[management,client] Normalize anonymize_level and sanity-check the bundle upload URL

Two review follow-ups.

The API validated anonymize_level after trimming and lowercasing but
persisted the value verbatim, so " default " passed as default yet reached
the client — which only lowercases — as an unrecognized value it resolves
to strict. Persist the normalized form so what was validated is what the
client parses.

The remote debug bundle job forwarded the management-supplied upload URL
to the uploader unchecked and logged it at info level, where it can leak a
host, credentials, or query tokens. Reject a malformed or non-https URL
before generating the bundle, and keep the URL out of the info-level line
while leaving the full parameters at debug. The accepted host is left
unrestricted for now, pending a decision on management-directed uploads.

.github/workflows/ui-translations.yml

@@ -1,42 +0,0 @@
-name: UI Translations
-
-on:
-  pull_request:
-    paths:
-      - "client/ui/i18n/locales/**"
-      - "client/ui/i18n/check-translations.mjs"
-      - ".github/workflows/ui-translations.yml"
-  push:
-    branches:
-      - main
-    paths:
-      - "client/ui/i18n/locales/**"
-      - "client/ui/i18n/check-translations.mjs"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
-  cancel-in-progress: true
-
-jobs:
-  check-translations:
-    name: Check translation key parity
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-
-      # English (en) is the source of truth for translation keys; every other
-      # locale declared in _index.json must carry the exact same key set.
-      - name: Check translation key parity
-        run: node client/ui/i18n/check-translations.mjs

client/android/client.go

@@ -110,11 +110,6 @@ type Client struct {
 
 	extendMu     sync.Mutex
 	extendCancel context.CancelFunc
-
-	// The file drop handle survives engine restarts so the UI keeps one listener
-	// registration and one history view across reconnects. See fileDropFor.
-	fileDropMu sync.Mutex
-	fileDrop   *FileDrop
 }
 
 func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cfgPath string, cc *internal.ConnectClient) {
@@ -202,7 +197,6 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.attachFileDrop(connectClient, cfgFile)
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
@@ -244,7 +238,6 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.attachFileDrop(connectClient, cfgFile)
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }

client/android/client_filedrop.go

@@ -1,78 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"fmt"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal"
-)
-
-// FileDrop returns the handle of the active profile, creating it on first use.
-// The UI calls this to list transfers and change settings while disconnected.
-func (c *Client) FileDrop(configDir string) (*FileDrop, error) {
-	profile, err := NewProfileManager(configDir).GetActiveProfile()
-	if err != nil {
-		return nil, fmt.Errorf("get active profile: %w", err)
-	}
-	return c.fileDropFor(configDir, profile.ID)
-}
-
-// fileDropFor returns the handle of one profile, replacing the cached one when
-// the profile changed. The listener is carried over so a profile switch does not
-// silence the UI.
-func (c *Client) fileDropFor(configDir, profileID string) (*FileDrop, error) {
-	c.fileDropMu.Lock()
-
-	if c.fileDrop != nil && c.fileDrop.ProfileID() == profileID {
-		fd := c.fileDrop
-		c.fileDropMu.Unlock()
-		return fd, nil
-	}
-
-	fd, err := NewFileDrop(configDir, profileID)
-	if err != nil {
-		c.fileDropMu.Unlock()
-		return nil, err
-	}
-	ensureFileDropDestination(fd)
-
-	old := c.fileDrop
-	if old != nil {
-		fd.SetListener(old.Listener())
-	}
-	c.fileDrop = fd
-	c.fileDropMu.Unlock()
-
-	// Closing waits out the in-flight uploads of the profile being left, which is
-	// far too long to hold the lock every caller of this goes through.
-	if old != nil {
-		if err := old.Close(); err != nil {
-			log.Warnf("failed to close previous file drop manager: %v", err)
-		}
-	}
-
-	return fd, nil
-}
-
-// attachFileDrop hands the connect client the file drop manager of the profile
-// the engine is starting for. The profile is derived from the config path rather
-// than read from the active profile state, so a switch racing the startup cannot
-// pair one profile's engine with another's transfers. A failure is not fatal:
-// the tunnel is worth more than the feature, so the engine runs on without it.
-func (c *Client) attachFileDrop(cc *internal.ConnectClient, cfgFile string) {
-	configDir, profileID, err := profileLocationFor(cfgFile)
-	if err != nil {
-		log.Warnf("file drop is unavailable: %v", err)
-		return
-	}
-
-	fd, err := c.fileDropFor(configDir, profileID)
-	if err != nil {
-		log.Warnf("file drop is unavailable: %v", err)
-		return
-	}
-	cc.SetFileDropManager(fd.manager)
-}

client/android/filedrop.go

@@ -1,205 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"errors"
-	"fmt"
-	"net/netip"
-	"path/filepath"
-	"sync"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/filedrop"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-)
-
-const filedropDataSubdir = "filedrop"
-
-// FileDrop is the platform-facing handle on one profile's file drop state. It
-// outlives the engine: the manager keeps policy and history readable while the
-// tunnel is down, and sending simply fails until it comes back up.
-type FileDrop struct {
-	mu        sync.Mutex
-	configDir string
-	profileID string
-	manager   *filedrop.Manager
-	listener  FileDropListener
-}
-
-// NewFileDrop opens the file drop state of the given profile.
-func NewFileDrop(configDir, profileID string) (*FileDrop, error) {
-	if configDir == "" || profileID == "" {
-		return nil, errors.New("file drop requires a config dir and profile ID")
-	}
-
-	prefs, err := newProfilePrefs(configDir, profileID)
-	if err != nil {
-		return nil, err
-	}
-
-	fd := &FileDrop{configDir: configDir, profileID: profileID}
-	manager, err := filedrop.NewManager(filedrop.ManagerConfig{
-		Profile: profilemanager.ID(profileID),
-		DataDir: filepath.Join(configDir, filedropDataSubdir, profileID),
-		Store:   filedrop.NewProfileStore(prefs.prefs),
-		Events:  fd.publish,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("create file drop manager: %w", err)
-	}
-
-	fd.manager = manager
-	return fd, nil
-}
-
-// ProfileID returns the profile this handle belongs to.
-func (f *FileDrop) ProfileID() string {
-	return f.profileID
-}
-
-// SetListener installs the event listener, replacing any previous one.
-func (f *FileDrop) SetListener(listener FileDropListener) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.listener = listener
-}
-
-// Listener returns the installed event listener, nil when there is none.
-func (f *FileDrop) Listener() FileDropListener {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return f.listener
-}
-
-// RemoveListener stops event delivery.
-func (f *FileDrop) RemoveListener() {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.listener = nil
-}
-
-// Send starts an asynchronous transfer and returns its local transfer ID.
-func (f *FileDrop) Send(peerKey, peerName, peerIP string, payloads *FileDropPayloads) (string, error) {
-	if payloads == nil || payloads.Length() == 0 {
-		return "", errors.New("nothing to send")
-	}
-
-	addr, err := netip.ParseAddr(peerIP)
-	if err != nil {
-		return "", fmt.Errorf("parse peer address %q: %w", peerIP, err)
-	}
-
-	id, err := f.manager.Send(filedrop.PeerKey(peerKey), peerName, addr.Unmap(), payloads.items)
-	if err != nil {
-		return "", err
-	}
-	return string(id), nil
-}
-
-// Accept releases a pending incoming offer for download.
-func (f *FileDrop) Accept(transferID string) error {
-	return f.manager.Accept(filedrop.OfferID(transferID))
-}
-
-// Decline refuses a pending incoming offer.
-func (f *FileDrop) Decline(transferID string) error {
-	return f.manager.Decline(filedrop.OfferID(transferID))
-}
-
-// Cancel aborts a transfer in either direction.
-func (f *FileDrop) Cancel(transferID string) {
-	f.manager.Cancel(filedrop.OfferID(transferID))
-}
-
-// Transfers returns the history, newest first.
-func (f *FileDrop) Transfers() *FileDropTransferArray {
-	transfers := f.manager.Transfers()
-	items := make([]*FileDropTransfer, 0, len(transfers))
-	for _, t := range transfers {
-		items = append(items, toFileDropTransfer(t))
-	}
-	return &FileDropTransferArray{items: items}
-}
-
-// Transfer returns one history entry, or nil when it is unknown.
-func (f *FileDrop) Transfer(transferID string) *FileDropTransfer {
-	for _, t := range f.manager.Transfers() {
-		if string(t.ID) == transferID {
-			return toFileDropTransfer(t)
-		}
-	}
-	return nil
-}
-
-// DeleteTransfer removes one history entry, cancelling it when still live.
-func (f *FileDrop) DeleteTransfer(transferID string) {
-	f.manager.DeleteTransfer(filedrop.OfferID(transferID))
-}
-
-// Mode returns the base receiving mode.
-func (f *FileDrop) Mode() int {
-	return int(f.manager.Policy().Get().Mode)
-}
-
-// SetMode changes the base receiving mode.
-func (f *FileDrop) SetMode(mode int) error {
-	return f.manager.Policy().SetMode(filedrop.Mode(mode))
-}
-
-// DestinationDir returns the directory received files are delivered to.
-func (f *FileDrop) DestinationDir() string {
-	return f.manager.DestinationDir()
-}
-
-// SetDestinationDir persists the delivery directory. It must be a filesystem
-// path the app can write; content URIs are not paths, so the platform layer
-// moves files out of this directory afterwards.
-func (f *FileDrop) SetDestinationDir(dir string) error {
-	return f.manager.SetDestinationDir(dir)
-}
-
-// PeerRule returns the rule stored for one sender.
-func (f *FileDrop) PeerRule(peerKey string) int {
-	return int(f.manager.Policy().Get().Senders[filedrop.PeerKey(peerKey)])
-}
-
-// SetPeerRule sets or clears the exception for one sender.
-func (f *FileDrop) SetPeerRule(peerKey string, rule int) error {
-	return f.manager.SetSenderRule(filedrop.PeerKey(peerKey), filedrop.SenderRule(rule))
-}
-
-// Close stops the receiver and aborts every outgoing transfer.
-func (f *FileDrop) Close() error {
-	f.RemoveListener()
-	return f.manager.Close()
-}
-
-func (f *FileDrop) publish(kind filedrop.EventKind, transfer filedrop.Transfer) {
-	f.mu.Lock()
-	listener := f.listener
-	f.mu.Unlock()
-	if listener == nil {
-		return
-	}
-	listener.OnFileDropEvent(int(kind), toFileDropTransfer(transfer))
-}
-
-// defaultFileDropDir is the app-private landing directory used until the
-// platform layer configures one.
-func defaultFileDropDir(configDir, profileID string) string {
-	return filepath.Join(configDir, filedropDataSubdir, profileID, "incoming")
-}
-
-// ensureFileDropDestination seeds the delivery directory on first use, so a
-// received file always has somewhere to land.
-func ensureFileDropDestination(fd *FileDrop) {
-	if fd.DestinationDir() != "" {
-		return
-	}
-	dir := defaultFileDropDir(fd.configDir, fd.profileID)
-	if err := fd.SetDestinationDir(dir); err != nil {
-		log.Warnf("failed to set default file drop destination: %v", err)
-	}
-}

client/android/filedrop_payload.go

@@ -1,122 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"errors"
-	"fmt"
-	"io"
-
-	"github.com/netbirdio/netbird/client/internal/filedrop"
-)
-
-// FileSource opens the bytes of one outgoing item. Android hands out content URIs
-// rather than paths, so the platform layer owns opening and seeking.
-type FileSource interface {
-	// Open returns a stream positioned at offset. It is called once per attempt,
-	// and again from the start when a transfer resumes.
-	Open(offset int64) (SourceStream, error)
-}
-
-// SourceStream is the readable half of a FileSource.
-//
-// It returns each chunk instead of filling a caller-supplied buffer: gomobile
-// copies a []byte argument into a fresh Java array and never copies it back, so
-// a fill-my-buffer method would hand back the right length with no data. Only
-// the return value crosses the bridge intact.
-type SourceStream interface {
-	// NextChunk returns up to max bytes. An empty result means end of stream.
-	NextChunk(max int) ([]byte, error)
-	Close() error
-}
-
-type sourceStreamReader struct {
-	stream SourceStream
-	buf    []byte
-	eof    bool
-}
-
-// FileDropPayloads collects the items of one outgoing transfer.
-type FileDropPayloads struct {
-	items []filedrop.Payload
-}
-
-// NewFileDropPayloads returns an empty payload list to fill before sending.
-func NewFileDropPayloads() *FileDropPayloads {
-	return &FileDropPayloads{}
-}
-
-// AddFile appends a file item backed by a platform-provided source.
-func (p *FileDropPayloads) AddFile(name string, size int64, contentType string, source FileSource) error {
-	if name == "" {
-		return errors.New("file name is required")
-	}
-	if source == nil {
-		return fmt.Errorf("file %s has no source", name)
-	}
-
-	p.items = append(p.items, filedrop.Payload{
-		Meta: filedrop.FileMeta{
-			Name:        name,
-			Size:        size,
-			ContentType: contentType,
-		},
-		Open: func(offset int64) (io.ReadCloser, error) {
-			stream, err := source.Open(offset)
-			if err != nil {
-				return nil, err
-			}
-			if stream == nil {
-				return nil, fmt.Errorf("no stream for %s", name)
-			}
-			return &sourceStreamReader{stream: stream}, nil
-		},
-	})
-	return nil
-}
-
-// AddText appends an inline text item.
-func (p *FileDropPayloads) AddText(name, text string) error {
-	if len(text) > filedrop.MaxInlineTextSize {
-		return fmt.Errorf("text exceeds %d bytes", filedrop.MaxInlineTextSize)
-	}
-	if name == "" {
-		name = "text"
-	}
-	p.items = append(p.items, filedrop.TextPayload(name, text))
-	return nil
-}
-
-// Length returns the number of items.
-func (p *FileDropPayloads) Length() int {
-	return len(p.items)
-}
-
-func (r *sourceStreamReader) Read(p []byte) (int, error) {
-	if len(p) == 0 {
-		return 0, nil
-	}
-
-	for len(r.buf) == 0 {
-		if r.eof {
-			return 0, io.EOF
-		}
-		chunk, err := r.stream.NextChunk(len(p))
-		if err != nil {
-			return 0, err
-		}
-		if len(chunk) == 0 {
-			r.eof = true
-			return 0, io.EOF
-		}
-		r.buf = chunk
-	}
-
-	n := copy(p, r.buf)
-	r.buf = r.buf[n:]
-	return n, nil
-}
-
-func (r *sourceStreamReader) Close() error {
-	return r.stream.Close()
-}

client/android/filedrop_test.go

@@ -1,261 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"errors"
-	"io"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/netbirdio/netbird/client/internal/filedrop"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-)
-
-type stubStream struct {
-	reader io.Reader
-	closed bool
-	// chunk caps what one call returns, so the reader's buffering is exercised
-	// rather than every read landing in a single hop.
-	chunk int
-}
-
-type stubSource struct {
-	content string
-	offsets []int64
-	chunk   int
-}
-
-func (s *stubStream) NextChunk(max int) ([]byte, error) {
-	if s.chunk > 0 && s.chunk < max {
-		max = s.chunk
-	}
-	buf := make([]byte, max)
-
-	n, err := s.reader.Read(buf)
-	if errors.Is(err, io.EOF) || n == 0 {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	return buf[:n], nil
-}
-
-func (s *stubStream) Close() error {
-	s.closed = true
-	return nil
-}
-
-func (s *stubSource) Open(offset int64) (SourceStream, error) {
-	s.offsets = append(s.offsets, offset)
-	return &stubStream{reader: strings.NewReader(s.content[offset:]), chunk: s.chunk}, nil
-}
-
-func TestPayloadSourceReassemblesChunks(t *testing.T) {
-	for name, chunk := range map[string]int{
-		"one hop":     0,
-		"three bytes": 3,
-		"one byte":    1,
-	} {
-		t.Run(name, func(t *testing.T) {
-			source := &stubSource{content: "hello world", chunk: chunk}
-
-			payloads := NewFileDropPayloads()
-			if err := payloads.AddFile("greeting.txt", 11, "text/plain", source); err != nil {
-				t.Fatalf("AddFile: %v", err)
-			}
-			if payloads.Length() != 1 {
-				t.Fatalf("expected 1 payload, got %d", payloads.Length())
-			}
-
-			stream, err := payloads.items[0].Open(0)
-			if err != nil {
-				t.Fatalf("Open: %v", err)
-			}
-			got, err := io.ReadAll(stream)
-			if err != nil {
-				t.Fatalf("ReadAll: %v", err)
-			}
-			if string(got) != "hello world" {
-				t.Fatalf("got %q, want %q", got, "hello world")
-			}
-			if err := stream.Close(); err != nil {
-				t.Fatalf("Close: %v", err)
-			}
-		})
-	}
-}
-
-func TestPayloadSourceHonoursOffset(t *testing.T) {
-	source := &stubSource{content: "hello world"}
-
-	payloads := NewFileDropPayloads()
-	if err := payloads.AddFile("greeting.txt", 11, "", source); err != nil {
-		t.Fatalf("AddFile: %v", err)
-	}
-
-	stream, err := payloads.items[0].Open(6)
-	if err != nil {
-		t.Fatalf("Open: %v", err)
-	}
-	defer stream.Close()
-
-	got, err := io.ReadAll(stream)
-	if err != nil {
-		t.Fatalf("ReadAll: %v", err)
-	}
-	if string(got) != "world" {
-		t.Fatalf("got %q, want %q", got, "world")
-	}
-	if len(source.offsets) != 1 || source.offsets[0] != 6 {
-		t.Fatalf("expected one open at offset 6, got %v", source.offsets)
-	}
-}
-
-func TestPayloadRejectsMissingSourceAndOversizedText(t *testing.T) {
-	payloads := NewFileDropPayloads()
-
-	if err := payloads.AddFile("no-source.bin", 1, "", nil); err == nil {
-		t.Fatal("expected an error for a file without a source")
-	}
-	if err := payloads.AddFile("", 1, "", &stubSource{}); err == nil {
-		t.Fatal("expected an error for an empty file name")
-	}
-	if err := payloads.AddText("big", strings.Repeat("x", filedrop.MaxInlineTextSize+1)); err == nil {
-		t.Fatal("expected an error for oversized text")
-	}
-	if payloads.Length() != 0 {
-		t.Fatalf("expected no payloads, got %d", payloads.Length())
-	}
-}
-
-func TestFileDropPersistsSettingsPerProfile(t *testing.T) {
-	configDir := t.TempDir()
-	writeTestProfile(t, configDir, "aaaaaaaabbbbbbbbccccccccdddddddd")
-	writeTestProfile(t, configDir, "11111111222222223333333344444444")
-
-	first, err := NewFileDrop(configDir, "aaaaaaaabbbbbbbbccccccccdddddddd")
-	if err != nil {
-		t.Fatalf("NewFileDrop: %v", err)
-	}
-	defer first.Close()
-
-	if err := first.SetMode(FileDropModeAutoAccept); err != nil {
-		t.Fatalf("SetMode: %v", err)
-	}
-	if err := first.SetPeerRule("peer-key", FileDropRuleBlock); err != nil {
-		t.Fatalf("SetPeerRule: %v", err)
-	}
-
-	second, err := NewFileDrop(configDir, "11111111222222223333333344444444")
-	if err != nil {
-		t.Fatalf("NewFileDrop: %v", err)
-	}
-	defer second.Close()
-
-	if got := second.Mode(); got != FileDropModeAsk {
-		t.Fatalf("second profile mode = %d, want the default %d", got, FileDropModeAsk)
-	}
-	if got := second.PeerRule("peer-key"); got != FileDropRuleDefault {
-		t.Fatalf("second profile rule = %d, want %d", got, FileDropRuleDefault)
-	}
-
-	reopened, err := NewFileDrop(configDir, "aaaaaaaabbbbbbbbccccccccdddddddd")
-	if err != nil {
-		t.Fatalf("NewFileDrop: %v", err)
-	}
-	defer reopened.Close()
-
-	if got := reopened.Mode(); got != FileDropModeAutoAccept {
-		t.Fatalf("reopened mode = %d, want %d", got, FileDropModeAutoAccept)
-	}
-	if got := reopened.PeerRule("peer-key"); got != FileDropRuleBlock {
-		t.Fatalf("reopened rule = %d, want %d", got, FileDropRuleBlock)
-	}
-}
-
-func TestFileDropSeedsDefaultDestination(t *testing.T) {
-	configDir := t.TempDir()
-	writeTestProfile(t, configDir, "aaaaaaaabbbbbbbbccccccccdddddddd")
-
-	fd, err := NewFileDrop(configDir, "aaaaaaaabbbbbbbbccccccccdddddddd")
-	if err != nil {
-		t.Fatalf("NewFileDrop: %v", err)
-	}
-	defer fd.Close()
-
-	if fd.DestinationDir() != "" {
-		t.Fatalf("expected no destination before seeding, got %q", fd.DestinationDir())
-	}
-
-	ensureFileDropDestination(fd)
-
-	want := filepath.Join(configDir, filedropDataSubdir, "aaaaaaaabbbbbbbbccccccccdddddddd", "incoming")
-	if got := fd.DestinationDir(); got != want {
-		t.Fatalf("destination = %q, want %q", got, want)
-	}
-}
-
-func TestFileDropSendWithoutTunnelFails(t *testing.T) {
-	configDir := t.TempDir()
-	writeTestProfile(t, configDir, "aaaaaaaabbbbbbbbccccccccdddddddd")
-
-	fd, err := NewFileDrop(configDir, "aaaaaaaabbbbbbbbccccccccdddddddd")
-	if err != nil {
-		t.Fatalf("NewFileDrop: %v", err)
-	}
-	defer fd.Close()
-
-	payloads := NewFileDropPayloads()
-	if err := payloads.AddText("note", "hi"); err != nil {
-		t.Fatalf("AddText: %v", err)
-	}
-
-	if _, err := fd.Send("peer-key", "peer", "100.64.0.2", payloads); !errors.Is(err, filedrop.ErrNotConnected) {
-		t.Fatalf("Send error = %v, want %v", err, filedrop.ErrNotConnected)
-	}
-	if _, err := fd.Send("peer-key", "peer", "100.64.0.2", NewFileDropPayloads()); err == nil {
-		t.Fatal("expected an error when there is nothing to send")
-	}
-	if _, err := fd.Send("peer-key", "peer", "not-an-ip", payloads); err == nil {
-		t.Fatal("expected an error for an unparseable peer address")
-	}
-}
-
-func TestProfileLocationForSplitsConfigPath(t *testing.T) {
-	root := t.TempDir()
-
-	dir, id, err := profileLocationFor(filepath.Join(root, defaultConfigFilename))
-	if err != nil {
-		t.Fatalf("default profile: %v", err)
-	}
-	if dir != root || id != profilemanager.DefaultProfileName {
-		t.Fatalf("default profile = (%q, %q), want (%q, %q)", dir, id, root, profilemanager.DefaultProfileName)
-	}
-
-	named := filepath.Join(root, profilesSubdir, "aaaaaaaabbbbbbbbccccccccdddddddd.json")
-	dir, id, err = profileLocationFor(named)
-	if err != nil {
-		t.Fatalf("named profile: %v", err)
-	}
-	if dir != root || id != "aaaaaaaabbbbbbbbccccccccdddddddd" {
-		t.Fatalf("named profile = (%q, %q), want (%q, %q)", dir, id, root, "aaaaaaaabbbbbbbbccccccccdddddddd")
-	}
-
-	for _, path := range []string{"", filepath.Join(root, "stray.json"), filepath.Join(root, profilesSubdir, "not-an-id!.json")} {
-		if _, _, err := profileLocationFor(path); err == nil {
-			t.Fatalf("expected an error for %q", path)
-		}
-	}
-}
-
-func writeTestProfile(t *testing.T, configDir, id string) {
-	t.Helper()
-
-	pm := NewProfileManager(configDir)
-	if _, err := pm.serviceMgr.ProfilePrefs(profilemanager.ID(id), androidUsername); err != nil {
-		t.Fatalf("resolve prefs for %s: %v", id, err)
-	}
-}

client/android/filedrop_transfer.go

@@ -1,163 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"strings"
-	"time"
-
-	"github.com/netbirdio/netbird/client/internal/filedrop"
-)
-
-// The file drop receiving modes exported via gomobile.
-const (
-	FileDropModeOff        = int(filedrop.ModeOff)
-	FileDropModeAsk        = int(filedrop.ModeAsk)
-	FileDropModeAutoAccept = int(filedrop.ModeAutoAccept)
-)
-
-// The per-sender rules exported via gomobile.
-const (
-	FileDropRuleDefault      = int(filedrop.SenderRuleDefault)
-	FileDropRuleAlwaysAccept = int(filedrop.SenderRuleAlwaysAccept)
-	FileDropRuleBlock        = int(filedrop.SenderRuleBlock)
-)
-
-// The transfer states exported via gomobile.
-const (
-	FileDropStatePending      = int(filedrop.StatePending)
-	FileDropStateTransferring = int(filedrop.StateTransferring)
-	FileDropStateCompleted    = int(filedrop.StateCompleted)
-	FileDropStateDeclined     = int(filedrop.StateDeclined)
-	FileDropStateExpired      = int(filedrop.StateExpired)
-	FileDropStateCancelled    = int(filedrop.StateCancelled)
-	FileDropStateFailed       = int(filedrop.StateFailed)
-)
-
-// The failure reasons exported via gomobile.
-const (
-	FileDropReasonNone        = int(filedrop.ReasonNone)
-	FileDropReasonUnreachable = int(filedrop.ReasonUnreachable)
-)
-
-// The event kinds delivered to a FileDropListener.
-const (
-	FileDropEventOffer     = int(filedrop.EventOffer)
-	FileDropEventCompleted = int(filedrop.EventCompleted)
-	FileDropEventFailed    = int(filedrop.EventFailed)
-	FileDropEventWithdrawn = int(filedrop.EventWithdrawn)
-)
-
-// FileDropListener receives transfer events. Calls arrive on background
-// goroutines, so implementations must post to the UI thread themselves.
-type FileDropListener interface {
-	OnFileDropEvent(kind int, transfer *FileDropTransfer)
-}
-
-// FileDropFile is one item of a transfer.
-type FileDropFile struct {
-	Name        string
-	Size        int64
-	ContentType string
-	IsText      bool
-	Text        string
-}
-
-// FileDropTransfer is one history entry.
-type FileDropTransfer struct {
-	ID          string
-	Outgoing    bool
-	PeerKey     string
-	PeerName    string
-	State       int
-	Transferred int64
-	TotalSize   int64
-	// Unix milliseconds, so the platform layer can render the time in the
-	// user's own locale and zone rather than parsing a preformatted string.
-	CreatedAtMillis int64
-	UpdatedAtMillis int64
-	// IsText marks a transfer that is a single inline snippet rather than
-	// files, so the UI can drop the size and offer a copy action instead.
-	IsText bool
-	Error  string
-	Reason int
-
-	files          []*FileDropFile
-	deliveredPaths []string
-}
-
-// FileDropTransferArray wraps transfers for gomobile compatibility.
-type FileDropTransferArray struct {
-	items []*FileDropTransfer
-}
-
-// FileCount returns the number of items in the transfer.
-func (t *FileDropTransfer) FileCount() int {
-	return len(t.files)
-}
-
-// GetFile returns the item at index i, or nil when out of range.
-func (t *FileDropTransfer) GetFile(i int) *FileDropFile {
-	if i < 0 || i >= len(t.files) {
-		return nil
-	}
-	return t.files[i]
-}
-
-// DeliveredPaths returns the delivered file paths joined by newlines, so the
-// platform layer can move them into user-visible storage.
-func (t *FileDropTransfer) DeliveredPaths() string {
-	return strings.Join(t.deliveredPaths, "\n")
-}
-
-// Length returns the number of transfers.
-func (a *FileDropTransferArray) Length() int {
-	return len(a.items)
-}
-
-// Get returns the transfer at index i, or nil when out of range.
-func (a *FileDropTransferArray) Get(i int) *FileDropTransfer {
-	if i < 0 || i >= len(a.items) {
-		return nil
-	}
-	return a.items[i]
-}
-
-func toFileDropTransfer(t filedrop.Transfer) *FileDropTransfer {
-	files := make([]*FileDropFile, 0, len(t.Files))
-	for _, f := range t.Files {
-		files = append(files, &FileDropFile{
-			Name:        f.Name,
-			Size:        f.Size,
-			ContentType: f.ContentType,
-			IsText:      f.Kind == filedrop.KindText,
-			Text:        f.Text,
-		})
-	}
-
-	return &FileDropTransfer{
-		ID:              string(t.ID),
-		Outgoing:        t.Direction == filedrop.DirectionSent,
-		PeerKey:         string(t.PeerKey),
-		PeerName:        t.PeerName,
-		State:           int(t.State),
-		Transferred:     t.Transferred,
-		TotalSize:       t.TotalSize,
-		CreatedAtMillis: unixMillis(t.CreatedAt),
-		UpdatedAtMillis: unixMillis(t.UpdatedAt),
-		IsText:          len(t.Files) == 1 && t.Files[0].Kind == filedrop.KindText,
-		Error:           t.Error,
-		Reason:          int(t.Reason),
-		files:           files,
-		deliveredPaths:  t.DeliveredPaths,
-	}
-}
-
-// unixMillis renders a timestamp for the platform layer, mapping the zero time
-// to 0 so it reads as "unknown" rather than as 1970.
-func unixMillis(t time.Time) int64 {
-	if t.IsZero() {
-		return 0
-	}
-	return t.UnixMilli()
-}

client/android/login.go

@@ -191,49 +191,39 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 	return nil
 }
 
+// loginHintSetter is implemented by both concrete flows (PKCE and device code)
+// but absent from the OAuthFlow interface, hence the assertion below — the same
+// way internal/auth wires it in authenticateWithPKCEFlow.
+type loginHintSetter interface {
+	SetLoginHint(hint string)
+}
+
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV, profileLoginHint(a.cfgPath))
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	return runOAuthFlow(a.ctx, oAuthFlow, urlOpener, nil)
-}
-
-// profileLoginHint returns the stored account email for the profile at cfgPath.
-// An empty hint is deliberate, not a fallback: a fresh profile leaves the
-// choice to the IdP. Switching accounts is done by switching or removing
-// profiles, not by logging out — logout keeps the email.
-func profileLoginHint(cfgPath string) string {
-	if cfgPath == "" {
-		return ""
+	// An empty hint is deliberate, not a fallback: a fresh or logged-out profile
+	// leaves the choice to the IdP, which is how accounts get switched.
+	if a.cfgPath != "" {
+		if hint := readProfileEmail(a.cfgPath); hint != "" {
+			if setter, ok := oAuthFlow.(loginHintSetter); ok {
+				setter.SetLoginHint(hint)
+			}
+		}
 	}
-	return readProfileEmail(cfgPath)
-}
 
-// runOAuthFlow drives an already acquired OAuth flow to a token: requests the
-// flow info, presents the verification URL through the opener and waits for
-// the browser round-trip. Open is called synchronously — it is what marks the
-// surface as opened on the client side, and a fast token's OnLoginSuccess is
-// a no-op until it has, so the dismissal would be dropped rather than
-// delayed. Openers must therefore not block: they post their UI work and
-// return. onWaiting, when set, runs after the URL is shown, right before the
-// blocking wait.
-func runOAuthFlow(ctx context.Context, flow auth.OAuthFlow, urlOpener URLOpener, onWaiting func()) (*auth.TokenInfo, error) {
-	flowInfo, err := flow.RequestAuthInfo(ctx)
+	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
-		return nil, fmt.Errorf("request auth info: %w", err)
+		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)
 	}
 
-	urlOpener.Open(flowInfo.VerificationURIComplete, flowInfo.UserCode)
+	go urlOpener.Open(flowInfo.VerificationURIComplete, flowInfo.UserCode)
 
-	if onWaiting != nil {
-		onWaiting()
-	}
-
-	tokenInfo, err := flow.WaitToken(ctx, flowInfo)
+	tokenInfo, err := oAuthFlow.WaitToken(a.ctx, flowInfo)
 	if err != nil {
-		return nil, fmt.Errorf("wait for token: %w", err)
+		return nil, fmt.Errorf("waiting for browser login failed: %v", err)
 	}
 
 	return &tokenInfo, nil

client/android/profile_manager.go

@@ -22,8 +22,7 @@ type Profile struct {
 	ID   string
 	Name string
 	// Email is the account this profile last logged in with, "" if it never
-	// completed an SSO login. Kept across logouts; cleared when the profile is
-	// removed. See profile_state.go.
+	// completed an SSO login or was logged out. See profile_state.go.
 	Email    string
 	IsActive bool
 }
@@ -201,9 +200,11 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("failed to save config: %w", err)
 	}
 
-	// The stored account email is kept on purpose, matching the desktop and CLI
-	// logout semantics: the next login passes it as the login_hint so the IdP
-	// preselects the account. Removing the profile is what deletes it.
+	// Not fatal: a stale hint costs an account switch, not the logout itself.
+	if err := removeProfileEmail(configPath); err != nil {
+		log.Warnf("failed to clear stored account email for profile %s: %v", id, err)
+	}
+
 	log.Infof("logged out from profile: %s", id)
 	return nil
 }
@@ -223,24 +224,11 @@ func (pm *ProfileManager) RenameProfile(id string, newName string) error {
 
 // RemoveProfile deletes a profile
 func (pm *ProfileManager) RemoveProfile(id string) error {
-	configPath, err := pm.getProfileConfigPath(id)
-	if err != nil {
-		return err
-	}
-
 	// Use ServiceManager (removes profile from profiles/ directory)
 	if err := pm.serviceMgr.RemoveProfile(profilemanager.ID(id), androidUsername); err != nil {
 		return fmt.Errorf("failed to remove profile: %w", err)
 	}
 
-	// The account file is this package's, not the ServiceManager's, so it must
-	// go here. The default profile has a fixed filename, so a recreated one
-	// would otherwise inherit the deleted profile's email as its login_hint.
-	// Not fatal: the profile itself is gone.
-	if err := removeProfileEmail(configPath); err != nil {
-		log.Warnf("failed to remove stored account email for profile %s: %v", id, err)
-	}
-
 	log.Infof("removed profile: %s", id)
 	return nil
 }

client/android/profile_prefs.go

@@ -1,38 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"fmt"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-)
-
-type prefsStore interface {
-	Get(namespace string, v any) (bool, error)
-	Put(namespace string, v any) error
-}
-
-type profilePrefs struct {
-	prefs *profilemanager.Prefs
-}
-
-func newProfilePrefs(configDir, profileID string) (*profilePrefs, error) {
-	if configDir == "" || profileID == "" {
-		return nil, fmt.Errorf("profile prefs require a config dir and profile ID")
-	}
-	pm := NewProfileManager(configDir)
-	prefs, err := pm.serviceMgr.ProfilePrefs(profilemanager.ID(profileID), androidUsername)
-	if err != nil {
-		return nil, fmt.Errorf("resolve profile prefs: %w", err)
-	}
-	return &profilePrefs{prefs: prefs}, nil
-}
-
-func (p *profilePrefs) Get(namespace string, v any) (bool, error) {
-	return p.prefs.Get(namespace, v)
-}
-
-func (p *profilePrefs) Put(namespace string, v any) error {
-	return p.prefs.Put(namespace, v)
-}

client/android/profile_state.go

@@ -48,33 +48,6 @@ func profileAccountPathFor(configPath string) (string, error) {
 	return filepath.Join(filepath.Dir(configPath), stem+profileAccountSuffix), nil
 }
 
-// profileLocationFor splits a profile's config path back into the config dir and
-// the profile ID: <dir>/netbird.cfg is the default profile, while
-// <dir>/profiles/<id>.json is a named one.
-func profileLocationFor(configPath string) (string, string, error) {
-	if configPath == "" {
-		return "", "", fmt.Errorf("empty config path")
-	}
-
-	base := filepath.Base(configPath)
-	dir := filepath.Dir(configPath)
-
-	if base == defaultConfigFilename {
-		return dir, profilemanager.DefaultProfileName, nil
-	}
-
-	if filepath.Base(dir) != profilesSubdir {
-		return "", "", fmt.Errorf("config path %q is outside the profiles directory", configPath)
-	}
-
-	id := strings.TrimSuffix(base, filepath.Ext(base))
-	if !profilemanager.IsValidProfileFilenameStem(profilemanager.ID(id)) {
-		return "", "", fmt.Errorf("config path %q has no valid profile ID", configPath)
-	}
-
-	return filepath.Dir(dir), id, nil
-}
-
 // readProfileEmail returns the account email stored for the profile whose config
 // lives at configPath. A missing or unreadable file yields "", which leaves the
 // account choice to the IdP.
@@ -117,10 +90,10 @@ func writeProfileEmail(configPath string, email string) error {
 	return nil
 }
 
-// removeProfileEmail drops the stored account email. Called on profile removal,
-// not on logout: a logged-out profile keeps its email so the next login passes
-// it as the login_hint, matching the desktop and CLI semantics. Mirrors the
-// desktop UI's RemoveProfileState call.
+// removeProfileEmail drops the stored account email. Called on logout: while the
+// email is on disk it goes out as a login_hint, which would steer the next login
+// straight back into the account just logged out of. Mirrors the desktop UI's
+// RemoveProfileState call.
 func removeProfileEmail(configPath string) error {
 	accountPath, err := profileAccountPathFor(configPath)
 	if err != nil {

client/android/profile_state_test.go

@@ -127,10 +127,10 @@ func TestWriteThenReadProfileEmail(t *testing.T) {
 		t.Fatalf("remove: %v", err)
 	}
 	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email after removal, got %q", got)
+		t.Errorf("expected no email after logout, got %q", got)
 	}
 
-	// Removal may run on a never-logged-in profile, so a second remove must pass.
+	// Logout may run on a never-logged-in profile, so a second remove must pass.
 	if err := removeProfileEmail(configPath); err != nil {
 		t.Fatalf("second remove should be a no-op: %v", err)
 	}

client/android/ssh_client.go

@@ -1,649 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	gossh "golang.org/x/crypto/ssh"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/auth"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbssh "github.com/netbirdio/netbird/client/ssh"
-	"github.com/netbirdio/netbird/client/ssh/detection"
-)
-
-const (
-	sshDialTimeout      = 30 * time.Second
-	sshDetectionTimeout = 5 * time.Second
-)
-
-// PasswordRequiredMarker tells Java to prompt for a password and retry. It is
-// a string because gomobile flattens errors to their message, so a sentinel
-// value would not survive the binding.
-const PasswordRequiredMarker = "netbird-ssh-password-required"
-
-// HostKeyUnknownMarker tells Java to show the fingerprint and, on confirmation,
-// retry with TrustHostKey set. The presented fingerprint is appended after the
-// marker so the prompt can display it and the retry can guard against a key
-// that changed between the two connects. Only regular (non-NetBird) servers
-// reach this: NetBird peers verify against the registry.
-const HostKeyUnknownMarker = "netbird-ssh-hostkey-unknown"
-
-var (
-	errPasswordRequired = errors.New(PasswordRequiredMarker)
-	errClientClosed     = errors.New("ssh client closed")
-)
-
-// errHostKeyUnknown carries the presented fingerprint so Connect can build the
-// marker message the Java side parses.
-type errHostKeyUnknown struct {
-	fingerprint string
-}
-
-func (e *errHostKeyUnknown) Error() string {
-	return HostKeyUnknownMarker + ":" + e.fingerprint
-}
-
-// SSHTerminalListener receives SSH session events. It is implemented in Java.
-//
-// All callbacks are invoked from goroutines and may run concurrently with each
-// other; the implementation must be safe to call from any thread.
-type SSHTerminalListener interface {
-	OnConnected()
-	OnData(data []byte)
-	OnClose(reason string)
-	OnError(message string)
-}
-
-// SSHClient is a NetBird-aware SSH client exposed to Java via gomobile.
-//
-// It dials through the running NetBird tunnel and runs a standard SSH session
-// on top with PTY enabled. Host-key verification uses the NetBird-provided
-// peer SSH host keys, identical to the desktop client.
-type SSHClient struct {
-	nb        *Client
-	mu        sync.Mutex
-	listener  SSHTerminalListener
-	urlOpener URLOpener
-
-	sshClient *gossh.Client
-	session   *gossh.Session
-	stdin     io.WriteCloser
-	closed    bool
-
-	// gen identifies the current connection attempt. Connect and Close bump it,
-	// so an in-flight dial or a reader left over from a previous connection
-	// finds itself stale and stays silent instead of publishing OnConnected or
-	// OnClose for a connection the caller already abandoned.
-	gen        uint64
-	dialCancel context.CancelFunc
-
-	// knownHostsConfigDir and knownHostsProfile locate the TOFU store for
-	// regular SSH servers in the profile's preferences. Java supplies them,
-	// since an overlay IP is a different host under a different profile. Empty
-	// until set: without them a regular server cannot be verified and Connect
-	// refuses one.
-	knownHostsConfigDir string
-	knownHostsProfile   string
-	// trustHostKey carries the fingerprint the user confirmed on a previous
-	// attempt, so the retry accepts exactly that key and persists it.
-	trustHostKey string
-}
-
-// NewSSHClient creates a new SSH client bound to the running NetBird Client.
-func NewSSHClient(c *Client) *SSHClient {
-	return &SSHClient{nb: c}
-}
-
-// SetListener registers the Java listener. Must be called before Connect to
-// receive any events.
-func (s *SSHClient) SetListener(l SSHTerminalListener) {
-	s.mu.Lock()
-	s.listener = l
-	s.mu.Unlock()
-}
-
-// SetURLOpener registers the Java URL opener used to display the device-code
-// authorization page in a Custom Tabs window when the target peer requires
-// JWT authentication. Must be set before Connect to be effective.
-func (s *SSHClient) SetURLOpener(opener URLOpener) {
-	s.mu.Lock()
-	s.urlOpener = opener
-	s.mu.Unlock()
-}
-
-// SetKnownHostsStore points the TOFU host-key store at a profile's preferences.
-// Must be set before connecting to a regular SSH server; without it such a
-// server cannot be verified and Connect refuses one.
-func (s *SSHClient) SetKnownHostsStore(configDir, profileID string) {
-	s.mu.Lock()
-	s.knownHostsConfigDir = configDir
-	s.knownHostsProfile = profileID
-	s.mu.Unlock()
-}
-
-// TrustHostKey records the fingerprint the user confirmed for a regular server,
-// so the next Connect accepts that exact key and adds it to the known-hosts
-// store. Passing a fingerprint that no longer matches makes the connect fail
-// rather than trust a key that changed since the prompt.
-func (s *SSHClient) TrustHostKey(fingerprint string) {
-	s.mu.Lock()
-	s.trustHostKey = fingerprint
-	s.mu.Unlock()
-}
-
-// Connect dials the SSH server through the NetBird tunnel and performs the
-// SSH handshake. It auto-detects the server type via SSH banner inspection
-// and selects the appropriate authentication path:
-//
-//   - NetBird-SSH server requiring JWT: launches the OAuth 2.0 device-code
-//     flow, opens the verification URL through the registered URLOpener, and
-//     uses the resulting token as the SSH password. Host-key verification
-//     uses the NetBird peer registry.
-//   - NetBird-SSH server without JWT: authenticates with the NetBird SSH
-//     private key. Host-key verification uses the NetBird peer registry.
-//   - Regular SSH server (e.g. OpenSSH): authenticates with the NetBird key
-//     first (so a user-installed NetBird public key works), then falls back
-//     to the supplied password if non-empty. Host-key verification is
-//     trust-on-first-use against the per-profile known-hosts store.
-//
-// The password parameter is only consulted for regular SSH servers.
-func (s *SSHClient) Connect(host string, port int, user, password string) error {
-	if port < 1 || port > 65535 {
-		return fmt.Errorf("invalid port: %d", port)
-	}
-
-	cfg, cfgPath, cc := s.nb.authSnapshot()
-	if cc == nil {
-		return errors.New("netbird client not running")
-	}
-	if cfg == nil {
-		return errors.New("netbird config not loaded")
-	}
-	engine := cc.Engine()
-	if engine == nil {
-		return errors.New("netbird engine not available")
-	}
-
-	s.mu.Lock()
-	s.gen++
-	gen := s.gen
-	s.mu.Unlock()
-
-	serverType := detectServerType(host, port)
-	log.Debugf("SSH server type: %s", serverType)
-
-	authMethods, hostKeyCallback, err := s.buildAuth(cfg, cfgPath, engine, serverType, password)
-	if err != nil {
-		return err
-	}
-
-	clientConfig := &gossh.ClientConfig{
-		User:            user,
-		Auth:            authMethods,
-		HostKeyCallback: hostKeyCallback,
-		Timeout:         sshDialTimeout,
-	}
-	err = s.dialAndHandshake(gen, host, port, clientConfig)
-
-	// An unknown host key is a prompt, not a failure: return the marker intact
-	// (rootCause would unwrap it) so Java can show the fingerprint and retry.
-	var unknownHost *errHostKeyUnknown
-	if errors.As(err, &unknownHost) {
-		return errors.New(unknownHost.Error())
-	}
-
-	// A regular server may still accept a password, so let the caller ask for
-	// one instead of failing. NetBird servers never use a password, so a
-	// failure there is genuine.
-	if err != nil && serverType != detection.ServerTypeNetBirdJWT &&
-		serverType != detection.ServerTypeNetBirdNoJWT && isAuthFailure(err) &&
-		passwordCouldHelp(err, password != "") {
-		return errPasswordRequired
-	}
-	if err != nil {
-		return rootCause(err)
-	}
-	return nil
-}
-
-// StartSession requests a PTY and starts an interactive shell. Output from
-// the session is forwarded to the listener via OnData.
-func (s *SSHClient) StartSession(cols, rows int) error {
-	err := s.startSession(cols, rows)
-	if err != nil {
-		log.Infof("SSH: start session failed: %v", err)
-		return rootCause(err)
-	}
-	return nil
-}
-
-// Write sends data to the SSH session stdin.
-func (s *SSHClient) Write(data []byte) error {
-	s.mu.Lock()
-	stdin := s.stdin
-	s.mu.Unlock()
-	if stdin == nil {
-		return errors.New("ssh session not started")
-	}
-	if _, err := stdin.Write(data); err != nil {
-		return fmt.Errorf("write stdin: %w", err)
-	}
-	return nil
-}
-
-// Resize updates the PTY window size.
-func (s *SSHClient) Resize(cols, rows int) error {
-	s.mu.Lock()
-	session := s.session
-	s.mu.Unlock()
-	if session == nil {
-		return errors.New("ssh session not started")
-	}
-	return session.WindowChange(rows, cols)
-}
-
-// Reset makes a closed client usable for another Connect: Close leaves the
-// one-shot guard set, and clearing it lets the same client back a reconnect.
-func (s *SSHClient) Reset() {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.closed = false
-}
-
-// Close terminates the SSH session and underlying connection. Safe to call
-// multiple times.
-func (s *SSHClient) Close() error {
-	s.mu.Lock()
-	s.gen++
-	if s.dialCancel != nil {
-		s.dialCancel()
-		s.dialCancel = nil
-	}
-	sshClient := s.sshClient
-	session := s.session
-	stdin := s.stdin
-	s.sshClient = nil
-	s.session = nil
-	s.stdin = nil
-	notify := !s.closed
-	s.closed = true
-	listener := s.listener
-	s.mu.Unlock()
-
-	if stdin != nil {
-		if err := stdin.Close(); err != nil {
-			log.Debugf("ssh: stdin close: %v", err)
-		}
-	}
-	if session != nil {
-		if err := session.Close(); err != nil && !errors.Is(err, io.EOF) {
-			log.Debugf("ssh: session close: %v", err)
-		}
-	}
-	var firstErr error
-	if sshClient != nil {
-		if err := sshClient.Close(); err != nil {
-			firstErr = err
-		}
-	}
-	if notify && listener != nil {
-		listener.OnClose("closed by client")
-	}
-	return firstErr
-}
-
-func (s *SSHClient) startSession(cols, rows int) error {
-	log.Debugf("SSH: starting session %dx%d", cols, rows)
-	s.mu.Lock()
-	sshClient := s.sshClient
-	gen := s.gen
-	s.mu.Unlock()
-
-	if sshClient == nil {
-		return errors.New("ssh client not connected")
-	}
-
-	pty, err := nbssh.StartPTYSession(sshClient, cols, rows)
-	if err != nil {
-		return err
-	}
-
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		closeQuiet(pty.Session, "stale session")
-		return errClientClosed
-	}
-	s.session = pty.Session
-	s.stdin = pty.Stdin
-	s.mu.Unlock()
-
-	readerDone := make(chan string, 2)
-	go func() { readerDone <- s.readLoop(pty.Stdout, "stdout") }()
-	go func() { readerDone <- s.readLoop(pty.Stderr, "stderr") }()
-	go func() {
-		reason := <-readerDone
-		if second := <-readerDone; reason == "" {
-			reason = second
-		}
-		s.notifyClose(gen, reason)
-	}()
-	log.Debug("SSH: session started, shell running")
-	return nil
-}
-
-func (s *SSHClient) buildAuth(cfg *profilemanager.Config, cfgPath string, engine *internal.Engine,
-	serverType detection.ServerType, password string) ([]gossh.AuthMethod, gossh.HostKeyCallback, error) {
-
-	switch serverType {
-	case detection.ServerTypeNetBirdJWT:
-		token, err := s.requestJWTToken(cfg, cfgPath)
-		if err != nil {
-			return nil, nil, fmt.Errorf("jwt: %w", err)
-		}
-		auths := []gossh.AuthMethod{gossh.Password(token)}
-		return auths, nbssh.CreateHostKeyCallback(nbssh.PeerKeyLookup(engine.GetPeerSSHKey)), nil
-
-	case detection.ServerTypeNetBirdNoJWT:
-		if cfg.SSHKey == "" {
-			return nil, nil, errors.New("no NetBird SSH key available")
-		}
-		signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey))
-		if err != nil {
-			return nil, nil, fmt.Errorf("parse netbird ssh key: %w", err)
-		}
-		auths := []gossh.AuthMethod{gossh.PublicKeys(signer)}
-		return auths, nbssh.CreateHostKeyCallback(nbssh.PeerKeyLookup(engine.GetPeerSSHKey)), nil
-
-	case detection.ServerTypeRegular:
-		var auths []gossh.AuthMethod
-		if cfg.SSHKey != "" {
-			if signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey)); err == nil {
-				auths = append(auths, gossh.PublicKeys(signer))
-			} else {
-				log.Debugf("ssh: parse netbird key for regular auth: %v", err)
-			}
-		}
-		if password != "" {
-			pw := password
-			auths = append(auths, gossh.Password(pw))
-			auths = append(auths, gossh.KeyboardInteractive(func(_, _ string, questions []string, _ []bool) ([]string, error) {
-				answers := make([]string, len(questions))
-				for i := range questions {
-					answers[i] = pw
-				}
-				return answers, nil
-			}))
-		}
-		if len(auths) == 0 {
-			// Nothing to offer at all: ask for a password rather than failing,
-			// so the caller can retry once the user supplies one.
-			return nil, nil, errPasswordRequired
-		}
-		callback, err := s.tofuHostKeyCallback()
-		if err != nil {
-			return nil, nil, err
-		}
-		return auths, callback, nil
-
-	default:
-		return nil, nil, fmt.Errorf("unsupported SSH server type: %v", serverType)
-	}
-}
-
-// tofuHostKeyCallback verifies a regular server's host key against the
-// per-profile known-hosts store. An unknown host returns errHostKeyUnknown so
-// Java can show the fingerprint and, once confirmed, retry with the key
-// trusted; a changed key is rejected outright, as OpenSSH does. When the user
-// has confirmed a fingerprint, the callback accepts exactly that key and
-// appends it to the store.
-func (s *SSHClient) tofuHostKeyCallback() (gossh.HostKeyCallback, error) {
-	s.mu.Lock()
-	configDir := s.knownHostsConfigDir
-	profileID := s.knownHostsProfile
-	trusted := s.trustHostKey
-	s.mu.Unlock()
-
-	if configDir == "" || profileID == "" {
-		return nil, errors.New("no known-hosts store configured for regular SSH")
-	}
-
-	store, err := openKnownHostsStore(configDir, profileID)
-	if err != nil {
-		return nil, fmt.Errorf("load known-hosts store: %w", err)
-	}
-
-	return func(hostname string, remote net.Addr, key gossh.PublicKey) error {
-		verdict, err := store.verify(hostname, remote, key)
-		if err != nil {
-			return err
-		}
-		if verdict == hostKeyMatched {
-			return nil
-		}
-		if verdict == hostKeyChanged {
-			return fmt.Errorf("SSH host key changed for %s (possible attack)", hostname)
-		}
-
-		fingerprint := gossh.FingerprintSHA256(key)
-		if trusted == "" {
-			return &errHostKeyUnknown{fingerprint: fingerprint}
-		}
-		if trusted != fingerprint {
-			return fmt.Errorf("SSH host key changed since it was confirmed for %s", hostname)
-		}
-		if err := store.append(hostname, remote, key); err != nil {
-			return fmt.Errorf("persist trusted host key: %w", err)
-		}
-		// The confirmation is spent: now that the key is stored, a later
-		// reconnect must verify against the file, not re-accept this fingerprint.
-		s.mu.Lock()
-		s.trustHostKey = ""
-		s.mu.Unlock()
-		return nil
-	}, nil
-}
-
-func (s *SSHClient) requestJWTToken(cfg *profilemanager.Config, cfgPath string) (string, error) {
-	s.mu.Lock()
-	urlOpener := s.urlOpener
-	s.mu.Unlock()
-	if urlOpener == nil {
-		return "", errors.New("URL opener not configured for JWT auth")
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	flow, err := auth.NewOAuthFlow(ctx, cfg, false, true, profileLoginHint(cfgPath))
-	if err != nil {
-		return "", fmt.Errorf("create oauth flow: %w", err)
-	}
-
-	// The status callback covers the browser round-trip, which would
-	// otherwise leave the terminal blank.
-	tokenInfo, err := runOAuthFlow(ctx, flow, urlOpener, func() {
-		s.notifyStatus("Waiting for browser authentication...")
-	})
-	if err != nil {
-		return "", err
-	}
-
-	token := tokenInfo.GetTokenToUse()
-	if token == "" {
-		return "", errors.New("empty token returned by IdP")
-	}
-
-	// Tells the client the browser round-trip is over so it can dismiss the
-	// surface it opened, the same way the login and session-extend flows do.
-	// Without it the Custom Tab stays in front of the terminal even though the
-	// token has already been collected.
-	urlOpener.OnLoginSuccess()
-
-	return token, nil
-}
-
-func (s *SSHClient) dialAndHandshake(gen uint64, host string, port int, clientConfig *gossh.ClientConfig) error {
-	addr := net.JoinHostPort(host, strconv.Itoa(port))
-	ctx, cancel := context.WithTimeout(context.Background(), sshDialTimeout)
-	defer cancel()
-
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		return errClientClosed
-	}
-	s.dialCancel = cancel
-	s.mu.Unlock()
-
-	var dialer net.Dialer
-	conn, err := dialer.DialContext(ctx, "tcp", addr)
-	if err != nil {
-		return fmt.Errorf("dial %s: %w", addr, err)
-	}
-
-	client, err := nbssh.Handshake(ctx, conn, addr, clientConfig)
-	if err != nil {
-		return err
-	}
-
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		closeQuiet(client, "stale ssh client")
-		return errClientClosed
-	}
-	s.sshClient = client
-	listener := s.listener
-	s.mu.Unlock()
-
-	if listener != nil {
-		listener.OnConnected()
-	}
-	return nil
-}
-
-func (s *SSHClient) readLoop(r io.Reader, name string) string {
-	buf := make([]byte, 4096)
-	for {
-		n, err := r.Read(buf)
-		if n > 0 {
-			s.mu.Lock()
-			listener := s.listener
-			s.mu.Unlock()
-			if listener != nil {
-				chunk := make([]byte, n)
-				copy(chunk, buf[:n])
-				listener.OnData(chunk)
-			}
-		}
-		if err != nil {
-			// EOF is a normal shell exit, so report it without a reason.
-			if errors.Is(err, io.EOF) {
-				return ""
-			}
-			log.Debugf("ssh %s read: %v", name, err)
-			return rootCause(err).Error()
-		}
-	}
-}
-
-// notifyStatus writes a progress line to the terminal through the normal
-// output path, so long steps are visible while nothing else is arriving.
-func (s *SSHClient) notifyStatus(text string) {
-	s.mu.Lock()
-	listener := s.listener
-	s.mu.Unlock()
-	if listener != nil {
-		listener.OnData([]byte("\r\n\x1b[33m" + text + "\x1b[0m\r\n"))
-	}
-}
-
-func (s *SSHClient) notifyClose(gen uint64, reason string) {
-	s.mu.Lock()
-	if gen != s.gen || s.closed {
-		s.mu.Unlock()
-		return
-	}
-	s.closed = true
-	listener := s.listener
-	s.mu.Unlock()
-	if listener != nil {
-		listener.OnClose(reason)
-	}
-}
-
-func closeQuiet(c io.Closer, label string) {
-	if c == nil {
-		return
-	}
-	if err := c.Close(); err != nil && !errors.Is(err, io.EOF) {
-		log.Debugf("ssh: close %s: %v", label, err)
-	}
-}
-
-func detectServerType(host string, port int) detection.ServerType {
-	ctx, cancel := context.WithTimeout(context.Background(), sshDetectionTimeout)
-	defer cancel()
-
-	dialer := &net.Dialer{}
-	serverType, err := detection.DetectSSHServerType(ctx, dialer, host, port)
-	if err != nil {
-		log.Debugf("ssh: server detection failed: %v (assuming regular SSH)", err)
-		return detection.ServerTypeRegular
-	}
-	return serverType
-}
-
-// rootCause returns the innermost error of a %w chain, so the terminal shows
-// "i/o timeout" rather than every layer that added context on the way up.
-func rootCause(err error) error {
-	for {
-		// A joined error has no single root, so keep it as-is.
-		if _, ok := err.(interface{ Unwrap() []error }); ok {
-			return err
-		}
-		next := errors.Unwrap(err)
-		if next == nil {
-			return err
-		}
-		err = next
-	}
-}
-
-// isAuthFailure distinguishes credential rejection from dial, timeout and
-// host-key errors, which retrying with a password would not fix.
-func isAuthFailure(err error) bool {
-	if errors.Is(err, errPasswordRequired) {
-		return true
-	}
-	var partial *gossh.PartialSuccessError
-	if errors.As(err, &partial) {
-		return true
-	}
-	return strings.Contains(err.Error(), "unable to authenticate")
-}
-
-// passwordCouldHelp reports whether prompting for a password again can change
-// the outcome. gossh lists a method under "attempted methods" only when the
-// server offered it, so a supplied password that was never attempted means the
-// server does not accept passwords and the real error should surface instead.
-func passwordCouldHelp(err error, passwordOffered bool) bool {
-	if !passwordOffered {
-		return true
-	}
-	msg := err.Error()
-	return strings.Contains(msg, "password") || strings.Contains(msg, "keyboard-interactive")
-}

