Rework signal protocol to minimize number of exchanged initial RP 512KB keys

The Rosenpass static keypair was regenerated on every engine start
(rp.GenerateKeyPair in NewManager), so the local ~512KB public key —
and its fingerprint — changed on each client restart.

Persist the keypair to <StateDir>/rosenpass_key.json with 0600
permissions (same protection tier as the WireGuard private key), and
reload it on start so the public key stays stable across restarts. A
missing, corrupt, or version-incompatible file degrades gracefully to
generating a fresh ephemeral keypair (previous behaviour); an empty
StateDir keeps the ephemeral path for callers without a state dir.

This is the foundation for fingerprint-based RP pubkey caching over
signalling (NET-1407): a stable local key lets remote peers keep their
cached copy valid across our restart.

client/cmd/login.go

@@ -17,7 +17,9 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/util"
 )
@@ -331,6 +333,14 @@ func doForegroundLogin(ctx context.Context, cmd *cobra.Command, setupKey string,
 		return fmt.Errorf("read config file %s: %v", configFilePath, err)
 	}
 
+	// Mirror runInForegroundMode: recover residual state (DNS, firewall,
+	// ssh config, legacy routing) from a previous unclean shutdown and
+	// enable advanced routing before dialing management.
+	if err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configFilePath).GetStatePath()); err != nil {
+		log.Warnf("failed to restore residual state: %v", err)
+	}
+	nbnet.Init()
+
 	err = foregroundLogin(ctx, cmd, config, setupKey, activeProf.ID)
 	if err != nil {
 		return fmt.Errorf("foreground login failed: %v", err)

client/cmd/up.go

@@ -22,6 +22,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
+	nbnet "github.com/netbirdio/netbird/client/net"
+	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/util"
@@ -229,6 +231,24 @@ func runInForegroundMode(ctx context.Context, cmd *cobra.Command, activeProf *pr
 
 	_, _ = profilemanager.UpdateOldManagementURL(ctx, config, configFilePath)
 
+	// Restore residual state left by a previous run that did not shut down
+	// cleanly, mirroring what the daemon does before connecting: it recovers
+	// DNS config (a stale resolv.conf takeover can make the management
+	// hostname unresolvable), firewall rules, ssh config and legacy routing.
+	// Route cleanup itself happens at engine start; nbnet.Init() below lets
+	// the management dial bypass a leftover fwmark rule until then.
+	// Foreground mode is particularly exposed in containers: a crashed
+	// container restarts inside the same (pod) network namespace, so stale
+	// state survives while the process does not.
+	if err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configPath).GetStatePath()); err != nil {
+		log.Warnf("failed to restore residual state: %v", err)
+	}
+
+	// Enable advanced routing (as the daemon does on startup) so the
+	// management dial bypasses a leftover fwmark rule instead of being
+	// shunted into a stale routing table.
+	nbnet.Init()
+
 	err = foregroundLogin(ctx, cmd, config, providedSetupKey, activeProf.ID)
 	if err != nil {
 		return fmt.Errorf("foreground login failed: %v", err)

client/internal/debug/debug.go

@@ -480,7 +480,6 @@ func (g *BundleGenerator) addStatus() error {
 
 		fullStatus := g.statusRecorder.GetFullStatus()
 		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
-		protoFullStatus.Events = g.statusRecorder.GetEventHistory()
 		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, nbstatus.ConvertOptions{
 			Anonymize:     g.anonymize,
 			ProfileName:   profName,

client/internal/engine.go

@@ -48,7 +48,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
@@ -183,7 +182,7 @@ type EngineServices struct {
 type Engine struct {
 	// signal is a Signal Service client
 	signal   signal.Client
-	signaler *signaling.Signaler
+	signaler *peer.Signaler
 	// mgmClient is a Management Service client
 	mgmClient mgm.Client
 	// peerConns is a map that holds all the peers that are known to this peer
@@ -319,7 +318,7 @@ func NewEngine(
 		ctx:                ctx,
 		cancel:             cancel,
 		signal:             services.SignalClient,
-		signaler:           signaling.NewSignaler(services.SignalClient, config.WgPrivateKey),
+		signaler:           peer.NewSignaler(services.SignalClient, config.WgPrivateKey),
 		mgmClient:          services.MgmClient,
 		relayManager:       services.RelayManager,
 		peerStore:          peerstore.NewConnStore(),
@@ -552,7 +551,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		} else {
 			log.Infof("running rosenpass in strict mode")
 		}
-		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName, publicKey)
+		e.rpManager, err = rosenpass.NewManager(e.config.PreSharedKey, e.config.WgIfaceName, publicKey, e.config.StateDir)
 		if err != nil {
 			return fmt.Errorf("create rosenpass manager: %w", err)
 		}
@@ -1810,6 +1809,7 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 			PubKey:         e.getRosenpassPubKey(),
 			Addr:           e.getRosenpassAddr(),
 			PermissiveMode: e.config.RosenpassPermissive,
+			KeyResolver:    e.rosenpassKeyResolver(),
 		},
 		ICEConfig: e.createICEConfig(),
 	}
@@ -1880,6 +1880,8 @@ func (e *Engine) receiveSignalEvents() error {
 
 				log.Debugf("receiveMSG: took %s to get lock for peer %s with session id %s", gotLock, msg.Key, offerAnswer.SessionID)
 
+				e.applyRosenpassKeyExchange(msg, offerAnswer)
+
 				if msg.Body.Type == sProto.Body_OFFER {
 					conn.OnRemoteOffer(*offerAnswer)
 				} else {
@@ -2223,6 +2225,34 @@ func (e *Engine) getRosenpassAddr() string {
 	return ""
 }
 
+// rosenpassKeyResolver returns the Rosenpass manager as the offer/answer key
+// resolver, or a true nil interface when Rosenpass is disabled (returning the
+// typed-nil *Manager would make the interface non-nil and panic on use).
+func (e *Engine) rosenpassKeyResolver() peer.RosenpassKeyResolver {
+	if e.rpManager == nil {
+		return nil
+	}
+	return e.rpManager
+}
+
+// applyRosenpassKeyExchange reconciles the fingerprint/cache fields of an incoming
+// offer/answer against the Rosenpass manager's cache: it resolves the remote peer's
+// full public key (from the message or the cache) into the OfferAnswer, and records
+// whether the peer acknowledged holding our key. No-op when Rosenpass is disabled.
+func (e *Engine) applyRosenpassKeyExchange(msg *sProto.Message, oa *peer.OfferAnswer) {
+	if e.rpManager == nil {
+		return
+	}
+	cfg := msg.GetBody().GetRosenpassConfig()
+	if cfg == nil {
+		return
+	}
+
+	remoteWgKey := msg.GetKey()
+	oa.RosenpassPubKey = e.rpManager.ResolveRemotePubKey(remoteWgKey, cfg.GetRosenpassPubKey(), cfg.GetRosenpassPubKeyHash())
+	e.rpManager.SetRemoteAck(remoteWgKey, cfg.GetAcknowledgedRosenpassPubKeyHash())
+}
+
 // RunHealthProbes executes health checks for Signal, Management, Relay, and WireGuard services
 // and updates the status recorder with the latest states.
 //
@@ -2606,13 +2636,14 @@ func (e *Engine) updateForwardRules(rules []*mgmProto.ForwardingRule) ([]firewal
 
 func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers []*mgmProto.RemotePeerConfig) map[string]bool {
 	excludedPeers := make(map[string]bool)
+
+	// Ingress forward targets: inbound forwarded traffic is initiated remotely and
+	// cannot wake a lazy connection, so the peer routing the target must stay
+	// permanently connected. AllowedIPs are already parsed on the peer conn, so
+	// reuse those typed prefixes instead of re-parsing the network map strings.
 	for _, r := range rules {
-		ip := r.TranslatedAddress
 		for _, p := range peers {
-			for _, allowedIP := range p.GetAllowedIps() {
-				if allowedIP != ip.String() {
-					continue
-				}
+			if e.peerRoutesAddr(p, r.TranslatedAddress) {
 				log.Infof("exclude forwarder peer from lazy connection: %s", p.GetWgPubKey())
 				excludedPeers[p.GetWgPubKey()] = true
 			}
@@ -2622,6 +2653,27 @@ func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers
 	return excludedPeers
 }
 
+// peerRoutesAddr reports whether the peer is a router for addr, matched against
+// the peer's already-parsed AllowedIPs from the store (the same typed value the
+// lazy manager consumes) rather than re-parsing the network map strings.
+func (e *Engine) peerRoutesAddr(p *mgmProto.RemotePeerConfig, addr netip.Addr) bool {
+	prefixes, ok := e.peerStore.AllowedIPs(p.GetWgPubKey())
+	if !ok {
+		return false
+	}
+	return prefixesContain(prefixes, addr)
+}
+
+// prefixesContain reports whether addr falls within any of the prefixes.
+func prefixesContain(prefixes []netip.Prefix, addr netip.Addr) bool {
+	for _, prefix := range prefixes {
+		if prefix.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}
+
 // isChecksEqual checks if two slices of checks are equal.
 func isChecksEqual(checks1, checks2 []*mgmProto.Checks) bool {
 	normalize := func(checks []*mgmProto.Checks) []string {
@@ -2748,7 +2800,7 @@ func createFile(path string) error {
 	return file.Close()
 }
 
-func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
+func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) {
 	remoteCred, err := signal.UnMarshalCredential(msg)
 	if err != nil {
 		return nil, err
@@ -2764,9 +2816,9 @@ func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
 	}
 
 	// Handle optional SessionID
-	var sessionID *icemaker.SessionID
+	var sessionID *peer.ICESessionID
 	if sessionBytes := msg.GetBody().GetSessionId(); sessionBytes != nil {
-		if id, err := icemaker.SessionIDFromBytes(sessionBytes); err != nil {
+		if id, err := peer.ICESessionIDFromBytes(sessionBytes); err != nil {
 			log.Warnf("Invalid session ID in message: %v", err)
 			sessionID = nil // Set to nil if conversion fails
 		} else {
@@ -2776,8 +2828,8 @@ func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
 
 	relayIP := decodeRelayIP(msg.GetBody().GetRelayServerIP())
 
-	offerAnswer := signaling.OfferAnswer{
-		IceCredentials: signaling.IceCredentials{
+	offerAnswer := peer.OfferAnswer{
+		IceCredentials: peer.IceCredentials{
 			UFrag: remoteCred.UFrag,
 			Pwd:   remoteCred.Pwd,
 		},

client/internal/engine_lazy_exclude_test.go

@@ -0,0 +1,87 @@
+package internal
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/internal/peerstore"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestPrefixesContain(t *testing.T) {
+	tests := []struct {
+		name     string
+		prefixes []string
+		addr     string
+		want     bool
+	}{
+		{name: "own overlay /32 matches", prefixes: []string{"100.110.8.145/32"}, addr: "100.110.8.145", want: true},
+		{name: "addr inside routed subnet", prefixes: []string{"10.121.0.0/16"}, addr: "10.121.208.4", want: true},
+		{name: "addr outside subnet", prefixes: []string{"10.121.0.0/16"}, addr: "10.122.0.1", want: false},
+		{name: "different /32", prefixes: []string{"100.110.8.145/32"}, addr: "100.110.8.146", want: false},
+		{name: "ipv6 /128 matches", prefixes: []string{"fd00::1/128"}, addr: "fd00::1", want: true},
+		{name: "no prefixes", prefixes: nil, addr: "10.121.208.4", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			prefixes := make([]netip.Prefix, 0, len(tt.prefixes))
+			for _, p := range tt.prefixes {
+				prefixes = append(prefixes, netip.MustParsePrefix(p))
+			}
+			require.Equal(t, tt.want, prefixesContain(prefixes, netip.MustParseAddr(tt.addr)))
+		})
+	}
+}
+
+// TestToExcludedLazyPeers_ForwardTarget guards a regression: the forward-target
+// peer (the peer routing a ForwardRule.TranslatedAddress) must be excluded from
+// lazy connections, matched via the peer's already-parsed AllowedIPs.
+func TestToExcludedLazyPeers_ForwardTarget(t *testing.T) {
+	const targetPeerKey = "cccccccccccccccccccccccccccccccccccccccccc0="
+	const otherPeerKey = "dddddddddddddddddddddddddddddddddddddddddd0="
+
+	store := peerstore.NewConnStore()
+	store.AddPeerConn(targetPeerKey, newTestConn(t, targetPeerKey, "100.110.8.145/32"))
+	store.AddPeerConn(otherPeerKey, newTestConn(t, otherPeerKey, "100.110.9.10/32"))
+
+	e := &Engine{peerStore: store}
+
+	peers := []*mgmProto.RemotePeerConfig{
+		{WgPubKey: targetPeerKey, AllowedIps: []string{"100.110.8.145/32"}},
+		{WgPubKey: otherPeerKey, AllowedIps: []string{"100.110.9.10/32"}},
+	}
+	rules := []firewallManager.ForwardRule{
+		{TranslatedAddress: netip.MustParseAddr("100.110.8.145")},
+	}
+
+	excluded := e.toExcludedLazyPeers(rules, peers)
+
+	require.True(t, excluded[targetPeerKey], "forward-target peer must be excluded from lazy connections")
+	require.False(t, excluded[otherPeerKey], "non-target peer must not be excluded")
+	require.Len(t, excluded, 1)
+}
+
+func TestToExcludedLazyPeers_NoRules(t *testing.T) {
+	e := &Engine{peerStore: peerstore.NewConnStore()}
+
+	peers := []*mgmProto.RemotePeerConfig{
+		{WgPubKey: "peer-a", AllowedIps: []string{"100.110.8.145/32"}},
+	}
+
+	require.Empty(t, e.toExcludedLazyPeers(nil, peers))
+}
+
+func newTestConn(t *testing.T, key, allowedIP string) *peer.Conn {
+	t.Helper()
+	conn, err := peer.NewConn(peer.ConnConfig{
+		Key:      key,
+		WgConfig: peer.WgConfig{AllowedIps: []netip.Prefix{netip.MustParsePrefix(allowedIP)}},
+	}, peer.ServiceDependencies{})
+	require.NoError(t, err)
+	return conn
+}

client/internal/peer/conn_status.go

@@ -1,5 +1,18 @@
 package peer
 
+import (
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// StatusIdle indicate the peer is in disconnected state
+	StatusIdle ConnStatus = iota
+	// StatusConnecting indicate the peer is in connecting state
+	StatusConnecting
+	// StatusConnected indicate the peer is in connected state
+	StatusConnected
+)
+
 // connStatusInputs is the primitive-valued snapshot of the state that drives the
 // tri-state connection classification. Extracted so the decision logic can be unit-tested
 // without constructing full Worker/Handshaker objects.
@@ -8,7 +21,24 @@ type connStatusInputs struct {
 	peerUsesRelay       bool // remote peer advertises relay support AND local has relay
 	relayConnected      bool // statusRelay reports Connected (independent of whether peer uses relay)
 	remoteSupportsICE   bool // remote peer sent ICE credentials
-	iceWorkerCreated    bool // local ICE worker exists (false in force-relay mode)
+	iceWorkerCreated    bool // local WorkerICE exists (false in force-relay mode)
 	iceStatusConnecting bool // statusICE is anything other than Disconnected
 	iceInProgress       bool // a negotiation is currently in flight
 }
+
+// ConnStatus describe the status of a peer's connection
+type ConnStatus int32
+
+func (s ConnStatus) String() string {
+	switch s {
+	case StatusConnecting:
+		return "Connecting"
+	case StatusConnected:
+		return "Connected"
+	case StatusIdle:
+		return "Idle"
+	default:
+		log.Errorf("unknown status: %d", s)
+		return "INVALID_PEER_CONNECTION_STATUS"
+	}
+}

client/internal/peer/conn_status_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"testing"

client/internal/peer/conn_test.go

@@ -3,33 +3,28 @@ package peer
 import (
 	"context"
 	"fmt"
-	"net/netip"
 	"os"
 	"testing"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/internal/peer/dispatcher"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	"github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/metricsstages"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/util"
 )
 
