[client, relay] Increase early-message buffer cap to 10000 to avoid dropping relayed handshakes

Adds a settings constraint: enabling `agent_network_only` requires `dashboard_features.agent_network` to be `true` in the same account update. Without the Agent Network menu flag, a focused account that later turns the focused view off would lose access to the Agent Network menu entirely, so the two must be set together.

The check runs in `updateAccountRequestSettings` against the parsed request state: if the resulting settings have `agent_network_only == true` but `dashboard_features.agent_network` is not `true`, the update is rejected with `status.InvalidArgument` (HTTP 422) before anything is persisted.

The OpenAPI field descriptions for `agent_network_only` and `dashboard_features.agent_network` document the requirement. Only the descriptions changed — `required` and the schema `$ref` are untouched — and `types.gen.go` was regenerated from the spec (diff is the two comment lines).

client/internal/debug/debug.go

@@ -480,7 +480,6 @@ func (g *BundleGenerator) addStatus() error {
 
 		fullStatus := g.statusRecorder.GetFullStatus()
 		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
-		protoFullStatus.Events = g.statusRecorder.GetEventHistory()
 		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, nbstatus.ConvertOptions{
 			Anonymize:     g.anonymize,
 			ProfileName:   profName,

client/internal/engine.go

@@ -48,7 +48,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
@@ -183,7 +182,7 @@ type EngineServices struct {
 type Engine struct {
 	// signal is a Signal Service client
 	signal   signal.Client
-	signaler *signaling.Signaler
+	signaler *peer.Signaler
 	// mgmClient is a Management Service client
 	mgmClient mgm.Client
 	// peerConns is a map that holds all the peers that are known to this peer
@@ -319,7 +318,7 @@ func NewEngine(
 		ctx:                ctx,
 		cancel:             cancel,
 		signal:             services.SignalClient,
-		signaler:           signaling.NewSignaler(services.SignalClient, config.WgPrivateKey),
+		signaler:           peer.NewSignaler(services.SignalClient, config.WgPrivateKey),
 		mgmClient:          services.MgmClient,
 		relayManager:       services.RelayManager,
 		peerStore:          peerstore.NewConnStore(),
@@ -2748,7 +2747,7 @@ func createFile(path string) error {
 	return file.Close()
 }
 
-func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
+func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) {
 	remoteCred, err := signal.UnMarshalCredential(msg)
 	if err != nil {
 		return nil, err
@@ -2764,9 +2763,9 @@ func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
 	}
 
 	// Handle optional SessionID
-	var sessionID *icemaker.SessionID
+	var sessionID *peer.ICESessionID
 	if sessionBytes := msg.GetBody().GetSessionId(); sessionBytes != nil {
-		if id, err := icemaker.SessionIDFromBytes(sessionBytes); err != nil {
+		if id, err := peer.ICESessionIDFromBytes(sessionBytes); err != nil {
 			log.Warnf("Invalid session ID in message: %v", err)
 			sessionID = nil // Set to nil if conversion fails
 		} else {
@@ -2776,8 +2775,8 @@ func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
 
 	relayIP := decodeRelayIP(msg.GetBody().GetRelayServerIP())
 
-	offerAnswer := signaling.OfferAnswer{
-		IceCredentials: signaling.IceCredentials{
+	offerAnswer := peer.OfferAnswer{
+		IceCredentials: peer.IceCredentials{
 			UFrag: remoteCred.UFrag,
 			Pwd:   remoteCred.Pwd,
 		},

client/internal/peer/conn_status.go

@@ -1,5 +1,18 @@
 package peer
 
+import (
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// StatusIdle indicate the peer is in disconnected state
+	StatusIdle ConnStatus = iota
+	// StatusConnecting indicate the peer is in connecting state
+	StatusConnecting
+	// StatusConnected indicate the peer is in connected state
+	StatusConnected
+)
+
 // connStatusInputs is the primitive-valued snapshot of the state that drives the
 // tri-state connection classification. Extracted so the decision logic can be unit-tested
 // without constructing full Worker/Handshaker objects.
@@ -8,7 +21,24 @@ type connStatusInputs struct {
 	peerUsesRelay       bool // remote peer advertises relay support AND local has relay
 	relayConnected      bool // statusRelay reports Connected (independent of whether peer uses relay)
 	remoteSupportsICE   bool // remote peer sent ICE credentials
-	iceWorkerCreated    bool // local ICE worker exists (false in force-relay mode)
+	iceWorkerCreated    bool // local WorkerICE exists (false in force-relay mode)
 	iceStatusConnecting bool // statusICE is anything other than Disconnected
 	iceInProgress       bool // a negotiation is currently in flight
 }
+
+// ConnStatus describe the status of a peer's connection
+type ConnStatus int32
+
+func (s ConnStatus) String() string {
+	switch s {
+	case StatusConnecting:
+		return "Connecting"
+	case StatusConnected:
+		return "Connected"
+	case StatusIdle:
+		return "Idle"
+	default:
+		log.Errorf("unknown status: %d", s)
+		return "INVALID_PEER_CONNECTION_STATUS"
+	}
+}

client/internal/peer/conn_status_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"testing"

client/internal/peer/conn_test.go

@@ -3,33 +3,28 @@ package peer
 import (
 	"context"
 	"fmt"
-	"net/netip"
 	"os"
 	"testing"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/internal/peer/dispatcher"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	"github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/metricsstages"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/util"
 )
 
+var testDispatcher = dispatcher.NewConnectionDispatcher()
+
 var connConf = ConnConfig{
 	Key:         "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
 	LocalKey:    "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
 	Timeout:     time.Second,
 	LocalWgPort: 51820,
-	WgConfig: WgConfig{
-		AllowedIps: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
-	},
 	ICEConfig: ice.Config{
 		InterfaceBlackList: nil,
 	},
@@ -57,37 +52,92 @@ func TestConn_GetKey(t *testing.T) {
 	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
 
 	sd := ServiceDependencies{
-		SrWatcher: swWatcher,
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
 	}
 	conn, err := NewConn(connConf, sd)
-	require.NoError(t, err)
+	if err != nil {
+		return
+	}
 
 	got := conn.GetKey()
 
 	assert.Equal(t, got, connConf.Key, "they should be equal")
 }
 
-// TestConn_DiscardMessagesWhenNotOpened: signal messages posted to a not yet
-// opened connection must be discarded without blocking or panicking.
-func TestConn_DiscardMessagesWhenNotOpened(t *testing.T) {
+func TestConn_OnRemoteOffer(t *testing.T) {
 	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
 	sd := ServiceDependencies{
-		StatusRecorder: status.NewRecorder("https://mgm"),
-		SrWatcher:      swWatcher,
+		StatusRecorder:     NewRecorder("https://mgm"),
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
 	}
 	conn, err := NewConn(connConf, sd)
-	require.NoError(t, err)
+	if err != nil {
+		return
+	}
 
-	offerAnswer := signaling.OfferAnswer{
-		IceCredentials: signaling.IceCredentials{
+	onNewOfferChan := make(chan struct{})
+
+	conn.handshaker.AddRelayListener(func(remoteOfferAnswer *OfferAnswer) {
+		onNewOfferChan <- struct{}{}
+	})
+
+	conn.OnRemoteOffer(OfferAnswer{
+		IceCredentials: IceCredentials{
 			UFrag: "test",
 			Pwd:   "test",
 		},
+		WgListenPort: 0,
+		Version:      "",
+	})
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	select {
+	case <-onNewOfferChan:
+		// success
+	case <-ctx.Done():
+		t.Error("expected to receive a new offer notification, but timed out")
+	}
+}
+
+func TestConn_OnRemoteAnswer(t *testing.T) {
+	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
+	sd := ServiceDependencies{
+		StatusRecorder:     NewRecorder("https://mgm"),
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
+	}
+	conn, err := NewConn(connConf, sd)
+	if err != nil {
+		return
+	}
+
+	onNewOfferChan := make(chan struct{})
+
+	conn.handshaker.AddRelayListener(func(remoteOfferAnswer *OfferAnswer) {
+		onNewOfferChan <- struct{}{}
+	})
+
+	conn.OnRemoteAnswer(OfferAnswer{
+		IceCredentials: IceCredentials{
+			UFrag: "test",
+			Pwd:   "test",
+		},
+		WgListenPort: 0,
+		Version:      "",
+	})
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	select {
+	case <-onNewOfferChan:
+		// success
+	case <-ctx.Done():
+		t.Error("expected to receive a new offer notification, but timed out")
 	}
-	conn.OnRemoteOffer(offerAnswer)
-	conn.OnRemoteAnswer(offerAnswer)
-	conn.OnRemoteCandidate(nil, nil)
-	conn.Close(false)
 }
 
 func TestConn_presharedKey(t *testing.T) {
@@ -270,7 +320,7 @@ func newWGTimeoutTestConn(rosenpassEnabled bool, disconnected *[]string) *Conn {
 		ctx:           context.Background(),
 		config:        cfg,
 		Log:           log.WithField("peer", cfg.Key),
-		metricsStages: &metricsstages.MetricsStages{},
+		metricsStages: &MetricsStages{},
 	}
 	conn.SetOnDisconnected(func(remotePeer string) {
 		*disconnected = append(*disconnected, remotePeer)
@@ -289,20 +339,20 @@ func TestConn_onWGDisconnected_EscalatesToRosenpassReset(t *testing.T) {
 	conn := newWGTimeoutTestConn(true, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected()
 	}
 	assert.Empty(t, disconnected, "escalation must not fire below the threshold")
 
-	conn.handleWGTimeout()
+	conn.onWGDisconnected()
 	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
 		"reaching the threshold must report the peer disconnected once")
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected()
 	}
 	assert.Len(t, disconnected, 1, "escalation must restart counting after firing")
 
-	conn.handleWGTimeout()
+	conn.onWGDisconnected()
 	assert.Len(t, disconnected, 2, "continued timeouts must escalate again")
 }
 
@@ -314,12 +364,12 @@ func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
 	conn := newWGTimeoutTestConn(true, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected()
 	}
-	conn.handleWGCheckSuccess()
+	conn.onWGCheckSuccess()
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected()
 	}
 	assert.Empty(t, disconnected, "handshake success must reset the timeout count")
 }
@@ -332,7 +382,7 @@ func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
 	conn := newWGTimeoutTestConn(false, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold*3; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected()
 	}
 	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
 }

client/internal/peer/conntype/priority.go

@@ -1,4 +1,4 @@
-package worker
+package conntype
 
 import (
 	"fmt"

client/internal/peer/dispatcher/dispatcher.go

@@ -0,0 +1,52 @@
+package dispatcher
+
+import (
+	"sync"
+
+	"github.com/netbirdio/netbird/client/internal/peer/id"
+)
+
+type ConnectionListener struct {
+	OnConnected    func(peerID id.ConnID)
+	OnDisconnected func(peerID id.ConnID)
+}
+
+type ConnectionDispatcher struct {
+	listeners map[*ConnectionListener]struct{}
+	mu        sync.Mutex
+}
+
+func NewConnectionDispatcher() *ConnectionDispatcher {
+	return &ConnectionDispatcher{
+		listeners: make(map[*ConnectionListener]struct{}),
+	}
+}
+
+func (e *ConnectionDispatcher) AddListener(listener *ConnectionListener) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.listeners[listener] = struct{}{}
+}
+
+func (e *ConnectionDispatcher) RemoveListener(listener *ConnectionListener) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	delete(e.listeners, listener)
+}
+
+func (e *ConnectionDispatcher) NotifyConnected(peerConnID id.ConnID) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for listener := range e.listeners {
+		listener.OnConnected(peerConnID)
+	}
+}
+
+func (e *ConnectionDispatcher) NotifyDisconnected(peerConnID id.ConnID) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for listener := range e.listeners {
+		listener.OnDisconnected(peerConnID)
+	}
+}

client/internal/peer/event.go

@@ -1,69 +0,0 @@
-package peer
-
-import (
-	"time"
-
-	"github.com/pion/ice/v4"
-
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/worker"
-	"github.com/netbirdio/netbird/route"
-)
-
-// event is a message processed by the Conn event loop. All mutable Conn state
-// is owned by that loop; producers deliver events through the mailbox and
-// never mutate Conn state directly.
-type event any
-
-// evClose asks the event loop to tear down the connection. done is closed
-// once the teardown finished.
-type evClose struct {
-	signalToRemote bool
-	done           chan struct{}
-}
-
-type evRemoteOffer struct {
-	offer signaling.OfferAnswer
-}
-
-type evRemoteAnswer struct {
-	answer signaling.OfferAnswer
-}
-
-type evRemoteCandidate struct {
-	candidate ice.Candidate
-	haRoutes  route.HAMap
-}
-
-type evICEReady struct {
-	priority worker.ConnPriority
-	info     worker.ICEConnInfo
-}
-
-type evICEDown struct {
-	sessionChanged bool
-}
-
-type evRelayReady struct {
-	info worker.RelayConnInfo
-}
-
-type evRelayDown struct{}
-
-// evRelayDialDone reports that the relay dial helper goroutine finished,
-// successfully or not, so the loop may dispatch a pending offer.
-type evRelayDialDone struct{}
-
-type evWGTimeout struct{}
-
-// evWGHandshake reports the first WireGuard handshake of the current watcher run.
-type evWGHandshake struct {
-	when time.Time
-}
-
-// evWGCheckOK reports a watcher check that observed a fresh handshake,
-// including handshakes of connections that were already up.
-type evWGCheckOK struct{}
-
-// evGuardTick asks the loop to send a new offer to restore connectivity.
-type evGuardTick struct{}

client/internal/peer/guard/ice_monitor.go

@@ -21,6 +21,8 @@ const (
 )
 
 type ICEMonitor struct {
+	ReconnectCh chan struct{}
+
 	iFaceDiscover stdnet.ExternalIFaceDiscover
 	iceConfig     icemaker.Config
 	tickerPeriod  time.Duration
@@ -32,6 +34,7 @@ type ICEMonitor struct {
 func NewICEMonitor(iFaceDiscover stdnet.ExternalIFaceDiscover, config icemaker.Config, period time.Duration) *ICEMonitor {
 	log.Debugf("prepare ICE monitor with period: %s", period)
 	cm := &ICEMonitor{
+		ReconnectCh:   make(chan struct{}, 1),
 		iFaceDiscover: iFaceDiscover,
 		iceConfig:     config,
 		tickerPeriod:  period,

