[client] Address review comments on DNS lazy-connection warm-up

- Use netip.Addr instead of string IPs in the local resolver's
  PeerConnectivity and PeerActivator interfaces; extract record
  addresses as netip.Addr (v4-mapped forms unmapped) and convert to
  string only at the peer.Status boundary.
- Scope warm-up to match-only (non-authoritative) zones so the
  synthesized private-service records keep warming while plain
  peer-name lookups in the authoritative peer zone no longer wake
  every idle peer.
- Parse NB_DNS_LAZY_WARMUP_TIMEOUT once in the resolver constructor
  instead of on every request, and log invalid values.
- Stop reusing engine.syncMsgMux on the DNS path: ConnMgr.ActivatePeer
  is now safe for concurrent use (lazy manager pointer guarded by a
  dedicated RWMutex; the manager itself is internally synchronized),
  so network-map processing no longer blocks DNS resolution.
- Add SetPeerActivator to the dns.Server interface (no-op on the mock)
  and drop the *dns.DefaultServer type assertion in the engine.
- Drop WireGuard wording from dns/local comments; the layer is
  transport-agnostic.

Tests: authoritative zones never trigger warm-up; warm-up timeout env
parsing (valid/invalid/non-positive); extractRecordAddr unmaps
v4-mapped record data; dnsPeerActivator skips connected/unknown/
conn-less peers, returns on connect, and releases at the budget when
the peer stays idle; ConnMgr.ActivatePeer races the manager lifecycle
cleanly under -race.

.github/workflows/frontend-ui.yml

@@ -86,7 +86,7 @@ jobs:
             ${{ runner.os }}-pnpm-
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile --ignore-scripts
+        run: pnpm install --frozen-lockfile
 
       - name: Generate Wails bindings
         run: pnpm run bindings

client/internal/auth/sessionwatch/watcher.go

@@ -24,7 +24,11 @@ import (
 )
 
 const (
-	maxPastHorizon = 30 * 24 * time.Hour
+	// Skew tolerates a small clock difference between the management
+	// server and this peer before treating a deadline as "in the past".
+	// Slightly above typical NTP drift; tight enough that the UI doesn't
+	// paint a stale expiry as if it were valid.
+	Skew = 30 * time.Second
 
 	// maxDeadlineHorizon caps how far in the future an accepted deadline
 	// can sit. A timestamp beyond this is almost certainly a protocol
@@ -53,7 +57,7 @@ var (
 	ErrDeadlineTooFarFuture = errors.New("session deadline too far in the future")
 
 	// ErrDeadlineInPast is returned by Update when the supplied deadline
-	// is more than maxPastHorizon in the past.
+	// is more than Skew in the past.
 	ErrDeadlineInPast = errors.New("session deadline in the past")
 )
 
@@ -62,14 +66,15 @@ var (
 // for deadline change/clear, PublishEvent for the two warnings); tests pass
 // a fake recorder so the same surface is observable without an engine.
 //
-// While the watcher runs, it owns the deadline propagated to the recorder:
-// every set, clear and sanity-check rejection routes the value through
-// SetSessionExpiresAt, so the SubscribeStatus snapshot the UI reads can
-// never drift from the watcher's timer state. (SetSessionExpiresAt fans
-// out its own state-change notification, so no separate notify is needed.)
-// The recorder is server-scoped and outlives this engine-scoped watcher;
-// Close deliberately leaves the recorder value in place so transient engine
-// restarts don't blank it — the client run loop clears it on real teardown.
+// The watcher is the single owner of the deadline propagated to the
+// recorder: every set, clear, sanity-check rejection and Close routes the
+// value through SetSessionExpiresAt, so the SubscribeStatus snapshot the UI
+// reads can never drift from the watcher's timer state. (SetSessionExpiresAt
+// fans out its own state-change notification, so no separate notify is
+// needed.) The recorder is server-scoped and outlives this engine-scoped
+// watcher — without the Close-time clear a teardown (Down, or the Down+Up of
+// a profile switch) would leave the next session showing the previous one's
+// stale "expires in" value.
 //
 // PublishEvent's signature mirrors peer.Status.PublishEvent: the watcher
 // composes the metadata internally so the wire format (MetaSession*) is
@@ -130,13 +135,10 @@ func NewWithLeads(lead, final time.Duration, recorder StatusRecorder) *Watcher {
 // was disabled).
 //
 // Same-value updates are no-ops. A different non-zero value cancels any
-// pending timer, resets the "already fired" guards, and — when the
-// deadline lies in the future — arms fresh warning timers. A deadline
-// already in the past (within maxPastHorizon) is recorded as-is with no
-// timers: the session has expired and consumers render it that way.
+// pending timer, resets the "already fired" guard, and arms a new one.
 //
 // Returns one of the sentinel Err* values when the deadline fails the
-// sanity checks (pre-epoch, far future, or past beyond maxPastHorizon).
+// sanity checks (pre-epoch, far future, or in the past beyond Skew).
 // In every error case the watcher first clears its state so it stays
 // consistent with what the caller will push into its other sinks (e.g.
 // applySessionDeadline forces a zero deadline into the status recorder
@@ -161,7 +163,7 @@ func (w *Watcher) Update(deadline time.Time) error {
 	case deadline.After(now.Add(maxDeadlineHorizon)):
 		w.clearLocked()
 		return fmt.Errorf("%w: %v", ErrDeadlineTooFarFuture, deadline)
-	case deadline.Before(now.Add(-maxPastHorizon)):
+	case deadline.Before(now.Add(-Skew)):
 		w.clearLocked()
 		return fmt.Errorf("%w: %v (now=%v)", ErrDeadlineInPast, deadline, now)
 	}
@@ -181,9 +183,7 @@ func (w *Watcher) Update(deadline time.Time) error {
 	w.finalFiredAt = time.Time{}
 	w.dismissedAt = time.Time{}
 
-	if deadline.After(now) {
-		w.armTimerLocked(deadline)
-	}
+	w.armTimerLocked(deadline)
 	recorder := w.recorder
 	w.mu.Unlock()
 	if recorder != nil {
@@ -227,25 +227,30 @@ func (w *Watcher) Dismiss() {
 	log.Infof("auth session final-warning dismissed for deadline %s", w.current.Format(time.RFC3339))
 }
 
-// Close stops any pending timer. Update calls after Close are ignored.
-// The recorder keeps its deadline: the watcher is engine-scoped and closes
-// on every engine restart (network change, sleep/wake, stream errors)
-// while the SSO deadline stays valid across those, so clearing here would
-// blank the UI's "expires in" row on every transient reconnect. The
-// client run loop clears the server-scoped recorder when it exits for
-// real (Down, profile switch, permanent login failure).
+// Close stops any pending timer and drops the deadline on the status
+// recorder. Update calls after Close are ignored. Clearing the recorder
+// here is what keeps a teardown (Down, or the Down+Up of a profile switch)
+// from leaving the next session showing this one's stale "expires in"
+// value — the recorder is server-scoped and outlives this engine-scoped
+// watcher, so nothing else drops the anchor on teardown.
 func (w *Watcher) Close() {
 	w.mu.Lock()
-	defer w.mu.Unlock()
 	if w.closed {
+		w.mu.Unlock()
 		return
 	}
 	w.closed = true
 	w.stopTimerLocked()
+	hadDeadline := !w.current.IsZero()
 	w.current = time.Time{}
 	w.firedAt = time.Time{}
 	w.finalFiredAt = time.Time{}
 	w.dismissedAt = time.Time{}
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder != nil && hadDeadline {
+		recorder.SetSessionExpiresAt(time.Time{})
+	}
 }
 
 // clearLocked drops the tracked deadline and notifies the recorder so

client/internal/auth/sessionwatch/watcher_test.go

@@ -224,13 +224,11 @@ func TestNewDeadlineCancelsPriorTimer(t *testing.T) {
 
 func TestRefreshAfterFireArmsNewWarning(t *testing.T) {
 	r := &fakeRecorder{}
-	lead := 150 * time.Millisecond
+	lead := 30 * time.Millisecond
 	w := newWatcher(lead, r)
 	defer w.Close()
 