+var testDispatcher = dispatcher.NewConnectionDispatcher()
+
 var connConf = ConnConfig{
 	Key:         "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
 	LocalKey:    "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
 	Timeout:     time.Second,
 	LocalWgPort: 51820,
-	WgConfig: WgConfig{
-		AllowedIps: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
-	},
 	ICEConfig: ice.Config{
 		InterfaceBlackList: nil,
 	},
@@ -57,37 +52,92 @@ func TestConn_GetKey(t *testing.T) {
 	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
 
 	sd := ServiceDependencies{
-		SrWatcher: swWatcher,
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
 	}
 	conn, err := NewConn(connConf, sd)
-	require.NoError(t, err)
+	if err != nil {
+		return
+	}
 
 	got := conn.GetKey()
 
 	assert.Equal(t, got, connConf.Key, "they should be equal")
 }
 
-// TestConn_DiscardMessagesWhenNotOpened: signal messages posted to a not yet
-// opened connection must be discarded without blocking or panicking.
-func TestConn_DiscardMessagesWhenNotOpened(t *testing.T) {
+func TestConn_OnRemoteOffer(t *testing.T) {
 	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
 	sd := ServiceDependencies{
-		StatusRecorder: status.NewRecorder("https://mgm"),
-		SrWatcher:      swWatcher,
+		StatusRecorder:     NewRecorder("https://mgm"),
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
 	}
 	conn, err := NewConn(connConf, sd)
-	require.NoError(t, err)
+	if err != nil {
+		return
+	}
 
-	offerAnswer := signaling.OfferAnswer{
-		IceCredentials: signaling.IceCredentials{
+	onNewOfferChan := make(chan struct{})
+
+	conn.handshaker.AddRelayListener(func(remoteOfferAnswer *OfferAnswer) {
+		onNewOfferChan <- struct{}{}
+	})
+
+	conn.OnRemoteOffer(OfferAnswer{
+		IceCredentials: IceCredentials{
 			UFrag: "test",
 			Pwd:   "test",
 		},
+		WgListenPort: 0,
+		Version:      "",
+	})
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	select {
+	case <-onNewOfferChan:
+		// success
+	case <-ctx.Done():
+		t.Error("expected to receive a new offer notification, but timed out")
+	}
+}
+
+func TestConn_OnRemoteAnswer(t *testing.T) {
+	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
+	sd := ServiceDependencies{
+		StatusRecorder:     NewRecorder("https://mgm"),
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
+	}
+	conn, err := NewConn(connConf, sd)
+	if err != nil {
+		return
+	}
+
+	onNewOfferChan := make(chan struct{})
+
+	conn.handshaker.AddRelayListener(func(remoteOfferAnswer *OfferAnswer) {
+		onNewOfferChan <- struct{}{}
+	})
+
+	conn.OnRemoteAnswer(OfferAnswer{
+		IceCredentials: IceCredentials{
+			UFrag: "test",
+			Pwd:   "test",
+		},
+		WgListenPort: 0,
+		Version:      "",
+	})
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	select {
+	case <-onNewOfferChan:
+		// success
+	case <-ctx.Done():
+		t.Error("expected to receive a new offer notification, but timed out")
 	}
-	conn.OnRemoteOffer(offerAnswer)
-	conn.OnRemoteAnswer(offerAnswer)
-	conn.OnRemoteCandidate(nil, nil)
-	conn.Close(false)
 }
 
 func TestConn_presharedKey(t *testing.T) {
@@ -270,7 +320,7 @@ func newWGTimeoutTestConn(rosenpassEnabled bool, disconnected *[]string) *Conn {
 		ctx:           context.Background(),
 		config:        cfg,
 		Log:           log.WithField("peer", cfg.Key),
-		metricsStages: &metricsstages.MetricsStages{},
+		metricsStages: &MetricsStages{},
 	}
 	conn.SetOnDisconnected(func(remotePeer string) {
 		*disconnected = append(*disconnected, remotePeer)
@@ -289,20 +339,20 @@ func TestConn_onWGDisconnected_EscalatesToRosenpassReset(t *testing.T) {
 	conn := newWGTimeoutTestConn(true, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Empty(t, disconnected, "escalation must not fire below the threshold")
 
-	conn.handleWGTimeout()
+	conn.onWGDisconnected(conn.ctx)
 	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
 		"reaching the threshold must report the peer disconnected once")
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Len(t, disconnected, 1, "escalation must restart counting after firing")
 
-	conn.handleWGTimeout()
+	conn.onWGDisconnected(conn.ctx)
 	assert.Len(t, disconnected, 2, "continued timeouts must escalate again")
 }
 
@@ -314,12 +364,12 @@ func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
 	conn := newWGTimeoutTestConn(true, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
-	conn.handleWGCheckSuccess()
+	conn.onWGCheckSuccess()
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Empty(t, disconnected, "handshake success must reset the timeout count")
 }
@@ -332,7 +382,7 @@ func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
 	conn := newWGTimeoutTestConn(false, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold*3; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
 }

client/internal/peer/conntype/priority.go

@@ -1,4 +1,4 @@
-package worker
+package conntype
 
 import (
 	"fmt"

client/internal/peer/dispatcher/dispatcher.go

@@ -0,0 +1,52 @@
+package dispatcher
+
+import (
+	"sync"
+
+	"github.com/netbirdio/netbird/client/internal/peer/id"
+)
+
+type ConnectionListener struct {
+	OnConnected    func(peerID id.ConnID)
+	OnDisconnected func(peerID id.ConnID)
+}
+
+type ConnectionDispatcher struct {
+	listeners map[*ConnectionListener]struct{}
+	mu        sync.Mutex
+}
+
+func NewConnectionDispatcher() *ConnectionDispatcher {
+	return &ConnectionDispatcher{
+		listeners: make(map[*ConnectionListener]struct{}),
+	}
+}
+
+func (e *ConnectionDispatcher) AddListener(listener *ConnectionListener) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.listeners[listener] = struct{}{}
+}
+
+func (e *ConnectionDispatcher) RemoveListener(listener *ConnectionListener) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	delete(e.listeners, listener)
+}
+
+func (e *ConnectionDispatcher) NotifyConnected(peerConnID id.ConnID) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for listener := range e.listeners {
+		listener.OnConnected(peerConnID)
+	}
+}
+
+func (e *ConnectionDispatcher) NotifyDisconnected(peerConnID id.ConnID) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for listener := range e.listeners {
+		listener.OnDisconnected(peerConnID)
+	}
+}

client/internal/peer/event.go

@@ -1,69 +0,0 @@
-package peer
-
-import (
-	"time"
-
-	"github.com/pion/ice/v4"
-
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/worker"
-	"github.com/netbirdio/netbird/route"
-)
-
-// event is a message processed by the Conn event loop. All mutable Conn state
-// is owned by that loop; producers deliver events through the mailbox and
-// never mutate Conn state directly.
-type event any
-
-// evClose asks the event loop to tear down the connection. done is closed
-// once the teardown finished.
-type evClose struct {
-	signalToRemote bool
-	done           chan struct{}
-}
-
-type evRemoteOffer struct {
-	offer signaling.OfferAnswer
-}
-
-type evRemoteAnswer struct {
-	answer signaling.OfferAnswer
-}
-
-type evRemoteCandidate struct {
-	candidate ice.Candidate
-	haRoutes  route.HAMap
-}
-
-type evICEReady struct {
-	priority worker.ConnPriority
-	info     worker.ICEConnInfo
-}
-
-type evICEDown struct {
-	sessionChanged bool
-}
-
-type evRelayReady struct {
-	info worker.RelayConnInfo
-}
-
-type evRelayDown struct{}
-
-// evRelayDialDone reports that the relay dial helper goroutine finished,
-// successfully or not, so the loop may dispatch a pending offer.
-type evRelayDialDone struct{}
-
-type evWGTimeout struct{}
-
-// evWGHandshake reports the first WireGuard handshake of the current watcher run.
-type evWGHandshake struct {
-	when time.Time
-}
-
-// evWGCheckOK reports a watcher check that observed a fresh handshake,
-// including handshakes of connections that were already up.
-type evWGCheckOK struct{}
-
-// evGuardTick asks the loop to send a new offer to restore connectivity.
-type evGuardTick struct{}

client/internal/peer/guard/ice_monitor.go

@@ -21,6 +21,8 @@ const (
 )
 
 type ICEMonitor struct {
+	ReconnectCh chan struct{}
+
 	iFaceDiscover stdnet.ExternalIFaceDiscover
 	iceConfig     icemaker.Config
 	tickerPeriod  time.Duration
@@ -32,6 +34,7 @@ type ICEMonitor struct {
 func NewICEMonitor(iFaceDiscover stdnet.ExternalIFaceDiscover, config icemaker.Config, period time.Duration) *ICEMonitor {
 	log.Debugf("prepare ICE monitor with period: %s", period)
 	cm := &ICEMonitor{
+		ReconnectCh:   make(chan struct{}, 1),
 		iFaceDiscover: iFaceDiscover,
 		iceConfig:     config,
 		tickerPeriod:  period,

client/internal/peer/handshaker.go

@@ -0,0 +1,275 @@
+package peer
+
+import (
+	"context"
+	"errors"
+	"net/netip"
+	"sync"
+	"sync/atomic"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/version"
+)
+
+var (
+	ErrSignalIsNotReady = errors.New("signal is not ready")
+)
+
+// IceCredentials ICE protocol credentials struct
+type IceCredentials struct {
+	UFrag string
+	Pwd   string
+}
+
+// OfferAnswer represents a session establishment offer or answer
+type OfferAnswer struct {
+	IceCredentials IceCredentials
+	// WgListenPort is a remote WireGuard listen port.
+	// This field is used when establishing a direct WireGuard connection without any proxy.
+	// We can set the remote peer's endpoint with this port.
+	WgListenPort int
+
+	// Version of NetBird Agent
+	Version string
+	// RosenpassPubKey is the Rosenpass public key of the remote peer when receiving this message
+	// This value is the local Rosenpass server public key when sending the message.
+	// May be empty on send when the remote peer has acknowledged already holding it (see RosenpassPubKeyAck).
+	RosenpassPubKey []byte
+	// RosenpassPubKeyHash is the SHA256 of the sender's own RosenpassPubKey. Always set when Rosenpass is enabled.
+	RosenpassPubKeyHash []byte
+	// RosenpassPubKeyAck is the SHA256 of the remote peer's key the sender holds cached; empty means "send it in full".
+	RosenpassPubKeyAck []byte
+	// RosenpassAddr is the Rosenpass server address (IP:port) of the remote peer when receiving this message
+	// This value is the local Rosenpass server address when sending the message
+	RosenpassAddr string
+
+	// relay server address
+	RelaySrvAddress string
+	// RelaySrvIP is the IP the remote peer is connected to on its
+	// relay server. Used as a dial target if DNS for RelaySrvAddress
+	// fails. Zero value if the peer did not advertise an IP.
+	RelaySrvIP netip.Addr
+	// SessionID is the unique identifier of the session, used to discard old messages
+	SessionID *ICESessionID
+}
+
+func (o *OfferAnswer) hasICECredentials() bool {
+	return o.IceCredentials.UFrag != "" && o.IceCredentials.Pwd != ""
+}
+
+type Handshaker struct {
+	mu            sync.Mutex
+	log           *log.Entry
+	config        ConnConfig
+	signaler      *Signaler
+	ice           *WorkerICE
+	relay         *WorkerRelay
+	metricsStages *MetricsStages
+	// relayListener is not blocking because the listener is using a goroutine to process the messages
+	// and it will only keep the latest message if multiple offers are received in a short time
+	// this is to avoid blocking the handshaker if the listener is doing some heavy processing
+	// and also to avoid processing old offers if multiple offers are received in a short time
+	// the listener will always process the latest offer
+	relayListener *AsyncOfferListener
+	iceListener   func(remoteOfferAnswer *OfferAnswer)
+
+	// remoteICESupported tracks whether the remote peer includes ICE credentials in its offers/answers.
+	// When false, the local side skips ICE listener dispatch and suppresses ICE credentials in responses.
+	remoteICESupported atomic.Bool
+
+	// remoteOffersCh is a channel used to wait for remote credentials to proceed with the connection
+	remoteOffersCh chan OfferAnswer
+	// remoteAnswerCh is a channel used to wait for remote credentials answer (confirmation of our offer) to proceed with the connection
+	remoteAnswerCh chan OfferAnswer
+}
+
+func NewHandshaker(log *log.Entry, config ConnConfig, signaler *Signaler, ice *WorkerICE, relay *WorkerRelay, metricsStages *MetricsStages) *Handshaker {
+	h := &Handshaker{
+		log:            log,
+		config:         config,
+		signaler:       signaler,
+		ice:            ice,
+		relay:          relay,
+		metricsStages:  metricsStages,
+		remoteOffersCh: make(chan OfferAnswer),
+		remoteAnswerCh: make(chan OfferAnswer),
+	}
+	// assume remote supports ICE until we learn otherwise from received offers
+	h.remoteICESupported.Store(ice != nil)
+	return h
+}
+
+func (h *Handshaker) RemoteICESupported() bool {
+	return h.remoteICESupported.Load()
+}
+
+func (h *Handshaker) AddRelayListener(offer func(remoteOfferAnswer *OfferAnswer)) {
+	h.relayListener = NewAsyncOfferListener(offer)
+}
+
+func (h *Handshaker) AddICEListener(offer func(remoteOfferAnswer *OfferAnswer)) {
+	h.iceListener = offer
+}
+
+func (h *Handshaker) Listen(ctx context.Context) {
+	for {
+		select {
+		case remoteOfferAnswer := <-h.remoteOffersCh:
+			h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+
+			// Record signaling received for reconnection attempts
+			if h.metricsStages != nil {
+				h.metricsStages.RecordSignalingReceived()
+			}
+
+			h.updateRemoteICEState(&remoteOfferAnswer)
+
+			if h.relayListener != nil {
+				h.relayListener.Notify(&remoteOfferAnswer)
+			}
+
+			if h.iceListener != nil && h.RemoteICESupported() {
+				h.iceListener(&remoteOfferAnswer)
+			}
+
+			if err := h.sendAnswer(); err != nil {
+				h.log.Errorf("failed to send remote offer confirmation: %s", err)
+				continue
+			}
+		case remoteOfferAnswer := <-h.remoteAnswerCh:
+			h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+
+			// Record signaling received for reconnection attempts
+			if h.metricsStages != nil {
+				h.metricsStages.RecordSignalingReceived()
+			}
+
+			h.updateRemoteICEState(&remoteOfferAnswer)
+
+			if h.relayListener != nil {
+				h.relayListener.Notify(&remoteOfferAnswer)
+			}
+
+			if h.iceListener != nil && h.RemoteICESupported() {
+				h.iceListener(&remoteOfferAnswer)
+			}
+		case <-ctx.Done():
+			h.log.Infof("stop listening for remote offers and answers")
+			return
+		}
+	}
+}
+
+func (h *Handshaker) SendOffer() error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.sendOffer()
+}
+
+// OnRemoteOffer handles an offer from the remote peer and returns true if the message was accepted, false otherwise
+// doesn't block, discards the message if connection wasn't ready
+func (h *Handshaker) OnRemoteOffer(offer OfferAnswer) {
+	select {
+	case h.remoteOffersCh <- offer:
+		return
+	default:
+		h.log.Warnf("skipping remote offer message because receiver not ready")
+		// connection might not be ready yet to receive so we ignore the message
+		return
+	}
+}
+
+// OnRemoteAnswer handles an offer from the remote peer and returns true if the message was accepted, false otherwise
+// doesn't block, discards the message if connection wasn't ready
+func (h *Handshaker) OnRemoteAnswer(answer OfferAnswer) {
+	select {
+	case h.remoteAnswerCh <- answer:
+		return
+	default:
+		// connection might not be ready yet to receive so we ignore the message
+		h.log.Warnf("skipping remote answer message because receiver not ready")
+		return
+	}
+}
+
+// sendOffer prepares local user credentials and signals them to the remote peer
+func (h *Handshaker) sendOffer() error {
+	if !h.signaler.Ready() {
+		return ErrSignalIsNotReady
+	}
+
+	offer := h.buildOfferAnswer()
+	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
+
+	return h.signaler.SignalOffer(offer, h.config.Key)
+}
+
+func (h *Handshaker) sendAnswer() error {
+	answer := h.buildOfferAnswer()
+	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
+
+	return h.signaler.SignalAnswer(answer, h.config.Key)
+}
+
+func (h *Handshaker) buildOfferAnswer() OfferAnswer {
+	answer := OfferAnswer{
+		WgListenPort:  h.config.LocalWgPort,
+		Version:       version.NetbirdVersion(),
+		RosenpassAddr: h.config.RosenpassConfig.Addr,
+	}
+	h.setRosenpassPubKey(&answer)
+
+	if h.ice != nil && h.RemoteICESupported() {
+		uFrag, pwd := h.ice.GetLocalUserCredentials()
+		sid := h.ice.SessionID()
+		answer.IceCredentials = IceCredentials{uFrag, pwd}
+		answer.SessionID = &sid
+	}
+
+	if addr, ip, err := h.relay.RelayInstanceAddress(); err == nil {
+		answer.RelaySrvAddress = addr
+		answer.RelaySrvIP = ip
+	}
+
+	return answer
+}
+
+// setRosenpassPubKey fills the Rosenpass key fields of an outgoing offer/answer.
+// With a resolver wired it advertises our key hash and the ack for the remote key
+// we hold, and includes the full public key only when the peer has not yet
+// acknowledged holding it. Without a resolver (Rosenpass disabled, or an older
+// code path) it always sends the full key, preserving the previous behaviour.
+func (h *Handshaker) setRosenpassPubKey(answer *OfferAnswer) {
+	localKey := h.config.RosenpassConfig.PubKey
+	if len(localKey) == 0 {
+		return
+	}
+
+	resolver := h.config.RosenpassConfig.KeyResolver
+	if resolver == nil {
+		answer.RosenpassPubKey = localKey
+		return
+	}
+
+	answer.RosenpassPubKeyHash = resolver.LocalPubKeyHash()
+	answer.RosenpassPubKeyAck = resolver.RemotePubKeyAck(h.config.Key)
+	if !resolver.RemoteHasLocalKey(h.config.Key) {
+		answer.RosenpassPubKey = localKey
+	}
+}
+
+func (h *Handshaker) updateRemoteICEState(offer *OfferAnswer) {
+	hasICE := offer.hasICECredentials()
+	prev := h.remoteICESupported.Swap(hasICE)
+	if prev != hasICE {
+		if hasICE {
+			h.log.Infof("remote peer started sending ICE credentials")
+		} else {
+			h.log.Infof("remote peer stopped sending ICE credentials")
+			if h.ice != nil {
+				h.ice.Close()
+			}
+		}
+	}
+}