client/android/ssh_known_hosts.go

@@ -1,168 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"bytes"
-	"net"
-	"strconv"
-	"strings"
-	"sync"
-
-	gossh "golang.org/x/crypto/ssh"
-	"golang.org/x/crypto/ssh/knownhosts"
-)
-
-const knownHostsNamespace = "ssh"
-
-const (
-	hostKeyUnknown hostKeyVerdict = iota
-	hostKeyMatched
-	hostKeyChanged
-)
-
-var knownHostsMu sync.Mutex
-
-type hostKeyVerdict uint8
-
-type knownHostsSection struct {
-	KnownHosts []string `json:"knownHosts"`
-}
-
-type knownHostsStore struct {
-	prefs prefsStore
-}
-
-// RemoveKnownHost deletes every known-hosts entry for host:port from the
-// profile's store, so a host trusted for a session that is being deleted does
-// not linger. Java calls this only once no session targets that host, so a
-// shared host stays trusted. A missing entry is not an error: the goal state
-// is "absent".
-func RemoveKnownHost(configDir, profileID, host string, port int) error {
-	store, err := openKnownHostsStore(configDir, profileID)
-	if err != nil {
-		return err
-	}
-	return store.removeHost(host, port)
-}
-
-func openKnownHostsStore(configDir, profileID string) (*knownHostsStore, error) {
-	prefs, err := newProfilePrefs(configDir, profileID)
-	if err != nil {
-		return nil, err
-	}
-	return &knownHostsStore{prefs: prefs}, nil
-}
-
-func (st *knownHostsStore) verify(hostname string, remote net.Addr, key gossh.PublicKey) (hostKeyVerdict, error) {
-	lines, err := st.lines()
-	if err != nil {
-		return hostKeyUnknown, err
-	}
-	targets := knownHostsTargets(hostname, remote)
-
-	verdict := hostKeyUnknown
-	for _, line := range lines {
-		pubKey, ok := knownHostsLineKey(line, targets)
-		if !ok {
-			continue
-		}
-		if pubKey.Type() == key.Type() && bytes.Equal(pubKey.Marshal(), key.Marshal()) {
-			return hostKeyMatched, nil
-		}
-		verdict = hostKeyChanged
-	}
-	return verdict, nil
-}
-
-func (st *knownHostsStore) append(hostname string, remote net.Addr, key gossh.PublicKey) error {
-	line := knownhosts.Line(knownHostsTargets(hostname, remote), key)
-
-	knownHostsMu.Lock()
-	defer knownHostsMu.Unlock()
-
-	lines, err := st.lines()
-	if err != nil {
-		return err
-	}
-	return st.prefs.Put(knownHostsNamespace, knownHostsSection{KnownHosts: append(lines, line)})
-}
-
-func (st *knownHostsStore) removeHost(host string, port int) error {
-	target := knownhosts.Normalize(net.JoinHostPort(host, strconv.Itoa(port)))
-
-	knownHostsMu.Lock()
-	defer knownHostsMu.Unlock()
-
-	lines, err := st.lines()
-	if err != nil {
-		return err
-	}
-	kept := make([]string, 0, len(lines))
-	for _, line := range lines {
-		if knownHostsLineMatches(line, target) {
-			continue
-		}
-		kept = append(kept, line)
-	}
-	if len(kept) == len(lines) {
-		return nil
-	}
-	return st.prefs.Put(knownHostsNamespace, knownHostsSection{KnownHosts: kept})
-}
-
-func (st *knownHostsStore) lines() ([]string, error) {
-	var section knownHostsSection
-	if _, err := st.prefs.Get(knownHostsNamespace, &section); err != nil {
-		return nil, err
-	}
-	return section.KnownHosts, nil
-}
-
-func knownHostsTargets(hostname string, remote net.Addr) []string {
-	targets := []string{knownhosts.Normalize(hostname)}
-	if remote != nil {
-		if normalized := knownhosts.Normalize(remote.String()); normalized != targets[0] {
-			targets = append(targets, normalized)
-		}
-	}
-	return targets
-}
-
-func knownHostsLineKey(line string, targets []string) (gossh.PublicKey, bool) {
-	trimmed := strings.TrimSpace(line)
-	if trimmed == "" || strings.HasPrefix(trimmed, "#") {
-		return nil, false
-	}
-	_, hosts, pubKey, _, _, err := gossh.ParseKnownHosts([]byte(trimmed))
-	if err != nil {
-		return nil, false
-	}
-	for _, host := range hosts {
-		for _, target := range targets {
-			if host == target {
-				return pubKey, true
-			}
-		}
-	}
-	return nil, false
-}
-
-// knownHostsLineMatches reports whether a known-hosts line's address list
-// contains the normalized target. Comment and blank lines never match.
-func knownHostsLineMatches(line, target string) bool {
-	trimmed := strings.TrimSpace(line)
-	if trimmed == "" || strings.HasPrefix(trimmed, "#") {
-		return false
-	}
-	fields := strings.Fields(trimmed)
-	if len(fields) == 0 {
-		return false
-	}
-	for _, addr := range strings.Split(fields[0], ",") {
-		if addr == target {
-			return true
-		}
-	}
-	return false
-}

client/android/ssh_sessions.go

@@ -1,104 +0,0 @@
-//go:build android
-
-package android
-
-const (
-	sshSessionsNamespace = "ssh-sessions"
-	maxStoredSSHSessions = 50
-)
-
-type sshSessionRecord struct {
-	ID   string `json:"id"`
-	Host string `json:"host"`
-	Port int    `json:"port"`
-	User string `json:"user"`
-}
-
-type sshSessionsSection struct {
-	Sessions []sshSessionRecord `json:"sessions"`
-}
-
-// SSHSessionEntry is one stored SSH session, without any credential.
-type SSHSessionEntry struct {
-	ID   string
-	Host string
-	Port int
-	User string
-}
-
-// SSHSessionArray wraps stored SSH sessions for gomobile compatibility.
-type SSHSessionArray struct {
-	items []*SSHSessionEntry
-}
-
-// NewSSHSessionArray creates an empty session array to fill via Add.
-func NewSSHSessionArray() *SSHSessionArray {
-	return &SSHSessionArray{}
-}
-
-// Add appends a session entry, oldest first.
-func (a *SSHSessionArray) Add(id, host string, port int, user string) {
-	a.items = append(a.items, &SSHSessionEntry{ID: id, Host: host, Port: port, User: user})
-}
-
-// Length returns the number of entries.
-func (a *SSHSessionArray) Length() int {
-	return len(a.items)
-}
-
-// Get returns the entry at index i, or nil when out of range.
-func (a *SSHSessionArray) Get(i int) *SSHSessionEntry {
-	if i < 0 || i >= len(a.items) {
-		return nil
-	}
-	return a.items[i]
-}
-
-// SSHSessionStore reads and writes a profile's stored SSH sessions.
-type SSHSessionStore struct {
-	prefs prefsStore
-}
-
-// NewSSHSessionStore opens the session store of the given profile.
-func NewSSHSessionStore(configDir, profileID string) (*SSHSessionStore, error) {
-	prefs, err := newProfilePrefs(configDir, profileID)
-	if err != nil {
-		return nil, err
-	}
-	return &SSHSessionStore{prefs: prefs}, nil
-}
-
-// Load returns the stored sessions, oldest first.
-func (s *SSHSessionStore) Load() (*SSHSessionArray, error) {
-	var section sshSessionsSection
-	if _, err := s.prefs.Get(sshSessionsNamespace, &section); err != nil {
-		return nil, err
-	}
-
-	out := NewSSHSessionArray()
-	for _, record := range section.Sessions {
-		if record.ID == "" || record.Host == "" {
-			continue
-		}
-		out.Add(record.ID, record.Host, record.Port, record.User)
-	}
-	return out, nil
-}
-
-// Save replaces the stored sessions, keeping only the newest entries when the
-// list exceeds the storage cap.
-func (s *SSHSessionStore) Save(sessions *SSHSessionArray) error {
-	var items []*SSHSessionEntry
-	if sessions != nil {
-		items = sessions.items
-	}
-	if len(items) > maxStoredSSHSessions {
-		items = items[len(items)-maxStoredSSHSessions:]
-	}
-
-	records := make([]sshSessionRecord, 0, len(items))
-	for _, item := range items {
-		records = append(records, sshSessionRecord{ID: item.ID, Host: item.Host, Port: item.Port, User: item.User})
-	}
-	return s.prefs.Put(sshSessionsNamespace, sshSessionsSection{Sessions: records})
-}

client/anonymize/anonymize.go

@@ -305,12 +305,6 @@ func (a *Anonymizer) AnonymizeDomain(domain string) string {
 		return domain
 	}
 
-	// A reverse zone names an address prefix, so it follows the address rules,
-	// which also keeps its digit labels intact.
-	if zone, ok := a.anonymizeReverseZone(baseDomain); ok {
-		return withTrailingDot(zone, hasDot)
-	}
-
 	if suffix := protectedSuffix(baseDomain); suffix != "" {
 		if a.level < LevelStrict || baseDomain == suffix || suffix == infraDomain {
 			return domain
@@ -411,10 +405,6 @@ func (a *Anonymizer) AnonymizeString(str string) string {
 	ipv4Regex := regexp.MustCompile(`\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b`)
 	ipv6Regex := regexp.MustCompile(`\b([0-9a-fA-F:]+:+[0-9a-fA-F]{0,4})(?:%[0-9a-zA-Z]+)?(?:\/[0-9]{1,3})?(?::[0-9]{1,5})?\b`)
 
-	// Reverse zones go first and are then held out of the passes below: their
-	// labels are digits, which the address patterns would otherwise consume.
-	str, restoreZones := a.replaceReverseZones(str)
-
 	str = ipv4Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 	str = ipv6Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 
@@ -435,7 +425,7 @@ func (a *Anonymizer) AnonymizeString(str string) string {
 		str = wgKeyRegex.ReplaceAllStringFunc(str, a.AnonymizeWGKey)
 	}
 
-	return restoreZones(str)
+	return str
 }
 
 // sortedDomains returns the domain mappings longest-first, so a full-FQDN

client/anonymize/reverse_zone.go

@@ -1,174 +0,0 @@
-package anonymize
-
-import (
-	"encoding/hex"
-	"net/netip"
-	"regexp"
-	"strconv"
-	"strings"
-)
-
-const (
-	reverseZoneSuffixV4 = ".in-addr.arpa"
-	reverseZoneSuffixV6 = ".ip6.arpa"
-
-	v6Nibbles = 32
-	v4Octets  = 4
-)
-
-// reverseZoneRegexes match a reverse zone or a full reverse name in free text.
-// They are applied before the address passes of AnonymizeString, whose IPv4
-// pattern would otherwise consume the digit labels of a zone and replace parts
-// of it with unrelated addresses.
-var reverseZoneRegexes = []*regexp.Regexp{
-	regexp.MustCompile(`(?:[0-9]{1,3}\.){1,4}in-addr\.arpa\b`),
-	regexp.MustCompile(`(?:[0-9a-fA-F]\.){1,32}ip6\.arpa\b`),
-}
-
-// anonymizeReverseZone maps a reverse zone to the zone of the anonymized form
-// of the prefix it encodes, so it follows the address rules rather than the
-// domain ones: the zone of an address that is preserved is preserved too, and
-// the zone of one that is replaced names the replacement. This keeps a reverse
-// zone recognizable as such, and consistent with the addresses it belongs to
-// elsewhere in the same output. It reports false for anything that is not a
-// reverse zone.
-func (a *Anonymizer) anonymizeReverseZone(domain string) (string, bool) {
-	prefix, labelCount, suffix, ok := parseReverseZone(domain)
-	if !ok {
-		return "", false
-	}
-
-	anonymized := a.AnonymizeIP(prefix)
-	if anonymized == prefix {
-		return domain, true
-	}
-
-	return reverseZoneName(anonymized, labelCount) + suffix, true
-}
-
-// replaceReverseZones anonymizes every reverse zone in str and swaps each one
-// for a placeholder, returning a function that puts the anonymized zones back.
-// The placeholders carry no dots, digits or colons, so no later pass matches
-// them.
-func (a *Anonymizer) replaceReverseZones(str string) (string, func(string) string) {
-	var zones []string
-
-	for _, re := range reverseZoneRegexes {
-		str = re.ReplaceAllStringFunc(str, func(match string) string {
-			zone, ok := a.anonymizeReverseZone(match)
-			if !ok {
-				return match
-			}
-
-			zones = append(zones, zone)
-			return reverseZonePlaceholder(len(zones) - 1)
-		})
-	}
-
-	if len(zones) == 0 {
-		return str, func(s string) string { return s }
-	}
-
-	return str, func(s string) string {
-		for i, zone := range zones {
-			s = strings.ReplaceAll(s, reverseZonePlaceholder(i), zone)
-		}
-		return s
-	}
-}
-
-func reverseZonePlaceholder(index int) string {
-	return "\x00reversezone" + strconv.Itoa(index) + "\x00"
-}
-
-// parseReverseZone turns a reverse zone into the address of the prefix its
-// labels spell backwards, padding the absent low-order part with zeroes, and
-// returns the label count and zone suffix so the name can be rebuilt.
-func parseReverseZone(domain string) (netip.Addr, int, string, bool) {
-	lower := strings.ToLower(domain)
-
-	switch {
-	case strings.HasSuffix(lower, reverseZoneSuffixV4):
-		labels := strings.Split(strings.TrimSuffix(lower, reverseZoneSuffixV4), ".")
-		addr, ok := reverseZoneAddrV4(labels)
-		return addr, len(labels), reverseZoneSuffixV4, ok
-	case strings.HasSuffix(lower, reverseZoneSuffixV6):
-		labels := strings.Split(strings.TrimSuffix(lower, reverseZoneSuffixV6), ".")
-		addr, ok := reverseZoneAddrV6(labels)
-		return addr, len(labels), reverseZoneSuffixV6, ok
-	default:
-		return netip.Addr{}, 0, "", false
-	}
-}
-
-func reverseZoneAddrV4(labels []string) (netip.Addr, bool) {
-	if len(labels) == 0 || len(labels) > v4Octets {
-		return netip.Addr{}, false
-	}
-
-	var octets [v4Octets]byte
-	for i, label := range labels {
-		octet, err := strconv.ParseUint(label, 10, 8)
-		if err != nil {
-			return netip.Addr{}, false
-		}
-		octets[len(labels)-1-i] = byte(octet)
-	}
-
-	return netip.AddrFrom4(octets), true
-}
-
-func reverseZoneAddrV6(labels []string) (netip.Addr, bool) {
-	if len(labels) == 0 || len(labels) > v6Nibbles {
-		return netip.Addr{}, false
-	}
-
-	nibbles := make([]byte, 0, v6Nibbles)
-	for i := len(labels) - 1; i >= 0; i-- {
-		if len(labels[i]) != 1 || !isHexDigit(labels[i][0]) {
-			return netip.Addr{}, false
-		}
-		nibbles = append(nibbles, labels[i][0])
-	}
-	for len(nibbles) < v6Nibbles {
-		nibbles = append(nibbles, '0')
-	}
-
-	var groups []string
-	for i := 0; i < len(nibbles); i += 4 {
-		groups = append(groups, string(nibbles[i:i+4]))
-	}
-
-	addr, err := netip.ParseAddr(strings.Join(groups, ":"))
-	if err != nil {
-		return netip.Addr{}, false
-	}
-
-	return addr, true
-}
-
-// reverseZoneName spells the first labelCount labels of addr backwards, the
-// inverse of parseReverseZone, without the zone suffix.
-func reverseZoneName(addr netip.Addr, labelCount int) string {
-	labels := make([]string, 0, labelCount)
-
-	if addr.Is4() {
-		octets := addr.As4()
-		for i := labelCount - 1; i >= 0; i-- {
-			labels = append(labels, strconv.Itoa(int(octets[i])))
-		}
-		return strings.Join(labels, ".")
-	}
-
-	address := addr.As16()
-	nibbles := hex.EncodeToString(address[:])
-	for i := labelCount - 1; i >= 0; i-- {
-		labels = append(labels, string(nibbles[i]))
-	}
-
-	return strings.Join(labels, ".")
-}
-
-func isHexDigit(c byte) bool {
-	return c >= '0' && c <= '9' || c >= 'a' && c <= 'f' || c >= 'A' && c <= 'F'
-}

client/anonymize/reverse_zone_test.go

@@ -1,171 +0,0 @@
-package anonymize
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func newLeveledAnonymizer(level Level) *Anonymizer {
-	a := NewAnonymizer(DefaultAddresses())
-	a.SetLevel(level)
-	return a
-}
-
-// TestAnonymizeDomainReverseZone covers reverse zones going through the address
-// rules instead of the domain ones, so a zone stays a zone and an address that
-// is preserved keeps the zone that names it.
-func TestAnonymizeDomainReverseZone(t *testing.T) {
-	// 100.64.0.0/10 is the overlay range, which is CGNAT: preserved at the
-	// default level and replaced from the internal pool at the strict one
-	const overlayZone = "64.100.in-addr.arpa"
-
-	t.Run("overlay zone preserved at the default level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-		assert.Equal(t, overlayZone, a.AnonymizeDomain(overlayZone), "should keep the zone of a preserved address")
-	})
-
-	t.Run("private zone preserved at the default level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-		assert.Equal(t, "168.192.in-addr.arpa", a.AnonymizeDomain("168.192.in-addr.arpa"), "should keep the zone of a private address")
-	})
-
-	t.Run("overlay zone replaced at the strict level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelStrict)
-
-		got := a.AnonymizeDomain(overlayZone)
-		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV4), "should stay a reverse zone, got %q", got)
-		assert.NotEqual(t, overlayZone, got, "should replace the encoded prefix")
-		assert.Len(t, strings.Split(strings.TrimSuffix(got, reverseZoneSuffixV4), "."), 2,
-			"should keep the label count, got %q", got)
-	})
-
-	t.Run("public zone replaced at the default level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		got := a.AnonymizeDomain("113.0.203.in-addr.arpa")
-		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV4), "should stay a reverse zone, got %q", got)
-		assert.NotEqual(t, "113.0.203.in-addr.arpa", got, "should replace a public prefix")
-	})
-
-	t.Run("zone of an address keeps that address mapping", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		anonymizedAddr := a.AnonymizeIPString("203.0.113.7")
-		got := a.AnonymizeDomain("7.113.0.203.in-addr.arpa")
-
-		octets := strings.Split(anonymizedAddr, ".")
-		want := octets[3] + "." + octets[2] + "." + octets[1] + "." + octets[0] + reverseZoneSuffixV4
-		assert.Equal(t, want, got, "should name the same replacement as the address itself")
-	})
-
-	t.Run("ipv6 nibble labels stay single digits", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		zone := "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6
-		got := a.AnonymizeDomain(zone)
-
-		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV6), "should stay a reverse zone, got %q", got)
-		labels := strings.Split(strings.TrimSuffix(got, reverseZoneSuffixV6), ".")
-		assert.Len(t, labels, 28, "should keep every nibble label, got %q", got)
-		for _, label := range labels {
-			assert.Len(t, label, 1, "nibble label %q should stay a single digit", label)
-		}
-	})
-
-	t.Run("trailing dot is kept", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-		assert.Equal(t, "64.100.in-addr.arpa.", a.AnonymizeDomain("64.100.in-addr.arpa."), "should keep the trailing dot")
-	})
-
-	t.Run("a domain that only looks like a zone is anonymized as a domain", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		got := a.AnonymizeDomain("not-a-zone.in-addr.arpa")
-		assert.NotContains(t, got, "in-addr.arpa", "should fall back to domain anonymization")
-	})
-}
-
-// TestAnonymizeStringReverseZone verifies that a zone inside free text, such as
-// a DNS log line, is not chewed up by the address passes. The IPv4 pattern
-// matches any run of dotted digits, which a reverse zone is made of.
-func TestAnonymizeStringReverseZone(t *testing.T) {
-	t.Run("ipv6 zone survives the address passes", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		zone := "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6
-		got := a.AnonymizeString("question: domain=" + zone + " type=PTR")
-
-		assert.Contains(t, got, "type=PTR", "should keep the rest of the line")
-		assert.NotContains(t, got, "198.51.100", "should not rewrite nibble labels as an address")
-
-		labels := strings.Split(strings.TrimSuffix(strings.TrimPrefix(got, "question: domain="), reverseZoneSuffixV6+" type=PTR"), ".")
-		assert.Len(t, labels, 28, "should keep every nibble label, got %q", got)
-	})
-
-	t.Run("preserved ipv4 zone is untouched", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		line := "reverse zone 64.100.in-addr.arpa registered"
-		assert.Equal(t, line, a.AnonymizeString(line), "should keep the zone of a preserved address")
-	})
-
-	t.Run("public ipv4 zone is replaced consistently", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		got := a.AnonymizeString("zone 113.0.203.in-addr.arpa and address 203.0.113.7")
-		assert.NotContains(t, got, "113.0.203.in-addr.arpa", "should replace the zone")
-		assert.NotContains(t, got, "203.0.113.7", "should replace the address")
-		assert.Contains(t, got, reverseZoneSuffixV4, "should keep the zone suffix")
-	})
-}
-
-func TestParseReverseZone(t *testing.T) {
-	tests := []struct {
-		name   string
-		zone   string
-		addr   string
-		labels int
-	}{
-		{name: "v4 two labels", zone: "0.100" + reverseZoneSuffixV4, addr: "100.0.0.0", labels: 2},
-		{name: "v4 three labels", zone: "1.168.192" + reverseZoneSuffixV4, addr: "192.168.1.0", labels: 3},
-		{name: "v4 full address", zone: "7.113.0.203" + reverseZoneSuffixV4, addr: "203.0.113.7", labels: 4},
-		{
-			name:   "v6 prefix",
-			zone:   "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6,
-			addr:   "2::",
-			labels: 28,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			addr, labels, suffix, ok := parseReverseZone(tc.zone)
-			require.True(t, ok, "should decode the reverse zone")
-			assert.Equal(t, tc.addr, addr.String(), "should decode to the encoded prefix")
-			assert.Equal(t, tc.labels, labels, "should count the labels")
-			assert.Equal(t, tc.zone, reverseZoneName(addr, labels)+suffix, "should re-encode to the original zone")
-		})
-	}
-}
-
-func TestParseReverseZoneRejectsNonZones(t *testing.T) {
-	tests := []string{
-		"example.com",
-		"in-addr.arpa",
-		"x.100" + reverseZoneSuffixV4,
-		"256" + reverseZoneSuffixV4,
-		"1.2.3.4.5" + reverseZoneSuffixV4,
-		"ab" + reverseZoneSuffixV6,
-		"g" + reverseZoneSuffixV6,
-	}
-
-	for _, zone := range tests {
-		t.Run(zone, func(t *testing.T) {
-			_, _, _, ok := parseReverseZone(zone)
-			assert.False(t, ok, "should reject %q", zone)
-		})
-	}
-}

client/cmd/login.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"os/user"
+	"runtime"
 	"strings"
 
 	log "github.com/sirupsen/logrus"
@@ -120,7 +121,7 @@ func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey str
 	loginRequest := proto.LoginRequest{
 		SetupKey:            providedSetupKey,
 		ManagementUrl:       managementURL,
-		IsUnixDesktopClient: util.HasGraphicalSession(),
+		IsUnixDesktopClient: isUnixRunningDesktop(),
 		Hostname:            hostName,
 		DnsLabels:           dnsLabelsReq,
 		ProfileName:         &handle,
@@ -188,8 +189,7 @@ func doExtendSession(ctx context.Context, cmd *cobra.Command) error {
 
 	client := proto.NewDaemonServiceClient(conn)
 
-	// the CLI runs in the user's session, the daemon does not: tell it what we can see
-	req := &proto.RequestExtendAuthSessionRequest{HasGraphicalSession: util.HasGraphicalSession()}
+	req := &proto.RequestExtendAuthSessionRequest{}
 	// Pre-fill the IdP login hint from the active profile so the user
 	// doesn't have to retype their email. Best-effort: we still proceed
 	// without a hint if the lookup fails.
@@ -408,7 +408,7 @@ func foregroundGetTokenInfo(ctx context.Context, cmd *cobra.Command, config *pro
 		hint = profileState.Email
 	}
 
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, util.HasGraphicalSession(), false, hint)
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isUnixRunningDesktop(), false, hint)
 	if err != nil {
 		return nil, err
 	}
@@ -458,6 +458,14 @@ func openURL(cmd *cobra.Command, verificationURIComplete, userCode string, noBro
 	}
 }
 
+// isUnixRunningDesktop checks if a Linux OS is running desktop environment
+func isUnixRunningDesktop() bool {
+	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
+		return false
+	}
+	return os.Getenv("DESKTOP_SESSION") != "" || os.Getenv("XDG_CURRENT_DESKTOP") != ""
+}
+
 func setEnvAndFlags(cmd *cobra.Command) error {
 	SetFlagsFromEnvVars(rootCmd)
 

client/cmd/up.go

@@ -21,8 +21,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
+	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -626,7 +626,7 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 		NatExternalIPs:      natExternalIPs,
 		CleanNATExternalIPs: natExternalIPs != nil && len(natExternalIPs) == 0,
 		CustomDNSAddress:    customDNSAddressConverted,
-		IsUnixDesktopClient: util.HasGraphicalSession(),
+		IsUnixDesktopClient: isUnixRunningDesktop(),
 		Hostname:            hostName,
 		ExtraIFaceBlacklist: extraIFaceBlackList,
 		DnsLabels:           dnsLabels,

client/embed/embed.go

@@ -21,7 +21,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbssh "github.com/netbirdio/netbird/client/ssh"
+	sshcommon "github.com/netbirdio/netbird/client/ssh"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
@@ -521,7 +521,12 @@ func (c *Client) VerifySSHHostKey(peerAddress string, key []byte) error {
 		return err
 	}
 
-	return nbssh.PeerKeyLookup(engine.GetPeerSSHKey).VerifySSHHostKey(peerAddress, key)
+	storedKey, found := engine.GetPeerSSHKey(peerAddress)
+	if !found {
+		return sshcommon.ErrPeerNotFound
+	}
+
+	return sshcommon.VerifyHostKey(storedKey, key, peerAddress)
 }
 
 // SetPerformance retunes a running Client. Only PreallocatedBuffersPerPool

client/internal/auth/auth.go

@@ -138,37 +138,26 @@ func (a *Auth) IsSSOSupported(ctx context.Context) (bool, error) {
 
 // GetOAuthFlow returns an OAuth flow (PKCE or Device) using the existing management connection
 // This avoids creating a new connection to the management server
-func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool, hint string) (OAuthFlow, error) {
+func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool) (OAuthFlow, error) {
 	var flow OAuthFlow
+	var err error
 
-	err := a.withRetry(ctx, func(client *mgm.GrpcClient) error {
+	err = a.withRetry(ctx, func(client *mgm.GrpcClient) error {
 		if forceDeviceAuth {
-			deviceFlow, err := a.getDeviceFlow(client)
-			if err != nil {
-				return err
-			}
-			deviceFlow.SetLoginHint(hint)
-			flow = deviceFlow
-			return nil
+			flow, err = a.getDeviceFlow(client)
+			return err
 		}
 
 		// Try PKCE flow first
-		pkceFlow, err := a.getPKCEFlow(client)
+		flow, err = a.getPKCEFlow(client)
 		if err != nil {
 			// If PKCE not supported, try Device flow
 			if s, ok := status.FromError(err); ok && (s.Code() == codes.NotFound || s.Code() == codes.Unimplemented) {
-				deviceFlow, err := a.getDeviceFlow(client)
-				if err != nil {
-					return err
-				}
-				deviceFlow.SetLoginHint(hint)
-				flow = deviceFlow
-				return nil
+				flow, err = a.getDeviceFlow(client)
+				return err
 			}
 			return err
 		}
-		pkceFlow.SetLoginHint(hint)
-		flow = pkceFlow
 		return nil
 	})
 

client/internal/auth/oauth.go

@@ -97,7 +97,9 @@ func authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config
 		return nil, fmt.Errorf("getting pkce authorization flow info failed with error: %v", err)
 	}
 
-	pkceFlowInfo.SetLoginHint(hint)
+	if hint != "" {
+		pkceFlowInfo.SetLoginHint(hint)
+	}
 
 	return pkceFlowInfo, nil
 }
@@ -125,7 +127,9 @@ func authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.
 		}
 	}
 
-	deviceFlowInfo.SetLoginHint(hint)
+	if hint != "" {
+		deviceFlowInfo.SetLoginHint(hint)
+	}
 
 	return deviceFlowInfo, nil
 }

client/internal/connect.go

@@ -27,7 +27,6 @@ import (
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/internal/dns"
-	"github.com/netbirdio/netbird/client/internal/filedrop"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/metrics"
@@ -65,11 +64,10 @@ type ConnectClient struct {
 	config         *profilemanager.Config
 	statusRecorder *peer.Status
 
-	engine          *Engine
-	engineMutex     sync.Mutex
-	clientMetrics   *metrics.ClientMetrics
-	updateManager   *updater.Manager
-	fileDropManager *filedrop.Manager
+	engine        *Engine
+	engineMutex   sync.Mutex
+	clientMetrics *metrics.ClientMetrics
+	updateManager *updater.Manager
 
 	persistSyncResponse bool
 }
@@ -97,12 +95,6 @@ func (c *ConnectClient) SetUpdateManager(um *updater.Manager) {
 	c.updateManager = um
 }
 
-// SetFileDropManager hands the engine the active profile's file drop manager, so
-// the transfer receiver starts and stops with the tunnel. Must be set before Run.
-func (c *ConnectClient) SetFileDropManager(m *filedrop.Manager) {
-	c.fileDropManager = m
-}
-
 // Run with main logic.
 func (c *ConnectClient) Run(runningChan chan struct{}, logPath string) error {
 	if androidRunOverride != nil {
@@ -432,7 +424,6 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			UpdateManager:  c.updateManager,
 			ClientMetrics:  c.clientMetrics,
 			MetricsCtx:     c.ctx,
-			FileDrop:       c.fileDropManager,
 		}, mobileDependency)
 		engine.SetSyncResponsePersistence(c.persistSyncResponse)
 		c.engine = engine

client/internal/debug/debug.go

@@ -51,7 +51,6 @@ nftables.txt: Anonymized nftables rules with packet counters across all families
 sysctls.txt: Forwarding, reverse-path filter, source-validation, and conntrack accounting sysctl values that the NetBird client may read or modify, if --system-info flag was provided (Linux only).
 resolv.conf: DNS resolver configuration from /etc/resolv.conf (Unix systems only), if --system-info flag was provided.
 scutil_dns.txt: DNS configuration from scutil --dns (macOS only), if --system-info flag was provided.
-dns_windows.txt: Anonymized NRPT rules and policy table in effect, DNS client policy, and per-interface and per-adapter DNS configuration (Windows only), if --system-info flag was provided.
 resolved_domains.txt: Anonymized resolved domain IP addresses from the status recorder.
 config.txt: Anonymized configuration information of the NetBird client.
 network_map.json: Anonymized sync response containing peer configurations, routes, DNS settings, and firewall rules.
@@ -238,13 +237,6 @@ scutil_dns.txt (macOS only):
 - Shows DNS configuration for all network interfaces
 - Includes search domains, nameservers, and DNS resolver settings
 - All IP addresses and domain names are anonymized
-
-dns_windows.txt (Windows only):
-- Lists the NRPT rules of both policy stores, the local one and the group policy one, marking the rules the client created
-- Follows them with the policy table the resolver has loaded, which differs from the rules while a change has not been picked up yet
-- Includes the DNS client group policy, the global TCP/IP and Dnscache parameters, and the DNS values of every interface that has any
-- Ends with the resolver configuration in effect per adapter, from GetAdaptersAddresses
-- All IP addresses and domain names are anonymized
 `
 
 const (

client/internal/debug/debug_nonunix.go

@@ -1,4 +1,4 @@
-//go:build !unix && !windows
+//go:build !unix
 
 package debug
 

client/internal/debug/debug_windows.go

@@ -1,443 +0,0 @@
-//go:build windows
-
-package debug
-
-import (
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"net/netip"
-	"strings"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-	"golang.org/x/sys/windows/registry"
-
-	nbdns "github.com/netbirdio/netbird/client/internal/dns"
-)
-
-const dnsInfoFileName = "dns_windows.txt"
-
-const (
-	gpoDNSClientRoot = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient`
-	tcpipParamsPath  = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters`
-	dnscacheParams   = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters`
-)
-
-// interfaceDNSValues are the per-interface values that decide how a name is
-// resolved and registered. Everything the DNS host manager writes is in here,
-// so a bundle shows both what we set and what it replaced.
-var interfaceDNSValues = []string{
-	"NameServer",
-	"DhcpNameServer",
-	"Domain",
-	"DhcpDomain",
-	"SearchList",
-	"RegistrationEnabled",
-	"DisableDynamicUpdate",
-	"MaxNumberOfAddressesToRegister",
-	"EnableDHCP",
-}
-
-// addDNSInfo collects and adds DNS configuration information to the archive
-func (g *BundleGenerator) addDNSInfo() error {
-	if err := g.addFileToZip(strings.NewReader(g.collectDNSInfo()), dnsInfoFileName); err != nil {
-		return fmt.Errorf("add DNS info to zip: %w", err)
-	}
-
-	return nil
-}
-
-// collectDNSInfo renders the report. Everything below it reaches the platform
-// through COM and through lazily resolved procedures, which panic when a
-// procedure is missing rather than returning an error, and a debug bundle is not
-// allowed to take the daemon down. The panic is contained here, and whatever was
-// collected before it is kept and reported with it.
-func (g *BundleGenerator) collectDNSInfo() (content string) {
-	var sb strings.Builder
-
-	defer func() {
-		if r := recover(); r != nil {
-			log.Errorf("collecting Windows DNS configuration panicked: %v", r)
-			fmt.Fprintf(&sb, "\nerror: collection stopped: %v\n", r)
-		}
-		content = sb.String()
-	}()
-
-	sb.WriteString("Windows DNS configuration\n")
-	sb.WriteString("=========================\n")
-
-	adapters, adaptersErr := adapterAddresses()
-
-	g.writeNRPTRules(&sb, "NRPT rules, local policy store", nbdns.DNSPolicyConfigRoot)
-	g.writeNRPTRules(&sb, "NRPT rules, group policy store", nbdns.GPODNSPolicyConfigRoot)
-	g.writeEffectiveNRPTPolicies(&sb)
-	g.writeRegistryKey(&sb, "DNS client group policy", gpoDNSClientRoot)
-	g.writeRegistryKey(&sb, "Global TCP/IP parameters", tcpipParamsPath)
-	g.writeRegistryKey(&sb, "Dnscache parameters", dnscacheParams)
-	g.writeInterfaceDNS(&sb, "Per-interface DNS, IPv4", nbdns.InterfaceConfigPath, adapterNames(adapters))
-	g.writeInterfaceDNS(&sb, "Per-interface DNS, IPv6", nbdns.InterfaceConfigPathV6, adapterNames(adapters))
-	g.writeAdapterDNS(&sb, adapters, adaptersErr)
-
-	return sb.String()
-}
-
-// writeNRPTRules lists every rule in a policy store, ours and any other
-// product's, since a foreign rule for the same namespace decides resolution
-// just as ours does. Rules the client wrote are marked.
-func (g *BundleGenerator) writeNRPTRules(sb *strings.Builder, title, root string) {
-	writeSection(sb, title, root)
-
-	names, err := subKeyNames(root)
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	if len(names) == 0 {
-		sb.WriteString("no rules\n")
-		return
-	}
-
-	for _, name := range names {
-		owner := ""
-		if strings.HasPrefix(strings.ToLower(name), strings.ToLower(nbdns.NRPTKeyPrefix)) {
-			owner = "  (netbird)"
-		}
-		fmt.Fprintf(sb, "%s%s\n", name, owner)
-		g.writeValues(sb, root+`\`+name, nil, "  ")
-	}
-}
-
-// writeEffectiveNRPTPolicies reports the table the resolver answers from, which
-// the registry cannot show: a rule is written before it is loaded, and it keeps
-// being enforced after its key is gone until the resolver reloads its policy.
-func (g *BundleGenerator) writeEffectiveNRPTPolicies(sb *strings.Builder) {
-	writeSection(sb, "NRPT policy table in effect", nrptPolicyClass+"."+nrptPolicyMethod+" in "+nrptPolicyNamespace)
-
-	entries, err := effectiveNRPTPolicies()
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	if len(entries) == 0 {
-		sb.WriteString("no policies\n")
-		return
-	}
-
-	for _, entry := range entries {
-		fmt.Fprintf(sb, "%s\n", g.anonymizeValue("Namespace", entry.namespace))
-		for _, value := range entry.values {
-			fmt.Fprintf(sb, "  %s: %s\n", value.name, g.anonymizeValue(value.name, value.value))
-		}
-	}
-}
-
-// writeInterfaceDNS reports the DNS values of every interface that has any, so
-// the netbird interface can be compared against the physical ones. The registry
-// keys the values by GUID, so each is named from the adapter list; a GUID with
-// no adapter is a leftover key of an interface that no longer exists.
-func (g *BundleGenerator) writeInterfaceDNS(sb *strings.Builder, title, root string, names map[string]string) {
-	writeSection(sb, title, root)
-
-	guids, err := subKeyNames(root)
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	var reported int
-	for _, guid := range guids {
-		var iface strings.Builder
-		g.writeValues(&iface, root+`\`+guid, interfaceDNSValues, "  ")
-		if iface.Len() == 0 {
-			continue
-		}
-
-		name, ok := names[strings.ToLower(guid)]
-		if !ok {
-			name = "no adapter with this GUID"
-		}
-
-		reported++
-		fmt.Fprintf(sb, "%s (%s)\n%s", guid, name, iface.String())
-	}
-
-	if reported == 0 {
-		sb.WriteString("no interface holds DNS values\n")
-	}
-}
-
-// writeRegistryKey reports the values of a single key, without its subkeys.
-func (g *BundleGenerator) writeRegistryKey(sb *strings.Builder, title, path string) {
-	writeSection(sb, title, path)
-
-	var values strings.Builder
-	g.writeValues(&values, path, nil, "")
-	if values.Len() == 0 {
-		sb.WriteString("no values\n")
-		return
-	}
-
-	sb.WriteString(values.String())
-}
-
-// writeValues renders the values of a key. A nil names list reports every
-// value, otherwise only those named and present.
-func (g *BundleGenerator) writeValues(sb *strings.Builder, path string, names []string, indent string) {
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.QUERY_VALUE)
-	switch {
-	case errors.Is(err, registry.ErrNotExist), errors.Is(err, windows.ERROR_PATH_NOT_FOUND):
-		// an absent key is the normal state for the GPO store and for
-		// interfaces without DNS settings
-		log.Debugf("HKEY_LOCAL_MACHINE\\%s does not exist", path)
-		return
-	case err != nil:
-		fmt.Fprintf(sb, "%serror: open HKEY_LOCAL_MACHINE\\%s: %v\n", indent, path, err)
-		return
-	}
-	defer closeKey(k)
-
-	if names == nil {
-		names, err = k.ReadValueNames(-1)
-		if err != nil {
-			fmt.Fprintf(sb, "%serror: read value names: %v\n", indent, err)
-			return
-		}
-	}
-
-	for _, name := range names {
-		value, err := readRegistryValue(k, name)
-		switch {
-		case errors.Is(err, registry.ErrNotExist):
-			// the caller asks for a fixed set of values, most of which a
-			// given interface does not carry
-			continue
-		case err != nil:
-			// report rather than omit: a value that is there but cannot be
-			// read reads as unset otherwise
-			fmt.Fprintf(sb, "%s%s: error: %v\n", indent, name, err)
-			continue
-		}
-
-		fmt.Fprintf(sb, "%s%s: %s\n", indent, name, g.anonymizeValue(name, value))
-	}
-}
-
-// anonymizeValue redacts a registry value according to what its name says it
-// holds. Domains and addresses are handled per entry rather than by the string
-// pass: the pass only replaces domains something else in the bundle already
-// seeded, and its address regex would eat the digit labels of a reverse zone.
-func (g *BundleGenerator) anonymizeValue(name, value string) string {
-	if !g.anonymize || value == "" {
-		return value
-	}
-
-	switch {
-	case holdsDomains(name):
-		return joinValueEntries(splitValueEntries(value), g.anonymizeDomain)
-	case holdsAddresses(name):
-		return joinValueEntries(splitValueEntries(value), g.anonymizer.AnonymizeIPString)
-	default:
-		return g.anonymizer.AnonymizeString(value)
-	}
-}
-
-// holdsDomains reports whether a value name holds domains: the domain list of
-// an NRPT rule (Name) or of the policy table (Namespace), a search list, the
-// DNS suffix values of the TCP/IP and policy keys, which all end in "Domain"
-// (Domain, DhcpDomain, NV Domain, ICSDomain), and a proxy host name.
-func holdsDomains(name string) bool {
-	lower := strings.ToLower(name)
-	return lower == "name" || lower == "namespace" || lower == "searchlist" ||
-		strings.HasSuffix(lower, "domain") || strings.HasSuffix(lower, "proxyname")
-}
-
-// holdsAddresses reports whether a value name holds DNS server addresses
-// (NameServer, DhcpNameServer, GenericDNSServers, NameServers).
-func holdsAddresses(name string) bool {
-	lower := strings.ToLower(name)
-	return strings.Contains(lower, "nameserver") || strings.Contains(lower, "dnsserver")
-}
-
-// adapterNames maps adapter GUIDs, as the registry keys the interfaces, to the
-// names an operator sees.
-func adapterNames(adapters []*windows.IpAdapterAddresses) map[string]string {
-	names := make(map[string]string, len(adapters))
-	for _, adapter := range adapters {
-		guid := windows.BytePtrToString(adapter.AdapterName)
-		names[strings.ToLower(guid)] = windows.UTF16PtrToString(adapter.FriendlyName)
-	}
-	return names
-}
-
-// writeAdapterDNS reports the resolver configuration in effect per adapter,
-// which is what the resolver uses for a name no NRPT rule matches.
-func (g *BundleGenerator) writeAdapterDNS(sb *strings.Builder, adapters []*windows.IpAdapterAddresses, err error) {
-	writeSection(sb, "Adapter DNS configuration", "GetAdaptersAddresses")
-
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	for _, adapter := range adapters {
-		name := windows.UTF16PtrToString(adapter.FriendlyName)
-		suffix := g.anonymizeDomain(windows.UTF16PtrToString(adapter.DnsSuffix))
-
-		fmt.Fprintf(sb, "%s (index %d, oper status %d)\n", name, adapter.IfIndex, adapter.OperStatus)
-		fmt.Fprintf(sb, "  DNS suffix: %s\n", suffix)
-
-		var servers []string
-		for server := adapter.FirstDnsServerAddress; server != nil; server = server.Next {
-			addr, ok := netip.AddrFromSlice(server.Address.IP())
-			if !ok {
-				continue
-			}
-
-			addr = addr.Unmap()
-			if g.anonymize {
-				addr = g.anonymizer.AnonymizeIP(addr)
-			}
-			servers = append(servers, addr.String())
-		}
-
-		fmt.Fprintf(sb, "  DNS servers: %s\n", strings.Join(servers, ", "))
-	}
-}
-
-// anonymizeDomain anonymizes a single domain, keeping the leading dot an NRPT
-// match domain carries.
-func (g *BundleGenerator) anonymizeDomain(entry string) string {
-	if !g.anonymize {
-		return entry
-	}
-
-	domain, dot := strings.CutPrefix(entry, ".")
-	if domain == "" {
-		return entry
-	}
-
-	anonymized := g.anonymizer.AnonymizeDomain(domain)
-	if dot {
-		anonymized = "." + anonymized
-	}
-	return anonymized
-}
-
-// splitValueEntries splits a registry value that holds a list. The separator
-// differs per value: a REG_MULTI_SZ arrives joined with ", ", a SearchList is
-// comma separated and a NameServer may use commas or spaces.
-func splitValueEntries(value string) []string {
-	return strings.FieldsFunc(value, func(r rune) bool {
-		return r == ',' || r == ';' || r == ' ' || r == '\t'
-	})
-}
-
-func joinValueEntries(entries []string, anonymize func(string) string) string {
-	for i, entry := range entries {
-		entries[i] = anonymize(entry)
-	}
-	return strings.Join(entries, ", ")
-}
-
-func writeSection(sb *strings.Builder, title, source string) {
-	fmt.Fprintf(sb, "\n%s\n%s\n%s\n", title, strings.Repeat("-", len(title)), source)
-}
-
-func subKeyNames(root string) ([]string, error) {
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, root, registry.ENUMERATE_SUB_KEYS)
-	if err != nil {
-		return nil, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", root, err)
-	}
-	defer closeKey(k)
-
-	names, err := k.ReadSubKeyNames(-1)
-	if err != nil {
-		return nil, fmt.Errorf("read subkey names: %w", err)
-	}
-
-	return names, nil
-}
-
-// readRegistryValue renders a value as text regardless of its type, so an
-// unexpected type in a policy key still shows up instead of being dropped.
-func readRegistryValue(k registry.Key, name string) (string, error) {
-	_, valueType, err := k.GetValue(name, nil)
-	if err != nil {
-		return "", fmt.Errorf("get value %s: %w", name, err)
-	}
-
-	switch valueType {
-	case registry.SZ, registry.EXPAND_SZ:
-		value, _, err := k.GetStringValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get string value %s: %w", name, err)
-		}
-		return value, nil
-	case registry.MULTI_SZ:
-		values, _, err := k.GetStringsValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get strings value %s: %w", name, err)
-		}
-		return strings.Join(values, ", "), nil
-	case registry.DWORD, registry.QWORD:
-		value, _, err := k.GetIntegerValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get integer value %s: %w", name, err)
-		}
-		return fmt.Sprintf("%d (0x%x)", value, value), nil
-	case registry.BINARY:
-		value, _, err := k.GetBinaryValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get binary value %s: %w", name, err)
-		}
-		return hex.EncodeToString(value), nil
-	default:
-		return fmt.Sprintf("<unhandled registry type %d>", valueType), nil
-	}
-}
-
-// adapterAddresses returns the adapter list including DNS servers. The call
-// reports the size it needs, so grow the buffer and retry until it fits.
-func adapterAddresses() (adapters []*windows.IpAdapterAddresses, err error) {
-	// GetAdaptersAddresses is resolved on first use and panics when it is
-	// missing, so this reports it as an error and leaves the rest of the
-	// report intact.
-	defer func() {
-		if r := recover(); r != nil {
-			adapters, err = nil, fmt.Errorf("GetAdaptersAddresses: %v", r)
-		}
-	}()
-
-	const flags = windows.GAA_FLAG_SKIP_ANYCAST | windows.GAA_FLAG_SKIP_MULTICAST
-
-	size := uint32(15000)
-	for range 3 {
-		buf := make([]byte, size)
-		first := (*windows.IpAdapterAddresses)(unsafe.Pointer(&buf[0]))
-
-		err := windows.GetAdaptersAddresses(windows.AF_UNSPEC, flags, 0, first, &size)
-		if errors.Is(err, windows.ERROR_BUFFER_OVERFLOW) {
-			continue
-		}
-		if err != nil {
-			return nil, fmt.Errorf("GetAdaptersAddresses: %w", err)
-		}
-
-		for adapter := first; adapter != nil; adapter = adapter.Next {
-			adapters = append(adapters, adapter)
-		}
-		return adapters, nil
-	}
-
-	return nil, fmt.Errorf("GetAdaptersAddresses: buffer kept growing")
-}
-
-func closeKey(k registry.Key) {
-	if err := k.Close(); err != nil {
-		log.Debugf("close registry key: %v", err)
-	}
-}

client/internal/debug/debug_windows_test.go

@@ -1,146 +0,0 @@
-//go:build windows
-
-package debug
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/anonymize"
-)
-
-func newDNSValueGenerator(level anonymize.Level) *BundleGenerator {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(level)
-
-	return &BundleGenerator{
-		anonymize:      true,
-		anonymizeLevel: level,
-		anonymizer:     anonymizer,
-	}
-}
-
-// TestAnonymizeValueByName covers the value kinds of the DNS registry keys. The
-// names decide the treatment, because the string pass alone replaces only
-// domains another part of the bundle already seeded.
-func TestAnonymizeValueByName(t *testing.T) {
-	tests := []struct {
-		name      string
-		valueName string
-		value     string
-		assert    func(t *testing.T, got string)
-	}{
-		{
-			name:      "NRPT match domains keep the leading dot",
-			valueName: "Name",
-			value:     ".internal.example.com, .corp.example.org",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				for _, entry := range strings.Split(got, ", ") {
-					assert.True(t, strings.HasPrefix(entry, "."), "entry %q should keep its leading dot", entry)
-					assert.NotContains(t, entry, "example", "entry %q should not keep the original domain", entry)
-				}
-			},
-		},
-		{
-			name:      "any value name ending in Domain is treated as a domain",
-			valueName: "ICSDomain",
-			value:     "mshome.net",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.NotContains(t, got, "mshome", "should anonymize a domain suffix value")
-			},
-		},
-		{
-			name:      "search list is a comma separated domain list",
-			valueName: "SearchList",
-			value:     "corp.example.com,branch.example.com",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.NotContains(t, got, "example", "should anonymize every search domain")
-				assert.Len(t, strings.Split(got, ", "), 2, "should keep both search domains")
-			},
-		},
-		{
-			name:      "name servers are anonymized as addresses",
-			valueName: "DhcpNameServer",
-			value:     "203.0.113.10 8.8.8.8",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.NotContains(t, got, "203.0.113.10", "should anonymize a public resolver address")
-				// well-known resolvers stay readable at every level
-				assert.Contains(t, got, "8.8.8.8", "should keep a well-known resolver address")
-			},
-		},
-		{
-			name:      "opaque values are left to the string pass",
-			valueName: "DataBasePath",
-			value:     `%SystemRoot%\System32\drivers\etc`,
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.Equal(t, `%SystemRoot%\System32\drivers\etc`, got, "should not alter a path")
-			},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			g := newDNSValueGenerator(anonymize.LevelDefault)
-			tc.assert(t, g.anonymizeValue(tc.valueName, tc.value))
-		})
-	}
-}
-
-// TestParseNRPTPolicyTable parses the MOF text of the policy table out
-// parameters, as the provider on a client with one NRPT rule renders it.
-func TestParseNRPTPolicyTable(t *testing.T) {
-	const text = `[abstract]
-class __PARAMETERS
-{
-	[Out, EmbeddedInstance("DnsClientPolicyConfiguration"): ToSubClass, ID(2): DisableOverride ToInstance] DnsClientPolicyConfiguration cmdletOutput[] = {
-instance of DnsClientPolicyConfiguration
-{
-	DirectAccessProxyType = "NoProxy";
-	DirectAccessQueryIPsecRequired = FALSE;
-	NameEncoding = "Utf8WithoutMapping";
-	Namespace = ".0.100.in-addr.arpa";
-}, 
-instance of DnsClientPolicyConfiguration
-{
-	DirectAccessProxyType = "NoProxy";
-	NameEncoding = "Utf8WithoutMapping";
-	NameServers = {"100.0.255.254", "100.0.255.253"};
-	Namespace = ".nb.internal";
-}};
-	[in] boolean Effective;
-	[out] uint32 ReturnValue = 0;
-};
-`
-
-	entries := parseNRPTPolicyTable(text)
-	require.Len(t, entries, 2, "should parse both embedded instances")
-
-	assert.Equal(t, ".0.100.in-addr.arpa", entries[0].namespace, "should read the namespace of the first instance")
-	assert.Equal(t, ".nb.internal", entries[1].namespace, "should read the namespace of the second instance")
-
-	assert.Equal(t, []registryValue{
-		{name: "DirectAccessProxyType", value: "NoProxy"},
-		{name: "DirectAccessQueryIPsecRequired", value: "FALSE"},
-		{name: "NameEncoding", value: "Utf8WithoutMapping"},
-	}, entries[0].values, "should keep the remaining values in order")
-
-	assert.Contains(t, entries[1].values, registryValue{name: "NameServers", value: "100.0.255.254, 100.0.255.253"},
-		"should flatten a MOF array")
-
-	for _, value := range entries[1].values {
-		assert.NotContains(t, value.name, "ReturnValue", "should not read the class level parameters as values")
-	}
-}
-
-func TestParseNRPTPolicyTableEmpty(t *testing.T) {
-	assert.Empty(t, parseNRPTPolicyTable(""), "should parse no entries from empty text")
-	assert.Empty(t, parseNRPTPolicyTable("class __PARAMETERS\n{\n};\n"), "should parse no entries from a table with no instances")
-}