client/internal/peer/handshaker.go

@@ -0,0 +1,246 @@
+package peer
+
+import (
+	"context"
+	"errors"
+	"net/netip"
+	"sync"
+	"sync/atomic"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/version"
+)
+
+var (
+	ErrSignalIsNotReady = errors.New("signal is not ready")
+)
+
+// IceCredentials ICE protocol credentials struct
+type IceCredentials struct {
+	UFrag string
+	Pwd   string
+}
+
+// OfferAnswer represents a session establishment offer or answer
+type OfferAnswer struct {
+	IceCredentials IceCredentials
+	// WgListenPort is a remote WireGuard listen port.
+	// This field is used when establishing a direct WireGuard connection without any proxy.
+	// We can set the remote peer's endpoint with this port.
+	WgListenPort int
+
+	// Version of NetBird Agent
+	Version string
+	// RosenpassPubKey is the Rosenpass public key of the remote peer when receiving this message
+	// This value is the local Rosenpass server public key when sending the message
+	RosenpassPubKey []byte
+	// RosenpassAddr is the Rosenpass server address (IP:port) of the remote peer when receiving this message
+	// This value is the local Rosenpass server address when sending the message
+	RosenpassAddr string
+
+	// relay server address
+	RelaySrvAddress string
+	// RelaySrvIP is the IP the remote peer is connected to on its
+	// relay server. Used as a dial target if DNS for RelaySrvAddress
+	// fails. Zero value if the peer did not advertise an IP.
+	RelaySrvIP netip.Addr
+	// SessionID is the unique identifier of the session, used to discard old messages
+	SessionID *ICESessionID
+}
+
+func (o *OfferAnswer) hasICECredentials() bool {
+	return o.IceCredentials.UFrag != "" && o.IceCredentials.Pwd != ""
+}
+
+type Handshaker struct {
+	mu            sync.Mutex
+	log           *log.Entry
+	config        ConnConfig
+	signaler      *Signaler
+	ice           *WorkerICE
+	relay         *WorkerRelay
+	metricsStages *MetricsStages
+	// relayListener is not blocking because the listener is using a goroutine to process the messages
+	// and it will only keep the latest message if multiple offers are received in a short time
+	// this is to avoid blocking the handshaker if the listener is doing some heavy processing
+	// and also to avoid processing old offers if multiple offers are received in a short time
+	// the listener will always process the latest offer
+	relayListener *AsyncOfferListener
+	iceListener   func(remoteOfferAnswer *OfferAnswer)
+
+	// remoteICESupported tracks whether the remote peer includes ICE credentials in its offers/answers.
+	// When false, the local side skips ICE listener dispatch and suppresses ICE credentials in responses.
+	remoteICESupported atomic.Bool
+
+	// remoteOffersCh is a channel used to wait for remote credentials to proceed with the connection
+	remoteOffersCh chan OfferAnswer
+	// remoteAnswerCh is a channel used to wait for remote credentials answer (confirmation of our offer) to proceed with the connection
+	remoteAnswerCh chan OfferAnswer
+}
+
+func NewHandshaker(log *log.Entry, config ConnConfig, signaler *Signaler, ice *WorkerICE, relay *WorkerRelay, metricsStages *MetricsStages) *Handshaker {
+	h := &Handshaker{
+		log:            log,
+		config:         config,
+		signaler:       signaler,
+		ice:            ice,
+		relay:          relay,
+		metricsStages:  metricsStages,
+		remoteOffersCh: make(chan OfferAnswer),
+		remoteAnswerCh: make(chan OfferAnswer),
+	}
+	// assume remote supports ICE until we learn otherwise from received offers
+	h.remoteICESupported.Store(ice != nil)
+	return h
+}
+
+func (h *Handshaker) RemoteICESupported() bool {
+	return h.remoteICESupported.Load()
+}
+
+func (h *Handshaker) AddRelayListener(offer func(remoteOfferAnswer *OfferAnswer)) {
+	h.relayListener = NewAsyncOfferListener(offer)
+}
+
+func (h *Handshaker) AddICEListener(offer func(remoteOfferAnswer *OfferAnswer)) {
+	h.iceListener = offer
+}
+
+func (h *Handshaker) Listen(ctx context.Context) {
+	for {
+		select {
+		case remoteOfferAnswer := <-h.remoteOffersCh:
+			h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+
+			// Record signaling received for reconnection attempts
+			if h.metricsStages != nil {
+				h.metricsStages.RecordSignalingReceived()
+			}
+
+			h.updateRemoteICEState(&remoteOfferAnswer)
+
+			if h.relayListener != nil {
+				h.relayListener.Notify(&remoteOfferAnswer)
+			}
+
+			if h.iceListener != nil && h.RemoteICESupported() {
+				h.iceListener(&remoteOfferAnswer)
+			}
+
+			if err := h.sendAnswer(); err != nil {
+				h.log.Errorf("failed to send remote offer confirmation: %s", err)
+				continue
+			}
+		case remoteOfferAnswer := <-h.remoteAnswerCh:
+			h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+
+			// Record signaling received for reconnection attempts
+			if h.metricsStages != nil {
+				h.metricsStages.RecordSignalingReceived()
+			}
+
+			h.updateRemoteICEState(&remoteOfferAnswer)
+
+			if h.relayListener != nil {
+				h.relayListener.Notify(&remoteOfferAnswer)
+			}
+
+			if h.iceListener != nil && h.RemoteICESupported() {
+				h.iceListener(&remoteOfferAnswer)
+			}
+		case <-ctx.Done():
+			h.log.Infof("stop listening for remote offers and answers")
+			return
+		}
+	}
+}
+
+func (h *Handshaker) SendOffer() error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.sendOffer()
+}
+
+// OnRemoteOffer handles an offer from the remote peer and returns true if the message was accepted, false otherwise
+// doesn't block, discards the message if connection wasn't ready
+func (h *Handshaker) OnRemoteOffer(offer OfferAnswer) {
+	select {
+	case h.remoteOffersCh <- offer:
+		return
+	default:
+		h.log.Warnf("skipping remote offer message because receiver not ready")
+		// connection might not be ready yet to receive so we ignore the message
+		return
+	}
+}
+
+// OnRemoteAnswer handles an offer from the remote peer and returns true if the message was accepted, false otherwise
+// doesn't block, discards the message if connection wasn't ready
+func (h *Handshaker) OnRemoteAnswer(answer OfferAnswer) {
+	select {
+	case h.remoteAnswerCh <- answer:
+		return
+	default:
+		// connection might not be ready yet to receive so we ignore the message
+		h.log.Warnf("skipping remote answer message because receiver not ready")
+		return
+	}
+}
+
+// sendOffer prepares local user credentials and signals them to the remote peer
+func (h *Handshaker) sendOffer() error {
+	if !h.signaler.Ready() {
+		return ErrSignalIsNotReady
+	}
+
+	offer := h.buildOfferAnswer()
+	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
+
+	return h.signaler.SignalOffer(offer, h.config.Key)
+}
+
+func (h *Handshaker) sendAnswer() error {
+	answer := h.buildOfferAnswer()
+	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
+
+	return h.signaler.SignalAnswer(answer, h.config.Key)
+}
+
+func (h *Handshaker) buildOfferAnswer() OfferAnswer {
+	answer := OfferAnswer{
+		WgListenPort:    h.config.LocalWgPort,
+		Version:         version.NetbirdVersion(),
+		RosenpassPubKey: h.config.RosenpassConfig.PubKey,
+		RosenpassAddr:   h.config.RosenpassConfig.Addr,
+	}
+
+	if h.ice != nil && h.RemoteICESupported() {
+		uFrag, pwd := h.ice.GetLocalUserCredentials()
+		sid := h.ice.SessionID()
+		answer.IceCredentials = IceCredentials{uFrag, pwd}
+		answer.SessionID = &sid
+	}
+
+	if addr, ip, err := h.relay.RelayInstanceAddress(); err == nil {
+		answer.RelaySrvAddress = addr
+		answer.RelaySrvIP = ip
+	}
+
+	return answer
+}
+
+func (h *Handshaker) updateRemoteICEState(offer *OfferAnswer) {
+	hasICE := offer.hasICECredentials()
+	prev := h.remoteICESupported.Swap(hasICE)
+	if prev != hasICE {
+		if hasICE {
+			h.log.Infof("remote peer started sending ICE credentials")
+		} else {
+			h.log.Infof("remote peer stopped sending ICE credentials")
+			if h.ice != nil {
+				h.ice.Close()
+			}
+		}
+	}
+}

client/internal/peer/handshaker_listener.go

@@ -0,0 +1,62 @@
+package peer
+
+import (
+	"sync"
+)
+
+type callbackFunc func(remoteOfferAnswer *OfferAnswer)
+
+func (oa *OfferAnswer) SessionIDString() string {
+	if oa.SessionID == nil {
+		return "unknown"
+	}
+	return oa.SessionID.String()
+}
+
+type AsyncOfferListener struct {
+	fn      callbackFunc
+	running bool
+	latest  *OfferAnswer
+	mu      sync.Mutex
+}
+
+func NewAsyncOfferListener(fn callbackFunc) *AsyncOfferListener {
+	return &AsyncOfferListener{
+		fn: fn,
+	}
+}
+
+func (o *AsyncOfferListener) Notify(remoteOfferAnswer *OfferAnswer) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+
+	// Store the latest offer
+	o.latest = remoteOfferAnswer
+
+	// If already running, the running goroutine will pick up this latest value
+	if o.running {
+		return
+	}
+
+	// Start processing
+	o.running = true
+
+	// Process in a goroutine to avoid blocking the caller
+	go func(remoteOfferAnswer *OfferAnswer) {
+		for {
+			o.fn(remoteOfferAnswer)
+
+			o.mu.Lock()
+			if o.latest == nil {
+				// No more work to do
+				o.running = false
+				o.mu.Unlock()
+				return
+			}
+			remoteOfferAnswer = o.latest
+			// Clear the latest to mark it as being processed
+			o.latest = nil
+			o.mu.Unlock()
+		}
+	}(remoteOfferAnswer)
+}

client/internal/peer/handshaker_listener_test.go

@@ -0,0 +1,39 @@
+package peer
+
+import (
+	"testing"
+	"time"
+)
+
+func Test_newOfferListener(t *testing.T) {
+	dummyOfferAnswer := &OfferAnswer{}
+	runChan := make(chan struct{}, 10)
+
+	longRunningFn := func(remoteOfferAnswer *OfferAnswer) {
+		time.Sleep(1 * time.Second)
+		runChan <- struct{}{}
+	}
+
+	hl := NewAsyncOfferListener(longRunningFn)
+
+	hl.Notify(dummyOfferAnswer)
+	hl.Notify(dummyOfferAnswer)
+	hl.Notify(dummyOfferAnswer)
+
+	// Wait for exactly 2 callbacks
+	for i := 0; i < 2; i++ {
+		select {
+		case <-runChan:
+		case <-time.After(3 * time.Second):
+			t.Fatal("Timeout waiting for callback")
+		}
+	}
+
+	// Verify no additional callbacks happen
+	select {
+	case <-runChan:
+		t.Fatal("Unexpected additional callback")
+	case <-time.After(100 * time.Millisecond):
+		t.Log("Correctly received exactly 2 callbacks")
+	}
+}

client/internal/peer/iface.go

@@ -0,0 +1,22 @@
+package peer
+
+import (
+	"net"
+	"net/netip"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/iface/configurer"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgproxy"
+)
+
+type WGIface interface {
+	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
+	RemovePeer(peerKey string) error
+	GetStats() (map[string]configurer.WGStats, error)
+	GetProxy() wgproxy.Proxy
+	Address() wgaddr.Address
+	RemoveEndpointAddress(key string) error
+}

client/internal/peer/listener.go

@@ -0,0 +1,11 @@
+package peer
+
+// Listener is a callback type about the NetBird network connection state
+type Listener interface {
+	OnConnected()
+	OnDisconnected()
+	OnConnecting()
+	OnDisconnecting()
+	OnAddressChanged(string, string)
+	OnPeersListChanged(int)
+}

client/internal/peer/mailbox.go

@@ -1,116 +0,0 @@
-package peer
-
-import (
-	"sync"
-)
-
-// maxQueuedCandidates bounds the remote candidate queue; on overflow the
-// oldest candidate is dropped. Lost candidates are recovered by the next
-// offer exchange triggered by the guard.
-const maxQueuedCandidates = 128
-
-// mailbox is the coalescing inbox of the Conn event loop. Posting never
-// blocks. Per message kind either the latest value wins (offer, answer,
-// guard tick), the values queue in bounded FIFO order (candidates) or in
-// unbounded FIFO order (lifecycle and transport state changes, which are
-// low-volume and must not be lost). A new offer flushes the queued
-// candidates because they belong to the superseded session.
-type mailbox struct {
-	mu     sync.Mutex
-	closed bool
-
-	lifecycle  []event
-	transport  []event
-	offer      *evRemoteOffer
-	answer     *evRemoteAnswer
-	candidates []evRemoteCandidate
-	guardTick  bool
-
-	wake chan struct{}
-}
-
-func newMailbox() *mailbox {
-	return &mailbox{
-		wake: make(chan struct{}, 1),
-	}
-}
-
-// post stores the event and wakes the loop. It reports false if the mailbox
-// is already closed and the event was not accepted.
-func (m *mailbox) post(ev event) bool {
-	m.mu.Lock()
-	if m.closed {
-		m.mu.Unlock()
-		return false
-	}
-
-	switch e := ev.(type) {
-	case evClose:
-		m.lifecycle = append(m.lifecycle, e)
-	case evRemoteOffer:
-		m.offer = &e
-		m.candidates = nil
-	case evRemoteAnswer:
-		m.answer = &e
-	case evRemoteCandidate:
-		if len(m.candidates) >= maxQueuedCandidates {
-			m.candidates = m.candidates[1:]
-		}
-		m.candidates = append(m.candidates, e)
-	case evGuardTick:
-		m.guardTick = true
-	default:
-		m.transport = append(m.transport, ev)
-	}
-	m.mu.Unlock()
-
-	select {
-	case m.wake <- struct{}{}:
-	default:
-	}
-	return true
-}
-
-// drain returns the pending events in processing order: lifecycle first,
-// then transport state changes, the coalesced offer and answer, the queued
-// candidates and finally the guard tick.
-func (m *mailbox) drain() []event {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return m.drainLocked()
-}
-
-// closeAndDrain marks the mailbox closed so further posts are rejected and
-// returns the events that were still pending.
-func (m *mailbox) closeAndDrain() []event {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.closed = true
-	return m.drainLocked()
-}
-
-func (m *mailbox) drainLocked() []event {
-	evs := make([]event, 0, len(m.lifecycle)+len(m.transport)+len(m.candidates)+3)
-	evs = append(evs, m.lifecycle...)
-	evs = append(evs, m.transport...)
-	if m.offer != nil {
-		evs = append(evs, *m.offer)
-	}
-	if m.answer != nil {
-		evs = append(evs, *m.answer)
-	}
-	for _, c := range m.candidates {
-		evs = append(evs, c)
-	}
-	if m.guardTick {
-		evs = append(evs, evGuardTick{})
-	}
-
-	m.lifecycle = nil
-	m.transport = nil
-	m.offer = nil
-	m.answer = nil
-	m.candidates = nil
-	m.guardTick = false
-	return evs
-}