client/internal/peer/handshaker_listener.go

@@ -0,0 +1,62 @@
+package peer
+
+import (
+	"sync"
+)
+
+type callbackFunc func(remoteOfferAnswer *OfferAnswer)
+
+func (oa *OfferAnswer) SessionIDString() string {
+	if oa.SessionID == nil {
+		return "unknown"
+	}
+	return oa.SessionID.String()
+}
+
+type AsyncOfferListener struct {
+	fn      callbackFunc
+	running bool
+	latest  *OfferAnswer
+	mu      sync.Mutex
+}
+
+func NewAsyncOfferListener(fn callbackFunc) *AsyncOfferListener {
+	return &AsyncOfferListener{
+		fn: fn,
+	}
+}
+
+func (o *AsyncOfferListener) Notify(remoteOfferAnswer *OfferAnswer) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+
+	// Store the latest offer
+	o.latest = remoteOfferAnswer
+
+	// If already running, the running goroutine will pick up this latest value
+	if o.running {
+		return
+	}
+
+	// Start processing
+	o.running = true
+
+	// Process in a goroutine to avoid blocking the caller
+	go func(remoteOfferAnswer *OfferAnswer) {
+		for {
+			o.fn(remoteOfferAnswer)
+
+			o.mu.Lock()
+			if o.latest == nil {
+				// No more work to do
+				o.running = false
+				o.mu.Unlock()
+				return
+			}
+			remoteOfferAnswer = o.latest
+			// Clear the latest to mark it as being processed
+			o.latest = nil
+			o.mu.Unlock()
+		}
+	}(remoteOfferAnswer)
+}

client/internal/peer/handshaker_listener_test.go

@@ -0,0 +1,39 @@
+package peer
+
+import (
+	"testing"
+	"time"
+)
+
+func Test_newOfferListener(t *testing.T) {
+	dummyOfferAnswer := &OfferAnswer{}
+	runChan := make(chan struct{}, 10)
+
+	longRunningFn := func(remoteOfferAnswer *OfferAnswer) {
+		time.Sleep(1 * time.Second)
+		runChan <- struct{}{}
+	}
+
+	hl := NewAsyncOfferListener(longRunningFn)
+
+	hl.Notify(dummyOfferAnswer)
+	hl.Notify(dummyOfferAnswer)
+	hl.Notify(dummyOfferAnswer)
+
+	// Wait for exactly 2 callbacks
+	for i := 0; i < 2; i++ {
+		select {
+		case <-runChan:
+		case <-time.After(3 * time.Second):
+			t.Fatal("Timeout waiting for callback")
+		}
+	}
+
+	// Verify no additional callbacks happen
+	select {
+	case <-runChan:
+		t.Fatal("Unexpected additional callback")
+	case <-time.After(100 * time.Millisecond):
+		t.Log("Correctly received exactly 2 callbacks")
+	}
+}

client/internal/peer/handshaker_rosenpass_test.go

@@ -0,0 +1,65 @@
+package peer
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+type fakeRPResolver struct {
+	localHash []byte
+	ack       []byte
+	hasLocal  bool
+}
+
+func (f fakeRPResolver) LocalPubKeyHash() []byte              { return f.localHash }
+func (f fakeRPResolver) RemotePubKeyAck(string) []byte        { return f.ack }
+func (f fakeRPResolver) RemoteHasLocalKey(remote string) bool { return f.hasLocal }
+
+func TestSetRosenpassPubKey_NoResolverAlwaysSendsFullKey(t *testing.T) {
+	localKey := []byte{1, 2, 3}
+	h := &Handshaker{config: ConnConfig{RosenpassConfig: RosenpassConfig{PubKey: localKey}}}
+
+	var a OfferAnswer
+	h.setRosenpassPubKey(&a)
+
+	require.Equal(t, localKey, a.RosenpassPubKey)
+	require.Nil(t, a.RosenpassPubKeyHash)
+	require.Nil(t, a.RosenpassPubKeyAck)
+}
+
+func TestSetRosenpassPubKey_ResolverIncludesFullKeyUntilAcked(t *testing.T) {
+	localKey := []byte{1, 2, 3}
+	res := fakeRPResolver{localHash: []byte{9}, ack: []byte{8}, hasLocal: false}
+	h := &Handshaker{config: ConnConfig{Key: "peerA", RosenpassConfig: RosenpassConfig{PubKey: localKey, KeyResolver: res}}}
+
+	var a OfferAnswer
+	h.setRosenpassPubKey(&a)
+
+	require.Equal(t, localKey, a.RosenpassPubKey, "full key must be sent until the peer acks it")
+	require.Equal(t, []byte{9}, a.RosenpassPubKeyHash)
+	require.Equal(t, []byte{8}, a.RosenpassPubKeyAck)
+}
+
+func TestSetRosenpassPubKey_ResolverOmitsFullKeyOnceAcked(t *testing.T) {
+	localKey := []byte{1, 2, 3}
+	res := fakeRPResolver{localHash: []byte{9}, ack: []byte{8}, hasLocal: true}
+	h := &Handshaker{config: ConnConfig{Key: "peerA", RosenpassConfig: RosenpassConfig{PubKey: localKey, KeyResolver: res}}}
+
+	var a OfferAnswer
+	h.setRosenpassPubKey(&a)
+
+	require.Nil(t, a.RosenpassPubKey, "full key must be omitted once the peer holds it")
+	require.Equal(t, []byte{9}, a.RosenpassPubKeyHash)
+	require.Equal(t, []byte{8}, a.RosenpassPubKeyAck)
+}
+
+func TestSetRosenpassPubKey_DisabledSetsNothing(t *testing.T) {
+	h := &Handshaker{config: ConnConfig{RosenpassConfig: RosenpassConfig{}}}
+
+	var a OfferAnswer
+	h.setRosenpassPubKey(&a)
+
+	require.Nil(t, a.RosenpassPubKey)
+	require.Nil(t, a.RosenpassPubKeyHash)
+}

client/internal/peer/iface.go

@@ -0,0 +1,22 @@
+package peer
+
+import (
+	"net"
+	"net/netip"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/iface/configurer"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgproxy"
+)
+
+type WGIface interface {
+	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
+	RemovePeer(peerKey string) error
+	GetStats() (map[string]configurer.WGStats, error)
+	GetProxy() wgproxy.Proxy
+	Address() wgaddr.Address
+	RemoveEndpointAddress(key string) error
+}

client/internal/peer/listener.go

@@ -0,0 +1,11 @@
+package peer
+
+// Listener is a callback type about the NetBird network connection state
+type Listener interface {
+	OnConnected()
+	OnDisconnected()
+	OnConnecting()
+	OnDisconnecting()
+	OnAddressChanged(string, string)
+	OnPeersListChanged(int)
+}

client/internal/peer/mailbox.go

@@ -1,116 +0,0 @@
-package peer
-
-import (
-	"sync"
-)
-
-// maxQueuedCandidates bounds the remote candidate queue; on overflow the
-// oldest candidate is dropped. Lost candidates are recovered by the next
-// offer exchange triggered by the guard.
-const maxQueuedCandidates = 128
-
-// mailbox is the coalescing inbox of the Conn event loop. Posting never
-// blocks. Per message kind either the latest value wins (offer, answer,
-// guard tick), the values queue in bounded FIFO order (candidates) or in
-// unbounded FIFO order (lifecycle and transport state changes, which are
-// low-volume and must not be lost). A new offer flushes the queued
-// candidates because they belong to the superseded session.
-type mailbox struct {
-	mu     sync.Mutex
-	closed bool
-
-	lifecycle  []event
-	transport  []event
-	offer      *evRemoteOffer
-	answer     *evRemoteAnswer
-	candidates []evRemoteCandidate
-	guardTick  bool
-
-	wake chan struct{}
-}
-
-func newMailbox() *mailbox {
-	return &mailbox{
-		wake: make(chan struct{}, 1),
-	}
-}
-
-// post stores the event and wakes the loop. It reports false if the mailbox
-// is already closed and the event was not accepted.
-func (m *mailbox) post(ev event) bool {
-	m.mu.Lock()
-	if m.closed {
-		m.mu.Unlock()
-		return false
-	}
-
-	switch e := ev.(type) {
-	case evClose:
-		m.lifecycle = append(m.lifecycle, e)
-	case evRemoteOffer:
-		m.offer = &e
-		m.candidates = nil
-	case evRemoteAnswer:
-		m.answer = &e
-	case evRemoteCandidate:
-		if len(m.candidates) >= maxQueuedCandidates {
-			m.candidates = m.candidates[1:]
-		}
-		m.candidates = append(m.candidates, e)
-	case evGuardTick:
-		m.guardTick = true
-	default:
-		m.transport = append(m.transport, ev)
-	}
-	m.mu.Unlock()
-
-	select {
-	case m.wake <- struct{}{}:
-	default:
-	}
-	return true
-}
-
-// drain returns the pending events in processing order: lifecycle first,
-// then transport state changes, the coalesced offer and answer, the queued
-// candidates and finally the guard tick.
-func (m *mailbox) drain() []event {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return m.drainLocked()
-}
-
-// closeAndDrain marks the mailbox closed so further posts are rejected and
-// returns the events that were still pending.
-func (m *mailbox) closeAndDrain() []event {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.closed = true
-	return m.drainLocked()
-}
-
-func (m *mailbox) drainLocked() []event {
-	evs := make([]event, 0, len(m.lifecycle)+len(m.transport)+len(m.candidates)+3)
-	evs = append(evs, m.lifecycle...)
-	evs = append(evs, m.transport...)
-	if m.offer != nil {
-		evs = append(evs, *m.offer)
-	}
-	if m.answer != nil {
-		evs = append(evs, *m.answer)
-	}
-	for _, c := range m.candidates {
-		evs = append(evs, c)
-	}
-	if m.guardTick {
-		evs = append(evs, evGuardTick{})
-	}
-
-	m.lifecycle = nil
-	m.transport = nil
-	m.offer = nil
-	m.answer = nil
-	m.candidates = nil
-	m.guardTick = false
-	return evs
-}

client/internal/peer/mailbox_test.go

@@ -1,128 +0,0 @@
-package peer
-
-import (
-	"testing"
-
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestMailbox_OfferCoalescing(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 1}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 2}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 3}}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 1, "consecutive offers must coalesce to a single event")
-	offer, ok := evs[0].(evRemoteOffer)
-	require.True(t, ok, "coalesced event must be an offer")
-	assert.Equal(t, 3, offer.offer.WgListenPort, "the newest offer must win")
-}
-
-func TestMailbox_OfferFlushesCandidates(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteCandidate{}))
-	require.True(t, mb.post(evRemoteCandidate{}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 1, "candidates of the superseded session must be flushed")
-	_, ok := evs[0].(evRemoteOffer)
-	assert.True(t, ok, "only the offer must remain after the flush")
-}
-
-func TestMailbox_CandidatesKeepOrderAfterOffer(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRemoteCandidate{haRoutes: nil}))
-	require.True(t, mb.post(evRemoteCandidate{haRoutes: nil}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 3)
-	_, ok := evs[0].(evRemoteOffer)
-	assert.True(t, ok, "offer must be processed before the candidates")
-	for _, ev := range evs[1:] {
-		_, ok := ev.(evRemoteCandidate)
-		assert.True(t, ok, "candidates posted after the offer must survive")
-	}
-}
-
-func TestMailbox_CandidateQueueBounded(t *testing.T) {
-	mb := newMailbox()
-
-	for i := 0; i < maxQueuedCandidates+10; i++ {
-		require.True(t, mb.post(evRemoteCandidate{}))
-	}
-
-	evs := mb.drain()
-	assert.Len(t, evs, maxQueuedCandidates, "candidate queue must stay bounded")
-}
-
-func TestMailbox_DrainOrder(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evRemoteAnswer{answer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRelayDown{}))
-	require.True(t, mb.post(evICEDown{sessionChanged: true}))
-	require.True(t, mb.post(evClose{}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 6)
-
-	_, ok := evs[0].(evClose)
-	assert.True(t, ok, "lifecycle events must come first")
-	_, ok = evs[1].(evRelayDown)
-	assert.True(t, ok, "transport events must keep FIFO order")
-	_, ok = evs[2].(evICEDown)
-	assert.True(t, ok, "transport events must keep FIFO order")
-	_, ok = evs[3].(evRemoteOffer)
-	assert.True(t, ok, "offer must come after transport events")
-	_, ok = evs[4].(evRemoteAnswer)
-	assert.True(t, ok, "answer must come after the offer")
-	_, ok = evs[5].(evGuardTick)
-	assert.True(t, ok, "guard tick must come last")
-}
-
-func TestMailbox_GuardTickCoalesced(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evGuardTick{}))
-
-	evs := mb.drain()
-	assert.Len(t, evs, 1, "guard ticks must coalesce to a single event")
-}
-
-func TestMailbox_PostAfterCloseRejected(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRelayDown{}))
-	leftovers := mb.closeAndDrain()
-	assert.Len(t, leftovers, 1, "pending events must be returned on close")
-
-	assert.False(t, mb.post(evRelayDown{}), "posts must be rejected after close")
-	assert.Empty(t, mb.drain(), "no events must remain after close")
-}
-
-func TestMailbox_WakeSignal(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRelayDown{}))
-	require.True(t, mb.post(evGuardTick{}))
-
-	select {
-	case <-mb.wake:
-	default:
-		t.Fatal("wake signal must be pending after posts")
-	}
-
-	assert.Len(t, mb.drain(), 2, "a single wake must deliver all pending events")
-}

client/internal/peer/metrics_saver.go

@@ -1,4 +1,4 @@
-package metricsstages
+package peer
 
 import (
 	"sync"

client/internal/peer/metrics_saver_test.go

@@ -1,4 +1,4 @@
-package metricsstages
+package peer
 
 import (
 	"testing"

client/internal/peer/notifier.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"sync"
@@ -11,16 +11,6 @@ const (
 	stateDisconnecting
 )
 
