error when ctx is done. On a nil receiver — no State
-// injected — it returns immediately.
-func (s *State) Wait(ctx context.Context) (bool, error) {
-	if s == nil {
-		return false, nil
-	}
-	waited := false
-	for {
-		s.mu.Lock()
-		if s.online {
-			s.mu.Unlock()
-			return waited, nil
-		}
-		ch := s.changed
-		s.mu.Unlock()
-
-		if !waited {
-			waited = true
-			log.Debugf("network is offline, pausing connection attempts")
-		}
-
-		select {
-		case <-ctx.Done():
-			return waited, ctx.Err()
-		case <-ch:
-		}
-	}
-}

client/netstate/netstate_test.go

@@ -1,170 +0,0 @@
-package netstate
-
-import (
-	"context"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewStateIsOnline(t *testing.T) {
-	assert.True(t, New().IsOnline(), "a fresh State should start online")
-}
-
-func TestSetTogglesOnlineState(t *testing.T) {
-	s := New()
-
-	s.Set(false)
-	assert.False(t, s.IsOnline(), "state should be offline after Set(false)")
-
-	s.Set(true)
-	assert.True(t, s.IsOnline(), "state should be online after Set(true)")
-}
-
-func TestWaitReturnsImmediatelyWhenOnline(t *testing.T) {
-	s := New()
-
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-
-	waited, err := s.Wait(ctx)
-	require.NoError(t, err)
-	assert.False(t, waited, "Wait should not block when the network is online")
-}
-
-func TestWaitBlocksUntilOnline(t *testing.T) {
-	s := New()
-	s.Set(false)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	result := make(chan bool, 1)
-	go func() {
-		waited, err := s.Wait(ctx)
-		if err != nil {
-			result <- false
-			return
-		}
-		result <- waited
-	}()
-
-	// Verify Wait is actually blocking while offline
-	select {
-	case <-result:
-		t.Fatal("Wait should block while the network is offline")
-	case <-time.After(100 * time.Millisecond):
-	}
-
-	s.Set(true)
-
-	select {
-	case waited := <-result:
-		assert.True(t, waited, "Wait should report that it had to wait for the network")
-	case <-time.After(2 * time.Second):
-		t.Fatal("Wait should return promptly after the network becomes available")
-	}
-}
-
-func TestWaitReturnsOnContextCancel(t *testing.T) {
-	s := New()
-	s.Set(false)
-
-	ctx, cancel := context.WithCancel(context.Background())
-
-	result := make(chan error, 1)
-	go func() {
-		_, err := s.Wait(ctx)
-		result <- err
-	}()
-
-	cancel()
-
-	select {
-	case err := <-result:
-		assert.ErrorIs(t, err, context.Canceled)
-	case <-time.After(2 * time.Second):
-		t.Fatal("Wait should return promptly after context cancellation")
-	}
-}
-
-func TestWaitWakesAllWaiters(t *testing.T) {
-	s := New()
-	s.Set(false)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	const waiters = 10
-	var wg sync.WaitGroup
-	results := make(chan bool, waiters)
-	for i := 0; i < waiters; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			waited, err := s.Wait(ctx)
-			if err != nil {
-				results <- false
-				return
-			}
-			results <- waited
-		}()
-	}
-
-	time.Sleep(100 * time.Millisecond)
-	s.Set(true)
-	wg.Wait()
-
-	close(results)
-	count := 0
-	for waited := range results {
-		assert.True(t, waited, "every waiter should report that it waited")
-		count++
-	}
-	assert.Equal(t, waiters, count, "all waiters should have returned")
-}
-
-func TestNilStateReadsAreNoops(t *testing.T) {
-	var s *State
-
-	assert.True(t, s.IsOnline(), "nil State should report online")
-
-	waited, err := s.Wait(context.Background())
-	require.NoError(t, err)
-	assert.False(t, waited, "nil State's Wait should not block")
-}
-
-func TestConcurrentSetAndWait(t *testing.T) {
-	s := New()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	var wg sync.WaitGroup
-	for i := 0; i < 4; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for j := 0; j < 100; j++ {
-				s.Set(j%2 == 0)
-				s.IsOnline()
-			}
-		}()
-	}
-	for i := 0; i < 4; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for j := 0; j < 100; j++ {
-				if _, err := s.Wait(ctx); err != nil {
-					return
-				}
-			}
-		}()
-	}
-
-	wg.Wait()
-}

client/netsweep/netsweep.go

@@ -1,267 +0,0 @@
-// Package netsweep cuts network-bound activity when the OS switches networks:
-// a sweep closes the registered connections and aborts the in-flight dials, so
-// their owners redial immediately instead of waiting for the old sockets to
-// time out.
-//
-// A nil *Sweeper disables everything: all methods are nil-safe no-ops.
-package netsweep
-
-import (
-	"context"
-	"errors"
-	"net"
-	"sync"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/netstate"
-)
-
-// DefaultSweepDelay absorbs network flapping while the OS settles on a
-// default network before the stale registrations are cut.
-const DefaultSweepDelay = 500 * time.Millisecond
-
-const recentMarkWindow = 3 * time.Second
-
-// Config customizes a Sweeper. The zero value applies the defaults.
-type Config struct {
-	// SweepDelay overrides DefaultSweepDelay when positive.
-	SweepDelay time.Duration
-}
-
-// ErrSwept reports that a dial finished after a network change swept its
-// registration. The connection is already closed; the caller must treat it
-// as a failed dial and redial on the new network.
-var ErrSwept = errors.New("netsweep: connection swept by network change")
-
-// sweepID identifies one registration in a sweeper. Connections and dials
-// draw from the same counter, so an id is unique across both registries.
-type sweepID uint64
-
-type connEntry struct {
-	conn net.Conn
-	gen  uint64
-}
-
-// Dial tracks one dial from start to connection registration. It hands the
-// dialed connection to the sweeper atomically, so a sweep can never fall
-// between the dial finishing and the connection being registered.
-type Dial struct {
-	sweeper *Sweeper
-	ctx     context.Context
-	cancel  context.CancelFunc
-	id      sweepID
-	done    bool // set by a sweep, WrapConn or Release; guarded by sweeper.mu
-	gen     uint64
-}
-
-// Ctx returns the dial's context. A sweep cancels it, so a dial started on the
-// old network aborts instead of waiting out its handshake timeout.
-func (d *Dial) Ctx() context.Context {
-	return d.ctx
-}
-
-// Release ends the dial's registration and cancels its context. It is
-// idempotent and safe after WrapConn, so callers can defer it.
-func (d *Dial) Release() {
-	s := d.sweeper
-	if s == nil {
-		return
-	}
-
-	s.mu.Lock()
-	d.done = true
-	delete(s.dials, d.id)
-	s.mu.Unlock()
-
-	d.cancel()
-}
-
-// sweptConn deregisters itself from the sweeper when closed.
-type sweptConn struct {
-	net.Conn
-	sweeper *Sweeper
-	id      sweepID
-}
-
-func (c *sweptConn) Close() error {
-	c.sweeper.deregister(c.id)
-	return c.Conn.Close()
-}
-
-// Sweeper registers live connections and in-flight dials so the
-// network-change sweep can cut everything registered before the change.
-type Sweeper struct {
-	mu         sync.Mutex
-	conns      map[sweepID]connEntry
-	dials      map[sweepID]*Dial
-	nextID     sweepID
-	gen        uint64
-	timer      *time.Timer
-	sweepDelay time.Duration
-	lastMark   time.Time
-}
-
-// New creates an empty sweeper with the default configuration.
-func New() *Sweeper {
-	return NewWithConfig(Config{})
-}
-
-// NewWithConfig creates an empty sweeper customized by cfg.
-func NewWithConfig(cfg Config) *Sweeper {
-	delay := cfg.SweepDelay
-	if delay <= 0 {
-		delay = DefaultSweepDelay
-	}
-	return &Sweeper{
-		conns:      make(map[sweepID]connEntry),
-		dials:      make(map[sweepID]*Dial),
-		sweepDelay: delay,
-	}
-}
-
-// StartDial registers an in-flight dial. Dial with Ctx, hand the result to
-// WrapConn, and Release the dial when the attempt is over, typically deferred.
-func (s *Sweeper) StartDial(ctx context.Context) *Dial {
-	if s == nil {
-		return &Dial{ctx: ctx}
-	}
-
-	ctx, cancel := context.WithCancel(ctx)
-	d := &Dial{sweeper: s, ctx: ctx, cancel: cancel}
-
-	s.mu.Lock()
-	d.id = s.nextID
-	s.nextID++
-	d.gen = s.gen
-	s.dials[d.id] = d
-	s.mu.Unlock()
-
-	return d
-}
-
-// WrapConn hands conn over to the sweeper. If a sweep ran since StartDial,
-// the connection belongs to the old network: it is closed and ErrSwept is
-// returned. Otherwise conn is registered against the next sweep and returned
-// wrapped, deregistering itself on Close. Call it once, before Release.
-func (d *Dial) WrapConn(conn net.Conn) (net.Conn, error) {
-	s := d.sweeper
-	if s == nil {
-		return conn, nil
-	}
-
-	s.mu.Lock()
-	if d.done {
-		s.mu.Unlock()
-		if err := conn.Close(); err != nil {
-			log.Debugf("swept dial close error: %v", err)
-		}
-		return nil, ErrSwept
-	}
-	d.done = true
-	delete(s.dials, d.id)
-	id := s.nextID
-	s.nextID++
-	// The conn inherits the dial's generation: the socket was bound to the
-	// network that was default when the dial started, not when it finished.
-	s.conns[id] = connEntry{conn: conn, gen: d.gen}
-	s.mu.Unlock()
-
-	return &sweptConn{Conn: conn, sweeper: s, id: id}, nil
-}
-
-// MarkNetworkChange records that the OS switched networks: everything
-// registered so far becomes stale, and a sweep is (re)scheduled after the
-// configured delay to cut whatever is still stale by then. Owners that
-// redialed in the meantime hold fresh-generation registrations and survive,
-// so no cancellation is needed around the sweep.
-func (s *Sweeper) MarkNetworkChange() {
-	if s == nil {
-		return
-	}
-
-	s.mu.Lock()
-	s.gen++
-	cutoff := s.gen
-	s.lastMark = time.Now()
-	if s.timer != nil {
-		s.timer.Stop()
-	}
-	s.timer = time.AfterFunc(s.sweepDelay, func() {
-		n := s.sweep(cutoff)
-		log.Infof("network change sweep: closed %d stale connections", n)
-	})
-	s.mu.Unlock()
-}
-
-// QuickRetryBackoff wraps bo so that after each Reset the first retry comes
-// quickly when the disconnect followed a recent network change and the
-// network is online. Any other failure keeps bo's spread, so the clients of
-// a restarted server still scatter their reconnects. A nil sweeper returns
-// bo unchanged.
-func (s *Sweeper) QuickRetryBackoff(ctx context.Context, bo backoff.BackOff, netState *netstate.State) backoff.BackOff {
-	if s == nil {
-		return bo
-	}
-	return backoff.WithContext(newQuickRetryBackoff(bo, s, netState), ctx)
-}
-
-func (s *Sweeper) markedRecently() bool {
-	if s == nil {
-		return false
-	}
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return !s.lastMark.IsZero() && time.Since(s.lastMark) < recentMarkWindow
-}
-
-// sweep closes the registered connections and aborts the in-flight dials
-// older than cutoff, and returns how many connections it closed. A dial
-// whose connection was not yet handed to WrapConn is marked, so the late
-// WrapConn closes it instead of registering it.
-func (s *Sweeper) sweep(cutoff uint64) int {
-	if s == nil {
-		return 0
-	}
-
-	s.mu.Lock()
-	var conns []net.Conn
-	for id, e := range s.conns {
-		if e.gen < cutoff {
-			delete(s.conns, id)
-			conns = append(conns, e.conn)
-		}
-	}
-	var dials []*Dial
-	for id, d := range s.dials {
-		if d.gen < cutoff {
-			d.done = true
-			delete(s.dials, id)
-			dials = append(dials, d)
-		}
-	}
-	s.mu.Unlock()
-
-	if len(dials) > 0 {
-		log.Debugf("aborting %d in-flight dials", len(dials))
-		for _, d := range dials {
-			d.cancel()
-		}
-	}
-
-	for _, conn := range conns {
-		log.Debugf("sweeping connection %s -> %s", conn.LocalAddr(), conn.RemoteAddr())
-		if err := conn.Close(); err != nil {
-			log.Debugf("swept connection close error: %v", err)
-		}
-	}
-	return len(conns)
-}
-
-func (s *Sweeper) deregister(id sweepID) {
-	s.mu.Lock()
-	delete(s.conns, id)
-	s.mu.Unlock()
-}