client/internal/debug/nrpt_windows.go

@@ -1,317 +0,0 @@
-//go:build windows
-
-package debug
-
-import (
-	"errors"
-	"fmt"
-	"runtime"
-	"strings"
-	"time"
-
-	"github.com/go-ole/go-ole"
-	"github.com/go-ole/go-ole/oleutil"
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	// The NRPT policy table is reachable through the CIM class that backs
-	// Get-DnsClientNrptPolicy. Unlike the rules in the registry, the table is
-	// what the resolver currently has loaded, which is the only way to tell an
-	// applied rule from one that is merely written, in either direction.
-	nrptPolicyNamespace = `root\Microsoft\Windows\DNS`
-	nrptPolicyClass     = "PS_DnsClientNrptPolicy"
-	nrptPolicyMethod    = "Get"
-
-	// The class has no instances, so the table comes from the out parameters
-	// of a static method call, rendered as MOF text: the embedded instances
-	// arrive as a safe array of objects, which cannot be read back through the
-	// COM bindings, and the text form carries all of them.
-	nrptPolicyInstanceKeyword = "instance of DnsClientPolicyConfiguration"
-
-	nrptPolicyTimeout = 15 * time.Second
-)
-
-// COM initialization results that leave the calling thread usable: S_FALSE for
-// a thread this process already initialized, RPC_E_CHANGED_MODE for one that
-// belongs to another apartment.
-const (
-	sFalse          = 0x00000001
-	rpcEChangedMode = 0x80010106
-)
-
-// nrptQueryInFlight admits one read of the policy table at a time. A provider
-// that stops answering keeps its goroutine and the OS thread that goroutine
-// pinned, so a later bundle reports that instead of pinning another one.
-var nrptQueryInFlight = make(chan struct{}, 1)
-
-// nrptPolicyEntry is one namespace of the effective policy table, holding the
-// values of an embedded DnsClientPolicyConfiguration instance in the order the
-// provider reported them.
-type nrptPolicyEntry struct {
-	namespace string
-	values    []registryValue
-}
-
-// registryValue is a name and its rendered value, shared by the registry and
-// policy table readers so both anonymize by value name the same way.
-type registryValue struct {
-	name  string
-	value string
-}
-
-// effectiveNRPTPolicies reads the effective NRPT table. The call is bounded
-// because a WMI provider can block indefinitely and a debug bundle must not.
-func effectiveNRPTPolicies() ([]nrptPolicyEntry, error) {
-	type result struct {
-		text string
-		err  error
-	}
-
-	select {
-	case nrptQueryInFlight <- struct{}{}:
-	default:
-		return nil, errors.New("an earlier read of the policy table has not returned")
-	}
-
-	done := make(chan result, 1)
-	go func() {
-		// the slot is released here rather than by the caller, so a read that
-		// outlives the timeout holds it until the provider answers
-		defer func() { <-nrptQueryInFlight }()
-
-		text, err := nrptPolicyTableText()
-		done <- result{text: text, err: err}
-	}()
-
-	select {
-	case res := <-done:
-		if res.err != nil {
-			return nil, res.err
-		}
-		return parseNRPTPolicyTable(res.text), nil
-	case <-time.After(nrptPolicyTimeout):
-		return nil, errors.New("read of the policy table timed out")
-	}
-}
-
-// nrptPolicyTableText calls the policy table method and returns the MOF text of
-// its out parameters.
-func nrptPolicyTableText() (text string, err error) {
-	// COM is per thread, and the collection is short lived, so the thread is
-	// pinned for the duration rather than initialized for the process.
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-
-	defer func() {
-		// The COM call chain is dynamically typed, so a provider that answers
-		// with an unexpected shape must not take the daemon down with it.
-		if r := recover(); r != nil {
-			err = fmt.Errorf("read NRPT policy table: %v", r)
-		}
-	}()
-
-	owns, err := coInitialize()
-	if err != nil {
-		return "", err
-	}
-	if owns {
-		defer ole.CoUninitialize()
-	}
-
-	locator, err := oleutil.CreateObject("WbemScripting.SWbemLocator")
-	if err != nil {
-		return "", fmt.Errorf("create WMI locator: %w", err)
-	}
-	defer locator.Release()
-
-	dispatch, err := locator.QueryInterface(ole.IID_IDispatch)
-	if err != nil {
-		return "", fmt.Errorf("query WMI locator interface: %w", err)
-	}
-	defer dispatch.Release()
-
-	service, err := dispatchCall(dispatch, "ConnectServer", nil, nrptPolicyNamespace)
-	if err != nil {
-		return "", fmt.Errorf("connect to %s: %w", nrptPolicyNamespace, err)
-	}
-	defer service.Release()
-
-	inParams, err := spawnMethodInParams(service)
-	if err != nil {
-		return "", err
-	}
-	defer inParams.Release()
-
-	// The effective table is the merge of the local and the group policy
-	// store, which is what the resolver answers from.
-	if _, err := oleutil.PutProperty(inParams, "Effective", true); err != nil {
-		return "", fmt.Errorf("set Effective parameter: %w", err)
-	}
-
-	outParams, err := dispatchCall(service, "ExecMethod", nrptPolicyClass, nrptPolicyMethod, inParams)
-	if err != nil {
-		return "", fmt.Errorf("call %s.%s: %w", nrptPolicyClass, nrptPolicyMethod, err)
-	}
-	defer outParams.Release()
-
-	textVariant, err := oleutil.CallMethod(outParams, "GetObjectText_")
-	if err != nil {
-		return "", fmt.Errorf("render policy table: %w", err)
-	}
-	defer func() {
-		if err := textVariant.Clear(); err != nil {
-			log.Debugf("clear policy table variant: %v", err)
-		}
-	}()
-
-	return textVariant.ToString(), nil
-}
-
-// spawnMethodInParams builds the in parameters instance the method needs. The
-// provider rejects the call without one, even when every parameter is optional.
-func spawnMethodInParams(service *ole.IDispatch) (*ole.IDispatch, error) {
-	class, err := dispatchCall(service, "Get", nrptPolicyClass)
-	if err != nil {
-		return nil, fmt.Errorf("get class %s: %w", nrptPolicyClass, err)
-	}
-	defer class.Release()
-
-	methods, err := dispatchProperty(class, "Methods_")
-	if err != nil {
-		return nil, fmt.Errorf("get class methods: %w", err)
-	}
-	defer methods.Release()
-
-	method, err := dispatchCall(methods, "Item", nrptPolicyMethod)
-	if err != nil {
-		return nil, fmt.Errorf("get method %s: %w", nrptPolicyMethod, err)
-	}
-	defer method.Release()
-
-	params, err := dispatchProperty(method, "InParameters")
-	if err != nil {
-		return nil, fmt.Errorf("get method parameters: %w", err)
-	}
-	defer params.Release()
-
-	inParams, err := dispatchCall(params, "SpawnInstance_")
-	if err != nil {
-		return nil, fmt.Errorf("spawn parameter instance: %w", err)
-	}
-
-	return inParams, nil
-}
-
-// parseNRPTPolicyTable pulls the embedded instances out of the MOF text. Each
-// instance is a namespace of the table, with one name and value per line.
-func parseNRPTPolicyTable(text string) []nrptPolicyEntry {
-	var entries []nrptPolicyEntry
-	var current *nrptPolicyEntry
-
-	for _, line := range strings.Split(text, "\n") {
-		line = strings.TrimSpace(strings.TrimSuffix(strings.TrimSpace(line), ";"))
-
-		switch {
-		case strings.HasPrefix(line, nrptPolicyInstanceKeyword):
-			entries = append(entries, nrptPolicyEntry{})
-			current = &entries[len(entries)-1]
-			continue
-		case strings.HasPrefix(line, "}"):
-			// closes an instance, and the array with the last one, so the
-			// class level parameters that follow are not read as values
-			current = nil
-			continue
-		case current == nil, line == "{":
-			continue
-		}
-
-		name, value, ok := strings.Cut(line, " = ")
-		if !ok {
-			continue
-		}
-
-		value = unquoteMOFValue(value)
-		if name == "Namespace" {
-			current.namespace = value
-			continue
-		}
-
-		current.values = append(current.values, registryValue{name: name, value: value})
-	}
-
-	return entries
-}
-
-// unquoteMOFValue renders a MOF scalar or array as plain text: "a" becomes a,
-// and {"a", "b"} becomes a, b.
-func unquoteMOFValue(value string) string {
-	value = strings.TrimSpace(value)
-
-	if inner, ok := strings.CutPrefix(value, "{"); ok {
-		value = strings.TrimSuffix(inner, "}")
-
-		entries := strings.Split(value, ",")
-		for i, entry := range entries {
-			entries[i] = strings.Trim(strings.TrimSpace(entry), `"`)
-		}
-		return strings.Join(entries, ", ")
-	}
-
-	return strings.Trim(value, `"`)
-}
-
-// coInitialize prepares the calling thread for COM and reports whether this
-// call owns the initialization, which decides whether it may be balanced with
-// CoUninitialize. S_FALSE took a reference on a thread this process had already
-// initialized and so has to be released, while RPC_E_CHANGED_MODE took none:
-// the thread belongs to another apartment, which is usable but is not ours to
-// uninitialize.
-func coInitialize() (bool, error) {
-	err := ole.CoInitializeEx(0, ole.COINIT_MULTITHREADED)
-	if err == nil {
-		return true, nil
-	}
-
-	var oleErr *ole.OleError
-	if errors.As(err, &oleErr) {
-		switch oleErr.Code() {
-		case sFalse:
-			return true, nil
-		case rpcEChangedMode:
-			return false, nil
-		}
-	}
-
-	return false, fmt.Errorf("initialize COM: %w", err)
-}
-
-// dispatchCall calls a COM method that returns an object.
-func dispatchCall(dispatch *ole.IDispatch, method string, params ...any) (*ole.IDispatch, error) {
-	variant, err := oleutil.CallMethod(dispatch, method, params...)
-	if err != nil {
-		return nil, err
-	}
-
-	object := variant.ToIDispatch()
-	if object == nil {
-		return nil, fmt.Errorf("%s returned no object", method)
-	}
-
-	return object, nil
-}
-
-// dispatchProperty reads a COM property that holds an object.
-func dispatchProperty(dispatch *ole.IDispatch, property string) (*ole.IDispatch, error) {
-	variant, err := oleutil.GetProperty(dispatch, property)
-	if err != nil {
-		return nil, err
-	}
-
-	object := variant.ToIDispatch()
-	if object == nil {
-		return nil, fmt.Errorf("property %s holds no object", property)
-	}
-
-	return object, nil
-}

client/internal/dns/host_windows.go

@@ -31,28 +31,10 @@ var (
 	dnsFlushResolverCacheFn = dnsapi.NewProc("DnsFlushResolverCache")
 )
 
-// Registry locations of the host DNS configuration this package programs,
-// exported so a diagnostic reader reports the same locations that are written.
 const (
-	// NRPTKeyPrefix starts the name of every NRPT rule key this client creates.
-	NRPTKeyPrefix = "NetBird-Match"
-
-	// DNSPolicyConfigRoot holds the NRPT rules of the local policy store.
-	DNSPolicyConfigRoot = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig`
-
-	// GPODNSPolicyConfigRoot holds the NRPT rules of the group policy store,
-	// which takes precedence over the local one when it is present.
-	GPODNSPolicyConfigRoot = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
-
-	// InterfaceConfigPath and InterfaceConfigPathV6 hold the per-interface DNS
-	// settings, keyed by interface GUID, in separate hives per address family.
-	InterfaceConfigPath   = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
-	InterfaceConfigPathV6 = `SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces`
-)
-
-const (
-	dnsPolicyConfigMatchPath    = DNSPolicyConfigRoot + `\` + NRPTKeyPrefix
-	gpoDnsPolicyConfigMatchPath = GPODNSPolicyConfigRoot + `\` + NRPTKeyPrefix
+	dnsPolicyConfigMatchPath    = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match`
+	gpoDnsPolicyRoot            = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
+	gpoDnsPolicyConfigMatchPath = gpoDnsPolicyRoot + `\NetBird-Match`
 
 	dnsPolicyConfigVersionKey           = "Version"
 	dnsPolicyConfigVersionValue         = 2
@@ -63,6 +45,8 @@ const (
 
 	nrptMaxDomainsPerRule = 50
 
+	interfaceConfigPath           = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
+	interfaceConfigPathV6         = `SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces`
 	interfaceConfigNameServerKey  = "NameServer"
 	interfaceConfigDhcpNameSrvKey = "DhcpNameServer"
 	interfaceConfigSearchListKey  = "SearchList"
@@ -100,7 +84,7 @@ func newHostManager(wgInterface WGIface) (*registryConfigurator, error) {
 	}
 
 	var useGPO bool
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, GPODNSPolicyConfigRoot, registry.QUERY_VALUE)
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, gpoDnsPolicyRoot, registry.QUERY_VALUE)
 	if err != nil {
 		log.Debugf("failed to open GPO DNS policy root: %v", err)
 	} else {
@@ -139,7 +123,7 @@ func (r *registryConfigurator) captureOriginalNameservers() ([]netip.Addr, error
 	seen := make(map[netip.Addr]struct{})
 	var out []netip.Addr
 	var merr *multierror.Error
-	for _, root := range []string{InterfaceConfigPath, InterfaceConfigPathV6} {
+	for _, root := range []string{interfaceConfigPath, interfaceConfigPathV6} {
 		addrs, err := r.captureFromTcpipRoot(root)
 		if err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("%s: %w", root, err))
@@ -512,7 +496,7 @@ func (r *registryConfigurator) deleteInterfaceRegistryKeyProperty(propertyKey st
 }
 
 func (r *registryConfigurator) getInterfaceRegistryKey() (registry.Key, error) {
-	regKeyPath := InterfaceConfigPath + "\\" + r.guid
+	regKeyPath := interfaceConfigPath + "\\" + r.guid
 	regKey, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.SET_VALUE)
 	if err != nil {
 		return regKey, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", regKeyPath, err)

client/internal/engine.go

@@ -40,7 +40,6 @@ import (
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
 	"github.com/netbirdio/netbird/client/internal/dnsfwd"
 	"github.com/netbirdio/netbird/client/internal/expose"
-	"github.com/netbirdio/netbird/client/internal/filedrop"
 	"github.com/netbirdio/netbird/client/internal/ingressgw"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/metrics"
@@ -182,7 +181,6 @@ type EngineServices struct {
 	UpdateManager  *updater.Manager
 	ClientMetrics  *metrics.ClientMetrics
 	MetricsCtx     context.Context
-	FileDrop       *filedrop.Manager
 }
 
 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -238,10 +236,6 @@ type Engine struct {
 
 	sshServer sshServer
 
-	fileDrop        *filedrop.Manager
-	fileDropRunning bool
-	fileDropPort    uint16
-
 	statusRecorder *peer.Status
 
 	firewall          firewallManager.Manager
@@ -356,7 +350,6 @@ func NewEngine(
 		metricsCtx:         services.MetricsCtx,
 		updateManager:      services.UpdateManager,
 		syncStoreDir:       config.StateDir,
-		fileDrop:           services.FileDrop,
 	}
 	// sessionWatcher keeps the SubscribeStatus consumers in sync with the
 	// session expiry deadline. Deadline-change ticks come for free via
@@ -422,8 +415,6 @@ func (e *Engine) stopLocked() {
 		log.Warnf("failed to stop SSH server: %v", err)
 	}
 
-	e.stopFileDrop()
-
 	e.cleanupSSHConfig()
 
 	if e.ingressGatewayMgr != nil {
@@ -1302,8 +1293,6 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 		}
 	}
 
-	e.startFileDrop()
-
 	state := e.statusRecorder.GetLocalPeerState()
 	state.IP = e.wgInterface.Address().String()
 	state.IPv6 = e.wgInterface.Address().IPv6String()
@@ -1376,7 +1365,17 @@ func (e *Engine) receiveJobEvents() {
 }
 
 func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobResponse_Bundle, error) {
-	log.Infof("handle remote debug bundle request: %s", params.String())
+	// The upload URL can carry a host, credentials, or query tokens, so it is
+	// kept out of the info-level line; the full parameters stay available at
+	// debug level for troubleshooting.
+	log.Infof("handle remote debug bundle request: anonymize=%v anonymize_level=%q log_file_count=%d bundle_for=%v bundle_for_time=%d",
+		params.GetAnonymize(), params.GetAnonymizeLevel(), params.GetLogFileCount(), params.GetBundleFor(), params.GetBundleForTime())
+	log.Debugf("remote debug bundle request parameters: %s", params.String())
+
+	if err := validateBundleUploadURL(params.GetUploadUrl()); err != nil {
+		return nil, err
+	}
+
 	syncResponse, err := e.GetLatestSyncResponse()
 	if err != nil {
 		log.Warnf("get latest sync response: %v", err)
@@ -1404,7 +1403,7 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 
 	waitFor := time.Duration(params.BundleForTime) * time.Minute
 
-	uploadKey, err := e.jobExecutor.BundleJob(e.ctx, bundleDeps, bundleJobParams, waitFor, e.config.ProfileConfig.ManagementURL.String())
+	uploadKey, err := e.jobExecutor.BundleJob(e.ctx, bundleDeps, bundleJobParams, waitFor, e.config.ProfileConfig.ManagementURL.String(), params.GetUploadUrl())
 	if err != nil {
 		return nil, err
 	}
@@ -1417,6 +1416,26 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 	return response, nil
 }
 
+// validateBundleUploadURL sanity-checks a management-supplied upload URL for a
+// remote debug bundle job. An empty value is accepted — the executor falls back
+// to the default upload service. A non-empty value must be a well-formed https
+// URL with a host; a malformed value or a plaintext scheme is rejected. This
+// deliberately does not constrain which host may receive the bundle; that
+// policy is left open pending a decision on management-directed uploads.
+func validateBundleUploadURL(raw string) error {
+	if raw == "" {
+		return nil
+	}
+	parsed, err := url.Parse(raw)
+	if err != nil {
+		return fmt.Errorf("parse upload URL: %w", err)
+	}
+	if parsed.Scheme != "https" || parsed.Host == "" {
+		return fmt.Errorf("upload URL must be an https URL with a host")
+	}
+	return nil
+}
+
 // receiveManagementEvents connects to the Management Service event stream to receive updates from the management service
 // E.g. when a new peer has been registered and we are allowed to connect to it.
 func (e *Engine) receiveManagementEvents() {
@@ -1971,8 +1990,6 @@ func (e *Engine) receiveSignalEvents() error {
 					return err
 				}
 
-				e.recordFiledropPort(msg.Key, msg.GetBody().GetFiledropPort())
-
 				log.Debugf("receiveMSG: took %s to get lock for peer %s with session id %s", gotLock, msg.Key, offerAnswer.SessionID)
 
 				if msg.Body.Type == sProto.Body_OFFER {
@@ -2452,8 +2469,6 @@ func (e *Engine) GetWgV6Addr() netip.Addr {
 	return e.wgInterface.Address().IPv6
 }
 
-// RenewTun swaps the tunnel device for the one behind fd, which the platform
-// hands over whenever it re-establishes the interface.
 func (e *Engine) RenewTun(fd int) error {
 	e.syncMsgMux.Lock()
 	wgInterface := e.wgInterface
@@ -2463,12 +2478,7 @@ func (e *Engine) RenewTun(fd int) error {
 		return fmt.Errorf("wireguard interface not initialized")
 	}
 
-	if err := wgInterface.RenewTun(fd); err != nil {
-		return err
-	}
-
-	e.restartFileDrop()
-	return nil
+	return wgInterface.RenewTun(fd)
 }
 
 // updateDNSForwarder start or stop the DNS forwarder based on the domains and the feature flag

client/internal/engine_bundle_test.go

@@ -0,0 +1,35 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestValidateBundleUploadURL covers the sanity check applied to a
+// management-supplied upload URL before a remote debug bundle is generated.
+func TestValidateBundleUploadURL(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		raw     string
+		wantErr bool
+	}{
+		{name: "empty falls back to default", raw: ""},
+		{name: "https with host", raw: "https://upload.debug.netbird.io/upload"},
+		{name: "https self-hosted host", raw: "https://upload.example.com"},
+		{name: "plaintext rejected", raw: "http://upload.example.com", wantErr: true},
+		{name: "missing host rejected", raw: "https:///upload", wantErr: true},
+		{name: "non-url scheme rejected", raw: "ftp://upload.example.com", wantErr: true},
+		{name: "garbage rejected", raw: "://not a url", wantErr: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateBundleUploadURL(tc.raw)
+			if tc.wantErr {
+				require.Error(t, err, "an invalid upload URL must be rejected")
+				return
+			}
+			assert.NoError(t, err, "a valid or empty upload URL must be accepted")
+		})
+	}
+}

client/internal/engine_filedrop.go

@@ -1,143 +0,0 @@
-package internal
-
-import (
-	"context"
-	"net"
-	"net/netip"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/filedrop"
-	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
-	"github.com/netbirdio/netbird/client/internal/peer"
-)
-
-type filedropResolver struct {
-	status *peer.Status
-}
-
-// ResolvePeer implements filedrop.PeerResolver.
-func (r filedropResolver) ResolvePeer(addr netip.Addr) (filedrop.PeerKey, string, bool) {
-	state, ok := r.status.PeerStateByIP(addr.String())
-	if !ok {
-		return "", "", false
-	}
-	return filedrop.PeerKey(state.PubKey), state.FQDN, true
-}
-
-func (e *Engine) startFileDrop() {
-	if e.fileDrop == nil || e.fileDropRunning || e.wgInterface == nil {
-		return
-	}
-	if e.config.BlockInbound {
-		log.Info("file drop receiver is disabled because inbound connections are blocked")
-		e.setFileDropTunnel()
-		return
-	}
-
-	wgAddr := e.wgInterface.Address()
-	addr := netip.AddrPortFrom(wgAddr.IP, filedrop.Port)
-	resolver := filedropResolver{status: e.statusRecorder}
-
-	netstackNet := e.wgInterface.GetNet()
-	if err := e.fileDrop.StartReceiver(e.ctx, addr, netstackNet, resolver); err != nil {
-		log.Errorf("failed to start file drop receiver: %v", err)
-		return
-	}
-
-	bound := e.fileDrop.ReceiverPort()
-	if bound == 0 {
-		bound = filedrop.Port
-	}
-	e.fileDropPort = bound
-
-	if v6 := wgAddr.IPv6; v6.IsValid() {
-		if err := e.fileDrop.AddReceiverListener(e.ctx, netip.AddrPortFrom(v6, bound)); err != nil {
-			log.Warnf("failed to add IPv6 file drop listener: %v", err)
-		}
-	}
-
-	if netstackNet != nil {
-		if registrar, ok := e.firewall.(interface {
-			RegisterNetstackService(protocol nftypes.Protocol, port uint16)
-		}); ok {
-			registrar.RegisterNetstackService(nftypes.TCP, bound)
-		}
-	}
-
-	if bound != filedrop.Port {
-		e.signaler.SetFiledropPort(bound)
-	}
-
-	e.setFileDropTunnel()
-	e.fileDropRunning = true
-}
-
-// recordFiledropPort stores the file drop port a peer advertised over signaling;
-// a value that does not fit a port is treated as the default.
-func (e *Engine) recordFiledropPort(peerKey string, port uint32) {
-	if e.fileDrop == nil {
-		return
-	}
-	if port > 65535 {
-		port = 0
-	}
-	e.fileDrop.Ports().Set(filedrop.PeerKey(peerKey), uint16(port))
-}
-
-func (e *Engine) setFileDropTunnel() {
-	var dial filedrop.DialFunc
-	if netstackNet := e.wgInterface.GetNet(); netstackNet != nil {
-		dial = func(ctx context.Context, _, addr string) (net.Conn, error) {
-			addrPort, err := netip.ParseAddrPort(addr)
-			if err != nil {
-				return nil, err
-			}
-			return netstackNet.DialContextTCPAddrPort(ctx, addrPort)
-		}
-	} else {
-		dialer := &net.Dialer{}
-		dial = dialer.DialContext
-	}
-
-	e.fileDrop.SetTunnel(dial, e.statusRecorder.GetLocalPeerState().FQDN)
-}
-
-// restartFileDrop rebinds the receiver after the platform replaced the tunnel
-// device. The listeners are bound to the overlay address of the interface being
-// swapped out and do not survive it: Android renews the tun on every route
-// change, which leaves the IPv4 listener dead with accept4: invalid argument.
-func (e *Engine) restartFileDrop() {
-	e.syncMsgMux.Lock()
-	defer e.syncMsgMux.Unlock()
-
-	if e.fileDrop == nil || !e.fileDropRunning || e.wgInterface == nil {
-		return
-	}
-
-	e.stopFileDrop()
-	e.startFileDrop()
-}
-
-func (e *Engine) stopFileDrop() {
-	if e.fileDrop == nil {
-		return
-	}
-
-	if e.fileDropRunning {
-		if netstackNet := e.wgInterface.GetNet(); netstackNet != nil {
-			if registrar, ok := e.firewall.(interface {
-				UnregisterNetstackService(protocol nftypes.Protocol, port uint16)
-			}); ok {
-				registrar.UnregisterNetstackService(nftypes.TCP, e.fileDropPort)
-			}
-		}
-		e.signaler.SetFiledropPort(0)
-	}
-
-	if err := e.fileDrop.StopReceiver(); err != nil {
-		log.Warnf("failed to stop file drop receiver: %v", err)
-	}
-	e.fileDropRunning = false
-	e.fileDropPort = 0
-}

client/internal/filedrop/client.go

@@ -1,446 +0,0 @@
-package filedrop
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/netip"
-	"strconv"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	defaultPollTimeout  = 60 * time.Second
-	defaultOfferTimeout = DefaultOfferTTL
-	uploadRetryDelay    = 2 * time.Second
-	maxUploadAttempts   = 3
-)
-
-// DialFunc opens a connection to the receiving peer over the tunnel.
-type DialFunc func(ctx context.Context, network, addr string) (net.Conn, error)
-
-// Payload is one item to send; Open is called per attempt starting at an offset.
-type Payload struct {
-	Meta FileMeta
-	Open func(offset int64) (io.ReadCloser, error)
-}
-
-// ProgressFunc reports staged bytes for one item as the upload streams.
-type ProgressFunc func(index int, sent int64, total int64)
-
-// ClientConfig configures the sending side.
-type ClientConfig struct {
-	Dial         DialFunc
-	SenderName   string
-	PollTimeout  time.Duration
-	OfferTimeout time.Duration
-}
-
-type progressReader struct {
-	r      io.Reader
-	sent   int64
-	total  int64
-	report func(sent int64)
-}
-
-// Client sends offers and payloads to a peer's file drop service.
-type Client struct {
-	http         *http.Client
-	senderName   string
-	pollTimeout  time.Duration
-	offerTimeout time.Duration
-}
-
-func (p *progressReader) Read(b []byte) (int, error) {
-	n, err := p.r.Read(b)
-	if n > 0 {
-		p.sent += int64(n)
-		p.report(p.sent)
-	}
-	return n, err
-}
-
-// NewClient builds a sending client over the given dialer.
-func NewClient(cfg ClientConfig) (*Client, error) {
-	if cfg.Dial == nil {
-		return nil, errors.New("dial function is required")
-	}
-
-	pollTimeout := cfg.PollTimeout
-	if pollTimeout <= 0 {
-		pollTimeout = defaultPollTimeout
-	}
-	offerTimeout := cfg.OfferTimeout
-	if offerTimeout <= 0 {
-		offerTimeout = defaultOfferTimeout
-	}
-
-	transport := &http.Transport{
-		DialContext:           func(ctx context.Context, network, addr string) (net.Conn, error) { return cfg.Dial(ctx, network, addr) },
-		MaxIdleConnsPerHost:   2,
-		ResponseHeaderTimeout: pollTimeout + 30*time.Second,
-	}
-
-	return &Client{
-		http:         &http.Client{Transport: transport},
-		senderName:   cfg.SenderName,
-		pollTimeout:  pollTimeout,
-		offerTimeout: offerTimeout,
-	}, nil
-}
-
-// TextPayload builds an inline text payload, which is carried in the offer itself.
-func TextPayload(name, text string) Payload {
-	return Payload{
-		Meta: FileMeta{
-			Name:        name,
-			Size:        int64(len(text)),
-			ContentType: "text/plain",
-			Kind:        KindText,
-			Text:        text,
-		},
-	}
-}
-
-// Send offers the payloads to the peer at addr and uploads them once accepted.
-func (c *Client) Send(ctx context.Context, addr netip.AddrPort, payloads []Payload, progress ProgressFunc) (OfferID, error) {
-	id, decision, err := c.Offer(ctx, addr, payloads)
-	if err != nil {
-		return id, err
-	}
-
-	decision, err = c.AwaitDecision(ctx, addr, id, decision)
-	if err != nil {
-		return id, err
-	}
-	if err := decisionError(decision); err != nil {
-		return id, err
-	}
-
-	return id, c.Upload(ctx, addr, id, payloads, progress)
-}
-
-// Offer announces the payloads and returns the offer ID with its initial decision.
-func (c *Client) Offer(ctx context.Context, addr netip.AddrPort, payloads []Payload) (OfferID, Decision, error) {
-	if len(payloads) == 0 {
-		return "", DecisionPending, fmt.Errorf("%w: no payloads", ErrInvalidOffer)
-	}
-	return c.postOffer(ctx, baseURL(addr), payloads)
-}
-
-// AwaitDecision resolves a pending decision by long-polling the receiver.
-func (c *Client) AwaitDecision(ctx context.Context, addr netip.AddrPort, id OfferID, decision Decision) (Decision, error) {
-	if decision != DecisionPending {
-		return decision, nil
-	}
-	return c.awaitDecision(ctx, baseURL(addr), id)
-}
-
-// Upload streams every non-inline payload of an accepted offer.
-func (c *Client) Upload(ctx context.Context, addr netip.AddrPort, id OfferID, payloads []Payload, progress ProgressFunc) error {
-	base := baseURL(addr)
-	for i, p := range payloads {
-		if p.Meta.Kind == KindText {
-			continue
-		}
-		if err := c.uploadFile(ctx, base, id, i, p, progress); err != nil {
-			return fmt.Errorf("upload %s: %w", p.Meta.Name, err)
-		}
-	}
-	return nil
-}
-
-// Cancel withdraws an offer, taking the receiver's consent prompt with it.
-func (c *Client) Cancel(ctx context.Context, addr netip.AddrPort, id OfferID) error {
-	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, offerURL(baseURL(addr), id), nil)
-	if err != nil {
-		return fmt.Errorf("build cancel request: %w", err)
-	}
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return fmt.Errorf("send cancel: %w", err)
-	}
-	defer drainAndClose(resp)
-
-	if resp.StatusCode != http.StatusNoContent && resp.StatusCode != http.StatusNotFound {
-		return statusError(resp)
-	}
-	return nil
-}
-
-func (c *Client) postOffer(ctx context.Context, base string, payloads []Payload) (OfferID, Decision, error) {
-	files := make([]FileMeta, len(payloads))
-	for i, p := range payloads {
-		files[i] = p.Meta
-	}
-
-	body, err := json.Marshal(OfferRequest{SenderName: c.senderName, Files: files})
-	if err != nil {
-		return "", DecisionPending, fmt.Errorf("encode offer: %w", err)
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, base+pathOffers, bytes.NewReader(body))
-	if err != nil {
-		return "", DecisionPending, fmt.Errorf("build offer request: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return "", DecisionPending, fmt.Errorf("send offer: %w", err)
-	}
-	defer drainAndClose(resp)
-
-	switch resp.StatusCode {
-	case http.StatusCreated, http.StatusAccepted:
-	case http.StatusForbidden:
-		return "", DecisionPending, ErrRefused
-	default:
-		return "", DecisionPending, statusError(resp)
-	}
-
-	var offer OfferResponse
-	if err := json.NewDecoder(io.LimitReader(resp.Body, maxOfferBodySize)).Decode(&offer); err != nil {
-		return "", DecisionPending, fmt.Errorf("decode offer response: %w", err)
-	}
-	if offer.ID == "" {
-		return "", DecisionPending, fmt.Errorf("%w: receiver returned no offer id", ErrInvalidOffer)
-	}
-	if !offer.Decision.valid() {
-		return "", DecisionPending, fmt.Errorf("%w: receiver returned decision %s", ErrInvalidOffer, offer.Decision)
-	}
-
-	return offer.ID, offer.Decision, nil
-}
-
-func (c *Client) awaitDecision(ctx context.Context, base string, id OfferID) (Decision, error) {
-	deadline := time.Now().Add(c.offerTimeout)
-
-	for time.Now().Before(deadline) {
-		decision, err := c.pollDecision(ctx, base, id)
-		if err != nil {
-			if ctx.Err() != nil {
-				return DecisionPending, ctx.Err()
-			}
-			log.Debugf("poll file drop decision: %v", err)
-			if !sleepCtx(ctx, uploadRetryDelay) {
-				return DecisionPending, ctx.Err()
-			}
-			continue
-		}
-		if decision != DecisionPending {
-			return decision, nil
-		}
-	}
-
-	return DecisionExpired, nil
-}
-
-func (c *Client) pollDecision(ctx context.Context, base string, id OfferID) (Decision, error) {
-	pollCtx, cancel := context.WithTimeout(ctx, c.pollTimeout)
-	defer cancel()
-
-	req, err := http.NewRequestWithContext(pollCtx, http.MethodGet, offerURL(base, id), nil)
-	if err != nil {
-		return DecisionPending, fmt.Errorf("build status request: %w", err)
-	}
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return DecisionPending, fmt.Errorf("poll status: %w", err)
-	}
-	defer drainAndClose(resp)
-
-	if resp.StatusCode == http.StatusNotFound {
-		return DecisionPending, ErrOfferNotFound
-	}
-	if resp.StatusCode != http.StatusOK {
-		return DecisionPending, statusError(resp)
-	}
-
-	var offer OfferResponse
-	if err := json.NewDecoder(io.LimitReader(resp.Body, maxOfferBodySize)).Decode(&offer); err != nil {
-		return DecisionPending, fmt.Errorf("decode status response: %w", err)
-	}
-	if !offer.Decision.valid() {
-		return DecisionPending, fmt.Errorf("%w: receiver returned decision %s", ErrInvalidOffer, offer.Decision)
-	}
-	return offer.Decision, nil
-}
-
-func (c *Client) uploadFile(ctx context.Context, base string, id OfferID, index int, p Payload, progress ProgressFunc) error {
-	var lastErr error
-
-	for attempt := range maxUploadAttempts {
-		offset := int64(0)
-		if attempt > 0 {
-			if !sleepCtx(ctx, uploadRetryDelay) {
-				return ctx.Err()
-			}
-			confirmed, err := c.confirmedOffset(ctx, base, id, index)
-			if err != nil {
-				lastErr = err
-				continue
-			}
-			offset = confirmed
-		}
-
-		if offset >= p.Meta.Size {
-			return nil
-		}
-
-		if err := c.putFile(ctx, base, id, index, p, offset, progress); err != nil {
-			if ctx.Err() != nil {
-				return ctx.Err()
-			}
-			lastErr = err
-			log.Debugf("upload attempt %d for %s: %v", attempt+1, p.Meta.Name, err)
-			continue
-		}
-		return nil
-	}
-
-	return lastErr
-}
-
-func (c *Client) putFile(ctx context.Context, base string, id OfferID, index int, p Payload, offset int64, progress ProgressFunc) error {
-	if p.Open == nil {
-		return fmt.Errorf("payload %s has no reader", p.Meta.Name)
-	}
-
-	body, err := p.Open(offset)
-	if err != nil {
-		return fmt.Errorf("open payload: %w", err)
-	}
-	defer func() {
-		if err := body.Close(); err != nil {
-			log.Debugf("close payload reader: %v", err)
-		}
-	}()
-
-	var reader io.Reader = body
-	if progress != nil {
-		reader = &progressReader{
-			r:     body,
-			sent:  offset,
-			total: p.Meta.Size,
-			report: func(sent int64) {
-				progress(index, sent, p.Meta.Size)
-			},
-		}
-	}
-
-	url := fileURL(base, id, index) + "?offset=" + strconv.FormatInt(offset, 10)
-	req, err := http.NewRequestWithContext(ctx, http.MethodPut, url, reader)
-	if err != nil {
-		return fmt.Errorf("build upload request: %w", err)
-	}
-	req.ContentLength = p.Meta.Size - offset
-	req.Header.Set("Content-Type", contentTypeOrDefault(p.Meta.ContentType))
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return fmt.Errorf("send payload: %w", err)
-	}
-	defer drainAndClose(resp)
-
-	if resp.StatusCode == http.StatusForbidden {
-		return ErrNotAccepted
-	}
-	if resp.StatusCode != http.StatusNoContent && resp.StatusCode != http.StatusOK {
-		return statusError(resp)
-	}
-	return nil
-}
-
-func (c *Client) confirmedOffset(ctx context.Context, base string, id OfferID, index int) (int64, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodHead, fileURL(base, id, index), nil)
-	if err != nil {
-		return 0, fmt.Errorf("build probe request: %w", err)
-	}
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return 0, fmt.Errorf("probe upload: %w", err)
-	}
-	defer drainAndClose(resp)
-
-	if resp.StatusCode != http.StatusOK {
-		return 0, statusError(resp)
-	}
-
-	raw := resp.Header.Get(HeaderReceivedBytes)
-	if raw == "" {
-		return 0, nil
-	}
-	offset, err := strconv.ParseInt(raw, 10, 64)
-	if err != nil || offset < 0 {
-		return 0, fmt.Errorf("invalid %s header %q", HeaderReceivedBytes, raw)
-	}
-	return offset, nil
-}
-
-func baseURL(addr netip.AddrPort) string {
-	return "http://" + net.JoinHostPort(addr.Addr().Unmap().String(), strconv.Itoa(int(addr.Port())))
-}
-
-func offerURL(base string, id OfferID) string {
-	return base + pathOffersSlash + string(id)
-}
-
-func fileURL(base string, id OfferID, index int) string {
-	return offerURL(base, id) + "/" + segmentFiles + "/" + strconv.Itoa(index)
-}
-
-func contentTypeOrDefault(ct string) string {
-	if ct == "" {
-		return "application/octet-stream"
-	}
-	return ct
-}
-
-func statusError(resp *http.Response) error {
-	return fmt.Errorf("receiver returned %s", resp.Status)
-}
-
-func drainAndClose(resp *http.Response) {
-	if _, err := io.Copy(io.Discard, io.LimitReader(resp.Body, maxOfferBodySize)); err != nil {
-		log.Tracef("drain response body: %v", err)
-	}
-	if err := resp.Body.Close(); err != nil {
-		log.Debugf("close response body: %v", err)
-	}
-}
-
-func sleepCtx(ctx context.Context, d time.Duration) bool {
-	timer := time.NewTimer(d)
-	defer timer.Stop()
-
-	select {
-	case <-timer.C:
-		return true
-	case <-ctx.Done():
-		return false
-	}
-}
-
-func decisionError(decision Decision) error {
-	switch decision {
-	case DecisionAccepted:
-		return nil
-	case DecisionDeclined:
-		return ErrDeclined
-	case DecisionExpired:
-		return ErrExpired
-	default:
-		return fmt.Errorf("unexpected decision %s", decision)
-	}
-}

client/internal/filedrop/delivery.go

@@ -1,100 +0,0 @@
-package filedrop
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-)
-
-func deliver(spool *Spool, offer Offer, destDir string) ([]string, error) {
-	if destDir == "" {
-		return nil, fmt.Errorf("no destination directory configured")
-	}
-	if err := os.MkdirAll(destDir, 0o755); err != nil {
-		return nil, fmt.Errorf("create destination dir: %w", err)
-	}
-
-	var delivered []string
-	for i, f := range offer.Files {
-		if f.Kind == KindText {
-			continue
-		}
-
-		dest, err := moveToUniqueName(spool.Path(offer.ID, i), destDir, sanitizeFileName(f.Name, i))
-		if err != nil {
-			return delivered, fmt.Errorf("deliver %s: %w", f.Name, err)
-		}
-		if err := chownToDirOwner(dest, destDir); err != nil {
-			log.Debugf("failed to adopt owner for %s: %v", dest, err)
-		}
-		delivered = append(delivered, dest)
-	}
-
-	spool.Remove(offer.ID)
-	return delivered, nil
-}
-
-func sanitizeFileName(name string, index int) string {
-	name = filepath.Base(filepath.Clean(strings.ReplaceAll(name, "\\", "/")))
-	if name == "" || name == "." || name == ".." || name == string(filepath.Separator) {
-		return fmt.Sprintf("file-%d", index)
-	}
-	return name
-}
-
-func moveToUniqueName(src, dir, name string) (string, error) {
-	ext := filepath.Ext(name)
-	stem := strings.TrimSuffix(name, ext)
-
-	for attempt := 0; attempt < 1000; attempt++ {
-		candidate := name
-		if attempt > 0 {
-			candidate = fmt.Sprintf("%s (%d)%s", stem, attempt, ext)
-		}
-		dest := filepath.Join(dir, candidate)
-
-		f, err := os.OpenFile(dest, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o644)
-		if err != nil {
-			if os.IsExist(err) {
-				continue
-			}
-			return "", fmt.Errorf("create destination: %w", err)
-		}
-
-		if err := moveInto(f, src); err != nil {
-			_ = f.Close()
-			_ = os.Remove(dest)
-			return "", err
-		}
-		if err := f.Close(); err != nil {
-			return "", fmt.Errorf("close destination: %w", err)
-		}
-		if err := os.Remove(src); err != nil {
-			log.Debugf("failed to remove spooled source %s: %v", src, err)
-		}
-		return dest, nil
-	}
-
-	return "", fmt.Errorf("no free name for %s in %s", name, dir)
-}
-
-func moveInto(dst *os.File, src string) error {
-	s, err := os.Open(src)
-	if err != nil {
-		return fmt.Errorf("open spooled file: %w", err)
-	}
-	defer func() {
-		if err := s.Close(); err != nil {
-			log.Debugf("close spooled file: %v", err)
-		}
-	}()
-
-	if _, err := io.Copy(dst, s); err != nil {
-		return fmt.Errorf("copy payload: %w", err)
-	}
-	return nil
-}

client/internal/filedrop/delivery_other.go

@@ -1,7 +0,0 @@
-//go:build windows || js
-
-package filedrop
-
-func chownToDirOwner(string, string) error {
-	return nil
-}

client/internal/filedrop/delivery_unix.go

@@ -1,29 +0,0 @@
-//go:build !windows && !js
-
-package filedrop
-
-import (
-	"fmt"
-	"os"
-	"syscall"
-)
-
-func chownToDirOwner(path, dir string) error {
-	info, err := os.Stat(dir)
-	if err != nil {
-		return fmt.Errorf("stat destination dir: %w", err)
-	}
-
-	stat, ok := info.Sys().(*syscall.Stat_t)
-	if !ok {
-		return nil
-	}
-	if os.Geteuid() != 0 || int(stat.Uid) == os.Geteuid() {
-		return nil
-	}
-
-	if err := os.Chown(path, int(stat.Uid), int(stat.Gid)); err != nil {
-		return fmt.Errorf("chown delivered file: %w", err)
-	}
-	return nil
-}

