[client] Guard browser-login cleanup on user close

client/internal/debug/debug.go

@@ -480,6 +480,7 @@ func (g *BundleGenerator) addStatus() error {
 
 		fullStatus := g.statusRecorder.GetFullStatus()
 		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
+		protoFullStatus.Events = g.statusRecorder.GetEventHistory()
 		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, nbstatus.ConvertOptions{
 			Anonymize:     g.anonymize,
 			ProfileName:   profName,

client/mdm/canonical_loaders.go

@@ -22,7 +22,6 @@ var allKeys = []string{
 	KeyDisableMetricsCollection,
 	KeyAllowServerSSH,
 	KeyDisableAutoConnect,
-	KeyDisableAutostart,
 	KeyPreSharedKey,
 	KeyRosenpassEnabled,
 	KeyRosenpassPermissive,

client/mdm/policy.go

@@ -20,10 +20,10 @@ import (
 // names (lowerCamelCase) so the daemon can map a Policy key directly to a
 // configuration field.
 const (
-	KeyManagementURL         = "managementURL"
-	KeyDisableUpdateSettings = "disableUpdateSettings"
-	KeyDisableProfiles       = "disableProfiles"
-	KeyDisableNetworks       = "disableNetworks"
+	KeyManagementURL            = "managementURL"
+	KeyDisableUpdateSettings    = "disableUpdateSettings"
+	KeyDisableProfiles          = "disableProfiles"
+	KeyDisableNetworks          = "disableNetworks"
 	// KeyDisableAdvancedView gates the advanced-view section in the
 	// upcoming UI revision. UI-only: NOT stored on Config, not
 	// applied by applyMDMPolicy, not rejectable via SetConfig. The
@@ -37,16 +37,10 @@ const (
 	KeyDisableMetricsCollection = "disableMetricsCollection"
 	KeyAllowServerSSH           = "allowServerSSH"
 	KeyDisableAutoConnect       = "disableAutoConnect"
-	// KeyDisableAutostart suppresses the GUI's fresh-install
-	// launch-on-login default and marks the Settings toggle as
-	// MDM-managed. UI-only: NOT stored on Config and not applied by
-	// applyMDMPolicy; the GUI reads it directly and it appears in
-	// GetConfigResponse.mDMManagedFields when set.
-	KeyDisableAutostart    = "disableAutostart"
-	KeyPreSharedKey        = "preSharedKey"
-	KeyRosenpassEnabled    = "rosenpassEnabled"
-	KeyRosenpassPermissive = "rosenpassPermissive"
-	KeyWireguardPort       = "wireguardPort"
+	KeyPreSharedKey             = "preSharedKey"
+	KeyRosenpassEnabled         = "rosenpassEnabled"
+	KeyRosenpassPermissive      = "rosenpassPermissive"
+	KeyWireguardPort            = "wireguardPort"
 
 	// Split tunnel is modeled as a single conceptual policy with two
 	// registry/plist values. KeySplitTunnelMode is the discriminator