client/netsweep/netsweep_test.go

@@ -1,241 +0,0 @@
-package netsweep
-
-import (
-	"context"
-	"math"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestSweepClosesRegisteredConns(t *testing.T) {
-	sweeper := New()
-
-	c1 := wrap(t, sweeper, connPair(t))
-	c2 := wrap(t, sweeper, connPair(t))
-
-	assert.Equal(t, 2, sweeper.sweepAll(), "both live connections should be closed")
-
-	// The wrappers must report closed now.
-	buf := make([]byte, 1)
-	_, err := c1.Read(buf)
-	assert.Error(t, err, "first connection should be unusable after the sweep")
-	_, err = c2.Read(buf)
-	assert.Error(t, err, "second connection should be unusable after the sweep")
-
-	assert.Equal(t, 0, sweeper.sweepAll(), "second sweep should find nothing")
-}
-
-func TestCloseDeregisters(t *testing.T) {
-	sweeper := New()
-
-	conn := wrap(t, sweeper, connPair(t))
-	require.NoError(t, conn.Close())
-
-	assert.Equal(t, 0, sweeper.sweepAll(), "closed connection must leave the registry")
-}
-
-func TestCloseIsIdempotent(t *testing.T) {
-	sweeper := New()
-
-	conn := wrap(t, sweeper, connPair(t))
-	require.NoError(t, conn.Close())
-	assert.Error(t, conn.Close(), "double close surfaces the underlying error but must not panic")
-}
-
-func TestSweepOnlyAffectsOlderConns(t *testing.T) {
-	sweeper := New()
-
-	_ = wrap(t, sweeper, connPair(t))
-	assert.Equal(t, 1, sweeper.sweepAll())
-
-	// A connection dialed after the sweep must survive until the next one.
-	_ = wrap(t, sweeper, connPair(t))
-	assert.Equal(t, 1, sweeper.sweepAll(), "post-sweep connection belongs to the next sweep")
-}
-
-func TestSweepAbortsInFlightDials(t *testing.T) {
-	sweeper := New()
-
-	dial := sweeper.StartDial(context.Background())
-	defer dial.Release()
-
-	sweeper.sweepAll()
-
-	assert.ErrorIs(t, dial.Ctx().Err(), context.Canceled, "sweep must cancel the in-flight dial context")
-}
-
-func TestReleasedDialIsNotAborted(t *testing.T) {
-	sweeper := New()
-
-	// Simulate a dial that finished before the sweep.
-	released := sweeper.StartDial(context.Background())
-	released.Release()
-
-	// A dial still in flight during the sweep.
-	pending := sweeper.StartDial(context.Background())
-	defer pending.Release()
-
-	sweeper.sweepAll()
-	assert.ErrorIs(t, pending.Ctx().Err(), context.Canceled, "pending dial must be aborted")
-}
-
-func TestSweepBetweenDialAndHandoffClosesConn(t *testing.T) {
-	sweeper := New()
-
-	dial := sweeper.StartDial(context.Background())
-	defer dial.Release()
-
-	// The dial succeeds on the old network, then the sweep lands before the
-	// connection is handed over.
-	conn := connPair(t)
-	assert.Equal(t, 0, sweeper.sweepAll(), "the connection is not registered yet")
-
-	wrapped, err := dial.WrapConn(conn)
-	require.ErrorIs(t, err, ErrSwept)
-	require.Nil(t, wrapped)
-
-	buf := make([]byte, 1)
-	_, err = conn.Read(buf)
-	assert.Error(t, err, "the old-network connection must be closed, not leaked")
-
-	assert.Equal(t, 0, sweeper.sweepAll(), "nothing may leak into the next sweep")
-}
-
-func TestMarkNetworkChangeSparesFreshConns(t *testing.T) {
-	sweeper := NewWithConfig(Config{SweepDelay: 10 * time.Millisecond})
-
-	stale := wrap(t, sweeper, connPair(t))
-	sweeper.MarkNetworkChange()
-	_ = wrap(t, sweeper, connPair(t))
-
-	_ = stale.SetReadDeadline(time.Now().Add(time.Second))
-	buf := make([]byte, 1)
-	_, err := stale.Read(buf)
-	require.ErrorIs(t, err, net.ErrClosed, "stale connection must be closed by the delayed sweep")
-
-	assert.Equal(t, 1, sweeper.sweepAll(), "the fresh connection must survive the stale sweep")
-}
-
-func TestMarkNetworkChangeAbortsStaleDials(t *testing.T) {
-	sweeper := NewWithConfig(Config{SweepDelay: 10 * time.Millisecond})
-
-	stale := sweeper.StartDial(context.Background())
-	defer stale.Release()
-	sweeper.MarkNetworkChange()
-	fresh := sweeper.StartDial(context.Background())
-	defer fresh.Release()
-
-	assert.Eventually(t, func() bool {
-		return stale.Ctx().Err() != nil
-	}, time.Second, 5*time.Millisecond, "stale dial must be aborted by the delayed sweep")
-	assert.NoError(t, fresh.Ctx().Err(), "post-mark dial must not be aborted")
-}
-
-func TestConnInheritsDialGeneration(t *testing.T) {
-	sweeper := NewWithConfig(Config{SweepDelay: 20 * time.Millisecond})
-
-	// The dial starts before the network change but completes after it: the
-	// socket is bound to the old network, so the sweep must still cut it.
-	dial := sweeper.StartDial(context.Background())
-	defer dial.Release()
-	sweeper.MarkNetworkChange()
-
-	wrapped, err := dial.WrapConn(connPair(t))
-	require.NoError(t, err)
-
-	_ = wrapped.SetReadDeadline(time.Now().Add(time.Second))
-	buf := make([]byte, 1)
-	_, err = wrapped.Read(buf)
-	require.ErrorIs(t, err, net.ErrClosed, "old-generation connection must be swept")
-}
-
-func TestRepeatedMarksCoalesce(t *testing.T) {
-	sweeper := NewWithConfig(Config{SweepDelay: 20 * time.Millisecond})
-
-	first := wrap(t, sweeper, connPair(t))
-	sweeper.MarkNetworkChange()
-	second := wrap(t, sweeper, connPair(t))
-	sweeper.MarkNetworkChange()
-	_ = wrap(t, sweeper, connPair(t))
-
-	buf := make([]byte, 1)
-	for _, conn := range []net.Conn{first, second} {
-		_ = conn.SetReadDeadline(time.Now().Add(time.Second))
-		_, err := conn.Read(buf)
-		require.ErrorIs(t, err, net.ErrClosed, "every pre-mark connection must be swept by the rescheduled sweep")
-	}
-	assert.Equal(t, 1, sweeper.sweepAll(), "only the newest-generation connection may remain")
-}
-
-func TestNilSweeperIsNoop(t *testing.T) {
-	var sweeper *Sweeper
-
-	conn := connPair(t)
-	dial := sweeper.StartDial(context.Background())
-	defer dial.Release()
-
-	wrapped, err := dial.WrapConn(conn)
-	require.NoError(t, err)
-	assert.Equal(t, conn, wrapped, "nil sweeper must return the conn unchanged")
-	assert.NoError(t, dial.Ctx().Err(), "nil sweeper must not cancel the dial context")
-	assert.Equal(t, 0, sweeper.sweepAll(), "nil sweeper closes nothing")
-}
-
-// wrap registers conn with the sweeper through a completed dial.
-func wrap(t *testing.T, sweeper *Sweeper, conn net.Conn) net.Conn {
-	t.Helper()
-
-	dial := sweeper.StartDial(context.Background())
-	defer dial.Release()
-
-	wrapped, err := dial.WrapConn(conn)
-	require.NoError(t, err)
-	return wrapped
-}
-
-// connPair dials a loopback TCP connection and keeps the accepted peer open
-// until the test ends: a peer that closed early would make the connection
-// unreadable on its own, so a read error after the sweep would prove nothing.
-func connPair(t *testing.T) net.Conn {
-	t.Helper()
-
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		if err := l.Close(); err != nil {
-			t.Logf("listener close error: %v", err)
-		}
-	})
-
-	accepted := make(chan net.Conn, 1)
-	go func() {
-		conn, err := l.Accept()
-		if err != nil {
-			close(accepted)
-			return
-		}
-		accepted <- conn
-	}()
-
-	conn, err := net.Dial("tcp", l.Addr().String())
-	require.NoError(t, err)
-
-	peer, ok := <-accepted
-	require.True(t, ok, "listener must accept the dialed connection")
-	t.Cleanup(func() {
-		if err := peer.Close(); err != nil {
-			t.Logf("peer close error: %v", err)
-		}
-	})
-
-	return conn
-}
-
-// sweepAll cuts every registration regardless of generation.
-func (s *Sweeper) sweepAll() int {
-	return s.sweep(math.MaxUint64)
-}

client/netsweep/quick_retry.go

@@ -1,39 +0,0 @@
-package netsweep
-
-import (
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-
-	"github.com/netbirdio/netbird/client/netstate"
-)
-
-const quickRetryDelay = 200 * time.Millisecond
-
-type quickRetryBackoff struct {
-	backoff.BackOff
-	sweeper  *Sweeper
-	netState *netstate.State
-	used     bool
-}
-
-func newQuickRetryBackoff(bo backoff.BackOff, sweeper *Sweeper, netState *netstate.State) *quickRetryBackoff {
-	return &quickRetryBackoff{
-		BackOff:  bo,
-		sweeper:  sweeper,
-		netState: netState,
-	}
-}
-
-func (b *quickRetryBackoff) NextBackOff() time.Duration {
-	if !b.used && b.sweeper.markedRecently() && b.netState.IsOnline() {
-		b.used = true
-		return quickRetryDelay
-	}
-	return b.BackOff.NextBackOff()
-}
-
-func (b *quickRetryBackoff) Reset() {
-	b.used = false
-	b.BackOff.Reset()
-}

client/netsweep/quick_retry_test.go

@@ -1,58 +0,0 @@
-package netsweep
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestQuickRetryAfterRecentMark(t *testing.T) {
-	sweeper := New()
-	sweeper.MarkNetworkChange()
-
-	slow := backoff.NewConstantBackOff(5 * time.Second)
-	bo := sweeper.QuickRetryBackoff(context.Background(), slow, nil)
-
-	assert.Equal(t, quickRetryDelay, bo.NextBackOff(), "first retry after a mark must be quick")
-	assert.Equal(t, 5*time.Second, bo.NextBackOff(), "second retry must fall back to the wrapped backoff")
-
-	bo.Reset()
-	assert.Equal(t, quickRetryDelay, bo.NextBackOff(), "reset must re-arm the quick retry")
-}
-
-func TestQuickRetryWithoutMarkKeepsSpread(t *testing.T) {
-	sweeper := New()
-
-	slow := backoff.NewConstantBackOff(5 * time.Second)
-	bo := sweeper.QuickRetryBackoff(context.Background(), slow, nil)
-
-	assert.Equal(t, 5*time.Second, bo.NextBackOff(), "without a mark the wrapped backoff decides")
-
-	sweeper.mu.Lock()
-	sweeper.lastMark = time.Now().Add(-recentMarkWindow)
-	sweeper.mu.Unlock()
-	assert.Equal(t, 5*time.Second, bo.NextBackOff(), "a stale mark must not trigger the quick retry")
-}
-
-func TestQuickRetryNilSweeperPassthrough(t *testing.T) {
-	var sweeper *Sweeper
-
-	slow := backoff.NewConstantBackOff(5 * time.Second)
-	bo := sweeper.QuickRetryBackoff(context.Background(), slow, nil)
-
-	assert.Equal(t, backoff.BackOff(slow), bo, "nil sweeper must return the backoff unchanged")
-}
-
-func TestQuickRetryHonorsContext(t *testing.T) {
-	sweeper := New()
-	sweeper.MarkNetworkChange()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	bo := sweeper.QuickRetryBackoff(ctx, backoff.NewConstantBackOff(time.Millisecond), nil)
-
-	assert.Equal(t, backoff.Stop, bo.NextBackOff(), "cancelled context must stop the retry loop")
-}

client/server/panic_windows.go

@@ -3,7 +3,6 @@
 package server
 
 import (
-	"errors"
 	"fmt"
 	"os"
 	"path"
@@ -70,7 +69,7 @@ func setStdHandle(f *os.File) error {
 	handle := f.Fd()
 	r0, _, e1 := setStdHandleFn.Call(stdErrorHandle, handle)
 	if r0 == 0 {
-		if !errors.Is(e1, syscall.Errno(0)) {
+		if e1 != nil {
 			return e1
 		}
 		return syscall.EINVAL

client/server/server_privileged_test.go

@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"go.uber.org/mock/gomock"
+	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"
 

client/ssh/client/client.go

@@ -313,23 +313,21 @@ func Dial(ctx context.Context, addr, user string, opts DialOptions) (*Client, er
 
 // dialSSH establishes an SSH connection without JWT authentication
 func dialSSH(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*Client, error) {
-	if config.Timeout > 0 {
-		var cancel context.CancelFunc
-		ctx, cancel = context.WithTimeout(ctx, config.Timeout)
-		defer cancel()
-	}
-
 	dialer := &net.Dialer{}
 	conn, err := dialer.DialContext(ctx, network, addr)
 	if err != nil {
 		return nil, fmt.Errorf("dial %s: %w", addr, err)
 	}
 
-	client, err := nbssh.Handshake(ctx, conn, addr, config)
+	clientConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
 	if err != nil {
-		return nil, err
+		if closeErr := conn.Close(); closeErr != nil {
+			log.Debugf("connection close after handshake failure: %v", closeErr)
+		}
+		return nil, fmt.Errorf("ssh handshake: %w", err)
 	}
 