client/internal/filedrop/filedrop_test.go

@@ -1,850 +0,0 @@
-package filedrop
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"net/netip"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-)
-
-const (
-	testPeer    = PeerKey("peer-pubkey")
-	testProfile = profilemanager.ID("test-profile")
-)
-
-type staticResolver struct {
-	key     PeerKey
-	name    string
-	unknown bool
-}
-
-func (r staticResolver) ResolvePeer(netip.Addr) (PeerKey, string, bool) {
-	if r.unknown {
-		return "", "", false
-	}
-	return r.key, r.name, true
-}
-
-type recordingNotifier struct {
-	mu        sync.Mutex
-	offers    []Offer
-	completed []Offer
-	failed    []Offer
-	withdrawn []Offer
-	progress  int
-}
-
-func (n *recordingNotifier) OnOffer(o Offer) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	n.offers = append(n.offers, o)
-}
-
-func (n *recordingNotifier) OnProgress(Offer, int, int64) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	n.progress++
-}
-
-func (n *recordingNotifier) OnCompleted(o Offer) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	n.completed = append(n.completed, o)
-}
-
-func (n *recordingNotifier) OnFailed(o Offer, _ error) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	n.failed = append(n.failed, o)
-}
-
-func (n *recordingNotifier) OnWithdrawn(o Offer) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	n.withdrawn = append(n.withdrawn, o)
-}
-
-func (n *recordingNotifier) snapshot() (offers, completed, failed, withdrawn []Offer) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	return append([]Offer(nil), n.offers...), append([]Offer(nil), n.completed...),
-		append([]Offer(nil), n.failed...), append([]Offer(nil), n.withdrawn...)
-}
-
-func startTestServer(t *testing.T, mode Mode, resolver PeerResolver) (*Server, *Client, *recordingNotifier) {
-	t.Helper()
-
-	policy := NewPolicyStore(testProfile)
-	require.NoError(t, policy.Set(Policy{Mode: mode}))
-
-	notifier := &recordingNotifier{}
-	srv, err := NewServer(ServerConfig{
-		SpoolDir: t.TempDir(),
-		Policy:   policy,
-		Resolver: resolver,
-		Notifier: notifier,
-		OfferTTL: 5 * time.Second,
-	})
-	require.NoError(t, err, "server setup must succeed")
-
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-
-	require.NoError(t, srv.Start(ctx, netip.AddrPortFrom(netip.AddrFrom4([4]byte{127, 0, 0, 1}), 0)))
-	t.Cleanup(func() {
-		require.NoError(t, srv.Stop())
-	})
-
-	srv.mu.RLock()
-	addr := srv.listener.Addr().String()
-	srv.mu.RUnlock()
-
-	client, err := NewClient(ClientConfig{
-		SenderName:   "sender",
-		PollTimeout:  2 * time.Second,
-		OfferTimeout: 5 * time.Second,
-		Dial: func(ctx context.Context, network, _ string) (net.Conn, error) {
-			var d net.Dialer
-			return d.DialContext(ctx, network, addr)
-		},
-	})
-	require.NoError(t, err, "client setup must succeed")
-
-	return srv, client, notifier
-}
-
-func filePayload(t *testing.T, name string, content []byte) Payload {
-	t.Helper()
-
-	path := filepath.Join(t.TempDir(), name)
-	require.NoError(t, os.WriteFile(path, content, 0o600))
-
-	return Payload{
-		Meta: FileMeta{Name: name, Size: int64(len(content)), ContentType: "application/octet-stream"},
-		Open: func(offset int64) (io.ReadCloser, error) {
-			f, err := os.Open(path)
-			if err != nil {
-				return nil, err
-			}
-			if _, err := f.Seek(offset, io.SeekStart); err != nil {
-				_ = f.Close()
-				return nil, err
-			}
-			return f, nil
-		},
-	}
-}
-
-var testAddr = netip.AddrPortFrom(netip.AddrFrom4([4]byte{100, 64, 0, 1}), Port)
-
-func TestAutoAcceptTransfersPayload(t *testing.T) {
-	srv, client, notifier := startTestServer(t, ModeAutoAccept, staticResolver{key: testPeer, name: "laptop"})
-
-	content := []byte(strings.Repeat("netbird", 1000))
-	payload := filePayload(t, "report.bin", content)
-
-	var lastSent int64
-	id, err := client.Send(context.Background(), testAddr, []Payload{payload}, func(_ int, sent, _ int64) {
-		lastSent = sent
-	})
-	require.NoError(t, err)
-	require.NotEmpty(t, id, "receiver must return an offer id")
-
-	assert.Equal(t, int64(len(content)), lastSent, "progress must reach the full payload size")
-
-	staged, err := os.ReadFile(srv.Spool().Path(id, 0))
-	require.NoError(t, err)
-	assert.Equal(t, content, staged, "staged bytes should match what was sent")
-
-	offer, ok := srv.Offers().Get(testPeer, id)
-	require.True(t, ok, "offer must still be tracked")
-	assert.Equal(t, StateCompleted, offer.State, "offer should be completed")
-	assert.Equal(t, "laptop", offer.SenderName, "sender name should come from the resolver")
-
-	_, completed, _, _ := notifier.snapshot()
-	require.Len(t, completed, 1, "one completion event expected")
-	assert.Equal(t, id, completed[0].ID)
-}
-
-func TestAskModeAcceptReleasesUpload(t *testing.T) {
-	srv, client, notifier := startTestServer(t, ModeAsk, staticResolver{key: testPeer})
-
-	content := []byte("consent required")
-	payload := filePayload(t, "note.txt", content)
-
-	go func() {
-		for {
-			offers, _, _, _ := notifier.snapshot()
-			if len(offers) > 0 {
-				srv.Offers().Decide(offers[0].ID, DecisionAccepted)
-				return
-			}
-			time.Sleep(10 * time.Millisecond)
-		}
-	}()
-
-	id, err := client.Send(context.Background(), testAddr, []Payload{payload}, nil)
-	require.NoError(t, err)
-
-	staged, err := os.ReadFile(srv.Spool().Path(id, 0))
-	require.NoError(t, err)
-	assert.Equal(t, content, staged, "payload should arrive after acceptance")
-
-	offers, _, _, _ := notifier.snapshot()
-	require.Len(t, offers, 1, "the pending offer must be raised exactly once")
-	assert.Equal(t, DecisionPending, offers[0].Decision, "the raised offer starts pending")
-}
-
-func TestAskModeDeclineKeepsPayloadOut(t *testing.T) {
-	srv, client, notifier := startTestServer(t, ModeAsk, staticResolver{key: testPeer})
-
-	go func() {
-		for {
-			offers, _, _, _ := notifier.snapshot()
-			if len(offers) > 0 {
-				srv.Offers().Decide(offers[0].ID, DecisionDeclined)
-				return
-			}
-			time.Sleep(10 * time.Millisecond)
-		}
-	}()
-
-	id, err := client.Send(context.Background(), testAddr, []Payload{filePayload(t, "x.bin", []byte("data"))}, nil)
-	require.ErrorIs(t, err, ErrDeclined, "sender must see the decline")
-
-	_, statErr := os.Stat(srv.Spool().Path(id, 0))
-	assert.True(t, os.IsNotExist(statErr), "declined payload must never be staged")
-}
-
-func TestOffModeRefusesOffer(t *testing.T) {
-	_, client, notifier := startTestServer(t, ModeOff, staticResolver{key: testPeer})
-
-	_, err := client.Send(context.Background(), testAddr, []Payload{filePayload(t, "x.bin", []byte("data"))}, nil)
-	require.ErrorIs(t, err, ErrRefused, "an off receiver must refuse the offer")
-
-	offers, _, _, _ := notifier.snapshot()
-	assert.Empty(t, offers, "a refused offer must not reach the user")
-}
-
-func TestUnknownSenderIsRefused(t *testing.T) {
-	_, client, _ := startTestServer(t, ModeAutoAccept, staticResolver{unknown: true})
-
-	_, err := client.Send(context.Background(), testAddr, []Payload{filePayload(t, "x.bin", []byte("data"))}, nil)
-	require.ErrorIs(t, err, ErrRefused, "an unresolvable source address must be refused")
-}
-
-func TestUploadResumesFromConfirmedOffset(t *testing.T) {
-	srv, client, _ := startTestServer(t, ModeAutoAccept, staticResolver{key: testPeer})
-
-	content := []byte(strings.Repeat("resume", 500))
-	payload := filePayload(t, "big.bin", content)
-
-	offer := srv.Offers().Add(testPeer, "", []FileMeta{payload.Meta}, DecisionAccepted)
-	require.NoError(t, srv.Spool().Prepare(offer.ID))
-
-	half := int64(len(content) / 2)
-	_, err := srv.Spool().Write(offer.ID, 0, 0, strings.NewReader(string(content[:half])), half)
-	require.NoError(t, err)
-
-	srv.mu.RLock()
-	base := "http://" + srv.listener.Addr().String()
-	srv.mu.RUnlock()
-
-	confirmed, err := client.confirmedOffset(context.Background(), base, offer.ID, 0)
-	require.NoError(t, err)
-	require.Equal(t, half, confirmed, "receiver must report the staged prefix")
-
-	require.NoError(t, client.putFile(context.Background(), base, offer.ID, 0, payload, confirmed, nil))
-
-	staged, err := os.ReadFile(srv.Spool().Path(offer.ID, 0))
-	require.NoError(t, err)
-	assert.Equal(t, content, staged, "resumed upload must reconstruct the full payload")
-}
-
-func TestUploadIsBoundedByAnnouncedSize(t *testing.T) {
-	srv, _, _ := startTestServer(t, ModeAutoAccept, staticResolver{key: testPeer})
-
-	// The request is issued raw: the stdlib client refuses to send a body that
-	announced := int64(10)
-	offer := srv.Offers().Add(testPeer, "", []FileMeta{{Name: "lie.bin", Size: announced}}, DecisionAccepted)
-	require.NoError(t, srv.Spool().Prepare(offer.ID))
-
-	srv.mu.RLock()
-	addr := srv.listener.Addr().String()
-	srv.mu.RUnlock()
-
-	conn, err := net.Dial("tcp", addr)
-	require.NoError(t, err)
-	defer func() {
-		_ = conn.Close()
-	}()
-
-	oversized := strings.Repeat("A", 100)
-	request := "PUT /v1/offers/" + string(offer.ID) + "/files/0?offset=0 HTTP/1.1\r\n" +
-		"Host: filedrop\r\nContent-Length: 100\r\nConnection: close\r\n\r\n" + oversized
-	_, err = conn.Write([]byte(request))
-	require.NoError(t, err)
-
-	_, err = io.ReadAll(conn)
-	require.NoError(t, err)
-
-	staged, err := os.ReadFile(srv.Spool().Path(offer.ID, 0))
-	require.NoError(t, err)
-	assert.Len(t, staged, int(announced), "staged size must be capped at the announced size")
-}
-
-func TestCancelWithdrawsPendingOffer(t *testing.T) {
-	srv, client, notifier := startTestServer(t, ModeAsk, staticResolver{key: testPeer})
-
-	sendCtx, cancelSend := context.WithCancel(context.Background())
-	defer cancelSend()
-
-	go func() {
-		_, _ = client.Send(sendCtx, testAddr, []Payload{filePayload(t, "x.bin", []byte("data"))}, nil)
-	}()
-
-	var id OfferID
-	require.Eventually(t, func() bool {
-		offers, _, _, _ := notifier.snapshot()
-		if len(offers) == 0 {
-			return false
-		}
-		id = offers[0].ID
-		return true
-	}, 3*time.Second, 10*time.Millisecond, "offer must reach the receiver")
-
-	require.NoError(t, client.Cancel(context.Background(), testAddr, id))
-
-	_, ok := srv.Offers().Get(testPeer, id)
-	assert.False(t, ok, "a withdrawn offer must be dropped")
-
-	_, _, _, withdrawn := notifier.snapshot()
-	require.Len(t, withdrawn, 1, "the consent prompt must be withdrawn")
-	assert.Equal(t, id, withdrawn[0].ID)
-}
-
-func TestTextPayloadStaysInline(t *testing.T) {
-	srv, client, _ := startTestServer(t, ModeAutoAccept, staticResolver{key: testPeer})
-
-	id, err := client.Send(context.Background(), testAddr, []Payload{TextPayload("snippet", "hello peer")}, nil)
-	require.NoError(t, err)
-
-	offer, ok := srv.Offers().Get(testPeer, id)
-	require.True(t, ok)
-	require.Len(t, offer.Files, 1)
-	assert.Equal(t, "hello peer", offer.Files[0].Text, "text must arrive in the offer itself")
-	assert.Equal(t, StateCompleted, offer.State, "a text-only offer completes without an upload")
-
-	_, statErr := os.Stat(srv.Spool().Path(id, 0))
-	assert.True(t, os.IsNotExist(statErr), "text payloads must not be written to the spool")
-}
-
-func TestOfferExpiresWithoutDecision(t *testing.T) {
-	policy := NewPolicyStore(testProfile)
-	require.NoError(t, policy.SetMode(ModeAsk))
-
-	srv, err := NewServer(ServerConfig{
-		SpoolDir: t.TempDir(),
-		Policy:   policy,
-		Resolver: staticResolver{key: testPeer},
-		OfferTTL: 100 * time.Millisecond,
-	})
-	require.NoError(t, err)
-
-	offer := srv.Offers().Add(testPeer, "", []FileMeta{{Name: "x", Size: 1}}, DecisionPending)
-
-	awaited, err := srv.Offers().Await(context.Background(), testPeer, offer.ID)
-	require.NoError(t, err)
-	assert.Equal(t, DecisionExpired, awaited.Decision, "an unanswered offer must expire")
-	assert.Equal(t, StateExpired, awaited.State)
-}
-
-func TestDecideIsFinal(t *testing.T) {
-	store := NewOfferStore(time.Minute)
-	offer := store.Add(testPeer, "", []FileMeta{{Name: "x", Size: 1}}, DecisionPending)
-
-	_, ok := store.Decide(offer.ID, DecisionDeclined)
-	require.True(t, ok, "the first decision must be recorded")
-
-	_, ok = store.Decide(offer.ID, DecisionAccepted)
-	assert.False(t, ok, "a decided offer must not be revived")
-
-	current, ok := store.Get(testPeer, offer.ID)
-	require.True(t, ok)
-	assert.Equal(t, DecisionDeclined, current.Decision, "the original decision must stand")
-}
-
-func TestOfferIsScopedToItsSender(t *testing.T) {
-	store := NewOfferStore(time.Minute)
-	offer := store.Add(testPeer, "", []FileMeta{{Name: "x", Size: 1}}, DecisionAccepted)
-
-	_, ok := store.Get("other-peer", offer.ID)
-	assert.False(t, ok, "another peer must not see the offer")
-
-	_, err := store.Await(context.Background(), "other-peer", offer.ID)
-	assert.ErrorIs(t, err, ErrOfferNotFound, "another peer must not poll the offer")
-}
-
-func TestPolicyEvaluation(t *testing.T) {
-	store := NewPolicyStore(testProfile)
-	require.NoError(t, store.Set(Policy{Mode: ModeAsk}))
-
-	assert.Equal(t, ModeAsk, store.Evaluate(testPeer), "unknown senders are asked about")
-
-	require.NoError(t, store.SetSenderRule(testPeer, SenderRuleBlock))
-	assert.Equal(t, ModeOff, store.Evaluate(testPeer), "a blocked sender is refused")
-
-	require.NoError(t, store.SetSenderRule(testPeer, SenderRuleAlwaysAccept))
-	assert.Equal(t, ModeAutoAccept, store.Evaluate(testPeer), "an always-accept sender skips the prompt")
-
-	require.NoError(t, store.SetSenderRule(testPeer, SenderRuleDefault))
-	assert.Equal(t, ModeAsk, store.Evaluate(testPeer), "clearing the rule restores the base mode")
-}
-
-func TestPolicyRejectsUnknownModeAndDeniesOnCorruptRule(t *testing.T) {
-	store := NewPolicyStore(testProfile)
-
-	require.Error(t, store.SetMode(Mode(200)), "an unknown mode must be rejected")
-	assert.Equal(t, ModeAsk, store.Get().Mode, "the rejected mode must not be applied")
-
-	require.NoError(t, store.SetSenderRule(testPeer, SenderRule(200)))
-	assert.Equal(t, ModeOff, store.Evaluate(testPeer), "an unrecognized rule must deny")
-}
-
-type memStore struct {
-	mu       sync.Mutex
-	sections map[string][]byte
-	loadErr  error
-}
-
-func newMemStore() *memStore {
-	return &memStore{sections: map[string][]byte{}}
-}
-
-func (s *memStore) Get(namespace string, v any) (bool, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if s.loadErr != nil {
-		return false, s.loadErr
-	}
-	raw, ok := s.sections[namespace]
-	if !ok {
-		return false, nil
-	}
-	return true, json.Unmarshal(raw, v)
-}
-
-func (s *memStore) Put(namespace string, v any) error {
-	raw, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.sections[namespace] = raw
-	return nil
-}
-
-func TestPolicyIsScopedPerProfile(t *testing.T) {
-	work, home := profilemanager.ID("work"), profilemanager.ID("home")
-	workPrefs, homePrefs := newMemStore(), newMemStore()
-
-	workStore := LoadPolicyStore(work, workPrefs)
-	require.NoError(t, workStore.SetMode(ModeOff))
-	require.NoError(t, workStore.SetSenderRule(testPeer, SenderRuleBlock))
-
-	homeStore := LoadPolicyStore(home, homePrefs)
-	assert.Equal(t, ModeAsk, homeStore.Get().Mode, "another profile keeps the default mode")
-	assert.Equal(t, ModeAsk, homeStore.Evaluate(testPeer), "a block in one profile must not apply to another")
-
-	reloaded := LoadPolicyStore(work, workPrefs)
-	assert.Equal(t, ModeOff, reloaded.Get().Mode, "the profile's mode must survive a reload")
-	assert.Equal(t, ModeOff, reloaded.Evaluate(testPeer), "the profile's sender rule must survive a reload")
-}
-
-func TestPolicyFallsBackToDefaultsOnLoadFailure(t *testing.T) {
-	prefs := newMemStore()
-	prefs.loadErr = errors.New("store unavailable")
-
-	store := LoadPolicyStore(testProfile, prefs)
-
-	assert.Equal(t, ModeAsk, store.Get().Mode, "an unreadable policy must not open the device up")
-	assert.Equal(t, ModeAsk, store.Evaluate(testPeer), "the safe default applies to unknown senders")
-}
-
-func TestPolicyRejectsStoredInvalidModeOnLoad(t *testing.T) {
-	prefs := newMemStore()
-	require.NoError(t, prefs.Put(namespacePolicy, Policy{Mode: Mode(200)}))
-
-	store := LoadPolicyStore(testProfile, prefs)
-
-	assert.Equal(t, ModeAsk, store.Get().Mode, "a corrupted stored mode must fall back to the default")
-}
-
-func TestStoreKeepsPolicyAndHistoryApart(t *testing.T) {
-	prefs := newMemStore()
-
-	mgr, err := NewManager(ManagerConfig{Profile: testProfile, DataDir: t.TempDir(), Store: prefs})
-	require.NoError(t, err)
-	require.NoError(t, mgr.Policy().SetMode(ModeAutoAccept))
-	require.NoError(t, mgr.SetDestinationDir("/tmp/received"))
-	mgr.history.Upsert(Transfer{ID: "offer-1", PeerKey: testPeer, State: StateCompleted})
-	require.NoError(t, mgr.Close())
-
-	reloaded, err := NewManager(ManagerConfig{Profile: testProfile, DataDir: t.TempDir(), Store: prefs})
-	require.NoError(t, err)
-	defer func() { require.NoError(t, reloaded.Close()) }()
-
-	assert.Equal(t, ModeAutoAccept, reloaded.Policy().Get().Mode, "the policy must survive a reload")
-	assert.Equal(t, "/tmp/received", reloaded.DestinationDir(), "the destination must survive a reload")
-	require.Len(t, reloaded.Transfers(), 1, "the history must survive a reload")
-	assert.Equal(t, OfferID("offer-1"), reloaded.Transfers()[0].ID)
-}
-
-func TestHistoryDropsOldestTerminalEntriesOverCap(t *testing.T) {
-	history := LoadHistory(newMemStore())
-
-	for i := 0; i < historyCap+10; i++ {
-		history.Upsert(Transfer{ID: OfferID(fmt.Sprintf("offer-%d", i)), State: StateCompleted})
-	}
-
-	entries := history.List()
-	require.Len(t, entries, historyCap, "the log must stay bounded")
-	assert.Equal(t, OfferID(fmt.Sprintf("offer-%d", historyCap+9)), entries[0].ID, "the newest entry stays")
-}
-
-func TestHistoryKeepsLiveTransfersOverCap(t *testing.T) {
-	history := LoadHistory(newMemStore())
-
-	history.Upsert(Transfer{ID: "live", State: StateTransferring})
-	for i := 0; i < historyCap+5; i++ {
-		history.Upsert(Transfer{ID: OfferID(fmt.Sprintf("done-%d", i)), State: StateCompleted})
-	}
-
-	_, ok := history.Get("live")
-	assert.True(t, ok, "a transfer still running must not be pruned")
-}
-
-func TestHistorySettlesTransfersInterruptedByRestart(t *testing.T) {
-	store := newMemStore()
-
-	history := LoadHistory(store)
-	history.Upsert(Transfer{ID: "pending", State: StatePending})
-	history.Upsert(Transfer{ID: "moving", State: StateTransferring})
-	history.Upsert(Transfer{ID: "done", State: StateCompleted})
-	history.Upsert(Transfer{ID: "refused", State: StateDeclined})
-
-	// A fresh load stands in for the next process: nothing survives to finish
-	// whatever was still moving.
-	reloaded := LoadHistory(store)
-
-	for _, tc := range []struct {
-		id     OfferID
-		state  State
-		reason FailureReason
-	}{
-		{"pending", StateFailed, ReasonInterrupted},
-		{"moving", StateFailed, ReasonInterrupted},
-		{"done", StateCompleted, ReasonNone},
-		{"refused", StateDeclined, ReasonNone},
-	} {
-		entry, ok := reloaded.Get(tc.id)
-		require.True(t, ok, "entry %s must survive the reload", tc.id)
-		assert.Equal(t, tc.state, entry.State, "state of %s", tc.id)
-		assert.Equal(t, tc.reason, entry.Reason, "reason of %s", tc.id)
-	}
-
-	// The settled states are written back, so a third start sees them as final
-	// rather than settling them again.
-	third := LoadHistory(store)
-	entry, ok := third.Get("moving")
-	require.True(t, ok)
-	assert.Equal(t, StateFailed, entry.State)
-}
-
-func TestSpoolWriteTruncatesStaleTail(t *testing.T) {
-	spool, err := NewSpool(t.TempDir())
-	require.NoError(t, err)
-
-	id := OfferID("offer")
-	require.NoError(t, spool.Prepare(id))
-
-	_, err = spool.Write(id, 0, 0, strings.NewReader("AAAAAAAAAA"), 10)
-	require.NoError(t, err)
-
-	total, err := spool.Write(id, 0, 2, strings.NewReader("BB"), 10)
-	require.NoError(t, err)
-	assert.Equal(t, int64(4), total, "staged size follows the resumed write")
-
-	staged, err := os.ReadFile(spool.Path(id, 0))
-	require.NoError(t, err)
-	assert.Equal(t, "AABB", string(staged), "stale bytes past the offset must be dropped")
-}
-
-func TestSpoolCleanupDropsStalePartials(t *testing.T) {
-	spool, err := NewSpool(t.TempDir())
-	require.NoError(t, err)
-
-	stale, fresh := OfferID("stale"), OfferID("fresh")
-	require.NoError(t, spool.Prepare(stale))
-	require.NoError(t, spool.Prepare(fresh))
-
-	old := time.Now().Add(-2 * time.Hour)
-	require.NoError(t, os.Chtimes(spool.OfferDir(stale), old, old))
-
-	spool.Cleanup(time.Hour, time.Now())
-
-	_, err = os.Stat(spool.OfferDir(stale))
-	assert.True(t, os.IsNotExist(err), "the stale offer dir must be removed")
-
-	_, err = os.Stat(spool.OfferDir(fresh))
-	assert.NoError(t, err, "a recent offer dir must survive")
-}
-
-func TestParseOfferPath(t *testing.T) {
-	tests := []struct {
-		path     string
-		id       OfferID
-		index    int
-		hasIndex bool
-		wantErr  bool
-	}{
-		{path: "/v1/offers/abc", id: "abc"},
-		{path: "/v1/offers/abc/files/3", id: "abc", index: 3, hasIndex: true},
-		{path: "/v1/offers/", wantErr: true},
-		{path: "/v1/offers/abc/files", wantErr: true},
-		{path: "/v1/offers/abc/other/1", wantErr: true},
-		{path: "/v1/offers/abc/files/-1", wantErr: true},
-		{path: "/v1/offers/abc/files/x", wantErr: true},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.path, func(t *testing.T) {
-			id, index, hasIndex, err := parseOfferPath(tc.path)
-			if tc.wantErr {
-				assert.Error(t, err)
-				return
-			}
-			require.NoError(t, err)
-			assert.Equal(t, tc.id, id)
-			assert.Equal(t, tc.index, index)
-			assert.Equal(t, tc.hasIndex, hasIndex)
-		})
-	}
-}
-
-func TestValidateOffer(t *testing.T) {
-	assert.Error(t, validateOffer(nil), "an empty offer is invalid")
-	assert.Error(t, validateOffer([]FileMeta{{Name: "x", Size: -1}}), "a negative size is invalid")
-	assert.Error(t, validateOffer(make([]FileMeta, MaxOfferFiles+1)), "too many files is invalid")
-	assert.Error(t, validateOffer([]FileMeta{{
-		Name: "x", Kind: KindText, Text: strings.Repeat("a", MaxInlineTextSize+1),
-	}}), "oversized inline text is invalid")
-
-	assert.NoError(t, validateOffer([]FileMeta{{Name: "x", Size: 10}}))
-}
-
-func TestStopIsIdempotent(t *testing.T) {
-	srv, err := NewServer(ServerConfig{
-		SpoolDir: t.TempDir(),
-		Policy:   NewPolicyStore(testProfile),
-		Resolver: staticResolver{key: testPeer},
-	})
-	require.NoError(t, err)
-
-	require.NoError(t, srv.Stop(), "stopping a server that never started is a no-op")
-
-	require.NoError(t, srv.Start(context.Background(), netip.AddrPortFrom(netip.AddrFrom4([4]byte{127, 0, 0, 1}), 0)))
-	require.NoError(t, srv.Stop())
-	require.NoError(t, srv.Stop(), "the second stop must also be a no-op")
-}
-
-func TestStartRejectsSecondStart(t *testing.T) {
-	srv, err := NewServer(ServerConfig{
-		SpoolDir: t.TempDir(),
-		Policy:   NewPolicyStore(testProfile),
-		Resolver: staticResolver{key: testPeer},
-	})
-	require.NoError(t, err)
-
-	addr := netip.AddrPortFrom(netip.AddrFrom4([4]byte{127, 0, 0, 1}), 0)
-	require.NoError(t, srv.Start(context.Background(), addr))
-	t.Cleanup(func() {
-		require.NoError(t, srv.Stop())
-	})
-
-	err = srv.Start(context.Background(), addr)
-	require.Error(t, err, "a running server must reject a second start")
-
-	srv.mu.RLock()
-	running := srv.httpServer != nil && srv.listener != nil
-	srv.mu.RUnlock()
-	assert.True(t, running, "the original listener must survive the rejected start")
-}
-
-func TestNewServerRequiresResolver(t *testing.T) {
-	_, err := NewServer(ServerConfig{SpoolDir: t.TempDir(), Policy: NewPolicyStore(testProfile)})
-	require.Error(t, err, "a server without peer resolution must not be constructed")
-}
-
-func TestNewServerRequiresPolicy(t *testing.T) {
-	_, err := NewServer(ServerConfig{SpoolDir: t.TempDir(), Resolver: staticResolver{key: testPeer}})
-	require.Error(t, err, "a server without a profile policy must not be constructed")
-}
-
-func TestNewClientRequiresDialer(t *testing.T) {
-	_, err := NewClient(ClientConfig{})
-	require.Error(t, err, "a client without a dialer must not be constructed")
-}
-
-func TestSendRejectsEmptyPayloadSet(t *testing.T) {
-	_, client, _ := startTestServer(t, ModeAutoAccept, staticResolver{key: testPeer})
-
-	_, err := client.Send(context.Background(), testAddr, nil, nil)
-	assert.True(t, errors.Is(err, ErrInvalidOffer), "sending nothing is an invalid offer")
-}
-
-func TestServerFallsBackWhenPortBusy(t *testing.T) {
-	blocker, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err, "blocker listener must bind")
-	defer func() {
-		require.NoError(t, blocker.Close())
-	}()
-	busyPort := uint16(blocker.Addr().(*net.TCPAddr).Port)
-
-	srv, err := NewServer(ServerConfig{
-		SpoolDir: t.TempDir(),
-		Policy:   NewPolicyStore(testProfile),
-		Resolver: staticResolver{key: testPeer},
-	})
-	require.NoError(t, err)
-
-	addr := netip.AddrPortFrom(netip.AddrFrom4([4]byte{127, 0, 0, 1}), busyPort)
-	require.NoError(t, srv.Start(context.Background(), addr), "start must fall back instead of failing")
-	t.Cleanup(func() {
-		require.NoError(t, srv.Stop())
-	})
-
-	bound := srv.BoundPort()
-	assert.NotZero(t, bound, "fallback must report the bound port")
-	assert.NotEqual(t, busyPort, bound, "fallback must pick a different port")
-}
-
-func TestPortRegistryAwait(t *testing.T) {
-	reg := NewPortRegistry()
-
-	reg.Set(testPeer, 5000)
-	port, changed := reg.Await(context.Background(), testPeer, 0)
-	assert.True(t, changed, "known differing port must return immediately")
-	assert.Equal(t, uint16(5000), port)
-
-	go func() {
-		time.Sleep(50 * time.Millisecond)
-		reg.Set(testPeer, 5000)
-	}()
-	_, changed = reg.Await(context.Background(), testPeer, 5000)
-	assert.False(t, changed, "an advertisement equal to the used port must release the waiter as unchanged")
-
-	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-	defer cancel()
-	_, changed = reg.Await(ctx, testPeer, 5000)
-	assert.False(t, changed, "timeout without advertisement must report unchanged")
-}
-
-// senderManager builds a send-only manager whose dialer reaches the test server only
-// on realPort; other ports behave per defaultPortBehavior ("refuse" or "hang").
-func senderManager(t *testing.T, serverAddr string, realPort uint16, defaultPortBehavior string) *Manager {
-	t.Helper()
-
-	mgr, err := NewManager(ManagerConfig{Profile: testProfile, DataDir: t.TempDir()})
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		require.NoError(t, mgr.Close())
-	})
-
-	mgr.SetTunnel(func(ctx context.Context, network, addr string) (net.Conn, error) {
-		ap, err := netip.ParseAddrPort(addr)
-		require.NoError(t, err, "dialer must receive a valid addr")
-		if ap.Port() == realPort {
-			var d net.Dialer
-			return d.DialContext(ctx, network, serverAddr)
-		}
-		if defaultPortBehavior == "hang" {
-			<-ctx.Done()
-			return nil, ctx.Err()
-		}
-		return nil, &net.OpError{Op: "dial", Net: network, Err: errors.New("connection refused")}
-	}, "sender")
-
-	return mgr
-}
-
-func waitForState(t *testing.T, mgr *Manager, id OfferID, want State) {
-	t.Helper()
-	require.Eventually(t, func() bool {
-		tr, ok := mgr.history.Get(id)
-		return ok && tr.State == want
-	}, 10*time.Second, 20*time.Millisecond, "transfer must reach state %s", want)
-}
-
-func TestSendRetriesOnAdvertisedPort(t *testing.T) {
-	srv, _, _ := startTestServer(t, ModeAutoAccept, staticResolver{key: PeerKey("sender-key")})
-	srv.mu.RLock()
-	serverAddr := srv.listener.Addr().String()
-	srv.mu.RUnlock()
-	realPort := srv.BoundPort()
-
-	mgr := senderManager(t, serverAddr, realPort, "refuse")
-
-	id, err := mgr.Send(testPeer, "receiver", netip.AddrFrom4([4]byte{100, 64, 0, 9}), []Payload{TextPayload("t", "hello")})
-	require.NoError(t, err)
-
-	time.Sleep(100 * time.Millisecond)
-	mgr.Ports().Set(testPeer, realPort)
-
-	waitForState(t, mgr, id, StateCompleted)
-}
-
-func TestSendAbortsHangingAttemptOnAdvertisedPort(t *testing.T) {
-	srv, _, _ := startTestServer(t, ModeAutoAccept, staticResolver{key: PeerKey("sender-key")})
-	srv.mu.RLock()
-	serverAddr := srv.listener.Addr().String()
-	srv.mu.RUnlock()
-	realPort := srv.BoundPort()
-
-	mgr := senderManager(t, serverAddr, realPort, "hang")
-
-	id, err := mgr.Send(testPeer, "receiver", netip.AddrFrom4([4]byte{100, 64, 0, 9}), []Payload{TextPayload("t", "hello")})
-	require.NoError(t, err)
-
-	time.Sleep(100 * time.Millisecond)
-	mgr.Ports().Set(testPeer, realPort)
-
-	waitForState(t, mgr, id, StateCompleted)
-}
-
-func TestSendFailsWhenSignalConfirmsUsedPort(t *testing.T) {
-	mgr := senderManager(t, "127.0.0.1:1", 1, "refuse")
-
-	id, err := mgr.Send(testPeer, "receiver", netip.AddrFrom4([4]byte{100, 64, 0, 9}), []Payload{TextPayload("t", "hello")})
-	require.NoError(t, err)
-
-	time.Sleep(100 * time.Millisecond)
-	mgr.Ports().Set(testPeer, 0)
-
-	waitForState(t, mgr, id, StateFailed)
-}

client/internal/filedrop/history.go

@@ -1,205 +0,0 @@
-package filedrop
-
-import (
-	"fmt"
-	"slices"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// The transfer directions.
-const (
-	DirectionReceived Direction = iota
-	DirectionSent
-)
-
-// The failure reasons a transfer can end with; None accompanies every other state.
-const (
-	ReasonNone FailureReason = iota
-	// ReasonUnreachable marks a transport-level failure: nothing listens on the
-	// peer's file drop port, so the client is old or receiving is off.
-	ReasonUnreachable
-	// ReasonInterrupted marks a transfer that was still moving when the process
-	// stopped; nothing survived to finish or resume it.
-	ReasonInterrupted
-)
-
-const historyCap = 30
-
-// Direction tells whether a transfer was sent by this device or received on it.
-type Direction uint8
-
-// FailureReason classifies why a transfer failed, when it is known.
-type FailureReason uint8
-
-// String implements fmt.Stringer.
-func (d Direction) String() string {
-	switch d {
-	case DirectionReceived:
-		return "received"
-	case DirectionSent:
-		return "sent"
-	default:
-		return fmt.Sprintf("unknown(%d)", uint8(d))
-	}
-}
-
-// Transfer is one history entry: a sent or received offer with its outcome.
-type Transfer struct {
-	ID             OfferID       `json:"id"`
-	Direction      Direction     `json:"direction"`
-	PeerKey        PeerKey       `json:"peerKey"`
-	PeerName       string        `json:"peerName"`
-	Files          []FileMeta    `json:"files"`
-	State          State         `json:"state"`
-	Transferred    int64         `json:"transferred"`
-	TotalSize      int64         `json:"totalSize"`
-	CreatedAt      time.Time     `json:"createdAt"`
-	UpdatedAt      time.Time     `json:"updatedAt"`
-	DeliveredPaths []string      `json:"deliveredPaths,omitempty"`
-	Error          string        `json:"error,omitempty"`
-	Reason         FailureReason `json:"reason,omitempty"`
-}
-
-// History is the persisted transfer log of one profile, newest first.
-type History struct {
-	mu      sync.RWMutex
-	store   Store
-	entries []Transfer
-}
-
-// LoadHistory reads the stored transfer log, starting empty when unreadable.
-func LoadHistory(store Store) *History {
-	h := &History{store: store}
-
-	var entries []Transfer
-	if err := loadSection(store, namespaceHistory, &entries); err != nil {
-		log.Warnf("failed to read file drop history, starting empty: %v", err)
-		return h
-	}
-	h.entries = entries
-	if h.settleInterrupted() {
-		h.persist()
-	}
-	return h
-}
-
-func (t Transfer) terminal() bool {
-	switch t.State {
-	case StateCompleted, StateDeclined, StateExpired, StateCancelled, StateFailed:
-		return true
-	default:
-		return false
-	}
-}
-
-func (t Transfer) clone() Transfer {
-	c := t
-	c.Files = slices.Clone(t.Files)
-	c.DeliveredPaths = slices.Clone(t.DeliveredPaths)
-	return c
-}
-
-// Upsert inserts or replaces the entry with the same ID and persists the log.
-func (h *History) Upsert(t Transfer) {
-	t.UpdatedAt = time.Now()
-
-	h.mu.Lock()
-	defer h.mu.Unlock()
-
-	if i := h.indexOf(t.ID); i >= 0 {
-		h.entries[i] = t
-	} else {
-		h.entries = slices.Insert(h.entries, 0, t)
-		h.prune()
-	}
-	h.persist()
-}
-
-// SetProgress updates the transferred byte count in memory only.
-func (h *History) SetProgress(id OfferID, transferred int64) {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-
-	if i := h.indexOf(id); i >= 0 {
-		h.entries[i].Transferred = transferred
-		h.entries[i].UpdatedAt = time.Now()
-		if h.entries[i].State == StatePending {
-			h.entries[i].State = StateTransferring
-		}
-	}
-}
-
-// Get returns the entry with the given ID.
-func (h *History) Get(id OfferID) (Transfer, bool) {
-	h.mu.RLock()
-	defer h.mu.RUnlock()
-
-	if i := h.indexOf(id); i >= 0 {
-		return h.entries[i].clone(), true
-	}
-	return Transfer{}, false
-}
-
-// List returns every entry, newest first.
-func (h *History) List() []Transfer {
-	h.mu.RLock()
-	defer h.mu.RUnlock()
-
-	list := make([]Transfer, len(h.entries))
-	for i, e := range h.entries {
-		list[i] = e.clone()
-	}
-	return list
-}
-
-// Delete removes one entry and persists the log.
-func (h *History) Delete(id OfferID) {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-
-	if i := h.indexOf(id); i >= 0 {
-		h.entries = slices.Delete(h.entries, i, i+1)
-		h.persist()
-	}
-}
-
-func (h *History) indexOf(id OfferID) int {
-	return slices.IndexFunc(h.entries, func(t Transfer) bool { return t.ID == id })
-}
-
-func (h *History) prune() {
-	if len(h.entries) <= historyCap {
-		return
-	}
-	for i := len(h.entries) - 1; i >= 0 && len(h.entries) > historyCap; i-- {
-		if h.entries[i].terminal() {
-			h.entries = slices.Delete(h.entries, i, i+1)
-		}
-	}
-}
-
-// settleInterrupted closes out transfers that were still moving when the
-// process died. Nothing is left to finish them, so left alone they would sit in
-// the log as permanently pending. Reports whether anything changed.
-func (h *History) settleInterrupted() bool {
-	changed := false
-	for i, t := range h.entries {
-		if t.terminal() {
-			continue
-		}
-		h.entries[i].State = StateFailed
-		h.entries[i].Reason = ReasonInterrupted
-		h.entries[i].UpdatedAt = time.Now()
-		changed = true
-	}
-	return changed
-}
-
-func (h *History) persist() {
-	if err := saveSection(h.store, namespaceHistory, h.entries); err != nil {
-		log.Warnf("failed to write file drop history: %v", err)
-	}
-}

client/internal/filedrop/http.go

@@ -1,221 +0,0 @@
-package filedrop
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/netip"
-	"strconv"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// httpTransport adapts the receiver to plain HTTP/1.1 over the tunnel. It only
-// parses requests, maps domain errors to status codes, and encodes responses.
-type httpTransport struct {
-	recv *receiver
-}
-
-func (t *httpTransport) routes() http.Handler {
-	mux := http.NewServeMux()
-	mux.HandleFunc(pathOffers, t.handleOffers)
-	mux.HandleFunc(pathOffersSlash, t.handleOffer)
-	return mux
-}
-
-func (t *httpTransport) handleOffers(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		return
-	}
-
-	sender, ok := t.identify(w, r)
-	if !ok {
-		return
-	}
-
-	var req OfferRequest
-	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, maxOfferBodySize)).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "malformed offer")
-		return
-	}
-
-	offer, err := t.recv.submitOffer(sender, req)
-	if err != nil {
-		writeDomainError(w, err)
-		return
-	}
-
-	status := http.StatusAccepted
-	if offer.Decision == DecisionAccepted {
-		status = http.StatusCreated
-	}
-	writeJSON(w, status, OfferResponse{ID: offer.ID, Decision: offer.Decision})
-}
-
-func (t *httpTransport) handleOffer(w http.ResponseWriter, r *http.Request) {
-	sender, ok := t.identify(w, r)
-	if !ok {
-		return
-	}
-
-	id, index, hasIndex, err := parseOfferPath(r.URL.Path)
-	if err != nil {
-		writeError(w, http.StatusNotFound, "unknown path")
-		return
-	}
-
-	if !hasIndex {
-		switch r.Method {
-		case http.MethodGet:
-			t.handleOfferStatus(w, r, sender, id)
-		case http.MethodDelete:
-			t.handleOfferCancel(w, sender, id)
-		default:
-			writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-		}
-		return
-	}
-
-	switch r.Method {
-	case http.MethodPut:
-		t.handleUpload(w, r, sender, id, index)
-	case http.MethodHead:
-		t.handleUploadProbe(w, sender, id, index)
-	default:
-		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
-	}
-}
-
-func (t *httpTransport) handleOfferStatus(w http.ResponseWriter, r *http.Request, sender senderIdentity, id OfferID) {
-	offer, err := t.recv.awaitDecision(r.Context(), sender, id)
-	if err != nil {
-		if errors.Is(err, ErrOfferNotFound) {
-			writeDomainError(w, err)
-		}
-		return
-	}
-	writeJSON(w, http.StatusOK, OfferResponse{ID: offer.ID, Decision: offer.Decision})
-}
-
-func (t *httpTransport) handleOfferCancel(w http.ResponseWriter, sender senderIdentity, id OfferID) {
-	if err := t.recv.withdraw(sender, id); err != nil {
-		writeDomainError(w, err)
-		return
-	}
-	w.WriteHeader(http.StatusNoContent)
-}
-
-func (t *httpTransport) handleUploadProbe(w http.ResponseWriter, sender senderIdentity, id OfferID, index int) {
-	received, err := t.recv.receivedBytes(sender, id, index)
-	if err != nil {
-		writeDomainError(w, err)
-		return
-	}
-	w.Header().Set(HeaderReceivedBytes, strconv.FormatInt(received, 10))
-	w.WriteHeader(http.StatusOK)
-}
-
-func (t *httpTransport) handleUpload(w http.ResponseWriter, r *http.Request, sender senderIdentity, id OfferID, index int) {
-	offset, err := parseOffset(r.URL.Query().Get("offset"))
-	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	if err := t.recv.upload(sender, id, index, offset, r.Body); err != nil {
-		writeDomainError(w, err)
-		return
-	}
-	w.WriteHeader(http.StatusNoContent)
-}
-
-func (t *httpTransport) identify(w http.ResponseWriter, r *http.Request) (senderIdentity, bool) {
-	host, _, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		host = r.RemoteAddr
-	}
-
-	addr, err := netip.ParseAddr(host)
-	if err != nil {
-		writeError(w, http.StatusForbidden, "unknown sender")
-		return senderIdentity{}, false
-	}
-
-	sender, ok := t.recv.identify(addr)
-	if !ok {
-		writeError(w, http.StatusForbidden, "unknown sender")
-		return senderIdentity{}, false
-	}
-	return sender, true
-}
-
-func writeDomainError(w http.ResponseWriter, err error) {
-	switch {
-	case errors.Is(err, ErrRefused), errors.Is(err, ErrNotAccepted), errors.Is(err, ErrUnknownPeer):
-		writeError(w, http.StatusForbidden, err.Error())
-	case errors.Is(err, ErrOfferNotFound):
-		writeError(w, http.StatusNotFound, err.Error())
-	case errors.Is(err, ErrInvalidOffer):
-		writeError(w, http.StatusBadRequest, err.Error())
-	case errors.Is(err, ErrStorage):
-		writeError(w, http.StatusInsufficientStorage, err.Error())
-	default:
-		writeError(w, http.StatusInternalServerError, err.Error())
-	}
-}
-
-func parseOfferPath(path string) (OfferID, int, bool, error) {
-	rest := strings.TrimPrefix(path, pathOffersSlash)
-	if rest == "" || rest == path {
-		return "", 0, false, fmt.Errorf("not an offer path")
-	}
-
-	parts := strings.Split(rest, "/")
-	if parts[0] == "" {
-		return "", 0, false, fmt.Errorf("missing offer id")
-	}
-	id := OfferID(parts[0])
-
-	switch len(parts) {
-	case 1:
-		return id, 0, false, nil
-	case 3:
-		if parts[1] != segmentFiles {
-			return "", 0, false, fmt.Errorf("unknown sub-resource %q", parts[1])
-		}
-		index, err := strconv.Atoi(parts[2])
-		if err != nil || index < 0 {
-			return "", 0, false, fmt.Errorf("invalid file index")
-		}
-		return id, index, true, nil
-	default:
-		return "", 0, false, fmt.Errorf("unknown offer path")
-	}
-}
-
-func parseOffset(raw string) (int64, error) {
-	if raw == "" {
-		return 0, nil
-	}
-	offset, err := strconv.ParseInt(raw, 10, 64)
-	if err != nil || offset < 0 {
-		return 0, fmt.Errorf("invalid offset")
-	}
-	return offset, nil
-}
-
-func writeJSON(w http.ResponseWriter, status int, body any) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	if err := json.NewEncoder(w).Encode(body); err != nil {
-		log.Debugf("write file drop response: %v", err)
-	}
-}
-
-func writeError(w http.ResponseWriter, status int, message string) {
-	writeJSON(w, status, map[string]string{"error": message})
-}

client/internal/filedrop/manager.go

@@ -1,660 +0,0 @@
-package filedrop
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/netip"
-	"net/url"
-	"os"
-	"path/filepath"
-	"sync"
-	"time"
-
-	"github.com/google/uuid"
-	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-)
-
-// The event kinds. Progress is not an event: live transfers are polled.
-const (
-	EventOffer EventKind = iota
-	EventCompleted
-	EventFailed
-	EventWithdrawn
-)
-
-// portSignalGrace bounds how long a failed attempt waits for one signal message
-// that may advertise the receiver's actual port before giving up.
-const portSignalGrace = 3 * time.Second
-
-// ErrNotConnected indicates the operation needs a running tunnel.
-var ErrNotConnected = errors.New("not connected")
-
-// EventKind classifies the events the manager surfaces to the platform layer.
-type EventKind uint8
-
-// EventSink receives transfer events. Calls may come from server goroutines.
-type EventSink func(kind EventKind, transfer Transfer)
-
-// ManagerConfig configures a per-profile file drop manager. Policy and history
-// live in Store; DataDir only holds the spool of partially received files,
-// which is disposable and never outlives an offer's TTL.
-type ManagerConfig struct {
-	Profile  profilemanager.ID
-	DataDir  string
-	Store    Store
-	Events   EventSink
-	OfferTTL time.Duration
-}
-
-type sendHandle struct {
-	cancel   context.CancelFunc
-	ip       netip.Addr
-	addr     netip.AddrPort
-	remoteID OfferID
-}
-
-// Manager owns one profile's file drop state.
-type Manager struct {
-	mu       sync.Mutex
-	profile  profilemanager.ID
-	dataDir  string
-	store    Store
-	policy   *PolicyStore
-	history  *History
-	events   EventSink
-	offerTTL time.Duration
-
-	server     *Server
-	ports      *PortRegistry
-	dial       DialFunc
-	senderName string
-	sends      map[OfferID]*sendHandle
-	sendWg     sync.WaitGroup
-}
-
-// NewManager loads or initializes the file drop state for one profile.
-func NewManager(cfg ManagerConfig) (*Manager, error) {
-	if cfg.DataDir == "" {
-		return nil, errors.New("data dir is required")
-	}
-	if err := os.MkdirAll(cfg.DataDir, 0o700); err != nil {
-		return nil, fmt.Errorf("create file drop dir: %w", err)
-	}
-
-	m := &Manager{
-		profile:  cfg.Profile,
-		dataDir:  cfg.DataDir,
-		store:    cfg.Store,
-		policy:   LoadPolicyStore(cfg.Profile, cfg.Store),
-		history:  LoadHistory(cfg.Store),
-		events:   cfg.Events,
-		offerTTL: cfg.OfferTTL,
-		ports:    NewPortRegistry(),
-		sends:    make(map[OfferID]*sendHandle),
-	}
-	return m, nil
-}
-
-// Profile returns the profile this manager belongs to.
-func (m *Manager) Profile() profilemanager.ID {
-	return m.profile
-}
-
-// Policy returns the receiving policy store.
-func (m *Manager) Policy() *PolicyStore {
-	return m.policy
-}
-
-// Ports returns the registry of peer-advertised listen ports; the engine feeds it
-// from incoming signal messages.
-func (m *Manager) Ports() *PortRegistry {
-	return m.ports
-}
-
-// ReceiverPort returns the port the receiver is actually bound to, 0 when stopped.
-func (m *Manager) ReceiverPort() uint16 {
-	m.mu.Lock()
-	server := m.server
-	m.mu.Unlock()
-	if server == nil {
-		return 0
-	}
-	return server.BoundPort()
-}
-
-// Transfers returns the history entries, newest first, with pending offers included.
-func (m *Manager) Transfers() []Transfer {
-	return m.history.List()
-}
-
-// DeleteTransfer removes a history entry. A live transfer is cancelled first.
-func (m *Manager) DeleteTransfer(id OfferID) {
-	if t, ok := m.history.Get(id); ok && !t.terminal() {
-		m.Cancel(id)
-	}
-	m.history.Delete(id)
-}
-
-// DestinationDir returns the directory received files are delivered to.
-func (m *Manager) DestinationDir() string {
-	return m.policy.DestinationDir()
-}
-
-// SetDestinationDir persists the delivery directory.
-func (m *Manager) SetDestinationDir(dir string) error {
-	return m.policy.SetDestinationDir(dir)
-}
-
-// StartReceiver binds the receiving server on addr.
-func (m *Manager) StartReceiver(ctx context.Context, addr netip.AddrPort, netstackNet *netstack.Net, resolver PeerResolver) error {
-	m.mu.Lock()
-	if m.server != nil {
-		m.mu.Unlock()
-		return errors.New("receiver is already running")
-	}
-	m.mu.Unlock()
-
-	server, err := NewServer(ServerConfig{
-		SpoolDir: filepath.Join(m.dataDir, "spool"),
-		Policy:   m.policy,
-		Resolver: resolver,
-		Notifier: m,
-		OfferTTL: m.offerTTL,
-	})
-	if err != nil {
-		return fmt.Errorf("create receiver: %w", err)
-	}
-	if netstackNet != nil {
-		server.SetNetstackNet(netstackNet)
-	}
-
-	if err := server.Start(ctx, addr); err != nil {
-		return fmt.Errorf("start receiver: %w", err)
-	}
-
-	m.mu.Lock()
-	m.server = server
-	m.mu.Unlock()
-	return nil
-}
-
-// AddReceiverListener serves the receiver on an additional address, such as IPv6.
-func (m *Manager) AddReceiverListener(ctx context.Context, addr netip.AddrPort) error {
-	m.mu.Lock()
-	server := m.server
-	m.mu.Unlock()
-
-	if server == nil {
-		return errors.New("receiver is not running")
-	}
-	return server.AddListener(ctx, addr)
-}
-
-// StopReceiver shuts the receiving server down and drops the tunnel dialer.
-func (m *Manager) StopReceiver() error {
-	m.mu.Lock()
-	server := m.server
-	m.server = nil
-	m.dial = nil
-	m.mu.Unlock()
-
-	if server == nil {
-		return nil
-	}
-	return server.Stop()
-}
-
-// SetTunnel gives the manager the tunnel dialer and the local sender name.
-func (m *Manager) SetTunnel(dial DialFunc, senderName string) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.dial = dial
-	m.senderName = senderName
-}
-
-// Close stops the receiver and aborts every outgoing transfer.
-func (m *Manager) Close() error {
-	err := m.StopReceiver()
-
-	m.mu.Lock()
-	for _, h := range m.sends {
-		h.cancel()
-	}
-	m.mu.Unlock()
-
-	m.sendWg.Wait()
-	return err
-}
-
-// Send starts an asynchronous transfer and returns its local transfer ID.
-func (m *Manager) Send(peer PeerKey, peerName string, addr netip.Addr, payloads []Payload) (OfferID, error) {
-	if len(payloads) == 0 {
-		return "", fmt.Errorf("%w: no payloads", ErrInvalidOffer)
-	}
-
-	m.mu.Lock()
-	dial, senderName := m.dial, m.senderName
-	m.mu.Unlock()
-	if dial == nil {
-		return "", ErrNotConnected
-	}
-
-	client, err := NewClient(ClientConfig{Dial: dial, SenderName: senderName, OfferTimeout: m.offerTTL})
-	if err != nil {
-		return "", err
-	}
-
-	id := OfferID(uuid.NewString())
-	ctx, cancel := context.WithCancel(context.Background())
-	handle := &sendHandle{cancel: cancel, ip: addr}
-
-	m.mu.Lock()
-	m.sends[id] = handle
-	m.mu.Unlock()
-
-	transfer := Transfer{
-		ID:        id,
-		Direction: DirectionSent,
-		PeerKey:   peer,
-		PeerName:  peerName,
-		Files:     payloadMetas(payloads),
-		State:     StatePending,
-		TotalSize: payloadTotal(payloads),
-		CreatedAt: time.Now(),
-	}
-	m.history.Upsert(transfer)
-
-	m.sendWg.Add(1)
-	go func() {
-		defer m.sendWg.Done()
-		defer cancel()
-		m.runSend(ctx, client, handle, transfer, payloads)
-
-		m.mu.Lock()
-		delete(m.sends, id)
-		m.mu.Unlock()
-	}()
-
-	return id, nil
-}
-
-// Cancel aborts a transfer in either direction.
-func (m *Manager) Cancel(id OfferID) {
-	m.mu.Lock()
-	handle := m.sends[id]
-	server := m.server
-	var remoteAddr netip.AddrPort
-	var remoteID OfferID
-	if handle != nil {
-		remoteAddr, remoteID = handle.addr, handle.remoteID
-	}
-	m.mu.Unlock()
-
-	if handle != nil {
-		handle.cancel()
-		if remoteID != "" && remoteAddr.IsValid() {
-			m.withdrawRemote(remoteAddr, remoteID)
-		}
-		m.finishTransfer(id, StateCancelled, "")
-		return
-	}
-
-	if server != nil {
-		if offer, ok := server.Offers().Decide(id, DecisionDeclined); ok {
-			server.Spool().Remove(offer.ID)
-		}
-	}
-	m.finishTransfer(id, StateCancelled, "")
-}
-
-// Accept releases a pending incoming offer for upload.
-func (m *Manager) Accept(id OfferID) error {
-	m.mu.Lock()
-	server := m.server
-	m.mu.Unlock()
-	if server == nil {
-		return ErrNotConnected
-	}
-
-	offer, ok := server.Offers().Decide(id, DecisionAccepted)
-	if !ok {
-		return ErrOfferNotFound
-	}
-
-	if offer.State == StateCompleted {
-		m.OnCompleted(offer)
-		return nil
-	}
-
-	m.history.SetProgress(id, 0)
-	return nil
-}
-
-// Decline refuses a pending incoming offer.
-func (m *Manager) Decline(id OfferID) error {
-	m.mu.Lock()
-	server := m.server
-	m.mu.Unlock()
-	if server == nil {
-		return ErrNotConnected
-	}
-
-	offer, ok := server.Offers().Decide(id, DecisionDeclined)
-	if !ok {
-		return ErrOfferNotFound
-	}
-
-	server.Spool().Remove(offer.ID)
-	m.finishTransfer(id, StateDeclined, "")
-	return nil
-}
-
-// SetSenderRule records a per-sender exception.
-func (m *Manager) SetSenderRule(peer PeerKey, rule SenderRule) error {
-	if err := m.policy.SetSenderRule(peer, rule); err != nil {
-		return err
-	}
-	if rule != SenderRuleBlock {
-		return nil
-	}
-
-	m.mu.Lock()
-	server := m.server
-	m.mu.Unlock()
-	if server == nil {
-		return nil
-	}
-
-	for _, offer := range server.Offers().List() {
-		if offer.Sender != peer || offer.Decision != DecisionPending {
-			continue
-		}
-		if declined, ok := server.Offers().Decide(offer.ID, DecisionDeclined); ok {
-			server.Spool().Remove(declined.ID)
-			m.finishTransfer(declined.ID, StateDeclined, "")
-			m.emit(EventWithdrawn, m.transferOf(declined.ID))
-		}
-	}
-	return nil
-}
-
-func (m *Manager) runSend(ctx context.Context, client *Client, handle *sendHandle, transfer Transfer, payloads []Payload) {
-	addr, remoteID, decision, err := m.offerWithPortRetry(ctx, client, handle, transfer.PeerKey, payloads)
-	if err != nil {
-		m.failSend(ctx, transfer.ID, err)
-		return
-	}
-
-	decision, err = client.AwaitDecision(ctx, addr, remoteID, decision)
-	if err != nil {
-		m.failSend(ctx, transfer.ID, err)
-		return
-	}
-	if err := decisionError(decision); err != nil {
-		m.failSend(ctx, transfer.ID, err)
-		return
-	}
-
-	m.history.SetProgress(transfer.ID, 0)
-
-	completed := make([]int64, len(payloads))
-	progress := func(index int, sent, _ int64) {
-		completed[index] = sent
-		var total int64
-		for _, n := range completed {
-			total += n
-		}
-		m.history.SetProgress(transfer.ID, total)
-	}
-
-	if err := client.Upload(ctx, addr, remoteID, payloads, progress); err != nil {
-		m.failSend(ctx, transfer.ID, err)
-		return
-	}
-
-	m.history.SetProgress(transfer.ID, transfer.TotalSize)
-	m.finishTransfer(transfer.ID, StateCompleted, "")
-	m.emit(EventCompleted, m.transferOf(transfer.ID))
-}
-
-// offerWithPortRetry places the offer on the last advertised port, falling back to
-// the default. When the attempt fails on the transport, it waits out one signal
-// message that may carry the receiver's actual port and retries there once. A port
-// learned mid-attempt aborts the attempt immediately instead of letting it hang.
-func (m *Manager) offerWithPortRetry(ctx context.Context, client *Client, handle *sendHandle, key PeerKey, payloads []Payload) (netip.AddrPort, OfferID, Decision, error) {
-	used := m.ports.Port(key)
-	addr := netip.AddrPortFrom(handle.ip, effectivePort(used))
-
-	remoteID, decision, err := m.offerWatchingPorts(ctx, client, key, used, addr, payloads)
-	if err == nil {
-		m.storeRemote(handle, addr, remoteID)
-		return addr, remoteID, decision, nil
-	}
-	if ctx.Err() != nil || !transportFailure(err) {
-		return addr, remoteID, decision, err
-	}
-
-	graceCtx, cancel := context.WithTimeout(ctx, portSignalGrace)
-	port, changed := m.ports.Await(graceCtx, key, used)
-	cancel()
-	if !changed {
-		return addr, remoteID, decision, err
-	}
-
-	addr = netip.AddrPortFrom(handle.ip, effectivePort(port))
-	remoteID, decision, err = client.Offer(ctx, addr, payloads)
-	if err != nil {
-		return addr, remoteID, decision, err
-	}
-	m.storeRemote(handle, addr, remoteID)
-	return addr, remoteID, decision, nil
-}
-
-// offerWatchingPorts runs the offer while watching for a port advertisement that
-// differs from the one in use; such an advertisement aborts the in-flight attempt.
-func (m *Manager) offerWatchingPorts(ctx context.Context, client *Client, key PeerKey, used uint16, addr netip.AddrPort, payloads []Payload) (OfferID, Decision, error) {
-	watchCtx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	go func() {
-		if _, changed := m.ports.Await(watchCtx, key, used); changed {
-			cancel()
-		}
-	}()
-
-	return client.Offer(watchCtx, addr, payloads)
-}
-
-func (m *Manager) storeRemote(handle *sendHandle, addr netip.AddrPort, remoteID OfferID) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	handle.addr = addr
-	handle.remoteID = remoteID
-}
-
-func (m *Manager) failSend(ctx context.Context, id OfferID, err error) {
-	if ctx.Err() != nil {
-		m.finishTransfer(id, StateCancelled, "")
-		return
-	}
-
-	state := StateFailed
-	switch {
-	case errors.Is(err, ErrDeclined):
-		state = StateDeclined
-	case errors.Is(err, ErrExpired):
-		state = StateExpired
-	}
-
-	message := ""
-	reason := ReasonNone
-	if state == StateFailed {
-		message = err.Error()
-		if transportFailure(err) {
-			reason = ReasonUnreachable
-		}
-	}
-	m.finishTransferReason(id, state, message, reason)
-	m.emit(EventFailed, m.transferOf(id))
-}
-
-func (m *Manager) withdrawRemote(addr netip.AddrPort, remoteID OfferID) {
-	m.mu.Lock()
-	dial, senderName := m.dial, m.senderName
-	m.mu.Unlock()
-	if dial == nil {
-		return
-	}
-
-	client, err := NewClient(ClientConfig{Dial: dial, SenderName: senderName})
-	if err != nil {
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	if err := client.Cancel(ctx, addr, remoteID); err != nil {
-		log.Debugf("failed to withdraw file drop offer: %v", err)
-	}
-}
-
-// OnOffer implements Notifier for the receiver server.
-func (m *Manager) OnOffer(offer Offer) {
-	transfer := Transfer{
-		ID:        offer.ID,
-		Direction: DirectionReceived,
-		PeerKey:   offer.Sender,
-		PeerName:  offer.SenderName,
-		Files:     offer.Files,
-		State:     offer.State,
-		TotalSize: offer.TotalSize(),
-		CreatedAt: offer.CreatedAt,
-	}
-	m.history.Upsert(transfer)
-
-	if offer.Decision == DecisionPending {
-		m.emit(EventOffer, transfer)
-	}
-	if offer.Decision == DecisionAccepted && offer.State == StateCompleted {
-		m.OnCompleted(offer)
-	}
-}
-
-// OnProgress implements Notifier.
-func (m *Manager) OnProgress(offer Offer, index int, received int64) {
-	var total int64
-	for i, n := range offer.Progress {
-		if i == index {
-			n = received
-		}
-		total += n
-	}
-	m.history.SetProgress(offer.ID, total)
-}
-
-// OnCompleted implements Notifier.
-func (m *Manager) OnCompleted(offer Offer) {
-	m.mu.Lock()
-	server := m.server
-	m.mu.Unlock()
-	if server == nil {
-		return
-	}
-
-	transfer, ok := m.history.Get(offer.ID)
-	if !ok || transfer.State == StateCompleted {
-		return
-	}
-
-	delivered, err := deliver(server.Spool(), offer, m.policy.DestinationDir())
-	if err != nil {
-		log.Errorf("failed to deliver file drop payloads: %v", err)
-		m.finishTransfer(offer.ID, StateFailed, err.Error())
-		m.emit(EventFailed, m.transferOf(offer.ID))
-		return
-	}
-
-	transfer.State = StateCompleted
-	transfer.Transferred = transfer.TotalSize
-	transfer.DeliveredPaths = delivered
-	transfer.Error = ""
-	m.history.Upsert(transfer)
-	m.emit(EventCompleted, transfer)
-}
-
-// OnFailed implements Notifier.
-func (m *Manager) OnFailed(offer Offer, err error) {
-	if errors.Is(err, ErrExpired) {
-		m.finishTransfer(offer.ID, StateExpired, "")
-		m.emit(EventWithdrawn, m.transferOf(offer.ID))
-		return
-	}
-	m.finishTransfer(offer.ID, StateFailed, err.Error())
-	m.emit(EventFailed, m.transferOf(offer.ID))
-}
-
-// OnWithdrawn implements Notifier: the sender cancelled, so the consent prompt goes away.
-func (m *Manager) OnWithdrawn(offer Offer) {
-	m.finishTransfer(offer.ID, StateCancelled, "")
-	m.emit(EventWithdrawn, m.transferOf(offer.ID))
-}
-
-func (m *Manager) finishTransfer(id OfferID, state State, message string) {
-	m.finishTransferReason(id, state, message, ReasonNone)
-}
-
-func (m *Manager) finishTransferReason(id OfferID, state State, message string, reason FailureReason) {
-	transfer, ok := m.history.Get(id)
-	if !ok || transfer.terminal() {
-		return
-	}
-	transfer.State = state
-	transfer.Error = message
-	transfer.Reason = reason
-	m.history.Upsert(transfer)
-}
-
-func (m *Manager) transferOf(id OfferID) Transfer {
-	t, _ := m.history.Get(id)
-	return t
-}
-
-func (m *Manager) emit(kind EventKind, transfer Transfer) {
-	if m.events != nil && transfer.ID != "" {
-		m.events(kind, transfer)
-	}
-}
-
-func payloadMetas(payloads []Payload) []FileMeta {
-	metas := make([]FileMeta, len(payloads))
-	for i, p := range payloads {
-		metas[i] = p.Meta
-	}
-	return metas
-}
-
-func payloadTotal(payloads []Payload) int64 {
-	var total int64
-	for _, p := range payloads {
-		total += p.Meta.Size
-	}
-	return total
-}
-
-func effectivePort(advertised uint16) uint16 {
-	if advertised == 0 {
-		return Port
-	}
-	return advertised
-}
-
-// transportFailure reports whether the offer never reached the receiver; any HTTP
-// response, refusal included, proves the port right and is not retried elsewhere.
-func transportFailure(err error) bool {
-	var urlErr *url.Error
-	return errors.As(err, &urlErr)
-}

client/internal/filedrop/offer.go

@@ -1,282 +0,0 @@
-package filedrop
-
-import (
-	"context"
-	"sync"
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// Offer is one incoming transfer as tracked by the receiver.
-type Offer struct {
-	ID         OfferID
-	Sender     PeerKey
-	SenderName string
-	Files      []FileMeta
-	Decision   Decision
-	State      State
-	CreatedAt  time.Time
-	ExpiresAt  time.Time
-	Progress   []int64
-}
-
-type offerEntry struct {
-	offer   Offer
-	decided chan struct{}
-}
-
-// OfferStore tracks incoming offers and their decisions.
-type OfferStore struct {
-	mu      sync.RWMutex
-	offers  map[OfferID]*offerEntry
-	ttl     time.Duration
-	newID   func() OfferID
-	nowFunc func() time.Time
-}
-
-// NewOfferStore returns an empty store using ttl as the decision deadline.
-func NewOfferStore(ttl time.Duration) *OfferStore {
-	if ttl <= 0 {
-		ttl = DefaultOfferTTL
-	}
-	return &OfferStore{
-		offers:  make(map[OfferID]*offerEntry),
-		ttl:     ttl,
-		newID:   func() OfferID { return OfferID(uuid.NewString()) },
-		nowFunc: time.Now,
-	}
-}
-
-// Add registers a new offer with the given initial decision and returns its snapshot.
-func (s *OfferStore) Add(sender PeerKey, senderName string, files []FileMeta, decision Decision) Offer {
-	now := s.nowFunc()
-
-	entry := &offerEntry{
-		offer: Offer{
-			ID:         s.newID(),
-			Sender:     sender,
-			SenderName: senderName,
-			Files:      files,
-			Decision:   decision,
-			State:      stateForDecision(decision),
-			CreatedAt:  now,
-			ExpiresAt:  now.Add(s.ttl),
-			Progress:   make([]int64, len(files)),
-		},
-		decided: make(chan struct{}),
-	}
-	if decision != DecisionPending {
-		close(entry.decided)
-	}
-
-	s.mu.Lock()
-	s.offers[entry.offer.ID] = entry
-	s.mu.Unlock()
-
-	return entry.offer.clone()
-}
-
-// Get returns a snapshot of one offer belonging to sender.
-func (s *OfferStore) Get(sender PeerKey, id OfferID) (Offer, bool) {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-
-	entry, ok := s.offers[id]
-	if !ok || entry.offer.Sender != sender {
-		return Offer{}, false
-	}
-	return entry.offer.clone(), true
-}
-
-// List returns snapshots of every tracked offer.
-func (s *OfferStore) List() []Offer {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-
-	offers := make([]Offer, 0, len(s.offers))
-	for _, entry := range s.offers {
-		offers = append(offers, entry.offer.clone())
-	}
-	return offers
-}
-
-// Decide records the receiver's answer; a made decision is final.
-func (s *OfferStore) Decide(id OfferID, decision Decision) (Offer, bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	entry, ok := s.offers[id]
-	if !ok || entry.offer.Decision != DecisionPending {
-		return Offer{}, false
-	}
-
-	entry.offer.Decision = decision
-	entry.offer.State = stateForDecision(decision)
-	if decision == DecisionAccepted && entry.offer.awaitsNoUpload() {
-		entry.offer.State = StateCompleted
-	}
-	close(entry.decided)
-
-	return entry.offer.clone(), true
-}
-
-// Await blocks until a decision, expiry, or ctx cancellation.
-func (s *OfferStore) Await(ctx context.Context, sender PeerKey, id OfferID) (Offer, error) {
-	s.mu.RLock()
-	entry, ok := s.offers[id]
-	if ok && entry.offer.Sender != sender {
-		ok = false
-	}
-	var decided chan struct{}
-	var expiresAt time.Time
-	if ok {
-		decided = entry.decided
-		expiresAt = entry.offer.ExpiresAt
-	}
-	s.mu.RUnlock()
-
-	if !ok {
-		return Offer{}, ErrOfferNotFound
-	}
-
-	timer := time.NewTimer(time.Until(expiresAt))
-	defer timer.Stop()
-
-	select {
-	case <-decided:
-	case <-timer.C:
-		s.Decide(id, DecisionExpired)
-	case <-ctx.Done():
-		offer, _ := s.Get(sender, id)
-		return offer, ctx.Err()
-	}
-
-	offer, ok := s.Get(sender, id)
-	if !ok {
-		return Offer{}, ErrOfferNotFound
-	}
-	return offer, nil
-}
-
-// SetProgress records the staged byte count for one file of an offer.
-func (s *OfferStore) SetProgress(id OfferID, index int, received int64) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	entry, ok := s.offers[id]
-	if !ok || index < 0 || index >= len(entry.offer.Progress) {
-		return
-	}
-	entry.offer.Progress[index] = received
-	if entry.offer.State == StatePending {
-		entry.offer.State = StateTransferring
-	}
-}
-
-// SetState overrides the transfer state, for completion and failure reporting.
-func (s *OfferStore) SetState(id OfferID, state State) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if entry, ok := s.offers[id]; ok {
-		entry.offer.State = state
-	}
-}
-
-// Remove drops an offer from the store.
-func (s *OfferStore) Remove(id OfferID) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	delete(s.offers, id)
-}
-
-// ExpireOverdue marks every pending offer past its deadline as expired and returns them.
-func (s *OfferStore) ExpireOverdue() []Offer {
-	now := s.nowFunc()
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	var expired []Offer
-	for _, entry := range s.offers {
-		if entry.offer.Decision != DecisionPending || now.Before(entry.offer.ExpiresAt) {
-			continue
-		}
-		entry.offer.Decision = DecisionExpired
-		entry.offer.State = StateExpired
-		close(entry.decided)
-		expired = append(expired, entry.offer.clone())
-	}
-	return expired
-}
-
-// Complete marks an offer completed once every file reached its announced size.
-func (s *OfferStore) Complete(id OfferID) (Offer, bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	entry, ok := s.offers[id]
-	if !ok || entry.offer.State == StateCompleted {
-		return Offer{}, false
-	}
-
-	if !entry.offer.fullyStaged() {
-		return Offer{}, false
-	}
-
-	entry.offer.State = StateCompleted
-	return entry.offer.clone(), true
-}
-
-func (o Offer) awaitsNoUpload() bool {
-	for _, f := range o.Files {
-		if f.Kind != KindText {
-			return false
-		}
-	}
-	return true
-}
-
-func (o Offer) fullyStaged() bool {
-	for i, f := range o.Files {
-		if f.Kind == KindText {
-			continue
-		}
-		if i >= len(o.Progress) || o.Progress[i] < f.Size {
-			return false
-		}
-	}
-	return true
-}
-
-func (o Offer) clone() Offer {
-	c := o
-	c.Files = make([]FileMeta, len(o.Files))
-	copy(c.Files, o.Files)
-	c.Progress = make([]int64, len(o.Progress))
-	copy(c.Progress, o.Progress)
-	return c
-}
-
-// TotalSize is the announced byte count across every file of the offer.
-func (o Offer) TotalSize() int64 {
-	var total int64
-	for _, f := range o.Files {
-		total += f.Size
-	}
-	return total
-}
-
-func stateForDecision(d Decision) State {
-	switch d {
-	case DecisionAccepted:
-		return StateTransferring
-	case DecisionDeclined:
-		return StateDeclined
-	case DecisionExpired:
-		return StateExpired
-	default:
-		return StatePending
-	}
-}