client/status/status.go

@@ -746,8 +746,6 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
 	}
 
-	pbFullStatus.Events = fullStatus.Events
-
 	return &pbFullStatus
 }
 

client/ui/autostart_default.go

@@ -1,107 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/mdm"
-	"github.com/netbirdio/netbird/client/ui/preferences"
-	"github.com/netbirdio/netbird/client/ui/services"
-)
-
-// autostartDefaultState carries the guard inputs of the one-time autostart
-// default decision so the decision itself stays a pure, testable function.
-type autostartDefaultState struct {
-	supported    bool
-	mdmDisabled  bool
-	priorInstall bool
-}
-
-// shouldEnableAutostartDefault applies the first-run guards in order and
-// returns whether autostart may be enabled, plus the reason when it may not.
-func shouldEnableAutostartDefault(s autostartDefaultState) (bool, string) {
-	switch {
-	case !s.supported:
-		return false, "autostart not supported on this platform"
-	case s.mdmDisabled:
-		return false, "autostart disabled by MDM policy"
-	case s.priorInstall:
-		return false, "existing NetBird installation"
-	}
-	return true, ""
-}
-
-// autostartDisabledByMDM reports whether the MDM policy manages the
-// disableAutostart key in a way that must suppress the default. An
-// unparseable managed value is treated as disabled to stay on the safe side.
-func autostartDisabledByMDM(policy *mdm.Policy) bool {
-	if !policy.HasKey(mdm.KeyDisableAutostart) {
-		return false
-	}
-	disabled, ok := policy.GetBool(mdm.KeyDisableAutostart)
-	return !ok || disabled
-}
-
-// netbirdFootprintExists reports whether the machine already carries NetBird
-// daemon config or state, meaning this is not a genuinely fresh install. It is
-// the update-safety gate for the autostart default: upgrading users always
-// have a footprint, so an update can never trigger a login-item write.
-func netbirdFootprintExists() bool {
-	candidates := []string{
-		profilemanager.DefaultConfigPath,
-		filepath.Join(profilemanager.DefaultConfigPathDir, "config.json"),
-		filepath.Join(profilemanager.DefaultConfigPathDir, "state.json"),
-	}
-	for _, path := range candidates {
-		if path != "" && fileExists(path) {
-			return true
-		}
-	}
-	return false
-}
-
-// applyAutostartDefault runs the one-time launch-on-login default for genuinely
-// fresh installs. The autostartInitialized marker is persisted before any
-// enable attempt so a crash mid-flow degrades to "never enabled" instead of
-// retrying login-item writes on every launch. A user's later disable in
-// Settings is never overridden: the marker guarantees at-most-once, ever.
-func applyAutostartDefault(ctx context.Context, autostart *services.Autostart, prefs *preferences.Store, prefsFileExisted bool) {
-	priorFootprint := netbirdFootprintExists() || prefsFileExisted
-
-	if prefs.Get().AutostartInitialized {
-		return
-	}
-	if err := prefs.SetAutostartInitialized(true); err != nil {
-		log.Warnf("persist autostart marker, skipping autostart default: %v", err)
-		return
-	}
-
-	state := autostartDefaultState{
-		supported:    autostart.Supported(ctx),
-		mdmDisabled:  autostartDisabledByMDM(mdm.LoadPolicy()),
-		priorInstall: priorFootprint,
-	}
-	enable, reason := shouldEnableAutostartDefault(state)
-	if !enable {
-		log.Debugf("skipping autostart default: %s", reason)
-		return
-	}
-
-	if err := autostart.SetEnabled(ctx, true); err != nil {
-		log.Warnf("enable autostart on fresh install: %v", err)
-		return
-	}
-	log.Info("autostart enabled by default on fresh install")
-}
-
-// fileExists reports whether path exists.
-func fileExists(path string) bool {
-	_, err := os.Stat(path)
-	return err == nil
-}

client/ui/autostart_default_test.go

@@ -1,125 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/netbirdio/netbird/client/mdm"
-)
-
-func TestShouldEnableAutostartDefault(t *testing.T) {
-	allPass := autostartDefaultState{
-		supported:    true,
-		mdmDisabled:  false,
-		priorInstall: false,
-	}
-
-	tests := []struct {
-		name       string
-		mutate     func(*autostartDefaultState)
-		wantEnable bool
-		wantReason string
-	}{
-		{
-			name:       "fresh install with all guards passing enables",
-			mutate:     func(*autostartDefaultState) {},
-			wantEnable: true,
-		},
-		{
-			name:       "unsupported platform skips",
-			mutate:     func(s *autostartDefaultState) { s.supported = false },
-			wantReason: "autostart not supported on this platform",
-		},
-		{
-			name:       "MDM disable skips",
-			mutate:     func(s *autostartDefaultState) { s.mdmDisabled = true },
-			wantReason: "autostart disabled by MDM policy",
-		},
-		{
-			name:       "existing installation (upgrade) skips",
-			mutate:     func(s *autostartDefaultState) { s.priorInstall = true },
-			wantReason: "existing NetBird installation",
-		},
-		{
-			name: "unsupported wins over every other guard",
-			mutate: func(s *autostartDefaultState) {
-				s.supported = false
-				s.mdmDisabled = true
-				s.priorInstall = true
-			},
-			wantReason: "autostart not supported on this platform",
-		},
-		{
-			name: "MDM disable wins over prior install",
-			mutate: func(s *autostartDefaultState) {
-				s.mdmDisabled = true
-				s.priorInstall = true
-			},
-			wantReason: "autostart disabled by MDM policy",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			state := allPass
-			tc.mutate(&state)
-			enable, reason := shouldEnableAutostartDefault(state)
-			assert.Equal(t, tc.wantEnable, enable, "enable decision should match for state %+v", state)
-			assert.Equal(t, tc.wantReason, reason, "skip reason should identify the failing guard")
-		})
-	}
-}
-
-func TestAutostartDisabledByMDM(t *testing.T) {
-	tests := []struct {
-		name   string
-		values map[string]any
-		want   bool
-	}{
-		{
-			name:   "empty policy does not disable",
-			values: nil,
-			want:   false,
-		},
-		{
-			name:   "unrelated managed keys do not disable",
-			values: map[string]any{mdm.KeyDisableAutoConnect: true},
-			want:   false,
-		},
-		{
-			name:   "disableAutostart true disables",
-			values: map[string]any{mdm.KeyDisableAutostart: true},
-			want:   true,
-		},
-		{
-			name:   "disableAutostart registry DWORD 1 disables",
-			values: map[string]any{mdm.KeyDisableAutostart: int64(1)},
-			want:   true,
-		},
-		{
-			name:   "disableAutostart string true disables",
-			values: map[string]any{mdm.KeyDisableAutostart: "true"},
-			want:   true,
-		},
-		{
-			name:   "disableAutostart explicit false allows",
-			values: map[string]any{mdm.KeyDisableAutostart: false},
-			want:   false,
-		},
-		{
-			name:   "unparseable managed value is treated as disabled",
-			values: map[string]any{mdm.KeyDisableAutostart: "not-a-bool"},
-			want:   true,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := autostartDisabledByMDM(mdm.NewPolicy(tc.values))
-			assert.Equal(t, tc.want, got, "MDM disable decision should match for values %v", tc.values)
-		})
-	}
-}