+	client := ssh.NewClient(clientConn, chans, reqs)
 	return &Client{
 		client: client,
 	}, nil

client/ssh/client/terminal_unix.go

@@ -12,8 +12,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/term"
-
-	nbssh "github.com/netbirdio/netbird/client/ssh"
 )
 
 func (c *Client) setupTerminalMode(ctx context.Context, session *ssh.Session) error {
@@ -84,7 +82,37 @@ func (c *Client) setupTerminal(session *ssh.Session, fd int) error {
 		return fmt.Errorf("get terminal size: %w", err)
 	}
 
-	modes := nbssh.DefaultTerminalModes
+	modes := ssh.TerminalModes{
+		ssh.ECHO:          1,
+		ssh.TTY_OP_ISPEED: 14400,
+		ssh.TTY_OP_OSPEED: 14400,
+		// Ctrl+C
+		ssh.VINTR: 3,
+		// Ctrl+\
+		ssh.VQUIT: 28,
+		// Backspace
+		ssh.VERASE: 127,
+		// Ctrl+U
+		ssh.VKILL: 21,
+		// Ctrl+D
+		ssh.VEOF:  4,
+		ssh.VEOL:  0,
+		ssh.VEOL2: 0,
+		// Ctrl+Q
+		ssh.VSTART: 17,
+		// Ctrl+S
+		ssh.VSTOP: 19,
+		// Ctrl+Z
+		ssh.VSUSP: 26,
+		// Ctrl+O
+		ssh.VDISCARD: 15,
+		// Ctrl+R
+		ssh.VREPRINT: 18,
+		// Ctrl+W
+		ssh.VWERASE: 23,
+		// Ctrl+V
+		ssh.VLNEXT: 22,
+	}
 
 	terminal := os.Getenv("TERM")
 	if terminal == "" {

client/ssh/client/terminal_windows.go

@@ -10,8 +10,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/crypto/ssh"
-
-	nbssh "github.com/netbirdio/netbird/client/ssh"
 )
 
 const (
@@ -82,14 +80,28 @@ func (c *Client) setupTerminalMode(_ context.Context, session *ssh.Session) erro
 	w, h := c.getWindowsConsoleSize()
 
 	modes := ssh.TerminalModes{
-		ssh.ICRNL:  1,
-		ssh.OPOST:  1,
-		ssh.ONLCR:  1,
-		ssh.ISIG:   1,
-		ssh.ICANON: 1,
-	}
-	for mode, value := range nbssh.DefaultTerminalModes {
-		modes[mode] = value
+		ssh.ECHO:          1,
+		ssh.TTY_OP_ISPEED: 14400,
+		ssh.TTY_OP_OSPEED: 14400,
+		ssh.ICRNL:         1,
+		ssh.OPOST:         1,
+		ssh.ONLCR:         1,
+		ssh.ISIG:          1,
+		ssh.ICANON:        1,
+		ssh.VINTR:         3,   // Ctrl+C
+		ssh.VQUIT:         28,  // Ctrl+\
+		ssh.VERASE:        127, // Backspace
+		ssh.VKILL:         21,  // Ctrl+U
+		ssh.VEOF:          4,   // Ctrl+D
+		ssh.VEOL:          0,
+		ssh.VEOL2:         0,
+		ssh.VSTART:        17, // Ctrl+Q
+		ssh.VSTOP:         19, // Ctrl+S
+		ssh.VSUSP:         26, // Ctrl+Z
+		ssh.VDISCARD:      15, // Ctrl+O
+		ssh.VWERASE:       23, // Ctrl+W
+		ssh.VLNEXT:        22, // Ctrl+V
+		ssh.VREPRINT:      18, // Ctrl+R
 	}
 
 	if err := session.RequestPty("xterm-256color", h, w, modes); err != nil {

client/ssh/common.go

@@ -35,19 +35,6 @@ type HostKeyVerifier interface {
 	VerifySSHHostKey(peerAddress string, key []byte) error
 }
 
-// PeerKeyLookup returns the stored SSH host key for a peer address.
-type PeerKeyLookup func(peerAddress string) ([]byte, bool)
-
-// VerifySSHHostKey implements HostKeyVerifier by looking up the stored key
-// and comparing it against the presented key.
-func (l PeerKeyLookup) VerifySSHHostKey(peerAddress string, presentedKey []byte) error {
-	storedKey, found := l(peerAddress)
-	if !found {
-		return ErrPeerNotFound
-	}
-	return VerifyHostKey(storedKey, presentedKey, peerAddress)
-}
-
 // DaemonHostKeyVerifier implements HostKeyVerifier using the NetBird daemon
 type DaemonHostKeyVerifier struct {
 	client proto.DaemonServiceClient

client/ssh/handshake.go

@@ -1,45 +0,0 @@
-package ssh
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/crypto/ssh"
-)
-
-// Handshake runs the SSH client handshake on an already dialed conn and
-// returns the resulting client. Dialing bounds only the TCP establishment;
-// without a deadline on the socket a peer that accepts and then goes silent
-// blocks the handshake forever, so the context deadline is applied to conn
-// for the duration of the handshake. conn is closed on any error.
-func Handshake(ctx context.Context, conn net.Conn, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
-	if deadline, ok := ctx.Deadline(); ok {
-		if err := conn.SetDeadline(deadline); err != nil {
-			closeHandshake(conn, "conn after deadline error")
-			return nil, fmt.Errorf("set handshake deadline: %w", err)
-		}
-	}
-
-	sshConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
-	if err != nil {
-		closeHandshake(conn, "conn after handshake error")
-		return nil, fmt.Errorf("ssh handshake: %w", err)
-	}
-
-	if err := conn.SetDeadline(time.Time{}); err != nil {
-		closeHandshake(sshConn, "ssh conn after deadline clear error")
-		return nil, fmt.Errorf("clear handshake deadline: %w", err)
-	}
-
-	return ssh.NewClient(sshConn, chans, reqs), nil
-}
-
-func closeHandshake(c io.Closer, label string) {
-	if err := c.Close(); err != nil {
-		log.Debugf("ssh: close %s: %v", label, err)
-	}
-}

client/ssh/proxy/proxy.go

@@ -610,10 +610,13 @@ func (p *SSHProxy) dialBackend(ctx context.Context, addr, user, jwtToken string)
 		return nil, fmt.Errorf("connect to server: %w", err)
 	}
 
-	handshakeCtx, cancel := context.WithTimeout(ctx, sshHandshakeTimeout)
-	defer cancel()
+	clientConn, chans, reqs, err := cryptossh.NewClientConn(conn, addr, config)
+	if err != nil {
+		_ = conn.Close()
+		return nil, fmt.Errorf("SSH handshake: %w", err)
+	}
 
-	return nbssh.Handshake(handshakeCtx, conn, addr, config)
+	return cryptossh.NewClient(clientConn, chans, reqs), nil
 }
 
 func (p *SSHProxy) verifyHostKey(hostname string, remote net.Addr, key cryptossh.PublicKey) error {

client/ssh/server/command_execution.go

@@ -75,8 +75,8 @@ func (s *Server) createCommand(logger *log.Entry, privilegeResult PrivilegeCheck
 	}
 
 	// Try su first for system integration (PAM/audit) when privileged
-	cmd, err := s.createSuCommand(logger, session, localUser, hasPty) //nolint:staticcheck
-	if err != nil || privilegeResult.UsedFallback {                   //nolint:staticcheck // always errors on platforms without su
+	cmd, err := s.createSuCommand(logger, session, localUser, hasPty)
+	if err != nil || privilegeResult.UsedFallback {
 		logger.Debugf("su command failed, falling back to executor: %v", err)
 		cmd, cleanup, err := s.createExecutorCommand(logger, session, localUser, hasPty)
 		if err != nil {

client/ssh/session.go

@@ -1,84 +0,0 @@
-package ssh
-
-import (
-	"fmt"
-	"io"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/crypto/ssh"
-)
-
-// DefaultTerminalModes are the PTY modes used by the interactive terminal clients.
-var DefaultTerminalModes = ssh.TerminalModes{
-	ssh.ECHO:          1,
-	ssh.TTY_OP_ISPEED: 14400,
-	ssh.TTY_OP_OSPEED: 14400,
-	ssh.VINTR:         3,   // Ctrl+C
-	ssh.VQUIT:         28,  // Ctrl+\
-	ssh.VERASE:        127, // Backspace
-	ssh.VKILL:         21,  // Ctrl+U
-	ssh.VEOF:          4,   // Ctrl+D
-	ssh.VEOL:          0,
-	ssh.VEOL2:         0,
-	ssh.VSTART:        17, // Ctrl+Q
-	ssh.VSTOP:         19, // Ctrl+S
-	ssh.VSUSP:         26, // Ctrl+Z
-	ssh.VDISCARD:      15, // Ctrl+O
-	ssh.VREPRINT:      18, // Ctrl+R
-	ssh.VWERASE:       23, // Ctrl+W
-	ssh.VLNEXT:        22, // Ctrl+V
-}
-
-// PTYSession is an interactive shell session with a PTY and its I/O pipes.
-type PTYSession struct {
-	Session *ssh.Session
-	Stdin   io.WriteCloser
-	Stdout  io.Reader
-	Stderr  io.Reader
-}
-
-// StartPTYSession opens a session on the client, requests an xterm-256color PTY
-// with the default terminal modes, wires up the I/O pipes and starts a shell.
-// The session is closed on any error.
-func StartPTYSession(client *ssh.Client, cols, rows int) (*PTYSession, error) {
-	session, err := client.NewSession()
-	if err != nil {
-		return nil, fmt.Errorf("new session: %w", err)
-	}
-
-	pty, err := setupPTYSession(session, cols, rows)
-	if err != nil {
-		if closeErr := session.Close(); closeErr != nil {
-			log.Debugf("ssh: session close after setup error: %v", closeErr)
-		}
-		return nil, err
-	}
-	return pty, nil
-}
-
-// setupPTYSession requests the PTY, opens the pipes and starts the shell on an
-// already created session.
-func setupPTYSession(session *ssh.Session, cols, rows int) (*PTYSession, error) {
-	if err := session.RequestPty("xterm-256color", rows, cols, DefaultTerminalModes); err != nil {
-		return nil, fmt.Errorf("request pty: %w", err)
-	}
-
-	stdin, err := session.StdinPipe()
-	if err != nil {
-		return nil, fmt.Errorf("stdin pipe: %w", err)
-	}
-	stdout, err := session.StdoutPipe()
-	if err != nil {
-		return nil, fmt.Errorf("stdout pipe: %w", err)
-	}
-	stderr, err := session.StderrPipe()
-	if err != nil {
-		return nil, fmt.Errorf("stderr pipe: %w", err)
-	}
-
-	if err := session.Shell(); err != nil {
-		return nil, fmt.Errorf("start shell: %w", err)
-	}
-
-	return &PTYSession{Session: session, Stdin: stdin, Stdout: stdout, Stderr: stderr}, nil
-}

client/system/info_android.go

@@ -30,11 +30,6 @@ func GetInfo(ctx context.Context) *Info {
 		kernelVersion = osInfo[2]
 	}
 
-	addrs, err := networkAddresses()
-	if err != nil {
-		log.Warnf("discover network addresses: %s", err)
-	}
-
 	gio := &Info{
 		GoOS:               runtime.GOOS,
 		Kernel:             kernel,
@@ -46,7 +41,6 @@ func GetInfo(ctx context.Context) *Info {
 		NetbirdVersion:     version.NetbirdVersion(),
 		UIVersion:          extractUIVersion(ctx),
 		KernelVersion:      kernelVersion,
-		NetworkAddresses:   addrs,
 		SystemSerialNumber: serial(),
 		SystemProductName:  productModel(),
 		SystemManufacturer: productManufacturer(),

client/system/network_addr.go

@@ -1,4 +1,4 @@
-//go:build !ios && !android
+//go:build !ios
 
 package system
 

client/system/network_addr_android.go

@@ -1,89 +0,0 @@
-package system
-
-import (
-	"net/netip"
-	"strings"
-)
-
-var iFaceDiscover IFaceDiscover
-
-type IFaceDiscover interface {
-	IFaces() (string, error)
-}
-
-// SetIFaceDiscover configures the Android interface discovery provider.
-func SetIFaceDiscover(discover IFaceDiscover) {
-	iFaceDiscover = discover
-}
-
-func networkAddresses() ([]NetworkAddress, error) {
-	if iFaceDiscover == nil {
-		return nil, nil
-	}
-	ifaces, err := iFaceDiscover.IFaces()
-	if err != nil {
-		return nil, err
-	}
-
-	var netAddresses []NetworkAddress
-	for _, line := range strings.Split(ifaces, "\n") {
-		addresses, ok := interfaceAddresses(line)
-		if !ok {
-			continue
-		}
-		for _, address := range addresses {
-			netAddr, ok := toNetworkAddress(address)
-			if !ok {
-				continue
-			}
-			if isDuplicated(netAddresses, netAddr) {
-				continue
-			}
-			netAddresses = append(netAddresses, netAddr)
-		}
-	}
-	return netAddresses, nil
-}
-
-func interfaceAddresses(line string) ([]string, bool) {
-	parts := strings.Split(line, "|")
-	if len(parts) != 2 {
-		return nil, false
-	}
-	flags := strings.Fields(parts[0])
-	if len(flags) != 8 {
-		return nil, false
-	}
-	up, loopback := flags[3], flags[5]
-	if up != "true" || loopback == "true" {
-		return nil, false
-	}
-	return strings.Fields(parts[1]), true
-}
-
-func toNetworkAddress(address string) (NetworkAddress, bool) {
-	prefix, err := netip.ParsePrefix(address)
-	if err != nil {
-		return NetworkAddress{}, false
-	}
-	if prefix.Addr().Is4In6() {
-		if prefix.Bits() < 96 {
-			return NetworkAddress{}, false
-		}
-		prefix = netip.PrefixFrom(prefix.Addr().Unmap(), prefix.Bits()-96)
-	}
-	ip := prefix.Addr()
-	if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsMulticast() {
-		return NetworkAddress{}, false
-	}
-	return NetworkAddress{NetIP: prefix}, true
-}
-
-func isDuplicated(addresses []NetworkAddress, addr NetworkAddress) bool {
-	for _, duplicated := range addresses {
-		if duplicated.NetIP == addr.NetIP {
-			return true
-		}
-	}
-	return false
-}

client/system/network_addr_test.go

@@ -1,4 +1,4 @@
-//go:build !ios && !android
+//go:build !ios
 
 package system
 

client/wasm/internal/ssh/client.go

@@ -80,12 +80,13 @@ func (c *Client) Connect(host string, port int, username, jwtToken string, ipVer
 		return fmt.Errorf("dial %s: %w", addr, err)
 	}
 