client/internal/filedrop/policy.go

@@ -1,206 +0,0 @@
-package filedrop
-
-import (
-	"fmt"
-	"sync"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-)
-
-const (
-	SenderRuleDefault SenderRule = iota
-	SenderRuleAlwaysAccept
-	SenderRuleBlock
-)
-
-// SenderRule is a per-sender override on top of the base mode.
-type SenderRule uint8
-
-// Policy is the device-local receiving policy of one profile. An empty
-// DestinationDir means the platform's default download directory.
-type Policy struct {
-	Mode           Mode                   `json:"mode"`
-	Senders        map[PeerKey]SenderRule `json:"senders,omitempty"`
-	DestinationDir string                 `json:"destinationDir,omitempty"`
-}
-
-// PolicyStore holds the receiving policy of one profile and evaluates it per sender.
-type PolicyStore struct {
-	mu      sync.RWMutex
-	profile profilemanager.ID
-	policy  Policy
-	store   Store
-}
-
-// NewPolicyStore returns an in-memory store seeded with the default policy.
-func NewPolicyStore(profile profilemanager.ID) *PolicyStore {
-	return &PolicyStore{profile: profile, policy: DefaultPolicy()}
-}
-
-// LoadPolicyStore builds a store from the persisted policy of one profile.
-func LoadPolicyStore(profile profilemanager.ID, store Store) *PolicyStore {
-	s := &PolicyStore{
-		profile: profile,
-		policy:  DefaultPolicy(),
-		store:   store,
-	}
-	if store == nil {
-		return s
-	}
-
-	policy := DefaultPolicy()
-	if err := loadSection(store, namespacePolicy, &policy); err != nil {
-		log.Warnf("failed to load file drop policy for profile %s, using defaults: %v", profile, err)
-		return s
-	}
-	if err := policy.validate(); err != nil {
-		log.Warnf("stored file drop policy for profile %s is invalid, using defaults: %v", profile, err)
-		return s
-	}
-
-	s.policy = policy.normalized()
-	return s
-}
-
-// String implements fmt.Stringer.
-func (r SenderRule) String() string {
-	switch r {
-	case SenderRuleDefault:
-		return "default"
-	case SenderRuleAlwaysAccept:
-		return "always"
-	case SenderRuleBlock:
-		return "block"
-	default:
-		return fmt.Sprintf("unknown(%d)", uint8(r))
-	}
-}
-
-func (p Policy) validate() error {
-	if !p.Mode.valid() {
-		return fmt.Errorf("invalid mode %s", p.Mode)
-	}
-	return nil
-}
-
-func (p Policy) normalized() Policy {
-	c := p.clone()
-	if c.Senders == nil {
-		c.Senders = map[PeerKey]SenderRule{}
-	}
-	return c
-}
-
-func (p Policy) clone() Policy {
-	c := p
-	c.Senders = make(map[PeerKey]SenderRule, len(p.Senders))
-	for k, v := range p.Senders {
-		c.Senders[k] = v
-	}
-	return c
-}
-
-// Profile returns the profile this policy belongs to.
-func (s *PolicyStore) Profile() profilemanager.ID {
-	return s.profile
-}
-
-// Get returns a copy of the current policy.
-func (s *PolicyStore) Get() Policy {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	return s.policy.clone()
-}
-
-// Set replaces the policy and persists it.
-func (s *PolicyStore) Set(p Policy) error {
-	if err := p.validate(); err != nil {
-		return err
-	}
-
-	s.mu.Lock()
-	s.policy = p.normalized()
-	store, stored := s.store, s.policy.clone()
-	s.mu.Unlock()
-
-	return saveSection(store, namespacePolicy, stored)
-}
-
-// SetMode changes the base mode, leaving per-sender rules untouched.
-func (s *PolicyStore) SetMode(m Mode) error {
-	if !m.valid() {
-		return fmt.Errorf("invalid mode %s", m)
-	}
-
-	s.mu.Lock()
-	s.policy.Mode = m
-	store, stored := s.store, s.policy.clone()
-	s.mu.Unlock()
-
-	return saveSection(store, namespacePolicy, stored)
-}
-
-// SetSenderRule sets or clears the override for a single sender.
-func (s *PolicyStore) SetSenderRule(key PeerKey, rule SenderRule) error {
-	s.mu.Lock()
-	if rule == SenderRuleDefault {
-		delete(s.policy.Senders, key)
-	} else {
-		if s.policy.Senders == nil {
-			s.policy.Senders = map[PeerKey]SenderRule{}
-		}
-		s.policy.Senders[key] = rule
-	}
-	store, stored := s.store, s.policy.clone()
-	s.mu.Unlock()
-
-	return saveSection(store, namespacePolicy, stored)
-}
-
-// DestinationDir returns the directory received files are delivered to.
-func (s *PolicyStore) DestinationDir() string {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	return s.policy.DestinationDir
-}
-
-// SetDestinationDir persists the delivery directory.
-func (s *PolicyStore) SetDestinationDir(dir string) error {
-	s.mu.Lock()
-	s.policy.DestinationDir = dir
-	store, stored := s.store, s.policy.clone()
-	s.mu.Unlock()
-
-	return saveSection(store, namespacePolicy, stored)
-}
-
-// Evaluate returns the mode that applies to one sender, denying on unknown values.
-func (s *PolicyStore) Evaluate(key PeerKey) Mode {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-
-	switch s.policy.Senders[key] {
-	case SenderRuleBlock:
-		return ModeOff
-	case SenderRuleAlwaysAccept:
-		return ModeAutoAccept
-	case SenderRuleDefault:
-	default:
-		return ModeOff
-	}
-
-	if !s.policy.Mode.valid() {
-		return ModeOff
-	}
-	return s.policy.Mode
-}
-
-// DefaultPolicy asks before accepting anything, so receiving is never silently on.
-func DefaultPolicy() Policy {
-	return Policy{
-		Mode:    ModeAsk,
-		Senders: map[PeerKey]SenderRule{},
-	}
-}

client/internal/filedrop/ports.go

@@ -1,81 +0,0 @@
-package filedrop
-
-import (
-	"context"
-	"sync"
-)
-
-// PortRegistry tracks the file drop listen port each peer advertised over
-// signaling; 0 means the well-known default. Senders can wait on it to learn a
-// better port after a failed attempt.
-type PortRegistry struct {
-	mu    sync.Mutex
-	ports map[PeerKey]uint16
-	waits map[PeerKey][]chan uint16
-}
-
-// NewPortRegistry returns an empty registry.
-func NewPortRegistry() *PortRegistry {
-	return &PortRegistry{
-		ports: make(map[PeerKey]uint16),
-		waits: make(map[PeerKey][]chan uint16),
-	}
-}
-
-// Set records the port a peer advertised and releases every waiter for it.
-func (r *PortRegistry) Set(key PeerKey, port uint16) {
-	r.mu.Lock()
-	r.ports[key] = port
-	waiters := r.waits[key]
-	delete(r.waits, key)
-	r.mu.Unlock()
-
-	for _, ch := range waiters {
-		ch <- port
-	}
-}
-
-// Port returns the last advertised port for a peer; 0 means default or unknown.
-func (r *PortRegistry) Port(key PeerKey) uint16 {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return r.ports[key]
-}
-
-// Await returns the peer's port as soon as it differs from used, or after the next
-// advertisement even when it does not, reporting whether it differs. It returns
-// immediately when the currently known port already differs.
-func (r *PortRegistry) Await(ctx context.Context, key PeerKey, used uint16) (uint16, bool) {
-	r.mu.Lock()
-	if port, ok := r.ports[key]; ok && port != used {
-		r.mu.Unlock()
-		return port, true
-	}
-	ch := make(chan uint16, 1)
-	r.waits[key] = append(r.waits[key], ch)
-	r.mu.Unlock()
-
-	select {
-	case port := <-ch:
-		return port, port != used
-	case <-ctx.Done():
-		r.drop(key, ch)
-		return 0, false
-	}
-}
-
-func (r *PortRegistry) drop(key PeerKey, ch chan uint16) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-
-	waiters := r.waits[key]
-	for i, w := range waiters {
-		if w == ch {
-			r.waits[key] = append(waiters[:i], waiters[i+1:]...)
-			break
-		}
-	}
-	if len(r.waits[key]) == 0 {
-		delete(r.waits, key)
-	}
-}

client/internal/filedrop/protocol.go

@@ -1,197 +0,0 @@
-package filedrop
-
-import (
-	"errors"
-	"fmt"
-	"time"
-)
-
-const Port uint16 = 41421
-
-// HeaderReceivedBytes carries the receiver's confirmed byte count in a HEAD response.
-const HeaderReceivedBytes = "Netbird-Received-Bytes"
-
-// DefaultOfferTTL bounds how long an offer waits for the receiver's decision.
-const DefaultOfferTTL = 5 * time.Minute
-
-// MaxOfferFiles bounds the number of items a single offer may announce.
-const MaxOfferFiles = 512
-
-// MaxInlineTextSize bounds an inline text snippet, which is held in memory.
-const MaxInlineTextSize = 64 * 1024
-
-const maxOfferBodySize = 1 << 20
-
-const (
-	pathOffers      = "/v1/offers"
-	pathOffersSlash = pathOffers + "/"
-
-	segmentFiles = "files"
-)
-
-// The decisions an offer can carry. Pending is the only non-final one.
-const (
-	DecisionPending Decision = iota
-	DecisionAccepted
-	DecisionDeclined
-	DecisionExpired
-)
-
-// The receiving modes a profile can be in.
-const (
-	ModeOff Mode = iota
-	ModeAsk
-	ModeAutoAccept
-)
-
-// The payload kinds an offer can announce.
-const (
-	KindFile Kind = iota
-	KindText
-)
-
-// The states a transfer moves through.
-const (
-	StatePending State = iota
-	StateTransferring
-	StateCompleted
-	StateDeclined
-	StateExpired
-	StateCancelled
-	StateFailed
-)
-
-var (
-	ErrOfferNotFound = errors.New("offer not found")
-	ErrRefused       = errors.New("offer refused by receiver")
-	ErrDeclined      = errors.New("offer declined")
-	ErrExpired       = errors.New("offer expired")
-	ErrNotAccepted   = errors.New("offer not accepted")
-	ErrUnknownPeer   = errors.New("unknown peer")
-	ErrInvalidOffer  = errors.New("invalid offer")
-)
-
-// OfferID identifies a single transfer offer on the receiving peer.
-type OfferID string
-
-// PeerKey is the remote peer's public key, used as the identity for per-sender policy.
-type PeerKey string
-
-// Decision is the receiver's answer to an offer.
-type Decision uint8
-
-// Mode is the receiver's profile-local policy for incoming offers.
-type Mode uint8
-
-// Kind distinguishes payloads that are written to the spool from inline text snippets.
-type Kind uint8
-
-// State is the lifecycle state of a transfer, on either side.
-type State uint8
-
-// FileMeta describes one payload item announced in an offer.
-type FileMeta struct {
-	Name        string `json:"name"`
-	Size        int64  `json:"size"`
-	ContentType string `json:"contentType,omitempty"`
-	Kind        Kind   `json:"kind,omitempty"`
-	Text        string `json:"text,omitempty"`
-}
-
-// OfferRequest is the JSON body of POST /v1/offers. It carries metadata only.
-type OfferRequest struct {
-	SenderName string     `json:"senderName,omitempty"`
-	Files      []FileMeta `json:"files"`
-}
-
-// OfferResponse is returned for an offer and for every poll of its status.
-type OfferResponse struct {
-	ID       OfferID  `json:"id"`
-	Decision Decision `json:"decision"`
-}
-
-// String implements fmt.Stringer.
-func (d Decision) String() string {
-	switch d {
-	case DecisionPending:
-		return "pending"
-	case DecisionAccepted:
-		return "accepted"
-	case DecisionDeclined:
-		return "declined"
-	case DecisionExpired:
-		return "expired"
-	default:
-		return fmt.Sprintf("unknown(%d)", uint8(d))
-	}
-}
-
-func (d Decision) valid() bool {
-	switch d {
-	case DecisionPending, DecisionAccepted, DecisionDeclined, DecisionExpired:
-		return true
-	default:
-		return false
-	}
-}
-
-// String implements fmt.Stringer.
-func (m Mode) String() string {
-	switch m {
-	case ModeOff:
-		return "off"
-	case ModeAsk:
-		return "ask"
-	case ModeAutoAccept:
-		return "auto"
-	default:
-		return fmt.Sprintf("unknown(%d)", uint8(m))
-	}
-}
-
-func (m Mode) valid() bool {
-	switch m {
-	case ModeOff, ModeAsk, ModeAutoAccept:
-		return true
-	default:
-		return false
-	}
-}
-
-// String implements fmt.Stringer.
-func (k Kind) String() string {
-	switch k {
-	case KindFile:
-		return "file"
-	case KindText:
-		return "text"
-	default:
-		return fmt.Sprintf("unknown(%d)", uint8(k))
-	}
-}
-
-func (k Kind) valid() bool {
-	return k == KindFile || k == KindText
-}
-
-// String implements fmt.Stringer.
-func (s State) String() string {
-	switch s {
-	case StatePending:
-		return "pending"
-	case StateTransferring:
-		return "transferring"
-	case StateCompleted:
-		return "completed"
-	case StateDeclined:
-		return "declined"
-	case StateExpired:
-		return "expired"
-	case StateCancelled:
-		return "cancelled"
-	case StateFailed:
-		return "failed"
-	default:
-		return fmt.Sprintf("unknown(%d)", uint8(s))
-	}
-}

client/internal/filedrop/receiver.go

@@ -1,226 +0,0 @@
-package filedrop
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net/netip"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// ErrStorage indicates the receiver could not stage payload data locally.
-var ErrStorage = errors.New("storage failure")
-
-type senderIdentity struct {
-	key  PeerKey
-	name string
-}
-
-// receiver implements the transfer protocol independent of any transport. Every
-// operation takes the already-authenticated sender identity and returns domain
-// errors for the transport to map.
-type receiver struct {
-	policy      *PolicyStore
-	resolver    PeerResolver
-	notifier    Notifier
-	offers      *OfferStore
-	spool       *Spool
-	spoolMaxAge time.Duration
-}
-
-func newReceiver(cfg ServerConfig, spool *Spool, maxAge time.Duration) *receiver {
-	return &receiver{
-		policy:      cfg.Policy,
-		resolver:    cfg.Resolver,
-		notifier:    cfg.Notifier,
-		offers:      NewOfferStore(cfg.OfferTTL),
-		spool:       spool,
-		spoolMaxAge: maxAge,
-	}
-}
-
-// identify maps a source overlay address to a known peer, refusing unknown ones.
-func (r *receiver) identify(addr netip.Addr) (senderIdentity, bool) {
-	key, name, ok := r.resolver.ResolvePeer(addr.Unmap())
-	if !ok {
-		return senderIdentity{}, false
-	}
-	return senderIdentity{key: key, name: name}, true
-}
-
-func (r *receiver) submitOffer(sender senderIdentity, req OfferRequest) (Offer, error) {
-	if err := validateOffer(req.Files); err != nil {
-		return Offer{}, fmt.Errorf("%w: %s", ErrInvalidOffer, err)
-	}
-
-	mode := r.policy.Evaluate(sender.key)
-	if mode == ModeOff {
-		return Offer{}, ErrRefused
-	}
-
-	senderName := sender.name
-	if senderName == "" {
-		senderName = req.SenderName
-	}
-
-	decision := DecisionPending
-	if mode == ModeAutoAccept {
-		decision = DecisionAccepted
-	}
-
-	offer := r.offers.Add(sender.key, senderName, req.Files, decision)
-	if err := r.spool.Prepare(offer.ID); err != nil {
-		r.offers.Remove(offer.ID)
-		log.Errorf("prepare spool for offer: %v", err)
-		return Offer{}, fmt.Errorf("%w: prepare spool", ErrStorage)
-	}
-
-	r.notifyOffer(offer)
-
-	if offer.Decision == DecisionAccepted {
-		if completed, done := r.offers.Complete(offer.ID); done {
-			r.notifyCompleted(completed)
-		}
-	}
-	return offer, nil
-}
-
-func (r *receiver) awaitDecision(ctx context.Context, sender senderIdentity, id OfferID) (Offer, error) {
-	return r.offers.Await(ctx, sender.key, id)
-}
-
-func (r *receiver) withdraw(sender senderIdentity, id OfferID) error {
-	offer, ok := r.offers.Get(sender.key, id)
-	if !ok {
-		return ErrOfferNotFound
-	}
-
-	r.offers.SetState(id, StateCancelled)
-	r.offers.Remove(id)
-	r.spool.Remove(id)
-
-	offer.State = StateCancelled
-	r.notifyWithdrawn(offer)
-	return nil
-}
-
-func (r *receiver) receivedBytes(sender senderIdentity, id OfferID, index int) (int64, error) {
-	offer, ok := r.offers.Get(sender.key, id)
-	if !ok || index >= len(offer.Files) {
-		return 0, ErrOfferNotFound
-	}
-
-	received, err := r.spool.Received(id, index)
-	if err != nil {
-		log.Debugf("probe spool file: %v", err)
-		return 0, fmt.Errorf("%w: read staged size", ErrStorage)
-	}
-	return received, nil
-}
-
-func (r *receiver) upload(sender senderIdentity, id OfferID, index int, offset int64, body io.Reader) error {
-	offer, ok := r.offers.Get(sender.key, id)
-	if !ok || index >= len(offer.Files) {
-		return ErrOfferNotFound
-	}
-	if offer.Decision != DecisionAccepted {
-		return ErrNotAccepted
-	}
-	if offer.Files[index].Kind == KindText {
-		return fmt.Errorf("%w: text payloads carry no body", ErrInvalidOffer)
-	}
-
-	size := offer.Files[index].Size
-	if offset < 0 || offset > size {
-		return fmt.Errorf("%w: offset out of range", ErrInvalidOffer)
-	}
-
-	received, err := r.spool.Write(id, index, offset, body, size)
-	r.offers.SetProgress(id, index, received)
-	r.notifyProgress(offer, index, received)
-
-	if err != nil {
-		r.offers.SetState(id, StateFailed)
-		r.notifyFailed(offer, err)
-		log.Debugf("stage payload for offer %s file %d: %v", id, index, err)
-		return fmt.Errorf("%w: stage payload", ErrStorage)
-	}
-
-	if completed, ok := r.offers.Complete(id); ok {
-		r.notifyCompleted(completed)
-	}
-	return nil
-}
-
-// expireOverdue reclaims offers past their decision deadline and stale spool data.
-func (r *receiver) expireOverdue() {
-	for _, offer := range r.offers.ExpireOverdue() {
-		r.spool.Remove(offer.ID)
-		r.notifyFailed(offer, ErrExpired)
-	}
-	r.spool.Cleanup(r.spoolMaxAge, time.Now())
-}
-
-func (r *receiver) close() {
-	for _, offer := range r.offers.List() {
-		r.offers.Remove(offer.ID)
-	}
-}
-
-func (r *receiver) notifyOffer(offer Offer) {
-	if r.notifier != nil {
-		r.notifier.OnOffer(offer)
-	}
-}
-
-func (r *receiver) notifyProgress(offer Offer, index int, received int64) {
-	if r.notifier != nil {
-		r.notifier.OnProgress(offer, index, received)
-	}
-}
-
-func (r *receiver) notifyCompleted(offer Offer) {
-	if r.notifier != nil {
-		r.notifier.OnCompleted(offer)
-	}
-}
-
-func (r *receiver) notifyFailed(offer Offer, err error) {
-	if r.notifier != nil {
-		r.notifier.OnFailed(offer, err)
-	}
-}
-
-func (r *receiver) notifyWithdrawn(offer Offer) {
-	if r.notifier != nil {
-		r.notifier.OnWithdrawn(offer)
-	}
-}
-
-func validateOffer(files []FileMeta) error {
-	if len(files) == 0 {
-		return fmt.Errorf("offer announces no files")
-	}
-	if len(files) > MaxOfferFiles {
-		return fmt.Errorf("offer announces more than %d files", MaxOfferFiles)
-	}
-
-	for _, f := range files {
-		if !f.Kind.valid() {
-			return fmt.Errorf("unknown payload kind %s", f.Kind)
-		}
-		if f.Kind == KindText {
-			if len(f.Text) > MaxInlineTextSize {
-				return fmt.Errorf("inline text exceeds %d bytes", MaxInlineTextSize)
-			}
-			continue
-		}
-		if f.Size < 0 {
-			return fmt.Errorf("negative file size")
-		}
-	}
-	return nil
-}

client/internal/filedrop/server.go

@@ -1,262 +0,0 @@
-package filedrop
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/netip"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
-)
-
-const (
-	defaultSpoolMaxAge = 24 * time.Hour
-	janitorInterval    = 10 * time.Minute
-	readHeaderTimeout  = 30 * time.Second
-	idleTimeout        = 5 * time.Minute
-)
-
-// PeerResolver maps the source overlay address of a connection to the peer that owns it.
-type PeerResolver interface {
-	ResolvePeer(addr netip.Addr) (key PeerKey, name string, ok bool)
-}
-
-// Notifier receives receiver-side transfer events for the platform layer to surface.
-type Notifier interface {
-	OnOffer(offer Offer)
-	OnProgress(offer Offer, index int, received int64)
-	OnCompleted(offer Offer)
-	OnFailed(offer Offer, err error)
-	OnWithdrawn(offer Offer)
-}
-
-// ServerConfig configures the receiving side.
-type ServerConfig struct {
-	SpoolDir    string
-	Policy      *PolicyStore
-	Resolver    PeerResolver
-	Notifier    Notifier
-	OfferTTL    time.Duration
-	SpoolMaxAge time.Duration
-}
-
-// Server serves the receiver over HTTP on the overlay address and owns the
-// listener and janitor lifecycle; the protocol logic itself lives in receiver.
-type Server struct {
-	mu             sync.RWMutex
-	httpServer     *http.Server
-	listener       net.Listener
-	extraListeners []net.Listener
-	netstackNet    *netstack.Net
-
-	recv      *receiver
-	boundPort uint16
-
-	janitorStop context.CancelFunc
-	janitorDone chan struct{}
-}
-
-// NewServer builds a receiving server. It does not start listening.
-func NewServer(cfg ServerConfig) (*Server, error) {
-	if cfg.Resolver == nil {
-		return nil, errors.New("peer resolver is required")
-	}
-	if cfg.Policy == nil {
-		return nil, errors.New("receiving policy is required")
-	}
-
-	spool, err := NewSpool(cfg.SpoolDir)
-	if err != nil {
-		return nil, fmt.Errorf("create spool: %w", err)
-	}
-
-	maxAge := cfg.SpoolMaxAge
-	if maxAge <= 0 {
-		maxAge = defaultSpoolMaxAge
-	}
-
-	return &Server{recv: newReceiver(cfg, spool, maxAge)}, nil
-}
-
-// SetNetstackNet routes listeners through the gVisor netstack instead of host sockets.
-func (s *Server) SetNetstackNet(n *netstack.Net) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.netstackNet = n
-}
-
-// Offers returns the offer store, for the platform layer to accept, decline, and list.
-func (s *Server) Offers() *OfferStore {
-	return s.recv.offers
-}
-
-// Spool returns the staging area, so the platform layer can deliver completed payloads.
-func (s *Server) Spool() *Spool {
-	return s.recv.spool
-}
-
-// Policy returns the active profile's receiving policy store.
-func (s *Server) Policy() *PolicyStore {
-	return s.recv.policy
-}
-
-// BoundPort returns the port the server actually listens on, 0 when stopped.
-func (s *Server) BoundPort() uint16 {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	return s.boundPort
-}
-
-// Start binds the service to addr and serves until Stop.
-func (s *Server) Start(ctx context.Context, addr netip.AddrPort) error {
-	s.mu.Lock()
-	if s.httpServer != nil {
-		s.mu.Unlock()
-		return errors.New("file drop server is already running")
-	}
-
-	ln, desc, err := s.createListener(ctx, addr)
-	if err != nil && addr.Port() != 0 {
-		log.Warnf("file drop port %d is unavailable, falling back to a dynamic port: %v", addr.Port(), err)
-		ln, desc, err = s.createListener(ctx, netip.AddrPortFrom(addr.Addr(), 0))
-	}
-	if err != nil {
-		s.mu.Unlock()
-		return fmt.Errorf("create listener: %w", err)
-	}
-
-	transport := &httpTransport{recv: s.recv}
-	httpServer := &http.Server{
-		Handler:           transport.routes(),
-		ReadHeaderTimeout: readHeaderTimeout,
-		IdleTimeout:       idleTimeout,
-	}
-
-	janitorCtx, cancel := context.WithCancel(context.Background())
-	done := make(chan struct{})
-
-	s.listener = ln
-	s.httpServer = httpServer
-	s.boundPort = listenerPort(ln, addr.Port())
-	s.janitorStop = cancel
-	s.janitorDone = done
-	s.mu.Unlock()
-
-	go s.runJanitor(janitorCtx, done)
-	go s.serve(httpServer, ln, desc)
-
-	log.Infof("file drop server started on %s", desc)
-	return nil
-}
-
-// AddListener serves the running service on an additional address, such as IPv6.
-func (s *Server) AddListener(ctx context.Context, addr netip.AddrPort) error {
-	s.mu.Lock()
-	httpServer := s.httpServer
-	if httpServer == nil {
-		s.mu.Unlock()
-		return errors.New("file drop server is not running")
-	}
-
-	ln, desc, err := s.createListener(ctx, addr)
-	if err != nil {
-		s.mu.Unlock()
-		return fmt.Errorf("create listener: %w", err)
-	}
-	s.extraListeners = append(s.extraListeners, ln)
-	s.mu.Unlock()
-
-	go s.serve(httpServer, ln, desc)
-
-	log.Infof("file drop server also listening on %s", desc)
-	return nil
-}
-
-// Stop shuts the service down and releases the offers it was tracking. It is idempotent.
-func (s *Server) Stop() error {
-	s.mu.Lock()
-	httpServer := s.httpServer
-	if httpServer == nil {
-		s.mu.Unlock()
-		return nil
-	}
-	s.httpServer = nil
-	s.listener = nil
-	s.boundPort = 0
-	extra := s.extraListeners
-	s.extraListeners = nil
-	stopJanitor, janitorDone := s.janitorStop, s.janitorDone
-	s.janitorStop, s.janitorDone = nil, nil
-	s.mu.Unlock()
-
-	if stopJanitor != nil {
-		stopJanitor()
-		<-janitorDone
-	}
-
-	err := httpServer.Close()
-
-	for _, ln := range extra {
-		if cerr := ln.Close(); cerr != nil {
-			log.Debugf("close extra file drop listener: %v", cerr)
-		}
-	}
-
-	s.recv.close()
-
-	if err != nil {
-		return fmt.Errorf("close: %w", err)
-	}
-	return nil
-}
-
-func (s *Server) serve(httpServer *http.Server, ln net.Listener, desc string) {
-	if err := httpServer.Serve(ln); err != nil && !errors.Is(err, http.ErrServerClosed) {
-		log.Errorf("file drop server error on %s: %v", desc, err)
-	}
-}
-
-func (s *Server) createListener(ctx context.Context, addr netip.AddrPort) (net.Listener, string, error) {
-	if s.netstackNet != nil {
-		ln, err := s.netstackNet.ListenTCPAddrPort(addr)
-		if err != nil {
-			return nil, "", fmt.Errorf("listen on netstack: %w", err)
-		}
-		return ln, fmt.Sprintf("netstack %s", addr), nil
-	}
-
-	var lc net.ListenConfig
-	ln, err := lc.Listen(ctx, "tcp", net.TCPAddrFromAddrPort(addr).String())
-	if err != nil {
-		return nil, "", fmt.Errorf("listen: %w", err)
-	}
-	return ln, addr.String(), nil
-}
-
-func (s *Server) runJanitor(ctx context.Context, done chan struct{}) {
-	defer close(done)
-
-	ticker := time.NewTicker(janitorInterval)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			s.recv.expireOverdue()
-		}
-	}
-}
-
-func listenerPort(ln net.Listener, requested uint16) uint16 {
-	if tcpAddr, ok := ln.Addr().(*net.TCPAddr); ok {
-		return uint16(tcpAddr.Port)
-	}
-	return requested
-}

client/internal/filedrop/spool.go

@@ -1,131 +0,0 @@
-package filedrop
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strconv"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// Spool stages incoming payloads in an app-private directory.
-type Spool struct {
-	root string
-}
-
-// NewSpool prepares the spool directory tree under root.
-func NewSpool(root string) (*Spool, error) {
-	if root == "" {
-		return nil, fmt.Errorf("empty spool root")
-	}
-	if err := os.MkdirAll(root, 0o700); err != nil {
-		return nil, fmt.Errorf("create spool root: %w", err)
-	}
-	return &Spool{root: root}, nil
-}
-
-// Root returns the spool base directory.
-func (s *Spool) Root() string {
-	return s.root
-}
-
-// OfferDir returns the directory holding one offer's payloads.
-func (s *Spool) OfferDir(id OfferID) string {
-	return filepath.Join(s.root, string(id))
-}
-
-func (s *Spool) filePath(id OfferID, index int) string {
-	return filepath.Join(s.OfferDir(id), strconv.Itoa(index))
-}
-
-// Prepare creates the directory for an offer.
-func (s *Spool) Prepare(id OfferID) error {
-	if err := os.MkdirAll(s.OfferDir(id), 0o700); err != nil {
-		return fmt.Errorf("create offer dir: %w", err)
-	}
-	return nil
-}
-
-// Received returns how many bytes of one item are already staged.
-func (s *Spool) Received(id OfferID, index int) (int64, error) {
-	info, err := os.Stat(s.filePath(id, index))
-	if os.IsNotExist(err) {
-		return 0, nil
-	}
-	if err != nil {
-		return 0, fmt.Errorf("stat spool file: %w", err)
-	}
-	return info.Size(), nil
-}
-
-// Write appends the payload at offset, truncating any bytes past it first.
-func (s *Spool) Write(id OfferID, index int, offset int64, r io.Reader, limit int64) (int64, error) {
-	if offset < 0 {
-		return 0, fmt.Errorf("negative offset %d", offset)
-	}
-
-	path := s.filePath(id, index)
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0o600)
-	if err != nil {
-		return 0, fmt.Errorf("open spool file: %w", err)
-	}
-	defer func() {
-		if err := f.Close(); err != nil {
-			log.Debugf("close spool file: %v", err)
-		}
-	}()
-
-	if err := f.Truncate(offset); err != nil {
-		return 0, fmt.Errorf("truncate spool file: %w", err)
-	}
-	if _, err := f.Seek(offset, io.SeekStart); err != nil {
-		return 0, fmt.Errorf("seek spool file: %w", err)
-	}
-
-	written, err := io.Copy(f, io.LimitReader(r, limit-offset))
-	if err != nil {
-		return offset + written, fmt.Errorf("write spool file: %w", err)
-	}
-	return offset + written, nil
-}
-
-// Path returns the staged path of one item for the platform layer to deliver from.
-func (s *Spool) Path(id OfferID, index int) string {
-	return s.filePath(id, index)
-}
-
-// Remove deletes an offer's staged payloads.
-func (s *Spool) Remove(id OfferID) {
-	if err := os.RemoveAll(s.OfferDir(id)); err != nil {
-		log.Debugf("remove spool dir: %v", err)
-	}
-}
-
-// Cleanup removes offer directories older than maxAge.
-func (s *Spool) Cleanup(maxAge time.Duration, now time.Time) {
-	entries, err := os.ReadDir(s.root)
-	if err != nil {
-		log.Debugf("read spool root: %v", err)
-		return
-	}
-
-	for _, entry := range entries {
-		if !entry.IsDir() {
-			continue
-		}
-		info, err := entry.Info()
-		if err != nil {
-			log.Debugf("stat spool entry: %v", err)
-			continue
-		}
-		if now.Sub(info.ModTime()) < maxAge {
-			continue
-		}
-		if err := os.RemoveAll(filepath.Join(s.root, entry.Name())); err != nil {
-			log.Debugf("remove stale spool dir: %v", err)
-		}
-	}
-}

client/internal/filedrop/store.go

@@ -1,58 +0,0 @@
-package filedrop
-
-import (
-	"fmt"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-)
-
-const (
-	namespacePolicy  = "filedrop"
-	namespaceHistory = "filedrop-history"
-)
-
-// Store persists one profile's file drop state in namespaced sections.
-type Store interface {
-	Get(namespace string, v any) (bool, error)
-	Put(namespace string, v any) error
-}
-
-type profileStore struct {
-	prefs *profilemanager.Prefs
-}
-
-// NewProfileStore returns the store backed by the profile's preferences.
-func NewProfileStore(prefs *profilemanager.Prefs) Store {
-	if prefs == nil {
-		return nil
-	}
-	return &profileStore{prefs: prefs}
-}
-
-func (s *profileStore) Get(namespace string, v any) (bool, error) {
-	return s.prefs.Get(namespace, v)
-}
-
-func (s *profileStore) Put(namespace string, v any) error {
-	return s.prefs.Put(namespace, v)
-}
-
-func loadSection(store Store, namespace string, v any) error {
-	if store == nil {
-		return nil
-	}
-	if _, err := store.Get(namespace, v); err != nil {
-		return fmt.Errorf("load %s: %w", namespace, err)
-	}
-	return nil
-}
-
-func saveSection(store Store, namespace string, v any) error {
-	if store == nil {
-		return nil
-	}
-	if err := store.Put(namespace, v); err != nil {
-		return fmt.Errorf("save %s: %w", namespace, err)
-	}
-	return nil
-}

client/internal/peer/signaler.go

@@ -1,8 +1,6 @@
 package peer
 
 import (
-	"sync/atomic"
-
 	"github.com/pion/ice/v4"
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
@@ -14,7 +12,6 @@ import (
 type Signaler struct {
 	signal       signal.Client
 	wgPrivateKey wgtypes.Key
-	filedropPort atomic.Uint32
 }
 
 func NewSignaler(signal signal.Client, wgPrivateKey wgtypes.Key) *Signaler {
@@ -47,12 +44,6 @@ func (s *Signaler) Ready() bool {
 	return s.signal.Ready()
 }
 
-// SetFiledropPort sets the file drop listen port advertised in offers and answers;
-// 0 means the well-known default and is not put on the wire.
-func (s *Signaler) SetFiledropPort(port uint16) {
-	s.filedropPort.Store(uint32(port))
-}
-
 // SignalOfferAnswer signals either an offer or an answer to remote peer
 func (s *Signaler) signalOfferAnswer(offerAnswer OfferAnswer, remoteKey string, bodyType sProto.Body_Type) error {
 	var sessionIDBytes []byte
@@ -66,7 +57,6 @@ func (s *Signaler) signalOfferAnswer(offerAnswer OfferAnswer, remoteKey string,
 	msg, err := signal.MarshalCredential(s.wgPrivateKey, remoteKey, signal.CredentialPayload{
 		Type:         bodyType,
 		WgListenPort: offerAnswer.WgListenPort,
-		FiledropPort: uint16(s.filedropPort.Load()),
 		Credential: &signal.Credential{
 			UFrag: offerAnswer.IceCredentials.UFrag,
 			Pwd:   offerAnswer.IceCredentials.Pwd,

client/internal/profilemanager/prefs.go

@@ -1,130 +0,0 @@
-package profilemanager
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sync"
-
-	"github.com/netbirdio/netbird/util"
-)
-
-const prefsFileSuffix = ".prefs.json"
-
-var prefsMu sync.Mutex
-
-// Prefs is a namespaced per-profile preference store backed by a single JSON
-// file next to the profile config; it is deleted together with the profile.
-type Prefs struct {
-	path string
-}
-
-// ProfilePrefs returns the preference store of the profile identified by id.
-func (s *ServiceManager) ProfilePrefs(id ID, username string) (*Prefs, error) {
-	if !IsValidProfileFilenameStem(id) {
-		return nil, fmt.Errorf("invalid profile ID: %q", id)
-	}
-	if id == defaultProfileName {
-		return &Prefs{path: filepath.Join(filepath.Dir(DefaultConfigPath), id.String()+prefsFileSuffix)}, nil
-	}
-	configDir, err := s.getConfigDir(username)
-	if err != nil {
-		return nil, fmt.Errorf("get config directory for user %s: %w", username, err)
-	}
-	return &Prefs{path: filepath.Join(configDir, id.String()+prefsFileSuffix)}, nil
-}
-
-// Get unmarshals the namespace section into v and reports whether it exists.
-func (p *Prefs) Get(namespace string, v any) (bool, error) {
-	if namespace == "" {
-		return false, fmt.Errorf("empty prefs namespace")
-	}
-
-	prefsMu.Lock()
-	defer prefsMu.Unlock()
-
-	sections, err := readPrefsFile(p.path)
-	if err != nil {
-		return false, err
-	}
-	raw, ok := sections[namespace]
-	if !ok {
-		return false, nil
-	}
-	if err := json.Unmarshal(raw, v); err != nil {
-		return false, fmt.Errorf("decode prefs namespace %q: %w", namespace, err)
-	}
-	return true, nil
-}
-
-// Put stores v as the namespace section, replacing any previous value.
-func (p *Prefs) Put(namespace string, v any) error {
-	if namespace == "" {
-		return fmt.Errorf("empty prefs namespace")
-	}
-	raw, err := json.Marshal(v)
-	if err != nil {
-		return fmt.Errorf("encode prefs namespace %q: %w", namespace, err)
-	}
-
-	prefsMu.Lock()
-	defer prefsMu.Unlock()
-
-	sections, err := readPrefsFile(p.path)
-	if err != nil {
-		return err
-	}
-	sections[namespace] = raw
-	return writePrefsFile(p.path, sections)
-}
-
-// Remove deletes the namespace section; a missing one is not an error.
-func (p *Prefs) Remove(namespace string) error {
-	if namespace == "" {
-		return fmt.Errorf("empty prefs namespace")
-	}
-
-	prefsMu.Lock()
-	defer prefsMu.Unlock()
-
-	sections, err := readPrefsFile(p.path)
-	if err != nil {
-		return err
-	}
-	if _, ok := sections[namespace]; !ok {
-		return nil
-	}
-	delete(sections, namespace)
-	return writePrefsFile(p.path, sections)
-}
-
-func removePrefsFile(path string) error {
-	prefsMu.Lock()
-	defer prefsMu.Unlock()
-	return os.Remove(path)
-}
-
-func readPrefsFile(path string) (map[string]json.RawMessage, error) {
-	data, err := os.ReadFile(path)
-	if os.IsNotExist(err) {
-		return map[string]json.RawMessage{}, nil
-	}
-	if err != nil {
-		return nil, fmt.Errorf("read prefs: %w", err)
-	}
-
-	sections := map[string]json.RawMessage{}
-	if err := json.Unmarshal(data, &sections); err != nil {
-		return nil, fmt.Errorf("decode prefs: %w", err)
-	}
-	return sections, nil
-}
-
-func writePrefsFile(path string, sections map[string]json.RawMessage) error {
-	if err := util.WriteJsonWithRestrictedPermission(context.Background(), path, sections); err != nil {
-		return fmt.Errorf("write prefs: %w", err)
-	}
-	return nil
-}

client/internal/profilemanager/prefs_test.go

@@ -1,138 +0,0 @@
-package profilemanager
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type testPrefsSection struct {
-	Mode uint8  `json:"mode"`
-	Dest string `json:"dest"`
-}
-
-func TestProfilePrefs_RoundTrip(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
-		require.NoError(t, err)
-
-		prefs, err := sm.ProfilePrefs(created.ID, username)
-		require.NoError(t, err)
-
-		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 2, Dest: "/tmp/x"}))
-		require.NoError(t, prefs.Put("other", map[string]int{"n": 1}))
-
-		var got testPrefsSection
-		found, err := prefs.Get("filedrop", &got)
-		require.NoError(t, err)
-		assert.True(t, found)
-		assert.Equal(t, testPrefsSection{Mode: 2, Dest: "/tmp/x"}, got)
-
-		var other map[string]int
-		found, err = prefs.Get("other", &other)
-		require.NoError(t, err)
-		assert.True(t, found)
-		assert.Equal(t, map[string]int{"n": 1}, other)
-	})
-}
-
-func TestProfilePrefs_GetMissingNamespace(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
-		require.NoError(t, err)
-
-		prefs, err := sm.ProfilePrefs(created.ID, username)
-		require.NoError(t, err)
-
-		var got testPrefsSection
-		found, err := prefs.Get("filedrop", &got)
-		require.NoError(t, err)
-		assert.False(t, found)
-	})
-}
-
-func TestProfilePrefs_RemoveNamespace(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
-		require.NoError(t, err)
-
-		prefs, err := sm.ProfilePrefs(created.ID, username)
-		require.NoError(t, err)
-
-		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 1}))
-		require.NoError(t, prefs.Put("other", map[string]int{"n": 1}))
-		require.NoError(t, prefs.Remove("filedrop"))
-		require.NoError(t, prefs.Remove("missing"))
-
-		var got testPrefsSection
-		found, err := prefs.Get("filedrop", &got)
-		require.NoError(t, err)
-		assert.False(t, found)
-
-		var other map[string]int
-		found, err = prefs.Get("other", &other)
-		require.NoError(t, err)
-		assert.True(t, found)
-		assert.Equal(t, map[string]int{"n": 1}, other)
-	})
-}
-
-func TestProfilePrefs_RejectsInvalidID(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		_, err := sm.ProfilePrefs("../escape", username)
-		assert.Error(t, err)
-	})
-}
-
-func TestProfilePrefs_RejectsEmptyNamespace(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
-		require.NoError(t, err)
-
-		prefs, err := sm.ProfilePrefs(created.ID, username)
-		require.NoError(t, err)
-
-		_, err = prefs.Get("", &testPrefsSection{})
-		assert.Error(t, err)
-		assert.Error(t, prefs.Put("", testPrefsSection{}))
-		assert.Error(t, prefs.Remove(""))
-	})
-}
-
-func TestProfilePrefs_DefaultProfile(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		prefs, err := sm.ProfilePrefs(defaultProfileName, username)
-		require.NoError(t, err)
-
-		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 1}))
-
-		expected := filepath.Join(filepath.Dir(DefaultConfigPath), "default"+prefsFileSuffix)
-		_, err = os.Stat(expected)
-		require.NoError(t, err)
-	})
-}
-
-func TestRemoveProfile_DeletesPrefsFile(t *testing.T) {
-	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
-		require.NoError(t, err)
-
-		prefs, err := sm.ProfilePrefs(created.ID, username)
-		require.NoError(t, err)
-		require.NoError(t, prefs.Put("filedrop", testPrefsSection{Mode: 2}))
-
-		configDir, err := sm.getConfigDir(username)
-		require.NoError(t, err)
-		prefsPath := filepath.Join(configDir, created.ID.String()+prefsFileSuffix)
-		_, err = os.Stat(prefsPath)
-		require.NoError(t, err)
-
-		require.NoError(t, sm.RemoveProfile(created.ID, username))
-		_, err = os.Stat(prefsPath)
-		assert.True(t, errors.Is(err, os.ErrNotExist), "prefs file should be removed")
-	})
-}

client/internal/profilemanager/service.go

@@ -420,11 +420,6 @@ func (s *ServiceManager) RemoveProfile(id ID, username string) error {
 		log.Warnf("failed to remove profile state file %s: %v", stateFile, err)
 	}
 
-	prefsFile := filepath.Join(filepath.Dir(target.Path), id.String()+prefsFileSuffix)
-	if err := removePrefsFile(prefsFile); err != nil && !os.IsNotExist(err) {
-		log.Warnf("failed to remove profile prefs file %s: %v", prefsFile, err)
-	}
-
 	return nil
 }
 

client/ios/NetBirdSDK/login.go

@@ -323,7 +323,7 @@ func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName strin
 const authInfoRequestTimeout = 30 * time.Second
 
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, forceDeviceAuth bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth, "")
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}

client/jobexec/executor.go

@@ -28,7 +28,11 @@ func NewExecutor() *Executor {
 	return &Executor{}
 }
 
-func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.GeneratorDependencies, params debug.BundleConfig, waitForDuration time.Duration, mgmURL string) (string, error) {
+func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.GeneratorDependencies, params debug.BundleConfig, waitForDuration time.Duration, mgmURL, uploadURL string) (string, error) {
+	if uploadURL == "" {
+		uploadURL = types.DefaultBundleURL
+	}
+
 	if waitForDuration > MaxBundleWaitTime {
 		log.Warnf("bundle wait time %v exceeds maximum %v, capping to maximum", waitForDuration, MaxBundleWaitTime)
 		waitForDuration = MaxBundleWaitTime
@@ -54,7 +58,7 @@ func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.
 		}
 	}()
 
-	key, err := debug.UploadDebugBundle(ctx, types.DefaultBundleURL, mgmURL, path, false)
+	key, err := debug.UploadDebugBundle(ctx, uploadURL, mgmURL, path, false)
 	if err != nil {
 		log.Errorf("failed to upload debug bundle: %v", err)
 		return "", fmt.Errorf("upload debug bundle: %w", err)

client/proto/daemon.pb.gw.go

@@ -1123,198 +1123,6 @@ func local_request_DaemonService_WailsUIReady_0(ctx context.Context, marshaler r
 	return msg, metadata, err
 }
 
-func request_DaemonService_FileDropSend_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropSendRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := client.FileDropSend(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-}
-
-func local_request_DaemonService_FileDropSend_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropSendRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := server.FileDropSend(ctx, &protoReq)
-	return msg, metadata, err
-}
-
-func request_DaemonService_FileDropDecide_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropDecideRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := client.FileDropDecide(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-}
-
-func local_request_DaemonService_FileDropDecide_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropDecideRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := server.FileDropDecide(ctx, &protoReq)
-	return msg, metadata, err
-}
-
-func request_DaemonService_FileDropCancel_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropCancelRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := client.FileDropCancel(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-}
-
-func local_request_DaemonService_FileDropCancel_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropCancelRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := server.FileDropCancel(ctx, &protoReq)
-	return msg, metadata, err
-}
-
-func request_DaemonService_FileDropListTransfers_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropListTransfersRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := client.FileDropListTransfers(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-}
-
-func local_request_DaemonService_FileDropListTransfers_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropListTransfersRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := server.FileDropListTransfers(ctx, &protoReq)
-	return msg, metadata, err
-}
-
-func request_DaemonService_FileDropDeleteTransfer_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropDeleteTransferRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := client.FileDropDeleteTransfer(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-}
-
-func local_request_DaemonService_FileDropDeleteTransfer_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropDeleteTransferRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := server.FileDropDeleteTransfer(ctx, &protoReq)
-	return msg, metadata, err
-}
-
-func request_DaemonService_FileDropGetSettings_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropGetSettingsRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := client.FileDropGetSettings(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-}
-
-func local_request_DaemonService_FileDropGetSettings_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropGetSettingsRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := server.FileDropGetSettings(ctx, &protoReq)
-	return msg, metadata, err
-}
-
-func request_DaemonService_FileDropSetSettings_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropSetSettingsRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := client.FileDropSetSettings(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-}
-
-func local_request_DaemonService_FileDropSetSettings_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropSetSettingsRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := server.FileDropSetSettings(ctx, &protoReq)
-	return msg, metadata, err
-}
-
-func request_DaemonService_FileDropSetPeerRule_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropSetPeerRuleRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := client.FileDropSetPeerRule(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-}
-
-func local_request_DaemonService_FileDropSetPeerRule_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq FileDropSetPeerRuleRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := server.FileDropSetPeerRule(ctx, &protoReq)
-	return msg, metadata, err
-}
-
 // RegisterDaemonServiceHandlerServer registers the http handlers for service DaemonService to "mux".
 // UnaryRPC     :call DaemonServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
@@ -2189,166 +1997,6 @@ func RegisterDaemonServiceHandlerServer(ctx context.Context, mux *runtime.ServeM
 		}
 		forward_DaemonService_WailsUIReady_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropSend_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/FileDropSend", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropSend"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_DaemonService_FileDropSend_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropSend_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropDecide_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/FileDropDecide", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropDecide"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_DaemonService_FileDropDecide_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropDecide_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropCancel_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/FileDropCancel", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropCancel"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_DaemonService_FileDropCancel_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropCancel_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropListTransfers_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/FileDropListTransfers", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropListTransfers"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_DaemonService_FileDropListTransfers_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropListTransfers_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropDeleteTransfer_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/FileDropDeleteTransfer", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropDeleteTransfer"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_DaemonService_FileDropDeleteTransfer_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropDeleteTransfer_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropGetSettings_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/FileDropGetSettings", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropGetSettings"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_DaemonService_FileDropGetSettings_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropGetSettings_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropSetSettings_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/FileDropSetSettings", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropSetSettings"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_DaemonService_FileDropSetSettings_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropSetSettings_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropSetPeerRule_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/FileDropSetPeerRule", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropSetPeerRule"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_DaemonService_FileDropSetPeerRule_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropSetPeerRule_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
 
 	return nil
 }
@@ -3171,142 +2819,6 @@ func RegisterDaemonServiceHandlerClient(ctx context.Context, mux *runtime.ServeM
 		}
 		forward_DaemonService_WailsUIReady_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropSend_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/FileDropSend", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropSend"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_DaemonService_FileDropSend_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropSend_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropDecide_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/FileDropDecide", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropDecide"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_DaemonService_FileDropDecide_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropDecide_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropCancel_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/FileDropCancel", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropCancel"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_DaemonService_FileDropCancel_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropCancel_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropListTransfers_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/FileDropListTransfers", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropListTransfers"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_DaemonService_FileDropListTransfers_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropListTransfers_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropDeleteTransfer_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/FileDropDeleteTransfer", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropDeleteTransfer"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_DaemonService_FileDropDeleteTransfer_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropDeleteTransfer_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropGetSettings_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/FileDropGetSettings", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropGetSettings"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_DaemonService_FileDropGetSettings_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropGetSettings_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropSetSettings_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/FileDropSetSettings", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropSetSettings"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_DaemonService_FileDropSetSettings_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropSetSettings_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_FileDropSetPeerRule_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/FileDropSetPeerRule", runtime.WithHTTPPathPattern("/daemon.DaemonService/FileDropSetPeerRule"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_DaemonService_FileDropSetPeerRule_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_FileDropSetPeerRule_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
 	return nil
 }
 
@@ -3357,14 +2869,6 @@ var (
 	pattern_DaemonService_GetInstallerResult_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetInstallerResult"}, ""))
 	pattern_DaemonService_ExposeService_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ExposeService"}, ""))
 	pattern_DaemonService_WailsUIReady_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "WailsUIReady"}, ""))
-	pattern_DaemonService_FileDropSend_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "FileDropSend"}, ""))
-	pattern_DaemonService_FileDropDecide_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "FileDropDecide"}, ""))
-	pattern_DaemonService_FileDropCancel_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "FileDropCancel"}, ""))
-	pattern_DaemonService_FileDropListTransfers_0      = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "FileDropListTransfers"}, ""))
-	pattern_DaemonService_FileDropDeleteTransfer_0     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "FileDropDeleteTransfer"}, ""))
-	pattern_DaemonService_FileDropGetSettings_0        = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "FileDropGetSettings"}, ""))
-	pattern_DaemonService_FileDropSetSettings_0        = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "FileDropSetSettings"}, ""))
-	pattern_DaemonService_FileDropSetPeerRule_0        = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "FileDropSetPeerRule"}, ""))
 )
 
 var (
@@ -3414,12 +2918,4 @@ var (
 	forward_DaemonService_GetInstallerResult_0         = runtime.ForwardResponseMessage
 	forward_DaemonService_ExposeService_0              = runtime.ForwardResponseStream
 	forward_DaemonService_WailsUIReady_0               = runtime.ForwardResponseMessage
-	forward_DaemonService_FileDropSend_0               = runtime.ForwardResponseMessage
-	forward_DaemonService_FileDropDecide_0             = runtime.ForwardResponseMessage
-	forward_DaemonService_FileDropCancel_0             = runtime.ForwardResponseMessage
-	forward_DaemonService_FileDropListTransfers_0      = runtime.ForwardResponseMessage
-	forward_DaemonService_FileDropDeleteTransfer_0     = runtime.ForwardResponseMessage
-	forward_DaemonService_FileDropGetSettings_0        = runtime.ForwardResponseMessage
-	forward_DaemonService_FileDropSetSettings_0        = runtime.ForwardResponseMessage
-	forward_DaemonService_FileDropSetPeerRule_0        = runtime.ForwardResponseMessage
 )

client/proto/daemon.proto

@@ -156,32 +156,6 @@ service DaemonService {
   // only cares whether the daemon implements it: an Unimplemented response
   // means the daemon predates this UI and is too old to drive it.
   rpc WailsUIReady(WailsUIReadyRequest) returns (WailsUIReadyResponse) {}
-
-  // FileDropSend starts an asynchronous file transfer to a peer. Progress is
-  // polled via FileDropListTransfers; the outcome also arrives as a SystemEvent.
-  rpc FileDropSend(FileDropSendRequest) returns (FileDropSendResponse) {}
-
-  // FileDropDecide accepts or declines a pending incoming offer.
-  rpc FileDropDecide(FileDropDecideRequest) returns (FileDropDecideResponse) {}
-
-  // FileDropCancel aborts a transfer in either direction.
-  rpc FileDropCancel(FileDropCancelRequest) returns (FileDropCancelResponse) {}
-
-  // FileDropListTransfers returns the transfer history, newest first, with live
-  // progress for running transfers.
-  rpc FileDropListTransfers(FileDropListTransfersRequest) returns (FileDropListTransfersResponse) {}
-
-  // FileDropDeleteTransfer removes one entry from the transfer history.
-  rpc FileDropDeleteTransfer(FileDropDeleteTransferRequest) returns (FileDropDeleteTransferResponse) {}
-
-  // FileDropGetSettings returns the active profile's receiving policy.
-  rpc FileDropGetSettings(FileDropGetSettingsRequest) returns (FileDropGetSettingsResponse) {}
-
-  // FileDropSetSettings updates the active profile's receiving policy.
-  rpc FileDropSetSettings(FileDropSetSettingsRequest) returns (FileDropSetSettingsResponse) {}
-
-  // FileDropSetPeerRule sets or clears a per-sender exception.
-  rpc FileDropSetPeerRule(FileDropSetPeerRuleRequest) returns (FileDropSetPeerRuleResponse) {}
 }
 