-// Listener is a callback type about the NetBird network connection state
-type Listener interface {
-	OnConnected()
-	OnDisconnected()
-	OnConnecting()
-	OnDisconnecting()
-	OnAddressChanged(string, string)
-	OnPeersListChanged(int)
-}
-
 type notifier struct {
 	serverStateLock    sync.Mutex
 	listenersLock      sync.Mutex

client/internal/peer/notifier_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"sync"

client/internal/peer/route.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"net/netip"

client/internal/peer/session_id.go

@@ -1,4 +1,4 @@
-package ice
+package peer
 
 import (
 	"crypto/rand"
@@ -9,26 +9,26 @@ import (
 
 const sessionIDSize = 5
 
-type SessionID string
+type ICESessionID string
 
-// NewSessionID generates a new session ID for distinguishing sessions
-func NewSessionID() (SessionID, error) {
+// NewICESessionID generates a new session ID for distinguishing sessions
+func NewICESessionID() (ICESessionID, error) {
 	b := make([]byte, sessionIDSize)
 	if _, err := io.ReadFull(rand.Reader, b); err != nil {
 		return "", fmt.Errorf("failed to generate session ID: %w", err)
 	}
-	return SessionID(hex.EncodeToString(b)), nil
+	return ICESessionID(hex.EncodeToString(b)), nil
 }
 
-func SessionIDFromBytes(b []byte) (SessionID, error) {
+func ICESessionIDFromBytes(b []byte) (ICESessionID, error) {
 	if len(b) != sessionIDSize {
 		return "", fmt.Errorf("invalid session ID length: %d", len(b))
 	}
-	return SessionID(hex.EncodeToString(b)), nil
+	return ICESessionID(hex.EncodeToString(b)), nil
 }
 
 // Bytes returns the raw bytes of the session ID for protobuf serialization
-func (id SessionID) Bytes() ([]byte, error) {
+func (id ICESessionID) Bytes() ([]byte, error) {
 	if len(id) == 0 {
 		return nil, fmt.Errorf("ICE session ID is empty")
 	}
@@ -42,6 +42,6 @@ func (id SessionID) Bytes() ([]byte, error) {
 	return b, nil
 }
 
-func (id SessionID) String() string {
+func (id ICESessionID) String() string {
 	return string(id)
 }

client/internal/peer/signaler.go

@@ -1,4 +1,4 @@
-package signaling
+package peer
 
 import (
 	"github.com/pion/ice/v4"
@@ -61,11 +61,13 @@ func (s *Signaler) signalOfferAnswer(offerAnswer OfferAnswer, remoteKey string,
 			UFrag: offerAnswer.IceCredentials.UFrag,
 			Pwd:   offerAnswer.IceCredentials.Pwd,
 		},
-		RosenpassPubKey: offerAnswer.RosenpassPubKey,
-		RosenpassAddr:   offerAnswer.RosenpassAddr,
-		RelaySrvAddress: offerAnswer.RelaySrvAddress,
-		RelaySrvIP:      offerAnswer.RelaySrvIP,
-		SessionID:       sessionIDBytes,
+		RosenpassPubKey:     offerAnswer.RosenpassPubKey,
+		RosenpassPubKeyHash: offerAnswer.RosenpassPubKeyHash,
+		RosenpassPubKeyAck:  offerAnswer.RosenpassPubKeyAck,
+		RosenpassAddr:       offerAnswer.RosenpassAddr,
+		RelaySrvAddress:     offerAnswer.RelaySrvAddress,
+		RelaySrvIP:          offerAnswer.RelaySrvIP,
+		SessionID:           sessionIDBytes,
 	})
 	if err != nil {
 		return err

client/internal/peer/signaling/handshaker.go

@@ -1,189 +0,0 @@
-package signaling
-
-import (
-	"errors"
-	"net/netip"
-	"sync"
-	"sync/atomic"
-
-	log "github.com/sirupsen/logrus"
-
-	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	relayClient "github.com/netbirdio/netbird/shared/relay/client"
-	"github.com/netbirdio/netbird/version"
-)
-
-var (
-	ErrSignalIsNotReady = errors.New("signal is not ready")
-)
-
-// IceCredentials ICE protocol credentials struct
-type IceCredentials struct {
-	UFrag string
-	Pwd   string
-}
-
-// OfferAnswer represents a session establishment offer or answer
-type OfferAnswer struct {
-	IceCredentials IceCredentials
-	// WgListenPort is a remote WireGuard listen port.
-	// This field is used when establishing a direct WireGuard connection without any proxy.
-	// We can set the remote peer's endpoint with this port.
-	WgListenPort int
-
-	// Version of NetBird Agent
-	Version string
-	// RosenpassPubKey is the Rosenpass public key of the remote peer when receiving this message
-	// This value is the local Rosenpass server public key when sending the message
-	RosenpassPubKey []byte
-	// RosenpassAddr is the Rosenpass server address (IP:port) of the remote peer when receiving this message
-	// This value is the local Rosenpass server address when sending the message
-	RosenpassAddr string
-
-	// relay server address
-	RelaySrvAddress string
-	// RelaySrvIP is the IP the remote peer is connected to on its
-	// relay server. Used as a dial target if DNS for RelaySrvAddress
-	// fails. Zero value if the peer did not advertise an IP.
-	RelaySrvIP netip.Addr
-	// SessionID is the unique identifier of the session, used to discard old messages
-	SessionID *icemaker.SessionID
-}
-
-func (o *OfferAnswer) HasICECredentials() bool {
-	return o.IceCredentials.UFrag != "" && o.IceCredentials.Pwd != ""
-}
-
-func (o *OfferAnswer) SessionIDString() string {
-	if o.SessionID == nil {
-		return "unknown"
-	}
-	return o.SessionID.String()
-}
-
-// Config carries the peer-specific values the Handshaker embeds into offers
-// and answers.
-type Config struct {
-	Key             string
-	LocalWgPort     int
-	RosenpassPubKey []byte
-	RosenpassAddr   string
-}
-
-// Credentials are the local ICE credentials and session id the Handshaker embeds in offers.
-type Credentials struct {
-	UFrag     string
-	Pwd       string
-	SessionID icemaker.SessionID
-}
-
-// ICEWorker is the subset of the ICE worker the Handshaker needs to build offers.
-type ICEWorker interface {
-	Credentials() Credentials
-	Close()
-}
-
-// Handshaker keeps the signaling protocol logic: building and sending offers
-// and answers and tracking whether the remote peer supports ICE. Incoming
-// message processing is driven by the Conn event loop.
-type Handshaker struct {
-	mu           sync.Mutex
-	log          *log.Entry
-	config       Config
-	signaler     *Signaler
-	ice          ICEWorker
-	relayManager *relayClient.Manager
-
-	// remoteICESupported tracks whether the remote peer includes ICE credentials in its offers/answers.
-	// When false, the local side skips ICE dispatch and suppresses ICE credentials in responses.
-	remoteICESupported atomic.Bool
-}
-
-func NewHandshaker(log *log.Entry, config Config, signaler *Signaler, ice ICEWorker, relayManager *relayClient.Manager) *Handshaker {
-	h := &Handshaker{
-		log:          log,
-		config:       config,
-		signaler:     signaler,
-		ice:          ice,
-		relayManager: relayManager,
-	}
-	// assume remote supports ICE until we learn otherwise from received offers
-	h.remoteICESupported.Store(ice != nil)
-	return h
-}
-
-func (h *Handshaker) RemoteICESupported() bool {
-	return h.remoteICESupported.Load()
-}
-
-func (h *Handshaker) SendOffer() error {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return h.sendOffer()
-}
-
-func (h *Handshaker) SendAnswer() error {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return h.sendAnswer()
-}
-
-// sendOffer prepares local user credentials and signals them to the remote peer
-func (h *Handshaker) sendOffer() error {
-	if !h.signaler.Ready() {
-		return ErrSignalIsNotReady
-	}
-
-	offer := h.buildOfferAnswer()
-	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
-
-	return h.signaler.SignalOffer(offer, h.config.Key)
-}
-
-func (h *Handshaker) sendAnswer() error {
-	answer := h.buildOfferAnswer()
-	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
-
-	return h.signaler.SignalAnswer(answer, h.config.Key)
-}
-
-func (h *Handshaker) buildOfferAnswer() OfferAnswer {
-	answer := OfferAnswer{
-		WgListenPort:    h.config.LocalWgPort,
-		Version:         version.NetbirdVersion(),
-		RosenpassPubKey: h.config.RosenpassPubKey,
-		RosenpassAddr:   h.config.RosenpassAddr,
-	}
-
-	if h.ice != nil && h.RemoteICESupported() {
-		creds := h.ice.Credentials()
-		answer.IceCredentials = IceCredentials{creds.UFrag, creds.Pwd}
-		sid := creds.SessionID
-		answer.SessionID = &sid
-	}
-
-	if addr, ip, err := h.relayManager.RelayInstanceAddress(); err == nil {
-		answer.RelaySrvAddress = addr
-		answer.RelaySrvIP = ip
-	}
-
-	return answer
-}
-
-// UpdateRemoteICEState refreshes the remote ICE support flag from a received
-// offer or answer and closes the ICE worker when the remote peer stopped
-// sending ICE credentials. Runs on the Conn event loop.
-func (h *Handshaker) UpdateRemoteICEState(offer *OfferAnswer) {
-	hasICE := offer.HasICECredentials()
-	prev := h.remoteICESupported.Swap(hasICE)
-	if prev != hasICE {
-		if hasICE {
-			h.log.Infof("remote peer started sending ICE credentials")
-		} else {
-			h.log.Infof("remote peer stopped sending ICE credentials")
-			if h.ice != nil {
-				h.ice.Close()
-			}
-		}
-	}
-}

client/internal/peer/state_dump.go

@@ -1,4 +1,4 @@
-package state_dump
+package peer
 
 import (
 	"context"
@@ -6,13 +6,11 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 )
 
-type StateDump struct {
+type stateDump struct {
 	log    *log.Entry
-	status *status.Recorder
+	status *Status
 	key    string
 
 	sentOffer       int
@@ -28,15 +26,15 @@ type StateDump struct {
 	mu sync.Mutex
 }
 
-func NewStateDump(key string, log *log.Entry, statusRecorder *status.Recorder) *StateDump {
-	return &StateDump{
+func newStateDump(key string, log *log.Entry, statusRecorder *Status) *stateDump {
+	return &stateDump{
 		log:    log,
 		status: statusRecorder,
 		key:    key,
 	}
 }
 
-func (s *StateDump) Start(ctx context.Context) {
+func (s *stateDump) Start(ctx context.Context) {
 	ticker := time.NewTicker(10 * time.Minute)
 	defer ticker.Stop()
 
@@ -50,25 +48,25 @@ func (s *StateDump) Start(ctx context.Context) {
 	}
 }
 
-func (s *StateDump) RemoteOffer() {
+func (s *stateDump) RemoteOffer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteOffer++
 }
 
-func (s *StateDump) RemoteCandidate() {
+func (s *stateDump) RemoteCandidate() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteCandidate++
 }
 
-func (s *StateDump) SendOffer() {
+func (s *stateDump) SendOffer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.sentOffer++
 }
 
-func (s *StateDump) dumpState() {
+func (s *stateDump) dumpState() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
@@ -82,41 +80,41 @@ func (s *StateDump) dumpState() {
 		status, s.sentOffer, s.remoteOffer, s.remoteAnswer, s.remoteCandidate, s.p2pConnected, s.switchToRelay, s.wgCheckSuccess, s.relayConnected, s.localProxies)
 }
 
-func (s *StateDump) RemoteAnswer() {
+func (s *stateDump) RemoteAnswer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteAnswer++
 }
 
-func (s *StateDump) P2PConnected() {
+func (s *stateDump) P2PConnected() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.p2pConnected++
 }
 
-func (s *StateDump) SwitchToRelay() {
+func (s *stateDump) SwitchToRelay() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.switchToRelay++
 }
 
-func (s *StateDump) WGcheckSuccess() {
+func (s *stateDump) WGcheckSuccess() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.wgCheckSuccess++
 }
 
-func (s *StateDump) RelayConnected() {
+func (s *stateDump) RelayConnected() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.relayConnected++
 }
 
-func (s *StateDump) NewLocalProxy() {
+func (s *stateDump) NewLocalProxy() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 

client/internal/peer/status/conn_status.go

@@ -1,31 +0,0 @@
-package status
-
-import (
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	// StatusIdle indicate the peer is in disconnected state
-	StatusIdle ConnStatus = iota
-	// StatusConnecting indicate the peer is in connecting state
-	StatusConnecting
-	// StatusConnected indicate the peer is in connected state
-	StatusConnected
-)
-
-// ConnStatus describe the status of a peer's connection
-type ConnStatus int32
-
-func (s ConnStatus) String() string {
-	switch s {
-	case StatusConnecting:
-		return "Connecting"
-	case StatusConnected:
-		return "Connected"
-	case StatusIdle:
-		return "Idle"
-	default:
-		log.Errorf("unknown status: %d", s)
-		return "INVALID_PEER_CONNECTION_STATUS"
-	}
-}

client/internal/peer/status/events.go

@@ -1,48 +0,0 @@
-package status
-
-import (
-	"slices"
-	"sync"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-type EventQueue struct {
-	maxSize int
-	events  []*proto.SystemEvent
-	mutex   sync.RWMutex
-}
-
-func NewEventQueue(size int) *EventQueue {
-	return &EventQueue{
-		maxSize: size,
-		events:  make([]*proto.SystemEvent, 0, size),
-	}
-}
-
-func (q *EventQueue) Add(event *proto.SystemEvent) {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	q.events = append(q.events, event)
-
-	if len(q.events) > q.maxSize {
-		q.events = q.events[len(q.events)-q.maxSize:]
-	}
-}
-
-func (q *EventQueue) GetAll() []*proto.SystemEvent {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return slices.Clone(q.events)
-}
-
-type EventSubscription struct {
-	id     string
-	events chan *proto.SystemEvent
-}
-
-func (s *EventSubscription) Events() <-chan *proto.SystemEvent {
-	return s.events
-}