-	sshClient, err := nbssh.Handshake(ctx, conn, addr, config)
+	sshConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
 	if err != nil {
-		return err
+		closeWithLog(conn, "connection after handshake error")
+		return fmt.Errorf("SSH handshake: %w", err)
 	}
 
-	c.sshClient = sshClient
+	c.sshClient = ssh.NewClient(sshConn, chans, reqs)
 	logrus.Infof("SSH: Connected to %s", addr)
 
 	return nil
@@ -118,26 +119,57 @@ func (c *Client) getAuthMethods(jwtToken string) ([]ssh.AuthMethod, error) {
 	return []ssh.AuthMethod{ssh.PublicKeys(signer)}, nil
 }
 
-// StartSession starts an SSH session with PTY. It holds the client lock for
-// the whole startup so Close cannot tear the client down mid-setup and the
-// new session cannot be installed into an already closed client.
+// StartSession starts an SSH session with PTY
 func (c *Client) StartSession(cols, rows int) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
 	if c.sshClient == nil {
 		return fmt.Errorf("SSH client not connected")
 	}
 
-	pty, err := nbssh.StartPTYSession(c.sshClient, cols, rows)
+	session, err := c.sshClient.NewSession()
 	if err != nil {
-		return err
+		return fmt.Errorf("create session: %w", err)
 	}
 
-	c.session = pty.Session
-	c.stdin = pty.Stdin
-	c.stdout = pty.Stdout
-	c.stderr = pty.Stderr
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.session = session
+
+	modes := ssh.TerminalModes{
+		ssh.ECHO:          1,
+		ssh.TTY_OP_ISPEED: 14400,
+		ssh.TTY_OP_OSPEED: 14400,
+		ssh.VINTR:         3,
+		ssh.VQUIT:         28,
+		ssh.VERASE:        127,
+	}
+
+	if err := session.RequestPty("xterm-256color", rows, cols, modes); err != nil {
+		closeWithLog(session, "session after PTY error")
+		return fmt.Errorf("PTY request: %w", err)
+	}
+
+	c.stdin, err = session.StdinPipe()
+	if err != nil {
+		closeWithLog(session, "session after stdin error")
+		return fmt.Errorf("get stdin: %w", err)
+	}
+
+	c.stdout, err = session.StdoutPipe()
+	if err != nil {
+		closeWithLog(session, "session after stdout error")
+		return fmt.Errorf("get stdout: %w", err)
+	}
+
+	c.stderr, err = session.StderrPipe()
+	if err != nil {
+		closeWithLog(session, "session after stderr error")
+		return fmt.Errorf("get stderr: %w", err)
+	}
+
+	if err := session.Shell(); err != nil {
+		closeWithLog(session, "session after shell error")
+		return fmt.Errorf("start shell: %w", err)
+	}
 
 	logrus.Info("SSH: Session started with PTY")
 	return nil

docs/agent-networks/01-end-to-end-flows.md

@@ -115,7 +115,7 @@ sequenceDiagram
         Resp->>Resp: parse usage tokens, completion
         Note over Resp: capture_completion gates raw<br/>completion capture
         Resp->>Cost: tokens
-        Cost->>Cost: lookup rates from config-delivered<br/>pricing table + compute cost
+        Cost->>Cost: lookup pricing.yaml + compute cost
         Cost->>Rec: tokens + cost
         Rec->>MgmtGrpc: RecordLLMUsage(provider, model, prompt_t, completion_t, cost, groups, user)
         Rec-->>Log: emit access-log entry<br/>(if EnableLogCollection)

docs/agent-networks/modules/21-management-agentnetwork.md

@@ -15,10 +15,6 @@ Inside the package: `manager.go` is the CRUD + permissions-gated facade; `synthe
 | ---- | ---- |
 | `agentnetwork/manager.go` | Manager interface + CRUD + permission gates + bootstrap-settings + reconcile trigger |
 | `agentnetwork/synthesizer.go` | Settings/policy → wire-format synthesis; sole writer of the proxy middleware chain |
-| `agentnetwork/synthesizer_pricing.go` | `buildCostMeterConfigJSON` — default table + per-provider prices → `cost_meter` config |
-| `agentnetwork/pricing/defaults.go` | Default pricing table derived from the catalog + supplementals; `DefaultTable`, `LookupDefault`, wire `Entry` |
-| `agentnetwork/pricing/override.go` | `LoadFile`/`StartReloader` for `AgentNetwork.PricingDefaultsFile` (mtime poll, merge over compiled-in base) |
-| `agentnetwork/pricing/{exampleyaml,gen}.go` | Generates `defaults_llm_pricing.example.yaml` from the compiled-in table (golden-tested) |
 | `agentnetwork/policyselect.go` | Per-request policy attribution + account-budget ceiling (min-wins) |
 | `agentnetwork/reconcile.go` | Per-account synth diff vs in-memory cache → Create/Update/Delete |
 | `agentnetwork/catalog/catalog.go` | Static provider catalogue (auth headers, identity-injection shapes) |
@@ -52,8 +48,6 @@ flowchart TD
     I --> J[indexProviderGroups: providerID -> sorted source groups]
     J --> K[buildRouterConfigJSON drops orphan providers]
     J --> L[buildIdentityInjectConfigJSON per catalog entry]
-    J --> K2[buildCostMeterConfigJSON: default table + per-provider prices]
-    K2 --> P
     H --> M[mergeGuardrails: union allowlist, OR redact]
     M --> N[applyAccountCollectionControls account toggle = SOLE capture control]
     N --> O[marshalGuardrailConfig]
@@ -66,84 +60,6 @@ flowchart TD
     R --> T[accountManager.UpdateAccountPeers — fans synth ACLs into network map]
 ```
 
-### LLM pricing (management is the sole authority)
-
-**The proxy carries no price list.** Management synthesizes the entire pricing
-table and ships it inside `cost_meter`'s `ConfigJSON`, so a price change reaches
-the proxies as an ordinary mapping push — the chain rebuild installs a fresh
-table and there is nothing to reload on the proxy side.
-
-```mermaid
-flowchart TD
-    A[catalog.All — PricingSurfaces x Models] --> B[buildDefaultTable + supplementalDefaults]
-    B --> C{AgentNetwork.PricingDefaultsFile}
-    C -- absent --> D[compiled-in table serves]
-    C -- loaded --> E[LoadFile: merge file entries WHOLE over compiled base]
-    E --> F[mergedTable atomic.Pointer]
-    D --> G[DefaultTable]
-    F --> G
-    G --> H[buildCostMeterConfigJSON — pricing.defaults]
-    I[types.Provider.Models operator prices] --> J[normalizePricingModelID<br/>bedrock ARN/region/version, vertex @version]
-    J --> K[materializeEntry: default entry as base,<br/>operator input/output verbatim,<br/>cache pointers only when non-nil]
-    K --> L[pricing.providers keyed by provider record ID]
-    H --> M[cost_meter ConfigJSON]
-    L --> M
-    G --> N[GET /catalog — applyDefaultPricing prefills dashboard rows]
-    O[StartReloader: mtime poll every ReloadInterval 1m] --> E
-```
-
-**Two tiers, resolved per request on the proxy** (`synthesizer_pricing.go:22-35`):
-
-- `pricing.defaults` — surface (`openai`/`anthropic`/`bedrock`) → normalized model
-  id → rates. The **full** default table ships to every account: it is small
-  (~10 KB) and it is what keeps gateway-style providers (which enumerate no
-  models, so they claim every model) priced.
-- `pricing.providers` — provider **record** id → normalized model id → rates,
-  matched against the `llm.resolved_provider_id` the router stamps. Entries are
-  **fully materialized here**, at synth time: `materializeEntry` starts from the
-  default entry for that model so cache rates the operator didn't state are
-  inherited, overlays operator `input`/`output` verbatim (**including an explicit
-  0**, which prices a self-hosted or internal endpoint as free rather than
-  silently reverting to list price), and overlays cache-rate **pointers only when
-  non-nil** — `nil` means "inherit the default", an explicit `0` means "no
-  discount, bill this bucket at the input rate". The proxy therefore does two map
-  lookups and no merging.
-
-Same orphan rule as the router: a provider no enabled policy authorises is
-unreachable, so its prices aren't shipped. Model ids are normalized with the
-**same** functions the request parser uses (`NormalizeBedrockModel` /
-`NormalizeVertexModel`), which is what makes the per-record lookup key compare
-equal to the `llm.model` the proxy meters. Post-normalization duplicates resolve
-first-occurrence-wins, matching the routing dedup order.
-
-**`AgentNetwork.PricingDefaultsFile`** (`config.go:190-207`) lets an operator
-replace default rates without a rebuild. Schema is `surface → model → rates`
-(`input_per_1k`, `output_per_1k`, and optional `cached_input_per_1k` /
-`cache_read_per_1k` / `cache_creation_per_1k`). Semantics:
-
-- A **relative** path resolves against `<Datadir>`, so a bare filename lands
-  alongside the store. Empty config probes `<Datadir>/defaults_llm_pricing.yaml`.
-- An **explicitly configured** path is *required to load*: a typo or malformed
-  file fails startup, because the operator believes those rates are live. The
-  conventional probe is optional — an absent file just serves compiled-in
-  defaults, and the path stays watched in case it appears later.
-- File entries **replace** the compiled-in entry for the same (surface, model)
-  **whole** — they are not field-merged, so an entry must repeat the cache rates
-  it wants to keep. Everything the file doesn't mention keeps built-in rates.
-- Unknown YAML fields are rejected (`KnownFields(true)`) and every rate must be
-  finite and non-negative — the same constraints the HTTP API enforces on
-  operator per-provider prices.
-- Reload is an mtime poll (`ReloadInterval`, 1 min) and is **lenient at runtime**:
-  a parse error keeps the previous table, a deleted file reverts to compiled-in
-  defaults. A mid-edit save can never take pricing down.
-
-The live table feeds **both** consumers, which is what keeps them consistent: the
-synthesizer (what proxies actually bill with) and `GET /api/agent-network/catalog`
-via `applyDefaultPricing` (what the dashboard's model-row prices prefill with).
-`defaults_llm_pricing.example.yaml` is generated from the compiled-in table
-(`go generate ./management/internals/modules/agentnetwork/pricing`) and
-golden-tested, so operators start from a file matching the built-in rates exactly.
-
 ### Budget rule resolution (min-wins, group+user bound)
 
 ```mermaid
@@ -208,7 +124,7 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
   | on_request | 3 | `llm_identity_inject` | `{"providers":[{provider_id, header_pair?, json_metadata?, extra_headers?}]}` | **true** |
   | on_request | 4 | `llm_guardrail` | `{"provider_allowlists"?: {providerID: []model}, "prompt_capture":{enabled,redact_pii}}` | – |
   | on_response | 5 | `llm_limit_record` | `{}` (runs LAST at runtime) | – |
-  | on_response | 6 | `cost_meter` | `{"pricing":{"defaults":{surface:{model:rates}},"providers"?:{providerRecordID:{model:rates}}}}` — rates are `{input_per_1k, output_per_1k, cached_input_per_1k?, cache_read_per_1k?, cache_creation_per_1k?}` | – |
+  | on_response | 6 | `cost_meter` | `{}` | – |
   | on_response | 7 | `llm_response_parser` | `{"capture_completion": <bool>, "redact_pii"?: true}` | – |
 - **Synthesized service shape** (`synthesizer.go:739`): `Mode=HTTP`, `Private=true`, `Domain=<subdomain>.<cluster>`, `AccessGroups=unionSourceGroups(enabledPolicies)`, one `TargetTypeCluster` target with `Host=noop.invalid:443` (router rewrites per request), `Options.{DirectUpstream,AgentNetwork}=true`, `DisableAccessLog=!settings.EnableLogCollection`, `CaptureMax{Req,Resp}Bytes=1<<20`, `CaptureContentTypes=["application/json","text/event-stream"]`.
 