client/ui/frontend/src/lib/connection.ts

@@ -51,14 +51,7 @@ async function runSsoLogin(
     if (uri) await openBrowserLoginUri(uri);
 
     const cancelPromise = buildSsoCancelPromise(state, signal);
-    // Combine wait + up in Go so the connection comes up the moment SSO
-    // completes. During SSO the tray window is hidden and the webview is
-    // suspended, so a frontend-driven Up (a promise continuation) would not
-    // fire until the user woke the window (e.g. hovering the tray icon).
-    const waitPromise = Connection.WaitSSOLoginAndUp(
-        { userCode: result.userCode, hostname: "" },
-        { profileName: "", username: "" },
-    );
+    const waitPromise = Connection.WaitSSOLogin({ userCode: result.userCode, hostname: "" });
 
     try {
         await Promise.race([waitPromise, cancelPromise]);
@@ -96,13 +89,13 @@ export async function startConnection(onSettled?: () => void, signal?: AbortSign
         if (signal?.aborted) state.cancelled = true;
 
         if (!state.cancelled && result.needsSsoLogin) {
-            // runSsoLogin brings the connection up in Go once SSO completes.
             await runSsoLogin(result, state, signal);
-        } else {
-            if (!state.cancelled && signal?.aborted) state.cancelled = true;
-            if (!state.cancelled) {
-                await Connection.Up({ profileName: "", username: "" });
-            }
+        }
+
+        if (!state.cancelled && signal?.aborted) state.cancelled = true;
+
+        if (!state.cancelled) {
+            await Connection.Up({ profileName: "", username: "" });
         }
     } catch (e) {
         WindowManager.CloseBrowserLogin().catch(console.error);

client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx

@@ -73,6 +73,13 @@ export default function SessionExpirationDialog() {
 
         let offCancel: (() => void) | undefined;
 
+        // Return the dialog to its interactive state and dismiss the browser popup
+        const resetDialog = () => {
+            offCancel?.();
+            WindowManager.CloseBrowserLogin().catch(console.error);
+            setBusy(false);
+        };
+
         try {
             const start = await Session.RequestExtend({ hint: "" });
             const uri = start.verificationUriComplete || start.verificationUri;
@@ -105,25 +112,22 @@ export default function SessionExpirationDialog() {
             if (outcome.kind === "cancel") {
                 waitPromise.cancel?.();
                 waitPromise.catch(() => {});
+                resetDialog();
                 return;
             }
 