client/internal/peer/mailbox_test.go

@@ -1,128 +0,0 @@
-package peer
-
-import (
-	"testing"
-
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestMailbox_OfferCoalescing(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 1}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 2}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 3}}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 1, "consecutive offers must coalesce to a single event")
-	offer, ok := evs[0].(evRemoteOffer)
-	require.True(t, ok, "coalesced event must be an offer")
-	assert.Equal(t, 3, offer.offer.WgListenPort, "the newest offer must win")
-}
-
-func TestMailbox_OfferFlushesCandidates(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteCandidate{}))
-	require.True(t, mb.post(evRemoteCandidate{}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 1, "candidates of the superseded session must be flushed")
-	_, ok := evs[0].(evRemoteOffer)
-	assert.True(t, ok, "only the offer must remain after the flush")
-}
-
-func TestMailbox_CandidatesKeepOrderAfterOffer(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRemoteCandidate{haRoutes: nil}))
-	require.True(t, mb.post(evRemoteCandidate{haRoutes: nil}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 3)
-	_, ok := evs[0].(evRemoteOffer)
-	assert.True(t, ok, "offer must be processed before the candidates")
-	for _, ev := range evs[1:] {
-		_, ok := ev.(evRemoteCandidate)
-		assert.True(t, ok, "candidates posted after the offer must survive")
-	}
-}
-
-func TestMailbox_CandidateQueueBounded(t *testing.T) {
-	mb := newMailbox()
-
-	for i := 0; i < maxQueuedCandidates+10; i++ {
-		require.True(t, mb.post(evRemoteCandidate{}))
-	}
-
-	evs := mb.drain()
-	assert.Len(t, evs, maxQueuedCandidates, "candidate queue must stay bounded")
-}
-
-func TestMailbox_DrainOrder(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evRemoteAnswer{answer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRelayDown{}))
-	require.True(t, mb.post(evICEDown{sessionChanged: true}))
-	require.True(t, mb.post(evClose{}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 6)
-
-	_, ok := evs[0].(evClose)
-	assert.True(t, ok, "lifecycle events must come first")
-	_, ok = evs[1].(evRelayDown)
-	assert.True(t, ok, "transport events must keep FIFO order")
-	_, ok = evs[2].(evICEDown)
-	assert.True(t, ok, "transport events must keep FIFO order")
-	_, ok = evs[3].(evRemoteOffer)
-	assert.True(t, ok, "offer must come after transport events")
-	_, ok = evs[4].(evRemoteAnswer)
-	assert.True(t, ok, "answer must come after the offer")
-	_, ok = evs[5].(evGuardTick)
-	assert.True(t, ok, "guard tick must come last")
-}
-
-func TestMailbox_GuardTickCoalesced(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evGuardTick{}))
-
-	evs := mb.drain()
-	assert.Len(t, evs, 1, "guard ticks must coalesce to a single event")
-}
-
-func TestMailbox_PostAfterCloseRejected(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRelayDown{}))
-	leftovers := mb.closeAndDrain()
-	assert.Len(t, leftovers, 1, "pending events must be returned on close")
-
-	assert.False(t, mb.post(evRelayDown{}), "posts must be rejected after close")
-	assert.Empty(t, mb.drain(), "no events must remain after close")
-}
-
-func TestMailbox_WakeSignal(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRelayDown{}))
-	require.True(t, mb.post(evGuardTick{}))
-
-	select {
-	case <-mb.wake:
-	default:
-		t.Fatal("wake signal must be pending after posts")
-	}
-
-	assert.Len(t, mb.drain(), 2, "a single wake must deliver all pending events")
-}

client/internal/peer/metrics_saver.go

@@ -1,4 +1,4 @@
-package metricsstages
+package peer
 
 import (
 	"sync"

client/internal/peer/metrics_saver_test.go

@@ -1,4 +1,4 @@
-package metricsstages
+package peer
 
 import (
 	"testing"

client/internal/peer/notifier.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"sync"
@@ -11,16 +11,6 @@ const (
 	stateDisconnecting
 )
 
-// Listener is a callback type about the NetBird network connection state
-type Listener interface {
-	OnConnected()
-	OnDisconnected()
-	OnConnecting()
-	OnDisconnecting()
-	OnAddressChanged(string, string)
-	OnPeersListChanged(int)
-}
-
 type notifier struct {
 	serverStateLock    sync.Mutex
 	listenersLock      sync.Mutex

client/internal/peer/notifier_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"sync"

client/internal/peer/route.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"net/netip"

client/internal/peer/session_id.go

@@ -1,4 +1,4 @@
-package ice
+package peer
 
 import (
 	"crypto/rand"
@@ -9,26 +9,26 @@ import (
 
 const sessionIDSize = 5
 
-type SessionID string
+type ICESessionID string
 
-// NewSessionID generates a new session ID for distinguishing sessions
-func NewSessionID() (SessionID, error) {
+// NewICESessionID generates a new session ID for distinguishing sessions
+func NewICESessionID() (ICESessionID, error) {
 	b := make([]byte, sessionIDSize)
 	if _, err := io.ReadFull(rand.Reader, b); err != nil {
 		return "", fmt.Errorf("failed to generate session ID: %w", err)
 	}
-	return SessionID(hex.EncodeToString(b)), nil
+	return ICESessionID(hex.EncodeToString(b)), nil
 }
 
-func SessionIDFromBytes(b []byte) (SessionID, error) {
+func ICESessionIDFromBytes(b []byte) (ICESessionID, error) {
 	if len(b) != sessionIDSize {
 		return "", fmt.Errorf("invalid session ID length: %d", len(b))
 	}
-	return SessionID(hex.EncodeToString(b)), nil
+	return ICESessionID(hex.EncodeToString(b)), nil
 }
 
 // Bytes returns the raw bytes of the session ID for protobuf serialization
-func (id SessionID) Bytes() ([]byte, error) {
+func (id ICESessionID) Bytes() ([]byte, error) {
 	if len(id) == 0 {
 		return nil, fmt.Errorf("ICE session ID is empty")
 	}
@@ -42,6 +42,6 @@ func (id SessionID) Bytes() ([]byte, error) {
 	return b, nil
 }
 
-func (id SessionID) String() string {
+func (id ICESessionID) String() string {
 	return string(id)
 }

client/internal/peer/signaler.go

@@ -1,4 +1,4 @@
-package signaling
+package peer
 
 import (
 	"github.com/pion/ice/v4"

client/internal/peer/signaling/handshaker.go

@@ -1,189 +0,0 @@
-package signaling
-
-import (
-	"errors"
-	"net/netip"
-	"sync"
-	"sync/atomic"
-
-	log "github.com/sirupsen/logrus"
-
-	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	relayClient "github.com/netbirdio/netbird/shared/relay/client"
-	"github.com/netbirdio/netbird/version"
-)
-
-var (
-	ErrSignalIsNotReady = errors.New("signal is not ready")
-)
-
-// IceCredentials ICE protocol credentials struct
-type IceCredentials struct {
-	UFrag string
-	Pwd   string
-}
-
-// OfferAnswer represents a session establishment offer or answer
-type OfferAnswer struct {
-	IceCredentials IceCredentials
-	// WgListenPort is a remote WireGuard listen port.
-	// This field is used when establishing a direct WireGuard connection without any proxy.
-	// We can set the remote peer's endpoint with this port.
-	WgListenPort int
-
-	// Version of NetBird Agent
-	Version string
-	// RosenpassPubKey is the Rosenpass public key of the remote peer when receiving this message
-	// This value is the local Rosenpass server public key when sending the message
-	RosenpassPubKey []byte
-	// RosenpassAddr is the Rosenpass server address (IP:port) of the remote peer when receiving this message
-	// This value is the local Rosenpass server address when sending the message
-	RosenpassAddr string
-
-	// relay server address
-	RelaySrvAddress string
-	// RelaySrvIP is the IP the remote peer is connected to on its
-	// relay server. Used as a dial target if DNS for RelaySrvAddress
-	// fails. Zero value if the peer did not advertise an IP.
-	RelaySrvIP netip.Addr
-	// SessionID is the unique identifier of the session, used to discard old messages
-	SessionID *icemaker.SessionID
-}
-
-func (o *OfferAnswer) HasICECredentials() bool {
-	return o.IceCredentials.UFrag != "" && o.IceCredentials.Pwd != ""
-}
-
-func (o *OfferAnswer) SessionIDString() string {
-	if o.SessionID == nil {
-		return "unknown"
-	}
-	return o.SessionID.String()
-}
-
-// Config carries the peer-specific values the Handshaker embeds into offers
-// and answers.
-type Config struct {
-	Key             string
-	LocalWgPort     int
-	RosenpassPubKey []byte
-	RosenpassAddr   string
-}
-
-// Credentials are the local ICE credentials and session id the Handshaker embeds in offers.
-type Credentials struct {
-	UFrag     string
-	Pwd       string
-	SessionID icemaker.SessionID
-}
-
-// ICEWorker is the subset of the ICE worker the Handshaker needs to build offers.
-type ICEWorker interface {
-	Credentials() Credentials
-	Close()
-}
-
-// Handshaker keeps the signaling protocol logic: building and sending offers
-// and answers and tracking whether the remote peer supports ICE. Incoming
-// message processing is driven by the Conn event loop.
-type Handshaker struct {
-	mu           sync.Mutex
-	log          *log.Entry
-	config       Config
-	signaler     *Signaler
-	ice          ICEWorker
-	relayManager *relayClient.Manager
-
-	// remoteICESupported tracks whether the remote peer includes ICE credentials in its offers/answers.
-	// When false, the local side skips ICE dispatch and suppresses ICE credentials in responses.
-	remoteICESupported atomic.Bool
-}
-
-func NewHandshaker(log *log.Entry, config Config, signaler *Signaler, ice ICEWorker, relayManager *relayClient.Manager) *Handshaker {
-	h := &Handshaker{
-		log:          log,
-		config:       config,
-		signaler:     signaler,
-		ice:          ice,
-		relayManager: relayManager,
-	}
-	// assume remote supports ICE until we learn otherwise from received offers
-	h.remoteICESupported.Store(ice != nil)
-	return h
-}
-
-func (h *Handshaker) RemoteICESupported() bool {
-	return h.remoteICESupported.Load()
-}
-
-func (h *Handshaker) SendOffer() error {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return h.sendOffer()
-}
-
-func (h *Handshaker) SendAnswer() error {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return h.sendAnswer()
-}
-
-// sendOffer prepares local user credentials and signals them to the remote peer
-func (h *Handshaker) sendOffer() error {
-	if !h.signaler.Ready() {
-		return ErrSignalIsNotReady
-	}
-
-	offer := h.buildOfferAnswer()
-	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
-
-	return h.signaler.SignalOffer(offer, h.config.Key)
-}
-
-func (h *Handshaker) sendAnswer() error {
-	answer := h.buildOfferAnswer()
-	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
-
-	return h.signaler.SignalAnswer(answer, h.config.Key)
-}
-
-func (h *Handshaker) buildOfferAnswer() OfferAnswer {
-	answer := OfferAnswer{
-		WgListenPort:    h.config.LocalWgPort,
-		Version:         version.NetbirdVersion(),
-		RosenpassPubKey: h.config.RosenpassPubKey,
-		RosenpassAddr:   h.config.RosenpassAddr,
-	}
-
-	if h.ice != nil && h.RemoteICESupported() {
-		creds := h.ice.Credentials()
-		answer.IceCredentials = IceCredentials{creds.UFrag, creds.Pwd}
-		sid := creds.SessionID
-		answer.SessionID = &sid
-	}
-
-	if addr, ip, err := h.relayManager.RelayInstanceAddress(); err == nil {
-		answer.RelaySrvAddress = addr
-		answer.RelaySrvIP = ip
-	}
-
-	return answer
-}
-
-// UpdateRemoteICEState refreshes the remote ICE support flag from a received
-// offer or answer and closes the ICE worker when the remote peer stopped
-// sending ICE credentials. Runs on the Conn event loop.
-func (h *Handshaker) UpdateRemoteICEState(offer *OfferAnswer) {
-	hasICE := offer.HasICECredentials()
-	prev := h.remoteICESupported.Swap(hasICE)
-	if prev != hasICE {
-		if hasICE {
-			h.log.Infof("remote peer started sending ICE credentials")
-		} else {
-			h.log.Infof("remote peer stopped sending ICE credentials")
-			if h.ice != nil {
-				h.ice.Close()
-			}
-		}
-	}
-}

client/internal/peer/state_dump.go

@@ -1,4 +1,4 @@
-package state_dump
+package peer
 
 import (
 	"context"
@@ -6,13 +6,11 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 )
 
-type StateDump struct {
+type stateDump struct {
 	log    *log.Entry
-	status *status.Recorder
+	status *Status
 	key    string
 
 	sentOffer       int
@@ -28,15 +26,15 @@ type StateDump struct {
 	mu sync.Mutex
 }
 
-func NewStateDump(key string, log *log.Entry, statusRecorder *status.Recorder) *StateDump {
-	return &StateDump{
+func newStateDump(key string, log *log.Entry, statusRecorder *Status) *stateDump {
+	return &stateDump{
 		log:    log,
 		status: statusRecorder,
 		key:    key,
 	}
 }
 
-func (s *StateDump) Start(ctx context.Context) {
+func (s *stateDump) Start(ctx context.Context) {
 	ticker := time.NewTicker(10 * time.Minute)
 	defer ticker.Stop()
 
@@ -50,25 +48,25 @@ func (s *StateDump) Start(ctx context.Context) {
 	}
 }
 
-func (s *StateDump) RemoteOffer() {
+func (s *stateDump) RemoteOffer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteOffer++
 }
 
-func (s *StateDump) RemoteCandidate() {
+func (s *stateDump) RemoteCandidate() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteCandidate++
 }
 
-func (s *StateDump) SendOffer() {
+func (s *stateDump) SendOffer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.sentOffer++
 }
 
-func (s *StateDump) dumpState() {
+func (s *stateDump) dumpState() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
@@ -82,41 +80,41 @@ func (s *StateDump) dumpState() {
 		status, s.sentOffer, s.remoteOffer, s.remoteAnswer, s.remoteCandidate, s.p2pConnected, s.switchToRelay, s.wgCheckSuccess, s.relayConnected, s.localProxies)
 }
 
-func (s *StateDump) RemoteAnswer() {
+func (s *stateDump) RemoteAnswer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteAnswer++
 }
 
-func (s *StateDump) P2PConnected() {
+func (s *stateDump) P2PConnected() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.p2pConnected++
 }
 
-func (s *StateDump) SwitchToRelay() {
+func (s *stateDump) SwitchToRelay() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.switchToRelay++
 }
 
-func (s *StateDump) WGcheckSuccess() {
+func (s *stateDump) WGcheckSuccess() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.wgCheckSuccess++
 }
 
-func (s *StateDump) RelayConnected() {
+func (s *stateDump) RelayConnected() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.relayConnected++
 }
 