client/internal/peer/status/full_status.go

@@ -1,122 +0,0 @@
-package status
-
-import (
-	"golang.org/x/exp/maps"
-	"google.golang.org/protobuf/types/known/durationpb"
-	"google.golang.org/protobuf/types/known/timestamppb"
-
-	"github.com/netbirdio/netbird/client/internal/relay"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// FullStatus contains the full state held by the Recorder instance
-type FullStatus struct {
-	Peers                 []State
-	ManagementState       ManagementState
-	SignalState           SignalState
-	LocalPeerState        LocalPeerState
-	RosenpassState        RosenpassState
-	Relays                []relay.ProbeResult
-	NSGroupStates         []NSGroupState
-	NumOfForwardingRules  int
-	LazyConnectionEnabled bool
-	Events                []*proto.SystemEvent
-}
-
-// ToProto converts FullStatus to proto.FullStatus.
-func (fs FullStatus) ToProto() *proto.FullStatus {
-	pbFullStatus := proto.FullStatus{
-		ManagementState: &proto.ManagementState{},
-		SignalState:     &proto.SignalState{},
-		LocalPeerState:  &proto.LocalPeerState{},
-		Peers:           []*proto.PeerState{},
-	}
-
-	pbFullStatus.ManagementState.URL = fs.ManagementState.URL
-	pbFullStatus.ManagementState.Connected = fs.ManagementState.Connected
-	if err := fs.ManagementState.Error; err != nil {
-		pbFullStatus.ManagementState.Error = err.Error()
-	}
-
-	pbFullStatus.SignalState.URL = fs.SignalState.URL
-	pbFullStatus.SignalState.Connected = fs.SignalState.Connected
-	if err := fs.SignalState.Error; err != nil {
-		pbFullStatus.SignalState.Error = err.Error()
-	}
-
-	pbFullStatus.LocalPeerState.IP = fs.LocalPeerState.IP
-	pbFullStatus.LocalPeerState.Ipv6 = fs.LocalPeerState.IPv6
-	pbFullStatus.LocalPeerState.PubKey = fs.LocalPeerState.PubKey
-	pbFullStatus.LocalPeerState.KernelInterface = fs.LocalPeerState.KernelInterface
-	pbFullStatus.LocalPeerState.Fqdn = fs.LocalPeerState.FQDN
-	pbFullStatus.LocalPeerState.WgPort = int32(fs.LocalPeerState.WgPort)
-	pbFullStatus.LocalPeerState.RosenpassPermissive = fs.RosenpassState.Permissive
-	pbFullStatus.LocalPeerState.RosenpassEnabled = fs.RosenpassState.Enabled
-	pbFullStatus.NumberOfForwardingRules = int32(fs.NumOfForwardingRules)
-	pbFullStatus.LazyConnectionEnabled = fs.LazyConnectionEnabled
-
-	pbFullStatus.LocalPeerState.Networks = maps.Keys(fs.LocalPeerState.Routes)
-
-	for _, peerState := range fs.Peers {
-		networks := maps.Keys(peerState.GetRoutes())
-
-		pbPeerState := &proto.PeerState{
-			IP:                         peerState.IP,
-			Ipv6:                       peerState.IPv6,
-			PubKey:                     peerState.PubKey,
-			ConnStatus:                 peerState.ConnStatus.String(),
-			ConnStatusUpdate:           timestamppb.New(peerState.ConnStatusUpdate),
-			Relayed:                    peerState.Relayed,
-			LocalIceCandidateType:      peerState.LocalIceCandidateType,
-			RemoteIceCandidateType:     peerState.RemoteIceCandidateType,
-			LocalIceCandidateEndpoint:  peerState.LocalIceCandidateEndpoint,
-			RemoteIceCandidateEndpoint: peerState.RemoteIceCandidateEndpoint,
-			RelayAddress:               peerState.RelayServerAddress,
-			Fqdn:                       peerState.FQDN,
-			LastWireguardHandshake:     timestamppb.New(peerState.LastWireguardHandshake),
-			BytesRx:                    peerState.BytesRx,
-			BytesTx:                    peerState.BytesTx,
-			RosenpassEnabled:           peerState.RosenpassEnabled,
-			Networks:                   networks,
-			Latency:                    durationpb.New(peerState.Latency),
-			SshHostKey:                 peerState.SSHHostKey,
-		}
-		pbFullStatus.Peers = append(pbFullStatus.Peers, pbPeerState)
-	}
-
-	for _, relayState := range fs.Relays {
-		pbRelayState := &proto.RelayState{
-			URI:       relayState.URI,
-			Available: relayState.Err == nil,
-			Transport: relayState.Transport,
-		}
-		if err := relayState.Err; err != nil {
-			pbRelayState.Error = err.Error()
-		}
-		pbFullStatus.Relays = append(pbFullStatus.Relays, pbRelayState)
-	}
-
-	for _, dnsState := range fs.NSGroupStates {
-		var err string
-		if dnsState.Error != nil {
-			err = dnsState.Error.Error()
-		}
-
-		var servers []string
-		for _, server := range dnsState.Servers {
-			servers = append(servers, server.String())
-		}
-
-		pbDnsState := &proto.NSGroupState{
-			Servers: servers,
-			Domains: dnsState.Domains,
-			Enabled: dnsState.Enabled,
-			Error:   err,
-		}
-		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
-	}
-
-	pbFullStatus.Events = fs.Events
-
-	return &pbFullStatus
-}

client/internal/peer/status/peer_state.go

@@ -1,63 +0,0 @@
-package status
-
-import (
-	"sync"
-	"time"
-
-	"golang.org/x/exp/maps"
-)
-
-// State contains the latest state of a peer
-type State struct {
-	Mux                        *sync.RWMutex
-	IP                         string
-	IPv6                       string
-	PubKey                     string
-	FQDN                       string
-	ConnStatus                 ConnStatus
-	ConnStatusUpdate           time.Time
-	Relayed                    bool
-	LocalIceCandidateType      string
-	RemoteIceCandidateType     string
-	LocalIceCandidateEndpoint  string
-	RemoteIceCandidateEndpoint string
-	RelayServerAddress         string
-	LastWireguardHandshake     time.Time
-	BytesTx                    int64
-	BytesRx                    int64
-	Latency                    time.Duration
-	RosenpassEnabled           bool
-	SSHHostKey                 []byte
-	routes                     map[string]struct{}
-}
-
-// AddRoute add a single route to routes map
-func (s *State) AddRoute(network string) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	if s.routes == nil {
-		s.routes = make(map[string]struct{})
-	}
-	s.routes[network] = struct{}{}
-}
-
-// SetRoutes set state routes
-func (s *State) SetRoutes(routes map[string]struct{}) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	s.routes = routes
-}
-
-// DeleteRoute removes a route from the network amp
-func (s *State) DeleteRoute(network string) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	delete(s.routes, network)
-}
-
-// GetRoutes return routes map
-func (s *State) GetRoutes() map[string]struct{} {
-	s.Mux.RLock()
-	defer s.Mux.RUnlock()
-	return maps.Clone(s.routes)
-}

client/internal/peer/status_alias.go

@@ -1,36 +0,0 @@
-package peer
-
-import "github.com/netbirdio/netbird/client/internal/peer/status"
-
-// Transitional aliases re-exporting the peer status recorder from its own
-// package. Callers are being migrated to reference the status package
-// directly; these aliases will be removed once the migration completes.
-type (
-	Status                   = status.Recorder
-	State                    = status.State
-	ConnStatus               = status.ConnStatus
-	FullStatus               = status.FullStatus
-	RouterState              = status.RouterState
-	LocalPeerState           = status.LocalPeerState
-	SignalState              = status.SignalState
-	ManagementState          = status.ManagementState
-	RosenpassState           = status.RosenpassState
-	NSGroupState             = status.NSGroupState
-	ResolvedDomainInfo       = status.ResolvedDomainInfo
-	StatusChangeSubscription = status.StatusChangeSubscription
-	EventQueue               = status.EventQueue
-	EventSubscription        = status.EventSubscription
-	WGIfaceStatus            = status.WGIfaceStatus
-	Listener                 = status.Listener
-	EventListener            = status.EventListener
-)
-
-const (
-	StatusIdle       = status.StatusIdle
-	StatusConnecting = status.StatusConnecting
-	StatusConnected  = status.StatusConnected
-)
-
-var (
-	NewRecorder = status.NewRecorder
-)

client/internal/peer/status_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"context"

client/internal/peer/wg_watcher.go

@@ -1,15 +1,13 @@
-package wg_watcher
+package peer
 
 import (
 	"context"
 	"fmt"
-	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/internal/peer/state_dump"
 )
 
 const (
@@ -25,21 +23,21 @@ type WGInterfaceStater interface {
 	GetStats() (map[string]configurer.WGStats, error)
 }
 
+// WGWatcher is single-shot: one instance per connection attempt, run once, then discarded.
+// Lifecycle is owned by Conn under conn.mu, so it keeps no "enabled" state to go stale.
 type WGWatcher struct {
 	log           *log.Entry
 	wgIfaceStater WGInterfaceStater
 	peerKey       string
-	stateDump     *state_dump.StateDump
+	stateDump     *stateDump
 
-	enabled   bool
-	muEnabled sync.Mutex
 	// initialHandshake is not thread-safe; never call PrepareInitialHandshake and EnableWgWatcher concurrently.
 	initialHandshake time.Time
 
 	resetCh chan struct{}
 }
 
-func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey string, stateDump *state_dump.StateDump) *WGWatcher {
+func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey string, stateDump *stateDump) *WGWatcher {
 	return &WGWatcher{
 		log:           log,
 		wgIfaceStater: wgIfaceStater,
@@ -49,25 +47,14 @@ func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey strin
 	}
 }
 
-// PrepareInitialHandshake reserves the watcher and reads the peer's current WireGuard
-// handshake time. It must be called before the peer is (re)configured on the WireGuard
-// interface, so the captured baseline reflects the state prior to this connection attempt
-// instead of racing with that configuration. Returns ok=false if the watcher is already
-// running, in which case EnableWgWatcher must not be called.
-func (w *WGWatcher) PrepareInitialHandshake() (ok bool) {
-	w.muEnabled.Lock()
-	if w.enabled {
-		w.muEnabled.Unlock()
-		return false
-	}
-
+// PrepareInitialHandshake reads the peer's current WireGuard handshake time. It must be
+// called before the peer is (re)configured on the WireGuard interface, so the captured
+// baseline reflects the state prior to this connection attempt instead of racing with
+// that configuration.
+func (w *WGWatcher) PrepareInitialHandshake() {
 	w.log.Debugf("enable WireGuard watcher")
-	w.enabled = true
-	w.muEnabled.Unlock()
-
 	handshake, _ := w.wgState()
 	w.initialHandshake = handshake
-	return true
 }
 
 // EnableWgWatcher runs the WireGuard watcher loop using the handshake baseline captured by
@@ -77,10 +64,6 @@ func (w *WGWatcher) PrepareInitialHandshake() (ok bool) {
 // handshake, including the first.
 func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func()) {
 	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, onCheckSuccessFn, enabledTime, w.initialHandshake)
-
-	w.muEnabled.Lock()
-	w.enabled = false
-	w.muEnabled.Unlock()
 }
 
 // Reset signals the watcher that the WireGuard peer has been reset and a new
@@ -106,6 +89,7 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 		case <-timer.C:
 			handshake, ok := w.handshakeCheck(lastHandshake)
 			if !ok {
+				// early ctx cancel check return
 				if ctx.Err() != nil {
 					return
 				}
@@ -154,9 +138,9 @@ func (w *WGWatcher) handshakeCheck(lastHandshake time.Time) (*time.Time, bool) {
 
 	w.log.Tracef("previous handshake, handshake: %v, %v", lastHandshake, handshake)
 
-	// the current know handshake did not change
+	// the current known handshake did not change
 	if handshake.Equal(lastHandshake) {
-		w.log.Warnf("WireGuard handshake timed out: %v", handshake)
+		w.log.Warnf("WireGuard handshake not updated: %v", handshake)
 		return nil, false
 	}
 

client/internal/peer/wg_watcher_test.go

@@ -1,4 +1,4 @@
-package wg_watcher
+package peer
 
 import (
 	"context"
@@ -7,11 +7,8 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/internal/peer/state_dump"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 )
 
 type MocWgIface struct {
@@ -59,27 +56,23 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 	// platforms with coarse clock resolution (Windows), where two time.Now() calls
 	// microseconds apart can return the same instant and read as a timed-out handshake.
 	stats := &mockHandshakeStats{handshake: time.Now().Add(-time.Hour)}
-	watcher := NewWGWatcher(mlog, stats, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, stats, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	require.True(t, watcher.PrepareInitialHandshake())
+	watcher.PrepareInitialHandshake()
 
 	firstHandshake := make(chan struct{}, 1)
 	checkSuccess := make(chan struct{}, 1)
-	watcherDone := make(chan struct{})
-	go func() {
-		defer close(watcherDone)
-		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
-			firstHandshake <- struct{}{}
-		}, func() {
-			select {
-			case checkSuccess <- struct{}{}:
-			default:
-			}
-		})
-	}()
+	go watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
+		firstHandshake <- struct{}{}
+	}, func() {
+		select {
+		case checkSuccess <- struct{}{}:
+		default:
+		}
+	})
 
 	stats.advance()
 
@@ -94,11 +87,6 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 		t.Errorf("first-handshake callback must not fire for a non-zero baseline")
 	default:
 	}
-
-	// Wait for the watcher goroutine to exit so it cannot race with other
-	// tests mutating the package-level check timing variables.
-	cancel()
-	<-watcherDone
 }
 
 func TestWGWatcher_EnableWgWatcher(t *testing.T) {
@@ -107,13 +95,12 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 
 	mlog := log.WithField("peer", "tet")
 	mocWgIface := &MocWgIface{}
-	watcher := NewWGWatcher(mlog, mocWgIface, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	ok := watcher.PrepareInitialHandshake()
-	require.True(t, ok, "watcher should not be enabled yet")
+	watcher.PrepareInitialHandshake()
 
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
@@ -140,11 +127,10 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 
 	mlog := log.WithField("peer", "tet")
 	mocWgIface := &MocWgIface{}
-	watcher := NewWGWatcher(mlog, mocWgIface, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
-	ok := watcher.PrepareInitialHandshake()
-	require.True(t, ok, "watcher should not be enabled yet")
+	watcher.PrepareInitialHandshake()
 
 	wg := &sync.WaitGroup{}
 	wg.Add(1)
@@ -160,8 +146,7 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	ctx, cancel = context.WithCancel(context.Background())
 	defer cancel()
 
-	ok = watcher.PrepareInitialHandshake()
-	require.True(t, ok, "watcher should be re-enabled after the previous run stopped")
+	watcher.PrepareInitialHandshake()
 
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {

client/internal/peer/worker/state.go

@@ -1,4 +1,4 @@
-package peer
+package worker
 
 import (
 	"sync/atomic"
@@ -7,17 +7,17 @@ import (
 )
 
 const (
-	WorkerStatusDisconnected WorkerStatus = iota
-	WorkerStatusConnected
+	StatusDisconnected Status = iota
+	StatusConnected
 )
 
-type WorkerStatus int32
+type Status int32
 
-func (s WorkerStatus) String() string {
+func (s Status) String() string {
 	switch s {
-	case WorkerStatusDisconnected:
+	case StatusDisconnected:
 		return "Disconnected"
-	case WorkerStatusConnected:
+	case StatusConnected:
 		return "Connected"
 	default:
 		log.Errorf("unknown status: %d", s)
@@ -37,16 +37,16 @@ func NewAtomicStatus() *AtomicWorkerStatus {
 }
 
 // Get returns the current connection status
-func (acs *AtomicWorkerStatus) Get() WorkerStatus {
-	return WorkerStatus(acs.status.Load())
+func (acs *AtomicWorkerStatus) Get() Status {
+	return Status(acs.status.Load())
 }
 
 func (acs *AtomicWorkerStatus) SetConnected() {
-	acs.status.Store(int32(WorkerStatusConnected))
+	acs.status.Store(int32(StatusConnected))
 }
 
 func (acs *AtomicWorkerStatus) SetDisconnected() {
-	acs.status.Store(int32(WorkerStatusDisconnected))
+	acs.status.Store(int32(StatusDisconnected))
 }
 
 // String returns the string representation of the current status

client/internal/peer/worker_ice.go

@@ -1,4 +1,4 @@
-package worker
+package peer
 
 import (
 	"context"
@@ -13,9 +13,8 @@ import (
 
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
+	"github.com/netbirdio/netbird/client/internal/peer/conntype"
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/route"
@@ -33,68 +32,57 @@ type ICEConnInfo struct {
 	RelayedOnLocal             bool
 }
 