-	// Warning fires ~20ms in; the deadline itself stays 150ms away so the
-	// replacement below lands well before it.
-	first := time.Now().Add(170 * time.Millisecond)
+	first := time.Now().Add(50 * time.Millisecond)
 	_ = w.Update(first)
 
 	// Wait for stateChange + warning of the first cycle.
@@ -308,29 +306,7 @@ func TestUpdateRejectsTooFarFuture(t *testing.T) {
 	}
 }
 
-func TestUpdateRecentPastRecordedAsExpired(t *testing.T) {
-	r := &fakeRecorder{}
-	w := newWatcher(50*time.Millisecond, r)
-	defer w.Close()
-
-	d := time.Now().Add(-1 * time.Hour)
-	if err := w.Update(d); err != nil {
-		t.Fatalf("recent-past Update should succeed, got %v", err)
-	}
-	if !w.Deadline().Equal(d) {
-		t.Fatalf("expected deadline to be recorded, got %v want %v", w.Deadline(), d)
-	}
-	if got := r.deadline(); !got.Equal(d) {
-		t.Fatalf("recorder deadline = %v, want %v", got, d)
-	}
-
-	time.Sleep(80 * time.Millisecond)
-	if n := countWhere(r.snapshot(), func(e event) bool { return e.kind == publish }); n != 0 {
-		t.Fatalf("no warning events may fire for an already-past deadline, got %+v", r.snapshot())
-	}
-}
-
-func TestUpdateAncientPastRejected(t *testing.T) {
+func TestUpdateInPastClearsDeadline(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(50*time.Millisecond, r)
 	defer w.Close()
@@ -342,12 +318,12 @@ func TestUpdateAncientPastRejected(t *testing.T) {
 	// Drain the stateChange from the seed.
 	waitForEvents(t, r, 1)
 
-	err := w.Update(time.Now().Add(-31 * 24 * time.Hour))
+	err := w.Update(time.Now().Add(-1 * time.Hour))
 	if !errors.Is(err, ErrDeadlineInPast) {
 		t.Fatalf("want ErrDeadlineInPast, got %v", err)
 	}
 	if !w.Deadline().IsZero() {
-		t.Fatalf("rejected ancient-past update must clear the deadline, got %v", w.Deadline())
+		t.Fatalf("in-past update must clear the deadline, got %v", w.Deadline())
 	}
 	events := waitForEvents(t, r, 2)
 	if events[1].kind != stateChange {
@@ -355,25 +331,39 @@ func TestUpdateAncientPastRejected(t *testing.T) {
 	}
 }
 
+func TestUpdateWithinSkewAccepted(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	// 5 seconds in the past is within the 30s Skew tolerance — accept it.
+	d := time.Now().Add(-5 * time.Second)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("within-skew Update should succeed, got %v", err)
+	}
+	if !w.Deadline().Equal(d) {
+		t.Fatalf("expected deadline to be applied, got %v want %v", w.Deadline(), d)
+	}
+}
+
 func TestCloseSilencesUpdates(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(50*time.Millisecond, r)
 	w.Close()
 
-	if err := w.Update(time.Now().Add(time.Hour)); err != nil {
-		t.Fatalf("Update after Close: want nil, got %v", err)
-	}
+	_ = w.Update(time.Now().Add(time.Hour))
+
+	time.Sleep(20 * time.Millisecond)
 	if got := r.snapshot(); len(got) != 0 {
 		t.Fatalf("expected no events after Close, got %+v", got)
 	}
 }
 
-// TestCloseKeepsRecorderDeadline pins the reconnect-flap fix: the watcher
-// closes on every engine restart (network change, sleep/wake) while the
-// SSO deadline stays valid across those, so Close must leave the
-// server-scoped recorder's value in place. The client run loop clears the
-// recorder when it exits for real.
-func TestCloseKeepsRecorderDeadline(t *testing.T) {
+// TestCloseClearsRecorderDeadline pins the profile-switch fix: a watcher
+// holding a live deadline must zero the recorder on Close so the next
+// engine's watcher (and the UI reading the shared server-scoped recorder)
+// doesn't start out showing the previous session's stale "expires in".
+func TestCloseClearsRecorderDeadline(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(time.Hour, r)
 
@@ -387,8 +377,8 @@ func TestCloseKeepsRecorderDeadline(t *testing.T) {
 
 	w.Close()
 
-	if got := r.deadline(); !got.Equal(d) {
-		t.Fatalf("recorder deadline after Close = %v, want %v", got, d)
+	if got := r.deadline(); !got.IsZero() {
+		t.Fatalf("recorder deadline after Close = %v, want zero", got)
 	}
 }
 

client/internal/conn_mgr.go

@@ -34,6 +34,8 @@ const (
 // - Handling connection establishment based on peer signaling
 //
 // The implementation is not thread-safe; it is protected by engine.syncMsgMux.
+// The only exception is ActivatePeer, which is safe for concurrent use so the
+// DNS warm-up path can call it without contending on the engine mutex.
 type ConnMgr struct {
 	peerStore        *peerstore.Store
 	statusRecorder   *peer.Status
@@ -42,6 +44,10 @@ type ConnMgr struct {
 	rosenpassEnabled bool
 
 	lazyConnMgr *manager.Manager
+	// lazyConnMgrMu guards the lazyConnMgr pointer for readers outside the
+	// engine loop (ActivatePeer). Writers hold it in addition to
+	// engine.syncMsgMux; all other reads stay under engine.syncMsgMux only.
+	lazyConnMgrMu sync.RWMutex
 
 	wg            sync.WaitGroup
 	lazyCtx       context.Context
@@ -238,12 +244,20 @@ func (e *ConnMgr) RemovePeerConn(peerKey string) {
 	conn.Log.Infof("removed peer from lazy conn manager")
 }
 
+// ActivatePeer wakes an idle lazy connection. Unlike the rest of ConnMgr it is
+// safe for concurrent use: the lazy manager pointer is read under lazyConnMgrMu
+// and the manager itself is internally synchronized, so callers outside the
+// engine loop (DNS warm-up) do not need engine.syncMsgMux.
 func (e *ConnMgr) ActivatePeer(ctx context.Context, conn *peer.Conn) {
-	if !e.isStartedWithLazyMgr() {
+	e.lazyConnMgrMu.RLock()
+	lazyConnMgr := e.lazyConnMgr
+	started := lazyConnMgr != nil && e.lazyCtxCancel != nil
+	e.lazyConnMgrMu.RUnlock()
+	if !started {
 		return
 	}
 
-	if found := e.lazyConnMgr.ActivatePeer(conn.GetKey()); found {
+	if found := lazyConnMgr.ActivatePeer(conn.GetKey()); found {
 		if err := conn.Open(ctx); err != nil {
 			conn.Log.Errorf("failed to open connection: %v", err)
 		}
@@ -268,16 +282,21 @@ func (e *ConnMgr) Close() {
 
 	e.lazyCtxCancel()
 	e.wg.Wait()
+
+	e.lazyConnMgrMu.Lock()
 	e.lazyConnMgr = nil
+	e.lazyConnMgrMu.Unlock()
 }
 
 func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
 	cfg := manager.Config{
 		InactivityThreshold: inactivityThresholdEnv(),
 	}
-	e.lazyConnMgr = manager.NewManager(cfg, engineCtx, e.peerStore, e.iface)
 