-func (s *StateDump) NewLocalProxy() {
+func (s *stateDump) NewLocalProxy() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 

client/internal/peer/status/conn_status.go

@@ -1,31 +0,0 @@
-package status
-
-import (
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	// StatusIdle indicate the peer is in disconnected state
-	StatusIdle ConnStatus = iota
-	// StatusConnecting indicate the peer is in connecting state
-	StatusConnecting
-	// StatusConnected indicate the peer is in connected state
-	StatusConnected
-)
-
-// ConnStatus describe the status of a peer's connection
-type ConnStatus int32
-
-func (s ConnStatus) String() string {
-	switch s {
-	case StatusConnecting:
-		return "Connecting"
-	case StatusConnected:
-		return "Connected"
-	case StatusIdle:
-		return "Idle"
-	default:
-		log.Errorf("unknown status: %d", s)
-		return "INVALID_PEER_CONNECTION_STATUS"
-	}
-}

client/internal/peer/status/events.go

@@ -1,48 +0,0 @@
-package status
-
-import (
-	"slices"
-	"sync"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-type EventQueue struct {
-	maxSize int
-	events  []*proto.SystemEvent
-	mutex   sync.RWMutex
-}
-
-func NewEventQueue(size int) *EventQueue {
-	return &EventQueue{
-		maxSize: size,
-		events:  make([]*proto.SystemEvent, 0, size),
-	}
-}
-
-func (q *EventQueue) Add(event *proto.SystemEvent) {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	q.events = append(q.events, event)
-
-	if len(q.events) > q.maxSize {
-		q.events = q.events[len(q.events)-q.maxSize:]
-	}
-}
-
-func (q *EventQueue) GetAll() []*proto.SystemEvent {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return slices.Clone(q.events)
-}
-
-type EventSubscription struct {
-	id     string
-	events chan *proto.SystemEvent
-}
-
-func (s *EventSubscription) Events() <-chan *proto.SystemEvent {
-	return s.events
-}

client/internal/peer/status/full_status.go

@@ -1,122 +0,0 @@
-package status
-
-import (
-	"golang.org/x/exp/maps"
-	"google.golang.org/protobuf/types/known/durationpb"
-	"google.golang.org/protobuf/types/known/timestamppb"
-
-	"github.com/netbirdio/netbird/client/internal/relay"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// FullStatus contains the full state held by the Recorder instance
-type FullStatus struct {
-	Peers                 []State
-	ManagementState       ManagementState
-	SignalState           SignalState
-	LocalPeerState        LocalPeerState
-	RosenpassState        RosenpassState
-	Relays                []relay.ProbeResult
-	NSGroupStates         []NSGroupState
-	NumOfForwardingRules  int
-	LazyConnectionEnabled bool
-	Events                []*proto.SystemEvent
-}
-
-// ToProto converts FullStatus to proto.FullStatus.
-func (fs FullStatus) ToProto() *proto.FullStatus {
-	pbFullStatus := proto.FullStatus{
-		ManagementState: &proto.ManagementState{},
-		SignalState:     &proto.SignalState{},
-		LocalPeerState:  &proto.LocalPeerState{},
-		Peers:           []*proto.PeerState{},
-	}
-
-	pbFullStatus.ManagementState.URL = fs.ManagementState.URL
-	pbFullStatus.ManagementState.Connected = fs.ManagementState.Connected
-	if err := fs.ManagementState.Error; err != nil {
-		pbFullStatus.ManagementState.Error = err.Error()
-	}
-
-	pbFullStatus.SignalState.URL = fs.SignalState.URL
-	pbFullStatus.SignalState.Connected = fs.SignalState.Connected
-	if err := fs.SignalState.Error; err != nil {
-		pbFullStatus.SignalState.Error = err.Error()
-	}
-
-	pbFullStatus.LocalPeerState.IP = fs.LocalPeerState.IP
-	pbFullStatus.LocalPeerState.Ipv6 = fs.LocalPeerState.IPv6
-	pbFullStatus.LocalPeerState.PubKey = fs.LocalPeerState.PubKey
-	pbFullStatus.LocalPeerState.KernelInterface = fs.LocalPeerState.KernelInterface
-	pbFullStatus.LocalPeerState.Fqdn = fs.LocalPeerState.FQDN
-	pbFullStatus.LocalPeerState.WgPort = int32(fs.LocalPeerState.WgPort)
-	pbFullStatus.LocalPeerState.RosenpassPermissive = fs.RosenpassState.Permissive
-	pbFullStatus.LocalPeerState.RosenpassEnabled = fs.RosenpassState.Enabled
-	pbFullStatus.NumberOfForwardingRules = int32(fs.NumOfForwardingRules)
-	pbFullStatus.LazyConnectionEnabled = fs.LazyConnectionEnabled
-
-	pbFullStatus.LocalPeerState.Networks = maps.Keys(fs.LocalPeerState.Routes)
-
-	for _, peerState := range fs.Peers {
-		networks := maps.Keys(peerState.GetRoutes())
-
-		pbPeerState := &proto.PeerState{
-			IP:                         peerState.IP,
-			Ipv6:                       peerState.IPv6,
-			PubKey:                     peerState.PubKey,
-			ConnStatus:                 peerState.ConnStatus.String(),
-			ConnStatusUpdate:           timestamppb.New(peerState.ConnStatusUpdate),
-			Relayed:                    peerState.Relayed,
-			LocalIceCandidateType:      peerState.LocalIceCandidateType,
-			RemoteIceCandidateType:     peerState.RemoteIceCandidateType,
-			LocalIceCandidateEndpoint:  peerState.LocalIceCandidateEndpoint,
-			RemoteIceCandidateEndpoint: peerState.RemoteIceCandidateEndpoint,
-			RelayAddress:               peerState.RelayServerAddress,
-			Fqdn:                       peerState.FQDN,
-			LastWireguardHandshake:     timestamppb.New(peerState.LastWireguardHandshake),
-			BytesRx:                    peerState.BytesRx,
-			BytesTx:                    peerState.BytesTx,
-			RosenpassEnabled:           peerState.RosenpassEnabled,
-			Networks:                   networks,
-			Latency:                    durationpb.New(peerState.Latency),
-			SshHostKey:                 peerState.SSHHostKey,
-		}
-		pbFullStatus.Peers = append(pbFullStatus.Peers, pbPeerState)
-	}
-
-	for _, relayState := range fs.Relays {
-		pbRelayState := &proto.RelayState{
-			URI:       relayState.URI,
-			Available: relayState.Err == nil,
-			Transport: relayState.Transport,
-		}
-		if err := relayState.Err; err != nil {
-			pbRelayState.Error = err.Error()
-		}
-		pbFullStatus.Relays = append(pbFullStatus.Relays, pbRelayState)
-	}
-
-	for _, dnsState := range fs.NSGroupStates {
-		var err string
-		if dnsState.Error != nil {
-			err = dnsState.Error.Error()
-		}
-
-		var servers []string
-		for _, server := range dnsState.Servers {
-			servers = append(servers, server.String())
-		}
-
-		pbDnsState := &proto.NSGroupState{
-			Servers: servers,
-			Domains: dnsState.Domains,
-			Enabled: dnsState.Enabled,
-			Error:   err,
-		}
-		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
-	}
-
-	pbFullStatus.Events = fs.Events
-
-	return &pbFullStatus
-}

client/internal/peer/status/peer_state.go

@@ -1,63 +0,0 @@
-package status
-
-import (
-	"sync"
-	"time"
-
-	"golang.org/x/exp/maps"
-)
-
-// State contains the latest state of a peer
-type State struct {
-	Mux                        *sync.RWMutex
-	IP                         string
-	IPv6                       string
-	PubKey                     string
-	FQDN                       string
-	ConnStatus                 ConnStatus
-	ConnStatusUpdate           time.Time
-	Relayed                    bool
-	LocalIceCandidateType      string
-	RemoteIceCandidateType     string
-	LocalIceCandidateEndpoint  string
-	RemoteIceCandidateEndpoint string
-	RelayServerAddress         string
-	LastWireguardHandshake     time.Time
-	BytesTx                    int64
-	BytesRx                    int64
-	Latency                    time.Duration
-	RosenpassEnabled           bool
-	SSHHostKey                 []byte
-	routes                     map[string]struct{}
-}
-
-// AddRoute add a single route to routes map
-func (s *State) AddRoute(network string) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	if s.routes == nil {
-		s.routes = make(map[string]struct{})
-	}
-	s.routes[network] = struct{}{}
-}
-
-// SetRoutes set state routes
-func (s *State) SetRoutes(routes map[string]struct{}) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	s.routes = routes
-}
-
-// DeleteRoute removes a route from the network amp
-func (s *State) DeleteRoute(network string) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	delete(s.routes, network)
-}
-
-// GetRoutes return routes map
-func (s *State) GetRoutes() map[string]struct{} {
-	s.Mux.RLock()
-	defer s.Mux.RUnlock()
-	return maps.Clone(s.routes)
-}

client/internal/peer/status_alias.go

@@ -1,36 +0,0 @@
-package peer
-
-import "github.com/netbirdio/netbird/client/internal/peer/status"
-
-// Transitional aliases re-exporting the peer status recorder from its own
-// package. Callers are being migrated to reference the status package
-// directly; these aliases will be removed once the migration completes.
-type (
-	Status                   = status.Recorder
-	State                    = status.State
-	ConnStatus               = status.ConnStatus
-	FullStatus               = status.FullStatus
-	RouterState              = status.RouterState
-	LocalPeerState           = status.LocalPeerState
-	SignalState              = status.SignalState
-	ManagementState          = status.ManagementState
-	RosenpassState           = status.RosenpassState
-	NSGroupState             = status.NSGroupState
-	ResolvedDomainInfo       = status.ResolvedDomainInfo
-	StatusChangeSubscription = status.StatusChangeSubscription
-	EventQueue               = status.EventQueue
-	EventSubscription        = status.EventSubscription
-	WGIfaceStatus            = status.WGIfaceStatus
-	Listener                 = status.Listener
-	EventListener            = status.EventListener
-)
-
-const (
-	StatusIdle       = status.StatusIdle
-	StatusConnecting = status.StatusConnecting
-	StatusConnected  = status.StatusConnected
-)
-
-var (
-	NewRecorder = status.NewRecorder
-)

client/internal/peer/status_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"context"

client/internal/peer/wg_watcher.go

@@ -1,4 +1,4 @@
-package wg_watcher
+package peer
 
 import (
 	"context"
@@ -9,7 +9,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/internal/peer/state_dump"
 )
 
 const (
@@ -29,7 +28,7 @@ type WGWatcher struct {
 	log           *log.Entry
 	wgIfaceStater WGInterfaceStater
 	peerKey       string
-	stateDump     *state_dump.StateDump
+	stateDump     *stateDump
 
 	enabled   bool
 	muEnabled sync.Mutex
@@ -39,7 +38,7 @@ type WGWatcher struct {
 	resetCh chan struct{}
 }
 
-func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey string, stateDump *state_dump.StateDump) *WGWatcher {
+func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey string, stateDump *stateDump) *WGWatcher {
 	return &WGWatcher{
 		log:           log,
 		wgIfaceStater: wgIfaceStater,

client/internal/peer/wg_watcher_test.go

@@ -1,4 +1,4 @@
-package wg_watcher
+package peer
 
 import (
 	"context"
@@ -10,8 +10,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/internal/peer/state_dump"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 )
 
 type MocWgIface struct {
@@ -59,7 +57,7 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 	// platforms with coarse clock resolution (Windows), where two time.Now() calls
 	// microseconds apart can return the same instant and read as a timed-out handshake.
 	stats := &mockHandshakeStats{handshake: time.Now().Add(-time.Hour)}
-	watcher := NewWGWatcher(mlog, stats, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, stats, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -68,18 +66,14 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 
 	firstHandshake := make(chan struct{}, 1)
 	checkSuccess := make(chan struct{}, 1)
-	watcherDone := make(chan struct{})
-	go func() {
-		defer close(watcherDone)
-		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
-			firstHandshake <- struct{}{}
-		}, func() {
-			select {
-			case checkSuccess <- struct{}{}:
-			default:
-			}
-		})
-	}()
+	go watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
+		firstHandshake <- struct{}{}
+	}, func() {
+		select {
+		case checkSuccess <- struct{}{}:
+		default:
+		}
+	})
 
 	stats.advance()
 
@@ -94,11 +88,6 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 		t.Errorf("first-handshake callback must not fire for a non-zero baseline")
 	default:
 	}
-
-	// Wait for the watcher goroutine to exit so it cannot race with other
-	// tests mutating the package-level check timing variables.
-	cancel()
-	<-watcherDone
 }
 
 func TestWGWatcher_EnableWgWatcher(t *testing.T) {
@@ -107,7 +96,7 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 
 	mlog := log.WithField("peer", "tet")
 	mocWgIface := &MocWgIface{}
-	watcher := NewWGWatcher(mlog, mocWgIface, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -140,7 +129,7 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 
 	mlog := log.WithField("peer", "tet")
 	mocWgIface := &MocWgIface{}
-	watcher := NewWGWatcher(mlog, mocWgIface, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	ok := watcher.PrepareInitialHandshake()

client/internal/peer/worker/state.go

@@ -1,4 +1,4 @@
-package peer
+package worker
 
 import (
 	"sync/atomic"
@@ -7,17 +7,17 @@ import (
 )
 
 const (
-	WorkerStatusDisconnected WorkerStatus = iota
-	WorkerStatusConnected
+	StatusDisconnected Status = iota
+	StatusConnected
 )
 
-type WorkerStatus int32
+type Status int32
 
-func (s WorkerStatus) String() string {
+func (s Status) String() string {
 	switch s {
-	case WorkerStatusDisconnected:
+	case StatusDisconnected:
 		return "Disconnected"
-	case WorkerStatusConnected:
+	case StatusConnected:
 		return "Connected"
 	default:
 		log.Errorf("unknown status: %d", s)
@@ -37,16 +37,16 @@ func NewAtomicStatus() *AtomicWorkerStatus {
 }
 
 // Get returns the current connection status
-func (acs *AtomicWorkerStatus) Get() WorkerStatus {
-	return WorkerStatus(acs.status.Load())
+func (acs *AtomicWorkerStatus) Get() Status {
+	return Status(acs.status.Load())
 }
 
 func (acs *AtomicWorkerStatus) SetConnected() {
-	acs.status.Store(int32(WorkerStatusConnected))
+	acs.status.Store(int32(StatusConnected))
 }
 
 func (acs *AtomicWorkerStatus) SetDisconnected() {
-	acs.status.Store(int32(WorkerStatusDisconnected))
+	acs.status.Store(int32(StatusDisconnected))
 }
 
 // String returns the string representation of the current status

client/internal/peer/worker_ice.go

@@ -1,4 +1,4 @@
-package worker
+package peer
 
 import (
 	"context"
@@ -13,9 +13,8 @@ import (
 
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
+	"github.com/netbirdio/netbird/client/internal/peer/conntype"
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/route"
@@ -33,68 +32,57 @@ type ICEConnInfo struct {
 	RelayedOnLocal             bool
 }
 