-type ICEDependencies struct {
-	Signaler           *signaling.Signaler
-	IFaceDiscover      stdnet.ExternalIFaceDiscover
-	StatusRecorder     *status.Recorder
-	PortForwardManager *portforward.Manager
-}
-
-type ICE struct {
-	log                *log.Entry
-	key                string
-	iceConfig          icemaker.Config
-	isController       bool
-	onConnReady        func(priority ConnPriority, iceConnInfo ICEConnInfo)
-	onStatusDisconnect func(sessionChanged bool)
-	signaler           *signaling.Signaler
-	iFaceDiscover      stdnet.ExternalIFaceDiscover
-	statusRecorder     *status.Recorder
-	portForwardManager *portforward.Manager
-	hasRelayOnLocally  bool
+type WorkerICE struct {
+	ctx               context.Context
+	log               *log.Entry
+	config            ConnConfig
+	conn              *Conn
+	signaler          *Signaler
+	iFaceDiscover     stdnet.ExternalIFaceDiscover
+	statusRecorder    *Status
+	hasRelayOnLocally bool
 
 	agent             *icemaker.ThreadSafeAgent
 	agentDialerCancel context.CancelFunc
 	agentConnecting   bool      // while it is true, drop all incoming offers
 	lastSuccess       time.Time // with this avoid the too frequent ICE agent recreation
-	// connectedAgent is the agent whose connection was last reported ready; guarded by muxAgent
-	connectedAgent *icemaker.ThreadSafeAgent
 	// remoteSessionID represents the peer's session identifier from the latest remote offer.
-	remoteSessionID icemaker.SessionID
+	remoteSessionID ICESessionID
 	// sessionID is used to track the current session ID of the ICE agent
 	// increase by one when disconnecting the agent
 	// with it the remote peer can discard the already deprecated offer/answer
 	// Without it the remote peer may recreate a workable ICE connection
-	sessionID            icemaker.SessionID
+	sessionID            ICESessionID
 	remoteSessionChanged bool
 	muxAgent             sync.Mutex
 
 	localUfrag string
 	localPwd   string
 
+	// we record the last known state of the ICE agent to avoid duplicate on disconnected events
+	lastKnownState ice.ConnectionState
+
 	// portForwardAttempted tracks if we've already tried port forwarding this session
 	portForwardAttempted bool
 }
 
-func NewICE(log *log.Entry, key string, iceConfig icemaker.Config, isController bool, onConnReady func(ConnPriority, ICEConnInfo), onStatusDisconnect func(bool), services ICEDependencies, hasRelayOnLocally bool) (*ICE, error) {
-	sessionID, err := icemaker.NewSessionID()
+func NewWorkerICE(ctx context.Context, log *log.Entry, config ConnConfig, conn *Conn, signaler *Signaler, ifaceDiscover stdnet.ExternalIFaceDiscover, statusRecorder *Status, hasRelayOnLocally bool) (*WorkerICE, error) {
+	sessionID, err := NewICESessionID()
 	if err != nil {
 		return nil, err
 	}
 
-	w := &ICE{
-		log:                log,
-		key:                key,
-		iceConfig:          iceConfig,
-		isController:       isController,
-		onConnReady:        onConnReady,
-		onStatusDisconnect: onStatusDisconnect,
-		signaler:           services.Signaler,
-		iFaceDiscover:      services.IFaceDiscover,
-		statusRecorder:     services.StatusRecorder,
-		portForwardManager: services.PortForwardManager,
-		hasRelayOnLocally:  hasRelayOnLocally,
-		sessionID:          sessionID,
+	w := &WorkerICE{
+		ctx:               ctx,
+		log:               log,
+		config:            config,
+		conn:              conn,
+		signaler:          signaler,
+		iFaceDiscover:     ifaceDiscover,
+		statusRecorder:    statusRecorder,
+		hasRelayOnLocally: hasRelayOnLocally,
+		lastKnownState:    ice.ConnectionStateDisconnected,
+		sessionID:         sessionID,
 	}
 
 	localUfrag, localPwd, err := icemaker.GenerateICECredentials()
@@ -106,7 +94,7 @@ func NewICE(log *log.Entry, key string, iceConfig icemaker.Config, isController
 	return w, nil
 }
 
-func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerICE) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	w.log.Debugf("OnNewOffer for ICE, serial: %s", remoteOfferAnswer.SessionIDString())
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
@@ -130,7 +118,7 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 			}
 		}
 
-		sessionID, err := icemaker.NewSessionID()
+		sessionID, err := NewICESessionID()
 		if err != nil {
 			w.log.Errorf("failed to create new session ID: %s", err)
 		}
@@ -148,8 +136,8 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 	if remoteOfferAnswer.SessionID != nil {
 		w.log.Debugf("recreate ICE agent: %s / %s", w.sessionID, *remoteOfferAnswer.SessionID)
 	}
-	dialerCtx, dialerCancel := context.WithCancel(ctx)
-	agent, err := w.reCreateAgent(ctx, dialerCancel, preferredCandidateTypes)
+	dialerCtx, dialerCancel := context.WithCancel(w.ctx)
+	agent, err := w.reCreateAgent(dialerCancel, preferredCandidateTypes)
 	if err != nil {
 		w.log.Errorf("failed to recreate ICE Agent: %s", err)
 		return
@@ -163,14 +151,14 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 		w.remoteSessionID = ""
 	}
 
-	go w.connect(dialerCtx, dialerCancel, agent, remoteOfferAnswer)
+	go w.connect(dialerCtx, agent, remoteOfferAnswer)
 }
 
 // OnRemoteCandidate Handles ICE connection Candidate provided by the remote peer.
-func (w *ICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
+func (w *WorkerICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
-	w.log.Debugf("OnRemoteCandidate from peer %s -> %s", w.key, candidate.String())
+	w.log.Debugf("OnRemoteCandidate from peer %s -> %s", w.config.Key, candidate.String())
 	if w.agent == nil {
 		w.log.Warnf("ICE Agent is not initialized yet")
 		return
@@ -197,24 +185,18 @@ func (w *ICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
 	}
 }
 
-func (w *ICE) Credentials() signaling.Credentials {
-	w.muxAgent.Lock()
-	defer w.muxAgent.Unlock()
-	return signaling.Credentials{
-		UFrag:     w.localUfrag,
-		Pwd:       w.localPwd,
-		SessionID: w.sessionID,
-	}
+func (w *WorkerICE) GetLocalUserCredentials() (frag string, pwd string) {
+	return w.localUfrag, w.localPwd
 }
 
-func (w *ICE) InProgress() bool {
+func (w *WorkerICE) InProgress() bool {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
 	return w.agentConnecting
 }
 
-func (w *ICE) Close() {
+func (w *WorkerICE) Close() {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
@@ -230,10 +212,10 @@ func (w *ICE) Close() {
 	w.agent = nil
 }
 
-func (w *ICE) reCreateAgent(ctx context.Context, dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, error) {
+func (w *WorkerICE) reCreateAgent(dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, error) {
 	w.portForwardAttempted = false
 
-	agent, err := icemaker.NewAgent(ctx, w.iFaceDiscover, w.iceConfig, candidates, w.localUfrag, w.localPwd)
+	agent, err := icemaker.NewAgent(w.ctx, w.iFaceDiscover, w.config.ICEConfig, candidates, w.localUfrag, w.localPwd)
 	if err != nil {
 		return nil, fmt.Errorf("create agent: %w", err)
 	}
@@ -255,7 +237,7 @@ func (w *ICE) reCreateAgent(ctx context.Context, dialerCancel context.CancelFunc
 	return agent, nil
 }
 
-func (w *ICE) getSessionID() icemaker.SessionID {
+func (w *WorkerICE) SessionID() ICESessionID {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
@@ -265,11 +247,11 @@ func (w *ICE) getSessionID() icemaker.SessionID {
 // will block until connection succeeded
 // but it won't release if ICE Agent went into Disconnected or Failed state,
 // so we have to cancel it with the provided context once agent detected a broken connection
-func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerICE) connect(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) {
 	w.log.Debugf("gather candidates")
 	if err := agent.GatherCandidates(); err != nil {
 		w.log.Warnf("failed to gather candidates: %s", err)
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 
@@ -277,19 +259,19 @@ func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agen
 	remoteConn, err := w.turnAgentDial(ctx, agent, remoteOfferAnswer)
 	if err != nil {
 		w.log.Debugf("failed to dial the remote peer: %s", err)
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 	w.log.Debugf("agent dial succeeded")
 
 	pair, err := agent.GetSelectedCandidatePair()
 	if err != nil {
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 	if pair == nil {
 		w.log.Warnf("selected candidate pair is nil, cannot proceed")
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 
@@ -317,22 +299,17 @@ func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agen
 	}
 	w.log.Debugf("on ICE conn is ready to use")
 
+	w.log.Infof("connection succeeded with offer session: %s", remoteOfferAnswer.SessionIDString())
 	w.muxAgent.Lock()
-	if w.agent != agent {
-		w.muxAgent.Unlock()
-		w.log.Debugf("agent has been replaced during connect, dropping obsolete connection")
-		return
-	}
 	w.agentConnecting = false
 	w.lastSuccess = time.Now()
-	w.connectedAgent = agent
 	w.muxAgent.Unlock()
 
-	w.log.Infof("connection succeeded with offer session: %s", remoteOfferAnswer.SessionIDString())
-	w.onConnReady(selectedPriority(pair), ci)
+	// todo: the potential problem is a race between the onConnectionStateChange
+	w.conn.onICEConnectionIsReady(selectedPriority(pair), ci)
 }
 
-func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelFunc) bool {
+func (w *WorkerICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelFunc) bool {
 	cancel()
 	if err := agent.Close(); err != nil {
 		w.log.Warnf("failed to close ICE agent: %s", err)
@@ -346,7 +323,7 @@ func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelF
 
 	if w.agent == agent {
 		// consider to remove from here and move to the OnNewOffer
-		sessionID, err := icemaker.NewSessionID()
+		sessionID, err := NewICESessionID()
 		if err != nil {
 			w.log.Errorf("failed to create new session ID: %s", err)
 		}
@@ -358,7 +335,7 @@ func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelF
 	return sessionChanged
 }
 
-func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
+func (w *WorkerICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 	// wait local endpoint configuration
 	time.Sleep(time.Second)
 	addr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(pair.Remote.Address(), strconv.Itoa(remoteWgPort)))
@@ -367,7 +344,7 @@ func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 		return
 	}
 
-	mux, ok := w.iceConfig.UDPMuxSrflx.(*udpmux.UniversalUDPMuxDefault)
+	mux, ok := w.config.ICEConfig.UDPMuxSrflx.(*udpmux.UniversalUDPMuxDefault)
 	if !ok {
 		w.log.Warn("invalid udp mux conversion")
 		return
@@ -380,7 +357,7 @@ func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 
 // onICECandidate is a callback attached to an ICE Agent to receive new local connection candidates
 // and then signals them to the remote peer
-func (w *ICE) onICECandidate(candidate ice.Candidate) {
+func (w *WorkerICE) onICECandidate(candidate ice.Candidate) {
 	// nil means candidate gathering has been ended
 	if candidate == nil {
 		return
@@ -389,9 +366,9 @@ func (w *ICE) onICECandidate(candidate ice.Candidate) {
 	// TODO: reported port is incorrect for CandidateTypeHost, makes understanding ICE use via logs confusing as port is ignored
 	w.log.Debugf("discovered local candidate %s", candidate.String())
 	go func() {
-		err := w.signaler.SignalICECandidate(candidate, w.key)
+		err := w.signaler.SignalICECandidate(candidate, w.config.Key)
 		if err != nil {
-			w.log.Errorf("failed signaling candidate to the remote peer %s %s", w.key, err)
+			w.log.Errorf("failed signaling candidate to the remote peer %s %s", w.config.Key, err)
 		}
 	}()
 
@@ -401,8 +378,8 @@ func (w *ICE) onICECandidate(candidate ice.Candidate) {
 }
 
 // injectPortForwardedCandidate signals an additional candidate using the pre-created port mapping.
-func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
-	pfManager := w.portForwardManager
+func (w *WorkerICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
+	pfManager := w.conn.portForwardManager
 	if pfManager == nil {
 		return
 	}
@@ -430,7 +407,7 @@ func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
 		forwardedCandidate.String(), mapping.InternalPort, mapping.ExternalPort, mapping.NATType, forwardedCandidate.Priority())
 
 	go func() {
-		if err := w.signaler.SignalICECandidate(forwardedCandidate, w.key); err != nil {
+		if err := w.signaler.SignalICECandidate(forwardedCandidate, w.config.Key); err != nil {
 			w.log.Errorf("signal port-forwarded candidate: %v", err)
 		}
 	}()
@@ -438,7 +415,7 @@ func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
 
 // createForwardedCandidate creates a new server reflexive candidate with the forwarded port.
 // It uses the NAT gateway's external IP with the forwarded port.
-func (w *ICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *portforward.Mapping) (ice.Candidate, error) {
+func (w *WorkerICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *portforward.Mapping) (ice.Candidate, error) {
 	var externalIP string
 	if mapping.ExternalIP != nil && !mapping.ExternalIP.IsUnspecified() {
 		externalIP = mapping.ExternalIP.String()
@@ -483,9 +460,9 @@ func (w *ICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *po
 	return candidate, nil
 }
 
-func (w *ICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2 ice.Candidate) {
+func (w *WorkerICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2 ice.Candidate) {
 	w.log.Debugf("selected candidate pair [local <-> remote] -> [%s <-> %s], peer %s", c1.String(), c2.String(),
-		w.key)
+		w.config.Key)
 
 	pairStat, ok := agent.GetSelectedCandidatePairStats()
 	if !ok {
@@ -494,14 +471,14 @@ func (w *ICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2
 	}
 
 	duration := time.Duration(pairStat.CurrentRoundTripTime * float64(time.Second))
-	if err := w.statusRecorder.UpdateLatency(w.key, duration); err != nil {
+	if err := w.statusRecorder.UpdateLatency(w.config.Key, duration); err != nil {
 		w.log.Debugf("failed to update latency for peer: %s", err)
 		return
 	}
 }
 
-func (w *ICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
-	sessionID := w.getSessionID()
+func (w *WorkerICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
+	sessionID := w.SessionID()
 	stats := agent.GetCandidatePairsStats()
 	localCandidates, _ := agent.GetLocalCandidates()
 	remoteCandidates, _ := agent.GetRemoteCandidates()
@@ -531,44 +508,32 @@ func (w *ICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
 	}
 }
 
-func (w *ICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dialerCancel context.CancelFunc) func(ice.ConnectionState) {
-	// per-agent state; pion delivers callbacks of one agent sequentially
-	var connected bool
+func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dialerCancel context.CancelFunc) func(ice.ConnectionState) {
 	return func(state ice.ConnectionState) {
 		w.log.Debugf("ICE ConnectionState has changed to %s", state.String())
 		switch state {
 		case ice.ConnectionStateConnected:
-			connected = true
+			w.lastKnownState = ice.ConnectionStateConnected
 			w.logSuccessfulPaths(agent)
+			return
 		case ice.ConnectionStateFailed, ice.ConnectionStateDisconnected, ice.ConnectionStateClosed:
 			// ice.ConnectionStateClosed happens when we recreate the agent. For the P2P to TURN switch important to
 			// notify the conn.onICEStateDisconnected changes to update the current used priority
 
 			sessionChanged := w.closeAgent(agent, dialerCancel)
 
-			if !connected {
-				return
+			if w.lastKnownState == ice.ConnectionStateConnected {
+				w.lastKnownState = ice.ConnectionStateDisconnected
+				w.conn.onICEStateDisconnected(sessionChanged)
 			}
-			connected = false
-
-			w.muxAgent.Lock()
-			stale := w.connectedAgent != agent
-			if !stale {
-				w.connectedAgent = nil
-			}
-			w.muxAgent.Unlock()
-
-			if stale {
-				w.log.Debugf("suppress disconnected event of replaced ICE agent")
-				return
-			}
-			w.onStatusDisconnect(sessionChanged)
+		default:
+			return
 		}
 	}
 }
 
-func (w *ICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *signaling.OfferAnswer) (*ice.Conn, error) {
-	if w.isController {
+func (w *WorkerICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (*ice.Conn, error) {
+	if isController(w.config) {
 		return agent.Dial(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
 	} else {
 		return agent.Accept(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
@@ -630,10 +595,10 @@ func isRelayed(pair *ice.CandidatePair) bool {
 	return false
 }
 
-func selectedPriority(pair *ice.CandidatePair) ConnPriority {
+func selectedPriority(pair *ice.CandidatePair) conntype.ConnPriority {
 	if isRelayed(pair) {
-		return ICETurn
+		return conntype.ICETurn
 	} else {
-		return ICEP2P
+		return conntype.ICEP2P
 	}
 }

client/internal/peer/worker_relay.go

@@ -1,4 +1,4 @@
-package worker
+package peer
 
 import (
 	"context"
@@ -10,23 +10,22 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
 
 type RelayConnInfo struct {
-	RelayedConn     net.Conn
-	RosenpassPubKey []byte
-	RosenpassAddr   string
+	relayedConn     net.Conn
+	rosenpassPubKey []byte
+	rosenpassAddr   string
 }
 
 type WorkerRelay struct {
-	log            *log.Entry
-	key            string
-	isController   bool
-	onConnReady    func(RelayConnInfo)
-	onDisconnected func()
-	relayManager   *relayClient.Manager
+	peerCtx      context.Context
+	log          *log.Entry
+	isController bool
+	config       ConnConfig
+	conn         *Conn
+	relayManager *relayClient.Manager
 
 	relayedConn net.Conn
 	relayLock   sync.Mutex
@@ -34,19 +33,19 @@ type WorkerRelay struct {
 	relaySupportedOnRemotePeer atomic.Bool
 }
 