+	e.lazyConnMgrMu.Lock()
+	e.lazyConnMgr = manager.NewManager(cfg, engineCtx, e.peerStore, e.iface)
 	e.lazyCtx, e.lazyCtxCancel = context.WithCancel(engineCtx)
+	e.lazyConnMgrMu.Unlock()
 
 	e.wg.Add(1)
 	go func() {
@@ -316,7 +335,10 @@ func (e *ConnMgr) closeManager(ctx context.Context) {
 
 	e.lazyCtxCancel()
 	e.wg.Wait()
+
+	e.lazyConnMgrMu.Lock()
 	e.lazyConnMgr = nil
+	e.lazyConnMgrMu.Unlock()
 
 	for _, peerID := range e.peerStore.PeersPubKey() {
 		e.peerStore.PeerConnOpen(ctx, peerID)

client/internal/conn_mgr_test.go

@@ -1,10 +1,21 @@
 package internal
 
 import (
+	"context"
+	"net"
+	"net/netip"
 	"os"
+	"sync"
 	"testing"
+	"time"
 
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/peerstore"
+	"github.com/netbirdio/netbird/monotime"
 )
 
 func TestResolveLazyForce(t *testing.T) {
@@ -38,3 +49,58 @@ func TestResolveLazyForce(t *testing.T) {
 		})
 	}
 }
+
+type mockLazyWGIface struct{}
+
+func (mockLazyWGIface) RemovePeer(string) error { return nil }
+func (mockLazyWGIface) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
+	return nil
+}
+func (mockLazyWGIface) IsUserspaceBind() bool                    { return false }
+func (mockLazyWGIface) Address() wgaddr.Address                  { return wgaddr.Address{} }
+func (mockLazyWGIface) LastActivities() map[string]monotime.Time { return nil }
+func (mockLazyWGIface) MTU() uint16                              { return 1280 }
+
+// TestConnMgr_ActivatePeerConcurrentWithLifecycle exercises ActivatePeer from
+// non-engine goroutines (the DNS warm-up path) racing the manager lifecycle,
+// which stays on the engine loop. Run with -race: it fails if ActivatePeer
+// still requires engine.syncMsgMux for safety.
+func TestConnMgr_ActivatePeerConcurrentWithLifecycle(t *testing.T) {
+	t.Setenv(lazyconn.EnvLazyConn, "on")
+
+	status := peer.NewRecorder("https://mgm")
+	store := peerstore.NewConnStore()
+	connMgr := NewConnMgr(&EngineConfig{}, status, store, mockLazyWGIface{})
+
+	conn := newTestPeerConn(t, "peerA")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	connMgr.Start(ctx)
+
+	done := make(chan struct{})
+	var wg sync.WaitGroup
+	for range 4 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for {
+				select {
+				case <-done:
+					return
+				default:
+					connMgr.ActivatePeer(ctx, conn)
+				}
+			}
+		}()
+	}
+
+	// Let the activators spin against the started manager, then tear it down
+	// underneath them and let them spin against the stopped manager.
+	time.Sleep(100 * time.Millisecond)
+	connMgr.Close()
+	time.Sleep(50 * time.Millisecond)
+
+	close(done)
+	wg.Wait()
+}

client/internal/connect.go

@@ -257,10 +257,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		log.Errorf("failed to clean up temporary installer file: %v", err)
 	}
 
-	defer func() {
-		c.statusRecorder.SetSessionExpiresAt(time.Time{})
-		c.statusRecorder.ClientStop()
-	}()
+	defer c.statusRecorder.ClientStop()
 	operation := func() error {
 		// if context cancelled we not start new backoff cycle
 		if c.ctx.Err() != nil {

client/internal/dns/local/local.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
+	"os"
 	"slices"
 	"strings"
 	"sync"
@@ -36,7 +37,43 @@ type resolver interface {
 // record is left alone (it points at something outside our mesh, e.g.
 // a non-peer upstream).
 type PeerConnectivity interface {
-	IsConnectedByIP(ip string) (known, connected bool)
+	IsConnectedByIP(ip netip.Addr) (known, connected bool)
+}
+
+// PeerActivator wakes lazy-connection peers on demand. The local resolver calls
+// it with the tunnel IPs an answer points at, so a peer that is idle (lazily
+// disconnected) starts connecting at DNS-resolution time rather than racing the
+// client's first request packet. nil disables warm-up.
+type PeerActivator interface {
+	// ActivatePeersByIP triggers wake-up for the peer(s) owning addrs and blocks
+	// until one is connected or ctx (a short per-query budget) expires. It is a
+	// fast no-op for unknown or already-connected addresses.
+	ActivatePeersByIP(ctx context.Context, addrs []netip.Addr)
+}
+
+const (
+	defaultLazyWarmupTimeout = 2 * time.Second
+	envLazyWarmupTimeout     = "NB_DNS_LAZY_WARMUP_TIMEOUT"
+)
+
+// lazyWarmupTimeoutFromEnv returns the per-query budget for waking a
+// lazy-connection peer a DNS answer points at. Tunable via
+// NB_DNS_LAZY_WARMUP_TIMEOUT (a Go duration). Parsed once at construction time.
+func lazyWarmupTimeoutFromEnv() time.Duration {
+	v := os.Getenv(envLazyWarmupTimeout)
+	if v == "" {
+		return defaultLazyWarmupTimeout
+	}
+	d, err := time.ParseDuration(v)
+	if err != nil {
+		log.Warnf("invalid %s value %q, using default %s: %v", envLazyWarmupTimeout, v, defaultLazyWarmupTimeout, err)
+		return defaultLazyWarmupTimeout
+	}
+	if d <= 0 {
+		log.Warnf("non-positive %s value %q, using default %s", envLazyWarmupTimeout, v, defaultLazyWarmupTimeout)
+		return defaultLazyWarmupTimeout
+	}
+	return d
 }
 
 type Resolver struct {
@@ -51,6 +88,12 @@ type Resolver struct {
 	// filter and preserves the legacy "return whatever is registered"
 	// behaviour for callers that never wire a status source.
 	peerConn PeerConnectivity
+	// peerActivator, when non-nil, is called at resolution time to warm the
+	// lazy connection to the peer(s) an answer points at. nil disables warm-up.
+	peerActivator PeerActivator
+	// warmupTimeout is the per-query budget for the lazy-connection warm-up
+	// wait, resolved from the environment once at construction time.
+	warmupTimeout time.Duration
 
 	ctx    context.Context
 	cancel context.CancelFunc
@@ -59,11 +102,12 @@ type Resolver struct {
 func NewResolver() *Resolver {
 	ctx, cancel := context.WithCancel(context.Background())
 	return &Resolver{
-		records: make(map[dns.Question][]dns.RR),
-		domains: make(map[domain.Domain]struct{}),
-		zones:   make(map[domain.Domain]bool),
-		ctx:     ctx,
-		cancel:  cancel,
+		records:       make(map[dns.Question][]dns.RR),
+		domains:       make(map[domain.Domain]struct{}),
+		zones:         make(map[domain.Domain]bool),
+		warmupTimeout: lazyWarmupTimeoutFromEnv(),
+		ctx:           ctx,
+		cancel:        cancel,
 	}
 }
 
@@ -76,6 +120,14 @@ func (d *Resolver) SetPeerConnectivity(p PeerConnectivity) {
 	d.peerConn = p
 }
 
+// SetPeerActivator wires the DNS-time lazy-connection warm-up. Pass nil to
+// disable. Safe to call multiple times; the latest value wins.
+func (d *Resolver) SetPeerActivator(a PeerActivator) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	d.peerActivator = a
+}
+
 func (d *Resolver) MatchSubdomains() bool {
 	return true
 }
@@ -122,6 +174,9 @@ func (d *Resolver) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 	replyMessage.RecursionAvailable = true
 
 	result := d.lookupRecords(logger, question)
+	// Warm before filtering: activation flips a lazily-idle target to connected,
+	// which then lets it survive the disconnected-peer filter below.
+	d.warmLazyPeers(question, result.records)
 	result.records = d.filterDisconnectedPeerAnswers(logger, question, result.records)
 	replyMessage.Authoritative = !result.hasExternalData
 	replyMessage.Answer = result.records
@@ -495,8 +550,8 @@ func (d *Resolver) filterDisconnectedPeerAnswers(logger *log.Entry, question dns
 	kept := make([]dns.RR, 0, len(records))
 	var dropped int
 	for _, rr := range records {
-		ip := extractRecordIP(rr)
-		if ip == "" {
+		ip, ok := extractRecordAddr(rr)
+		if !ok {
 			kept = append(kept, rr)
 			continue
 		}
@@ -518,22 +573,54 @@ func (d *Resolver) filterDisconnectedPeerAnswers(logger *log.Entry, question dns
 	return kept
 }
 