             // Another surface owns this flow; keep the dialog open to retry.
             if (outcome.result.preempted) {
+                resetDialog();
                 return;
             }
-
-            // Close before the popup so the restore can't flash this window back.
-            WindowManager.CloseSessionExpiration().catch(console.error);
+            WindowManager.CloseRenewFlow().catch(console.error);
         } catch (e) {
+            resetDialog();
             await errorDialog({
                 Title: t("sessionExpiration.extendFailedTitle"),
                 Message: formatErrorMessage(e),
             });
-        } finally {
-            offCancel?.();
-            WindowManager.CloseBrowserLogin().catch(console.error);
-            setBusy(false);
         }
     }, [busy, t]);
 
@@ -139,12 +143,11 @@ export default function SessionExpirationDialog() {
             });
             WindowManager.CloseSessionExpiration().catch(console.error);
         } catch (e) {
+            setBusy(false);
             await errorDialog({
                 Title: t("sessionExpiration.logoutFailedTitle"),
                 Message: formatErrorMessage(e),
             });
-        } finally {
-            setBusy(false);
         }
     }, [busy, t]);
 

client/ui/main.go

@@ -197,9 +197,6 @@ func main() {
 		// daemon may keep the main window from showing, so the OS toast is the
 		// only reliable signal the user gets.
 		go notifyIfDaemonOutdated(compat, notifier, localizer)
-		// One-time launch-on-login default for fresh installs; gated by the
-		// NetBird footprint check, MDM policy, and the persisted marker.
-		go applyAutostartDefault(context.Background(), services.NewAutostart(app.Autostart), prefStore, prefStore.ExistedAtLoad())
 	})
 
 	if err := app.Run(); err != nil {

client/ui/preferences/store.go

@@ -54,10 +54,6 @@ type UIPreferences struct {
 	Language            i18n.LanguageCode `json:"language"`
 	ViewMode            ViewMode          `json:"viewMode"`
 	OnboardingCompleted bool              `json:"onboardingCompleted"`
-	// AutostartInitialized records that the one-time autostart default
-	// decision has run for this OS user. It only ever transitions to true
-	// and is never reset, so the default-on flow runs at most once, ever.
-	AutostartInitialized bool `json:"autostartInitialized"`
 }
 
 // LanguageValidator rejects SetLanguage inputs with no shipped bundle.
@@ -76,9 +72,8 @@ type Emitter interface {
 type Store struct {
 	path string
 
-	mu            sync.RWMutex
-	current       UIPreferences
-	existedAtLoad bool
+	mu      sync.RWMutex
+	current UIPreferences
 
 	subsMu sync.Mutex
 	subs   []chan UIPreferences
@@ -162,27 +157,6 @@ func (s *Store) SetOnboardingCompleted(done bool) error {
 	return nil
 }
 
-// SetAutostartInitialized persists the one-time autostart decision marker.
-// No-op if unchanged.
-func (s *Store) SetAutostartInitialized(done bool) error {
-	s.mu.Lock()
-	if s.current.AutostartInitialized == done {
-		s.mu.Unlock()
-		return nil
-	}
-	next := s.current
-	next.AutostartInitialized = done
-	if err := s.persistLocked(next); err != nil {
-		s.mu.Unlock()
-		return fmt.Errorf("persist preferences: %w", err)
-	}
-	s.current = next
-	s.mu.Unlock()
-
-	s.broadcast(next)
-	return nil
-}
-
 // SetLanguage validates, persists, and broadcasts. No-op if unchanged.
 func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
 	if lang == "" {
@@ -232,29 +206,13 @@ func (s *Store) Subscribe() (<-chan UIPreferences, func()) {
 	return ch, unsubscribe
 }
 
-// ExistedAtLoad reports whether the backing preferences file was present on
-// disk when the store loaded. It distinguishes a user who ran a prior GUI
-// version from a brand-new OS user with no preferences yet.
-func (s *Store) ExistedAtLoad() bool {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	return s.existedAtLoad
-}
-
 // load reads the file into current. A missing file is not an error (the
 // in-memory default stands); malformed contents return an error.
 func (s *Store) load() error {
-	if _, err := os.Stat(s.path); err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return nil
-		}
-		return fmt.Errorf("stat preferences: %w", err)
+	if _, err := os.Stat(s.path); errors.Is(err, os.ErrNotExist) {
+		return nil
 	}
 
-	s.mu.Lock()
-	s.existedAtLoad = true
-	s.mu.Unlock()
-
 	var loaded UIPreferences
 	if _, err := util.ReadJson(s.path, &loaded); err != nil {
 		return err

client/ui/preferences/store_test.go

@@ -215,46 +215,6 @@ func TestStore_FileShapeIsJSON(t *testing.T) {
 	assert.Equal(t, i18n.LanguageCode("hu"), parsed.Language)
 }
 