-type ICEDependencies struct {
-	Signaler           *signaling.Signaler
-	IFaceDiscover      stdnet.ExternalIFaceDiscover
-	StatusRecorder     *status.Recorder
-	PortForwardManager *portforward.Manager
-}
-
-type ICE struct {
-	log                *log.Entry
-	key                string
-	iceConfig          icemaker.Config
-	isController       bool
-	onConnReady        func(priority ConnPriority, iceConnInfo ICEConnInfo)
-	onStatusDisconnect func(sessionChanged bool)
-	signaler           *signaling.Signaler
-	iFaceDiscover      stdnet.ExternalIFaceDiscover
-	statusRecorder     *status.Recorder
-	portForwardManager *portforward.Manager
-	hasRelayOnLocally  bool
+type WorkerICE struct {
+	ctx               context.Context
+	log               *log.Entry
+	config            ConnConfig
+	conn              *Conn
+	signaler          *Signaler
+	iFaceDiscover     stdnet.ExternalIFaceDiscover
+	statusRecorder    *Status
+	hasRelayOnLocally bool
 
 	agent             *icemaker.ThreadSafeAgent
 	agentDialerCancel context.CancelFunc
 	agentConnecting   bool      // while it is true, drop all incoming offers
 	lastSuccess       time.Time // with this avoid the too frequent ICE agent recreation
-	// connectedAgent is the agent whose connection was last reported ready; guarded by muxAgent
-	connectedAgent *icemaker.ThreadSafeAgent
 	// remoteSessionID represents the peer's session identifier from the latest remote offer.
-	remoteSessionID icemaker.SessionID
+	remoteSessionID ICESessionID
 	// sessionID is used to track the current session ID of the ICE agent
 	// increase by one when disconnecting the agent
 	// with it the remote peer can discard the already deprecated offer/answer
 	// Without it the remote peer may recreate a workable ICE connection
-	sessionID            icemaker.SessionID
+	sessionID            ICESessionID
 	remoteSessionChanged bool
 	muxAgent             sync.Mutex
 
 	localUfrag string
 	localPwd   string
 
+	// we record the last known state of the ICE agent to avoid duplicate on disconnected events
+	lastKnownState ice.ConnectionState
+
 	// portForwardAttempted tracks if we've already tried port forwarding this session
 	portForwardAttempted bool
 }
 
-func NewICE(log *log.Entry, key string, iceConfig icemaker.Config, isController bool, onConnReady func(ConnPriority, ICEConnInfo), onStatusDisconnect func(bool), services ICEDependencies, hasRelayOnLocally bool) (*ICE, error) {
-	sessionID, err := icemaker.NewSessionID()
+func NewWorkerICE(ctx context.Context, log *log.Entry, config ConnConfig, conn *Conn, signaler *Signaler, ifaceDiscover stdnet.ExternalIFaceDiscover, statusRecorder *Status, hasRelayOnLocally bool) (*WorkerICE, error) {
+	sessionID, err := NewICESessionID()
 	if err != nil {
 		return nil, err
 	}
 
-	w := &ICE{
-		log:                log,
-		key:                key,
-		iceConfig:          iceConfig,
-		isController:       isController,
-		onConnReady:        onConnReady,
-		onStatusDisconnect: onStatusDisconnect,
-		signaler:           services.Signaler,
-		iFaceDiscover:      services.IFaceDiscover,
-		statusRecorder:     services.StatusRecorder,
-		portForwardManager: services.PortForwardManager,
-		hasRelayOnLocally:  hasRelayOnLocally,
-		sessionID:          sessionID,
+	w := &WorkerICE{
+		ctx:               ctx,
+		log:               log,
+		config:            config,
+		conn:              conn,
+		signaler:          signaler,
+		iFaceDiscover:     ifaceDiscover,
+		statusRecorder:    statusRecorder,
+		hasRelayOnLocally: hasRelayOnLocally,
+		lastKnownState:    ice.ConnectionStateDisconnected,
+		sessionID:         sessionID,
 	}
 
 	localUfrag, localPwd, err := icemaker.GenerateICECredentials()
@@ -106,7 +94,7 @@ func NewICE(log *log.Entry, key string, iceConfig icemaker.Config, isController
 	return w, nil
 }
 
-func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerICE) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	w.log.Debugf("OnNewOffer for ICE, serial: %s", remoteOfferAnswer.SessionIDString())
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
@@ -130,7 +118,7 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 			}
 		}
 
-		sessionID, err := icemaker.NewSessionID()
+		sessionID, err := NewICESessionID()
 		if err != nil {
 			w.log.Errorf("failed to create new session ID: %s", err)
 		}
@@ -148,8 +136,8 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 	if remoteOfferAnswer.SessionID != nil {
 		w.log.Debugf("recreate ICE agent: %s / %s", w.sessionID, *remoteOfferAnswer.SessionID)
 	}
-	dialerCtx, dialerCancel := context.WithCancel(ctx)
-	agent, err := w.reCreateAgent(ctx, dialerCancel, preferredCandidateTypes)
+	dialerCtx, dialerCancel := context.WithCancel(w.ctx)
+	agent, err := w.reCreateAgent(dialerCancel, preferredCandidateTypes)
 	if err != nil {
 		w.log.Errorf("failed to recreate ICE Agent: %s", err)
 		return
@@ -163,14 +151,14 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 		w.remoteSessionID = ""
 	}
 
-	go w.connect(dialerCtx, dialerCancel, agent, remoteOfferAnswer)
+	go w.connect(dialerCtx, agent, remoteOfferAnswer)
 }
 
 // OnRemoteCandidate Handles ICE connection Candidate provided by the remote peer.
-func (w *ICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
+func (w *WorkerICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
-	w.log.Debugf("OnRemoteCandidate from peer %s -> %s", w.key, candidate.String())
+	w.log.Debugf("OnRemoteCandidate from peer %s -> %s", w.config.Key, candidate.String())
 	if w.agent == nil {
 		w.log.Warnf("ICE Agent is not initialized yet")
 		return
@@ -197,24 +185,18 @@ func (w *ICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
 	}
 }
 
-func (w *ICE) Credentials() signaling.Credentials {
-	w.muxAgent.Lock()
-	defer w.muxAgent.Unlock()
-	return signaling.Credentials{
-		UFrag:     w.localUfrag,
-		Pwd:       w.localPwd,
-		SessionID: w.sessionID,
-	}
+func (w *WorkerICE) GetLocalUserCredentials() (frag string, pwd string) {
+	return w.localUfrag, w.localPwd
 }
 
-func (w *ICE) InProgress() bool {
+func (w *WorkerICE) InProgress() bool {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
 	return w.agentConnecting
 }
 
-func (w *ICE) Close() {
+func (w *WorkerICE) Close() {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
@@ -230,10 +212,10 @@ func (w *ICE) Close() {
 	w.agent = nil
 }
 
-func (w *ICE) reCreateAgent(ctx context.Context, dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, error) {
+func (w *WorkerICE) reCreateAgent(dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, error) {
 	w.portForwardAttempted = false
 
-	agent, err := icemaker.NewAgent(ctx, w.iFaceDiscover, w.iceConfig, candidates, w.localUfrag, w.localPwd)
+	agent, err := icemaker.NewAgent(w.ctx, w.iFaceDiscover, w.config.ICEConfig, candidates, w.localUfrag, w.localPwd)
 	if err != nil {
 		return nil, fmt.Errorf("create agent: %w", err)
 	}
@@ -255,7 +237,7 @@ func (w *ICE) reCreateAgent(ctx context.Context, dialerCancel context.CancelFunc
 	return agent, nil
 }
 
-func (w *ICE) getSessionID() icemaker.SessionID {
+func (w *WorkerICE) SessionID() ICESessionID {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
@@ -265,11 +247,11 @@ func (w *ICE) getSessionID() icemaker.SessionID {
 // will block until connection succeeded
 // but it won't release if ICE Agent went into Disconnected or Failed state,
 // so we have to cancel it with the provided context once agent detected a broken connection
-func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerICE) connect(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) {
 	w.log.Debugf("gather candidates")
 	if err := agent.GatherCandidates(); err != nil {
 		w.log.Warnf("failed to gather candidates: %s", err)
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 
@@ -277,19 +259,19 @@ func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agen
 	remoteConn, err := w.turnAgentDial(ctx, agent, remoteOfferAnswer)
 	if err != nil {
 		w.log.Debugf("failed to dial the remote peer: %s", err)
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 	w.log.Debugf("agent dial succeeded")
 
 	pair, err := agent.GetSelectedCandidatePair()
 	if err != nil {
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 	if pair == nil {
 		w.log.Warnf("selected candidate pair is nil, cannot proceed")
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 
@@ -317,22 +299,17 @@ func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agen
 	}
 	w.log.Debugf("on ICE conn is ready to use")
 
+	w.log.Infof("connection succeeded with offer session: %s", remoteOfferAnswer.SessionIDString())
 	w.muxAgent.Lock()
-	if w.agent != agent {
-		w.muxAgent.Unlock()
-		w.log.Debugf("agent has been replaced during connect, dropping obsolete connection")
-		return
-	}
 	w.agentConnecting = false
 	w.lastSuccess = time.Now()
-	w.connectedAgent = agent
 	w.muxAgent.Unlock()
 
-	w.log.Infof("connection succeeded with offer session: %s", remoteOfferAnswer.SessionIDString())
-	w.onConnReady(selectedPriority(pair), ci)
+	// todo: the potential problem is a race between the onConnectionStateChange
+	w.conn.onICEConnectionIsReady(selectedPriority(pair), ci)
 }
 
-func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelFunc) bool {
+func (w *WorkerICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelFunc) bool {
 	cancel()
 	if err := agent.Close(); err != nil {
 		w.log.Warnf("failed to close ICE agent: %s", err)
@@ -346,7 +323,7 @@ func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelF
 
 	if w.agent == agent {
 		// consider to remove from here and move to the OnNewOffer
-		sessionID, err := icemaker.NewSessionID()
+		sessionID, err := NewICESessionID()
 		if err != nil {
 			w.log.Errorf("failed to create new session ID: %s", err)
 		}
@@ -358,7 +335,7 @@ func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelF
 	return sessionChanged
 }
 
-func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
+func (w *WorkerICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 	// wait local endpoint configuration
 	time.Sleep(time.Second)
 	addr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(pair.Remote.Address(), strconv.Itoa(remoteWgPort)))
@@ -367,7 +344,7 @@ func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 		return
 	}
 
-	mux, ok := w.iceConfig.UDPMuxSrflx.(*udpmux.UniversalUDPMuxDefault)
+	mux, ok := w.config.ICEConfig.UDPMuxSrflx.(*udpmux.UniversalUDPMuxDefault)
 	if !ok {
 		w.log.Warn("invalid udp mux conversion")
 		return
@@ -380,7 +357,7 @@ func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 
 // onICECandidate is a callback attached to an ICE Agent to receive new local connection candidates
 // and then signals them to the remote peer
-func (w *ICE) onICECandidate(candidate ice.Candidate) {
+func (w *WorkerICE) onICECandidate(candidate ice.Candidate) {
 	// nil means candidate gathering has been ended
 	if candidate == nil {
 		return
@@ -389,9 +366,9 @@ func (w *ICE) onICECandidate(candidate ice.Candidate) {
 	// TODO: reported port is incorrect for CandidateTypeHost, makes understanding ICE use via logs confusing as port is ignored
 	w.log.Debugf("discovered local candidate %s", candidate.String())
 	go func() {
-		err := w.signaler.SignalICECandidate(candidate, w.key)
+		err := w.signaler.SignalICECandidate(candidate, w.config.Key)
 		if err != nil {
-			w.log.Errorf("failed signaling candidate to the remote peer %s %s", w.key, err)
+			w.log.Errorf("failed signaling candidate to the remote peer %s %s", w.config.Key, err)
 		}
 	}()
 
@@ -401,8 +378,8 @@ func (w *ICE) onICECandidate(candidate ice.Candidate) {
 }
 
 // injectPortForwardedCandidate signals an additional candidate using the pre-created port mapping.
-func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
-	pfManager := w.portForwardManager
+func (w *WorkerICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
+	pfManager := w.conn.portForwardManager
 	if pfManager == nil {
 		return
 	}
@@ -430,7 +407,7 @@ func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
 		forwardedCandidate.String(), mapping.InternalPort, mapping.ExternalPort, mapping.NATType, forwardedCandidate.Priority())
 
 	go func() {
-		if err := w.signaler.SignalICECandidate(forwardedCandidate, w.key); err != nil {
+		if err := w.signaler.SignalICECandidate(forwardedCandidate, w.config.Key); err != nil {
 			w.log.Errorf("signal port-forwarded candidate: %v", err)
 		}
 	}()
@@ -438,7 +415,7 @@ func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
 
 // createForwardedCandidate creates a new server reflexive candidate with the forwarded port.
 // It uses the NAT gateway's external IP with the forwarded port.
-func (w *ICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *portforward.Mapping) (ice.Candidate, error) {
+func (w *WorkerICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *portforward.Mapping) (ice.Candidate, error) {
 	var externalIP string
 	if mapping.ExternalIP != nil && !mapping.ExternalIP.IsUnspecified() {
 		externalIP = mapping.ExternalIP.String()
@@ -483,9 +460,9 @@ func (w *ICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *po
 	return candidate, nil
 }
 
-func (w *ICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2 ice.Candidate) {
+func (w *WorkerICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2 ice.Candidate) {
 	w.log.Debugf("selected candidate pair [local <-> remote] -> [%s <-> %s], peer %s", c1.String(), c2.String(),
-		w.key)
+		w.config.Key)
 
 	pairStat, ok := agent.GetSelectedCandidatePairStats()
 	if !ok {
@@ -494,14 +471,14 @@ func (w *ICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2
 	}
 
 	duration := time.Duration(pairStat.CurrentRoundTripTime * float64(time.Second))
-	if err := w.statusRecorder.UpdateLatency(w.key, duration); err != nil {
+	if err := w.statusRecorder.UpdateLatency(w.config.Key, duration); err != nil {
 		w.log.Debugf("failed to update latency for peer: %s", err)
 		return
 	}
 }
 
-func (w *ICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
-	sessionID := w.getSessionID()
+func (w *WorkerICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
+	sessionID := w.SessionID()
 	stats := agent.GetCandidatePairsStats()
 	localCandidates, _ := agent.GetLocalCandidates()
 	remoteCandidates, _ := agent.GetRemoteCandidates()
@@ -531,44 +508,32 @@ func (w *ICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
 	}
 }
 
-func (w *ICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dialerCancel context.CancelFunc) func(ice.ConnectionState) {
-	// per-agent state; pion delivers callbacks of one agent sequentially
-	var connected bool
+func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dialerCancel context.CancelFunc) func(ice.ConnectionState) {
 	return func(state ice.ConnectionState) {
 		w.log.Debugf("ICE ConnectionState has changed to %s", state.String())
 		switch state {
 		case ice.ConnectionStateConnected:
-			connected = true
+			w.lastKnownState = ice.ConnectionStateConnected
 			w.logSuccessfulPaths(agent)
+			return
 		case ice.ConnectionStateFailed, ice.ConnectionStateDisconnected, ice.ConnectionStateClosed:
 			// ice.ConnectionStateClosed happens when we recreate the agent. For the P2P to TURN switch important to
 			// notify the conn.onICEStateDisconnected changes to update the current used priority
 
 			sessionChanged := w.closeAgent(agent, dialerCancel)
 
-			if !connected {
-				return
+			if w.lastKnownState == ice.ConnectionStateConnected {
+				w.lastKnownState = ice.ConnectionStateDisconnected
+				w.conn.onICEStateDisconnected(sessionChanged)
 			}
-			connected = false
-
-			w.muxAgent.Lock()
-			stale := w.connectedAgent != agent
-			if !stale {
-				w.connectedAgent = nil
-			}
-			w.muxAgent.Unlock()
-
-			if stale {
-				w.log.Debugf("suppress disconnected event of replaced ICE agent")
-				return
-			}
-			w.onStatusDisconnect(sessionChanged)
+		default:
+			return
 		}
 	}
 }
 