-// extractRecordIP returns the dotted-decimal / colon-hex IP carried by
-// an A or AAAA record, or "" for any other record type.
-func extractRecordIP(rr dns.RR) string {
+// warmLazyPeers triggers lazy-connection wake-up for the peers a resolved
+// answer points at and waits briefly for one to connect, so the caller's first
+// request doesn't race the connection establishment. Warm-up is scoped to
+// match-only (non-authoritative) zones — the synthesized private-service zones
+// and user-created zones whose records point at specific peers. The account's
+// peer zone is authoritative, so plain peer-name lookups never trigger warm-up;
+// otherwise resolving any peer's name would wake its idle connection, defeating
+// laziness mesh-wide. No-op when no activator is wired (lazy connections
+// disabled) or the answer carries no peer IPs.
+func (d *Resolver) warmLazyPeers(question dns.Question, records []dns.RR) {
+	d.mu.RLock()
+	activator := d.peerActivator
+	var nonAuth, found bool
+	if activator != nil {
+		nonAuth, found = d.findZone(question.Name)
+	}
+	d.mu.RUnlock()
+	if activator == nil || !found || !nonAuth {
+		return
+	}
+
+	var addrs []netip.Addr
+	for _, rr := range records {
+		if addr, ok := extractRecordAddr(rr); ok {
+			addrs = append(addrs, addr)
+		}
+	}
+	if len(addrs) == 0 {
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(d.ctx, d.warmupTimeout)
+	defer cancel()
+	activator.ActivatePeersByIP(ctx, addrs)
+}
+
+// extractRecordAddr returns the IP address carried by an A or AAAA record.
+// ok is false for any other record type or a record with no address.
+func extractRecordAddr(rr dns.RR) (netip.Addr, bool) {
 	switch r := rr.(type) {
 	case *dns.A:
-		if r.A == nil {
-			return ""
-		}
-		return r.A.String()
+		addr, ok := netip.AddrFromSlice(r.A)
+		return addr.Unmap(), ok
 	case *dns.AAAA:
-		if r.AAAA == nil {
-			return ""
-		}
-		return r.AAAA.String()
+		addr, ok := netip.AddrFromSlice(r.AAAA)
+		return addr.Unmap(), ok
 	}
-	return ""
+	return netip.Addr{}, false
 }
 
 // Update replaces all zones and their records

client/internal/dns/local/local_test.go

@@ -37,8 +37,8 @@ type mockPeerConnectivity struct {
 	byIP map[string]struct{ known, connected bool }
 }
 
-func (m mockPeerConnectivity) IsConnectedByIP(ip string) (known, connected bool) {
-	v, ok := m.byIP[ip]
+func (m mockPeerConnectivity) IsConnectedByIP(ip netip.Addr) (known, connected bool) {
+	v, ok := m.byIP[ip.String()]
 	if !ok {
 		return false, false
 	}

client/internal/dns/local/warmup_test.go

@@ -0,0 +1,172 @@
+package local
+
+import (
+	"context"
+	"net"
+	"net/netip"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/dns/test"
+	nbdns "github.com/netbirdio/netbird/dns"
+)
+
+// recordingActivator records the addresses it was asked to warm and returns
+// immediately, so ServeDNS is not blocked by the test.
+type recordingActivator struct {
+	mu     sync.Mutex
+	called bool
+	addrs  []netip.Addr
+}
+
+func (r *recordingActivator) ActivatePeersByIP(_ context.Context, addrs []netip.Addr) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.called = true
+	r.addrs = append(r.addrs, addrs...)
+}
+
+func serveA(t *testing.T, resolver *Resolver, name string) *dns.Msg {
+	t.Helper()
+	var resp *dns.Msg
+	w := &test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}
+	resolver.ServeDNS(w, new(dns.Msg).SetQuestion(name, dns.TypeA))
+	return resp
+}
+
+// serviceZone registers rec in a match-only (non-authoritative) zone, the shape
+// the synthesized private-service zones arrive in.
+func serviceZone(t *testing.T, resolver *Resolver, zone string, records ...nbdns.SimpleRecord) {
+	t.Helper()
+	resolver.Update([]nbdns.CustomZone{{
+		Domain:           zone,
+		Records:          records,
+		NonAuthoritative: true,
+	}})
+}
+
+func TestLocalResolver_WarmsLazyPeerOnResolve(t *testing.T) {
+	rec := nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"}
+	resolver := NewResolver()
+	serviceZone(t, resolver, "proxy.netbird.cloud", rec)
+
+	act := &recordingActivator{}
+	resolver.SetPeerActivator(act)
+
+	resp := serveA(t, resolver, rec.Name)
+	require.NotNil(t, resp, "resolver must answer")
+	require.NotEmpty(t, resp.Answer, "answer must carry the A record")
+
+	act.mu.Lock()
+	defer act.mu.Unlock()
+	assert.True(t, act.called, "activator must be invoked for a service-zone A answer")
+	assert.Contains(t, act.addrs, netip.MustParseAddr("100.64.0.7"), "activator must receive the answer's peer IP")
+}
+
+func TestLocalResolver_NoActivatorNoWarmup(t *testing.T) {
+	// With no activator wired the resolver behaves exactly as before.
+	rec := nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"}
+	resolver := NewResolver()
+	serviceZone(t, resolver, "proxy.netbird.cloud", rec)
+
+	resp := serveA(t, resolver, rec.Name)
+	require.NotNil(t, resp, "resolver must still answer without an activator")
+	require.NotEmpty(t, resp.Answer, "answer must carry the A record")
+}
+
+func TestLocalResolver_NoWarmupForMissingRecord(t *testing.T) {
+	// A query that resolves to nothing must not invoke the activator (no IPs).
+	resolver := NewResolver()
+	serviceZone(t, resolver, "proxy.netbird.cloud",
+		nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"})
+
+	act := &recordingActivator{}
+	resolver.SetPeerActivator(act)
+
+	serveA(t, resolver, "absent.proxy.netbird.cloud.")
+
+	act.mu.Lock()
+	defer act.mu.Unlock()
+	assert.False(t, act.called, "activator must not be invoked when there is no answer")
+}
+
+func TestLocalResolver_NoWarmupInAuthoritativeZone(t *testing.T) {
+	// The account's peer zone is authoritative; resolving a peer's name there
+	// must not wake its lazy connection — warm-up is scoped to match-only
+	// (non-authoritative) zones such as the synthesized private-service zones.
+	rec := nbdns.SimpleRecord{Name: "peer.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.9"}
+	resolver := NewResolver()
+	resolver.Update([]nbdns.CustomZone{{
+		Domain:  "netbird.cloud",
+		Records: []nbdns.SimpleRecord{rec},
+	}})
+
+	act := &recordingActivator{}
+	resolver.SetPeerActivator(act)
+
+	resp := serveA(t, resolver, rec.Name)
+	require.NotNil(t, resp, "resolver must answer")
+	require.NotEmpty(t, resp.Answer, "answer must carry the A record")
+
+	act.mu.Lock()
+	defer act.mu.Unlock()
+	assert.False(t, act.called, "activator must not be invoked for authoritative-zone answers")
+}
+
+func TestLazyWarmupTimeoutFromEnv(t *testing.T) {
+	tests := []struct {
+		name   string
+		value  string
+		envSet bool
+		want   time.Duration
+	}{
+		{name: "unset uses default", want: defaultLazyWarmupTimeout},
+		{name: "valid overrides", value: "5s", envSet: true, want: 5 * time.Second},
+		{name: "invalid falls back", value: "not-a-duration", envSet: true, want: defaultLazyWarmupTimeout},
+		{name: "negative falls back", value: "-1s", envSet: true, want: defaultLazyWarmupTimeout},
+		{name: "zero falls back", value: "0s", envSet: true, want: defaultLazyWarmupTimeout},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.envSet {
+				t.Setenv(envLazyWarmupTimeout, tt.value)
+			}
+			assert.Equal(t, tt.want, lazyWarmupTimeoutFromEnv())
+			assert.Equal(t, tt.want, NewResolver().warmupTimeout, "constructor must resolve the timeout once")
+		})
+	}
+}
+
+func TestExtractRecordAddr(t *testing.T) {
+	t.Run("A record yields unmapped v4", func(t *testing.T) {
+		// net.ParseIP returns the 16-byte v4-in-v6 form, the same shape
+		// miekg/dns stores after parsing an A record; the extracted address
+		// must compare equal to a plain v4 netip.Addr.
+		addr, ok := extractRecordAddr(&dns.A{A: net.ParseIP("100.64.0.7")})
+		require.True(t, ok)
+		assert.True(t, addr.Is4())
+		assert.Equal(t, netip.MustParseAddr("100.64.0.7"), addr)
+	})
+
+	t.Run("AAAA record yields v6", func(t *testing.T) {
+		addr, ok := extractRecordAddr(&dns.AAAA{AAAA: net.ParseIP("fd00::1")})
+		require.True(t, ok)
+		assert.Equal(t, netip.MustParseAddr("fd00::1"), addr)
+	})
+
+	t.Run("A record without address", func(t *testing.T) {
+		_, ok := extractRecordAddr(&dns.A{})
+		assert.False(t, ok)
+	})
+
+	t.Run("non-address record", func(t *testing.T) {
+		_, ok := extractRecordAddr(&dns.CNAME{Target: "target.netbird.cloud."})
+		assert.False(t, ok)
+	})
+}