 
@@ -920,10 +894,6 @@ message GetPeerSSHHostKeyResponse {
 message RequestJWTAuthRequest {
   // hint for OIDC login_hint parameter (typically email address)
   optional string hint = 1;
-  // hasGraphicalSession tells the daemon that the caller has a graphical session,
-  // which decides whether PKCE or the device code flow is preferred. The daemon
-  // cannot detect this itself: it does not inherit the session environment.
-  bool hasGraphicalSession = 2;
 }
 
 // RequestJWTAuthResponse contains authentication flow information
@@ -967,10 +937,6 @@ message RequestExtendAuthSessionRequest {
   // Optional OIDC login_hint (typically the user's email) to pre-fill the
   // IdP login form.
   optional string hint = 1;
-  // hasGraphicalSession tells the daemon that the caller has a graphical session,
-  // which decides whether PKCE or the device code flow is preferred. The daemon
-  // cannot detect this itself: it does not inherit the session environment.
-  bool hasGraphicalSession = 2;
 }
 
 // RequestExtendAuthSessionResponse carries the verification URI the UI
@@ -1089,119 +1055,3 @@ message StartBundleCaptureRequest {
 message StartBundleCaptureResponse {}
 message StopBundleCaptureRequest {}
 message StopBundleCaptureResponse {}
-
-// FileDropMode is the device-local policy for incoming file offers.
-enum FileDropMode {
-  FILE_DROP_MODE_OFF = 0;
-  FILE_DROP_MODE_ASK = 1;
-  FILE_DROP_MODE_AUTO = 2;
-}
-
-// FileDropRule is a per-sender exception on top of the base mode.
-enum FileDropRule {
-  FILE_DROP_RULE_DEFAULT = 0;
-  FILE_DROP_RULE_ALWAYS = 1;
-  FILE_DROP_RULE_BLOCK = 2;
-}
-
-// FileDropReason classifies why a transfer failed, when it is known.
-enum FileDropReason {
-  FILE_DROP_REASON_NONE = 0;
-  FILE_DROP_REASON_UNREACHABLE = 1;
-}
-
-// FileDropState is the lifecycle state of a transfer.
-enum FileDropState {
-  FILE_DROP_STATE_PENDING = 0;
-  FILE_DROP_STATE_TRANSFERRING = 1;
-  FILE_DROP_STATE_COMPLETED = 2;
-  FILE_DROP_STATE_DECLINED = 3;
-  FILE_DROP_STATE_EXPIRED = 4;
-  FILE_DROP_STATE_CANCELLED = 5;
-  FILE_DROP_STATE_FAILED = 6;
-}
-
-message FileDropFile {
-  string name = 1;
-  int64 size = 2;
-  string contentType = 3;
-  bool isText = 4;
-  // text carries an inline snippet; it never becomes a file on disk.
-  string text = 5;
-}
-
-message FileDropTransfer {
-  string id = 1;
-  bool outgoing = 2;
-  string peerKey = 3;
-  string peerName = 4;
-  repeated FileDropFile files = 5;
-  FileDropState state = 6;
-  int64 transferred = 7;
-  int64 totalSize = 8;
-  google.protobuf.Timestamp createdAt = 9;
-  google.protobuf.Timestamp updatedAt = 10;
-  repeated string deliveredPaths = 11;
-  string error = 12;
-  FileDropReason reason = 13;
-}
-
-message FileDropSendRequest {
-  string peerKey = 1;
-  // paths are local files to send; the daemon opens them as the caller.
-  repeated string paths = 2;
-  // text is an inline snippet payload, sent instead of or alongside files.
-  string text = 3;
-}
-
-message FileDropSendResponse {
-  string transferId = 1;
-}
-
-message FileDropDecideRequest {
-  string transferId = 1;
-  bool accept = 2;
-}
-
-message FileDropDecideResponse {}
-
-message FileDropCancelRequest {
-  string transferId = 1;
-}
-
-message FileDropCancelResponse {}
-
-message FileDropListTransfersRequest {}
-
-message FileDropListTransfersResponse {
-  repeated FileDropTransfer transfers = 1;
-}
-
-message FileDropDeleteTransferRequest {
-  string transferId = 1;
-}
-
-message FileDropDeleteTransferResponse {}
-
-message FileDropGetSettingsRequest {}
-
-message FileDropGetSettingsResponse {
-  FileDropMode mode = 1;
-  string destinationDir = 2;
-  // peerRules is keyed by the peer's public key.
-  map<string, FileDropRule> peerRules = 3;
-}
-
-message FileDropSetSettingsRequest {
-  FileDropMode mode = 1;
-  string destinationDir = 2;
-}
-
-message FileDropSetSettingsResponse {}
-
-message FileDropSetPeerRuleRequest {
-  string peerKey = 1;
-  FileDropRule rule = 2;
-}
-
-message FileDropSetPeerRuleResponse {}

client/proto/daemon_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.6.1
-// - protoc             v7.34.1
+// - protoc             v6.33.1
 // source: daemon.proto
 
 package proto
@@ -65,14 +65,6 @@ const (
 	DaemonService_GetInstallerResult_FullMethodName         = "/daemon.DaemonService/GetInstallerResult"
 	DaemonService_ExposeService_FullMethodName              = "/daemon.DaemonService/ExposeService"
 	DaemonService_WailsUIReady_FullMethodName               = "/daemon.DaemonService/WailsUIReady"
-	DaemonService_FileDropSend_FullMethodName               = "/daemon.DaemonService/FileDropSend"
-	DaemonService_FileDropDecide_FullMethodName             = "/daemon.DaemonService/FileDropDecide"
-	DaemonService_FileDropCancel_FullMethodName             = "/daemon.DaemonService/FileDropCancel"
-	DaemonService_FileDropListTransfers_FullMethodName      = "/daemon.DaemonService/FileDropListTransfers"
-	DaemonService_FileDropDeleteTransfer_FullMethodName     = "/daemon.DaemonService/FileDropDeleteTransfer"
-	DaemonService_FileDropGetSettings_FullMethodName        = "/daemon.DaemonService/FileDropGetSettings"
-	DaemonService_FileDropSetSettings_FullMethodName        = "/daemon.DaemonService/FileDropSetSettings"
-	DaemonService_FileDropSetPeerRule_FullMethodName        = "/daemon.DaemonService/FileDropSetPeerRule"
 )
 
 // DaemonServiceClient is the client API for DaemonService service.
@@ -179,24 +171,6 @@ type DaemonServiceClient interface {
 	// only cares whether the daemon implements it: an Unimplemented response
 	// means the daemon predates this UI and is too old to drive it.
 	WailsUIReady(ctx context.Context, in *WailsUIReadyRequest, opts ...grpc.CallOption) (*WailsUIReadyResponse, error)
-	// FileDropSend starts an asynchronous file transfer to a peer. Progress is
-	// polled via FileDropListTransfers; the outcome also arrives as a SystemEvent.
-	FileDropSend(ctx context.Context, in *FileDropSendRequest, opts ...grpc.CallOption) (*FileDropSendResponse, error)
-	// FileDropDecide accepts or declines a pending incoming offer.
-	FileDropDecide(ctx context.Context, in *FileDropDecideRequest, opts ...grpc.CallOption) (*FileDropDecideResponse, error)
-	// FileDropCancel aborts a transfer in either direction.
-	FileDropCancel(ctx context.Context, in *FileDropCancelRequest, opts ...grpc.CallOption) (*FileDropCancelResponse, error)
-	// FileDropListTransfers returns the transfer history, newest first, with live
-	// progress for running transfers.
-	FileDropListTransfers(ctx context.Context, in *FileDropListTransfersRequest, opts ...grpc.CallOption) (*FileDropListTransfersResponse, error)
-	// FileDropDeleteTransfer removes one entry from the transfer history.
-	FileDropDeleteTransfer(ctx context.Context, in *FileDropDeleteTransferRequest, opts ...grpc.CallOption) (*FileDropDeleteTransferResponse, error)
-	// FileDropGetSettings returns the active profile's receiving policy.
-	FileDropGetSettings(ctx context.Context, in *FileDropGetSettingsRequest, opts ...grpc.CallOption) (*FileDropGetSettingsResponse, error)
-	// FileDropSetSettings updates the active profile's receiving policy.
-	FileDropSetSettings(ctx context.Context, in *FileDropSetSettingsRequest, opts ...grpc.CallOption) (*FileDropSetSettingsResponse, error)
-	// FileDropSetPeerRule sets or clears a per-sender exception.
-	FileDropSetPeerRule(ctx context.Context, in *FileDropSetPeerRuleRequest, opts ...grpc.CallOption) (*FileDropSetPeerRuleResponse, error)
 }
 
 type daemonServiceClient struct {
@@ -703,86 +677,6 @@ func (c *daemonServiceClient) WailsUIReady(ctx context.Context, in *WailsUIReady
 	return out, nil
 }
 
-func (c *daemonServiceClient) FileDropSend(ctx context.Context, in *FileDropSendRequest, opts ...grpc.CallOption) (*FileDropSendResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(FileDropSendResponse)
-	err := c.cc.Invoke(ctx, DaemonService_FileDropSend_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *daemonServiceClient) FileDropDecide(ctx context.Context, in *FileDropDecideRequest, opts ...grpc.CallOption) (*FileDropDecideResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(FileDropDecideResponse)
-	err := c.cc.Invoke(ctx, DaemonService_FileDropDecide_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *daemonServiceClient) FileDropCancel(ctx context.Context, in *FileDropCancelRequest, opts ...grpc.CallOption) (*FileDropCancelResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(FileDropCancelResponse)
-	err := c.cc.Invoke(ctx, DaemonService_FileDropCancel_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *daemonServiceClient) FileDropListTransfers(ctx context.Context, in *FileDropListTransfersRequest, opts ...grpc.CallOption) (*FileDropListTransfersResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(FileDropListTransfersResponse)
-	err := c.cc.Invoke(ctx, DaemonService_FileDropListTransfers_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *daemonServiceClient) FileDropDeleteTransfer(ctx context.Context, in *FileDropDeleteTransferRequest, opts ...grpc.CallOption) (*FileDropDeleteTransferResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(FileDropDeleteTransferResponse)
-	err := c.cc.Invoke(ctx, DaemonService_FileDropDeleteTransfer_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *daemonServiceClient) FileDropGetSettings(ctx context.Context, in *FileDropGetSettingsRequest, opts ...grpc.CallOption) (*FileDropGetSettingsResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(FileDropGetSettingsResponse)
-	err := c.cc.Invoke(ctx, DaemonService_FileDropGetSettings_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *daemonServiceClient) FileDropSetSettings(ctx context.Context, in *FileDropSetSettingsRequest, opts ...grpc.CallOption) (*FileDropSetSettingsResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(FileDropSetSettingsResponse)
-	err := c.cc.Invoke(ctx, DaemonService_FileDropSetSettings_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *daemonServiceClient) FileDropSetPeerRule(ctx context.Context, in *FileDropSetPeerRuleRequest, opts ...grpc.CallOption) (*FileDropSetPeerRuleResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(FileDropSetPeerRuleResponse)
-	err := c.cc.Invoke(ctx, DaemonService_FileDropSetPeerRule_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 // DaemonServiceServer is the server API for DaemonService service.
 // All implementations must embed UnimplementedDaemonServiceServer
 // for forward compatibility.
@@ -887,24 +781,6 @@ type DaemonServiceServer interface {
 	// only cares whether the daemon implements it: an Unimplemented response
 	// means the daemon predates this UI and is too old to drive it.
 	WailsUIReady(context.Context, *WailsUIReadyRequest) (*WailsUIReadyResponse, error)
-	// FileDropSend starts an asynchronous file transfer to a peer. Progress is
-	// polled via FileDropListTransfers; the outcome also arrives as a SystemEvent.
-	FileDropSend(context.Context, *FileDropSendRequest) (*FileDropSendResponse, error)
-	// FileDropDecide accepts or declines a pending incoming offer.
-	FileDropDecide(context.Context, *FileDropDecideRequest) (*FileDropDecideResponse, error)
-	// FileDropCancel aborts a transfer in either direction.
-	FileDropCancel(context.Context, *FileDropCancelRequest) (*FileDropCancelResponse, error)
-	// FileDropListTransfers returns the transfer history, newest first, with live
-	// progress for running transfers.
-	FileDropListTransfers(context.Context, *FileDropListTransfersRequest) (*FileDropListTransfersResponse, error)
-	// FileDropDeleteTransfer removes one entry from the transfer history.
-	FileDropDeleteTransfer(context.Context, *FileDropDeleteTransferRequest) (*FileDropDeleteTransferResponse, error)
-	// FileDropGetSettings returns the active profile's receiving policy.
-	FileDropGetSettings(context.Context, *FileDropGetSettingsRequest) (*FileDropGetSettingsResponse, error)
-	// FileDropSetSettings updates the active profile's receiving policy.
-	FileDropSetSettings(context.Context, *FileDropSetSettingsRequest) (*FileDropSetSettingsResponse, error)
-	// FileDropSetPeerRule sets or clears a per-sender exception.
-	FileDropSetPeerRule(context.Context, *FileDropSetPeerRuleRequest) (*FileDropSetPeerRuleResponse, error)
 	mustEmbedUnimplementedDaemonServiceServer()
 }
 
@@ -1053,30 +929,6 @@ func (UnimplementedDaemonServiceServer) ExposeService(*ExposeServiceRequest, grp
 func (UnimplementedDaemonServiceServer) WailsUIReady(context.Context, *WailsUIReadyRequest) (*WailsUIReadyResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method WailsUIReady not implemented")
 }
-func (UnimplementedDaemonServiceServer) FileDropSend(context.Context, *FileDropSendRequest) (*FileDropSendResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method FileDropSend not implemented")
-}
-func (UnimplementedDaemonServiceServer) FileDropDecide(context.Context, *FileDropDecideRequest) (*FileDropDecideResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method FileDropDecide not implemented")
-}
-func (UnimplementedDaemonServiceServer) FileDropCancel(context.Context, *FileDropCancelRequest) (*FileDropCancelResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method FileDropCancel not implemented")
-}
-func (UnimplementedDaemonServiceServer) FileDropListTransfers(context.Context, *FileDropListTransfersRequest) (*FileDropListTransfersResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method FileDropListTransfers not implemented")
-}
-func (UnimplementedDaemonServiceServer) FileDropDeleteTransfer(context.Context, *FileDropDeleteTransferRequest) (*FileDropDeleteTransferResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method FileDropDeleteTransfer not implemented")
-}
-func (UnimplementedDaemonServiceServer) FileDropGetSettings(context.Context, *FileDropGetSettingsRequest) (*FileDropGetSettingsResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method FileDropGetSettings not implemented")
-}
-func (UnimplementedDaemonServiceServer) FileDropSetSettings(context.Context, *FileDropSetSettingsRequest) (*FileDropSetSettingsResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method FileDropSetSettings not implemented")
-}
-func (UnimplementedDaemonServiceServer) FileDropSetPeerRule(context.Context, *FileDropSetPeerRuleRequest) (*FileDropSetPeerRuleResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method FileDropSetPeerRule not implemented")
-}
 func (UnimplementedDaemonServiceServer) mustEmbedUnimplementedDaemonServiceServer() {}
 func (UnimplementedDaemonServiceServer) testEmbeddedByValue()                       {}
 
@@ -1898,150 +1750,6 @@ func _DaemonService_WailsUIReady_Handler(srv interface{}, ctx context.Context, d
 	return interceptor(ctx, in, info, handler)
 }
 
-func _DaemonService_FileDropSend_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(FileDropSendRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(DaemonServiceServer).FileDropSend(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: DaemonService_FileDropSend_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DaemonServiceServer).FileDropSend(ctx, req.(*FileDropSendRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _DaemonService_FileDropDecide_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(FileDropDecideRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(DaemonServiceServer).FileDropDecide(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: DaemonService_FileDropDecide_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DaemonServiceServer).FileDropDecide(ctx, req.(*FileDropDecideRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _DaemonService_FileDropCancel_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(FileDropCancelRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(DaemonServiceServer).FileDropCancel(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: DaemonService_FileDropCancel_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DaemonServiceServer).FileDropCancel(ctx, req.(*FileDropCancelRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _DaemonService_FileDropListTransfers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(FileDropListTransfersRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(DaemonServiceServer).FileDropListTransfers(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: DaemonService_FileDropListTransfers_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DaemonServiceServer).FileDropListTransfers(ctx, req.(*FileDropListTransfersRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _DaemonService_FileDropDeleteTransfer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(FileDropDeleteTransferRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(DaemonServiceServer).FileDropDeleteTransfer(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: DaemonService_FileDropDeleteTransfer_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DaemonServiceServer).FileDropDeleteTransfer(ctx, req.(*FileDropDeleteTransferRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _DaemonService_FileDropGetSettings_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(FileDropGetSettingsRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(DaemonServiceServer).FileDropGetSettings(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: DaemonService_FileDropGetSettings_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DaemonServiceServer).FileDropGetSettings(ctx, req.(*FileDropGetSettingsRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _DaemonService_FileDropSetSettings_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(FileDropSetSettingsRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(DaemonServiceServer).FileDropSetSettings(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: DaemonService_FileDropSetSettings_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DaemonServiceServer).FileDropSetSettings(ctx, req.(*FileDropSetSettingsRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _DaemonService_FileDropSetPeerRule_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(FileDropSetPeerRuleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(DaemonServiceServer).FileDropSetPeerRule(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: DaemonService_FileDropSetPeerRule_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DaemonServiceServer).FileDropSetPeerRule(ctx, req.(*FileDropSetPeerRuleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 // DaemonService_ServiceDesc is the grpc.ServiceDesc for DaemonService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -2217,38 +1925,6 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "WailsUIReady",
 			Handler:    _DaemonService_WailsUIReady_Handler,
 		},
-		{
-			MethodName: "FileDropSend",
-			Handler:    _DaemonService_FileDropSend_Handler,
-		},
-		{
-			MethodName: "FileDropDecide",
-			Handler:    _DaemonService_FileDropDecide_Handler,
-		},
-		{
-			MethodName: "FileDropCancel",
-			Handler:    _DaemonService_FileDropCancel_Handler,
-		},
-		{
-			MethodName: "FileDropListTransfers",
-			Handler:    _DaemonService_FileDropListTransfers_Handler,
-		},
-		{
-			MethodName: "FileDropDeleteTransfer",
-			Handler:    _DaemonService_FileDropDeleteTransfer_Handler,
-		},
-		{
-			MethodName: "FileDropGetSettings",
-			Handler:    _DaemonService_FileDropGetSettings_Handler,
-		},
-		{
-			MethodName: "FileDropSetSettings",
-			Handler:    _DaemonService_FileDropSetSettings_Handler,
-		},
-		{
-			MethodName: "FileDropSetPeerRule",
-			Handler:    _DaemonService_FileDropSetPeerRule_Handler,
-		},
 	},
 	Streams: []grpc.StreamDesc{
 		{

client/proto/metadata.go

@@ -59,24 +59,3 @@ const (
 	// MetadataSourceMDM marks a config_changed driven by an MDM policy diff.
 	MetadataSourceMDM = "mdm"
 )
-
-// SystemEvent metadata markers for file drop transfers. The daemon publishes one
-// per transfer milestone; the UI shows a notification and refreshes its transfer
-// views. Progress is not evented — the UI polls FileDropListTransfers.
-const (
-	// MetadataKindFileDropOffer marks an incoming offer awaiting the user's decision.
-	MetadataKindFileDropOffer = "filedrop-offer"
-	// MetadataKindFileDropCompleted marks a finished transfer in either direction.
-	MetadataKindFileDropCompleted = "filedrop-completed"
-	// MetadataKindFileDropFailed marks a transfer that ended without completing.
-	MetadataKindFileDropFailed = "filedrop-failed"
-	// MetadataKindFileDropWithdrawn marks a pending offer that was cancelled by the
-	// sender or expired, so its consent prompt should be dismissed.
-	MetadataKindFileDropWithdrawn = "filedrop-withdrawn"
-
-	// MetadataFileDropTransferKey carries the transfer ID for the filedrop-* kinds.
-	MetadataFileDropTransferKey = "filedropTransferId"
-	// MetadataFileDropPeerKey carries the remote peer's public key for the
-	// filedrop-* kinds, so notification actions can set per-sender rules.
-	MetadataFileDropPeerKey = "filedropPeerKey"
-)

client/server/filedrop.go

@@ -1,412 +0,0 @@
-package server
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"mime"
-	"net/netip"
-	"os"
-	"os/user"
-	"path/filepath"
-
-	log "github.com/sirupsen/logrus"
-	"google.golang.org/protobuf/types/known/timestamppb"
-
-	"github.com/netbirdio/netbird/client/internal/filedrop"
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-func (s *Server) fileDropManager() (*filedrop.Manager, error) {
-	activeProf, err := s.profileManager.GetActiveProfileState()
-	if err != nil {
-		return nil, fmt.Errorf("get active profile: %w", err)
-	}
-	if !profilemanager.IsValidProfileFilenameStem(activeProf.ID) {
-		return nil, fmt.Errorf("invalid profile ID %q", activeProf.ID)
-	}
-
-	s.mutex.Lock()
-	if s.fileDrop != nil && s.fileDrop.Profile() == activeProf.ID {
-		mgr := s.fileDrop
-		s.mutex.Unlock()
-		return mgr, nil
-	}
-	old := s.fileDrop
-	s.fileDrop = nil
-	s.mutex.Unlock()
-
-	if old != nil {
-		if err := old.Close(); err != nil {
-			log.Warnf("failed to close previous file drop manager: %v", err)
-		}
-	}
-
-	prefs, err := s.profileManager.ProfilePrefs(activeProf.ID, activeProf.Username)
-	if err != nil {
-		return nil, fmt.Errorf("resolve profile prefs: %w", err)
-	}
-
-	mgr, err := filedrop.NewManager(filedrop.ManagerConfig{
-		Profile: activeProf.ID,
-		DataDir: filepath.Join(profilemanager.DefaultConfigPathDir, "filedrop", activeProf.ID.String()),
-		Store:   filedrop.NewProfileStore(prefs),
-		Events:  s.publishFileDropEvent,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("create file drop manager: %w", err)
-	}
-
-	seedFileDropDestination(mgr, activeProf.Username)
-
-	s.mutex.Lock()
-	if s.fileDrop != nil && s.fileDrop.Profile() == activeProf.ID {
-		winner := s.fileDrop
-		s.mutex.Unlock()
-		_ = mgr.Close()
-		return winner, nil
-	}
-	s.fileDrop = mgr
-	s.mutex.Unlock()
-	return mgr, nil
-}
-
-func (s *Server) publishFileDropEvent(kind filedrop.EventKind, transfer filedrop.Transfer) {
-	s.mutex.Lock()
-	statusRecorder := s.statusRecorder
-	s.mutex.Unlock()
-	if statusRecorder == nil {
-		return
-	}
-
-	var metaKind, userMsg string
-	switch kind {
-	case filedrop.EventOffer:
-		metaKind = proto.MetadataKindFileDropOffer
-		userMsg = fmt.Sprintf("%s wants to send you %s", transfer.PeerName, transferLabel(transfer))
-	case filedrop.EventCompleted:
-		metaKind = proto.MetadataKindFileDropCompleted
-		if transfer.Direction == filedrop.DirectionSent {
-			userMsg = fmt.Sprintf("Sent %s to %s", transferLabel(transfer), transfer.PeerName)
-		} else {
-			userMsg = fmt.Sprintf("Received %s from %s", transferLabel(transfer), transfer.PeerName)
-		}
-	case filedrop.EventFailed:
-		metaKind = proto.MetadataKindFileDropFailed
-		userMsg = fmt.Sprintf("Transfer of %s failed", transferLabel(transfer))
-	case filedrop.EventWithdrawn:
-		metaKind = proto.MetadataKindFileDropWithdrawn
-	default:
-		return
-	}
-
-	statusRecorder.PublishEvent(
-		proto.SystemEvent_INFO,
-		proto.SystemEvent_SYSTEM,
-		"file drop transfer update",
-		userMsg,
-		map[string]string{
-			proto.MetadataKindKey:             metaKind,
-			proto.MetadataFileDropTransferKey: string(transfer.ID),
-			proto.MetadataFileDropPeerKey:     string(transfer.PeerKey),
-		},
-	)
-}
-
-// FileDropSend starts an asynchronous transfer to a peer.
-func (s *Server) FileDropSend(ctx context.Context, req *proto.FileDropSendRequest) (*proto.FileDropSendResponse, error) {
-	mgr, err := s.fileDropManager()
-	if err != nil {
-		return nil, err
-	}
-
-	s.mutex.Lock()
-	statusRecorder := s.statusRecorder
-	s.mutex.Unlock()
-	if statusRecorder == nil {
-		return nil, errors.New("not connected")
-	}
-
-	peerState, err := statusRecorder.GetPeer(req.GetPeerKey())
-	if err != nil {
-		return nil, fmt.Errorf("unknown peer: %w", err)
-	}
-	addr, err := netip.ParseAddr(peerState.IP)
-	if err != nil {
-		return nil, fmt.Errorf("parse peer address: %w", err)
-	}
-
-	payloads, err := s.buildFileDropPayloads(ctx, req)
-	if err != nil {
-		return nil, err
-	}
-
-	id, err := mgr.Send(filedrop.PeerKey(req.GetPeerKey()), peerState.FQDN, addr.Unmap(), payloads)
-	if err != nil {
-		return nil, err
-	}
-	return &proto.FileDropSendResponse{TransferId: string(id)}, nil
-}
-
-func (s *Server) buildFileDropPayloads(ctx context.Context, req *proto.FileDropSendRequest) ([]filedrop.Payload, error) {
-	var payloads []filedrop.Payload
-
-	if len(req.GetPaths()) > 0 {
-		caller, ok := ipcauth.CallerIdentity(ctx)
-		if !ok {
-			return nil, errors.New("caller identity required to send files")
-		}
-		for _, path := range req.GetPaths() {
-			payload, err := fileDropPayload(caller, path)
-			if err != nil {
-				return nil, err
-			}
-			payloads = append(payloads, payload)
-		}
-	}
-
-	if text := req.GetText(); text != "" {
-		if len(text) > filedrop.MaxInlineTextSize {
-			return nil, fmt.Errorf("text exceeds %d bytes", filedrop.MaxInlineTextSize)
-		}
-		payloads = append(payloads, filedrop.TextPayload("text", text))
-	}
-
-	if len(payloads) == 0 {
-		return nil, errors.New("nothing to send")
-	}
-	return payloads, nil
-}
-
-// FileDropDecide accepts or declines a pending incoming offer.
-func (s *Server) FileDropDecide(_ context.Context, req *proto.FileDropDecideRequest) (*proto.FileDropDecideResponse, error) {
-	mgr, err := s.fileDropManager()
-	if err != nil {
-		return nil, err
-	}
-
-	id := filedrop.OfferID(req.GetTransferId())
-	if req.GetAccept() {
-		err = mgr.Accept(id)
-	} else {
-		err = mgr.Decline(id)
-	}
-	if err != nil {
-		return nil, err
-	}
-	return &proto.FileDropDecideResponse{}, nil
-}
-
-// FileDropCancel aborts a transfer in either direction.
-func (s *Server) FileDropCancel(_ context.Context, req *proto.FileDropCancelRequest) (*proto.FileDropCancelResponse, error) {
-	mgr, err := s.fileDropManager()
-	if err != nil {
-		return nil, err
-	}
-	mgr.Cancel(filedrop.OfferID(req.GetTransferId()))
-	return &proto.FileDropCancelResponse{}, nil
-}
-
-// FileDropListTransfers returns the transfer history, newest first.
-func (s *Server) FileDropListTransfers(context.Context, *proto.FileDropListTransfersRequest) (*proto.FileDropListTransfersResponse, error) {
-	mgr, err := s.fileDropManager()
-	if err != nil {
-		return nil, err
-	}
-
-	transfers := mgr.Transfers()
-	resp := &proto.FileDropListTransfersResponse{
-		Transfers: make([]*proto.FileDropTransfer, 0, len(transfers)),
-	}
-	for _, t := range transfers {
-		resp.Transfers = append(resp.Transfers, fileDropTransferToProto(t))
-	}
-	return resp, nil
-}
-
-// FileDropDeleteTransfer removes one entry from the transfer history.
-func (s *Server) FileDropDeleteTransfer(_ context.Context, req *proto.FileDropDeleteTransferRequest) (*proto.FileDropDeleteTransferResponse, error) {
-	mgr, err := s.fileDropManager()
-	if err != nil {
-		return nil, err
-	}
-	mgr.DeleteTransfer(filedrop.OfferID(req.GetTransferId()))
-	return &proto.FileDropDeleteTransferResponse{}, nil
-}
-
-// FileDropGetSettings returns the active profile's receiving policy.
-func (s *Server) FileDropGetSettings(context.Context, *proto.FileDropGetSettingsRequest) (*proto.FileDropGetSettingsResponse, error) {
-	mgr, err := s.fileDropManager()
-	if err != nil {
-		return nil, err
-	}
-
-	policy := mgr.Policy().Get()
-	rules := make(map[string]proto.FileDropRule, len(policy.Senders))
-	for key, rule := range policy.Senders {
-		rules[string(key)] = proto.FileDropRule(rule)
-	}
-
-	return &proto.FileDropGetSettingsResponse{
-		Mode:           proto.FileDropMode(policy.Mode),
-		DestinationDir: mgr.DestinationDir(),
-		PeerRules:      rules,
-	}, nil
-}
-
-// FileDropSetSettings updates the active profile's receiving policy.
-func (s *Server) FileDropSetSettings(ctx context.Context, req *proto.FileDropSetSettingsRequest) (*proto.FileDropSetSettingsResponse, error) {
-	mgr, err := s.fileDropManager()
-	if err != nil {
-		return nil, err
-	}
-
-	policy := mgr.Policy().Get()
-	policy.Mode = filedrop.Mode(req.GetMode())
-	if err := mgr.Policy().Set(policy); err != nil {
-		return nil, err
-	}
-
-	if dir := req.GetDestinationDir(); dir != mgr.DestinationDir() {
-		if err := s.validateFileDropDestination(ctx, dir); err != nil {
-			return nil, err
-		}
-		if err := mgr.SetDestinationDir(dir); err != nil {
-			return nil, err
-		}
-	}
-	return &proto.FileDropSetSettingsResponse{}, nil
-}
-
-func (s *Server) validateFileDropDestination(ctx context.Context, dir string) error {
-	if dir == "" {
-		return nil
-	}
-	if !filepath.IsAbs(dir) {
-		return errors.New("destination must be an absolute path")
-	}
-
-	caller, ok := ipcauth.CallerIdentity(ctx)
-	if !ok {
-		return errors.New("caller identity required to change the destination")
-	}
-
-	info, err := os.Stat(dir)
-	if err != nil {
-		return fmt.Errorf("destination: %w", err)
-	}
-	if !info.IsDir() {
-		return errors.New("destination is not a directory")
-	}
-	return checkDirOwnership(caller, dir, info)
-}
-
-// FileDropSetPeerRule sets or clears a per-sender exception.
-func (s *Server) FileDropSetPeerRule(_ context.Context, req *proto.FileDropSetPeerRuleRequest) (*proto.FileDropSetPeerRuleResponse, error) {
-	mgr, err := s.fileDropManager()
-	if err != nil {
-		return nil, err
-	}
-	if err := mgr.SetSenderRule(filedrop.PeerKey(req.GetPeerKey()), filedrop.SenderRule(req.GetRule())); err != nil {
-		return nil, err
-	}
-	return &proto.FileDropSetPeerRuleResponse{}, nil
-}
-
-func fileDropTransferToProto(t filedrop.Transfer) *proto.FileDropTransfer {
-	files := make([]*proto.FileDropFile, 0, len(t.Files))
-	for _, f := range t.Files {
-		files = append(files, &proto.FileDropFile{
-			Name:        f.Name,
-			Size:        f.Size,
-			ContentType: f.ContentType,
-			IsText:      f.Kind == filedrop.KindText,
-			Text:        f.Text,
-		})
-	}
-
-	return &proto.FileDropTransfer{
-		Id:             string(t.ID),
-		Outgoing:       t.Direction == filedrop.DirectionSent,
-		PeerKey:        string(t.PeerKey),
-		PeerName:       t.PeerName,
-		Files:          files,
-		State:          proto.FileDropState(t.State),
-		Transferred:    t.Transferred,
-		TotalSize:      t.TotalSize,
-		CreatedAt:      timestamppb.New(t.CreatedAt),
-		UpdatedAt:      timestamppb.New(t.UpdatedAt),
-		DeliveredPaths: t.DeliveredPaths,
-		Error:          t.Error,
-		Reason:         proto.FileDropReason(t.Reason),
-	}
-}
-
-func transferLabel(t filedrop.Transfer) string {
-	if len(t.Files) == 1 {
-		return t.Files[0].Name
-	}
-	return fmt.Sprintf("%d files", len(t.Files))
-}
-
-func fileDropPayload(caller ipcauth.Identity, path string) (filedrop.Payload, error) {
-	f, err := ipcauth.OpenOwnedFile(caller, path)
-	if err != nil {
-		return filedrop.Payload{}, fmt.Errorf("open %s: %w", path, err)
-	}
-	info, err := f.Stat()
-	closeErr := f.Close()
-	if err != nil {
-		return filedrop.Payload{}, fmt.Errorf("stat %s: %w", path, err)
-	}
-	if closeErr != nil {
-		return filedrop.Payload{}, fmt.Errorf("close %s: %w", path, closeErr)
-	}
-
-	return filedrop.Payload{
-		Meta: filedrop.FileMeta{
-			Name:        filepath.Base(path),
-			Size:        info.Size(),
-			ContentType: mime.TypeByExtension(filepath.Ext(path)),
-		},
-		Open: func(offset int64) (io.ReadCloser, error) {
-			f, err := ipcauth.OpenOwnedFile(caller, path)
-			if err != nil {
-				return nil, err
-			}
-			if _, err := f.Seek(offset, io.SeekStart); err != nil {
-				_ = f.Close()
-				return nil, err
-			}
-			return f, nil
-		},
-	}, nil
-}
-
-// seedFileDropDestination gives a profile a delivery directory on first use, so
-// a received file always has somewhere to land. Resolved from the profile's own
-// user rather than the process: the daemon runs as root, whose home is not where
-// the user would look for their downloads.
-func seedFileDropDestination(mgr *filedrop.Manager, username string) {
-	if mgr.DestinationDir() != "" {
-		return
-	}
-
-	u, err := user.Lookup(username)
-	if err != nil {
-		log.Warnf("cannot resolve home of %s for the file drop destination: %v", username, err)
-		return
-	}
-	if u.HomeDir == "" {
-		log.Warnf("user %s has no home directory for the file drop destination", username)
-		return
-	}
-
-	dir := filepath.Join(u.HomeDir, "Downloads", "NetBird")
-	if err := mgr.SetDestinationDir(dir); err != nil {
-		log.Warnf("failed to set the default file drop destination: %v", err)
-	}
-}

client/server/filedrop_unix.go

@@ -1,25 +0,0 @@
-//go:build !windows
-
-package server
-
-import (
-	"errors"
-	"os"
-	"syscall"
-
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
-)
-
-func checkDirOwnership(caller ipcauth.Identity, _ string, info os.FileInfo) error {
-	if caller.UID == 0 {
-		return nil
-	}
-	stat, ok := info.Sys().(*syscall.Stat_t)
-	if !ok {
-		return errors.New("cannot determine destination ownership")
-	}
-	if stat.Uid != caller.UID {
-		return errors.New("destination is not owned by the caller")
-	}
-	return nil
-}

client/server/filedrop_windows.go

@@ -1,11 +0,0 @@
-package server
-
-import (
-	"os"
-
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
-)
-
-func checkDirOwnership(ipcauth.Identity, string, os.FileInfo) error {
-	return nil
-}

client/server/server.go

@@ -31,7 +31,6 @@ import (
 	"github.com/netbirdio/netbird/shared/management/domain"
 
 	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/filedrop"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 	"github.com/netbirdio/netbird/client/internal/updater"
@@ -110,8 +109,6 @@ type Server struct {
 	statusRecorder *peer.Status
 	sessionWatcher *internal.SessionWatcher
 
-	fileDrop *filedrop.Manager
-
 	probeThrottle       *probeThrottle
 	persistSyncResponse bool
 	isSessionActive     atomic.Bool
@@ -1726,8 +1723,8 @@ func (s *Server) RequestJWTAuth(
 		hint = profilemanager.GetLoginHint()
 	}
 
-	// the daemon has no graphical session of its own, only the caller can answer this
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint)
+	isDesktop := isUnixRunningDesktop()
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isDesktop, false, hint)
 	if err != nil {
 		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
 	}
@@ -1830,8 +1827,8 @@ func (s *Server) RequestExtendAuthSession(
 		hint = profilemanager.GetLoginHint()
 	}
 
-	// the daemon has no graphical session of its own, only the caller can answer this
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint)
+	isDesktop := isUnixRunningDesktop()
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isDesktop, false, hint)
 	if err != nil {
 		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
 	}
@@ -2003,6 +2000,13 @@ func (s *Server) ExposeService(req *proto.ExposeServiceRequest, srv proto.Daemon
 	return nil
 }
 
+func isUnixRunningDesktop() bool {
+	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
+		return false
+	}
+	return os.Getenv("DESKTOP_SESSION") != "" || os.Getenv("XDG_CURRENT_DESKTOP") != ""
+}
+
 func (s *Server) runProbes(ctx context.Context, waitForProbeResult bool) {
 	if s.connectClient == nil {
 		return
@@ -2354,12 +2358,6 @@ func (s *Server) connect(ctx context.Context, config *profilemanager.Config, sta
 	client.SetUpdateManager(s.updateManager)
 	client.SetSyncResponsePersistence(s.persistSyncResponse)
 
-	if mgr, err := s.fileDropManager(); err != nil {
-		log.Warnf("file drop is unavailable: %v", err)
-	} else {
-		client.SetFileDropManager(mgr)
-	}
-
 	s.mutex.Lock()
 	s.connectClient = client
 	s.mutex.Unlock()

client/ssh/client/client.go

@@ -313,23 +313,21 @@ func Dial(ctx context.Context, addr, user string, opts DialOptions) (*Client, er
 
 // dialSSH establishes an SSH connection without JWT authentication
 func dialSSH(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*Client, error) {
-	if config.Timeout > 0 {
-		var cancel context.CancelFunc
-		ctx, cancel = context.WithTimeout(ctx, config.Timeout)
-		defer cancel()
-	}
-
 	dialer := &net.Dialer{}
 	conn, err := dialer.DialContext(ctx, network, addr)
 	if err != nil {
 		return nil, fmt.Errorf("dial %s: %w", addr, err)
 	}
 
-	client, err := nbssh.Handshake(ctx, conn, addr, config)
+	clientConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
 	if err != nil {
-		return nil, err
+		if closeErr := conn.Close(); closeErr != nil {
+			log.Debugf("connection close after handshake failure: %v", closeErr)
+		}
+		return nil, fmt.Errorf("ssh handshake: %w", err)
 	}
 
+	client := ssh.NewClient(clientConn, chans, reqs)
 	return &Client{
 		client: client,
 	}, nil

client/ssh/client/terminal_unix.go

@@ -12,8 +12,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/term"
-
-	nbssh "github.com/netbirdio/netbird/client/ssh"
 )
 
 func (c *Client) setupTerminalMode(ctx context.Context, session *ssh.Session) error {
@@ -84,7 +82,37 @@ func (c *Client) setupTerminal(session *ssh.Session, fd int) error {
 		return fmt.Errorf("get terminal size: %w", err)
 	}
 
-	modes := nbssh.DefaultTerminalModes
+	modes := ssh.TerminalModes{
+		ssh.ECHO:          1,
+		ssh.TTY_OP_ISPEED: 14400,
+		ssh.TTY_OP_OSPEED: 14400,
+		// Ctrl+C
+		ssh.VINTR: 3,
+		// Ctrl+\
+		ssh.VQUIT: 28,
+		// Backspace
+		ssh.VERASE: 127,
+		// Ctrl+U
+		ssh.VKILL: 21,
+		// Ctrl+D
+		ssh.VEOF:  4,
+		ssh.VEOL:  0,
+		ssh.VEOL2: 0,
+		// Ctrl+Q
+		ssh.VSTART: 17,
+		// Ctrl+S
+		ssh.VSTOP: 19,
+		// Ctrl+Z
+		ssh.VSUSP: 26,
+		// Ctrl+O
+		ssh.VDISCARD: 15,
+		// Ctrl+R
+		ssh.VREPRINT: 18,
+		// Ctrl+W
+		ssh.VWERASE: 23,
+		// Ctrl+V
+		ssh.VLNEXT: 22,
+	}
 
 	terminal := os.Getenv("TERM")
 	if terminal == "" {

client/ssh/client/terminal_windows.go

@@ -10,8 +10,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/crypto/ssh"
-
-	nbssh "github.com/netbirdio/netbird/client/ssh"
 )
 
 const (
@@ -82,14 +80,28 @@ func (c *Client) setupTerminalMode(_ context.Context, session *ssh.Session) erro
 	w, h := c.getWindowsConsoleSize()
 
 	modes := ssh.TerminalModes{
-		ssh.ICRNL:  1,
-		ssh.OPOST:  1,
-		ssh.ONLCR:  1,
-		ssh.ISIG:   1,
-		ssh.ICANON: 1,
-	}
-	for mode, value := range nbssh.DefaultTerminalModes {
-		modes[mode] = value
+		ssh.ECHO:          1,
+		ssh.TTY_OP_ISPEED: 14400,
+		ssh.TTY_OP_OSPEED: 14400,
+		ssh.ICRNL:         1,
+		ssh.OPOST:         1,
+		ssh.ONLCR:         1,
+		ssh.ISIG:          1,
+		ssh.ICANON:        1,
+		ssh.VINTR:         3,   // Ctrl+C
+		ssh.VQUIT:         28,  // Ctrl+\
+		ssh.VERASE:        127, // Backspace
+		ssh.VKILL:         21,  // Ctrl+U
+		ssh.VEOF:          4,   // Ctrl+D
+		ssh.VEOL:          0,
+		ssh.VEOL2:         0,
+		ssh.VSTART:        17, // Ctrl+Q
+		ssh.VSTOP:         19, // Ctrl+S
+		ssh.VSUSP:         26, // Ctrl+Z
+		ssh.VDISCARD:      15, // Ctrl+O
+		ssh.VWERASE:       23, // Ctrl+W
+		ssh.VLNEXT:        22, // Ctrl+V
+		ssh.VREPRINT:      18, // Ctrl+R
 	}
 
 	if err := session.RequestPty("xterm-256color", h, w, modes); err != nil {

client/ssh/common.go

@@ -13,7 +13,6 @@ import (
 	"golang.org/x/crypto/ssh"
 
 	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/util"
 )
 
 const (
@@ -35,19 +34,6 @@ type HostKeyVerifier interface {
 	VerifySSHHostKey(peerAddress string, key []byte) error
 }
 
-// PeerKeyLookup returns the stored SSH host key for a peer address.
-type PeerKeyLookup func(peerAddress string) ([]byte, bool)
-
-// VerifySSHHostKey implements HostKeyVerifier by looking up the stored key
-// and comparing it against the presented key.
-func (l PeerKeyLookup) VerifySSHHostKey(peerAddress string, presentedKey []byte) error {
-	storedKey, found := l(peerAddress)
-	if !found {
-		return ErrPeerNotFound
-	}
-	return VerifyHostKey(storedKey, presentedKey, peerAddress)
-}
-
 // DaemonHostKeyVerifier implements HostKeyVerifier using the NetBird daemon
 type DaemonHostKeyVerifier struct {
 	client proto.DaemonServiceClient
@@ -106,8 +92,7 @@ func printAuthInstructions(stderr io.Writer, authResponse *proto.RequestJWTAuthR
 
 // RequestJWTToken requests or retrieves a JWT token for SSH authentication
 func RequestJWTToken(ctx context.Context, client proto.DaemonServiceClient, stdout, stderr io.Writer, useCache bool, hint string, openBrowser func(string) error) (string, error) {
-	// the ssh client runs in the user's session, the daemon does not: tell it what we can see
-	req := &proto.RequestJWTAuthRequest{HasGraphicalSession: util.HasGraphicalSession()}
+	req := &proto.RequestJWTAuthRequest{}
 	if hint != "" {
 		req.Hint = &hint
 	}
@@ -208,3 +193,4 @@ func buildAddressList(hostname string, remote net.Addr) []string {
 	}
 	return addresses
 }
+

client/ssh/handshake.go

@@ -1,45 +0,0 @@
-package ssh
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/crypto/ssh"
-)
-
-// Handshake runs the SSH client handshake on an already dialed conn and
-// returns the resulting client. Dialing bounds only the TCP establishment;
-// without a deadline on the socket a peer that accepts and then goes silent
-// blocks the handshake forever, so the context deadline is applied to conn
-// for the duration of the handshake. conn is closed on any error.
-func Handshake(ctx context.Context, conn net.Conn, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
-	if deadline, ok := ctx.Deadline(); ok {
-		if err := conn.SetDeadline(deadline); err != nil {
-			closeHandshake(conn, "conn after deadline error")
-			return nil, fmt.Errorf("set handshake deadline: %w", err)
-		}
-	}
-
-	sshConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
-	if err != nil {
-		closeHandshake(conn, "conn after handshake error")
-		return nil, fmt.Errorf("ssh handshake: %w", err)
-	}
-
-	if err := conn.SetDeadline(time.Time{}); err != nil {
-		closeHandshake(sshConn, "ssh conn after deadline clear error")
-		return nil, fmt.Errorf("clear handshake deadline: %w", err)
-	}
-
-	return ssh.NewClient(sshConn, chans, reqs), nil
-}
-
-func closeHandshake(c io.Closer, label string) {
-	if err := c.Close(); err != nil {
-		log.Debugf("ssh: close %s: %v", label, err)
-	}
-}

client/ssh/proxy/proxy.go

@@ -610,10 +610,13 @@ func (p *SSHProxy) dialBackend(ctx context.Context, addr, user, jwtToken string)
 		return nil, fmt.Errorf("connect to server: %w", err)
 	}
 
-	handshakeCtx, cancel := context.WithTimeout(ctx, sshHandshakeTimeout)
-	defer cancel()
+	clientConn, chans, reqs, err := cryptossh.NewClientConn(conn, addr, config)
+	if err != nil {
+		_ = conn.Close()
+		return nil, fmt.Errorf("SSH handshake: %w", err)
+	}
 
-	return nbssh.Handshake(handshakeCtx, conn, addr, config)
+	return cryptossh.NewClient(clientConn, chans, reqs), nil
 }
 
 func (p *SSHProxy) verifyHostKey(hostname string, remote net.Addr, key cryptossh.PublicKey) error {

client/ssh/session.go

@@ -1,84 +0,0 @@
-package ssh
-
-import (
-	"fmt"
-	"io"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/crypto/ssh"
-)
-
-// DefaultTerminalModes are the PTY modes used by the interactive terminal clients.
-var DefaultTerminalModes = ssh.TerminalModes{
-	ssh.ECHO:          1,
-	ssh.TTY_OP_ISPEED: 14400,
-	ssh.TTY_OP_OSPEED: 14400,
-	ssh.VINTR:         3,   // Ctrl+C
-	ssh.VQUIT:         28,  // Ctrl+\
-	ssh.VERASE:        127, // Backspace
-	ssh.VKILL:         21,  // Ctrl+U
-	ssh.VEOF:          4,   // Ctrl+D
-	ssh.VEOL:          0,
-	ssh.VEOL2:         0,
-	ssh.VSTART:        17, // Ctrl+Q
-	ssh.VSTOP:         19, // Ctrl+S
-	ssh.VSUSP:         26, // Ctrl+Z
-	ssh.VDISCARD:      15, // Ctrl+O
-	ssh.VREPRINT:      18, // Ctrl+R
-	ssh.VWERASE:       23, // Ctrl+W
-	ssh.VLNEXT:        22, // Ctrl+V
-}
-
-// PTYSession is an interactive shell session with a PTY and its I/O pipes.
-type PTYSession struct {
-	Session *ssh.Session
-	Stdin   io.WriteCloser
-	Stdout  io.Reader
-	Stderr  io.Reader
-}
-
-// StartPTYSession opens a session on the client, requests an xterm-256color PTY
-// with the default terminal modes, wires up the I/O pipes and starts a shell.
-// The session is closed on any error.
-func StartPTYSession(client *ssh.Client, cols, rows int) (*PTYSession, error) {
-	session, err := client.NewSession()
-	if err != nil {
-		return nil, fmt.Errorf("new session: %w", err)
-	}
-
-	pty, err := setupPTYSession(session, cols, rows)
-	if err != nil {
-		if closeErr := session.Close(); closeErr != nil {
-			log.Debugf("ssh: session close after setup error: %v", closeErr)
-		}
-		return nil, err
-	}
-	return pty, nil
-}
-
-// setupPTYSession requests the PTY, opens the pipes and starts the shell on an
-// already created session.
-func setupPTYSession(session *ssh.Session, cols, rows int) (*PTYSession, error) {
-	if err := session.RequestPty("xterm-256color", rows, cols, DefaultTerminalModes); err != nil {
-		return nil, fmt.Errorf("request pty: %w", err)
-	}
-
-	stdin, err := session.StdinPipe()
-	if err != nil {
-		return nil, fmt.Errorf("stdin pipe: %w", err)
-	}
-	stdout, err := session.StdoutPipe()
-	if err != nil {
-		return nil, fmt.Errorf("stdout pipe: %w", err)
-	}
-	stderr, err := session.StderrPipe()
-	if err != nil {
-		return nil, fmt.Errorf("stderr pipe: %w", err)
-	}
-
-	if err := session.Shell(); err != nil {
-		return nil, fmt.Errorf("start shell: %w", err)
-	}
-
-	return &PTYSession{Session: session, Stdin: stdin, Stdout: stdout, Stderr: stderr}, nil
-}

client/ui/authsession/service.go

@@ -58,8 +58,7 @@ func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (Exten
 		return ExtendStartResult{}, err
 	}
 
-	// a request from the UI implies a graphical session, which the daemon cannot detect itself
-	req := &proto.RequestExtendAuthSessionRequest{HasGraphicalSession: true}
+	req := &proto.RequestExtendAuthSessionRequest{}
 	if p.Hint != "" {
 		h := p.Hint
 		req.Hint = &h

client/ui/frontend/package.json

@@ -15,8 +15,7 @@
     "lint": "eslint \"src/**/*.{ts,tsx}\"",
     "lint:fix": "eslint \"src/**/*.{ts,tsx}\" --fix",
     "check": "pnpm lint && pnpm typecheck && pnpm format:check",
-    "check:fix": "pnpm lint:fix && pnpm format && pnpm typecheck",
-    "i18n:check": "node ../i18n/check-translations.mjs"
+    "check:fix": "pnpm lint:fix && pnpm format && pnpm typecheck"
   },
   "dependencies": {
     "@radix-ui/react-dialog": "^1.1.15",

client/ui/frontend/src/contexts/NavSectionContext.tsx

@@ -1,6 +1,6 @@
 import { createContext, useContext, useMemo, useState, type ReactNode } from "react";
 
-export type NavSection = "peers" | "networks" | "files";
+export type NavSection = "peers" | "networks";
 
 type NavSectionContextValue = {
     section: NavSection;

client/ui/frontend/src/lib/filedrop.ts

@@ -1,47 +0,0 @@
-export const enum TransferState {
-    Pending = 0,
-    Transferring = 1,
-    Completed = 2,
-    Declined = 3,
-    Expired = 4,
-    Cancelled = 5,
-    Failed = 6,
-}
-
-export const enum ReceiveMode {
-    Off = 0,
-    Ask = 1,
-    Auto = 2,
-}
-
-export const enum PeerRule {
-    Default = 0,
-    Always = 1,
-    Block = 2,
-}
-
-export const enum FailureReason {
-    None = 0,
-    Unreachable = 1,
-}
-
-export const isTerminalState = (state: number): boolean => state >= TransferState.Completed;
-
-export const stateLabelKey = (state: number): string => {
-    switch (state) {
-        case TransferState.Pending:
-            return "files.state.pending";
-        case TransferState.Transferring:
-            return "files.state.transferring";
-        case TransferState.Completed:
-            return "files.state.received";
-        case TransferState.Declined:
-            return "files.state.declined";
-        case TransferState.Expired:
-            return "files.state.expired";
-        case TransferState.Cancelled:
-            return "files.state.cancelled";
-        default:
-            return "files.state.failed";
-    }
-};

client/ui/frontend/src/modules/main/MainPage.tsx

@@ -11,7 +11,6 @@ import { NotConnectedState } from "@/components/empty-state/NotConnectedState";
 import { useStatus } from "@/contexts/StatusContext";
 import { Peers } from "@/modules/main/advanced/peers/Peers";
 import { Networks } from "@/modules/main/advanced/networks/Networks";
-import { Files } from "@/modules/main/advanced/files/Files";
 import { NetworksProvider } from "@/contexts/NetworksContext";
 import { PeerDetailProvider, usePeerDetail } from "@/contexts/PeerDetailContext";
 import { useRestrictions } from "@/contexts/RestrictionsContext";
@@ -45,10 +44,7 @@ const MainBody = () => {
     const isAdvanced = viewMode === "advanced";
 
     return (
-        // min-w-0 matters here: without it this flex parent keeps its automatic
-        // minimum width, and a long file name in the right panel pushes the
-        // layout wider than the window, which cannot be resized.
-        <main className={"wails-draggable flex min-h-0 min-w-0 flex-1"}>
+        <main className={"wails-draggable flex min-h-0 flex-1"}>
             {/* Windows narrower width compensates for the OS frame Wails counts differently than macOS.
                 See https://github.com/wailsapp/wails/issues/3260 */}
             <div
@@ -102,14 +98,10 @@ const AdvancedAppRightPanel = () => {
                     role={"tabpanel"}
                     id={`nb-tabpanel-${section}`}
                     aria-labelledby={`nb-tab-${section}`}
-                    // min-w-0: this is the section's direct parent, so without
-                    // it a long file name sets the floor for the whole panel
-                    // and the row overflows instead of truncating.
-                    className={"flex min-h-0 min-w-0 flex-1 flex-col"}
+                    className={"flex min-h-0 flex-1 flex-col"}
                 >
                     {section === "peers" && <Peers />}
                     {section === "networks" && <Networks />}
-                    {section === "files" && <Files />}
                 </div>
             </div>
             {!isConnected && (

client/ui/frontend/src/modules/main/advanced/Navigation.tsx

@@ -1,6 +1,6 @@
 import { type ComponentType, type KeyboardEvent, useEffect, useRef } from "react";
 import { useTranslation } from "react-i18next";
-import { FolderDownIcon, Layers3Icon, type LucideProps, MonitorSmartphoneIcon } from "lucide-react";
+import { Layers3Icon, type LucideProps, MonitorSmartphoneIcon } from "lucide-react";
 import { cn } from "@/lib/cn";
 import { useNavSection, type NavSection } from "@/contexts/NavSectionContext";
 import { useStatus } from "@/contexts/StatusContext";
@@ -40,11 +40,6 @@ export const Navigation = () => {
             icon: Layers3Icon,
         });
     }
-    tabs.push({
-        value: "files",
-        label: t("nav.files.title"),
-        icon: FolderDownIcon,
-    });
 
     const tabRefs = useRef<Record<string, HTMLButtonElement | null>>({});
 