@@ -223,12 +139,6 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Orphan providers (no enabled policy authorises them) NEVER reach the router** (`synthesizer.go:351-357`); skipped from `identity_inject` for symmetry.
 - **Provider creation refuses empty `api_key`** (`manager.go:175`); **deletion refuses while any policy still references it** (`manager.go:265-273`).
 - **Session keypair stability across provider edits** (`manager.go:226-228`) — server-managed, copied through every `UpdateProvider`, never API-surfaced.
-- **Management is the sole pricing authority.** The proxy has no embedded price list, so an account whose `cost_meter` config carries no `pricing` block bills **nothing** (`cost.skipped=unknown_model`, $0) rather than falling back to stale built-ins. The top-level `pricing` wrapper is also the feature-detection signal in both directions: an old proxy ignores it as an unknown field, and a new proxy reads its absence as "old management".
-- **Per-provider prices are materialized at synth time, not merged on the proxy** (`synthesizer_pricing.go:114-131`). A per-record entry is always complete, so the proxy's lookup is per-record-then-defaults with no field-level fallback between tiers.
-- **An explicit operator price of `0` prices the model as free** — it must not be treated as "unset" and reverted to list price (`synthesizer_pricing.go:49-54`). Only *cache*-rate fields distinguish unset from zero, via `*float64`.
-- **Pricing model ids are normalized with the same functions the request parser uses** (`normalizePricingModelID`). If the two ever diverge, per-record prices silently stop matching and every request falls through to surface defaults.
-- **The default table's coverage is structural, not curated.** It is derived from the catalog via each provider's `PricingSurfaces`; `TestDefaultTable_CoversEveryCatalogModel` fails on an unpriced catalog model and `TestDefaultTable_NoConflictingContributions` fails if two providers contribute the same (surface, model) at different rates.
-- **A pricing-defaults file failure is fatal only at startup, and only for an explicitly configured path.** Runtime reload failures keep the previous table; a deleted file reverts to compiled-in defaults (`pricing/override.go:62-81, 113-148`).
 
 ## Things to scrutinize
 
@@ -266,12 +176,10 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Capture-pointer semantics (restated):** non-agent-network callers see no field → legacy nil-default emit, identical to pre-PR. Agent-network targets always carry an explicit `capture_*` value.
 - **`TestSynthesizeServices_HappyPath` was updated:** request-parser config moved from `{}` to `{"capture_prompt":false}` (`synthesizer_test.go:174`). External snapshot tests against synth output need updating.
 - **`MergedGuardrails` retains zeroed `TokenLimits`/`Budget`/`Retention`** even though `Policy.Limits` carries the real values now; `llm_limit_check` is the authoritative enforcement. Comment at `synthesizer.go:940-948` calls this out.
-- **`cost_meter`'s `pricing` block is version-skew-safe in both directions.** A proxy predating config-delivered pricing ignores the field as unknown JSON (it previously priced from its own embedded table, so it keeps billing — at its own rates, which is the skew to be aware of during a rolling upgrade). A current proxy paired with old management sees no `pricing` block, logs one warning at chain-build time, and records `cost.skipped=unknown_model` — token counting and cap enforcement are unaffected, only the USD annotation goes to $0.
 
 ### Performance
 
 - **`SynthesizeServices` runs on every controller tick / mutation reconcile.** Cost: 4 store reads + optional per-provider keypair backfill. Sort + index + merge are O(N log N) / O(P × G); dominant cost is JSON marshalling. No nested loops escape these dimensions.
-- **The full default pricing table is marshalled into every account's `cost_meter` config on every synth** (~10 KB serialized). This is a deliberate trade: it keeps gateway-style providers priced for every catalog model, and it is the largest single contributor to the synth JSON. `DefaultTable()` itself is a pointer load (or a `sync.Once`-built map) — the cost is the marshal, not the build.
 - **`reconcile.diffMappings` is O(N + M)** with N=M=1 per account today — effectively constant.
 - **`SynthesizeServicesForCluster`** (`synthesizer.go:71`) walks every account on a cluster; per-account failures are **swallowed** (`synthesizer.go:91-93`) so a single misconfigured account doesn't drop the cluster. Runs per proxy reconnect.
 
@@ -280,7 +188,6 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Activity codes:** `AgentNetwork{Provider,Policy,Guardrail,BudgetRule}{Created,Updated,Deleted}`; `AgentNetworkSettingsUpdated` with `log_collection/prompt_collection/redact_pii` payload (`manager.go:567-571`). **No activity code for `SelectPolicyForRequest` denies** — surfaced via proxy access log only (likely intentional given volume).
 - **Deny codes** namespaced: `llm_policy.{token,budget}_cap_exceeded`, `llm_account.{token,budget}_cap_exceeded` (`policyselect.go:18-26`).
 - **Reconcile failures are logged at warn and swallowed** (`reconcile.go:42-44`). Persistent synth failures (e.g. unknown catalog id) silently keep the proxy out of sync — consider a manager-level synth-health surface if this becomes a support burden.
-- **Pricing-file lifecycle logs at info** (load, reload, revert-to-built-ins) and **at warn** for a runtime reload failure; the mtime check itself is `Debugf`. There is no metric on reload failures, so an operator who breaks the file mid-flight keeps billing at the previous table with only a log line to show it (`pricing/override.go:113-148`).
 
 ## Test coverage
 
@@ -291,9 +198,6 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 | `synthesizer_guardrail_realstore_test.go` | `PromptCaptureAccountIsSoleControl`; `PromptCaptureFlowsWhenAccountOptsIn`; `AccountRedactWithoutGuardrailRedact`; `NoGuardrail_CaptureOff`. |
 | `synthesizer_log_collection_realstore_test.go` | `LogCollection{Off_SuppressesAccessLog,On_PermitsAccessLog}` — verifies `DisableAccessLog` propagation through `ToProtoMapping`. |
 | `synthesizer_parser_redact_realstore_test.go` | **Capture-pointer regression suite:** `ParserConfigsCarryRedactPii`; `ParserConfigsSuppressCaptureWhenLogCollectionOnly` (log=on/prompt=off ⇒ both capture flags false); `ParserConfigsOmitRedactPiiWhenOff`. |
-| `synthesizer_pricing_test.go` | `BuildCostMeterConfig_{BedrockModelNormalization,CacheRateNilVsZero,OrphanAndGatewayProviders}` — the per-record tier's three load-bearing rules: keys normalized like the parser's, `nil` cache pointer inherits vs explicit `0` bills at input rate, and orphan / gateway (empty `Models`) providers ship no per-record entry. |
-| `pricing/defaults_test.go` | `DefaultTable_{CoversEveryCatalogModel,NoConflictingContributions,AllRatesFiniteNonNegative,PinnedRates}`; `LookupDefault_SurfaceOrder`. Catalog-derived coverage + rate sanity are structural, not curated. |
-| `pricing/override_test.go` | `LoadFile_{MergesOverCompiledDefaults,MissingPath,RejectsInvalid}`; `Reload_LifeCycle` (mtime detect, parse error keeps previous, delete reverts to built-ins); `ExampleYAML_InSyncWithBuiltins` golden. |
 | `policyselect_test.go` | Mock-store: `NoApplicablePolicies`; `AllowWithLowestGroupAttribution`; `LargerPoolWinsAcrossUsageLevels`; `StaysOnLargerPoolAfterPartialDrain`; `FallsThroughToSmallerPoolWhenLargerExhausted`; `TiebreakBy{LargerGroupPool,CreatedAt}`; `DeniesWhenAllExhausted`; `UncappedPolicyAlwaysWinsAgainstCapped`; `DisabledPolicyIgnored`; `StoreErrorPropagates`; `RejectsEmptyAccount`; `SharesGroupCounterAcrossPolicies`; `AntiFallThroughOnLowestGroup`; `BudgetOnlyExhaustionDenies`; `BudgetTighterThanTokenWins`. |
 | `policyselect_realstore_test.go` | Real-sqlite regression guard: `NoApplicablePolicies`; `AllowAndLowestGroupAttribution`; `LargerPoolWins_FallsThroughWhenExhausted`; `BudgetCapDenies`; `GroupCounterSharedAcrossPolicies`; `DisabledPolicyIgnored`. |
 | `policyselect_account_realstore_test.go` | Account budget rules: `AccountCeilingBindsEvenWithUncappedPolicy` (min-wins); `AccountGroupCeiling`; `AccountTargetUsersBindsOnlyThatUser`; `AccountRuleRecordsToOwnWindow`. |

docs/agent-networks/modules/31-proxy-middleware-builtin.md

@@ -5,7 +5,7 @@ LLM request. The two highest-blast-radius areas are the **capture-pointer
 semantics** and the **limit_check ⇒ limit_record** record-once invariant.
 
 Sibling module: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — the SDK
-adapters + pricing table and cost formula this chain delegates to.
+adapters + pricing catalog this chain delegates to.
 
 ---
 
@@ -34,7 +34,7 @@ rewrites.
 | `llm_identity_inject` | OnRequest | `llm.{resolved_provider_id,authorising_groups}`, `Input.{UserEmail,UserID,UserGroups,UserGroupNames}` | none | header strip/inject + optional body rewrite |
 | `llm_guardrail` | OnRequest | `llm.{model,request_prompt_raw}` | `llm_policy.{decision,reason}`, `llm.request_prompt` | none (model allowlist deny) |
 | `llm_response_parser` | OnResponse | `llm.provider`, `Input.{RespHeaders,RespBody,Status}` | `llm.{input,output,total,cached_input,cache_creation}_tokens`, `llm.response_completion` | none |
-| `cost_meter` | OnResponse | `llm.{provider,model,resolved_provider_id}`, token buckets | `cost.usd_{input,cached_input,cache_creation,output,total,cache}` or `cost.skipped` | none (in-memory pricing lookup) |
+| `cost_meter` | OnResponse | `llm.{provider,model}`, token buckets | `cost.usd_total` or `cost.skipped` | pricing lookup |
 | `llm_limit_record` | OnResponse | `llm.{attribution_group_id,attribution_window_seconds,input_tokens,output_tokens}`, `cost.usd_total` | none | gRPC `RecordLLMUsage` |
 
 [all_test.go:26–40](../../../proxy/internal/middleware/builtin/all_test.go)
@@ -44,7 +44,7 @@ locks the ID set; adding or removing one is a conscious extension.
 
 | File | LOC | Notes |
 |---|---:|---|
-| `builtin.go` | 90 | Registry + `FactoryContext` (ctx, meter, logger, mgmt client) |
+| `builtin.go` | 86 | Registry + `FactoryContext` (ctx, data dir, meter, logger, mgmt client) |
 | `all_test.go` | 41 | Locks the 8-ID registry surface |
 | `agentnetwork_chain_integration_test.go` | 319 | Live sqlite + real gRPC bufconn; gate→recorder wire path |
 | `llm_request_parser/*` | 162 / 66 / 356 | Provider detection, body parse, prompt extraction with capture-pointer gating |
@@ -53,7 +53,7 @@ locks the ID set; adding or removing one is a conscious extension.
 | `llm_identity_inject/*` | 440 / 108 / 666 | HeaderPair (LiteLLM) + JSONMetadata (Portkey) + ExtraHeaders |
 | `llm_guardrail/*` | 176 / 82 / 75 / 219 / 217 | Model allowlist + optional prompt capture with PII redaction |
 | `llm_response_parser/*` | 258 / 222 / 43 / 433 / 169 / 111 | Buffered + SSE accumulation; AWS event-stream accumulator (`streaming_bedrock.go`) for Bedrock; capture-pointer gates completion emit |
-| `cost_meter/*` | 236 / 98 / 586 | Token → USD via `proxy/internal/llm/pricing`; both pricing tiers arrive in the middleware config |
+| `cost_meter/*` | 181 / 84 / 439 | Token → USD via `proxy/internal/llm/pricing` |
 | `llm_limit_record/*` | 144 / 35 / 191 | Post-flight `RecordLLMUsage` (5s, debug-on-error) |
 
 ## Per-middleware
@@ -168,46 +168,12 @@ token schema.
 
 ### cost_meter
 
-Reads `llm.provider` + `llm.model` + token buckets, looks up the per-1k rates,
-and emits the full `cost.usd_*` breakdown (four per-bucket values plus the
-`_total` and `_cache` aggregates) or a closed-set `cost.skipped` reason
-(`missing_provider/model/tokens`, `unparseable_tokens`, `zero_tokens`,
-`unknown_model`).
-
-**Management owns pricing.** The proxy carries no embedded price list: the whole
-table arrives in this middleware's `ConfigJSON` as
-`{pricing: {defaults, providers}}`, synthesized by management from the catalog
-plus the operator's stored per-provider prices
-([factory.go:13–34](../../../proxy/internal/middleware/builtin/cost_meter/factory.go)).
-Both tiers are validated by `pricing.NewTable` / `pricing.NewEntries` at
-construction, so a non-finite or negative rate fails the chain build. A price
-change is an ordinary mapping push — the chain rebuild yields a fresh instance
-over a fresh immutable table, so there is no data dir, no pricing file, no
-reload goroutine, and nothing to invalidate.
-
-**Two-tier lookup**
-([middleware.go:165–183](../../../proxy/internal/middleware/builtin/cost_meter/middleware.go)):
-
-1. **Per-provider-record** — the operator's stored price for the route that
-   actually served the request, keyed by the `llm.resolved_provider_id` that
-   `llm_router` stamped on the allow path, then by normalized model id. Entries
-   arrive fully materialized (management folds default cache rates in at synth
-   time), so there is no merging here. Absent metadata — no router in the chain
-   — skips this tier.
-2. **Surface defaults** — the catalog-derived table keyed by `llm.provider`
-   (`openai`/`anthropic`/`bedrock`). This is also what prices gateway-style
-   providers, which enumerate no models and therefore get no per-record entry.
-
-**Backward compatibility:** a config with no `pricing` block means management
-predates config-delivered pricing. The factory logs one warning at build time
-and the instance records `cost.skipped=unknown_model` ($0) for every request
-rather than falling back to a stale built-in price list
-([factory.go:55–60](../../../proxy/internal/middleware/builtin/cost_meter/factory.go)).
-
-**Key invariant:** the provider-shape switch lives in `pricing.EntryCosts`
-(sibling doc) and is selected by the **surface**, not by which tier the entry
-came from — `cost_meter` stays provider-agnostic, and a per-record override on
-an Anthropic route still bills its cache buckets additively.
+Reads `llm.provider` + `llm.model` + token buckets, looks up per-1k rate via
+`pricing.Loader`, emits `cost.usd_total` or a closed-set `cost.skipped`
+reason (`missing_provider/model/tokens`, `unparseable_tokens`, `zero_tokens`,
+`unknown_model`). Loader's hot-reload goroutine is bound to proxy-lifetime
+context via `startReloader`. **Key invariant:** provider-shape switch lives
+in `pricing.Table.Cost` (sibling doc) — `cost_meter` stays provider-agnostic.
 