client/internal/dns/mock_server.go

@@ -8,6 +8,7 @@ import (
 	"github.com/miekg/dns"
 
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
+	"github.com/netbirdio/netbird/client/internal/dns/local"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -92,6 +93,11 @@ func (m *MockServer) SetFirewall(Firewall) {
 	// Mock implementation - no-op
 }
 
+// SetPeerActivator mock implementation of SetPeerActivator from Server interface
+func (m *MockServer) SetPeerActivator(local.PeerActivator) {
+	// Mock implementation - no-op
+}
+
 // BeginBatch mock implementation of BeginBatch from Server interface
 func (m *MockServer) BeginBatch() {
 	// Mock implementation - no-op

client/internal/dns/server.go

@@ -82,6 +82,7 @@ type Server interface {
 	PopulateManagementDomain(mgmtURL *url.URL) error
 	SetRouteSources(selected, active func() route.HAMap)
 	SetFirewall(Firewall)
+	SetPeerActivator(local.PeerActivator)
 }
 
 type nsGroupsByDomain struct {
@@ -491,6 +492,13 @@ func (s *DefaultServer) SetFirewall(fw Firewall) {
 	}
 }
 
+// SetPeerActivator wires the DNS-time lazy-connection warm-up on the local
+// resolver. Injected after the connection manager exists (it does not at
+// DNS-server construction time). Pass nil to disable.
+func (s *DefaultServer) SetPeerActivator(a local.PeerActivator) {
+	s.localResolver.SetPeerActivator(a)
+}
+
 // Stop stops the server
 func (s *DefaultServer) Stop() {
 	s.ctxCancel()
@@ -1435,11 +1443,11 @@ type localPeerConnectivity struct {
 
 // IsConnectedByIP looks the IP up in the peerstore and surfaces both
 // the known and connected bits. Used by Resolver.filterDisconnectedPeerAnswers.
-func (l localPeerConnectivity) IsConnectedByIP(ip string) (known, connected bool) {
+func (l localPeerConnectivity) IsConnectedByIP(ip netip.Addr) (known, connected bool) {
 	if l.status == nil {
 		return false, false
 	}
-	state, ok := l.status.PeerStateByIP(ip)
+	state, ok := l.status.PeerStateByIP(ip.String())
 	if !ok {
 		return false, false
 	}

client/internal/dns_peer_activator.go

@@ -0,0 +1,76 @@
+package internal
+
+import (
+	"context"
+	"net/netip"
+	"time"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/peerstore"
+)
+
+const dnsActivationPollInterval = 50 * time.Millisecond
+
+// dnsPeerActivator wakes lazy-connection peers from the DNS resolution path. It
+// implements dns/local.PeerActivator. DNS queries run on their own goroutines,
+// so it only touches state that is safe for concurrent use — ConnMgr.ActivatePeer,
+// peerstore.Store and peer.Status — and never takes the engine's syncMsgMux,
+// keeping DNS resolution from contending with network-map processing.
+type dnsPeerActivator struct {
+	connMgr   *ConnMgr
+	peerStore *peerstore.Store
+	status    *peer.Status
+	// ctx is the engine's long-lived context. The connection dial is tied to it
+	// (not the per-query DNS wait budget) so a handshake that outlasts the wait
+	// still completes in the background rather than being cancelled at the deadline.
+	ctx context.Context
+}
+
+// ActivatePeersByIP triggers wake-up for the peer(s) owning addrs and waits
+// until one is connected or ctx (the per-query DNS wait budget) expires.
+// Activation itself is tied to the engine's long-lived context so the dial
+// survives a wait that times out. Unknown or already-connected addresses are
+// skipped, so the steady-state (warm) path adds no latency.
+func (a *dnsPeerActivator) ActivatePeersByIP(ctx context.Context, addrs []netip.Addr) {
+	if a == nil || a.connMgr == nil {
+		return
+	}
+
+	var pending []string
+	for _, addr := range addrs {
+		ip := addr.String()
+		st, ok := a.status.PeerStateByIP(ip)
+		if !ok || st.ConnStatus == peer.StatusConnected {
+			continue
+		}
+		conn, ok := a.peerStore.PeerConn(st.PubKey)
+		if !ok {
+			continue
+		}
+		a.connMgr.ActivatePeer(a.ctx, conn)
+		pending = append(pending, ip)
+	}
+
+	if len(pending) == 0 {
+		return
+	}
+	a.waitConnected(ctx, pending)
+}
+
+// waitConnected blocks until any of ips reports a connected peer or ctx expires.
+func (a *dnsPeerActivator) waitConnected(ctx context.Context, ips []string) {
+	ticker := time.NewTicker(dnsActivationPollInterval)
+	defer ticker.Stop()
+	for {
+		for _, ip := range ips {
+			if st, ok := a.status.PeerStateByIP(ip); ok && st.ConnStatus == peer.StatusConnected {
+				return
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+	}
+}