-func (w *ICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *signaling.OfferAnswer) (*ice.Conn, error) {
-	if w.isController {
+func (w *WorkerICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (*ice.Conn, error) {
+	if isController(w.config) {
 		return agent.Dial(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
 	} else {
 		return agent.Accept(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
@@ -630,10 +595,10 @@ func isRelayed(pair *ice.CandidatePair) bool {
 	return false
 }
 
-func selectedPriority(pair *ice.CandidatePair) ConnPriority {
+func selectedPriority(pair *ice.CandidatePair) conntype.ConnPriority {
 	if isRelayed(pair) {
-		return ICETurn
+		return conntype.ICETurn
 	} else {
-		return ICEP2P
+		return conntype.ICEP2P
 	}
 }

client/internal/peer/worker_relay.go

@@ -1,4 +1,4 @@
-package worker
+package peer
 
 import (
 	"context"
@@ -10,23 +10,22 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
 
 type RelayConnInfo struct {
-	RelayedConn     net.Conn
-	RosenpassPubKey []byte
-	RosenpassAddr   string
+	relayedConn     net.Conn
+	rosenpassPubKey []byte
+	rosenpassAddr   string
 }
 
 type WorkerRelay struct {
-	log            *log.Entry
-	key            string
-	isController   bool
-	onConnReady    func(RelayConnInfo)
-	onDisconnected func()
-	relayManager   *relayClient.Manager
+	peerCtx      context.Context
+	log          *log.Entry
+	isController bool
+	config       ConnConfig
+	conn         *Conn
+	relayManager *relayClient.Manager
 
 	relayedConn net.Conn
 	relayLock   sync.Mutex
@@ -34,19 +33,19 @@ type WorkerRelay struct {
 	relaySupportedOnRemotePeer atomic.Bool
 }
 
-func NewWorkerRelay(log *log.Entry, key string, isController bool, onConnReady func(RelayConnInfo), onDisconnected func(), relayManager *relayClient.Manager) *WorkerRelay {
+func NewWorkerRelay(ctx context.Context, log *log.Entry, ctrl bool, config ConnConfig, conn *Conn, relayManager *relayClient.Manager) *WorkerRelay {
 	r := &WorkerRelay{
-		log:            log,
-		key:            key,
-		isController:   isController,
-		onConnReady:    onConnReady,
-		onDisconnected: onDisconnected,
-		relayManager:   relayManager,
+		peerCtx:      ctx,
+		log:          log,
+		isController: ctrl,
+		config:       config,
+		conn:         conn,
+		relayManager: relayManager,
 	}
 	return r
 }
 
-func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	if !w.isRelaySupported(remoteOfferAnswer) {
 		w.log.Infof("Relay is not supported by remote peer")
 		w.relaySupportedOnRemotePeer.Store(false)
@@ -67,7 +66,7 @@ func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signali
 		serverIP = remoteOfferAnswer.RelaySrvIP
 	}
 
-	relayedConn, err := w.relayManager.OpenConn(ctx, srv, w.key, serverIP)
+	relayedConn, err := w.relayManager.OpenConn(w.peerCtx, srv, w.config.Key, serverIP)
 	if err != nil {
 		if errors.Is(err, relayClient.ErrConnAlreadyExists) {
 			w.log.Debugf("handled offer by reusing existing relay connection")
@@ -89,10 +88,10 @@ func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signali
 	}
 
 	w.log.Debugf("peer conn opened via Relay: %s", srv)
-	w.onConnReady(RelayConnInfo{
-		RelayedConn:     relayedConn,
-		RosenpassPubKey: remoteOfferAnswer.RosenpassPubKey,
-		RosenpassAddr:   remoteOfferAnswer.RosenpassAddr,
+	go w.conn.onRelayConnectionIsReady(RelayConnInfo{
+		relayedConn:     relayedConn,
+		rosenpassPubKey: remoteOfferAnswer.RosenpassPubKey,
+		rosenpassAddr:   remoteOfferAnswer.RosenpassAddr,
 	})
 }
 
@@ -120,7 +119,7 @@ func (w *WorkerRelay) CloseConn() {
 	}
 }
 
-func (w *WorkerRelay) isRelaySupported(answer *signaling.OfferAnswer) bool {
+func (w *WorkerRelay) isRelaySupported(answer *OfferAnswer) bool {
 	if !w.relayManager.HasRelayAddress() {
 		return false
 	}
@@ -135,5 +134,5 @@ func (w *WorkerRelay) preferredRelayServer(myRelayAddress, remoteRelayAddress st
 }
 
 func (w *WorkerRelay) onRelayClientDisconnected() {
-	w.onDisconnected()
+	go w.conn.onRelayDisconnected()
 }

client/mdm/canonical_loaders.go

@@ -22,6 +22,7 @@ var allKeys = []string{
 	KeyDisableMetricsCollection,
 	KeyAllowServerSSH,
 	KeyDisableAutoConnect,
+	KeyDisableAutostart,
 	KeyPreSharedKey,
 	KeyRosenpassEnabled,
 	KeyRosenpassPermissive,

client/mdm/policy.go

@@ -20,10 +20,10 @@ import (
 // names (lowerCamelCase) so the daemon can map a Policy key directly to a
 // configuration field.
 const (
-	KeyManagementURL            = "managementURL"
-	KeyDisableUpdateSettings    = "disableUpdateSettings"
-	KeyDisableProfiles          = "disableProfiles"
-	KeyDisableNetworks          = "disableNetworks"
+	KeyManagementURL         = "managementURL"
+	KeyDisableUpdateSettings = "disableUpdateSettings"
+	KeyDisableProfiles       = "disableProfiles"
+	KeyDisableNetworks       = "disableNetworks"
 	// KeyDisableAdvancedView gates the advanced-view section in the
 	// upcoming UI revision. UI-only: NOT stored on Config, not
 	// applied by applyMDMPolicy, not rejectable via SetConfig. The
@@ -37,10 +37,16 @@ const (
 	KeyDisableMetricsCollection = "disableMetricsCollection"
 	KeyAllowServerSSH           = "allowServerSSH"
 	KeyDisableAutoConnect       = "disableAutoConnect"
-	KeyPreSharedKey             = "preSharedKey"
-	KeyRosenpassEnabled         = "rosenpassEnabled"
-	KeyRosenpassPermissive      = "rosenpassPermissive"
-	KeyWireguardPort            = "wireguardPort"
+	// KeyDisableAutostart suppresses the GUI's fresh-install
+	// launch-on-login default and marks the Settings toggle as
+	// MDM-managed. UI-only: NOT stored on Config and not applied by
+	// applyMDMPolicy; the GUI reads it directly and it appears in
+	// GetConfigResponse.mDMManagedFields when set.
+	KeyDisableAutostart    = "disableAutostart"
+	KeyPreSharedKey        = "preSharedKey"
+	KeyRosenpassEnabled    = "rosenpassEnabled"
+	KeyRosenpassPermissive = "rosenpassPermissive"
+	KeyWireguardPort       = "wireguardPort"
 
 	// Split tunnel is modeled as a single conceptual policy with two
 	// registry/plist values. KeySplitTunnelMode is the discriminator

client/status/status.go

@@ -746,6 +746,8 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
 	}
 
+	pbFullStatus.Events = fullStatus.Events
+
 	return &pbFullStatus
 }
 

client/ui/autostart_default.go

@@ -0,0 +1,107 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// autostartDefaultState carries the guard inputs of the one-time autostart
+// default decision so the decision itself stays a pure, testable function.
+type autostartDefaultState struct {
+	supported    bool
+	mdmDisabled  bool
+	priorInstall bool
+}
+
+// shouldEnableAutostartDefault applies the first-run guards in order and
+// returns whether autostart may be enabled, plus the reason when it may not.
+func shouldEnableAutostartDefault(s autostartDefaultState) (bool, string) {
+	switch {
+	case !s.supported:
+		return false, "autostart not supported on this platform"
+	case s.mdmDisabled:
+		return false, "autostart disabled by MDM policy"
+	case s.priorInstall:
+		return false, "existing NetBird installation"
+	}
+	return true, ""
+}
+
+// autostartDisabledByMDM reports whether the MDM policy manages the
+// disableAutostart key in a way that must suppress the default. An
+// unparseable managed value is treated as disabled to stay on the safe side.
+func autostartDisabledByMDM(policy *mdm.Policy) bool {
+	if !policy.HasKey(mdm.KeyDisableAutostart) {
+		return false
+	}
+	disabled, ok := policy.GetBool(mdm.KeyDisableAutostart)
+	return !ok || disabled
+}
+
+// netbirdFootprintExists reports whether the machine already carries NetBird
+// daemon config or state, meaning this is not a genuinely fresh install. It is
+// the update-safety gate for the autostart default: upgrading users always
+// have a footprint, so an update can never trigger a login-item write.
+func netbirdFootprintExists() bool {
+	candidates := []string{
+		profilemanager.DefaultConfigPath,
+		filepath.Join(profilemanager.DefaultConfigPathDir, "config.json"),
+		filepath.Join(profilemanager.DefaultConfigPathDir, "state.json"),
+	}
+	for _, path := range candidates {
+		if path != "" && fileExists(path) {
+			return true
+		}
+	}
+	return false
+}
+
+// applyAutostartDefault runs the one-time launch-on-login default for genuinely
+// fresh installs. The autostartInitialized marker is persisted before any
+// enable attempt so a crash mid-flow degrades to "never enabled" instead of
+// retrying login-item writes on every launch. A user's later disable in
+// Settings is never overridden: the marker guarantees at-most-once, ever.
+func applyAutostartDefault(ctx context.Context, autostart *services.Autostart, prefs *preferences.Store, prefsFileExisted bool) {
+	priorFootprint := netbirdFootprintExists() || prefsFileExisted
+
+	if prefs.Get().AutostartInitialized {
+		return
+	}
+	if err := prefs.SetAutostartInitialized(true); err != nil {
+		log.Warnf("persist autostart marker, skipping autostart default: %v", err)
+		return
+	}
+
+	state := autostartDefaultState{
+		supported:    autostart.Supported(ctx),
+		mdmDisabled:  autostartDisabledByMDM(mdm.LoadPolicy()),
+		priorInstall: priorFootprint,
+	}
+	enable, reason := shouldEnableAutostartDefault(state)
+	if !enable {
+		log.Debugf("skipping autostart default: %s", reason)
+		return
+	}
+
+	if err := autostart.SetEnabled(ctx, true); err != nil {
+		log.Warnf("enable autostart on fresh install: %v", err)
+		return
+	}
+	log.Info("autostart enabled by default on fresh install")
+}
+
+// fileExists reports whether path exists.
+func fileExists(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}

client/ui/autostart_default_test.go

@@ -0,0 +1,125 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+func TestShouldEnableAutostartDefault(t *testing.T) {
+	allPass := autostartDefaultState{
+		supported:    true,
+		mdmDisabled:  false,
+		priorInstall: false,
+	}
+
+	tests := []struct {
+		name       string
+		mutate     func(*autostartDefaultState)
+		wantEnable bool
+		wantReason string
+	}{
+		{
+			name:       "fresh install with all guards passing enables",
+			mutate:     func(*autostartDefaultState) {},
+			wantEnable: true,
+		},
+		{
+			name:       "unsupported platform skips",
+			mutate:     func(s *autostartDefaultState) { s.supported = false },
+			wantReason: "autostart not supported on this platform",
+		},
+		{
+			name:       "MDM disable skips",
+			mutate:     func(s *autostartDefaultState) { s.mdmDisabled = true },
+			wantReason: "autostart disabled by MDM policy",
+		},
+		{
+			name:       "existing installation (upgrade) skips",
+			mutate:     func(s *autostartDefaultState) { s.priorInstall = true },
+			wantReason: "existing NetBird installation",
+		},
+		{
+			name: "unsupported wins over every other guard",
+			mutate: func(s *autostartDefaultState) {
+				s.supported = false
+				s.mdmDisabled = true
+				s.priorInstall = true
+			},
+			wantReason: "autostart not supported on this platform",
+		},
+		{
+			name: "MDM disable wins over prior install",
+			mutate: func(s *autostartDefaultState) {
+				s.mdmDisabled = true
+				s.priorInstall = true
+			},
+			wantReason: "autostart disabled by MDM policy",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			state := allPass
+			tc.mutate(&state)
+			enable, reason := shouldEnableAutostartDefault(state)
+			assert.Equal(t, tc.wantEnable, enable, "enable decision should match for state %+v", state)
+			assert.Equal(t, tc.wantReason, reason, "skip reason should identify the failing guard")
+		})
+	}
+}
+
+func TestAutostartDisabledByMDM(t *testing.T) {
+	tests := []struct {
+		name   string
+		values map[string]any
+		want   bool
+	}{
+		{
+			name:   "empty policy does not disable",
+			values: nil,
+			want:   false,
+		},
+		{
+			name:   "unrelated managed keys do not disable",
+			values: map[string]any{mdm.KeyDisableAutoConnect: true},
+			want:   false,
+		},
+		{
+			name:   "disableAutostart true disables",
+			values: map[string]any{mdm.KeyDisableAutostart: true},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart registry DWORD 1 disables",
+			values: map[string]any{mdm.KeyDisableAutostart: int64(1)},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart string true disables",
+			values: map[string]any{mdm.KeyDisableAutostart: "true"},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart explicit false allows",
+			values: map[string]any{mdm.KeyDisableAutostart: false},
+			want:   false,
+		},
+		{
+			name:   "unparseable managed value is treated as disabled",
+			values: map[string]any{mdm.KeyDisableAutostart: "not-a-bool"},
+			want:   true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := autostartDisabledByMDM(mdm.NewPolicy(tc.values))
+			assert.Equal(t, tc.want, got, "MDM disable decision should match for values %v", tc.values)
+		})
+	}
+}

client/ui/frontend/src/lib/connection.ts

@@ -51,7 +51,14 @@ async function runSsoLogin(
     if (uri) await openBrowserLoginUri(uri);
 
     const cancelPromise = buildSsoCancelPromise(state, signal);
-    const waitPromise = Connection.WaitSSOLogin({ userCode: result.userCode, hostname: "" });
+    // Combine wait + up in Go so the connection comes up the moment SSO
+    // completes. During SSO the tray window is hidden and the webview is
+    // suspended, so a frontend-driven Up (a promise continuation) would not
+    // fire until the user woke the window (e.g. hovering the tray icon).
+    const waitPromise = Connection.WaitSSOLoginAndUp(
+        { userCode: result.userCode, hostname: "" },
+        { profileName: "", username: "" },
+    );
 
     try {
         await Promise.race([waitPromise, cancelPromise]);
@@ -89,13 +96,13 @@ export async function startConnection(onSettled?: () => void, signal?: AbortSign
         if (signal?.aborted) state.cancelled = true;
 
         if (!state.cancelled && result.needsSsoLogin) {
+            // runSsoLogin brings the connection up in Go once SSO completes.
             await runSsoLogin(result, state, signal);
-        }
-
-        if (!state.cancelled && signal?.aborted) state.cancelled = true;
-
-        if (!state.cancelled) {
-            await Connection.Up({ profileName: "", username: "" });
+        } else {
+            if (!state.cancelled && signal?.aborted) state.cancelled = true;
+            if (!state.cancelled) {
+                await Connection.Up({ profileName: "", username: "" });
+            }
         }
     } catch (e) {
         WindowManager.CloseBrowserLogin().catch(console.error);

client/ui/main.go

@@ -197,6 +197,9 @@ func main() {
 		// daemon may keep the main window from showing, so the OS toast is the
 		// only reliable signal the user gets.
 		go notifyIfDaemonOutdated(compat, notifier, localizer)
+		// One-time launch-on-login default for fresh installs; gated by the
+		// NetBird footprint check, MDM policy, and the persisted marker.
+		go applyAutostartDefault(context.Background(), services.NewAutostart(app.Autostart), prefStore, prefStore.ExistedAtLoad())
 	})
 
 	if err := app.Run(); err != nil {

client/ui/preferences/store.go

@@ -54,6 +54,10 @@ type UIPreferences struct {
 	Language            i18n.LanguageCode `json:"language"`
 	ViewMode            ViewMode          `json:"viewMode"`
 	OnboardingCompleted bool              `json:"onboardingCompleted"`
+	// AutostartInitialized records that the one-time autostart default
+	// decision has run for this OS user. It only ever transitions to true
+	// and is never reset, so the default-on flow runs at most once, ever.
+	AutostartInitialized bool `json:"autostartInitialized"`
 }
 