-func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
-	withTempConfigDir(t)
-	emitter := &recordingEmitter{}
-	s, err := NewStore(nil, emitter)
-	require.NoError(t, err)
-
-	assert.False(t, s.Get().AutostartInitialized, "marker must default to false when no file is on disk")
-
-	require.NoError(t, s.SetAutostartInitialized(true))
-	assert.True(t, s.Get().AutostartInitialized, "Get should reflect the persisted marker")
-	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first marker write should broadcast")
-
-	// Re-setting the same value must be a no-op: no disk write, no broadcast.
-	require.NoError(t, s.SetAutostartInitialized(true))
-	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent marker write should not broadcast again")
-
-	// A fresh Store (new GUI launch) must see the marker so the autostart
-	// default decision never runs twice.
-	reloaded, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
-}
-
-func TestStore_ExistedAtLoad(t *testing.T) {
-	withTempConfigDir(t)
-
-	// Brand-new OS user: no preferences file on disk yet.
-	fresh, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.False(t, fresh.ExistedAtLoad(), "ExistedAtLoad must be false when no file is on disk")
-
-	// Persisting a value writes the file to disk.
-	require.NoError(t, fresh.SetLanguage("en"))
-
-	// A subsequent GUI launch reopens the now-present file.
-	reopened, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.True(t, reopened.ExistedAtLoad(), "ExistedAtLoad must be true after the store has persisted and is reopened")
-}
-
 func TestStore_ErrUnsupportedSentinel(t *testing.T) {
 	// Verifies callers can match on the sentinel error rather than parsing
 	// strings — protects against accidental %v -> %w changes that would

client/ui/services/connection.go

@@ -35,7 +35,7 @@ type LoginResult struct {
 	VerificationURIComplete string `json:"verificationUriComplete"`
 }
 
-// WaitSSOParams are the inputs to waitSSOLogin.
+// WaitSSOParams are the inputs to WaitSSOLogin.
 type WaitSSOParams struct {
 	UserCode string `json:"userCode"`
 	Hostname string `json:"hostname"`
@@ -125,6 +125,23 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	}, nil
 }
 
+func (s *Connection) WaitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	log.Infof("waiting for SSO login to complete")
+	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
+		UserCode: p.UserCode,
+		Hostname: p.Hostname,
+	})
+	if err != nil {
+		return "", s.classifyDaemonError(err)
+	}
+	log.Infof("SSO login completed, daemon reported success")
+	return resp.GetEmail(), nil
+}
+
 func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -145,27 +162,6 @@ func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	return nil
 }
 
-// WaitSSOLoginAndUp blocks until the SSO login completes and then brings the
-// connection up, both from the Go side. Keeping the post-login Up here rather
-// than as a frontend continuation is deliberate: during SSO the tray window is
-// hidden and the webview is suspended (macOS App Nap / hidden-window timer
-// throttling), so a frontend-driven Up would not run until the user woke the
-// window (e.g. by hovering the tray icon). Doing it in Go connects the moment
-// the daemon reports SSO success. Returns the authenticated user's email.
-func (s *Connection) WaitSSOLoginAndUp(ctx context.Context, wait WaitSSOParams, up UpParams) (string, error) {
-	email, err := s.waitSSOLogin(ctx, wait)
-	if err != nil {
-		return "", err
-	}
-	if err := ctx.Err(); err != nil {
-		return "", err
-	}
-	if err := s.Up(ctx, up); err != nil {
-		return "", err
-	}
-	return email, nil
-}
-
 func (s *Connection) Down(ctx context.Context) error {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -225,26 +221,6 @@ func (s *Connection) Logout(ctx context.Context, p LogoutParams) error {
 	return nil
 }
 