client/internal/dns_peer_activator_test.go

@@ -0,0 +1,129 @@
+package internal
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/peerstore"
+)
+
+func newTestPeerConn(t *testing.T, key string) *peer.Conn {
+	t.Helper()
+	conn, err := peer.NewConn(peer.ConnConfig{
+		Key:      key,
+		LocalKey: "local",
+		WgConfig: peer.WgConfig{
+			AllowedIps: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
+		},
+	}, peer.ServiceDependencies{})
+	require.NoError(t, err)
+	return conn
+}
+
+func newTestDNSPeerActivator(t *testing.T) (*dnsPeerActivator, *peer.Status, *peerstore.Store) {
+	t.Helper()
+	status := peer.NewRecorder("https://mgm")
+	store := peerstore.NewConnStore()
+	// ConnMgr without Start: the lazy manager is nil, so ActivatePeer is a
+	// no-op — these tests exercise the activator's skip/wait logic.
+	connMgr := NewConnMgr(&EngineConfig{}, status, store, nil)
+	return &dnsPeerActivator{
+		connMgr:   connMgr,
+		peerStore: store,
+		status:    status,
+		ctx:       context.Background(),
+	}, status, store
+}
+
+func TestDNSPeerActivator_NilSafe(t *testing.T) {
+	var a *dnsPeerActivator
+	a.ActivatePeersByIP(context.Background(), []netip.Addr{netip.MustParseAddr("100.64.0.1")})
+}
+
+// TestDNSPeerActivator_SkipsUnknownAndConnectedPeers verifies the steady-state
+// (warm) path adds no latency: already-connected and unknown addresses never
+// enter the wait loop.
+func TestDNSPeerActivator_SkipsUnknownAndConnectedPeers(t *testing.T) {
+	a, status, store := newTestDNSPeerActivator(t)
+
+	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", "fd00::1"))
+	require.NoError(t, status.UpdatePeerState(peer.State{PubKey: "peerA", ConnStatus: peer.StatusConnected}))
+	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	start := time.Now()
+	a.ActivatePeersByIP(ctx, []netip.Addr{
+		netip.MustParseAddr("100.64.0.1"),  // known, connected -> skipped
+		netip.MustParseAddr("fd00::1"),     // known via IPv6, connected -> skipped
+		netip.MustParseAddr("100.64.0.99"), // unknown -> skipped
+	})
+	require.Less(t, time.Since(start), time.Second, "no pending peer must mean no wait")
+}
+
+// TestDNSPeerActivator_WaitsForPendingPeerToConnect verifies the wait loop
+// returns as soon as a pending peer reports connected, well before the
+// per-query budget expires.
+func TestDNSPeerActivator_WaitsForPendingPeerToConnect(t *testing.T) {
+	a, status, store := newTestDNSPeerActivator(t)
+
+	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
+	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
+
+	go func() {
+		time.Sleep(150 * time.Millisecond)
+		_ = status.UpdatePeerState(peer.State{PubKey: "peerA", ConnStatus: peer.StatusConnected})
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	start := time.Now()
+	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
+	elapsed := time.Since(start)
+
+	require.GreaterOrEqual(t, elapsed, 100*time.Millisecond, "must wait for the pending peer")
+	require.Less(t, elapsed, 5*time.Second, "must return on connect, not at the deadline")
+}
+
+// TestDNSPeerActivator_ReturnsAtBudgetWhenPeerStaysIdle verifies a peer that
+// never connects releases the DNS response at the per-query budget instead of
+// blocking it indefinitely.
+func TestDNSPeerActivator_ReturnsAtBudgetWhenPeerStaysIdle(t *testing.T) {
+	a, status, store := newTestDNSPeerActivator(t)
+
+	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
+	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 300*time.Millisecond)
+	defer cancel()
+
+	start := time.Now()
+	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
+	elapsed := time.Since(start)
+
+	require.GreaterOrEqual(t, elapsed, 250*time.Millisecond, "must wait out the budget for a pending peer")
+	require.Less(t, elapsed, 5*time.Second, "must not block past the budget")
+}
+
+// TestDNSPeerActivator_NoWaitWithoutPeerConn verifies a known-but-idle peer
+// with no connection object in the store is not waited on: there is nothing to
+// activate, so waiting could only ever time out.
+func TestDNSPeerActivator_NoWaitWithoutPeerConn(t *testing.T) {
+	a, status, _ := newTestDNSPeerActivator(t)
+
+	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	start := time.Now()
+	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
+	require.Less(t, time.Since(start), time.Second, "peer without a conn must not be waited on")
+}

client/internal/engine.go

@@ -654,6 +654,16 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	e.connMgr = NewConnMgr(e.config, e.statusRecorder, e.peerStore, wgIface)
 	e.connMgr.Start(e.ctx)
 
+	// Wire DNS-time lazy-connection warm-up now that the connection manager
+	// exists (it does not at DNS-server construction time). A DNS answer that
+	// points at an idle peer then wakes it before the client's first request.
+	e.dnsServer.SetPeerActivator(&dnsPeerActivator{
+		connMgr:   e.connMgr,
+		peerStore: e.peerStore,
+		status:    e.statusRecorder,
+		ctx:       e.ctx,
+	})
+
 	e.srWatcher = guard.NewSRWatcher(e.signal, e.relayManager, e.mobileDep.IFaceDiscover, iceCfg)
 	e.srWatcher.Start(peer.IsForceRelayed())
 

client/internal/engine_session_deadline_test.go

@@ -75,14 +75,4 @@ func TestApplySessionDeadline_ThreeState(t *testing.T) {
 		require.True(t, e.statusRecorder.GetSessionExpiresAt().IsZero(),
 			"invalid timestamp must clear the deadline")
 	})
-
-	t.Run("recently expired timestamp stays visible as expired", func(t *testing.T) {
-		e := newEngine()
-		expired := time.Now().Add(-5 * time.Minute).UTC().Truncate(time.Second)
-
-		e.ApplySessionDeadline(timestamppb.New(expired))
-
-		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(expired),
-			"recently-expired deadline must stay on the recorder so consumers render it as expired")
-	})
 }

client/internal/peer/status.go

@@ -813,14 +813,19 @@ func (d *Status) SetSessionExpiresAt(deadline time.Time) {
 }
 
 // GetSessionExpiresAt returns the most recently recorded SSO session deadline,
-// or the zero value when no deadline is tracked. A deadline in the past is
-// returned as-is: it means the session has expired, and consumers (tray row,
-// CLI status) render it as "expired" rather than hiding it — masking it as
-// "none" would blank the UI at the exact moment it should say the session
-// ended.
+// or the zero value when no deadline is tracked. A deadline that has already
+// slipped into the past reports as "none": once the session has expired it is
+// no longer a meaningful countdown, and the sessionwatch.Watcher does not
+// arm a timer at the deadline itself to clear it (only the two pre-expiry
+// warnings). Without this guard the UI would keep painting a stale
+// "expires in …" against a moment that has passed until the next login,
+// extend, or teardown rewrote the value.
 func (d *Status) GetSessionExpiresAt() time.Time {
 	d.mux.Lock()
 	defer d.mux.Unlock()
+	if !d.sessionExpiresAt.IsZero() && d.sessionExpiresAt.Before(time.Now()) {
+		return time.Time{}
+	}
 	return d.sessionExpiresAt
 }
 

client/ui/autostart_default.go

@@ -51,7 +51,7 @@ func autostartDisabledByMDM(policy *mdm.Policy) bool {
 // netbirdFootprintExists reports whether the machine already carries NetBird
 // daemon config or state, meaning this is not a genuinely fresh install. It is
 // the update-safety gate for the autostart default: upgrading users always
-// have a footprint, so an update can never trigger a autostart entry write.
+// have a footprint, so an update can never trigger a login-item write.
 func netbirdFootprintExists() bool {
 	candidates := []string{
 		profilemanager.DefaultConfigPath,
@@ -69,23 +69,9 @@ func netbirdFootprintExists() bool {
 // applyAutostartDefault runs the one-time launch-on-login default for genuinely
 // fresh installs. The autostartInitialized marker is persisted before any
 // enable attempt so a crash mid-flow degrades to "never enabled" instead of
-// retrying autostart entry writes on every launch. A user's later disable in
+// retrying login-item writes on every launch. A user's later disable in
 // Settings is never overridden: the marker guarantees at-most-once, ever.
 func applyAutostartDefault(ctx context.Context, autostart *services.Autostart, prefs *preferences.Store, prefsFileExisted bool) {
-	mdmDisabled := autostartDisabledByMDM(mdm.LoadPolicy())
-
-	if mdmDisabled {
-		if enabled, err := autostart.IsEnabled(ctx); err != nil {
-			log.Warnf("MDM disableAutostart: read autostart state: %v", err)
-		} else if enabled {
-			if err := autostart.SetEnabled(ctx, false); err != nil {
-				log.Warnf("MDM disableAutostart: force off failed: %v", err)
-			} else {
-				log.Info("MDM disableAutostart enforced: autostart turned off")
-			}
-		}
-	}
-
 	priorFootprint := netbirdFootprintExists() || prefsFileExisted
 
 	if prefs.Get().AutostartInitialized {
@@ -98,7 +84,7 @@ func applyAutostartDefault(ctx context.Context, autostart *services.Autostart, p
 
 	state := autostartDefaultState{
 		supported:    autostart.Supported(ctx),
-		mdmDisabled:  mdmDisabled,
+		mdmDisabled:  autostartDisabledByMDM(mdm.LoadPolicy()),
 		priorInstall: priorFootprint,
 	}
 	enable, reason := shouldEnableAutostartDefault(state)

client/ui/services/autostart.go

@@ -10,7 +10,7 @@ import (
 	"github.com/wailsapp/wails/v3/pkg/application"
 )
 