 ### llm_limit_record
 
@@ -280,14 +246,12 @@ no mocks. Tests: `TestChain_AllowPath_StampsAttributionAndRecordsCounter`
 | `llm_identity_inject` | `{providers: [{provider_id, header_pair?|json_metadata?, extra_headers?}]}` |
 | `llm_guardrail` | `{provider_allowlists: {providerID: []string}, prompt_capture: {enabled, redact_pii}}` — allowlist keyed by resolved provider id; a provider absent from the map is unrestricted (fail-closed backstop; authoritative per-policy/group check is management's `CheckLLMPolicyLimits`) |
 | `llm_response_parser` | `{redact_pii?, capture_completion?: *bool}` |
-| `cost_meter` | `{pricing: {defaults: {surface: {model: rates}}, providers: {providerRecordID: {model: rates}}}}` — rates are `{input_per_1k, output_per_1k, cached_input_per_1k?, cache_read_per_1k?, cache_creation_per_1k?}`. A missing `pricing` key means "management predates config-delivered pricing": every request records `cost.skipped=unknown_model` |
+| `cost_meter` | `{pricing_path?}` (basename inside data-dir; defaults `pricing.yaml`) |
 | `llm_limit_record` | `{}` — same pattern as `llm_limit_check` |
 
 All factories accept empty / null / `{}` / whitespace as zero-value config;
 only structurally invalid JSON is rejected so misconfig surfaces at chain
-build time. `cost_meter` adds a semantic check on top of that: a `pricing`
-block carrying a negative or non-finite rate fails the build too, rather than
-mispricing live traffic.
+build time.
 
 ## Invariants
 
@@ -356,11 +320,10 @@ non-object `metadata` field
 — header path still attributes, but body-level tag-budget enforcement
 doesn't run for that request.
 
-**Concurrency.** `cost_meter`'s two pricing tables are built once from the
-middleware config and never mutated, so the lookup path needs no lock or atomic
-swap — a price change replaces the whole instance. Every middleware is
-otherwise a stateless value receiver. Integration test uses real bufconn gRPC —
-race detector is the meaningful bar.
+**Concurrency.** `cost_meter` shares a `pricing.Loader` via
+`atomic.Pointer[Table]`; readers always see a consistent table. Every
+middleware is a stateless value receiver. Integration test uses real bufconn
+gRPC — race detector is the meaningful bar.
 
 **Perf.** Hot path is `lookupKV` linear scan over <10 KVs; `cost_meter.Cost`
 is O(1); SSE accumulation is single-pass. No map allocation per call.
@@ -386,13 +349,13 @@ counter accuracy.
 | `llm_guardrail/redact_test.go` | 15 | Email, SSN, phone (E.164 + NA), bearer, IPv4; fixture-driven |
 | `llm_response_parser/middleware_test.go` | 18 | Buffered OAI+Anthro, capture-pointer, redact, truncation |
 | `llm_response_parser/streaming_test.go` | 7 | OAI usage frame, Anthro message_delta, truncated body best-effort |
-| `cost_meter/middleware_test.go` | 22 | Each skip reason, provider-shape formulas, config-delivered defaults, per-record-beats-defaults + miss-falls-back, per-record uses surface formula, nil-pricing skips everything, invalid-rate rejection |
+| `cost_meter/middleware_test.go` | 17 | Each skip reason, provider-shape, pricing loader integration |
 | `llm_limit_record/middleware_test.go` | 7 | Skip-on-no-signal, skip-on-missing-attribution, RPC failure swallowed |
 
 ## Cross-references
 
 - Sibling: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — SDK adapters
-  + SSE framer + pricing table and cost formula.
+  + SSE framer + pricing loader.
 - Path-routed providers (Vertex AI + Bedrock), `keyfile::` credential, GCP
   token minting, `/bedrock` prefix:
   [50-path-routed-providers.md](./50-path-routed-providers.md).

docs/agent-networks/modules/32-proxy-llm-parsers.md

@@ -9,7 +9,7 @@ pricing table's per-provider cost formula is the highest-leverage place a
 small bug would silently mis-bill operators.
 
 Sibling module: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
-— the 8 middlewares that consume this package's parsers + pricing table.
+— the 8 middlewares that consume this package's parsers + pricing loader.
 
 ---
 
@@ -24,9 +24,8 @@ proxy-framework dependencies:
 - `openai.go` / `anthropic.go` / `bedrock.go` — per-provider `Parser` impls.
 - `sse.go` — SSE scanner (`Scanner`, `Event`, `NewScanner`).
 - `errors.go` — sentinels callers branch on with `errors.Is`.
-- `pricing/` — immutable pricing table + the per-surface cost formula. The
-  rates themselves come from management inside `cost_meter`'s middleware
-  config; this package holds no price list and reads no files.
+- `pricing/` — embedded-default + hot-reload override table with
+  symlink-safe Unix loader (build-tagged stub elsewhere).
 - `fixtures/` — captured request/response/stream bodies the tests replay.
 
 The package carries zero proxy-framework dependencies so the same parsers can
@@ -48,9 +47,12 @@ be reused later by a WASM adapter
 | `sse_test.go` | 175 | 12 tests; fixture replay + multiline + size limits |
 | `parser_test.go` | 53 | `Parsers()`, `DetectParser`, provider enum values |
 | `errors.go` | 31 | 6 sentinels: `Err{Unknown,Unsupported}Provider/Model`, `Err{NotLLM,Malformed}Response`, `ErrStreamingUnsupported`, `ErrMalformedRequest` |
-| `pricing/pricing.go` | 234 | `Table`, `Entry`, `EntryJSON`, `Costs`; `NewTable`/`NewEntries` validation + `EntryCosts` formula. No I/O, no reload, no embedded rates |
-| `pricing/pricing_test.go` | 177 | 10 tests — provider-shape formulas, cached clamp, rate fallback, nil-safety, rate validation |
-| `fixtures/*` | 21–59 | OAI chat/responses/stream + Anthro messages/stream |
+| `pricing/pricing.go` | 421 | `Loader`, `Table`, `Entry`; embedded defaults + atomic swap + mtime reload |
+| `pricing/pricing_unix.go` | 69 | `O_NOFOLLOW` + fstat-from-FD + 1 MiB cap |
+| `pricing/pricing_other.go` | 21 | Stub returning "not supported on this platform" |
+| `pricing/pricing_test.go` | 432 | 21 tests — symlink rejection, reload race, path traversal, oversize |
+| `pricing/defaults_pricing.yaml` | 85 | go:embed source of truth |
+| `fixtures/*` | 21–59 | OAI chat/responses/stream + Anthro messages/stream + pricing starter |
 
 ## Request body → parser dispatch
 
@@ -186,11 +188,9 @@ response leg, covering both Bedrock body shapes:
   `totalTokens`). `firstNonZero` folds the two naming conventions into one
   `Usage`; when Converse omits `totalTokens` the parser sums the buckets.
 
-`ProviderName()` returns `"bedrock"` — its own pricing surface in the table
-management ships, keyed by the **normalised** model id (region prefix + version
-suffix stripped by the request parser; management normalises its keys the same
-way at synth time so the two compare equal). `ParseResponse` returns
-`ErrStreamingUnsupported` for an
+`ProviderName()` returns `"bedrock"` — its own `defaults_pricing.yaml` block,
+keyed by the **normalised** model id (region prefix + version suffix stripped by
+the request parser). `ParseResponse` returns `ErrStreamingUnsupported` for an
 AWS binary event-stream content-type (`application/vnd.amazon.eventstream`,
 `isAWSEventStream`) so the caller routes to the streaming accumulator instead.
 
@@ -205,34 +205,11 @@ response body. Streaming accumulators live in the middleware package
 ([llm_response_parser/streaming.go](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go))
 but use `llm.NewScanner` so the framing contract stays here.
 
-### Pricing table
+### Pricing catalog
 
-**Management is the sole pricing authority.** The proxy carries no embedded
-price list and reads no pricing file: the whole table arrives inside
-`cost_meter`'s `ConfigJSON` on the ordinary mapping push, and a price change
-is just another push — the chain rebuild constructs a fresh `Table`, so there
-is nothing to reload
-([pricing.go:1–7](../../../proxy/internal/llm/pricing/pricing.go)). The
-management side of the contract (catalog defaults, the operator's stored
-per-provider prices, and `AgentNetwork.PricingDefaultsFile`) is covered in the
-management-side module guide; `cost_meter`'s wire shape is in
-[31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md).
-
-`EntryJSON`
-([pricing.go:36–45](../../../proxy/internal/llm/pricing/pricing.go)) is the
-management→proxy contract — five USD-per-1k rates under `input_per_1k`,
-`output_per_1k`, `cached_input_per_1k`, `cache_read_per_1k`,
-`cache_creation_per_1k`. Management's `pricing.Entry` marshals the identical
-names, and `EntryJSON`/`Entry` are field-identical so `NewEntries` converts by
-direct struct conversion rather than field-by-field copying (a new rate can't
-be silently dropped in transit).
-
-`EntryCosts`
-([pricing.go:183–234](../../../proxy/internal/llm/pricing/pricing.go))
-is the cost formula — most security-relevant math in this module. The
-**surface** (the `llm.provider` value the request parser stamped) selects the
-formula, never the tier the entry came from: a per-provider-record override on
-an Anthropic route still bills its cache buckets additively.
+`Table.Cost`
+([pricing.go:129–174](../../../proxy/internal/llm/pricing/pricing.go))
+is the cost formula — most security-relevant math in this module:
 
 | Provider | Formula |
 |---|---|
@@ -241,7 +218,7 @@ an Anthropic route still bills its cache buckets additively.
 | default | `inTokens × InputPer1K + outTokens × OutputPer1K` |
 
 `bedrock` shares the Anthropic additive-cache formula
-([pricing.go:214–229](../../../proxy/internal/llm/pricing/pricing.go)):
+([pricing.go:172-174](../../../proxy/internal/llm/pricing/pricing.go)):
 Anthropic-on-Bedrock reports the same additive cache buckets, while non-Anthropic
 Bedrock models (Nova, Llama) simply report zero in those buckets so cost reduces
 to `input + output`.
@@ -249,12 +226,15 @@ to `input + output`.
 Each per-bucket rate falls back to `InputPer1K` when zero — operators opt in
 to discounts by setting the field.
 
-`Costs`
-([pricing.go:143–163](../../../proxy/internal/llm/pricing/pricing.go)) is the
-per-request split. The four per-bucket fields are the base; `TotalUSD` and
-`CacheUSD` are **derived** in `newCosts` so the aggregates can never drift from
-the breakdown. `InputUSD` is always the non-cached input bucket on both
-provider shapes, so input and cached-input never double-count.
+`Loader`
+([pricing.go:212–268](../../../proxy/internal/llm/pricing/pricing.go))
+overlays an optional `pricing.yaml` from data-dir on top of the go:embed
+defaults. Atomic pointer swap means readers never observe a partial update.
+The mtime-poll reloader (30s default cadence) keeps the previous table on
+parse failure so cost annotation never goes blank during a botched edit.
+
+`defaults_pricing.yaml` is the source of truth for built-in pricing.
+Operator overrides only carry the entries they want to change.
 
 ## Public contracts
 
@@ -284,38 +264,29 @@ Order matters: `DetectFromURL` ties resolve by registration order.
 `ProviderBedrock = 3`. Numeric values are persisted in nothing today but treat
 them as wire-stable — new providers must take fresh numbers.
 