 // LanguageValidator rejects SetLanguage inputs with no shipped bundle.
@@ -72,8 +76,9 @@ type Emitter interface {
 type Store struct {
 	path string
 
-	mu      sync.RWMutex
-	current UIPreferences
+	mu            sync.RWMutex
+	current       UIPreferences
+	existedAtLoad bool
 
 	subsMu sync.Mutex
 	subs   []chan UIPreferences
@@ -157,6 +162,27 @@ func (s *Store) SetOnboardingCompleted(done bool) error {
 	return nil
 }
 
+// SetAutostartInitialized persists the one-time autostart decision marker.
+// No-op if unchanged.
+func (s *Store) SetAutostartInitialized(done bool) error {
+	s.mu.Lock()
+	if s.current.AutostartInitialized == done {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.AutostartInitialized = done
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
 // SetLanguage validates, persists, and broadcasts. No-op if unchanged.
 func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
 	if lang == "" {
@@ -206,13 +232,29 @@ func (s *Store) Subscribe() (<-chan UIPreferences, func()) {
 	return ch, unsubscribe
 }
 
+// ExistedAtLoad reports whether the backing preferences file was present on
+// disk when the store loaded. It distinguishes a user who ran a prior GUI
+// version from a brand-new OS user with no preferences yet.
+func (s *Store) ExistedAtLoad() bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.existedAtLoad
+}
+
 // load reads the file into current. A missing file is not an error (the
 // in-memory default stands); malformed contents return an error.
 func (s *Store) load() error {
-	if _, err := os.Stat(s.path); errors.Is(err, os.ErrNotExist) {
-		return nil
+	if _, err := os.Stat(s.path); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil
+		}
+		return fmt.Errorf("stat preferences: %w", err)
 	}
 
+	s.mu.Lock()
+	s.existedAtLoad = true
+	s.mu.Unlock()
+
 	var loaded UIPreferences
 	if _, err := util.ReadJson(s.path, &loaded); err != nil {
 		return err

client/ui/preferences/store_test.go

@@ -215,6 +215,46 @@ func TestStore_FileShapeIsJSON(t *testing.T) {
 	assert.Equal(t, i18n.LanguageCode("hu"), parsed.Language)
 }
 
+func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
+	withTempConfigDir(t)
+	emitter := &recordingEmitter{}
+	s, err := NewStore(nil, emitter)
+	require.NoError(t, err)
+
+	assert.False(t, s.Get().AutostartInitialized, "marker must default to false when no file is on disk")
+
+	require.NoError(t, s.SetAutostartInitialized(true))
+	assert.True(t, s.Get().AutostartInitialized, "Get should reflect the persisted marker")
+	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first marker write should broadcast")
+
+	// Re-setting the same value must be a no-op: no disk write, no broadcast.
+	require.NoError(t, s.SetAutostartInitialized(true))
+	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent marker write should not broadcast again")
+
+	// A fresh Store (new GUI launch) must see the marker so the autostart
+	// default decision never runs twice.
+	reloaded, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
+}
+
+func TestStore_ExistedAtLoad(t *testing.T) {
+	withTempConfigDir(t)
+
+	// Brand-new OS user: no preferences file on disk yet.
+	fresh, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.False(t, fresh.ExistedAtLoad(), "ExistedAtLoad must be false when no file is on disk")
+
+	// Persisting a value writes the file to disk.
+	require.NoError(t, fresh.SetLanguage("en"))
+
+	// A subsequent GUI launch reopens the now-present file.
+	reopened, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.True(t, reopened.ExistedAtLoad(), "ExistedAtLoad must be true after the store has persisted and is reopened")
+}
+
 func TestStore_ErrUnsupportedSentinel(t *testing.T) {
 	// Verifies callers can match on the sentinel error rather than parsing
 	// strings — protects against accidental %v -> %w changes that would

client/ui/services/connection.go

@@ -35,7 +35,7 @@ type LoginResult struct {
 	VerificationURIComplete string `json:"verificationUriComplete"`
 }
 
-// WaitSSOParams are the inputs to WaitSSOLogin.
+// WaitSSOParams are the inputs to waitSSOLogin.
 type WaitSSOParams struct {
 	UserCode string `json:"userCode"`
 	Hostname string `json:"hostname"`
@@ -125,23 +125,6 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	}, nil
 }
 
-func (s *Connection) WaitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return "", err
-	}
-	log.Infof("waiting for SSO login to complete")
-	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
-		UserCode: p.UserCode,
-		Hostname: p.Hostname,
-	})
-	if err != nil {
-		return "", s.classifyDaemonError(err)
-	}
-	log.Infof("SSO login completed, daemon reported success")
-	return resp.GetEmail(), nil
-}
-
 func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -162,6 +145,27 @@ func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	return nil
 }
 
+// WaitSSOLoginAndUp blocks until the SSO login completes and then brings the
+// connection up, both from the Go side. Keeping the post-login Up here rather
+// than as a frontend continuation is deliberate: during SSO the tray window is
+// hidden and the webview is suspended (macOS App Nap / hidden-window timer
+// throttling), so a frontend-driven Up would not run until the user woke the
+// window (e.g. by hovering the tray icon). Doing it in Go connects the moment
+// the daemon reports SSO success. Returns the authenticated user's email.
+func (s *Connection) WaitSSOLoginAndUp(ctx context.Context, wait WaitSSOParams, up UpParams) (string, error) {
+	email, err := s.waitSSOLogin(ctx, wait)
+	if err != nil {
+		return "", err
+	}
+	if err := ctx.Err(); err != nil {
+		return "", err
+	}
+	if err := s.Up(ctx, up); err != nil {
+		return "", err
+	}
+	return email, nil
+}
+
 func (s *Connection) Down(ctx context.Context) error {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -221,6 +225,26 @@ func (s *Connection) Logout(ctx context.Context, p LogoutParams) error {
 	return nil
 }
 
+// waitSSOLogin blocks until the daemon reports the SSO login result and returns
+// the authenticated user's email. It is unexported because the frontend drives
+// SSO through the exported WaitSSOLoginAndUp.
+func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	log.Infof("waiting for SSO login to complete")
+	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
+		UserCode: p.UserCode,
+		Hostname: p.Hostname,
+	})
+	if err != nil {
+		return "", s.classifyDaemonError(err)
+	}
+	log.Infof("SSO login completed, daemon reported success")
+	return resp.GetEmail(), nil
+}
+
 // classifyDaemonError maps a gRPC error to a localised ClientError.
 func (s *Connection) classifyDaemonError(err error) *ClientError {
 	return s.classifier.classify(err)

client/ui/services/settings.go

@@ -20,11 +20,12 @@ type MDMFields struct {
 	DisableServerRoutes      bool   `json:"disableServerRoutes"`
 	AllowServerSSH           *bool  `json:"allowServerSSH"`
 	DisableAutoConnect       bool   `json:"disableAutoConnect"`
+	DisableAutostart         bool   `json:"disableAutostart"`
 	BlockInbound             bool   `json:"blockInbound"`
 	DisableMetricsCollection bool   `json:"disableMetricsCollection"`
 	SplitTunnelMode          bool   `json:"splitTunnelMode"`
 	SplitTunnelApps          bool   `json:"splitTunnelApps"`
-	DisableAdvancedView bool `json:"disableAdvancedView"`
+	DisableAdvancedView      bool   `json:"disableAdvancedView"`
 }
 
 type Features struct {

management/internals/modules/peers/ephemeral/manager/ephemeral.go

@@ -215,7 +215,7 @@ func (e *EphemeralManager) cleanup(ctx context.Context) {
 	}
 
 	for accountID, peerIDs := range peerIDsPerAccount {
-		log.WithContext(ctx).Tracef("cleanup: deleting %d ephemeral peers for account %s", len(peerIDs), accountID)
+		log.WithContext(ctx).Debugf("cleanup: deleting %d ephemeral peers for account %s: %s", len(peerIDs), accountID, peerIDs)
 		err := e.peersManager.DeletePeers(ctx, accountID, peerIDs, activity.SystemInitiator, true)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to delete ephemeral peers: %s", err)

management/internals/modules/peers/manager.go

@@ -184,6 +184,8 @@ func (m *managerImpl) DeletePeers(ctx context.Context, accountID string, peerIDs
 				return err
 			}
 
+			log.WithContext(ctx).Debugf("DeletePeers: deleted peer %s", peerID)
+
 			if !(peer.ProxyMeta.Embedded || peer.Meta.KernelVersion == "wasm") {
 				eventsToStore = append(eventsToStore, func() {
 					m.accountManager.StoreEvent(ctx, userID, peer.ID, accountID, activity.PeerRemovedByUser, peer.EventMeta(dnsDomain))

management/internals/shared/grpc/token_mgr.go

@@ -161,6 +161,8 @@ func (m *TimeBasedAuthSecretsManager) SetupRefresh(ctx context.Context, accountI
 		m.turnCancelMap[peerID] = turnCancel
 		go m.refreshTURNTokens(ctx, accountID, peerID, turnCancel)
 		log.WithContext(ctx).Debugf("starting TURN refresh for %s", peerID)
+	} else {
+		log.WithContext(ctx).Debugf("no TURN configuration, skipping TURN refresh for %s", peerID)
 	}
 
 	if m.relayCfg != nil {
@@ -168,6 +170,8 @@ func (m *TimeBasedAuthSecretsManager) SetupRefresh(ctx context.Context, accountI
 		m.relayCancelMap[peerID] = relayCancel
 		go m.refreshRelayTokens(ctx, accountID, peerID, relayCancel)
 		log.WithContext(ctx).Tracef("starting relay refresh for %s", peerID)
+	} else {
+		log.WithContext(ctx).Tracef("no relay configuration, skipping relay refresh for %s", peerID)
 	}
 }
 

management/server/http/handlers/accounts/accounts_handler.go

@@ -286,6 +286,21 @@ func (h *handler) updateAccountRequestSettings(req api.PutApiAccountsAccountIdJS
 	if req.Settings.MetricsPushEnabled != nil {
 		returnSettings.MetricsPushEnabled = *req.Settings.MetricsPushEnabled
 	}
+	if req.Settings.AgentNetworkOnly != nil {
+		returnSettings.AgentNetworkOnly = *req.Settings.AgentNetworkOnly
+	}
+	if req.Settings.DashboardFeatures != nil {
+		returnSettings.DashboardFeatures = &types.DashboardFeatures{
+			AgentNetwork: req.Settings.DashboardFeatures.AgentNetwork,
+		}
+	}
+
+	if returnSettings.AgentNetworkOnly &&
+		(returnSettings.DashboardFeatures == nil ||
+			returnSettings.DashboardFeatures.AgentNetwork == nil ||
+			!*returnSettings.DashboardFeatures.AgentNetwork) {
+		return nil, status.Errorf(status.InvalidArgument, "agent network only mode requires dashboard_features.agent_network to be enabled")
+	}
 
 	return returnSettings, nil
 }
@@ -417,6 +432,7 @@ func toAccountResponse(accountID string, settings *types.Settings, meta *types.A
 		AutoUpdateAlways:                &settings.AutoUpdateAlways,
 		Ipv6EnabledGroups:               &settings.IPv6EnabledGroups,
 		MetricsPushEnabled:              &settings.MetricsPushEnabled,
+		AgentNetworkOnly:                &settings.AgentNetworkOnly,
 		EmbeddedIdpEnabled:              &settings.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               &settings.LocalAuthDisabled,
 		LocalMfaEnabled:                 &settings.LocalMfaEnabled,
@@ -430,6 +446,11 @@ func toAccountResponse(accountID string, settings *types.Settings, meta *types.A
 		networkRangeV6Str := settings.NetworkRangeV6.String()
 		apiSettings.NetworkRangeV6 = &networkRangeV6Str
 	}
+	if settings.DashboardFeatures != nil {
+		apiSettings.DashboardFeatures = &api.AccountDashboardFeatures{
+			AgentNetwork: settings.DashboardFeatures.AgentNetwork,
+		}
+	}
 
 	apiOnboarding := api.AccountOnboarding{
 		OnboardingFlowPending: onboarding.OnboardingFlowPending,