-// Autostart facade over Wails' AutostartManager. The OS autostart entry registration
+// Autostart facade over Wails' AutostartManager. The OS login-item registration
 // is the single source of truth; nothing is mirrored to preferences.
 type Autostart struct {
 	mgr *application.AutostartManager

client/ui/tray.go

@@ -317,7 +317,8 @@ func (t *Tray) relayoutMenu() {
 		if sessionDeadline.IsZero() {
 			t.sessionExpiresItem.SetHidden(true)
 		} else {
-			t.sessionExpiresItem.SetLabel(t.sessionRowLabel(sessionDeadline))
+			remaining := t.formatSessionRemaining(time.Until(sessionDeadline))
+			t.sessionExpiresItem.SetLabel(t.loc.T("tray.session.expiresIn", "remaining", remaining))
 			t.sessionExpiresItem.SetHidden(false)
 		}
 	}

client/ui/tray_session.go

@@ -64,42 +64,11 @@ func (t *Tray) applySessionExpiry(deadline *time.Time, connected bool) bool {
 	return changed
 }
 
-// runSessionExpiryTicker recomputes the "Expires in …" row label until process exit.
-// The interval scales with the remaining time: coarse when the deadline is far off,
-// down to 10s in the final two minutes so the label doesn't lag the ceiling-rounded
-// countdown near expiry. The cached deadline is re-read every iteration, so an extend
-// or reconnect that moves it is picked up on the next tick.
+// runSessionExpiryTicker recomputes the "Expires in …" row label every 30s. Runs until process exit.
 func (t *Tray) runSessionExpiryTicker() {
-	tm := time.NewTimer(sessionRefreshInterval(t.sessionRemaining()))
-	defer tm.Stop()
-	for range tm.C {
+	tk := time.NewTicker(30 * time.Second)
+	for range tk.C {
 		t.refreshSessionExpiresLabel()
-		tm.Reset(sessionRefreshInterval(t.sessionRemaining()))
-	}
-}
-
-// sessionRemaining returns the time left on the cached SSO deadline, or 0 when unknown.
-func (t *Tray) sessionRemaining() time.Duration {
-	t.sessionMu.Lock()
-	deadline := t.sessionExpiresAt
-	t.sessionMu.Unlock()
-	if deadline.IsZero() {
-		return 0
-	}
-	return time.Until(deadline)
-}
-
-// sessionRefreshInterval picks how long to wait before the next label recompute.
-func sessionRefreshInterval(remaining time.Duration) time.Duration {
-	switch {
-	case remaining <= 0:
-		return 30 * time.Second
-	case remaining <= 2*time.Minute:
-		return 10 * time.Second
-	case remaining <= time.Hour:
-		return 30 * time.Second
-	default:
-		return time.Minute
 	}
 }
 
@@ -118,39 +87,30 @@ func (t *Tray) refreshSessionExpiresLabel() {
 	if deadline.IsZero() {
 		return
 	}
-	item.SetLabel(t.sessionRowLabel(deadline))
-}
-
-func (t *Tray) sessionRowLabel(deadline time.Time) string {
-	remaining := time.Until(deadline)
-	if remaining <= 0 {
-		return t.loc.T("tray.status.sessionExpired")
-	}
-	return t.loc.T("tray.session.expiresIn", "remaining", t.formatSessionRemaining(remaining))
+	remaining := t.formatSessionRemaining(time.Until(deadline))
+	item.SetLabel(t.loc.T("tray.session.expiresIn", "remaining", remaining))
 }
 
 // formatSessionRemaining renders d as a localised long-form string picking the largest non-zero unit.
-// Each unit is rounded up so the label never claims less time than actually remains, matching the
-// upper-bound sense of the sub-minute "less than a minute" fragment.
 // Singular/plural keys are split per language for proper translation.
 func (t *Tray) formatSessionRemaining(d time.Duration) string {
 	switch {
 	case d < time.Minute:
 		return t.loc.T("tray.session.unit.lessThanMinute")
-	case d <= 59*time.Minute:
-		m := ceilDiv(d, time.Minute)
+	case d < time.Hour:
+		m := int(d / time.Minute)
 		if m == 1 {
 			return t.loc.T("tray.session.unit.minute")
 		}
 		return t.loc.T("tray.session.unit.minutes", "count", strconv.Itoa(m))
-	case d <= 23*time.Hour:
-		h := ceilDiv(d, time.Hour)
+	case d < 24*time.Hour:
+		h := int((d + 30*time.Minute) / time.Hour)
 		if h == 1 {
 			return t.loc.T("tray.session.unit.hour")
 		}
 		return t.loc.T("tray.session.unit.hours", "count", strconv.Itoa(h))
 	default:
-		days := ceilDiv(d, 24*time.Hour)
+		days := int((d + 12*time.Hour) / (24 * time.Hour))
 		if days == 1 {
 			return t.loc.T("tray.session.unit.day")
 		}
@@ -158,11 +118,6 @@ func (t *Tray) formatSessionRemaining(d time.Duration) string {
 	}
 }
 
-// ceilDiv divides d by unit rounding up, assuming d > 0.
-func ceilDiv(d, unit time.Duration) int {
-	return int((d + unit - time.Nanosecond) / unit)
-}
-
 // registerSessionWarningCategory wires the OS notification category and response handler for the expiry warning.
 // Errors are swallowed since the worst case is a plain notification without buttons.
 func (t *Tray) registerSessionWarningCategory() {
@@ -297,9 +252,11 @@ func (t *Tray) openSessionExpiration() {
 }
 
 // openSessionExtendFlow opens the SessionExpiration window seeded with the cached deadline's remaining time,
-// for the "Expires in …" tray row. Once the deadline has elapsed the row reads "Session expired" and the
-// click routes to the login flow instead. No-op when the deadline is unknown.
+// for the "Expires in …" tray row. No-ops when the deadline is unknown or elapsed.
 func (t *Tray) openSessionExtendFlow() {
+	if t.svc.WindowManager == nil {
+		return
+	}
 	t.sessionMu.Lock()
 	deadline := t.sessionExpiresAt
 	t.sessionMu.Unlock()
@@ -308,14 +265,6 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
-		if t.window != nil {
-			t.window.SetURL("/#/login")
-			t.window.Show()
-			t.window.Focus()
-		}
-		return
-	}
-	if t.svc.WindowManager == nil {
 		return
 	}
 	t.svc.WindowManager.OpenSessionExpiration(seconds)

docs/io.netbird.client.plist

@@ -66,9 +66,6 @@
     <key>disableAutoConnect</key>
     <false/>
 
-    <key>disableAutostart</key>
-    <false/>
-
     <key>disableClientRoutes</key>
     <false/>
 

docs/netbird-macos.mobileconfig

@@ -103,8 +103,6 @@
                                 <!--
                                 <key>disableAutoConnect</key>
                                 <false/>
-                                <key>disableAutostart</key>
-                                <false/>
                                 <key>disableClientRoutes</key>
                                 <false/>
                                 <key>disableServerRoutes</key>