-**`Pricing` construction + lookup**
-([pricing.go:60–130](../../../proxy/internal/llm/pricing/pricing.go)):
+**`Pricing` lookup**
+([pricing.go:129](../../../proxy/internal/llm/pricing/pricing.go)):
 
 ```go
-func NewEntries(raw map[string]map[string]EntryJSON) (map[string]map[string]Entry, error)
-func NewTable(raw map[string]map[string]EntryJSON) (*Table, error)
-
-func (t *Table) Lookup(provider, model string) (Entry, bool)
 func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool)
-func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (Costs, bool)
-func EntryCosts(entry Entry, surface string, inTokens, outTokens, cachedInput, cacheCreation int64) Costs
 ```
 
-`NewTable` is the surface-keyed defaults table; `NewEntries` returns the raw
-two-level map `cost_meter` uses for the per-provider-record tier (it looks up an
-`Entry` directly and calls `EntryCosts`, so it needs no `Table` wrapper). Both
-reject any non-finite or negative rate, so a corrupt config fails the chain
-build rather than mispricing silently. Nil input yields an empty,
-never-matching table.
-
-Nil-safe: `t.Cost`/`t.Lookup` on a nil receiver returns `ok=false`
-([pricing.go:96–99](../../../proxy/internal/llm/pricing/pricing.go)).
-`ok=false` means the surface or model is absent from the table management sent;
-the caller emits `cost.skipped=unknown_model`.
+Nil-safe: `t.Cost` on a nil receiver returns `(0, false)`
+([pricing.go:130–132](../../../proxy/internal/llm/pricing/pricing.go)).
+`ok=false` means provider or model is absent from the loaded table; the caller
+emits `cost.skipped=unknown_model`.
 
 ## Invariants
 
-1. **The pricing package is pure and platform-independent.** No file I/O, no
-   `//go:embed`, no goroutines, no build tags — the rates arrive as config, so
-   there is nothing platform-specific left to port. Anything reintroducing a
-   read-from-disk path here re-splits pricing authority between management and
-   the proxy, which is exactly what this design removed.
+1. **Cross-platform pricing build.** `pricing_unix.go` carries the only
+   functional `loadPricing` (uses `syscall.O_NOFOLLOW` and `f.Stat()` on an
+   open descriptor — both Unix-only). `pricing_other.go` is a build-tag
+   fallback that returns `"not supported on this platform"`
+   ([pricing_other.go:14–16](../../../proxy/internal/llm/pricing/pricing_other.go)).
+   The proxy is Linux-only in production today; a Windows port needs an
+   equivalent path-as-handle implementation. Reviewers building on Windows
+   should expect this surface to return an error at startup if an override
+   file is configured.
 
 2. **SSE scanner handles partial chunks.** A buffered prefix that doesn't end
    in `\n\n` still yields its accumulated event before `io.EOF`
@@ -327,45 +298,38 @@ the caller emits `cost.skipped=unknown_model`.
    usage rather than aborting
    ([streaming.go:68–73, 144–150](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go)).
 
-3. **Management is the only source of rates.** `Table` has no constructor that
-   invents prices: the only way in is `NewTable`/`NewEntries` over the wire map
-   management sent. A missing or empty `pricing` block therefore means *no
-   prices at all* (`cost_meter` records `cost.skipped=unknown_model`, $0) —
-   never a stale built-in fallback that would silently bill list price.
+3. **`defaults_pricing.yaml` is the source of truth.** Compiled into the
+   binary via `//go:embed`
+   ([pricing.go:29–30](../../../proxy/internal/llm/pricing/pricing.go)).
+   `DefaultTable()` parses once and panics on parse failure
+   ([pricing.go:42–49](../../../proxy/internal/llm/pricing/pricing.go))
+   — by design: a broken embedded YAML must not ship to production.
 
-4. **Tables are immutable once built.** `Table.entries` is written only in
-   `NewEntries` and never mutated afterwards, and `cost_meter`'s `perRecord`
-   map is likewise build-time-only
-   ([pricing.go:47–52](../../../proxy/internal/llm/pricing/pricing.go)). This
-   is what makes the no-reload design safe: a price change arrives as a mapping
-   push that builds a new middleware instance over a new table, so concurrent
-   readers can't observe a half-updated price list and no atomic swap or lock
-   is needed on the hot path.
+4. **Loader path validation.** `resolveMiddlewareDataPath`
+   ([pricing.go:370–394](../../../proxy/internal/llm/pricing/pricing.go))
+   rejects absolute paths, traversal segments, and basenames that fail
+   `basenameRegex = ^[a-zA-Z0-9._-]+$`. The resolved path must remain
+   inside `baseDir` even after `filepath.Clean`. Tests:
+   `TestNewLoader_PathValidation`, `TestNewLoader_PathValidation_Extended`,
+   `TestNewLoader_SymlinkOutsideBaseDirRejected`, `TestNewLoader_SymlinkRejected`.
 
-5. **Rate validation happens at chain-build time, not per request.**
-   `NewEntries` rejects negative, NaN, and ±Inf rates field by field
-   ([pricing.go:60–83](../../../proxy/internal/llm/pricing/pricing.go)), naming
-   the offending surface/model/field in the error. Management enforces the same
-   constraints at its API boundary and in its YAML parser, so this is
-   defense-in-depth — but it means a corrupt push fails loudly at build instead
-   of producing negative costs on live traffic. Test:
-   `TestNewTable_ValidatesRates`.
+5. **Unix loader symlink safety.** `O_NOFOLLOW` on open, `f.Stat()` on the
+   open descriptor (never re-stat by path), `info.Mode().IsRegular()` check,
+   `io.LimitReader(f, maxPricingBytes+1)` with a final size assertion
+   ([pricing_unix.go:25–57](../../../proxy/internal/llm/pricing/pricing_unix.go)).
+   A mid-read symlink swap is detected because the fstat is on the original
+   fd. Test: `TestNewLoader_RejectsOversizedFile_FixesM4`.
 
-6. **New rates must be added to `Entry`, `EntryJSON`, *and* management's
-   `pricing.Entry` together.** `NewEntries` converts by direct struct
-   conversion `Entry(e)`
-   ([pricing.go:76–78](../../../proxy/internal/llm/pricing/pricing.go)), which
-   only compiles while the two structs stay field-identical — so the proxy half
-   is compiler-enforced. The management half is not: a rate added there but not
-   here unmarshals into nothing and prices that bucket at `InputPer1K`.
+6. **`yaml.NewDecoder(...).KnownFields(true)`**
+   ([pricing.go:397–398](../../../proxy/internal/llm/pricing/pricing.go))
+   rejects YAML files that carry fields not in the schema. A typo in an
+   operator override file fails loud instead of silently zeroing rates.
 
 ## Things to scrutinise
 
-**Correctness.** Verify the OpenAI cached-prompt clamp at
-[pricing.go:203–206](../../../proxy/internal/llm/pricing/pricing.go)
-short-circuits before subtraction. Negative token counts are clamped to zero up
-front ([pricing.go:186–197](../../../proxy/internal/llm/pricing/pricing.go)) so
-no formula can yield a negative cost. `Anthropic.TotalTokens` sums all four
+**Correctness.** Verify OpenAI cached-prompt clamp at
+[pricing.go:147–149](../../../proxy/internal/llm/pricing/pricing.go)
+short-circuits before subtraction. `Anthropic.TotalTokens` sums all four
 buckets (in + out + cache_read + cache_creation) — downstream dashboards
 need to know this differs from `input + output`.
 `OpenAIParser.ExtractPrompt` falls through `messages → input → prompt`; a
@@ -374,27 +338,22 @@ noting).
 
 **Security.** `Scanner.maxLine = 1 MiB`; a 2 MiB single-line `data:` event
 errors from `Scanner.Next` and both accumulators stop with partial usage.
-Pricing is no longer file-backed, so the loader's path-traversal / symlink /
-oversize surface is gone entirely — the config channel (an authenticated
-mapping push from management) is now the only way rates enter the proxy, and
-`NewEntries` is the validation boundary on it. A new rate added to management's
-`pricing.Entry` but not to `EntryJSON` here is the remaining silent-mispricing
-path (see invariant 6).
+Pricing file 1 MiB cap is orders of magnitude larger than realistic. Confirm
+new schema additions are mirrored in both `pricingFile` and `Entry`;
+`KnownFields(true)` will reject silently-typo'd operator overrides
+otherwise.
 
-**Concurrency.** Nothing in this package is shared mutable state: tables are
-built once and never written again, so `cost_meter`'s hot path is lock-free by
-construction rather than by atomic swap. Per-call `Scanner` instances mean no
-shared state across concurrent response-parser calls.
+**Concurrency.** `Loader.table` is `atomic.Pointer[Table]`; readers never
+block or see a torn table. `Loader.Reload` is one goroutine, cancelled via
+context (`TestLoader_ReloadBackgroundLoopCancellation`). `DefaultTable()`
+uses `sync.Once`. Per-call `Scanner` instances mean no shared state across
+concurrent response-parser calls.
 
-**Perf.** `Table.Cost` is two map lookups + multiplications, O(1); the
-per-provider-record tier adds at most one more lookup. `Scanner.Next` is one
-`ReadString('\n')` per line. No background goroutines and no per-request
-allocation of pricing state.
+**Perf.** `Table.Cost` is two map lookups + multiplications, O(1).
+`Scanner.Next` is one `ReadString('\n')` per line. Pricing reload poll 30s.
 
-**Observability.** A config carrying no `pricing` block logs one warning at
-chain-build time (`cost_meter` factory) and then records
-`cost.skipped=unknown_model` per request, so an old-management deployment is
-visible in both logs and the access log rather than quietly reporting $0.
+**Observability.** Reload failures count via `metric.Int64Counter` keyed
+`plugin`; warning log rate-limited at 5 min so a broken file doesn't flood.
 Parser errors return sentinels — middleware uses `errors.Is` to map to the
 right `cost.skipped` reason.
 
@@ -406,7 +365,7 @@ right `cost.skipped` reason.
 | `openai_test.go` | 11 | Chat Completions + Responses API + legacy `prompt`; cached-tokens subset for both naming conventions; fixture replays |
 | `anthropic_test.go` | 7 | Messages + legacy `/v1/complete`; streaming REJECTED on `ParseResponse` (must use scanner); fixture replays |
 | `sse_test.go` | 12 | Fixture replay both providers; multiline `data:`; CRLF; comment skip; trailing-event-without-blank-line; oversize rejection |
-| `pricing/pricing_test.go` | 10 | Provider-shape switch (surface selects the formula); cached-rate + cache-read/creation fallback to `InputPer1K`; cached-clamp; negative-token clamp; nil-receiver safety; rate validation (negative / NaN / Inf rejected); nil + empty table |
+| `pricing/pricing_test.go` | 21 | Provider-shape switch; cached-rate fallback; cached-clamp; symlink rejection (target outside basedir + symlink to file); path validation matrix; oversize rejection; reload-keeps-previous-on-parse-error; mtime change detection; goroutine cancellation |
 
 **Fixtures** ([proxy/internal/llm/fixtures/](../../../proxy/internal/llm/fixtures/)):
 `openai_chat_completion.json` (chat.completions with usage),
@@ -414,15 +373,14 @@ right `cost.skipped` reason.
 `openai_stream.txt` (3 deltas + usage + `[DONE]`),
 `anthropic_messages.json` (Messages API non-streaming),
 `anthropic_stream.txt` (full 7-event sequence: message_start →
-content_block_{start,delta×2,stop} → message_delta (usage) → message_stop).
-No pricing fixture: the table is config-delivered, so pricing tests construct
-it in-process from a wire-shape map.
+content_block_{start,delta×2,stop} → message_delta (usage) → message_stop),
+`pricing.yaml` (realistic-pricing starter for operator overrides).
 
 ## Cross-references
 
 - Sibling: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
   — the chain that calls `llm.Parsers()`, `llm.ParserByName`,
-  `llm.NewScanner`, `pricing.NewTable` / `pricing.NewEntries`.
+  `llm.NewScanner`, `pricing.NewLoader`.
 - Path-routed providers (Vertex AI + Bedrock), credential syntax, and the
   Bedrock AWS event-stream accumulator:
   [50-path-routed-providers.md](./50-path-routed-providers.md).

docs/agent-networks/modules/33-proxy-runtime.md

@@ -1,7 +1,7 @@
 # proxy/runtime — translate + serve + log
 
 > **Risk level:** High — every config push from management is translated here, and the chain runs on every HTTP request to a synth target.
-> **Backward-compat impact:** Additive at the wire (`PathTargetOptions.middlewares`, `agent_network`, `disable_access_log`, capture caps) and on the proxy `Server` struct (`MiddlewareCaptureBudgetBytes`). Non-agent-network targets stay on the no-middleware fast path. Middleware config is entirely wire-delivered — no proxy-side data dir is involved, including for LLM pricing, which management ships inside `cost_meter`'s config.
+> **Backward-compat impact:** Additive at the wire (`PathTargetOptions.middlewares`, `agent_network`, `disable_access_log`, capture caps) and on the proxy `Server` struct (`MiddlewareDataDir`, `MiddlewareCaptureBudgetBytes`). Non-agent-network targets stay on the no-middleware fast path.
 