-func NewWorkerRelay(log *log.Entry, key string, isController bool, onConnReady func(RelayConnInfo), onDisconnected func(), relayManager *relayClient.Manager) *WorkerRelay {
+func NewWorkerRelay(ctx context.Context, log *log.Entry, ctrl bool, config ConnConfig, conn *Conn, relayManager *relayClient.Manager) *WorkerRelay {
 	r := &WorkerRelay{
-		log:            log,
-		key:            key,
-		isController:   isController,
-		onConnReady:    onConnReady,
-		onDisconnected: onDisconnected,
-		relayManager:   relayManager,
+		peerCtx:      ctx,
+		log:          log,
+		isController: ctrl,
+		config:       config,
+		conn:         conn,
+		relayManager: relayManager,
 	}
 	return r
 }
 
-func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	if !w.isRelaySupported(remoteOfferAnswer) {
 		w.log.Infof("Relay is not supported by remote peer")
 		w.relaySupportedOnRemotePeer.Store(false)
@@ -67,7 +66,7 @@ func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signali
 		serverIP = remoteOfferAnswer.RelaySrvIP
 	}
 
-	relayedConn, err := w.relayManager.OpenConn(ctx, srv, w.key, serverIP)
+	relayedConn, err := w.relayManager.OpenConn(w.peerCtx, srv, w.config.Key, serverIP)
 	if err != nil {
 		if errors.Is(err, relayClient.ErrConnAlreadyExists) {
 			w.log.Debugf("handled offer by reusing existing relay connection")
@@ -89,10 +88,10 @@ func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signali
 	}
 
 	w.log.Debugf("peer conn opened via Relay: %s", srv)
-	w.onConnReady(RelayConnInfo{
-		RelayedConn:     relayedConn,
-		RosenpassPubKey: remoteOfferAnswer.RosenpassPubKey,
-		RosenpassAddr:   remoteOfferAnswer.RosenpassAddr,
+	go w.conn.onRelayConnectionIsReady(RelayConnInfo{
+		relayedConn:     relayedConn,
+		rosenpassPubKey: remoteOfferAnswer.RosenpassPubKey,
+		rosenpassAddr:   remoteOfferAnswer.RosenpassAddr,
 	})
 }
 
@@ -120,7 +119,7 @@ func (w *WorkerRelay) CloseConn() {
 	}
 }
 
-func (w *WorkerRelay) isRelaySupported(answer *signaling.OfferAnswer) bool {
+func (w *WorkerRelay) isRelaySupported(answer *OfferAnswer) bool {
 	if !w.relayManager.HasRelayAddress() {
 		return false
 	}
@@ -135,5 +134,5 @@ func (w *WorkerRelay) preferredRelayServer(myRelayAddress, remoteRelayAddress st
 }
 
 func (w *WorkerRelay) onRelayClientDisconnected() {
-	w.onDisconnected()
+	go w.conn.onRelayDisconnected()
 }

client/internal/rosenpass/cache_test.go

@@ -0,0 +1,62 @@
+package rosenpass
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func newCacheTestManager(spk []byte) *Manager {
+	return &Manager{
+		spk:               spk,
+		remotePubKeys:     make(map[string][]byte),
+		remoteHasLocalKey: make(map[string]bool),
+	}
+}
+
+func TestResolveRemotePubKey(t *testing.T) {
+	m := newCacheTestManager([]byte{0x01, 0x02})
+	full := bytes.Repeat([]byte{0xAB}, 64)
+
+	// a received full key is cached and returned
+	require.Equal(t, full, m.ResolveRemotePubKey("peerA", full, nil))
+
+	// a later hash-only message resolves from the cache
+	require.Equal(t, full, m.ResolveRemotePubKey("peerA", nil, rawRosenpassKeyHash(full)))
+
+	// hash mismatch is a cache miss
+	require.Nil(t, m.ResolveRemotePubKey("peerA", nil, bytes.Repeat([]byte{0x01}, 32)))
+
+	// no key and no hash (remote without Rosenpass) resolves to nil
+	require.Nil(t, m.ResolveRemotePubKey("peerB", nil, nil))
+}
+
+func TestRemotePubKeyAck(t *testing.T) {
+	m := newCacheTestManager([]byte{0x01})
+
+	// unknown peer -> no ack (signals "send me the full key")
+	require.Nil(t, m.RemotePubKeyAck("peerA"))
+
+	full := bytes.Repeat([]byte{0x09}, 48)
+	m.ResolveRemotePubKey("peerA", full, nil)
+	require.Equal(t, rawRosenpassKeyHash(full), m.RemotePubKeyAck("peerA"))
+}
+
+func TestSetRemoteAckAndRemoteHasLocalKey(t *testing.T) {
+	m := newCacheTestManager(bytes.Repeat([]byte{0x07}, 100))
+
+	require.False(t, m.RemoteHasLocalKey("peerA"))
+
+	// an ack matching our own key hash marks the peer as holding our key
+	m.SetRemoteAck("peerA", m.LocalPubKeyHash())
+	require.True(t, m.RemoteHasLocalKey("peerA"))
+
+	// empty ack clears it
+	m.SetRemoteAck("peerA", nil)
+	require.False(t, m.RemoteHasLocalKey("peerA"))
+
+	// a non-matching ack does not count
+	m.SetRemoteAck("peerA", bytes.Repeat([]byte{0x01}, 32))
+	require.False(t, m.RemoteHasLocalKey("peerA"))
+}

client/internal/rosenpass/manager.go

@@ -8,6 +8,7 @@ import (
 	"log/slog"
 	"net"
 	"os"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
@@ -28,6 +29,11 @@ func hashRosenpassKey(key []byte) string {
 	return hex.EncodeToString(hasher.Sum(nil))
 }
 
+func rawRosenpassKeyHash(key []byte) []byte {
+	sum := sha256.Sum256(key)
+	return sum[:]
+}
+
 // rpServer is the subset of rp.Server used by Manager. Defined as an interface
 // so tests can substitute a mock without spinning up a real UDP server.
 type rpServer interface {
@@ -50,12 +56,29 @@ type Manager struct {
 	lock         sync.Mutex
 	port         int
 	wgIface      PresharedKeySetter
+
+	// remotePubKeys caches remote peers' full Rosenpass public keys keyed by their
+	// WireGuard public key, so a peer that already sent us its (large) key over
+	// signalling need only send its hash on subsequent offers/answers. RAM only —
+	// never persisted (1000 peers x ~512KB would be ~512MB on disk).
+	remotePubKeys map[string][]byte
+	// remoteHasLocalKey tracks, per remote WireGuard key, whether that peer has
+	// acknowledged holding our current Rosenpass public key, letting us omit it.
+	remoteHasLocalKey map[string]bool
 }
 
 // NewManager creates a new Rosenpass manager. localWgKey is the local
-// WireGuard public key, used to derive the per-peer rendezvous key.
-func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtypes.Key) (*Manager, error) {
-	public, secret, err := rp.GenerateKeyPair()
+// WireGuard public key, used to derive the per-peer rendezvous key. When stateDir
+// is non-empty the static keypair is persisted under it and reused across
+// restarts, keeping the public key (and the fingerprint peers cache) stable;
+// an empty stateDir keeps the previous behaviour of an ephemeral per-run keypair.
+func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtypes.Key, stateDir string) (*Manager, error) {
+	var keyPath string
+	if stateDir != "" {
+		keyPath = filepath.Join(stateDir, keypairFileName)
+	}
+
+	public, secret, err := loadOrGenerateKeypair(keyPath)
 	if err != nil {
 		return nil, err
 	}
@@ -76,8 +99,10 @@ func NewManager(preSharedKey *wgtypes.Key, wgIfaceName string, localWgKey wgtype
 		// nil receiver in addPeer -> m.rpWgHandler.AddPeer. generateConfig will
 		// replace it with a fresh handler on each Run() to clear stale peer
 		// state from previous engine sessions.
-		rpWgHandler: NewNetbirdHandler((*[32]byte)(preSharedKey), localWgKey),
-		lock:        sync.Mutex{},
+		rpWgHandler:       NewNetbirdHandler((*[32]byte)(preSharedKey), localWgKey),
+		lock:              sync.Mutex{},
+		remotePubKeys:     make(map[string][]byte),
+		remoteHasLocalKey: make(map[string]bool),
 	}, nil
 }
 
@@ -90,6 +115,68 @@ func (m *Manager) GetAddress() *net.UDPAddr {
 	return &net.UDPAddr{Port: m.port}
 }
 
+// LocalPubKeyHash returns the raw SHA256 of the local Rosenpass public key. It is
+// advertised on every offer/answer so the remote peer can tell (via its cache)
+// whether it already holds our full key.
+func (m *Manager) LocalPubKeyHash() []byte {
+	return rawRosenpassKeyHash(m.spk)
+}
+
+// RemotePubKeyAck returns the SHA256 of the remote peer's cached public key, used
+// as the acknowledgement we send back. Nil means we do not hold the peer's key,
+// which signals the peer to include its full key next time.
+func (m *Manager) RemotePubKeyAck(remoteWgKey string) []byte {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+
+	key, ok := m.remotePubKeys[remoteWgKey]
+	if !ok {
+		return nil
+	}
+	return rawRosenpassKeyHash(key)
+}
+
+// RemoteHasLocalKey reports whether the remote peer acknowledged holding our
+// current public key, so we may omit the full key from the next offer/answer.
+func (m *Manager) RemoteHasLocalKey(remoteWgKey string) bool {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+
+	return m.remoteHasLocalKey[remoteWgKey]
+}
+
+// ResolveRemotePubKey reconciles the Rosenpass key material from a received
+// offer/answer: it caches a received full key, or — when only a hash was sent —
+// returns the cached key matching that hash. It returns nil when the remote peer
+// does not use Rosenpass (no key, no hash) or on a cache miss (hash sent but not
+// held); a miss self-heals because our resulting empty ack makes the peer resend
+// its full key.
+func (m *Manager) ResolveRemotePubKey(remoteWgKey string, full, hash []byte) []byte {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+
+	if len(full) > 0 {
+		m.remotePubKeys[remoteWgKey] = full
+		return full
+	}
+	if len(hash) == 0 {
+		return nil
+	}
+	if cached, ok := m.remotePubKeys[remoteWgKey]; ok && bytes.Equal(rawRosenpassKeyHash(cached), hash) {
+		return cached
+	}
+	return nil
+}
+
+// SetRemoteAck records whether the remote peer's acknowledgement matches our
+// current public key hash, i.e. whether it already holds our key.
+func (m *Manager) SetRemoteAck(remoteWgKey string, ack []byte) {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+
+	m.remoteHasLocalKey[remoteWgKey] = len(ack) > 0 && bytes.Equal(ack, rawRosenpassKeyHash(m.spk))
+}
+
 // addPeer adds a new peer to the Rosenpass server
 func (m *Manager) addPeer(rosenpassPubKey []byte, rosenpassAddr string, wireGuardIP string, wireGuardPubKey string) error {
 	// Defense in depth against issue #4341 (Android crash): if Run() has not

client/internal/rosenpass/manager_test.go

@@ -255,7 +255,7 @@ func TestAddPeer_NilServer_ReturnsErrorNoCrash(t *testing.T) {
 // issue #4341 cannot occur in the window between NewManager and Run().
 func TestNewManager_PreInitializesHandler(t *testing.T) {
 	psk := wgtypes.Key{}
-	m, err := NewManager(&psk, "wt0", wgtypes.Key{0x01})
+	m, err := NewManager(&psk, "wt0", wgtypes.Key{0x01}, "")
 	require.NoError(t, err)
 	require.NotNil(t, m.rpWgHandler, "rpWgHandler must be initialized in NewManager")
 }

client/internal/rosenpass/persistence.go

@@ -0,0 +1,92 @@
+package rosenpass
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	rp "cunicu.li/go-rosenpass"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/util"
+)
+
+const (
+	// keypairFileName is the file, relative to the state directory, that holds
+	// the persisted local Rosenpass static keypair.
+	keypairFileName = "rosenpass_key.json"
+
+	// rpStaticPublicKeySize is the byte length of a Rosenpass (Classic McEliece)
+	// static public key as produced by the pinned go-rosenpass version. Used as a
+	// version-compatibility guard: a persisted key of any other size is treated as
+	// stale and regenerated instead of being fed to go-rosenpass (which would fail).
+	rpStaticPublicKeySize = 524160
+
+	// keypairFormatVersion is bumped whenever the on-disk representation changes so
+	// old files are discarded and regenerated rather than misparsed.
+	keypairFormatVersion = 1
+)
+
+// persistedKeypair is the on-disk representation of the local Rosenpass static
+// keypair. Keys are stored raw (base64 via JSON) with the same restricted 0600
+// permission as the WireGuard private key and other client secrets.
+type persistedKeypair struct {
+	Version   int    `json:"version"`
+	PublicKey []byte `json:"public_key"`
+	SecretKey []byte `json:"secret_key"`
+}
+
+// loadOrGenerateKeypair returns a Rosenpass static keypair. When keyPath is set
+// and holds a valid persisted keypair it is reused, so the local public key —
+// and therefore the fingerprint advertised to remote peers over signalling —
+// stays stable across restarts. Otherwise a fresh keypair is generated and, when
+// keyPath is set, persisted for subsequent runs. A missing or corrupt file is not
+// fatal: it degrades to generating an ephemeral keypair, matching the pre-persistence
+// behaviour.
+func loadOrGenerateKeypair(keyPath string) (public []byte, secret []byte, err error) {
+	if keyPath != "" {
+		public, secret, err = loadKeypair(keyPath)
+		switch {
+		case err == nil:
+			return public, secret, nil
+		case os.IsNotExist(err):
+			// first run for this state dir; fall through to generate
+		default:
+			log.Warnf("failed to load persisted rosenpass keypair, generating a new one: %v", err)
+		}
+	}
+
+	pub, sec, err := rp.GenerateKeyPair()
+	if err != nil {
+		return nil, nil, fmt.Errorf("generate rosenpass key pair: %w", err)
+	}
+
+	if keyPath != "" {
+		if err := saveKeypair(keyPath, pub, sec); err != nil {
+			log.Warnf("failed to persist rosenpass keypair, key will be regenerated on next restart: %v", err)
+		}
+	}
+
+	return pub, sec, nil
+}
+
+func loadKeypair(keyPath string) ([]byte, []byte, error) {
+	var kp persistedKeypair
+	if _, err := util.ReadJson(keyPath, &kp); err != nil {
+		return nil, nil, err
+	}
+
+	if kp.Version != keypairFormatVersion || len(kp.PublicKey) != rpStaticPublicKeySize || len(kp.SecretKey) == 0 {
+		return nil, nil, fmt.Errorf("persisted rosenpass keypair is incompatible (version %d, public %d bytes, secret %d bytes)", kp.Version, len(kp.PublicKey), len(kp.SecretKey))
+	}
+
+	return kp.PublicKey, kp.SecretKey, nil
+}
+
+func saveKeypair(keyPath string, public, secret []byte) error {
+	return util.WriteJsonWithRestrictedPermission(context.Background(), keyPath, persistedKeypair{
+		Version:   keypairFormatVersion,
+		PublicKey: public,
+		SecretKey: secret,
+	})
+}