docs/netbird-macos.sh

@@ -58,7 +58,6 @@ preSharedKey="$NULL"                       # secret; redacted in log
 allowServerSSH='true'
 blockInbound="$NULL"
 disableAutoConnect="$NULL"
-disableAutostart="$NULL"
 disableClientRoutes="$NULL"
 disableServerRoutes="$NULL"
 disableMetricsCollection="$NULL"
@@ -156,7 +155,6 @@ main() {
   is_set "$allowServerSSH"            && emit_bool    allowServerSSH            "$allowServerSSH"
   is_set "$blockInbound"              && emit_bool    blockInbound              "$blockInbound"
   is_set "$disableAutoConnect"        && emit_bool    disableAutoConnect        "$disableAutoConnect"
-  is_set "$disableAutostart"          && emit_bool    disableAutostart          "$disableAutostart"
   is_set "$disableClientRoutes"       && emit_bool    disableClientRoutes       "$disableClientRoutes"
   is_set "$disableServerRoutes"       && emit_bool    disableServerRoutes       "$disableServerRoutes"
   is_set "$disableMetricsCollection"  && emit_bool    disableMetricsCollection  "$disableMetricsCollection"

docs/netbird.adml

@@ -24,9 +24,6 @@
       <string id="DisableAutoConnect_Name">Disable auto-connect</string>
       <string id="DisableAutoConnect_Help">When enabled, the NetBird tunnel does not auto-connect at daemon startup. Equivalent to --disable-auto-connect.</string>
 
-      <string id="DisableAutostart_Name">Disable autostart</string>
-      <string id="DisableAutostart_Help">When enabled, the NetBird GUI is prevented from registering itself as an OS autostart entry on fresh installs, and any existing OS autostart entry registration is removed on the next GUI launch (Windows Registry Run key, macOS Login Item, Linux .desktop). Once the admin lifts the policy, the setting stays off until the user re-enables it in Settings.</string>
-
       <string id="DisableClientRoutes_Name">Disable client routes</string>
       <string id="DisableClientRoutes_Help">When enabled, this client will not consume routes advertised by routing peers. Equivalent to --disable-client-routes.</string>
 

docs/netbird.admx

@@ -64,18 +64,6 @@
       <disabledValue><decimal value="0" /></disabledValue>
     </policy>
 
-    <policy name="DisableAutostart"
-            class="Machine"
-            displayName="$(string.DisableAutostart_Name)"
-            explainText="$(string.DisableAutostart_Help)"
-            key="Software\Policies\NetBird"
-            valueName="DisableAutostart">
-      <parentCategory ref="NetBird" />
-      <supportedOn ref="SUPPORTED_NetBird_All" />
-      <enabledValue><decimal value="1" /></enabledValue>
-      <disabledValue><decimal value="0" /></disabledValue>
-    </policy>
-
     <policy name="DisableClientRoutes"
             class="Machine"
             displayName="$(string.DisableClientRoutes_Name)"

e2e/agentnetwork/chat_test.go

@@ -91,7 +91,14 @@ func availableProviders() []providerCase {
 		if region == "" {
 			region = "us-east-1"
 		}
-		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: "us.anthropic.claude-haiku-4-5", kind: harness.WireBedrock})
+		// A valid Bedrock inference-profile id (region prefix + date + version),
+		// overridable per account. `global.` profiles can be invoked from any
+		// region; set AWS_BEDROCK_MODEL to match the enabled profile for the token.
+		model := os.Getenv("AWS_BEDROCK_MODEL")
+		if model == "" {
+			model = "global.anthropic.claude-haiku-4-5-20251001-v1:0"
+		}
+		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: model, kind: harness.WireBedrock})
 	}
 	return ps
 }
@@ -108,8 +115,16 @@ func providerRequest(pc providerCase) api.AgentNetworkProviderRequest {
 		Enabled:     ptr(true),
 	}
 	if pc.kind != harness.WireVertex {
+		// The router matches the normalized catalog id. Bedrock's request model
+		// travels as a region-prefixed inference-profile id in the URL path
+		// (us.anthropic...), which the router strips before matching, so register
+		// the normalized form here or routing fails as model_not_routable.
+		modelID := pc.model
+		if pc.kind == harness.WireBedrock {
+			modelID = catalogModel(pc)
+		}
 		req.Models = &[]api.AgentNetworkProviderModel{
-			{Id: pc.model, InputPer1k: 0.001, OutputPer1k: 0.002},
+			{Id: modelID, InputPer1k: 0.001, OutputPer1k: 0.002},
 		}
 	}
 	return req
@@ -201,11 +216,13 @@ func TestProvidersMatrix(t *testing.T) {
 	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
 
 	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Resolve first: the DNS lookup triggers the lazy-connection warm-up, waking
+	// the proxy peer so WaitProxyPeer then observes it connected.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
 	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
 		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
 	}
-	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
-	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
 
 	for _, pc := range matrix {
 		pc := pc

e2e/agentnetwork/guardrail_test.go

@@ -4,6 +4,7 @@ package agentnetwork
 
 import (
 	"context"
+	"regexp"
 	"strings"
 	"testing"
 	"time"
@@ -15,13 +16,29 @@ import (
 	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
+// bedrockRegionPrefixes and bedrockVersionSuffix mirror the proxy's Bedrock
+// model normalization (region/inference-profile prefix + version suffix) so the
+// provider is registered under the same catalog key the router matches against.
+var (
+	bedrockRegionPrefixes = []string{"us.", "eu.", "apac.", "global."}
+	bedrockVersionSuffix  = regexp.MustCompile(`-(\d{8}-)?v\d+(:\d+)?$`)
+)
+
 // catalogModel returns the normalized catalog id the proxy stamps for a
-// path-routed provider's configured model — the form the guardrail allowlist is
-// compared against (region prefix / @version stripped).
+// path-routed provider's configured model — the form the router and guardrail
+// allowlist compare against (Bedrock region prefix + version stripped, Vertex
+// @version stripped).
 func catalogModel(pc providerCase) string {
 	switch pc.kind {
 	case harness.WireBedrock:
-		return strings.TrimPrefix(pc.model, "us.")
+		m := pc.model
+		for _, p := range bedrockRegionPrefixes {
+			if strings.HasPrefix(m, p) {
+				m = m[len(p):]
+				break
+			}
+		}
+		return bedrockVersionSuffix.ReplaceAllString(m, "")
 	case harness.WireVertex:
 		return strings.SplitN(pc.model, "@", 2)[0]
 	default:
@@ -147,11 +164,13 @@ func TestModelAllowlistEnforced(t *testing.T) {
 	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
 
 	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Resolve first: the DNS lookup triggers the lazy-connection warm-up, waking
+	// the proxy peer so WaitProxyPeer then observes it connected.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
 	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
 		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
 	}
-	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
-	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
 
 	for _, pc := range providers {
 		pc := pc

e2e/agentnetwork/skiptls_test.go

@@ -104,11 +104,13 @@ func TestProviderSkipTLSVerification(t *testing.T) {
 	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
 
 	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Resolve first: the DNS lookup triggers the lazy-connection warm-up, waking
+	// the proxy peer so WaitProxyPeer then observes it connected.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
 	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
 		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
 	}
-	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
-	require.NoError(t, err, "resolve endpoint to proxy IP")
 
 	// Positive: skip=true reaches the self-signed upstream. Retry to absorb
 	// tunnel/DNS jitter on the first call; success also proves the path works.

e2e/agentnetwork/vllm_test.go

@@ -106,11 +106,13 @@ func TestVLLMProvider(t *testing.T) {
 	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
 
 	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Resolve first: the DNS lookup triggers the lazy-connection warm-up, waking
+	// the proxy peer so WaitProxyPeer then observes it connected.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
 	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
 		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
 	}
-	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
-	require.NoError(t, err, "resolve endpoint to proxy IP")
 
 	before, _ := srv.ListAccessLogs(ctx)
 	sessionID := "e2e-session-vllm"