@@ -108,7 +103,7 @@ export const Navigation = () => {
                         onKeyDown={handleKeyDown}
                         disabled={isDisabled}
                         className={cn(
-                            "group relative flex min-w-0 flex-1 items-center justify-center",
+                            "group relative flex flex-1 items-center justify-center",
                             "gap-2.5 px-5 py-3.5",
                             "outline-none transition-all",
                             isFirst && "rounded-tl-xl",
@@ -118,8 +113,8 @@ export const Navigation = () => {
                             isDisabled ? "cursor-not-allowed opacity-50" : "cursor-default",
                         )}
                     >
-                        <Icon size={14} className={"shrink-0"} aria-hidden={"true"} />
-                        <span className={"truncate text-sm font-normal"}>{tab.label}</span>
+                        <Icon size={14} aria-hidden={"true"} />
+                        <span className={"text-sm font-normal"}>{tab.label}</span>
                         <span
                             aria-hidden={"true"}
                             className={cn(

client/ui/frontend/src/modules/main/advanced/files/Files.tsx

@@ -1,494 +0,0 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { useTranslation } from "react-i18next";
-import { Events } from "@wailsio/runtime";
-import * as ScrollArea from "@radix-ui/react-scroll-area";
-import {
-    ArrowDownIcon,
-    ArrowUpIcon,
-    BanIcon,
-    CheckIcon,
-    CopyIcon,
-    FolderDownIcon,
-    FolderOpenIcon,
-    MoreVerticalIcon,
-    ShieldCheckIcon,
-    Trash2Icon,
-    XIcon,
-} from "lucide-react";
-import { FileDrop } from "@bindings/services";
-import type { FileDropTransfer } from "@bindings/services/models.js";
-import { cn } from "@/lib/cn";
-import { formatBytes } from "@/lib/formatters";
-import {
-    FailureReason,
-    isTerminalState,
-    PeerRule,
-    stateLabelKey,
-    TransferState,
-} from "@/lib/filedrop";
-import { SearchInput } from "@/components/inputs/SearchInput";
-import { EmptyState } from "@/components/empty-state/EmptyState";
-import { NoResults } from "@/components/empty-state/NoResults";
-import { Button } from "@/components/buttons/Button";
-import { Tooltip } from "@/components/Tooltip";
-import {
-    DropdownMenu,
-    DropdownMenuContent,
-    DropdownMenuItem,
-    DropdownMenuTrigger,
-} from "@/components/DropdownMenu";
-
-const EVENT_FILEDROP = "netbird:filedrop";
-const POLL_MS = 1000;
-
-const transferTitle = (transfer: FileDropTransfer): string => {
-    const files = transfer.files ?? [];
-    if (files.length === 1 && files[0].isText) {
-        return `“${files[0].text}”`;
-    }
-    return files.map((f) => f.name).join(", ");
-};
-
-const isTextTransfer = (transfer: FileDropTransfer): boolean =>
-    (transfer.files ?? []).length === 1 && transfer.files[0].isText;
-
-const timeLabel = (iso: string): string => {
-    const d = new Date(iso);
-    if (Number.isNaN(d.getTime())) return "";
-    return d.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" });
-};
-
-// Colours only what the eye should catch scanning the outcome column: a refusal
-// or failure in red, a completed send in green. Everything else, a received file
-// included, stays neutral so the exceptions stand out.
-const outcomeClass = (transfer: FileDropTransfer, inProgress: boolean): string => {
-    if (inProgress) return "text-nb-gray-500";
-    switch (transfer.state) {
-        case TransferState.Declined:
-        case TransferState.Failed:
-            return "text-red-400";
-        case TransferState.Completed:
-            return transfer.outgoing ? "text-green-400" : "text-nb-gray-500";
-        default:
-            return "text-nb-gray-500";
-    }
-};
-
-export const Files = () => {
-    const { t } = useTranslation();
-    const [transfers, setTransfers] = useState<FileDropTransfer[] | null>(null);
-    const [search, setSearch] = useState("");
-    const searchRef = useRef<HTMLInputElement>(null);
-
-    const refresh = useCallback(async () => {
-        try {
-            setTransfers(await FileDrop.List());
-        } catch {
-            setTransfers((prev) => prev ?? []);
-        }
-    }, []);
-
-    useEffect(() => {
-        searchRef.current?.focus();
-        void refresh();
-        const id = setInterval(() => void refresh(), POLL_MS);
-        const off = Events.On(EVENT_FILEDROP, () => void refresh());
-        return () => {
-            clearInterval(id);
-            off();
-        };
-    }, [refresh]);
-
-    const filtered = useMemo(() => {
-        const all = transfers ?? [];
-        const q = search.trim().toLowerCase();
-        if (!q) return all;
-        return all.filter(
-            (tr) =>
-                transferTitle(tr).toLowerCase().includes(q) ||
-                tr.peerName.toLowerCase().includes(q),
-        );
-    }, [transfers, search]);
-
-    const pending = filtered.filter((tr) => !tr.outgoing && tr.state === TransferState.Pending);
-    const rest = filtered.filter((tr) => tr.outgoing || tr.state !== TransferState.Pending);
-
-    const groups = useMemo(() => {
-        const byDay = new Map<string, FileDropTransfer[]>();
-        for (const tr of rest) {
-            const d = new Date(tr.createdAt as unknown as string);
-            const key = Number.isNaN(d.getTime()) ? "" : d.toDateString();
-            const list = byDay.get(key) ?? [];
-            list.push(tr);
-            byDay.set(key, list);
-        }
-        const today = new Date().toDateString();
-        const yesterday = new Date(Date.now() - 86400000).toDateString();
-        return Array.from(byDay.entries()).map(([key, list]) => {
-            let label = key;
-            if (key === today) label = t("files.group.today");
-            else if (key === yesterday) label = t("files.group.yesterday");
-            else if (key) label = new Date(key).toLocaleDateString();
-            return { label, list };
-        });
-    }, [rest, t]);
-
-    if (transfers !== null && transfers.length === 0) {
-        return (
-            <EmptyState
-                icon={FolderDownIcon}
-                title={t("files.empty.title")}
-                description={t("files.empty.description")}
-            />
-        );
-    }
-
-    return (
-        <div className={"flex h-full min-h-0 w-full flex-col"}>
-            <div className={"flex items-center gap-2 border-b border-nb-gray-910 px-6 py-2.5"}>
-                <div className={"min-w-0 flex-1"}>
-                    <SearchInput
-                        ref={searchRef}
-                        placeholder={t("files.search.placeholder")}
-                        value={search}
-                        onChange={(e) => setSearch(e.target.value)}
-                    />
-                </div>
-            </div>
-            {filtered.length === 0 ? (
-                <NoResults />
-            ) : (
-                <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
-                    <ScrollArea.Viewport className={"h-full w-full"}>
-                        <div className={"flex flex-col pb-4 pt-2"}>
-                            {pending.map((tr) => (
-                                <PendingOfferRow key={tr.id} transfer={tr} onChanged={refresh} />
-                            ))}
-                            {groups.map((group) => (
-                                <div key={group.label} className={"flex flex-col"}>
-                                    <div
-                                        className={
-                                            "px-6 pb-1 pt-4 text-xs font-semibold uppercase tracking-wider text-nb-gray-500"
-                                        }
-                                    >
-                                        {group.label}
-                                    </div>
-                                    {group.list.map((tr) => (
-                                        <TransferRow
-                                            key={tr.id}
-                                            transfer={tr}
-                                            onChanged={refresh}
-                                        />
-                                    ))}
-                                </div>
-                            ))}
-                        </div>
-                    </ScrollArea.Viewport>
-                    <ScrollArea.Scrollbar
-                        orientation={"vertical"}
-                        className={"flex w-1.5 touch-none select-none bg-transparent py-1"}
-                    >
-                        <ScrollArea.Thumb
-                            className={
-                                "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
-                            }
-                        />
-                    </ScrollArea.Scrollbar>
-                </ScrollArea.Root>
-            )}
-        </div>
-    );
-};
-
-type RowProps = {
-    transfer: FileDropTransfer;
-    onChanged: () => void;
-};
-
-const PendingOfferRow = ({ transfer, onChanged }: RowProps) => {
-    const { t } = useTranslation();
-    const [busy, setBusy] = useState(false);
-
-    const decide = async (accept: boolean) => {
-        if (busy) return;
-        setBusy(true);
-        try {
-            await FileDrop.Decide(transfer.id, accept);
-        } finally {
-            setBusy(false);
-            onChanged();
-        }
-    };
-
-    return (
-        // The panel is a fixed ~500px wide, so the buttons sit under the text
-        // rather than beside it: side by side they would squeeze the file name
-        // down to a few characters.
-        <div
-            className={cn(
-                "mx-4 mt-2 flex flex-col gap-2.5 rounded-lg border border-netbird/30",
-                "bg-netbird/5 px-4 py-3",
-                "wails-no-draggable",
-            )}
-        >
-            <div className={"flex min-w-0 items-center gap-2.5"}>
-                <ArrowDownIcon
-                    size={16}
-                    className={"shrink-0 text-netbird"}
-                    aria-hidden={"true"}
-                />
-                <div className={"flex min-w-0 flex-1 flex-col leading-tight"}>
-                    <span className={"truncate text-[0.81rem] font-medium text-nb-gray-100"}>
-                        {transferTitle(transfer)}
-                        <span className={"font-normal text-nb-gray-400"}>
-                            {" · "}
-                            {formatBytes(transfer.totalSize)}
-                        </span>
-                    </span>
-                    <span className={"truncate text-xs text-nb-gray-400"}>
-                        {t("files.offer.subtitle", { peer: transfer.peerName })}
-                    </span>
-                </div>
-            </div>
-            <div className={"flex items-center gap-2 pl-[26px]"}>
-                <Button
-                    variant={"primary"}
-                    size={"xs"}
-                    disabled={busy}
-                    onClick={() => void decide(true)}
-                >
-                    {t("files.offer.accept")}
-                </Button>
-                <Button
-                    variant={"secondary"}
-                    size={"xs"}
-                    disabled={busy}
-                    onClick={() => void decide(false)}
-                >
-                    {t("files.offer.decline")}
-                </Button>
-            </div>
-        </div>
-    );
-};
-
-const TransferRow = ({ transfer, onChanged }: RowProps) => {
-    const { t } = useTranslation();
-    const [copied, setCopied] = useState(false);
-    const isText = isTextTransfer(transfer);
-    const live = !isTerminalState(transfer.state);
-    const delivered =
-        !transfer.outgoing &&
-        transfer.state === TransferState.Completed &&
-        (transfer.deliveredPaths ?? []).length > 0;
-    const progress =
-        transfer.state === TransferState.Transferring && transfer.totalSize > 0
-            ? Math.min(100, Math.floor((transfer.transferred / transfer.totalSize) * 100))
-            : null;
-
-    // The subtitle carries who and how big; the outcome sits on the right next
-    // to the time, so a glance down that column reads the results.
-    const subtitleParts = [
-        transfer.outgoing
-            ? t("files.row.to", { peer: transfer.peerName })
-            : t("files.row.from", { peer: transfer.peerName }),
-    ];
-    if (!isText) subtitleParts.push(formatBytes(transfer.totalSize));
-
-    let stateLabel: string;
-    if (progress !== null) {
-        stateLabel = t("files.state.progress", { percent: progress });
-    } else if (transfer.state === TransferState.Completed) {
-        stateLabel = t(transfer.outgoing ? "files.state.sent" : "files.state.received");
-    } else if (
-        transfer.state === TransferState.Failed &&
-        transfer.reason === FailureReason.Unreachable
-    ) {
-        stateLabel = t("files.state.unreachable");
-    } else {
-        stateLabel = t(stateLabelKey(transfer.state));
-    }
-
-    const stateClass = outcomeClass(transfer, progress !== null);
-    const time = timeLabel(transfer.createdAt as unknown as string);
-
-    const copyText = async () => {
-        await navigator.clipboard.writeText(transfer.files[0]?.text ?? "");
-        setCopied(true);
-        setTimeout(() => setCopied(false), 1500);
-    };
-
-    return (
-        <div
-            className={cn(
-                "group relative flex items-center gap-2.5 py-2.5 pl-6 pr-4",
-                "transition-colors hover:bg-nb-gray-900/40",
-                "wails-no-draggable",
-            )}
-        >
-            {transfer.outgoing ? (
-                <ArrowUpIcon size={15} className={"shrink-0 text-netbird"} aria-hidden={"true"} />
-            ) : (
-                <ArrowDownIcon
-                    size={15}
-                    className={"shrink-0 text-green-400"}
-                    aria-hidden={"true"}
-                />
-            )}
-            <div className={"flex min-w-0 flex-1 flex-col leading-tight"}>
-                <span
-                    className={cn(
-                        "truncate text-[0.81rem] font-medium text-nb-gray-100",
-                        isText && "italic",
-                    )}
-                >
-                    {transferTitle(transfer)}
-                </span>
-                <span className={"truncate text-xs text-nb-gray-400"}>
-                    {subtitleParts.join(" · ")}
-                </span>
-            </div>
-            {/* Time over outcome, capped: the window is a fixed 900px and some
-                translations of the state labels are long enough to eat the file
-                name if they share one line with the timestamp. */}
-            <span
-                className={cn(
-                    "flex max-w-[8.5rem] shrink-0 flex-col items-end leading-tight",
-                    "pl-2 text-xs text-nb-gray-500",
-                    "transition-opacity group-hover:opacity-0",
-                )}
-            >
-                <span className={"tabular-nums"}>{time}</span>
-                <span className={cn("max-w-full truncate", stateClass)}>{stateLabel}</span>
-            </span>
-            {/* The window is a fixed 900px wide and cannot be resized, so the
-                row actions overlay the outcome column on hover instead of
-                reserving width that the file name would otherwise lose. */}
-            <div
-                className={cn(
-                    "absolute right-4 flex items-center gap-1",
-                    // Fades the covered outcome text out rather than sitting on
-                    // a flat block, which would not match the row's hover tint.
-                    "bg-gradient-to-l from-nb-gray-940 via-nb-gray-940 to-transparent pl-8",
-                    "opacity-0 transition-opacity focus-within:opacity-100 group-hover:opacity-100",
-                )}
-            >
-                {isText && (
-                    <RowIconButton label={t("files.action.copy")} onClick={() => void copyText()}>
-                        {copied ? (
-                            <CheckIcon size={14} className={"text-green-400"} />
-                        ) : (
-                            <CopyIcon size={14} />
-                        )}
-                    </RowIconButton>
-                )}
-                {delivered && (
-                    <RowIconButton
-                        label={t("files.action.reveal")}
-                        onClick={() => void FileDrop.Reveal(transfer.deliveredPaths[0])}
-                    >
-                        <FolderOpenIcon size={14} />
-                    </RowIconButton>
-                )}
-                {live && (
-                    <RowIconButton
-                        label={t("files.action.cancel")}
-                        onClick={async () => {
-                            await FileDrop.Cancel(transfer.id);
-                            onChanged();
-                        }}
-                    >
-                        <XIcon size={14} />
-                    </RowIconButton>
-                )}
-                <TransferMenu transfer={transfer} delivered={delivered} onChanged={onChanged} />
-            </div>
-        </div>
-    );
-};
-
-const RowIconButton = ({
-    label,
-    onClick,
-    children,
-}: {
-    label: string;
-    onClick: () => void;
-    children: React.ReactNode;
-}) => (
-    <Tooltip content={label}>
-        <button
-            type={"button"}
-            aria-label={label}
-            onClick={onClick}
-            className={cn(
-                "flex h-7 w-7 items-center justify-center rounded-md",
-                "text-nb-gray-300 hover:bg-nb-gray-900 hover:text-nb-gray-100",
-                "cursor-default outline-none transition-colors",
-                "focus-visible:ring-2 focus-visible:ring-white/60",
-            )}
-        >
-            {children}
-        </button>
-    </Tooltip>
-);
-
-const TransferMenu = ({ transfer, delivered, onChanged }: RowProps & { delivered: boolean }) => {
-    const { t } = useTranslation();
-
-    const setRule = async (rule: PeerRule) => {
-        await FileDrop.SetPeerRule(transfer.peerKey, rule);
-        onChanged();
-    };
-
-    return (
-        <DropdownMenu>
-            <DropdownMenuTrigger asChild>
-                <button
-                    type={"button"}
-                    aria-label={t("files.action.more")}
-                    className={cn(
-                        "flex h-7 w-7 items-center justify-center rounded-md",
-                        "text-nb-gray-300 hover:bg-nb-gray-900 hover:text-nb-gray-100",
-                        "cursor-default outline-none transition-colors",
-                        "focus-visible:ring-2 focus-visible:ring-white/60",
-                    )}
-                >
-                    <MoreVerticalIcon size={14} />
-                </button>
-            </DropdownMenuTrigger>
-            <DropdownMenuContent align={"end"}>
-                {delivered && (
-                    <DropdownMenuItem
-                        onClick={() => void FileDrop.Open(transfer.deliveredPaths[0])}
-                    >
-                        <FolderOpenIcon size={14} className={"mr-2"} />
-                        {t("files.action.open")}
-                    </DropdownMenuItem>
-                )}
-                {!transfer.outgoing && (
-                    <>
-                        <DropdownMenuItem onClick={() => void setRule(PeerRule.Always)}>
-                            <ShieldCheckIcon size={14} className={"mr-2"} />
-                            {t("files.action.alwaysAccept")}
-                        </DropdownMenuItem>
-                        <DropdownMenuItem onClick={() => void setRule(PeerRule.Block)}>
-                            <BanIcon size={14} className={"mr-2"} />
-                            {t("files.action.block")}
-                        </DropdownMenuItem>
-                    </>
-                )}
-                <DropdownMenuItem
-                    variant={"danger"}
-                    onClick={async () => {
-                        await FileDrop.Delete(transfer.id);
-                        onChanged();
-                    }}
-                >
-                    <Trash2Icon size={14} className={"mr-2"} />
-                    {t("files.action.delete")}
-                </DropdownMenuItem>
-            </DropdownMenuContent>
-        </DropdownMenu>
-    );
-};

client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx

@@ -20,7 +20,6 @@ import {
     Check as CheckIcon,
     ChevronDownIcon,
     ChevronsLeftRightEllipsisIcon,
-    ClipboardIcon,
     ClockIcon,
     Copy as CopyIcon,
     GaugeIcon,
@@ -32,13 +31,9 @@ import {
     MonitorIcon,
     Radio,
     RefreshCwIcon,
-    SendIcon,
     WaypointsIcon,
 } from "lucide-react";
-import { FileDrop } from "@bindings/services";
 import type { PeerStatus } from "@bindings/services/models.js";
-import { Button } from "@/components/buttons/Button";
-import { useNavSection } from "@/contexts/NavSectionContext";
 import { cn } from "@/lib/cn";
 import { CopyToClipboard } from "@/components/CopyToClipboard";
 import { Tooltip } from "@/components/Tooltip";
@@ -255,7 +250,6 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
                     </div>
                     <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
                         <ScrollArea.Viewport className={"h-full w-full"}>
-                            <PeerSendActions peer={selected} />
                             <PeerDetails peer={selected} now={now} />
                         </ScrollArea.Viewport>
                         <ScrollArea.Scrollbar
@@ -278,76 +272,6 @@ export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
     );
 };
 
-const PeerSendActions = ({ peer }: { peer: PeerStatus }) => {
-    const { t } = useTranslation();
-    const { setSection } = useNavSection();
-    const { setSelected } = usePeerDetail();
-    const [error, setError] = useState<string | null>(null);
-    // Deliberately not gated on connStatus: an idle peer is the normal resting
-    // state under lazy connections, and the outgoing packets of the transfer are
-    // exactly what wakes it. Only a peer without an overlay address has nothing
-    // to dial.
-    const canSend = peer.ip !== "";
-
-    const finishSend = () => {
-        setSelected(null);
-        setSection("files");
-    };
-
-    const sendFiles = async () => {
-        setError(null);
-        try {
-            const paths = await FileDrop.PickFiles();
-            if (!paths || paths.length === 0) return;
-            await FileDrop.Send(peer.pubKey, paths, "");
-            finishSend();
-        } catch (e) {
-            setError(String(e));
-        }
-    };
-
-    const sendClipboard = async () => {
-        setError(null);
-        try {
-            const text = await FileDrop.ClipboardText();
-            if (!text) {
-                setError(t("peers.details.sendClipboard.empty"));
-                return;
-            }
-            await FileDrop.Send(peer.pubKey, [], text);
-            finishSend();
-        } catch (e) {
-            setError(String(e));
-        }
-    };
-
-    return (
-        <div className={"border-b border-nb-gray-920 px-5 py-3"}>
-            <div className={"flex items-center gap-2"}>
-                <Button
-                    variant={"secondary"}
-                    size={"xs"}
-                    disabled={!canSend}
-                    onClick={() => void sendFiles()}
-                >
-                    <SendIcon size={12} aria-hidden={"true"} />
-                    {t("peers.details.sendFile")}
-                </Button>
-                <Button
-                    variant={"secondary"}
-                    size={"xs"}
-                    disabled={!canSend}
-                    onClick={() => void sendClipboard()}
-                >
-                    <ClipboardIcon size={12} aria-hidden={"true"} />
-                    {t("peers.details.sendClipboard")}
-                </Button>
-            </div>
-            {error && <div className={"mt-2 text-xs text-red-400"}>{error}</div>}
-        </div>
-    );
-};
-
 const PeerDetails = ({ peer, now }: { peer: PeerStatus; now: number }) => {
     const { t } = useTranslation();
     const formatAge = (unix: number, fallback: string): string => {

client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx

@@ -1,21 +1,9 @@
-import {
-    type DragEvent,
-    type KeyboardEvent,
-    useCallback,
-    useEffect,
-    useMemo,
-    useRef,
-    useState,
-    type ReactNode,
-} from "react";
+import { type KeyboardEvent, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
 import { useTranslation } from "react-i18next";
-import { Events } from "@wailsio/runtime";
 import * as ScrollArea from "@radix-ui/react-scroll-area";
 import { Virtuoso, type VirtuosoHandle } from "react-virtuoso";
-import { ChevronRightIcon, MonitorSmartphoneIcon, SendIcon } from "lucide-react";
-import { FileDrop } from "@bindings/services";
+import { ChevronRightIcon, MonitorSmartphoneIcon } from "lucide-react";
 import type { PeerStatus } from "@bindings/services/models.js";
-import { useNavSection } from "@/contexts/NavSectionContext";
 import { cn } from "@/lib/cn";
 import { reconcileOrder } from "@/lib/sorting";
 import { CopyToClipboard } from "@/components/CopyToClipboard";
@@ -53,36 +41,13 @@ export const peerStatusLabelKey = (connStatus: string): string => {
     }
 };
 
-const EVENT_FILES_DROPPED = "netbird:files:dropped";
-
 export const Peers = () => {
     const { t } = useTranslation();
     const { status } = useStatus();
-    const { setSection } = useNavSection();
     const [search, setSearch] = useState("");
     const [statusFilter, setStatusFilter] = useState<StatusFilter>("all");
     const [scrollParent, setScrollParent] = useState<HTMLDivElement | null>(null);
     const searchRef = useRef<HTMLInputElement>(null);
-    const [dropTarget, setDropTarget] = useState<string | null>(null);
-    const dropTargetRef = useRef<string | null>(null);
-
-    const setDropTargetBoth = useCallback((pubKey: string | null) => {
-        dropTargetRef.current = pubKey;
-        setDropTarget(pubKey);
-    }, []);
-
-    useEffect(() => {
-        const off = Events.On(EVENT_FILES_DROPPED, (ev: { data: string[] | string[][] }) => {
-            const target = dropTargetRef.current;
-            setDropTargetBoth(null);
-            if (!target) return;
-            const raw = ev.data;
-            const paths = (Array.isArray(raw[0]) ? raw[0] : raw) as string[];
-            if (paths.length === 0) return;
-            void FileDrop.Send(target, paths, "").then(() => setSection("files"));
-        });
-        return off;
-    }, [setDropTargetBoth, setSection]);
 
     useEffect(() => {
         searchRef.current?.focus();
@@ -170,26 +135,9 @@ export const Peers = () => {
             {filtered.length === 0 ? (
                 <NoResults />
             ) : (
-                <ScrollArea.Root
-                    type={"auto"}
-                    className={"min-h-0 flex-1 overflow-hidden"}
-                    onDragLeave={(e: DragEvent) => {
-                        if (!e.currentTarget.contains(e.relatedTarget as Node | null)) {
-                            setDropTargetBoth(null);
-                        }
-                    }}
-                    onDragOver={(e: DragEvent) => e.preventDefault()}
-                    onDrop={(e: DragEvent) => e.preventDefault()}
-                >
+                <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
                     <ScrollArea.Viewport ref={setScrollParent} className={"h-full w-full"}>
-                        {scrollParent && (
-                            <PeersList
-                                data={filtered}
-                                scrollParent={scrollParent}
-                                dropTarget={dropTarget}
-                                onDropTarget={setDropTargetBoth}
-                            />
-                        )}
+                        {scrollParent && <PeersList data={filtered} scrollParent={scrollParent} />}
                     </ScrollArea.Viewport>
                     <ScrollArea.Scrollbar
                         orientation={"vertical"}
@@ -215,11 +163,9 @@ const ListTopSpacer = () => <div className={"h-2"} />;
 type PeersListProps = {
     data: PeerStatus[];
     scrollParent: HTMLElement;
-    dropTarget: string | null;
-    onDropTarget: (pubKey: string | null) => void;
 };
 
-const PeersList = ({ data, scrollParent, dropTarget, onDropTarget }: PeersListProps) => {
+const PeersList = ({ data, scrollParent }: PeersListProps) => {
     const { setSelected } = usePeerDetail();
     const virtuosoRef = useRef<VirtuosoHandle>(null);
     const rowRefs = useRef<Map<string, HTMLButtonElement>>(new Map());
@@ -275,15 +221,9 @@ const PeersList = ({ data, scrollParent, dropTarget, onDropTarget }: PeersListPr
     };
 
     const ctx = useMemo<PeerRowContext>(
-        () => ({
-            onKeyDown: handleRowKeyDown,
-            onSelect: setSelected,
-            setRowRef,
-            dropTarget,
-            onDropTarget,
-        }),
+        () => ({ onKeyDown: handleRowKeyDown, onSelect: setSelected, setRowRef }),
         // eslint-disable-next-line react-hooks/exhaustive-deps
-        [data, setSelected, dropTarget, onDropTarget],
+        [data, setSelected],
     );
 
     return (
@@ -304,8 +244,6 @@ type PeerRowContext = {
     onKeyDown: (e: KeyboardEvent<Element>, index: number) => void;
     onSelect: (peer: PeerStatus) => void;
     setRowRef: (pubKey: string, el: HTMLButtonElement | null) => void;
-    dropTarget: string | null;
-    onDropTarget: (pubKey: string | null) => void;
 };
 
 const renderPeerRow = (index: number, peer: PeerStatus, ctx: PeerRowContext): ReactNode => (
@@ -315,8 +253,6 @@ const renderPeerRow = (index: number, peer: PeerStatus, ctx: PeerRowContext): Re
         onKeyDown={ctx.onKeyDown}
         onSelect={ctx.onSelect}
         setRowRef={ctx.setRowRef}
-        isDropTarget={ctx.dropTarget === peer.pubKey}
-        onDropTarget={ctx.onDropTarget}
     />
 );
 
@@ -326,19 +262,9 @@ type PeerRowProps = {
     onKeyDown: (e: KeyboardEvent<Element>, index: number) => void;
     onSelect: (peer: PeerStatus) => void;
     setRowRef: (pubKey: string, el: HTMLButtonElement | null) => void;
-    isDropTarget: boolean;
-    onDropTarget: (pubKey: string | null) => void;
 };
 
-const PeerRow = ({
-    peer,
-    index,
-    onKeyDown,
-    onSelect,
-    setRowRef,
-    isDropTarget,
-    onDropTarget,
-}: PeerRowProps) => {
+const PeerRow = ({ peer, index, onKeyDown, onSelect, setRowRef }: PeerRowProps) => {
     const { t } = useTranslation();
     const isConnected = peer.connStatus === "Connected";
     const peerName = shortenDns(peer.fqdn) || peer.ip;
@@ -346,29 +272,12 @@ const PeerRow = ({
     const handleKey = (e: KeyboardEvent<Element>) => onKeyDown(e, index);
     return (
         <div
-            onDragOver={(e: DragEvent) => {
-                if (!isConnected) return;
-                e.preventDefault();
-                onDropTarget(peer.pubKey);
-            }}
             className={cn(
                 "group relative flex min-w-0 items-start gap-2.5 py-3 pl-6 pr-4",
                 "transition-colors hover:bg-nb-gray-900/40",
                 "wails-no-draggable",
             )}
         >
-            {isDropTarget && (
-                <div
-                    className={cn(
-                        "pointer-events-none absolute inset-x-2 inset-y-0.5 z-10",
-                        "flex items-center justify-center gap-2 rounded-lg",
-                        "border border-netbird bg-nb-gray-940/90 text-netbird",
-                    )}
-                >
-                    <SendIcon size={14} aria-hidden={"true"} />
-                    <span className={"text-sm"}>{t("peers.dropToSend")}</span>
-                </div>
-            )}
             <button
                 type={"button"}
                 tabIndex={0}

client/ui/frontend/src/modules/settings/SettingsFileSharing.tsx

@@ -1,222 +0,0 @@
-import { useCallback, useEffect, useState } from "react";
-import { useTranslation } from "react-i18next";
-import { BanIcon, CheckIcon, XIcon } from "lucide-react";
-import { FileDrop } from "@bindings/services";
-import { FileDropSettings } from "@bindings/services/models.js";
-import { cn } from "@/lib/cn";
-import { PeerRule, ReceiveMode } from "@/lib/filedrop";
-import { shortenDns } from "@/lib/formatters";
-import { Button } from "@/components/buttons/Button";
-import { HelpText } from "@/components/typography/HelpText";
-import { Label } from "@/components/typography/Label";
-import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
-import { useStatus } from "@/contexts/StatusContext";
-
-const MODES: { value: ReceiveMode; labelKey: string; helpKey: string }[] = [
-    {
-        value: ReceiveMode.Off,
-        labelKey: "settings.fileSharing.mode.off",
-        helpKey: "settings.fileSharing.mode.off.help",
-    },
-    {
-        value: ReceiveMode.Ask,
-        labelKey: "settings.fileSharing.mode.ask",
-        helpKey: "settings.fileSharing.mode.ask.help",
-    },
-    {
-        value: ReceiveMode.Auto,
-        labelKey: "settings.fileSharing.mode.auto",
-        helpKey: "settings.fileSharing.mode.auto.help",
-    },
-];
-
-export function SettingsFileSharing() {
-    const { t } = useTranslation();
-    const { status } = useStatus();
-    const [settings, setSettings] = useState<FileDropSettings | null>(null);
-    const [error, setError] = useState<string | null>(null);
-
-    useEffect(() => {
-        FileDrop.GetSettings()
-            .then(setSettings)
-            .catch((e: unknown) => setError(String(e)));
-    }, []);
-
-    const apply = useCallback(
-        async (next: FileDropSettings) => {
-            const prev = settings;
-            setSettings(next);
-            try {
-                await FileDrop.SetSettings(next);
-                setError(null);
-            } catch (e) {
-                setSettings(prev);
-                setError(String(e));
-            }
-        },
-        [settings],
-    );
-
-    const changeDirectory = async () => {
-        if (!settings) return;
-        const dir = await FileDrop.PickDirectory();
-        if (!dir) return;
-        await apply(new FileDropSettings({ ...settings, destinationDir: dir }));
-    };
-
-    const removeRule = async (peerKey: string) => {
-        if (!settings) return;
-        try {
-            await FileDrop.SetPeerRule(peerKey, PeerRule.Default);
-            setSettings(await FileDrop.GetSettings());
-        } catch (e) {
-            setError(String(e));
-        }
-    };
-
-    const peerName = (key: string): string => {
-        const peer = (status?.peers ?? []).find((p) => p.pubKey === key);
-        return peer ? shortenDns(peer.fqdn) || peer.ip : key.slice(0, 12) + "…";
-    };
-
-    if (!settings) {
-        return (
-            <SectionGroup title={t("settings.fileSharing.section")}>
-                <HelpText>{error ?? t("settings.fileSharing.loading")}</HelpText>
-            </SectionGroup>
-        );
-    }
-
-    const rules = Object.entries(settings.peerRules ?? {});
-
-    return (
-        <SectionGroup title={t("settings.fileSharing.section")}>
-            {error && <HelpText className={"text-red-400"}>{error}</HelpText>}
-            <div>
-                <Label>{t("settings.fileSharing.mode.label")}</Label>
-                <HelpText>{t("settings.fileSharing.mode.help")}</HelpText>
-                <div
-                    role={"radiogroup"}
-                    aria-label={t("settings.fileSharing.mode.label")}
-                    className={"mt-2 flex flex-col gap-1.5"}
-                >
-                    {MODES.map((mode) => {
-                        const active = settings.mode === mode.value;
-                        return (
-                            <button
-                                key={mode.value}
-                                type={"button"}
-                                role={"radio"}
-                                aria-checked={active}
-                                onClick={() =>
-                                    void apply(
-                                        new FileDropSettings({ ...settings, mode: mode.value }),
-                                    )
-                                }
-                                className={cn(
-                                    "flex items-center gap-3 rounded-lg border px-4 py-3 text-left",
-                                    "cursor-default outline-none transition-colors",
-                                    "focus-visible:ring-2 focus-visible:ring-white/60",
-                                    active
-                                        ? "border-netbird/60 bg-netbird/5"
-                                        : "border-nb-gray-900 hover:border-nb-gray-800",
-                                )}
-                            >
-                                <span
-                                    aria-hidden={"true"}
-                                    className={cn(
-                                        "flex h-4 w-4 shrink-0 items-center justify-center rounded-full border",
-                                        active ? "border-netbird bg-netbird" : "border-nb-gray-600",
-                                    )}
-                                >
-                                    {active && <CheckIcon size={11} className={"text-white"} />}
-                                </span>
-                                <span className={"flex flex-col leading-tight"}>
-                                    <span className={"text-sm text-nb-gray-100"}>
-                                        {t(mode.labelKey)}
-                                    </span>
-                                    <span className={"text-xs text-nb-gray-400"}>
-                                        {t(mode.helpKey)}
-                                    </span>
-                                </span>
-                            </button>
-                        );
-                    })}
-                </div>
-            </div>
-            <div>
-                <Label>{t("settings.fileSharing.destination.label")}</Label>
-                <HelpText>{t("settings.fileSharing.destination.help")}</HelpText>
-                <div className={"mt-2 flex items-center gap-3"}>
-                    <span
-                        className={cn(
-                            "min-w-0 flex-1 truncate rounded-md border border-nb-gray-900",
-                            "px-3 py-2 font-mono text-xs text-nb-gray-300",
-                        )}
-                    >
-                        {settings.destinationDir || t("settings.fileSharing.destination.unset")}
-                    </span>
-                    <Button
-                        variant={"secondary"}
-                        size={"xs"}
-                        onClick={() => void changeDirectory()}
-                    >
-                        {t("settings.fileSharing.destination.change")}
-                    </Button>
-                </div>
-            </div>
-            <div>
-                <Label>{t("settings.fileSharing.exceptions.label")}</Label>
-                <HelpText>{t("settings.fileSharing.exceptions.help")}</HelpText>
-                {rules.length === 0 ? (
-                    <HelpText className={"mt-2"}>
-                        {t("settings.fileSharing.exceptions.empty")}
-                    </HelpText>
-                ) : (
-                    <ul className={"mt-2 flex flex-col divide-y divide-nb-gray-920"}>
-                        {rules.map(([key, rule]) => (
-                            <li key={key} className={"flex items-center gap-3 py-2"}>
-                                {rule === PeerRule.Block ? (
-                                    <BanIcon
-                                        size={14}
-                                        className={"shrink-0 text-red-400"}
-                                        aria-hidden={"true"}
-                                    />
-                                ) : (
-                                    <CheckIcon
-                                        size={14}
-                                        className={"shrink-0 text-green-400"}
-                                        aria-hidden={"true"}
-                                    />
-                                )}
-                                <span
-                                    className={"min-w-0 flex-1 truncate text-sm text-nb-gray-100"}
-                                >
-                                    {peerName(key)}
-                                </span>
-                                <span className={"shrink-0 text-xs text-nb-gray-400"}>
-                                    {rule === PeerRule.Block
-                                        ? t("settings.fileSharing.exceptions.blocked")
-                                        : t("settings.fileSharing.exceptions.always")}
-                                </span>
-                                <button
-                                    type={"button"}
-                                    aria-label={t("settings.fileSharing.exceptions.remove")}
-                                    onClick={() => void removeRule(key)}
-                                    className={cn(
-                                        "flex h-6 w-6 shrink-0 items-center justify-center rounded-md",
-                                        "text-nb-gray-400 hover:bg-nb-gray-900 hover:text-nb-gray-100",
-                                        "cursor-default outline-none transition-colors",
-                                        "focus-visible:ring-2 focus-visible:ring-white/60",
-                                    )}
-                                >
-                                    <XIcon size={13} />
-                                </button>
-                            </li>
-                        ))}
-                    </ul>
-                )}
-            </div>
-        </SectionGroup>
-    );
-}

client/ui/frontend/src/modules/settings/SettingsNavigation.tsx

@@ -6,7 +6,6 @@ import { useClientVersion } from "@/contexts/ClientVersionContext.tsx";
 import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
 import {
     BoltIcon,
-    FolderDownIcon,
     InfoIcon,
     LifeBuoyIcon,
     NetworkIcon,
@@ -50,11 +49,6 @@ export const SettingsNavigation = () => {
                         />
                     </>
                 )}
-                <VerticalTabs.Trigger
-                    value={"fileSharing"}
-                    icon={FolderDownIcon}
-                    title={t("settings.tabs.fileSharing")}
-                />
                 {!features.disableProfiles && (
                     <VerticalTabs.Trigger
                         value={"profiles"}

client/ui/frontend/src/modules/settings/SettingsPage.tsx

@@ -12,7 +12,6 @@ import { SettingsGeneral } from "@/modules/settings/SettingsGeneral.tsx";
 import { SettingsNetwork } from "@/modules/settings/SettingsNetwork.tsx";
 import { SettingsSecurity } from "@/modules/settings/SettingsSecurity.tsx";
 import { ProfilesTab } from "@/modules/profiles/ProfilesTab.tsx";
-import { SettingsFileSharing } from "@/modules/settings/SettingsFileSharing.tsx";
 import { SettingsSSH } from "@/modules/settings/SettingsSSH.tsx";
 import { SettingsAdvanced } from "@/modules/settings/SettingsAdvanced.tsx";
 import { SettingsTroubleshooting } from "@/modules/settings/SettingsTroubleshooting.tsx";
@@ -25,7 +24,6 @@ const enum Tab {
     General = "general",
     Network = "network",
     Security = "security",
-    FileSharing = "fileSharing",
     Profiles = "profiles",
     SSH = "ssh",
     Advanced = "advanced",
@@ -37,7 +35,6 @@ const TAB_CONTENT: Record<Tab, ReactNode> = {
     [Tab.General]: <SettingsGeneral />,
     [Tab.Network]: <SettingsNetwork />,
     [Tab.Security]: <SettingsSecurity />,
-    [Tab.FileSharing]: <SettingsFileSharing />,
     [Tab.Profiles]: <ProfilesTab />,
     [Tab.SSH]: <SettingsSSH />,
     [Tab.Advanced]: <SettingsAdvanced />,
@@ -56,7 +53,6 @@ export const SettingsPage = () => {
             [Tab.General]: true,
             [Tab.Network]: editable,
             [Tab.Security]: editable,
-            [Tab.FileSharing]: true,
             [Tab.Profiles]: !features.disableProfiles,
             [Tab.SSH]: mdm.allowServerSSH ?? editable,
             [Tab.Advanced]: editable,

client/ui/i18n/check-translations.mjs

@@ -1,104 +0,0 @@
-#!/usr/bin/env node
-// Validates that every shipped translation bundle carries exactly the same set
-// of keys as the English source of truth. English (en) defines the keys; every
-// other locale declared in _index.json must match it 1:1:
-//
-//   - no missing keys — a missing key silently falls back to English at runtime
-//     (see i18n bundle fallback), so the gap never surfaces to users or CI
-//     without this check;
-//   - no orphaned keys — keys left behind after an English key is renamed or
-//     removed are dead weight and a sign the locale is drifting.
-//
-// Pure Node, no dependencies, so it runs without installing the frontend
-// toolchain.
-//
-//   Local:  node client/ui/i18n/check-translations.mjs   (or: pnpm i18n:check)
-//   CI:     .github/workflows/ui-translations.yml
-
-import { readdirSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const SOURCE = "en";
-const localesDir = join(dirname(fileURLToPath(import.meta.url)), "locales");
-const isCI = Boolean(process.env.GITHUB_ACTIONS);
-
-function readJSON(path) {
-    return JSON.parse(readFileSync(path, "utf8"));
-}
-
-function keysOf(langCode) {
-    return Object.keys(readJSON(join(localesDir, langCode, "common.json")));
-}
-
-// Emit a GitHub Actions annotation so failures render inline on the PR diff.
-function annotate(file, message) {
-    if (isCI) console.log(`::error file=${file}::${message}`);
-}
-
-const index = readJSON(join(localesDir, "_index.json"));
-const declared = index.languages.map((l) => l.code);
-
-if (!declared.includes(SOURCE)) {
-    console.error(`FATAL: source language "${SOURCE}" is not declared in _index.json`);
-    process.exit(1);
-}
-
-const sourceKeys = keysOf(SOURCE);
-const sourceSet = new Set(sourceKeys);
-console.log(`Source of truth: ${SOURCE}/common.json — ${sourceKeys.length} keys\n`);
-
-let failed = false;
-
-for (const code of declared) {
-    if (code === SOURCE) continue;
-    const file = `client/ui/i18n/locales/${code}/common.json`;
-
-    let keys;
-    try {
-        keys = keysOf(code);
-    } catch (e) {
-        failed = true;
-        const msg = `bundle is declared in _index.json but common.json is missing or invalid (${e.message})`;
-        console.error(`✗ ${code}: ${msg}`);
-        annotate("client/ui/i18n/locales/_index.json", `${code}: ${msg}`);
-        continue;
-    }
-
-    const set = new Set(keys);
-    const missing = sourceKeys.filter((k) => !set.has(k));
-    const extra = keys.filter((k) => !sourceSet.has(k));
-
-    if (missing.length === 0 && extra.length === 0) {
-        console.log(`✓ ${code}: ${keys.length} keys`);
-        continue;
-    }
-
-    failed = true;
-    console.error(`✗ ${code}: ${keys.length} keys (expected ${sourceKeys.length})`);
-    if (missing.length) {
-        console.error(`    missing ${missing.length}: ${missing.join(", ")}`);
-        annotate(file, `Missing ${missing.length} key(s) present in ${SOURCE}: ${missing.join(", ")}`);
-    }
-    if (extra.length) {
-        console.error(`    extra ${extra.length}: ${extra.join(", ")}`);
-        annotate(file, `Has ${extra.length} key(s) not present in ${SOURCE}: ${extra.join(", ")}`);
-    }
-}
-
-// Locale directories present on disk but not declared in _index.json are never
-// loaded by the app — surface them so dead translation files don't rot silently.
-const onDisk = readdirSync(localesDir, { withFileTypes: true })
-    .filter((e) => e.isDirectory())
-    .map((e) => e.name);
-const undeclared = onDisk.filter((d) => !declared.includes(d));
-if (undeclared.length) {
-    console.warn(`\n⚠ locale directories not declared in _index.json (not shipped): ${undeclared.join(", ")}`);
-}
-
-console.log();
-if (failed) {
-    console.error("Translation check FAILED — every locale must match the English key set.");
-    process.exit(1);
-}
-console.log("Translation check passed — all locales match the English key set.");

client/ui/i18n/locales/de/common.json

@@ -1338,174 +1338,5 @@
     },
     "error.unknown": {
         "message": "Vorgang fehlgeschlagen."
-    },
-    "nav.files.title": {
-        "message": "Dateien"
-    },
-    "files.search.placeholder": {
-        "message": "Übertragungen nach Datei oder Peer suchen"
-    },
-    "files.empty.title": {
-        "message": "Noch keine Übertragungen"
-    },
-    "files.empty.description": {
-        "message": "Gesendete und empfangene Dateien erscheinen hier."
-    },
-    "files.group.today": {
-        "message": "Heute"
-    },
-    "files.group.yesterday": {
-        "message": "Gestern"
-    },
-    "files.offer.subtitle": {
-        "message": "{peer} möchte etwas senden"
-    },
-    "files.offer.accept": {
-        "message": "Annehmen"
-    },
-    "files.offer.decline": {
-        "message": "Ablehnen"
-    },
-    "files.row.to": {
-        "message": "an {peer}"
-    },
-    "files.row.from": {
-        "message": "von {peer}"
-    },
-    "files.state.pending": {
-        "message": "Wartet"
-    },
-    "files.state.transferring": {
-        "message": "Überträgt"
-    },
-    "files.state.progress": {
-        "message": "{percent}%"
-    },
-    "files.state.received": {
-        "message": "Empfangen"
-    },
-    "files.state.sent": {
-        "message": "Gesendet"
-    },
-    "files.state.declined": {
-        "message": "Abgelehnt"
-    },
-    "files.state.expired": {
-        "message": "Keine Antwort"
-    },
-    "files.state.cancelled": {
-        "message": "Abgebrochen"
-    },
-    "files.state.failed": {
-        "message": "Fehlgeschlagen"
-    },
-    "files.action.copy": {
-        "message": "Kopieren"
-    },
-    "files.action.reveal": {
-        "message": "Im Ordner anzeigen"
-    },
-    "files.action.cancel": {
-        "message": "Abbrechen"
-    },
-    "files.action.more": {
-        "message": "Mehr"
-    },
-    "files.action.open": {
-        "message": "Öffnen"
-    },
-    "files.action.alwaysAccept": {
-        "message": "Von diesem Peer immer annehmen"
-    },
-    "files.action.block": {
-        "message": "Diesen Peer blockieren"
-    },
-    "files.action.delete": {
-        "message": "Löschen"
-    },
-    "peers.dropToSend": {
-        "message": "Zum Senden ablegen"
-    },
-    "peers.details.sendFile": {
-        "message": "Datei senden…"
-    },
-    "peers.details.sendClipboard": {
-        "message": "Zwischenablage senden"
-    },
-    "peers.details.sendClipboard.empty": {
-        "message": "Zwischenablage ist leer"
-    },
-    "settings.tabs.fileSharing": {
-        "message": "Dateifreigabe"
-    },
-    "settings.fileSharing.section": {
-        "message": "Dateiempfang"
-    },
-    "settings.fileSharing.loading": {
-        "message": "Lädt…"
-    },
-    "settings.fileSharing.mode.label": {
-        "message": "Dateien von Peers empfangen"
-    },
-    "settings.fileSharing.mode.help": {
-        "message": "Wie dieses Gerät eingehende Dateiangebote behandelt."
-    },
-    "settings.fileSharing.mode.off": {
-        "message": "Aus"
-    },
-    "settings.fileSharing.mode.off.help": {
-        "message": "Dieses Gerät nimmt keine Dateien an."
-    },
-    "settings.fileSharing.mode.ask": {
-        "message": "Jedes Mal fragen"
-    },
-    "settings.fileSharing.mode.ask.help": {
-        "message": "Jedes Angebot fragt zuerst nach Ihrer Zustimmung."
-    },
-    "settings.fileSharing.mode.auto": {
-        "message": "Automatisch annehmen"
-    },
-    "settings.fileSharing.mode.auto.help": {
-        "message": "Dateien kommen ohne Interaktion an."
-    },
-    "settings.fileSharing.destination.label": {
-        "message": "Empfangene Dateien speichern unter"
-    },
-    "settings.fileSharing.destination.help": {
-        "message": "Empfangene Dateien werden in diesen Ordner zugestellt."
-    },
-    "settings.fileSharing.destination.unset": {
-        "message": "Nicht festgelegt"
-    },
-    "settings.fileSharing.destination.change": {
-        "message": "Ändern…"
-    },
-    "settings.fileSharing.exceptions.label": {
-        "message": "Ausnahmen pro Peer"
-    },
-    "settings.fileSharing.exceptions.help": {
-        "message": "Überschreibungen zusätzlich zum Empfangsmodus."
-    },
-    "settings.fileSharing.exceptions.empty": {
-        "message": "Keine Ausnahmen."
-    },
-    "settings.fileSharing.exceptions.blocked": {
-        "message": "Blockiert"
-    },
-    "settings.fileSharing.exceptions.always": {
-        "message": "Immer angenommen"
-    },
-    "settings.fileSharing.exceptions.remove": {
-        "message": "Ausnahme entfernen"
-    },
-    "files.state.unreachable": {
-        "message": "Abgelehnt",
-        "description": "Failed-transfer reason: the peer's file drop port refused the offer."
-    },
-    "notify.filedrop.offer.title": {
-        "message": "Eingehende Datei"
-    },
-    "notify.filedrop.always": {
-        "message": "Immer annehmen"
     }
 }

client/ui/i18n/locales/en/common.json

@@ -1810,229 +1810,5 @@
     "settings.ssh.privilege.oneWayInverted": {
         "message": "You can switch this on, but switching it back off needs {actor}:",
         "description": "Warning under the SSH authentication setting, which an unprivileged user may re-enable but not disable again. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
-    },
-    "nav.files.title": {
-        "message": "Files",
-        "description": "Navigation label for the Files section (file transfers)."
-    },
-    "files.search.placeholder": {
-        "message": "Search transfers by file or peer",
-        "description": "Placeholder of the transfer search field."
-    },
-    "files.empty.title": {
-        "message": "No transfers yet",
-        "description": "Empty state title of the Files section."
-    },
-    "files.empty.description": {
-        "message": "Files you send or receive will show up here.",
-        "description": "Empty state description of the Files section."
-    },
-    "files.group.today": {
-        "message": "Today",
-        "description": "Day group header for today's transfers."
-    },
-    "files.group.yesterday": {
-        "message": "Yesterday",
-        "description": "Day group header for yesterday's transfers."
-    },
-    "files.offer.subtitle": {
-        "message": "{peer} wants to send",
-        "description": "Subtitle of a pending incoming offer. {peer} is the sender's name."
-    },
-    "files.offer.accept": {
-        "message": "Accept",
-        "description": "Accept button of a pending offer."
-    },
-    "files.offer.decline": {
-        "message": "Decline",
-        "description": "Decline button of a pending offer."
-    },
-    "files.row.to": {
-        "message": "to {peer}",
-        "description": "Direction label of a sent transfer. {peer} is the receiver's name."
-    },
-    "files.row.from": {
-        "message": "from {peer}",
-        "description": "Direction label of a received transfer. {peer} is the sender's name."
-    },
-    "files.state.pending": {
-        "message": "Waiting",
-        "description": "Transfer state: waiting for the receiver's decision."
-    },
-    "files.state.transferring": {
-        "message": "Transferring",
-        "description": "Transfer state: payload is streaming."
-    },
-    "files.state.progress": {
-        "message": "{percent}%",
-        "description": "Transfer progress. {percent} is a number."
-    },
-    "files.state.received": {
-        "message": "Received",
-        "description": "Transfer state: completed incoming transfer."
-    },
-    "files.state.sent": {
-        "message": "Sent",
-        "description": "Transfer state: completed outgoing transfer."
-    },
-    "files.state.declined": {
-        "message": "Declined",
-        "description": "Transfer state: the receiver declined."
-    },
-    "files.state.expired": {
-        "message": "No response",
-        "description": "Transfer state: the offer expired unanswered."
-    },
-    "files.state.cancelled": {
-        "message": "Cancelled",
-        "description": "Transfer state: cancelled by a user."
-    },
-    "files.state.failed": {
-        "message": "Failed",
-        "description": "Transfer state: the transfer failed."
-    },
-    "files.action.copy": {
-        "message": "Copy",
-        "description": "Copy a received text snippet."
-    },
-    "files.action.reveal": {
-        "message": "Show in folder",
-        "description": "Open the file manager at the delivered file."
-    },
-    "files.action.cancel": {
-        "message": "Cancel",
-        "description": "Cancel a running transfer."
-    },
-    "files.action.more": {
-        "message": "More",
-        "description": "Open the row's overflow menu."
-    },
-    "files.action.open": {
-        "message": "Open",
-        "description": "Open the delivered file."
-    },
-    "files.action.alwaysAccept": {
-        "message": "Always accept from this peer",
-        "description": "Per-sender exception shortcut."
-    },
-    "files.action.block": {
-        "message": "Block this peer",
-        "description": "Per-sender block shortcut."
-    },
-    "files.action.delete": {
-        "message": "Delete",
-        "description": "Remove the entry from the history."
-    },
-    "peers.dropToSend": {
-        "message": "Drop to send",
-        "description": "Overlay shown while dragging files over a peer row."
-    },
-    "peers.details.sendFile": {
-        "message": "Send file…",
-        "description": "Peer action opening the file picker."
-    },
-    "peers.details.sendClipboard": {
-        "message": "Send clipboard",
-        "description": "Peer action sending the clipboard text."
-    },
-    "peers.details.sendClipboard.empty": {
-        "message": "Clipboard is empty",
-        "description": "Error when the clipboard has no text."
-    },
-    "settings.tabs.fileSharing": {
-        "message": "File sharing",
-        "description": "Settings tab for file transfer policy."
-    },
-    "settings.fileSharing.section": {
-        "message": "File receiving",
-        "description": "Section title of the file receiving policy."
-    },
-    "settings.fileSharing.loading": {
-        "message": "Loading…",
-        "description": "Shown while the policy is being fetched."
-    },
-    "settings.fileSharing.mode.label": {
-        "message": "Receive files from peers",
-        "description": "Label of the receiving mode selector."
-    },
-    "settings.fileSharing.mode.help": {
-        "message": "How this device handles incoming file offers.",
-        "description": "Help text of the receiving mode selector."
-    },
-    "settings.fileSharing.mode.off": {
-        "message": "Off",
-        "description": "Receiving mode: no files are accepted."
-    },
-    "settings.fileSharing.mode.off.help": {
-        "message": "This device does not accept files.",
-        "description": "Help text of the Off mode."
-    },
-    "settings.fileSharing.mode.ask": {
-        "message": "Ask every time",
-        "description": "Receiving mode: each offer asks for consent."
-    },
-    "settings.fileSharing.mode.ask.help": {
-        "message": "Every offer asks for your consent first.",
-        "description": "Help text of the Ask mode."
-    },
-    "settings.fileSharing.mode.auto": {
-        "message": "Auto-accept",
-        "description": "Receiving mode: files arrive without interaction."
-    },
-    "settings.fileSharing.mode.auto.help": {
-        "message": "Files arrive without interaction.",
-        "description": "Help text of the Auto-accept mode."
-    },
-    "settings.fileSharing.destination.label": {
-        "message": "Save received files to",
-        "description": "Label of the delivery directory row."
-    },
-    "settings.fileSharing.destination.help": {
-        "message": "Received files are delivered into this folder.",
-        "description": "Help text of the delivery directory row."
-    },
-    "settings.fileSharing.destination.unset": {
-        "message": "Not set",
-        "description": "Placeholder when no delivery directory is configured."
-    },
-    "settings.fileSharing.destination.change": {
-        "message": "Change…",
-        "description": "Button opening the directory picker."
-    },
-    "settings.fileSharing.exceptions.label": {
-        "message": "Per-peer exceptions",
-        "description": "Label of the exception list."
-    },
-    "settings.fileSharing.exceptions.help": {
-        "message": "Overrides on top of the receiving mode.",
-        "description": "Help text of the exception list."
-    },
-    "settings.fileSharing.exceptions.empty": {
-        "message": "No exceptions.",
-        "description": "Shown when the exception list is empty."
-    },
-    "settings.fileSharing.exceptions.blocked": {
-        "message": "Blocked",
-        "description": "Exception kind: sender is blocked."
-    },
-    "settings.fileSharing.exceptions.always": {
-        "message": "Always accepted",
-        "description": "Exception kind: sender is always accepted."
-    },
-    "settings.fileSharing.exceptions.remove": {
-        "message": "Remove exception",
-        "description": "Button removing one exception."
-    },
-    "files.state.unreachable": {
-        "message": "Declined",
-        "description": "Failed-transfer reason: the peer's file drop port refused the offer."
-    },
-    "notify.filedrop.offer.title": {
-        "message": "Incoming file",
-        "description": "Title of the consent notification for an incoming file offer."
-    },
-    "notify.filedrop.always": {
-        "message": "Always accept",
-        "description": "Consent-notification button: accept this offer and auto-accept this sender from now on."
     }
 }