-// waitSSOLogin blocks until the daemon reports the SSO login result and returns
-// the authenticated user's email. It is unexported because the frontend drives
-// SSO through the exported WaitSSOLoginAndUp.
-func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return "", err
-	}
-	log.Infof("waiting for SSO login to complete")
-	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
-		UserCode: p.UserCode,
-		Hostname: p.Hostname,
-	})
-	if err != nil {
-		return "", s.classifyDaemonError(err)
-	}
-	log.Infof("SSO login completed, daemon reported success")
-	return resp.GetEmail(), nil
-}
-
 // classifyDaemonError maps a gRPC error to a localised ClientError.
 func (s *Connection) classifyDaemonError(err error) *ClientError {
 	return s.classifier.classify(err)

client/ui/services/settings.go

@@ -20,12 +20,11 @@ type MDMFields struct {
 	DisableServerRoutes      bool   `json:"disableServerRoutes"`
 	AllowServerSSH           *bool  `json:"allowServerSSH"`
 	DisableAutoConnect       bool   `json:"disableAutoConnect"`
-	DisableAutostart         bool   `json:"disableAutostart"`
 	BlockInbound             bool   `json:"blockInbound"`
 	DisableMetricsCollection bool   `json:"disableMetricsCollection"`
 	SplitTunnelMode          bool   `json:"splitTunnelMode"`
 	SplitTunnelApps          bool   `json:"splitTunnelApps"`
-	DisableAdvancedView      bool   `json:"disableAdvancedView"`
+	DisableAdvancedView bool `json:"disableAdvancedView"`
 }
 
 type Features struct {

client/ui/services/windowmanager.go

@@ -185,37 +185,38 @@ func (s *WindowManager) OpenBrowserLogin(uri string) {
 			startURL = "/#/dialog/browser-login?uri=" + url.QueryEscape(uri)
 		}
 		s.hideOtherWindowsLocked("browser-login")
-		// Prefer the main window's screen (multi-monitor); falls back to OS-default centering.
-		var screen *application.Screen
-		if s.mainWindow != nil {
-			if sc, err := s.mainWindow.GetScreen(); err == nil {
-				screen = sc
-			}
-		}
 		opts := DialogWindowOptions("browser-login", s.title("window.title.signIn"), startURL, s.linuxIcon)
 		// Not always-on-top: it would obscure the browser tab the user logs in through.
 		opts.AlwaysOnTop = false
 		opts.InitialPosition = application.WindowCentered
-		opts.Screen = screen
+		// Open on the active (where users cursor is) display, like the session-expiration dialog.
+		opts.Screen = s.getScreenBasedOnCursorPosition()
 		s.browserLogin = s.app.Window.NewWithOptions(opts)
 		bl := s.browserLogin
-		// Red-X close means cancel: emit the event so startLogin() tears down the SSO wait.
 		bl.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
-			s.app.Event.Emit(EventBrowserLoginCancel)
 			s.mu.Lock()
-			s.browserLogin = nil
-			s.restoreHiddenWindowsLocked()
+			// Only a live user red-X still has this registered; programmatic closers
+			// nil s.browserLogin first and clean up themselves. Guarding here stops a
+			// stale close event from wiping a replacement popup's state.
+			userClosed := s.browserLogin == bl
+			if userClosed {
+				s.browserLogin = nil
+				s.restoreHiddenWindowsLocked()
+			}
 			s.mu.Unlock()
+			if userClosed {
+				s.app.Event.Emit(EventBrowserLoginCancel)
+			}
 		})
-		s.centerWhenReady(s.browserLogin)
+		s.centerOnCursorScreen(s.browserLogin)
 		return
 	}
 	if uri != "" {
 		s.browserLogin.SetURL("/#/dialog/browser-login?uri=" + url.QueryEscape(uri))
 	}
+	s.centerOnCursorScreen(s.browserLogin)
 	s.browserLogin.Show()
 	s.browserLogin.Focus()
-	s.centerWhenReady(s.browserLogin)
 }
 
 // BrowserLoginWindow returns the live SSO popup, or nil. While non-nil it is the
@@ -238,6 +239,8 @@ func (s *WindowManager) CloseBrowserLogin() {
 	s.mu.Lock()
 	w := s.browserLogin
 	s.browserLogin = nil
+	// The WindowClosing hook no-ops on a programmatic close, so restore here.
+	s.restoreHiddenWindowsLocked()
 	s.mu.Unlock()
 	if w != nil {
 		w.Close()
@@ -279,6 +282,35 @@ func (s *WindowManager) CloseSessionExpiration() {
 	}
 }
 