 ## Module boundary
 
@@ -114,7 +114,8 @@ At **request time** the access-log middleware stamps `CapturedData`; the auth ch
 
 ## Public contracts touched
 
-- `proxy.Server.MiddlewareCaptureBudgetBytes` (int64) — process-wide capture cap; defaults to 256 MiB (server.go:249-253). There is no `MiddlewareDataDir`: no built-in middleware reads config from disk, so `builtin.FactoryContext` carries only the proxy-lifetime context, meter, logger, and management client.
+- `proxy.Server.MiddlewareDataDir` (string) — base dir for file-backed middleware config (server.go:238-241).
+- `proxy.Server.MiddlewareCaptureBudgetBytes` (int64) — process-wide capture cap; defaults to 256 MiB (server.go:248-250).
 - `proxy/internal/proxy.WithMiddlewareManager(*middleware.Manager) Option` — new option on `NewReverseProxy`; nil keeps the fast path (reverseproxy.go:48-56).
 - `proxy/internal/proxy.PathTarget` adds `Middlewares`, `CaptureConfig`, `AgentNetwork`, `DisableAccessLog` (servicemapping.go:27-51), all zero-default.
 - `proxy/internal/proxy.CapturedData` adds `agentNetwork`, `suppressAccessLog`, `userGroupNames` behind `sync.RWMutex`; slices deep-copied (context.go:47-66, 183-258).

docs/agent-networks/modules/50-path-routed-providers.md

@@ -87,9 +87,9 @@ strips the `@version` suffix from the model, and maps the publisher to a parser
 surface via `vertexPublisherVendor`:
 
 - `anthropic` → `llm.provider="anthropic"` → metered through the Anthropic
-  parser, priced under the **`anthropic`** surface of the pricing table
-  management ships (the parser emits the standard Anthropic provider label, so
-  Vertex Claude reuses first-party Anthropic prices).
+  parser, priced under the **`anthropic`** block in `defaults_pricing.yaml`
+  (the parser emits the standard Anthropic provider label, so Vertex Claude
+  reuses first-party Anthropic prices).
 - `openai` → `llm.provider="openai"` (reserved; not in the catalog lineup
   today).
 - anything else (notably `google` / Gemini) → empty vendor → **no parser**.
@@ -104,9 +104,8 @@ is omitted from the catalog.
 
 > Caveat: cross-region inference profiles in `eu` / `apac` carry a ~10% price
 > premium that the base per-token rates do **not** model — cost annotations for
-> those regions read low. Operators who need exact regional billing set the
-> affected models' prices on the provider record, or replace the default entries
-> via management's `AgentNetwork.PricingDefaultsFile`.
+> those regions read low. Operators who need exact regional billing override
+> the affected entries in `pricing.yaml`.
 
 ## AWS Bedrock (`bedrock_api`)
 
@@ -212,19 +211,15 @@ so a model-listing call can't be rewritten onto an upstream that would 404 it.
 ## Catalog ↔ pricing cross-check
 
 Catalog prices and context windows are cross-checked against LiteLLM's
-`model_prices_and_context_window.json`. The **catalog is the source of default
-prices**: management's `pricing.DefaultTable` folds every catalog provider's
-models into the surfaces that provider declares (`PricingSurfaces`), so coverage
-is structural rather than maintained in a parallel file
-([pricing/defaults.go](../../../management/internals/modules/agentnetwork/pricing/defaults.go)).
-`TestDefaultTable_CoversEveryCatalogModel` fails if a catalog model ends up
-unpriced, and `TestDefaultTable_NoConflictingContributions` fails if two
-providers contribute the same (surface, model) at different rates. Bedrock
-entries are keyed by the **normalised** id the request parser emits (region
-prefix + version suffix stripped) — management applies the same normalisation to
-per-provider prices at synth time, so the two keys compare equal. Vertex Claude
-carries no Bedrock-style prefix, so it prices straight off the `anthropic`
-surface.
+`model_prices_and_context_window.json`. The proxy's embedded
+`defaults_pricing.yaml` covers **every metered first-party model** the catalog
+enumerates — guarded by
+`TestDefaultTable_FirstPartyModelCoverage`
+([pricing/defaults_coverage_test.go](../../../proxy/internal/llm/pricing/defaults_coverage_test.go)),
+which fails if a catalog model has no embedded price. Bedrock entries are keyed
+by the **normalised** id the request parser emits (region prefix + version
+suffix stripped). Vertex Claude carries no Bedrock-style prefix, so it prices
+straight off the `anthropic` block.
 
 ## Things to scrutinise
 
@@ -237,17 +232,16 @@ operator-misconfigured Vertex provider and unmetered Gemini traffic; verify
 publishers).
 
 **Correctness.** `normalizeBedrockModel` is the join between the wire id and the
-pricing key — a model that normalises to something absent from the shipped
-pricing table meters at `cost.skipped=unknown_model` rather than failing the
-request. The
+pricing key — a model that normalises to something not in `defaults_pricing.yaml`
+meters at `cost.skipped=unknown_model` rather than failing the request. The
 `/bedrock` prefix strip must run on both the parser side (so the model is
 extracted) and the router side (so the upstream path is native); a regression in
 either silently breaks the other.
 
 **Metering caveats.** eu/apac cross-region Bedrock + Vertex profiles carry a
-~10% premium not modelled by base pricing — flagged in the catalog comment.
-Operators needing exact regional billing set per-provider prices on the model
-rows (or replace the default entries via `AgentNetwork.PricingDefaultsFile`).
+~10% premium not modelled by base pricing — flagged in both the catalog comment
+and `defaults_pricing.yaml`. Operators needing exact regional billing override
+the relevant entries.
 
 ## Cross-references
 

e2e/agentnetwork/custom_pricing_test.go

@@ -23,9 +23,10 @@ import (
 // model the client asks for. The proxy prices off the REQUEST model, not the
 // upstream response model, so a made-up model id billed at operator rates lets
 // these tests assert exact costs without a real vendor key.
+// Sourced from the harness so the counts can't drift from the mock's config.
 const (
-	vllmPromptTokens     = 11
-	vllmCompletionTokens = 2
+	vllmPromptTokens     = harness.VLLMChatInputTokens
+	vllmCompletionTokens = harness.VLLMChatOutputTokens
 )
 
 // pricedEnv is a connected single-provider agent-network deployment pointed at
@@ -169,23 +170,48 @@ func chatOnce(t *testing.T, ctx context.Context, env pricedEnv, model, sessionID
 	return body
 }
 
-// findAccessLogBySession polls the access-log page for the row carrying sessionID.
-func findAccessLogBySession(t *testing.T, ctx context.Context, sessionID string) api.AgentNetworkAccessLog {
-	t.Helper()
-	var row api.AgentNetworkAccessLog
-	require.Eventually(t, func() bool {
-		logs, lerr := srv.ListAccessLogs(ctx)
-		if lerr != nil {
-			return false
-		}
-		for _, r := range logs.Data {
-			if r.SessionId != nil && *r.SessionId == sessionID {
-				row = r
-				return true
+// accessLogIngestWindow is how long a single request's access-log row is given
+// to appear before the caller gives up on it.
+// accessLogIngestWindow bounds how long a row may take to appear after its
+// request returned. The proxy streams each entry to management with a 10s send
+// timeout of its own, so a request whose send hits one full timeout and is
+// retried has not yet missed anything real — 30s left barely three send
+// attempts of headroom and lost the race on a loaded runner.
+const accessLogIngestWindow = 60 * time.Second
+
+// lookupAccessLogBySession polls the access-log page for the row carrying
+// sessionID and reports whether it arrived within the window. It never fails
+// the test: callers that can recover — by firing a fresh request under a new
+// session — need to see the miss rather than die on it.
+func lookupAccessLogBySession(ctx context.Context, sessionID string, within time.Duration) (api.AgentNetworkAccessLog, bool) {
+	deadline := time.Now().Add(within)
+	for {
+		if logs, lerr := srv.ListAccessLogs(ctx); lerr == nil {
+			for _, r := range logs.Data {
+				if r.SessionId != nil && *r.SessionId == sessionID {
+					return r, true
+				}
 			}
 		}
-		return false
-	}, 30*time.Second, 2*time.Second, "session id %q must be recorded in an access-log row", sessionID)
+		if time.Now().After(deadline) {
+			return api.AgentNetworkAccessLog{}, false
+		}
+		select {
+		case <-ctx.Done():
+			return api.AgentNetworkAccessLog{}, false
+		case <-time.After(2 * time.Second):
+		}
+	}
+}
+
+// findAccessLogBySession polls the access-log page for the row carrying
+// sessionID, failing the test if it never lands. Use it for a request whose row
+// must exist; where a missing row is a recoverable race, use
+// lookupAccessLogBySession and retry.
+func findAccessLogBySession(t *testing.T, ctx context.Context, sessionID string) api.AgentNetworkAccessLog {
+	t.Helper()
+	row, ok := lookupAccessLogBySession(ctx, sessionID, accessLogIngestWindow)
+	require.True(t, ok, "session id %q must be recorded in an access-log row", sessionID)
 	return row
 }
 
@@ -319,6 +345,11 @@ func TestPriceChangeUpdatesRecordedCost(t *testing.T) {
 		outRateA    = 0.020
 		inRateB     = 0.050 // 5x / 4x the original, so a repriced row is unmistakable
 		outRateB    = 0.080
+		// Per-attempt ingest wait, shorter than the default so a request that
+		// produces no row costs one retry rather than most of the budget, and an
+		// overall deadline long enough to hold several attempts.
+		repriceIngestWindow = 20 * time.Second
+		repriceDeadline     = 180 * time.Second
 	)
 
 	env := provisionPricedProvider(t, ctx, "reprice", []api.AgentNetworkProviderModel{
@@ -353,10 +384,15 @@ func TestPriceChangeUpdatesRecordedCost(t *testing.T) {
 	// reading its cost, so an un-ingested row is never mistaken for "still rate A".
 	// The expected new input cost is unmistakably higher than rate A, so a
 	// lingering old-rate row can't satisfy the check.
+	//
+	// Every way an iteration can come up short — the request failing, its row not
+	// landing, or the row still carrying rate A — is a symptom of the same
+	// in-flight rebuild, so each one retries under a fresh session rather than
+	// ending the test. Only the outer deadline is fatal.
 	wantInputB := float64(vllmPromptTokens) / 1000 * inRateB
 	var repriced api.AgentNetworkAccessLog
 	var lastSession string
-	deadline := time.Now().Add(90 * time.Second)
+	deadline := time.Now().Add(repriceDeadline)
 	for time.Now().Before(deadline) {
 		lastSession = fmt.Sprintf("e2e-session-reprice-b-%d", time.Now().UnixNano())
 		code, _, cerr := env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireChat, customModel, "Reply with exactly: pong", lastSession)
@@ -364,7 +400,15 @@ func TestPriceChangeUpdatesRecordedCost(t *testing.T) {
 			time.Sleep(5 * time.Second)
 			continue
 		}
-		row := findAccessLogBySession(t, ctx, lastSession)
+		row, ok := lookupAccessLogBySession(ctx, lastSession, repriceIngestWindow)
+		if !ok {
+			// No row for this request. The provider update rebuilds the proxy's
+			// middleware chain, and a request served mid-rebuild can complete
+			// without a resolved provider — 200 to the caller, nothing to
+			// attribute, so no row is ever written for it. Fire another one.
+			t.Logf("no access-log row for session %q within %s; retrying under a fresh session", lastSession, repriceIngestWindow)
+			continue
+		}
 		if inDelta(row.InputCostUsd, wantInputB, 1e-6) {
 			repriced = row
 			break
@@ -630,3 +674,47 @@ func inDelta(a, b, tol float64) bool {
 	}
 	return d <= tol
 }
+
+// TestCustomDatedModelKeepsItsOwnPrice covers the review fix that anchored the
+// release-date fallback to Claude ids. Pricing looks every model up through
+// that helper, so while it matched a bare trailing date any operator id ending
+// in eight digits inherited the rate of its undated sibling — a silent
+// mis-bill on models NetBird knows nothing about.
+func TestCustomDatedModelKeepsItsOwnPrice(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	const (
+		baseModel  = "internal-llm"
+		datedModel = "internal-llm-20250101"
+		baseIn     = 0.010
+		baseOut    = 0.020
+		// An order of magnitude apart, so a row billed at the wrong entry is
+		// unmistakable rather than a rounding argument.
+		datedIn  = 0.100
+		datedOut = 0.200
+	)
+
+	env := provisionPricedProvider(t, ctx, "customdated", []api.AgentNetworkProviderModel{
+		{Id: baseModel, InputPer1k: baseIn, OutputPer1k: baseOut},
+		{Id: datedModel, InputPer1k: datedIn, OutputPer1k: datedOut},
+	})
+
+	t.Run("the undated id bills at its own rate", func(t *testing.T) {
+		session := fmt.Sprintf("e2e-session-customdated-base-%d", time.Now().UnixNano())
+		chatOnce(t, ctx, env, baseModel, session)
+		assertOpenAICostAtRates(t, findAccessLogBySession(t, ctx, session), baseIn, baseOut)
+	})
+
+	t.Run("the dated id keeps its own rate", func(t *testing.T) {
+		session := fmt.Sprintf("e2e-session-customdated-dated-%d", time.Now().UnixNano())
+		chatOnce(t, ctx, env, datedModel, session)
+		row := findAccessLogBySession(t, ctx, session)
+		assertOpenAICostAtRates(t, row, datedIn, datedOut)
+
+		// Spelled out because it is the regression: inheriting the sibling's
+		// rate would bill this request at a tenth of its price.
+		assert.Greater(t, row.InputCostUsd, float64(vllmPromptTokens)/1000*baseIn*2,
+			"a custom dated id must not inherit the undated entry's rate")
+	})
+}