client/ui/i18n/locales/es/common.json

@@ -1338,174 +1338,5 @@
     },
     "error.unknown": {
         "message": "La operación falló."
-    },
-    "nav.files.title": {
-        "message": "Archivos"
-    },
-    "files.search.placeholder": {
-        "message": "Buscar transferencias por archivo o peer"
-    },
-    "files.empty.title": {
-        "message": "Aún no hay transferencias"
-    },
-    "files.empty.description": {
-        "message": "Los archivos que envíes o recibas aparecerán aquí."
-    },
-    "files.group.today": {
-        "message": "Hoy"
-    },
-    "files.group.yesterday": {
-        "message": "Ayer"
-    },
-    "files.offer.subtitle": {
-        "message": "{peer} quiere enviar"
-    },
-    "files.offer.accept": {
-        "message": "Aceptar"
-    },
-    "files.offer.decline": {
-        "message": "Rechazar"
-    },
-    "files.row.to": {
-        "message": "a {peer}"
-    },
-    "files.row.from": {
-        "message": "de {peer}"
-    },
-    "files.state.pending": {
-        "message": "Esperando"
-    },
-    "files.state.transferring": {
-        "message": "Transfiriendo"
-    },
-    "files.state.progress": {
-        "message": "{percent}%"
-    },
-    "files.state.received": {
-        "message": "Recibido"
-    },
-    "files.state.sent": {
-        "message": "Enviado"
-    },
-    "files.state.declined": {
-        "message": "Rechazado"
-    },
-    "files.state.expired": {
-        "message": "Sin respuesta"
-    },
-    "files.state.cancelled": {
-        "message": "Cancelado"
-    },
-    "files.state.failed": {
-        "message": "Fallido"
-    },
-    "files.action.copy": {
-        "message": "Copiar"
-    },
-    "files.action.reveal": {
-        "message": "Mostrar en la carpeta"
-    },
-    "files.action.cancel": {
-        "message": "Cancelar"
-    },
-    "files.action.more": {
-        "message": "Más"
-    },
-    "files.action.open": {
-        "message": "Abrir"
-    },
-    "files.action.alwaysAccept": {
-        "message": "Aceptar siempre de este peer"
-    },
-    "files.action.block": {
-        "message": "Bloquear este peer"
-    },
-    "files.action.delete": {
-        "message": "Eliminar"
-    },
-    "peers.dropToSend": {
-        "message": "Suelta para enviar"
-    },
-    "peers.details.sendFile": {
-        "message": "Enviar archivo…"
-    },
-    "peers.details.sendClipboard": {
-        "message": "Enviar portapapeles"
-    },
-    "peers.details.sendClipboard.empty": {
-        "message": "El portapapeles está vacío"
-    },
-    "settings.tabs.fileSharing": {
-        "message": "Compartir archivos"
-    },
-    "settings.fileSharing.section": {
-        "message": "Recepción de archivos"
-    },
-    "settings.fileSharing.loading": {
-        "message": "Cargando…"
-    },
-    "settings.fileSharing.mode.label": {
-        "message": "Recibir archivos de peers"
-    },
-    "settings.fileSharing.mode.help": {
-        "message": "Cómo maneja este dispositivo las ofertas de archivos entrantes."
-    },
-    "settings.fileSharing.mode.off": {
-        "message": "Desactivado"
-    },
-    "settings.fileSharing.mode.off.help": {
-        "message": "Este dispositivo no acepta archivos."
-    },
-    "settings.fileSharing.mode.ask": {
-        "message": "Preguntar cada vez"
-    },
-    "settings.fileSharing.mode.ask.help": {
-        "message": "Cada oferta pide primero tu consentimiento."
-    },
-    "settings.fileSharing.mode.auto": {
-        "message": "Aceptar automáticamente"
-    },
-    "settings.fileSharing.mode.auto.help": {
-        "message": "Los archivos llegan sin interacción."
-    },
-    "settings.fileSharing.destination.label": {
-        "message": "Guardar archivos recibidos en"
-    },
-    "settings.fileSharing.destination.help": {
-        "message": "Los archivos recibidos se entregan en esta carpeta."
-    },
-    "settings.fileSharing.destination.unset": {
-        "message": "Sin configurar"
-    },
-    "settings.fileSharing.destination.change": {
-        "message": "Cambiar…"
-    },
-    "settings.fileSharing.exceptions.label": {
-        "message": "Excepciones por peer"
-    },
-    "settings.fileSharing.exceptions.help": {
-        "message": "Anulaciones sobre el modo de recepción."
-    },
-    "settings.fileSharing.exceptions.empty": {
-        "message": "Sin excepciones."
-    },
-    "settings.fileSharing.exceptions.blocked": {
-        "message": "Bloqueado"
-    },
-    "settings.fileSharing.exceptions.always": {
-        "message": "Siempre aceptado"
-    },
-    "settings.fileSharing.exceptions.remove": {
-        "message": "Eliminar excepción"
-    },
-    "files.state.unreachable": {
-        "message": "Rechazado",
-        "description": "Failed-transfer reason: the peer's file drop port refused the offer."
-    },
-    "notify.filedrop.offer.title": {
-        "message": "Archivo entrante"
-    },
-    "notify.filedrop.always": {
-        "message": "Aceptar siempre"
     }
 }

client/ui/i18n/locales/fr/common.json

@@ -1338,174 +1338,5 @@
     },
     "error.unknown": {
         "message": "L’opération a échoué."
-    },
-    "nav.files.title": {
-        "message": "Fichiers"
-    },
-    "files.search.placeholder": {
-        "message": "Rechercher des transferts par fichier ou pair"
-    },
-    "files.empty.title": {
-        "message": "Aucun transfert pour l'instant"
-    },
-    "files.empty.description": {
-        "message": "Les fichiers envoyés ou reçus apparaîtront ici."
-    },
-    "files.group.today": {
-        "message": "Aujourd'hui"
-    },
-    "files.group.yesterday": {
-        "message": "Hier"
-    },
-    "files.offer.subtitle": {
-        "message": "{peer} veut envoyer"
-    },
-    "files.offer.accept": {
-        "message": "Accepter"
-    },
-    "files.offer.decline": {
-        "message": "Refuser"
-    },
-    "files.row.to": {
-        "message": "vers {peer}"
-    },
-    "files.row.from": {
-        "message": "de {peer}"
-    },
-    "files.state.pending": {
-        "message": "En attente"
-    },
-    "files.state.transferring": {
-        "message": "Transfert"
-    },
-    "files.state.progress": {
-        "message": "{percent}%"
-    },
-    "files.state.received": {
-        "message": "Reçu"
-    },
-    "files.state.sent": {
-        "message": "Envoyé"
-    },
-    "files.state.declined": {
-        "message": "Refusé"
-    },
-    "files.state.expired": {
-        "message": "Sans réponse"
-    },
-    "files.state.cancelled": {
-        "message": "Annulé"
-    },
-    "files.state.failed": {
-        "message": "Échoué"
-    },
-    "files.action.copy": {
-        "message": "Copier"
-    },
-    "files.action.reveal": {
-        "message": "Afficher dans le dossier"
-    },
-    "files.action.cancel": {
-        "message": "Annuler"
-    },
-    "files.action.more": {
-        "message": "Plus"
-    },
-    "files.action.open": {
-        "message": "Ouvrir"
-    },
-    "files.action.alwaysAccept": {
-        "message": "Toujours accepter de ce pair"
-    },
-    "files.action.block": {
-        "message": "Bloquer ce pair"
-    },
-    "files.action.delete": {
-        "message": "Supprimer"
-    },
-    "peers.dropToSend": {
-        "message": "Déposer pour envoyer"
-    },
-    "peers.details.sendFile": {
-        "message": "Envoyer un fichier…"
-    },
-    "peers.details.sendClipboard": {
-        "message": "Envoyer le presse-papiers"
-    },
-    "peers.details.sendClipboard.empty": {
-        "message": "Le presse-papiers est vide"
-    },
-    "settings.tabs.fileSharing": {
-        "message": "Partage de fichiers"
-    },
-    "settings.fileSharing.section": {
-        "message": "Réception de fichiers"
-    },
-    "settings.fileSharing.loading": {
-        "message": "Chargement…"
-    },
-    "settings.fileSharing.mode.label": {
-        "message": "Recevoir des fichiers des pairs"
-    },
-    "settings.fileSharing.mode.help": {
-        "message": "Comment cet appareil traite les offres de fichiers entrantes."
-    },
-    "settings.fileSharing.mode.off": {
-        "message": "Désactivé"
-    },
-    "settings.fileSharing.mode.off.help": {
-        "message": "Cet appareil n'accepte pas de fichiers."
-    },
-    "settings.fileSharing.mode.ask": {
-        "message": "Demander à chaque fois"
-    },
-    "settings.fileSharing.mode.ask.help": {
-        "message": "Chaque offre demande d'abord votre accord."
-    },
-    "settings.fileSharing.mode.auto": {
-        "message": "Acceptation automatique"
-    },
-    "settings.fileSharing.mode.auto.help": {
-        "message": "Les fichiers arrivent sans interaction."
-    },
-    "settings.fileSharing.destination.label": {
-        "message": "Enregistrer les fichiers reçus dans"
-    },
-    "settings.fileSharing.destination.help": {
-        "message": "Les fichiers reçus sont déposés dans ce dossier."
-    },
-    "settings.fileSharing.destination.unset": {
-        "message": "Non défini"
-    },
-    "settings.fileSharing.destination.change": {
-        "message": "Modifier…"
-    },
-    "settings.fileSharing.exceptions.label": {
-        "message": "Exceptions par pair"
-    },
-    "settings.fileSharing.exceptions.help": {
-        "message": "Dérogations au mode de réception."
-    },
-    "settings.fileSharing.exceptions.empty": {
-        "message": "Aucune exception."
-    },
-    "settings.fileSharing.exceptions.blocked": {
-        "message": "Bloqué"
-    },
-    "settings.fileSharing.exceptions.always": {
-        "message": "Toujours accepté"
-    },
-    "settings.fileSharing.exceptions.remove": {
-        "message": "Supprimer l'exception"
-    },
-    "files.state.unreachable": {
-        "message": "Refusé",
-        "description": "Failed-transfer reason: the peer's file drop port refused the offer."
-    },
-    "notify.filedrop.offer.title": {
-        "message": "Fichier entrant"
-    },
-    "notify.filedrop.always": {
-        "message": "Toujours accepter"
     }
 }

client/ui/i18n/locales/hu/common.json

@@ -1338,174 +1338,5 @@
     },
     "error.unknown": {
         "message": "A művelet meghiúsult."
-    },
-    "nav.files.title": {
-        "message": "Fájlok"
-    },
-    "files.search.placeholder": {
-        "message": "Keresés fájl vagy peer szerint"
-    },
-    "files.empty.title": {
-        "message": "Még nincs átvitel"
-    },
-    "files.empty.description": {
-        "message": "Az elküldött és fogadott fájlok itt jelennek meg."
-    },
-    "files.group.today": {
-        "message": "Ma"
-    },
-    "files.group.yesterday": {
-        "message": "Tegnap"
-    },
-    "files.offer.subtitle": {
-        "message": "{peer} küldeni szeretne"
-    },
-    "files.offer.accept": {
-        "message": "Elfogadás"
-    },
-    "files.offer.decline": {
-        "message": "Elutasítás"
-    },
-    "files.row.to": {
-        "message": "ide: {peer}"
-    },
-    "files.row.from": {
-        "message": "tőle: {peer}"
-    },
-    "files.state.pending": {
-        "message": "Várakozás"
-    },
-    "files.state.transferring": {
-        "message": "Átvitel folyamatban"
-    },
-    "files.state.progress": {
-        "message": "{percent}%"
-    },
-    "files.state.received": {
-        "message": "Fogadva"
-    },
-    "files.state.sent": {
-        "message": "Elküldve"
-    },
-    "files.state.declined": {
-        "message": "Elutasítva"
-    },
-    "files.state.expired": {
-        "message": "Nincs válasz"
-    },
-    "files.state.cancelled": {
-        "message": "Megszakítva"
-    },
-    "files.state.failed": {
-        "message": "Sikertelen"
-    },
-    "files.action.copy": {
-        "message": "Másolás"
-    },
-    "files.action.reveal": {
-        "message": "Megjelenítés a mappában"
-    },
-    "files.action.cancel": {
-        "message": "Megszakítás"
-    },
-    "files.action.more": {
-        "message": "Továbbiak"
-    },
-    "files.action.open": {
-        "message": "Megnyitás"
-    },
-    "files.action.alwaysAccept": {
-        "message": "Mindig elfogadás ettől a peertől"
-    },
-    "files.action.block": {
-        "message": "Peer tiltása"
-    },
-    "files.action.delete": {
-        "message": "Törlés"
-    },
-    "peers.dropToSend": {
-        "message": "Engedd el a küldéshez"
-    },
-    "peers.details.sendFile": {
-        "message": "Fájl küldése…"
-    },
-    "peers.details.sendClipboard": {
-        "message": "Vágólap küldése"
-    },
-    "peers.details.sendClipboard.empty": {
-        "message": "A vágólap üres"
-    },
-    "settings.tabs.fileSharing": {
-        "message": "Fájlmegosztás"
-    },
-    "settings.fileSharing.section": {
-        "message": "Fájlfogadás"
-    },
-    "settings.fileSharing.loading": {
-        "message": "Betöltés…"
-    },
-    "settings.fileSharing.mode.label": {
-        "message": "Fájlok fogadása peerektől"
-    },
-    "settings.fileSharing.mode.help": {
-        "message": "Így kezeli az eszköz a bejövő fájlfelajánlásokat."
-    },
-    "settings.fileSharing.mode.off": {
-        "message": "Kikapcsolva"
-    },
-    "settings.fileSharing.mode.off.help": {
-        "message": "Az eszköz nem fogad fájlokat."
-    },
-    "settings.fileSharing.mode.ask": {
-        "message": "Mindig kérdezzen"
-    },
-    "settings.fileSharing.mode.ask.help": {
-        "message": "Minden felajánlás először engedélyt kér."
-    },
-    "settings.fileSharing.mode.auto": {
-        "message": "Automatikus elfogadás"
-    },
-    "settings.fileSharing.mode.auto.help": {
-        "message": "A fájlok beavatkozás nélkül érkeznek."
-    },
-    "settings.fileSharing.destination.label": {
-        "message": "Fogadott fájlok mentése ide"
-    },
-    "settings.fileSharing.destination.help": {
-        "message": "A fogadott fájlok ebbe a mappába kerülnek."
-    },
-    "settings.fileSharing.destination.unset": {
-        "message": "Nincs beállítva"
-    },
-    "settings.fileSharing.destination.change": {
-        "message": "Módosítás…"
-    },
-    "settings.fileSharing.exceptions.label": {
-        "message": "Peerenkénti kivételek"
-    },
-    "settings.fileSharing.exceptions.help": {
-        "message": "A fogadási módot felülíró szabályok."
-    },
-    "settings.fileSharing.exceptions.empty": {
-        "message": "Nincsenek kivételek."
-    },
-    "settings.fileSharing.exceptions.blocked": {
-        "message": "Tiltva"
-    },
-    "settings.fileSharing.exceptions.always": {
-        "message": "Mindig elfogadva"
-    },
-    "settings.fileSharing.exceptions.remove": {
-        "message": "Kivétel eltávolítása"
-    },
-    "files.state.unreachable": {
-        "message": "Elutasítva",
-        "description": "Failed-transfer reason: the peer's file drop port refused the offer."
-    },
-    "notify.filedrop.offer.title": {
-        "message": "Bejövő fájl"
-    },
-    "notify.filedrop.always": {
-        "message": "Mindig elfogadás"
     }
 }

client/ui/i18n/locales/it/common.json

@@ -1338,174 +1338,5 @@
     },
     "error.unknown": {
         "message": "Operazione non riuscita."
-    },
-    "nav.files.title": {
-        "message": "File"
-    },
-    "files.search.placeholder": {
-        "message": "Cerca trasferimenti per file o peer"
-    },
-    "files.empty.title": {
-        "message": "Nessun trasferimento"
-    },
-    "files.empty.description": {
-        "message": "I file inviati o ricevuti appariranno qui."
-    },
-    "files.group.today": {
-        "message": "Oggi"
-    },
-    "files.group.yesterday": {
-        "message": "Ieri"
-    },
-    "files.offer.subtitle": {
-        "message": "{peer} vuole inviare"
-    },
-    "files.offer.accept": {
-        "message": "Accetta"
-    },
-    "files.offer.decline": {
-        "message": "Rifiuta"
-    },
-    "files.row.to": {
-        "message": "a {peer}"
-    },
-    "files.row.from": {
-        "message": "da {peer}"
-    },
-    "files.state.pending": {
-        "message": "In attesa"
-    },
-    "files.state.transferring": {
-        "message": "Trasferimento"
-    },
-    "files.state.progress": {
-        "message": "{percent}%"
-    },
-    "files.state.received": {
-        "message": "Ricevuto"
-    },
-    "files.state.sent": {
-        "message": "Inviato"
-    },
-    "files.state.declined": {
-        "message": "Rifiutato"
-    },
-    "files.state.expired": {
-        "message": "Nessuna risposta"
-    },
-    "files.state.cancelled": {
-        "message": "Annullato"
-    },
-    "files.state.failed": {
-        "message": "Non riuscito"
-    },
-    "files.action.copy": {
-        "message": "Copia"
-    },
-    "files.action.reveal": {
-        "message": "Mostra nella cartella"
-    },
-    "files.action.cancel": {
-        "message": "Annulla"
-    },
-    "files.action.more": {
-        "message": "Altro"
-    },
-    "files.action.open": {
-        "message": "Apri"
-    },
-    "files.action.alwaysAccept": {
-        "message": "Accetta sempre da questo peer"
-    },
-    "files.action.block": {
-        "message": "Blocca questo peer"
-    },
-    "files.action.delete": {
-        "message": "Elimina"
-    },
-    "peers.dropToSend": {
-        "message": "Rilascia per inviare"
-    },
-    "peers.details.sendFile": {
-        "message": "Invia file…"
-    },
-    "peers.details.sendClipboard": {
-        "message": "Invia appunti"
-    },
-    "peers.details.sendClipboard.empty": {
-        "message": "Gli appunti sono vuoti"
-    },
-    "settings.tabs.fileSharing": {
-        "message": "Condivisione file"
-    },
-    "settings.fileSharing.section": {
-        "message": "Ricezione file"
-    },
-    "settings.fileSharing.loading": {
-        "message": "Caricamento…"
-    },
-    "settings.fileSharing.mode.label": {
-        "message": "Ricevi file dai peer"
-    },
-    "settings.fileSharing.mode.help": {
-        "message": "Come questo dispositivo gestisce le offerte di file in arrivo."
-    },
-    "settings.fileSharing.mode.off": {
-        "message": "Disattivato"
-    },
-    "settings.fileSharing.mode.off.help": {
-        "message": "Questo dispositivo non accetta file."
-    },
-    "settings.fileSharing.mode.ask": {
-        "message": "Chiedi ogni volta"
-    },
-    "settings.fileSharing.mode.ask.help": {
-        "message": "Ogni offerta chiede prima il tuo consenso."
-    },
-    "settings.fileSharing.mode.auto": {
-        "message": "Accettazione automatica"
-    },
-    "settings.fileSharing.mode.auto.help": {
-        "message": "I file arrivano senza interazione."
-    },
-    "settings.fileSharing.destination.label": {
-        "message": "Salva i file ricevuti in"
-    },
-    "settings.fileSharing.destination.help": {
-        "message": "I file ricevuti vengono consegnati in questa cartella."
-    },
-    "settings.fileSharing.destination.unset": {
-        "message": "Non impostato"
-    },
-    "settings.fileSharing.destination.change": {
-        "message": "Cambia…"
-    },
-    "settings.fileSharing.exceptions.label": {
-        "message": "Eccezioni per peer"
-    },
-    "settings.fileSharing.exceptions.help": {
-        "message": "Sostituzioni rispetto alla modalità di ricezione."
-    },
-    "settings.fileSharing.exceptions.empty": {
-        "message": "Nessuna eccezione."
-    },
-    "settings.fileSharing.exceptions.blocked": {
-        "message": "Bloccato"
-    },
-    "settings.fileSharing.exceptions.always": {
-        "message": "Sempre accettato"
-    },
-    "settings.fileSharing.exceptions.remove": {
-        "message": "Rimuovi eccezione"
-    },
-    "files.state.unreachable": {
-        "message": "Rifiutato",
-        "description": "Failed-transfer reason: the peer's file drop port refused the offer."
-    },
-    "notify.filedrop.offer.title": {
-        "message": "File in arrivo"
-    },
-    "notify.filedrop.always": {
-        "message": "Accetta sempre"
     }
 }

client/ui/i18n/locales/ja/common.json

@@ -1312,9 +1312,6 @@
     "daemon.outdated.description": {
         "message": "このアプリを使用するには NetBird サービスを更新してください。"
     },
-    "daemon.outdated.download": {
-        "message": "最新版をダウンロード"
-    },
     "error.jwt_clock_skew": {
         "message": "サインインに失敗しました: このデバイスの時計がサーバーと同期していません。システムの時計を同期してからもう一度お試しください。"
     },
@@ -1338,174 +1335,5 @@
     },
     "error.unknown": {
         "message": "操作に失敗しました。"
-    },
-    "nav.files.title": {
-        "message": "ファイル"
-    },
-    "files.search.placeholder": {
-        "message": "ファイルまたはピアで転送を検索"
-    },
-    "files.empty.title": {
-        "message": "転送はまだありません"
-    },
-    "files.empty.description": {
-        "message": "送受信したファイルがここに表示されます。"
-    },
-    "files.group.today": {
-        "message": "今日"
-    },
-    "files.group.yesterday": {
-        "message": "昨日"
-    },
-    "files.offer.subtitle": {
-        "message": "{peer} が送信を希望しています"
-    },
-    "files.offer.accept": {
-        "message": "承認"
-    },
-    "files.offer.decline": {
-        "message": "拒否"
-    },
-    "files.row.to": {
-        "message": "{peer} へ"
-    },
-    "files.row.from": {
-        "message": "{peer} から"
-    },
-    "files.state.pending": {
-        "message": "待機中"
-    },
-    "files.state.transferring": {
-        "message": "転送中"
-    },
-    "files.state.progress": {
-        "message": "{percent}%"
-    },
-    "files.state.received": {
-        "message": "受信済み"
-    },
-    "files.state.sent": {
-        "message": "送信済み"
-    },
-    "files.state.declined": {
-        "message": "拒否されました"
-    },
-    "files.state.expired": {
-        "message": "応答なし"
-    },
-    "files.state.cancelled": {
-        "message": "キャンセル済み"
-    },
-    "files.state.failed": {
-        "message": "失敗"
-    },
-    "files.action.copy": {
-        "message": "コピー"
-    },
-    "files.action.reveal": {
-        "message": "フォルダーで表示"
-    },
-    "files.action.cancel": {
-        "message": "キャンセル"
-    },
-    "files.action.more": {
-        "message": "その他"
-    },
-    "files.action.open": {
-        "message": "開く"
-    },
-    "files.action.alwaysAccept": {
-        "message": "このピアからは常に承認"
-    },
-    "files.action.block": {
-        "message": "このピアをブロック"
-    },
-    "files.action.delete": {
-        "message": "削除"
-    },
-    "peers.dropToSend": {
-        "message": "ドロップして送信"
-    },
-    "peers.details.sendFile": {
-        "message": "ファイルを送信…"
-    },
-    "peers.details.sendClipboard": {
-        "message": "クリップボードを送信"
-    },
-    "peers.details.sendClipboard.empty": {
-        "message": "クリップボードは空です"
-    },
-    "settings.tabs.fileSharing": {
-        "message": "ファイル共有"
-    },
-    "settings.fileSharing.section": {
-        "message": "ファイル受信"
-    },
-    "settings.fileSharing.loading": {
-        "message": "読み込み中…"
-    },
-    "settings.fileSharing.mode.label": {
-        "message": "ピアからファイルを受信"
-    },
-    "settings.fileSharing.mode.help": {
-        "message": "このデバイスが受信ファイルの提案を処理する方法。"
-    },
-    "settings.fileSharing.mode.off": {
-        "message": "オフ"
-    },
-    "settings.fileSharing.mode.off.help": {
-        "message": "このデバイスはファイルを受け付けません。"
-    },
-    "settings.fileSharing.mode.ask": {
-        "message": "毎回確認"
-    },
-    "settings.fileSharing.mode.ask.help": {
-        "message": "各提案はまず同意を求めます。"
-    },
-    "settings.fileSharing.mode.auto": {
-        "message": "自動承認"
-    },
-    "settings.fileSharing.mode.auto.help": {
-        "message": "ファイルは操作なしで届きます。"
-    },
-    "settings.fileSharing.destination.label": {
-        "message": "受信ファイルの保存先"
-    },
-    "settings.fileSharing.destination.help": {
-        "message": "受信したファイルはこのフォルダーに保存されます。"
-    },
-    "settings.fileSharing.destination.unset": {
-        "message": "未設定"
-    },
-    "settings.fileSharing.destination.change": {
-        "message": "変更…"
-    },
-    "settings.fileSharing.exceptions.label": {
-        "message": "ピアごとの例外"
-    },
-    "settings.fileSharing.exceptions.help": {
-        "message": "受信モードを上書きする設定。"
-    },
-    "settings.fileSharing.exceptions.empty": {
-        "message": "例外はありません。"
-    },
-    "settings.fileSharing.exceptions.blocked": {
-        "message": "ブロック済み"
-    },
-    "settings.fileSharing.exceptions.always": {
-        "message": "常に承認"
-    },
-    "settings.fileSharing.exceptions.remove": {
-        "message": "例外を削除"
-    },
-    "files.state.unreachable": {
-        "message": "拒否されました",
-        "description": "Failed-transfer reason: the peer's file drop port refused the offer."
-    },
-    "notify.filedrop.offer.title": {
-        "message": "受信ファイル"
-    },
-    "notify.filedrop.always": {
-        "message": "常に承認"
     }
 }

client/ui/i18n/locales/pt/common.json

@@ -1338,174 +1338,5 @@
     },
     "error.unknown": {
         "message": "A operação falhou."
-    },
-    "nav.files.title": {
-        "message": "Arquivos"
-    },
-    "files.search.placeholder": {
-        "message": "Buscar transferências por arquivo ou peer"
-    },
-    "files.empty.title": {
-        "message": "Nenhuma transferência ainda"
-    },
-    "files.empty.description": {
-        "message": "Os arquivos enviados ou recebidos aparecerão aqui."
-    },
-    "files.group.today": {
-        "message": "Hoje"
-    },
-    "files.group.yesterday": {
-        "message": "Ontem"
-    },
-    "files.offer.subtitle": {
-        "message": "{peer} quer enviar"
-    },
-    "files.offer.accept": {
-        "message": "Aceitar"
-    },
-    "files.offer.decline": {
-        "message": "Recusar"
-    },
-    "files.row.to": {
-        "message": "para {peer}"
-    },
-    "files.row.from": {
-        "message": "de {peer}"
-    },
-    "files.state.pending": {
-        "message": "Aguardando"
-    },
-    "files.state.transferring": {
-        "message": "Transferindo"
-    },
-    "files.state.progress": {
-        "message": "{percent}%"
-    },
-    "files.state.received": {
-        "message": "Recebido"
-    },
-    "files.state.sent": {
-        "message": "Enviado"
-    },
-    "files.state.declined": {
-        "message": "Recusado"
-    },
-    "files.state.expired": {
-        "message": "Sem resposta"
-    },
-    "files.state.cancelled": {
-        "message": "Cancelado"
-    },
-    "files.state.failed": {
-        "message": "Falhou"
-    },
-    "files.action.copy": {
-        "message": "Copiar"
-    },
-    "files.action.reveal": {
-        "message": "Mostrar na pasta"
-    },
-    "files.action.cancel": {
-        "message": "Cancelar"
-    },
-    "files.action.more": {
-        "message": "Mais"
-    },
-    "files.action.open": {
-        "message": "Abrir"
-    },
-    "files.action.alwaysAccept": {
-        "message": "Sempre aceitar deste peer"
-    },
-    "files.action.block": {
-        "message": "Bloquear este peer"
-    },
-    "files.action.delete": {
-        "message": "Excluir"
-    },
-    "peers.dropToSend": {
-        "message": "Solte para enviar"
-    },
-    "peers.details.sendFile": {
-        "message": "Enviar arquivo…"
-    },
-    "peers.details.sendClipboard": {
-        "message": "Enviar área de transferência"
-    },
-    "peers.details.sendClipboard.empty": {
-        "message": "A área de transferência está vazia"
-    },
-    "settings.tabs.fileSharing": {
-        "message": "Compartilhamento de arquivos"
-    },
-    "settings.fileSharing.section": {
-        "message": "Recebimento de arquivos"
-    },
-    "settings.fileSharing.loading": {
-        "message": "Carregando…"
-    },
-    "settings.fileSharing.mode.label": {
-        "message": "Receber arquivos de peers"
-    },
-    "settings.fileSharing.mode.help": {
-        "message": "Como este dispositivo trata ofertas de arquivos recebidas."
-    },
-    "settings.fileSharing.mode.off": {
-        "message": "Desativado"
-    },
-    "settings.fileSharing.mode.off.help": {
-        "message": "Este dispositivo não aceita arquivos."
-    },
-    "settings.fileSharing.mode.ask": {
-        "message": "Perguntar sempre"
-    },
-    "settings.fileSharing.mode.ask.help": {
-        "message": "Cada oferta pede primeiro o seu consentimento."
-    },
-    "settings.fileSharing.mode.auto": {
-        "message": "Aceitar automaticamente"
-    },
-    "settings.fileSharing.mode.auto.help": {
-        "message": "Os arquivos chegam sem interação."
-    },
-    "settings.fileSharing.destination.label": {
-        "message": "Salvar arquivos recebidos em"
-    },
-    "settings.fileSharing.destination.help": {
-        "message": "Os arquivos recebidos são entregues nesta pasta."
-    },
-    "settings.fileSharing.destination.unset": {
-        "message": "Não definido"
-    },
-    "settings.fileSharing.destination.change": {
-        "message": "Alterar…"
-    },
-    "settings.fileSharing.exceptions.label": {
-        "message": "Exceções por peer"
-    },
-    "settings.fileSharing.exceptions.help": {
-        "message": "Substituições sobre o modo de recebimento."
-    },
-    "settings.fileSharing.exceptions.empty": {
-        "message": "Sem exceções."
-    },
-    "settings.fileSharing.exceptions.blocked": {
-        "message": "Bloqueado"
-    },
-    "settings.fileSharing.exceptions.always": {
-        "message": "Sempre aceito"
-    },
-    "settings.fileSharing.exceptions.remove": {
-        "message": "Remover exceção"
-    },
-    "files.state.unreachable": {
-        "message": "Recusado",
-        "description": "Failed-transfer reason: the peer's file drop port refused the offer."
-    },
-    "notify.filedrop.offer.title": {
-        "message": "Arquivo recebido"
-    },
-    "notify.filedrop.always": {
-        "message": "Sempre aceitar"
     }
 }

client/ui/i18n/locales/ru/common.json

@@ -1338,174 +1338,5 @@
     },
     "error.unknown": {
         "message": "Не удалось выполнить операцию."
-    },
-    "nav.files.title": {
-        "message": "Файлы"
-    },
-    "files.search.placeholder": {
-        "message": "Поиск передач по файлу или пиру"
-    },
-    "files.empty.title": {
-        "message": "Передач пока нет"
-    },
-    "files.empty.description": {
-        "message": "Отправленные и полученные файлы появятся здесь."
-    },
-    "files.group.today": {
-        "message": "Сегодня"
-    },
-    "files.group.yesterday": {
-        "message": "Вчера"
-    },
-    "files.offer.subtitle": {
-        "message": "{peer} хочет отправить"
-    },
-    "files.offer.accept": {
-        "message": "Принять"
-    },
-    "files.offer.decline": {
-        "message": "Отклонить"
-    },
-    "files.row.to": {
-        "message": "кому: {peer}"
-    },
-    "files.row.from": {
-        "message": "от {peer}"
-    },
-    "files.state.pending": {
-        "message": "Ожидание"
-    },
-    "files.state.transferring": {
-        "message": "Передача"
-    },
-    "files.state.progress": {
-        "message": "{percent}%"
-    },
-    "files.state.received": {
-        "message": "Получено"
-    },
-    "files.state.sent": {
-        "message": "Отправлено"
-    },
-    "files.state.declined": {
-        "message": "Отклонено"
-    },
-    "files.state.expired": {
-        "message": "Нет ответа"
-    },
-    "files.state.cancelled": {
-        "message": "Отменено"
-    },
-    "files.state.failed": {
-        "message": "Ошибка"
-    },
-    "files.action.copy": {
-        "message": "Копировать"
-    },
-    "files.action.reveal": {
-        "message": "Показать в папке"
-    },
-    "files.action.cancel": {
-        "message": "Отменить"
-    },
-    "files.action.more": {
-        "message": "Ещё"
-    },
-    "files.action.open": {
-        "message": "Открыть"
-    },
-    "files.action.alwaysAccept": {
-        "message": "Всегда принимать от этого пира"
-    },
-    "files.action.block": {
-        "message": "Заблокировать этого пира"
-    },
-    "files.action.delete": {
-        "message": "Удалить"
-    },
-    "peers.dropToSend": {
-        "message": "Отпустите для отправки"
-    },
-    "peers.details.sendFile": {
-        "message": "Отправить файл…"
-    },
-    "peers.details.sendClipboard": {
-        "message": "Отправить буфер обмена"
-    },
-    "peers.details.sendClipboard.empty": {
-        "message": "Буфер обмена пуст"
-    },
-    "settings.tabs.fileSharing": {
-        "message": "Обмен файлами"
-    },
-    "settings.fileSharing.section": {
-        "message": "Получение файлов"
-    },
-    "settings.fileSharing.loading": {
-        "message": "Загрузка…"
-    },
-    "settings.fileSharing.mode.label": {
-        "message": "Получать файлы от пиров"
-    },
-    "settings.fileSharing.mode.help": {
-        "message": "Как это устройство обрабатывает входящие предложения файлов."
-    },
-    "settings.fileSharing.mode.off": {
-        "message": "Выключено"
-    },
-    "settings.fileSharing.mode.off.help": {
-        "message": "Это устройство не принимает файлы."
-    },
-    "settings.fileSharing.mode.ask": {
-        "message": "Спрашивать каждый раз"
-    },
-    "settings.fileSharing.mode.ask.help": {
-        "message": "Каждое предложение сначала запрашивает согласие."
-    },
-    "settings.fileSharing.mode.auto": {
-        "message": "Автоприём"
-    },
-    "settings.fileSharing.mode.auto.help": {
-        "message": "Файлы приходят без подтверждения."
-    },
-    "settings.fileSharing.destination.label": {
-        "message": "Сохранять полученные файлы в"
-    },
-    "settings.fileSharing.destination.help": {
-        "message": "Полученные файлы помещаются в эту папку."
-    },
-    "settings.fileSharing.destination.unset": {
-        "message": "Не задано"
-    },
-    "settings.fileSharing.destination.change": {
-        "message": "Изменить…"
-    },
-    "settings.fileSharing.exceptions.label": {
-        "message": "Исключения для пиров"
-    },
-    "settings.fileSharing.exceptions.help": {
-        "message": "Переопределения поверх режима приёма."
-    },
-    "settings.fileSharing.exceptions.empty": {
-        "message": "Исключений нет."
-    },
-    "settings.fileSharing.exceptions.blocked": {
-        "message": "Заблокирован"
-    },
-    "settings.fileSharing.exceptions.always": {
-        "message": "Всегда принимается"
-    },
-    "settings.fileSharing.exceptions.remove": {
-        "message": "Удалить исключение"
-    },
-    "files.state.unreachable": {
-        "message": "Отклонено",
-        "description": "Failed-transfer reason: the peer's file drop port refused the offer."
-    },
-    "notify.filedrop.offer.title": {
-        "message": "Входящий файл"
-    },
-    "notify.filedrop.always": {
-        "message": "Всегда принимать"
     }
 }

client/ui/i18n/locales/zh-CN/common.json

@@ -1338,174 +1338,5 @@
     },
     "error.unknown": {
         "message": "操作失败。"
-    },
-    "nav.files.title": {
-        "message": "文件"
-    },
-    "files.search.placeholder": {
-        "message": "按文件或对等设备搜索传输"
-    },
-    "files.empty.title": {
-        "message": "暂无传输"
-    },
-    "files.empty.description": {
-        "message": "您发送或接收的文件将显示在这里。"
-    },
-    "files.group.today": {
-        "message": "今天"
-    },
-    "files.group.yesterday": {
-        "message": "昨天"
-    },
-    "files.offer.subtitle": {
-        "message": "{peer} 想要发送"
-    },
-    "files.offer.accept": {
-        "message": "接受"
-    },
-    "files.offer.decline": {
-        "message": "拒绝"
-    },
-    "files.row.to": {
-        "message": "发送至 {peer}"
-    },
-    "files.row.from": {
-        "message": "来自 {peer}"
-    },
-    "files.state.pending": {
-        "message": "等待中"
-    },
-    "files.state.transferring": {
-        "message": "传输中"
-    },
-    "files.state.progress": {
-        "message": "{percent}%"
-    },
-    "files.state.received": {
-        "message": "已接收"
-    },
-    "files.state.sent": {
-        "message": "已发送"
-    },
-    "files.state.declined": {
-        "message": "已拒绝"
-    },
-    "files.state.expired": {
-        "message": "无响应"
-    },
-    "files.state.cancelled": {
-        "message": "已取消"
-    },
-    "files.state.failed": {
-        "message": "失败"
-    },
-    "files.action.copy": {
-        "message": "复制"
-    },
-    "files.action.reveal": {
-        "message": "在文件夹中显示"
-    },
-    "files.action.cancel": {
-        "message": "取消"
-    },
-    "files.action.more": {
-        "message": "更多"
-    },
-    "files.action.open": {
-        "message": "打开"
-    },
-    "files.action.alwaysAccept": {
-        "message": "始终接受此对等设备"
-    },
-    "files.action.block": {
-        "message": "屏蔽此对等设备"
-    },
-    "files.action.delete": {
-        "message": "删除"
-    },
-    "peers.dropToSend": {
-        "message": "放开即发送"
-    },
-    "peers.details.sendFile": {
-        "message": "发送文件…"
-    },
-    "peers.details.sendClipboard": {
-        "message": "发送剪贴板"
-    },
-    "peers.details.sendClipboard.empty": {
-        "message": "剪贴板为空"
-    },
-    "settings.tabs.fileSharing": {
-        "message": "文件共享"
-    },
-    "settings.fileSharing.section": {
-        "message": "文件接收"
-    },
-    "settings.fileSharing.loading": {
-        "message": "加载中…"
-    },
-    "settings.fileSharing.mode.label": {
-        "message": "接收对等设备的文件"
-    },
-    "settings.fileSharing.mode.help": {
-        "message": "此设备如何处理传入的文件提议。"
-    },
-    "settings.fileSharing.mode.off": {
-        "message": "关闭"
-    },
-    "settings.fileSharing.mode.off.help": {
-        "message": "此设备不接受文件。"
-    },
-    "settings.fileSharing.mode.ask": {
-        "message": "每次询问"
-    },
-    "settings.fileSharing.mode.ask.help": {
-        "message": "每个提议都会先征求您的同意。"
-    },
-    "settings.fileSharing.mode.auto": {
-        "message": "自动接受"
-    },
-    "settings.fileSharing.mode.auto.help": {
-        "message": "文件无需交互即可到达。"
-    },
-    "settings.fileSharing.destination.label": {
-        "message": "接收文件保存至"
-    },
-    "settings.fileSharing.destination.help": {
-        "message": "接收的文件将存放到此文件夹。"
-    },
-    "settings.fileSharing.destination.unset": {
-        "message": "未设置"
-    },
-    "settings.fileSharing.destination.change": {
-        "message": "更改…"
-    },
-    "settings.fileSharing.exceptions.label": {
-        "message": "按对等设备的例外"
-    },
-    "settings.fileSharing.exceptions.help": {
-        "message": "覆盖接收模式的规则。"
-    },
-    "settings.fileSharing.exceptions.empty": {
-        "message": "无例外。"
-    },
-    "settings.fileSharing.exceptions.blocked": {
-        "message": "已屏蔽"
-    },
-    "settings.fileSharing.exceptions.always": {
-        "message": "始终接受"
-    },
-    "settings.fileSharing.exceptions.remove": {
-        "message": "移除例外"
-    },
-    "files.state.unreachable": {
-        "message": "已拒绝",
-        "description": "Failed-transfer reason: the peer's file drop port refused the offer."
-    },
-    "notify.filedrop.offer.title": {
-        "message": "传入文件"
-    },
-    "notify.filedrop.always": {
-        "message": "始终接受"
     }
 }

client/ui/main.go

@@ -56,7 +56,6 @@ func (s *stringList) Set(v string) error {
 
 type registeredServices struct {
 	connection      *services.Connection
-	fileDrop        *services.FileDrop
 	authSession     *authsession.Session
 	settings        *services.Settings
 	networks        *services.Networks
@@ -124,11 +123,9 @@ func main() {
 	// the React frontend calls, keeping the generated TS surface minimal.
 	authSession := authsession.NewSession(conn)
 	networks := services.NewNetworks(conn)
-	fileDrop := services.NewFileDrop(conn)
 
 	registerServices(app, conn, registeredServices{
 		connection:      connection,
-		fileDrop:        fileDrop,
 		authSession:     authSession,
 		settings:        settings,
 		networks:        networks,
@@ -173,7 +170,6 @@ func main() {
 
 	tray = NewTray(app, window, TrayServices{
 		Connection:      connection,
-		FileDrop:        fileDrop,
 		Settings:        settings,
 		Profiles:        profiles,
 		Networks:        networks,
@@ -330,7 +326,6 @@ func registerServices(app *application.App, conn *Conn, s registeredServices) {
 	app.RegisterService(application.NewService(services.NewForwarding(conn)))
 	app.RegisterService(application.NewService(s.profiles))
 	app.RegisterService(application.NewService(services.NewDebug(conn)))
-	app.RegisterService(application.NewService(s.fileDrop))
 	app.RegisterService(application.NewService(s.update))
 	app.RegisterService(application.NewService(s.daemonFeed))
 	app.RegisterService(application.NewService(s.notifier))
@@ -364,7 +359,6 @@ func newMainWindow(app *application.App, prefStore *preferences.Store) *applicat
 		BackgroundColour:    services.WindowBackgroundColour,
 		URL:                 "/",
 		DisableResize:       true,
-		EnableFileDrop:      true,
 		MinimiseButtonState: application.ButtonHidden,
 		MaximiseButtonState: application.ButtonHidden,
 		Mac:                 services.AppleMacOSAppearanceOptions(),
@@ -374,10 +368,6 @@ func newMainWindow(app *application.App, prefStore *preferences.Store) *applicat
 		},
 	})
 
-	window.RegisterHook(events.Common.WindowFilesDropped, func(e *application.WindowEvent) {
-		app.Event.Emit(services.EventFilesDropped, e.Context().DroppedFiles())
-	})
-
 	// Hide instead of quit on close; "really quit" is reached via tray -> Quit.
 	window.RegisterHook(events.Common.WindowClosing, func(e *application.WindowEvent) {
 		if services.ShuttingDown() {

client/ui/notifier.go

@@ -85,14 +85,6 @@ func (n *Notifier) SendNotificationWithActions(options notifications.Notificatio
 	return n.inner.SendNotificationWithActions(options)
 }
 
-// RemoveNotification withdraws a delivered notification, a no-op without a backend.
-func (n *Notifier) RemoveNotification(identifier string) error {
-	if !n.available.Load() {
-		return nil
-	}
-	return n.inner.RemoveNotification(identifier)
-}
-
 func (n *Notifier) RegisterNotificationCategory(category notifications.NotificationCategory) error {
 	if !n.available.Load() {
 		return nil

client/ui/services/connection.go

@@ -108,11 +108,10 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	}
 
 	req := &proto.LoginRequest{
-		ManagementUrl: p.ManagementURL,
-		SetupKey:      p.SetupKey,
-		Hostname:      p.Hostname,
-		// a login driven by the UI always has a graphical session available
-		IsUnixDesktopClient: true,
+		ManagementUrl:       p.ManagementURL,
+		SetupKey:            p.SetupKey,
+		Hostname:            p.Hostname,
+		IsUnixDesktopClient: runtime.GOOS == "linux",
 	}
 	if profileName != "" {
 		req.ProfileName = ptrStr(profileName)

client/ui/services/daemon_feed.go

@@ -33,9 +33,6 @@ const (
 	// subscribers needn't filter the notification firehose. Consumers branch on
 	// SessionWarning.Final to tell the T-10 event from the T-2 fallback.
 	EventSessionWarning = "netbird:session:warning"
-	// EventFileDrop is a typed sibling of EventDaemonNotification for file
-	// transfer milestones; the payload is a FileDropEvent.
-	EventFileDrop = "netbird:filedrop"
 
 	// StatusDaemonUnavailable is the synthetic Status emitted when the daemon's
 	// gRPC socket is unreachable. No internal.Status* collides with this label.
@@ -60,29 +57,6 @@ type Emitter interface {
 	Emit(name string, data ...any) bool
 }
 
-// FileDropEvent is the payload of EventFileDrop. Kind is one of "offer",
-// "completed", "failed", "withdrawn".
-type FileDropEvent struct {
-	Kind       string `json:"kind"`
-	TransferID string `json:"transferId"`
-	Message    string `json:"message"`
-}
-
-func fileDropEventKind(metaKind string) (string, bool) {
-	switch metaKind {
-	case proto.MetadataKindFileDropOffer:
-		return "offer", true
-	case proto.MetadataKindFileDropCompleted:
-		return "completed", true
-	case proto.MetadataKindFileDropFailed:
-		return "failed", true
-	case proto.MetadataKindFileDropWithdrawn:
-		return "withdrawn", true
-	default:
-		return "", false
-	}
-}
-
 // SystemEvent is the frontend-facing shape of a daemon SystemEvent.
 type SystemEvent struct {
 	ID          string            `json:"id"`
@@ -512,16 +486,6 @@ func (s *DaemonFeed) dispatchSystemEvent(ev *proto.SystemEvent) {
 		}
 		return
 	}
-	if kind, ok := fileDropEventKind(se.Metadata[proto.MetadataKindKey]); ok {
-		s.emitter.Emit(EventFileDrop, FileDropEvent{
-			Kind:       kind,
-			TransferID: se.Metadata[proto.MetadataFileDropTransferKey],
-			Message:    se.UserMessage,
-		})
-		if se.UserMessage == "" {
-			return
-		}
-	}
 	s.emitter.Emit(EventDaemonNotification, se)
 	if warn, ok := authsession.WarningFromMetadata(se.Metadata); ok {
 		s.emitter.Emit(EventSessionWarning, warn)

client/ui/services/filedrop.go

@@ -1,238 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package services
-
-import (
-	"context"
-	"errors"
-	"time"
-
-	"github.com/wailsapp/wails/v3/pkg/application"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// EventFilesDropped carries the absolute paths of files natively dropped on the
-// main window.
-const EventFilesDropped = "netbird:files:dropped"
-
-// FileDropFile mirrors one payload item of a transfer.
-type FileDropFile struct {
-	Name        string `json:"name"`
-	Size        int64  `json:"size"`
-	ContentType string `json:"contentType"`
-	IsText      bool   `json:"isText"`
-	Text        string `json:"text"`
-}
-
-// FileDropTransfer mirrors proto.FileDropTransfer for the frontend.
-type FileDropTransfer struct {
-	ID             string         `json:"id"`
-	Outgoing       bool           `json:"outgoing"`
-	PeerKey        string         `json:"peerKey"`
-	PeerName       string         `json:"peerName"`
-	Files          []FileDropFile `json:"files"`
-	State          int32          `json:"state"`
-	Transferred    int64          `json:"transferred"`
-	TotalSize      int64          `json:"totalSize"`
-	CreatedAt      time.Time      `json:"createdAt"`
-	UpdatedAt      time.Time      `json:"updatedAt"`
-	DeliveredPaths []string       `json:"deliveredPaths"`
-	Error          string         `json:"error"`
-	Reason         int32          `json:"reason"`
-}
-
-// FileDropSettings mirrors the daemon's receiving policy with ordinal enums.
-type FileDropSettings struct {
-	Mode           int32            `json:"mode"`
-	DestinationDir string           `json:"destinationDir"`
-	PeerRules      map[string]int32 `json:"peerRules"`
-}
-
-// FileDrop bridges the daemon's file transfer RPCs to the frontend.
-type FileDrop struct {
-	conn DaemonConn
-}
-
-func NewFileDrop(conn DaemonConn) *FileDrop {
-	return &FileDrop{conn: conn}
-}
-
-// List returns the transfer history, newest first.
-func (s *FileDrop) List(ctx context.Context) ([]FileDropTransfer, error) {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return nil, err
-	}
-	resp, err := cli.FileDropListTransfers(ctx, &proto.FileDropListTransfersRequest{})
-	if err != nil {
-		return nil, err
-	}
-
-	out := make([]FileDropTransfer, 0, len(resp.GetTransfers()))
-	for _, t := range resp.GetTransfers() {
-		out = append(out, fileDropTransferFromProto(t))
-	}
-	return out, nil
-}
-
-// Send starts a transfer of local files and/or an inline text to a peer.
-func (s *FileDrop) Send(ctx context.Context, peerKey string, paths []string, text string) (string, error) {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return "", err
-	}
-	resp, err := cli.FileDropSend(ctx, &proto.FileDropSendRequest{
-		PeerKey: peerKey,
-		Paths:   paths,
-		Text:    text,
-	})
-	if err != nil {
-		return "", err
-	}
-	return resp.GetTransferId(), nil
-}
-
-// PickFiles opens the native file picker; an empty result means cancelled.
-func (s *FileDrop) PickFiles(_ context.Context) ([]string, error) {
-	return application.Get().Dialog.OpenFile().PromptForMultipleSelection()
-}
-
-// PickDirectory opens the native directory picker; empty means cancelled.
-func (s *FileDrop) PickDirectory(_ context.Context) (string, error) {
-	return application.Get().Dialog.OpenFile().
-		CanChooseDirectories(true).
-		CanChooseFiles(false).
-		PromptForSingleSelection()
-}
-
-// Decide accepts or declines a pending incoming offer.
-func (s *FileDrop) Decide(ctx context.Context, id string, accept bool) error {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return err
-	}
-	_, err = cli.FileDropDecide(ctx, &proto.FileDropDecideRequest{TransferId: id, Accept: accept})
-	return err
-}
-
-// Cancel aborts a transfer.
-func (s *FileDrop) Cancel(ctx context.Context, id string) error {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return err
-	}
-	_, err = cli.FileDropCancel(ctx, &proto.FileDropCancelRequest{TransferId: id})
-	return err
-}
-
-// Delete removes a history entry.
-func (s *FileDrop) Delete(ctx context.Context, id string) error {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return err
-	}
-	_, err = cli.FileDropDeleteTransfer(ctx, &proto.FileDropDeleteTransferRequest{TransferId: id})
-	return err
-}
-
-// GetSettings returns the receiving policy of the active profile.
-func (s *FileDrop) GetSettings(ctx context.Context) (FileDropSettings, error) {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return FileDropSettings{}, err
-	}
-	resp, err := cli.FileDropGetSettings(ctx, &proto.FileDropGetSettingsRequest{})
-	if err != nil {
-		return FileDropSettings{}, err
-	}
-
-	rules := make(map[string]int32, len(resp.GetPeerRules()))
-	for key, rule := range resp.GetPeerRules() {
-		rules[key] = int32(rule)
-	}
-	return FileDropSettings{
-		Mode:           int32(resp.GetMode()),
-		DestinationDir: resp.GetDestinationDir(),
-		PeerRules:      rules,
-	}, nil
-}
-
-// SetSettings updates the receiving policy of the active profile.
-func (s *FileDrop) SetSettings(ctx context.Context, settings FileDropSettings) error {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return err
-	}
-	_, err = cli.FileDropSetSettings(ctx, &proto.FileDropSetSettingsRequest{
-		Mode:           proto.FileDropMode(settings.Mode),
-		DestinationDir: settings.DestinationDir,
-	})
-	return err
-}
-
-// SetPeerRule sets or clears a per-sender exception.
-func (s *FileDrop) SetPeerRule(ctx context.Context, peerKey string, rule int32) error {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return err
-	}
-	_, err = cli.FileDropSetPeerRule(ctx, &proto.FileDropSetPeerRuleRequest{
-		PeerKey: peerKey,
-		Rule:    proto.FileDropRule(rule),
-	})
-	return err
-}
-
-// ClipboardText returns the current clipboard text, empty when unavailable.
-func (s *FileDrop) ClipboardText(_ context.Context) string {
-	text, ok := application.Get().Clipboard.Text()
-	if !ok {
-		return ""
-	}
-	return text
-}
-
-// Reveal opens the OS file manager focused on a delivered file.
-func (s *FileDrop) Reveal(_ context.Context, path string) error {
-	if path == "" {
-		return errors.New("empty path")
-	}
-	return revealFile(path)
-}
-
-// Open opens a delivered file with its default application.
-func (s *FileDrop) Open(_ context.Context, path string) error {
-	if path == "" {
-		return errors.New("empty path")
-	}
-	return openFile(path)
-}
-
-func fileDropTransferFromProto(t *proto.FileDropTransfer) FileDropTransfer {
-	files := make([]FileDropFile, 0, len(t.GetFiles()))
-	for _, f := range t.GetFiles() {
-		files = append(files, FileDropFile{
-			Name:        f.GetName(),
-			Size:        f.GetSize(),
-			ContentType: f.GetContentType(),
-			IsText:      f.GetIsText(),
-			Text:        f.GetText(),
-		})
-	}
-	return FileDropTransfer{
-		ID:             t.GetId(),
-		Outgoing:       t.GetOutgoing(),
-		PeerKey:        t.GetPeerKey(),
-		PeerName:       t.GetPeerName(),
-		Files:          files,
-		State:          int32(t.GetState()),
-		Transferred:    t.GetTransferred(),
-		TotalSize:      t.GetTotalSize(),
-		CreatedAt:      t.GetCreatedAt().AsTime(),
-		UpdatedAt:      t.GetUpdatedAt().AsTime(),
-		DeliveredPaths: append([]string{}, t.GetDeliveredPaths()...),
-		Error:          t.GetError(),
-		Reason:         int32(t.GetReason()),
-	}
-}

client/ui/services/openfile_other.go

@@ -1,16 +0,0 @@
-//go:build !android && !ios && !freebsd && !js && !windows
-
-package services
-
-import (
-	"os/exec"
-	"runtime"
-)
-
-func openFile(path string) error {
-	opener := "xdg-open"
-	if runtime.GOOS == "darwin" {
-		opener = "open"
-	}
-	return exec.Command(opener, path).Start()
-}