+// CloseRenewFlow tears down the SSO session-renewal UI in a single call: it
+// closes the browser-login popup and the session-expiration window together.
+func (s *WindowManager) CloseRenewFlow() {
+	s.mu.Lock()
+	bl := s.browserLogin
+	se := s.sessionExpiration
+	s.browserLogin = nil
+	s.sessionExpiration = nil
+	if se != nil {
+		kept := s.hiddenForLogin[:0]
+		for _, w := range s.hiddenForLogin {
+			if w != se {
+				kept = append(kept, w)
+			}
+		}
+		s.hiddenForLogin = kept
+	}
+	s.restoreHiddenWindowsLocked()
+	s.mu.Unlock()
+
+	// Close after unlock so the re-entrant handlers can take s.mu.
+	if bl != nil {
+		bl.Close()
+	}
+	if se != nil {
+		se.Close()
+	}
+}
+
 // OpenInstallProgress shows the install-progress window and hides the rest for the duration
 // (restored on close). It owns its own result polling since the daemon restarts mid-install.
 func (s *WindowManager) OpenInstallProgress(version string) {

management/internals/modules/peers/ephemeral/manager/ephemeral.go

@@ -215,7 +215,7 @@ func (e *EphemeralManager) cleanup(ctx context.Context) {
 	}
 
 	for accountID, peerIDs := range peerIDsPerAccount {
-		log.WithContext(ctx).Debugf("cleanup: deleting %d ephemeral peers for account %s: %s", len(peerIDs), accountID, peerIDs)
+		log.WithContext(ctx).Tracef("cleanup: deleting %d ephemeral peers for account %s", len(peerIDs), accountID)
 		err := e.peersManager.DeletePeers(ctx, accountID, peerIDs, activity.SystemInitiator, true)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to delete ephemeral peers: %s", err)

management/internals/modules/peers/manager.go

@@ -184,8 +184,6 @@ func (m *managerImpl) DeletePeers(ctx context.Context, accountID string, peerIDs
 				return err
 			}
 
-			log.WithContext(ctx).Debugf("DeletePeers: deleted peer %s", peerID)
-
 			if !(peer.ProxyMeta.Embedded || peer.Meta.KernelVersion == "wasm") {
 				eventsToStore = append(eventsToStore, func() {
 					m.accountManager.StoreEvent(ctx, userID, peer.ID, accountID, activity.PeerRemovedByUser, peer.EventMeta(dnsDomain))

management/internals/shared/grpc/token_mgr.go

@@ -161,8 +161,6 @@ func (m *TimeBasedAuthSecretsManager) SetupRefresh(ctx context.Context, accountI
 		m.turnCancelMap[peerID] = turnCancel
 		go m.refreshTURNTokens(ctx, accountID, peerID, turnCancel)
 		log.WithContext(ctx).Debugf("starting TURN refresh for %s", peerID)
-	} else {
-		log.WithContext(ctx).Debugf("no TURN configuration, skipping TURN refresh for %s", peerID)
 	}
 
 	if m.relayCfg != nil {
@@ -170,8 +168,6 @@ func (m *TimeBasedAuthSecretsManager) SetupRefresh(ctx context.Context, accountI
 		m.relayCancelMap[peerID] = relayCancel
 		go m.refreshRelayTokens(ctx, accountID, peerID, relayCancel)
 		log.WithContext(ctx).Tracef("starting relay refresh for %s", peerID)
-	} else {
-		log.WithContext(ctx).Tracef("no relay configuration, skipping relay refresh for %s", peerID)
 	}
 }
 

management/server/http/handlers/accounts/accounts_handler.go

@@ -295,13 +295,6 @@ func (h *handler) updateAccountRequestSettings(req api.PutApiAccountsAccountIdJS
 		}
 	}
 
-	if returnSettings.AgentNetworkOnly &&
-		(returnSettings.DashboardFeatures == nil ||
-			returnSettings.DashboardFeatures.AgentNetwork == nil ||
-			!*returnSettings.DashboardFeatures.AgentNetwork) {
-		return nil, status.Errorf(status.InvalidArgument, "agent network only mode requires dashboard_features.agent_network to be enabled")
-	}
-
 	return returnSettings, nil
 }
 