management/server/http/handlers/accounts/accounts_handler_test.go

@@ -130,6 +130,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -158,6 +159,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -186,6 +188,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr("latest"),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -214,6 +217,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -242,6 +246,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -270,6 +275,109 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
+				EmbeddedIdpEnabled:              br(false),
+				LocalAuthDisabled:               br(false),
+				LocalMfaEnabled:                 br(false),
+			},
+			expectedArray: false,
+			expectedID:    accountID,
+		},
+		{
+			name:           "PutAccount OK enabling agent_network_only",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": true,\"dashboard_features\": {\"agent_network\": true}},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusOK,
+			expectedSettings: api.AccountSettings{
+				PeerLoginExpiration:             15552000,
+				PeerLoginExpirationEnabled:      true,
+				GroupsPropagationEnabled:        br(false),
+				JwtGroupsClaimName:              sr(""),
+				JwtGroupsEnabled:                br(false),
+				JwtAllowGroups:                  &[]string{},
+				RegularUsersViewBlocked:         false,
+				RoutingPeerDnsResolutionEnabled: br(false),
+				LazyConnectionEnabled:           br(false),
+				DnsDomain:                       sr(""),
+				AutoUpdateAlways:                br(false),
+				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(true),
+				DashboardFeatures: &api.AccountDashboardFeatures{
+					AgentNetwork: br(true),
+				},
+				EmbeddedIdpEnabled: br(false),
+				LocalAuthDisabled:  br(false),
+				LocalMfaEnabled:    br(false),
+			},
+			expectedArray: false,
+			expectedID:    accountID,
+		},
+		{
+			name:           "PutAccount fails enabling agent_network_only without dashboard_features",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": true},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusUnprocessableEntity,
+			expectedArray:  false,
+		},
+		{
+			name:           "PutAccount OK setting dashboard_features agent_network",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"dashboard_features\": {\"agent_network\": true}},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusOK,
+			expectedSettings: api.AccountSettings{
+				PeerLoginExpiration:             15552000,
+				PeerLoginExpirationEnabled:      true,
+				GroupsPropagationEnabled:        br(false),
+				JwtGroupsClaimName:              sr(""),
+				JwtGroupsEnabled:                br(false),
+				JwtAllowGroups:                  &[]string{},
+				RegularUsersViewBlocked:         false,
+				RoutingPeerDnsResolutionEnabled: br(false),
+				LazyConnectionEnabled:           br(false),
+				DnsDomain:                       sr(""),
+				AutoUpdateAlways:                br(false),
+				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
+				DashboardFeatures: &api.AccountDashboardFeatures{
+					AgentNetwork: br(true),
+				},
+				EmbeddedIdpEnabled: br(false),
+				LocalAuthDisabled:  br(false),
+				LocalMfaEnabled:    br(false),
+			},
+			expectedArray: false,
+			expectedID:    accountID,
+		},
+		{
+			name:           "PutAccount OK disabling agent_network_only again",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": false},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusOK,
+			expectedSettings: api.AccountSettings{
+				PeerLoginExpiration:             15552000,
+				PeerLoginExpirationEnabled:      true,
+				GroupsPropagationEnabled:        br(false),
+				JwtGroupsClaimName:              sr(""),
+				JwtGroupsEnabled:                br(false),
+				JwtAllowGroups:                  &[]string{},
+				RegularUsersViewBlocked:         false,
+				RoutingPeerDnsResolutionEnabled: br(false),
+				LazyConnectionEnabled:           br(false),
+				DnsDomain:                       sr(""),
+				AutoUpdateAlways:                br(false),
+				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),

management/server/peer.go

@@ -106,11 +106,13 @@ func (am *DefaultAccountManager) MarkPeerConnected(ctx context.Context, peerPubK
 	}
 	if !updated {
 		am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusConnect, telemetry.PeerStatusStale)
-		log.WithContext(ctx).Tracef("peer %s already has a newer session in store, skipping connect", peer.ID)
+		log.WithContext(ctx).Debugf("peer %s already has a newer session in store, skipping connect", peer.ID)
 		return nil
 	}
 	am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusConnect, telemetry.PeerStatusApplied)
 
+	log.WithContext(ctx).Debugf("mark peer %s connected", peer.ID)
+
 	if err = am.schedulePeerExpirations(ctx, accountID, peer); err != nil {
 		return err
 	}
@@ -180,12 +182,14 @@ func (am *DefaultAccountManager) MarkPeerDisconnected(ctx context.Context, peerP
 	}
 	if !updated {
 		am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusDisconnect, telemetry.PeerStatusStale)
-		log.WithContext(ctx).Tracef("peer %s session token mismatch on disconnect (token=%d), skipping",
+		log.WithContext(ctx).Debugf("peer %s session token mismatch on disconnect (token=%d), skipping",
 			peer.ID, sessionStartedAt)
 		return nil
 	}
 	am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusDisconnect, telemetry.PeerStatusApplied)
 
+	log.WithContext(ctx).Debugf("mark peer %s disconnected", peer.ID)
+
 	// Symmetric with MarkPeerConnected: when an embedded proxy peer goes
 	// offline, refresh the peers that had synthesized records pointing at
 	// it so they pull the stale entries instead of waiting out TTL.

management/server/store/sql_store.go

@@ -1605,7 +1605,8 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 			settings_jwt_groups_enabled, settings_jwt_groups_claim_name, settings_jwt_allow_groups,
 			settings_routing_peer_dns_resolution_enabled, settings_dns_domain, settings_network_range,
 			settings_network_range_v6, settings_ipv6_enabled_groups, settings_lazy_connection_enabled,
-			settings_local_mfa_enabled, settings_metrics_push_enabled,
+			settings_local_mfa_enabled, settings_metrics_push_enabled, settings_agent_network_only,
+			settings_dashboard_features,
 			-- Embedded ExtraSettings
 			settings_extra_peer_approval_enabled, settings_extra_user_approval_required,
 			settings_extra_integrated_validator, settings_extra_integrated_validator_groups
@@ -1629,6 +1630,8 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 		sLazyConnectionEnabled           sql.NullBool
 		sLocalMFAEnabled                 sql.NullBool
 		sMetricsPushEnabled              sql.NullBool
+		sAgentNetworkOnly                sql.NullBool
+		sDashboardFeatures               sql.NullString
 		sExtraPeerApprovalEnabled        sql.NullBool
 		sExtraUserApprovalRequired       sql.NullBool
 		sExtraIntegratedValidator        sql.NullString
@@ -1651,7 +1654,8 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 		&sJWTGroupsEnabled, &sJWTGroupsClaimName, &sJWTAllowGroups,
 		&sRoutingPeerDNSResolutionEnabled, &sDNSDomain, &sNetworkRange,
 		&sNetworkRangeV6, &sIPv6EnabledGroups, &sLazyConnectionEnabled,
-		&sLocalMFAEnabled, &sMetricsPushEnabled,
+		&sLocalMFAEnabled, &sMetricsPushEnabled, &sAgentNetworkOnly,
+		&sDashboardFeatures,
 		&sExtraPeerApprovalEnabled, &sExtraUserApprovalRequired,
 		&sExtraIntegratedValidator, &sExtraIntegratedValidatorGroups,
 	)
@@ -1720,6 +1724,14 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 	if sMetricsPushEnabled.Valid {
 		account.Settings.MetricsPushEnabled = sMetricsPushEnabled.Bool
 	}
+	if sAgentNetworkOnly.Valid {
+		account.Settings.AgentNetworkOnly = sAgentNetworkOnly.Bool
+	}
+	if sDashboardFeatures.Valid && sDashboardFeatures.String != "" {
+		if err := json.Unmarshal([]byte(sDashboardFeatures.String), &account.Settings.DashboardFeatures); err != nil {
+			log.WithContext(ctx).Warnf("failed to unmarshal dashboard features for account %s: %v", accountID, err)
+		}
+	}
 	if sJWTAllowGroups.Valid {
 		_ = json.Unmarshal([]byte(sJWTAllowGroups.String), &account.Settings.JWTAllowGroups)
 	}

management/server/store/sql_store_test.go

@@ -1245,6 +1245,61 @@ func TestSqlite_CreateAndGetObjectInTransaction(t *testing.T) {
 	assert.NoError(t, err)
 }
 
+func TestSqlStore_SaveAccountPersistsAgentNetworkOnly(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	account, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.False(t, account.Settings.AgentNetworkOnly, "setting should default to false")
+
+	account.Settings.AgentNetworkOnly = true
+	require.NoError(t, store.SaveAccount(context.Background(), account))
+
+	reloaded, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.True(t, reloaded.Settings.AgentNetworkOnly, "setting should survive a save/load round-trip")
+
+	reloaded.Settings.AgentNetworkOnly = false
+	require.NoError(t, store.SaveAccount(context.Background(), reloaded))
+
+	disabled, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.False(t, disabled.Settings.AgentNetworkOnly, "disabling should persist")
+}
+
+func TestSqlStore_SaveAccountPersistsDashboardFeatures(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	account, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.Nil(t, account.Settings.DashboardFeatures, "dashboard features should default to unset")
+
+	agentNetwork := true
+	account.Settings.DashboardFeatures = &types.DashboardFeatures{AgentNetwork: &agentNetwork}
+	require.NoError(t, store.SaveAccount(context.Background(), account))
+
+	reloaded, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.NotNil(t, reloaded.Settings.DashboardFeatures, "dashboard features should survive a save/load round-trip")
+	require.NotNil(t, reloaded.Settings.DashboardFeatures.AgentNetwork, "agent network flag should be set")
+	require.True(t, *reloaded.Settings.DashboardFeatures.AgentNetwork, "agent network flag should persist as true")
+
+	disabled := false
+	reloaded.Settings.DashboardFeatures = &types.DashboardFeatures{AgentNetwork: &disabled}
+	require.NoError(t, store.SaveAccount(context.Background(), reloaded))
+
+	reloadedDisabled, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.NotNil(t, reloadedDisabled.Settings.DashboardFeatures.AgentNetwork, "agent network flag should remain set")
+	require.False(t, *reloadedDisabled.Settings.DashboardFeatures.AgentNetwork, "explicit false should persist")
+}
+
 func TestSqlStore_GetAccountUsers(t *testing.T) {
 	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
 	t.Cleanup(cleanup)

management/server/types/settings.go

@@ -76,6 +76,15 @@ type Settings struct {
 	// MetricsPushEnabled globally enables or disables client metrics push for the account
 	MetricsPushEnabled bool `gorm:"default:false"`
 
+	// AgentNetworkOnly limits the dashboard to the Agent Network surface for this account.
+	// Set for accounts created via netbird.ai signups; users can disable it later.
+	AgentNetworkOnly bool `gorm:"default:false"`
+
+	// DashboardFeatures holds per-account dashboard section visibility overrides.
+	// It serializes to a single JSON column so new sections can be added without
+	// a schema change.
+	DashboardFeatures *DashboardFeatures `gorm:"serializer:json"`
+
 	// EmbeddedIdpEnabled indicates if the embedded identity provider is enabled.
 	// This is a runtime-only field, not stored in the database.
 	EmbeddedIdpEnabled bool `gorm:"-"`
@@ -114,6 +123,7 @@ func (s *Settings) Copy() *Settings {
 		AutoUpdateAlways:                s.AutoUpdateAlways,
 		IPv6EnabledGroups:               slices.Clone(s.IPv6EnabledGroups),
 		MetricsPushEnabled:              s.MetricsPushEnabled,
+		AgentNetworkOnly:                s.AgentNetworkOnly,
 		EmbeddedIdpEnabled:              s.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               s.LocalAuthDisabled,
 		LocalMfaEnabled:                 s.LocalMfaEnabled,
@@ -121,9 +131,31 @@ func (s *Settings) Copy() *Settings {
 	if s.Extra != nil {
 		settings.Extra = s.Extra.Copy()
 	}
+	if s.DashboardFeatures != nil {
+		settings.DashboardFeatures = s.DashboardFeatures.Copy()
+	}
 	return settings
 }
 
+// DashboardFeatures holds per-account dashboard section visibility overrides.
+// Nil fields are unset and follow the default dashboard behavior; an explicit
+// value forces that section shown or hidden for the account.
+type DashboardFeatures struct {
+	// AgentNetwork, when set, forces the Agent Network menu shown (true) or
+	// hidden (false) regardless of the deployment feature flag.
+	AgentNetwork *bool `json:"agent_network,omitempty"`
+}
+
+// Copy returns a deep copy of the DashboardFeatures struct.
+func (d *DashboardFeatures) Copy() *DashboardFeatures {
+	c := &DashboardFeatures{}
+	if d.AgentNetwork != nil {
+		v := *d.AgentNetwork
+		c.AgentNetwork = &v
+	}
+	return c
+}
+
 type ExtraSettings struct {
 	// PeerApprovalEnabled enables or disables the need for peers bo be approved by an administrator
 	PeerApprovalEnabled bool

shared/management/http/api/openapi.yml

@@ -375,6 +375,12 @@ components:
           description: Enables or disables client metrics push for all peers in the account
           type: boolean
           example: false
+        agent_network_only:
+          description: Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later. Enabling this requires dashboard_features.agent_network to be true in the same request.
+          type: boolean
+          example: false
+        dashboard_features:
+          $ref: '#/components/schemas/AccountDashboardFeatures'
         embedded_idp_enabled:
           description: Indicates whether the embedded identity provider (Dex) is enabled for this account. This is a read-only field.
           type: boolean
@@ -403,6 +409,14 @@ components:
         - regular_users_view_blocked
         - peer_expose_enabled
         - peer_expose_groups
+    AccountDashboardFeatures:
+      description: Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
+      type: object
+      properties:
+        agent_network:
+          description: Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies. Must be true when agent_network_only is enabled.
+          type: boolean
+          example: true
     AccountExtraSettings:
       type: object
       properties:
@@ -10490,7 +10504,7 @@ paths:
         - EDR Intune Integrations
       summary: Delete EDR Intune Integration
       description: Deletes an EDR Intune Integration by its ID.
-      operationId: deleteIntegration
+      operationId: deleteEDRIntuneIntegration
       responses:
         '200':
           description: Integration deleted successfully. Returns an empty object.
@@ -12574,7 +12588,7 @@ paths:
         - Event Streaming Integrations
       summary: Delete Event Streaming Integration
       description: Deletes an event streaming integration by its ID.
-      operationId: deleteIntegration
+      operationId: deleteEventStreamingIntegration
       responses:
         '200':
           description: Integration deleted successfully. Returns an empty object.

shared/management/http/api/types.gen.go

@@ -1612,6 +1612,12 @@ type Account struct {
 	Settings   AccountSettings   `json:"settings"`
 }
 
+// AccountDashboardFeatures Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
+type AccountDashboardFeatures struct {
+	// AgentNetwork Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies. Must be true when agent_network_only is enabled.
+	AgentNetwork *bool `json:"agent_network,omitempty"`
+}
+
 // AccountExtraSettings defines model for AccountExtraSettings.
 type AccountExtraSettings struct {
 	// NetworkTrafficLogsEnabled Enables or disables network traffic logging. If enabled, all network traffic events from peers will be stored.
@@ -1647,12 +1653,18 @@ type AccountRequest struct {
 
 // AccountSettings defines model for AccountSettings.
 type AccountSettings struct {
+	// AgentNetworkOnly Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later. Enabling this requires dashboard_features.agent_network to be true in the same request.
+	AgentNetworkOnly *bool `json:"agent_network_only,omitempty"`
+
 	// AutoUpdateAlways When true, updates are installed automatically in the background. When false, updates require user interaction from the UI.
 	AutoUpdateAlways *bool `json:"auto_update_always,omitempty"`
 
 	// AutoUpdateVersion Set Clients auto-update version. "latest", "disabled", or a specific version (e.g "0.50.1")
 	AutoUpdateVersion *string `json:"auto_update_version,omitempty"`
 
+	// DashboardFeatures Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
+	DashboardFeatures *AccountDashboardFeatures `json:"dashboard_features,omitempty"`
+
 	// DnsDomain Allows to define a custom dns domain for the account
 	DnsDomain *string `json:"dns_domain,omitempty"`
 

shared/relay/client/early_msg_buffer.go

@@ -10,7 +10,7 @@ import (
 
 const (
 	earlyMsgTTL      = 5 * time.Second
-	earlyMsgCapacity = 1000
+	earlyMsgCapacity = 10000
 )
 
 // earlyMsgBuffer buffers transport messages that arrive before the corresponding