management/server/http/handlers/accounts/accounts_handler_test.go

@@ -288,7 +288,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 			expectedBody:   true,
 			requestType:    http.MethodPut,
 			requestPath:    "/api/accounts/" + accountID,
-			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": true,\"dashboard_features\": {\"agent_network\": true}},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": true},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
 			expectedStatus: http.StatusOK,
 			expectedSettings: api.AccountSettings{
 				PeerLoginExpiration:             15552000,
@@ -305,25 +305,13 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
 				AgentNetworkOnly:                br(true),
-				DashboardFeatures: &api.AccountDashboardFeatures{
-					AgentNetwork: br(true),
-				},
-				EmbeddedIdpEnabled: br(false),
-				LocalAuthDisabled:  br(false),
-				LocalMfaEnabled:    br(false),
+				EmbeddedIdpEnabled:              br(false),
+				LocalAuthDisabled:               br(false),
+				LocalMfaEnabled:                 br(false),
 			},
 			expectedArray: false,
 			expectedID:    accountID,
 		},
-		{
-			name:           "PutAccount fails enabling agent_network_only without dashboard_features",
-			expectedBody:   true,
-			requestType:    http.MethodPut,
-			requestPath:    "/api/accounts/" + accountID,
-			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": true},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
-			expectedStatus: http.StatusUnprocessableEntity,
-			expectedArray:  false,
-		},
 		{
 			name:           "PutAccount OK setting dashboard_features agent_network",
 			expectedBody:   true,

management/server/peer.go

@@ -106,13 +106,11 @@ func (am *DefaultAccountManager) MarkPeerConnected(ctx context.Context, peerPubK
 	}
 	if !updated {
 		am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusConnect, telemetry.PeerStatusStale)
-		log.WithContext(ctx).Debugf("peer %s already has a newer session in store, skipping connect", peer.ID)
+		log.WithContext(ctx).Tracef("peer %s already has a newer session in store, skipping connect", peer.ID)
 		return nil
 	}
 	am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusConnect, telemetry.PeerStatusApplied)
 
-	log.WithContext(ctx).Debugf("mark peer %s connected", peer.ID)
-
 	if err = am.schedulePeerExpirations(ctx, accountID, peer); err != nil {
 		return err
 	}
@@ -182,14 +180,12 @@ func (am *DefaultAccountManager) MarkPeerDisconnected(ctx context.Context, peerP
 	}
 	if !updated {
 		am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusDisconnect, telemetry.PeerStatusStale)
-		log.WithContext(ctx).Debugf("peer %s session token mismatch on disconnect (token=%d), skipping",
+		log.WithContext(ctx).Tracef("peer %s session token mismatch on disconnect (token=%d), skipping",
 			peer.ID, sessionStartedAt)
 		return nil
 	}
 	am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusDisconnect, telemetry.PeerStatusApplied)
 
-	log.WithContext(ctx).Debugf("mark peer %s disconnected", peer.ID)
-
 	// Symmetric with MarkPeerConnected: when an embedded proxy peer goes
 	// offline, refresh the peers that had synthesized records pointing at
 	// it so they pull the stale entries instead of waiting out TTL.

shared/management/http/api/openapi.yml

@@ -376,7 +376,7 @@ components:
           type: boolean
           example: false
         agent_network_only:
-          description: Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later. Enabling this requires dashboard_features.agent_network to be true in the same request.
+          description: Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later.
           type: boolean
           example: false
         dashboard_features:
@@ -414,7 +414,7 @@ components:
       type: object
       properties:
         agent_network:
-          description: Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies. Must be true when agent_network_only is enabled.
+          description: Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies.
           type: boolean
           example: true
     AccountExtraSettings:

shared/management/http/api/types.gen.go

@@ -1614,7 +1614,7 @@ type Account struct {
 
 // AccountDashboardFeatures Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
 type AccountDashboardFeatures struct {
-	// AgentNetwork Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies. Must be true when agent_network_only is enabled.
+	// AgentNetwork Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies.
 	AgentNetwork *bool `json:"agent_network,omitempty"`
 }
 
@@ -1653,7 +1653,7 @@ type AccountRequest struct {
 
 // AccountSettings defines model for AccountSettings.
 type AccountSettings struct {
-	// AgentNetworkOnly Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later. Enabling this requires dashboard_features.agent_network to be true in the same request.
+	// AgentNetworkOnly Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later.
 	AgentNetworkOnly *bool `json:"agent_network_only,omitempty"`
 
 	// AutoUpdateAlways When true, updates are installed automatically in the background. When false, updates require user interaction from the UI.

shared/relay/client/early_msg_buffer.go

@@ -10,7 +10,7 @@ import (
 
 const (
 	earlyMsgTTL      = 5 * time.Second
-	earlyMsgCapacity = 10000
+	earlyMsgCapacity = 1000
 )
 
 // earlyMsgBuffer buffers transport messages that arrive before the corresponding