client/internal/rosenpass/persistence_test.go

@@ -0,0 +1,66 @@
+package rosenpass
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLoadOrGenerateKeypair_EphemeralWhenNoPath(t *testing.T) {
+	pub, sec, err := loadOrGenerateKeypair("")
+	require.NoError(t, err)
+	require.Len(t, pub, rpStaticPublicKeySize)
+	require.NotEmpty(t, sec)
+}
+
+func TestLoadOrGenerateKeypair_PersistsAndReloads(t *testing.T) {
+	keyPath := filepath.Join(t.TempDir(), keypairFileName)
+
+	pub1, sec1, err := loadOrGenerateKeypair(keyPath)
+	require.NoError(t, err)
+
+	info, err := os.Stat(keyPath)
+	require.NoError(t, err, "keypair file must be written")
+	require.Equal(t, os.FileMode(0600), info.Mode().Perm(), "keypair file must be 0600")
+
+	pub2, sec2, err := loadOrGenerateKeypair(keyPath)
+	require.NoError(t, err)
+	require.True(t, bytes.Equal(pub1, pub2), "public key must be stable across reloads")
+	require.True(t, bytes.Equal(sec1, sec2), "secret key must be stable across reloads")
+}
+
+func TestLoadOrGenerateKeypair_RegeneratesOnCorruptFile(t *testing.T) {
+	keyPath := filepath.Join(t.TempDir(), keypairFileName)
+	require.NoError(t, os.WriteFile(keyPath, []byte("not json"), 0600))
+
+	pub, sec, err := loadOrGenerateKeypair(keyPath)
+	require.NoError(t, err)
+	require.Len(t, pub, rpStaticPublicKeySize)
+	require.NotEmpty(t, sec)
+
+	// the corrupt file must have been overwritten with a valid, reloadable keypair
+	pub2, _, err := loadOrGenerateKeypair(keyPath)
+	require.NoError(t, err)
+	require.True(t, bytes.Equal(pub, pub2))
+}
+
+func TestLoadOrGenerateKeypair_RegeneratesOnVersionMismatch(t *testing.T) {
+	keyPath := filepath.Join(t.TempDir(), keypairFileName)
+
+	pub1, _, err := loadOrGenerateKeypair(keyPath)
+	require.NoError(t, err)
+
+	// rewrite with a bumped/unknown format version -> must be discarded
+	bs, err := json.Marshal(persistedKeypair{Version: keypairFormatVersion + 1, PublicKey: pub1, SecretKey: []byte{0x01}})
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(keyPath, bs, 0600))
+
+	pub2, sec2, err := loadOrGenerateKeypair(keyPath)
+	require.NoError(t, err)
+	require.Len(t, pub2, rpStaticPublicKeySize)
+	require.NotEmpty(t, sec2)
+}

client/mdm/canonical_loaders.go

@@ -22,6 +22,7 @@ var allKeys = []string{
 	KeyDisableMetricsCollection,
 	KeyAllowServerSSH,
 	KeyDisableAutoConnect,
+	KeyDisableAutostart,
 	KeyPreSharedKey,
 	KeyRosenpassEnabled,
 	KeyRosenpassPermissive,

client/mdm/policy.go

@@ -20,10 +20,10 @@ import (
 // names (lowerCamelCase) so the daemon can map a Policy key directly to a
 // configuration field.
 const (
-	KeyManagementURL            = "managementURL"
-	KeyDisableUpdateSettings    = "disableUpdateSettings"
-	KeyDisableProfiles          = "disableProfiles"
-	KeyDisableNetworks          = "disableNetworks"
+	KeyManagementURL         = "managementURL"
+	KeyDisableUpdateSettings = "disableUpdateSettings"
+	KeyDisableProfiles       = "disableProfiles"
+	KeyDisableNetworks       = "disableNetworks"
 	// KeyDisableAdvancedView gates the advanced-view section in the
 	// upcoming UI revision. UI-only: NOT stored on Config, not
 	// applied by applyMDMPolicy, not rejectable via SetConfig. The
@@ -37,10 +37,16 @@ const (
 	KeyDisableMetricsCollection = "disableMetricsCollection"
 	KeyAllowServerSSH           = "allowServerSSH"
 	KeyDisableAutoConnect       = "disableAutoConnect"
-	KeyPreSharedKey             = "preSharedKey"
-	KeyRosenpassEnabled         = "rosenpassEnabled"
-	KeyRosenpassPermissive      = "rosenpassPermissive"
-	KeyWireguardPort            = "wireguardPort"
+	// KeyDisableAutostart suppresses the GUI's fresh-install
+	// launch-on-login default and marks the Settings toggle as
+	// MDM-managed. UI-only: NOT stored on Config and not applied by
+	// applyMDMPolicy; the GUI reads it directly and it appears in
+	// GetConfigResponse.mDMManagedFields when set.
+	KeyDisableAutostart    = "disableAutostart"
+	KeyPreSharedKey        = "preSharedKey"
+	KeyRosenpassEnabled    = "rosenpassEnabled"
+	KeyRosenpassPermissive = "rosenpassPermissive"
+	KeyWireguardPort       = "wireguardPort"
 
 	// Split tunnel is modeled as a single conceptual policy with two
 	// registry/plist values. KeySplitTunnelMode is the discriminator

client/server/server.go

@@ -181,7 +181,7 @@ func (s *Server) Start() error {
 		log.Warnf("failed to redirect stderr: %v", err)
 	}
 
-	if err := restoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 
@@ -551,7 +551,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.actCancel = cancel
 	s.mutex.Unlock()
 
-	if err := restoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 
@@ -858,7 +858,7 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 
 		return s.waitForUp(callerCtx)
 	}
-	if err := restoreResidualState(callerCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := RestoreResidualState(callerCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 

client/server/state.go

@@ -46,7 +46,7 @@ func (s *Server) CleanState(ctx context.Context, req *proto.CleanStateRequest) (
 
 	if req.All {
 		// Reuse existing cleanup logic for all states
-		if err := restoreResidualState(ctx, statePath); err != nil {
+		if err := RestoreResidualState(ctx, statePath); err != nil {
 			return nil, status.Errorf(codes.Internal, "failed to clean all states: %v", err)
 		}
 
@@ -113,9 +113,9 @@ func (s *Server) DeleteState(ctx context.Context, req *proto.DeleteStateRequest)
 	}, nil
 }
 
-// restoreResidualState checks if the client was not shut down in a clean way and restores residual if required.
+// RestoreResidualState checks if the client was not shut down in a clean way and restores residual if required.
 // Otherwise, we might not be able to connect to the management server to retrieve new config.
-func restoreResidualState(ctx context.Context, statePath string) error {
+func RestoreResidualState(ctx context.Context, statePath string) error {
 	if statePath == "" {
 		return nil
 	}

client/status/status.go

@@ -746,6 +746,8 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
 	}
 
+	pbFullStatus.Events = fullStatus.Events
+
 	return &pbFullStatus
 }
 

client/ui/autostart_default.go

@@ -0,0 +1,107 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// autostartDefaultState carries the guard inputs of the one-time autostart
+// default decision so the decision itself stays a pure, testable function.
+type autostartDefaultState struct {
+	supported    bool
+	mdmDisabled  bool
+	priorInstall bool
+}
+
+// shouldEnableAutostartDefault applies the first-run guards in order and
+// returns whether autostart may be enabled, plus the reason when it may not.
+func shouldEnableAutostartDefault(s autostartDefaultState) (bool, string) {
+	switch {
+	case !s.supported:
+		return false, "autostart not supported on this platform"
+	case s.mdmDisabled:
+		return false, "autostart disabled by MDM policy"
+	case s.priorInstall:
+		return false, "existing NetBird installation"
+	}
+	return true, ""
+}
+
+// autostartDisabledByMDM reports whether the MDM policy manages the
+// disableAutostart key in a way that must suppress the default. An
+// unparseable managed value is treated as disabled to stay on the safe side.
+func autostartDisabledByMDM(policy *mdm.Policy) bool {
+	if !policy.HasKey(mdm.KeyDisableAutostart) {
+		return false
+	}
+	disabled, ok := policy.GetBool(mdm.KeyDisableAutostart)
+	return !ok || disabled
+}
+
+// netbirdFootprintExists reports whether the machine already carries NetBird
+// daemon config or state, meaning this is not a genuinely fresh install. It is
+// the update-safety gate for the autostart default: upgrading users always
+// have a footprint, so an update can never trigger a login-item write.
+func netbirdFootprintExists() bool {
+	candidates := []string{
+		profilemanager.DefaultConfigPath,
+		filepath.Join(profilemanager.DefaultConfigPathDir, "config.json"),
+		filepath.Join(profilemanager.DefaultConfigPathDir, "state.json"),
+	}
+	for _, path := range candidates {
+		if path != "" && fileExists(path) {
+			return true
+		}
+	}
+	return false
+}
+
+// applyAutostartDefault runs the one-time launch-on-login default for genuinely
+// fresh installs. The autostartInitialized marker is persisted before any
+// enable attempt so a crash mid-flow degrades to "never enabled" instead of
+// retrying login-item writes on every launch. A user's later disable in
+// Settings is never overridden: the marker guarantees at-most-once, ever.
+func applyAutostartDefault(ctx context.Context, autostart *services.Autostart, prefs *preferences.Store, prefsFileExisted bool) {
+	priorFootprint := netbirdFootprintExists() || prefsFileExisted
+
+	if prefs.Get().AutostartInitialized {
+		return
+	}
+	if err := prefs.SetAutostartInitialized(true); err != nil {
+		log.Warnf("persist autostart marker, skipping autostart default: %v", err)
+		return
+	}
+
+	state := autostartDefaultState{
+		supported:    autostart.Supported(ctx),
+		mdmDisabled:  autostartDisabledByMDM(mdm.LoadPolicy()),
+		priorInstall: priorFootprint,
+	}
+	enable, reason := shouldEnableAutostartDefault(state)
+	if !enable {
+		log.Debugf("skipping autostart default: %s", reason)
+		return
+	}
+
+	if err := autostart.SetEnabled(ctx, true); err != nil {
+		log.Warnf("enable autostart on fresh install: %v", err)
+		return
+	}
+	log.Info("autostart enabled by default on fresh install")
+}
+
+// fileExists reports whether path exists.
+func fileExists(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}

client/ui/autostart_default_test.go

@@ -0,0 +1,125 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+func TestShouldEnableAutostartDefault(t *testing.T) {
+	allPass := autostartDefaultState{
+		supported:    true,
+		mdmDisabled:  false,
+		priorInstall: false,
+	}
+
+	tests := []struct {
+		name       string
+		mutate     func(*autostartDefaultState)
+		wantEnable bool
+		wantReason string
+	}{
+		{
+			name:       "fresh install with all guards passing enables",
+			mutate:     func(*autostartDefaultState) {},
+			wantEnable: true,
+		},
+		{
+			name:       "unsupported platform skips",
+			mutate:     func(s *autostartDefaultState) { s.supported = false },
+			wantReason: "autostart not supported on this platform",
+		},
+		{
+			name:       "MDM disable skips",
+			mutate:     func(s *autostartDefaultState) { s.mdmDisabled = true },
+			wantReason: "autostart disabled by MDM policy",
+		},
+		{
+			name:       "existing installation (upgrade) skips",
+			mutate:     func(s *autostartDefaultState) { s.priorInstall = true },
+			wantReason: "existing NetBird installation",
+		},
+		{
+			name: "unsupported wins over every other guard",
+			mutate: func(s *autostartDefaultState) {
+				s.supported = false
+				s.mdmDisabled = true
+				s.priorInstall = true
+			},
+			wantReason: "autostart not supported on this platform",
+		},
+		{
+			name: "MDM disable wins over prior install",
+			mutate: func(s *autostartDefaultState) {
+				s.mdmDisabled = true
+				s.priorInstall = true
+			},
+			wantReason: "autostart disabled by MDM policy",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			state := allPass
+			tc.mutate(&state)
+			enable, reason := shouldEnableAutostartDefault(state)
+			assert.Equal(t, tc.wantEnable, enable, "enable decision should match for state %+v", state)
+			assert.Equal(t, tc.wantReason, reason, "skip reason should identify the failing guard")
+		})
+	}
+}
+
+func TestAutostartDisabledByMDM(t *testing.T) {
+	tests := []struct {
+		name   string
+		values map[string]any
+		want   bool
+	}{
+		{
+			name:   "empty policy does not disable",
+			values: nil,
+			want:   false,
+		},
+		{
+			name:   "unrelated managed keys do not disable",
+			values: map[string]any{mdm.KeyDisableAutoConnect: true},
+			want:   false,
+		},
+		{
+			name:   "disableAutostart true disables",
+			values: map[string]any{mdm.KeyDisableAutostart: true},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart registry DWORD 1 disables",
+			values: map[string]any{mdm.KeyDisableAutostart: int64(1)},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart string true disables",
+			values: map[string]any{mdm.KeyDisableAutostart: "true"},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart explicit false allows",
+			values: map[string]any{mdm.KeyDisableAutostart: false},
+			want:   false,
+		},
+		{
+			name:   "unparseable managed value is treated as disabled",
+			values: map[string]any{mdm.KeyDisableAutostart: "not-a-bool"},
+			want:   true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := autostartDisabledByMDM(mdm.NewPolicy(tc.values))
+			assert.Equal(t, tc.want, got, "MDM disable decision should match for values %v", tc.values)
+		})
+	}
+}

client/ui/frontend/src/lib/connection.ts

@@ -51,7 +51,14 @@ async function runSsoLogin(
     if (uri) await openBrowserLoginUri(uri);
 
     const cancelPromise = buildSsoCancelPromise(state, signal);
-    const waitPromise = Connection.WaitSSOLogin({ userCode: result.userCode, hostname: "" });
+    // Combine wait + up in Go so the connection comes up the moment SSO
+    // completes. During SSO the tray window is hidden and the webview is
+    // suspended, so a frontend-driven Up (a promise continuation) would not
+    // fire until the user woke the window (e.g. hovering the tray icon).
+    const waitPromise = Connection.WaitSSOLoginAndUp(
+        { userCode: result.userCode, hostname: "" },
+        { profileName: "", username: "" },
+    );
 
     try {
         await Promise.race([waitPromise, cancelPromise]);
@@ -89,13 +96,13 @@ export async function startConnection(onSettled?: () => void, signal?: AbortSign
         if (signal?.aborted) state.cancelled = true;
 
         if (!state.cancelled && result.needsSsoLogin) {
+            // runSsoLogin brings the connection up in Go once SSO completes.
             await runSsoLogin(result, state, signal);
-        }
-
-        if (!state.cancelled && signal?.aborted) state.cancelled = true;
-
-        if (!state.cancelled) {
-            await Connection.Up({ profileName: "", username: "" });
+        } else {
+            if (!state.cancelled && signal?.aborted) state.cancelled = true;
+            if (!state.cancelled) {
+                await Connection.Up({ profileName: "", username: "" });
+            }
         }
     } catch (e) {
         WindowManager.CloseBrowserLogin().catch(console.error);

client/ui/main.go

@@ -197,6 +197,9 @@ func main() {
 		// daemon may keep the main window from showing, so the OS toast is the
 		// only reliable signal the user gets.
 		go notifyIfDaemonOutdated(compat, notifier, localizer)
+		// One-time launch-on-login default for fresh installs; gated by the
+		// NetBird footprint check, MDM policy, and the persisted marker.
+		go applyAutostartDefault(context.Background(), services.NewAutostart(app.Autostart), prefStore, prefStore.ExistedAtLoad())
 	})
 
 	if err := app.Run(); err != nil {

client/ui/preferences/store.go

@@ -54,6 +54,10 @@ type UIPreferences struct {
 	Language            i18n.LanguageCode `json:"language"`
 	ViewMode            ViewMode          `json:"viewMode"`
 	OnboardingCompleted bool              `json:"onboardingCompleted"`
+	// AutostartInitialized records that the one-time autostart default
+	// decision has run for this OS user. It only ever transitions to true
+	// and is never reset, so the default-on flow runs at most once, ever.
+	AutostartInitialized bool `json:"autostartInitialized"`
 }
 
 // LanguageValidator rejects SetLanguage inputs with no shipped bundle.
@@ -72,8 +76,9 @@ type Emitter interface {
 type Store struct {
 	path string
 
-	mu      sync.RWMutex
-	current UIPreferences
+	mu            sync.RWMutex
+	current       UIPreferences
+	existedAtLoad bool
 
 	subsMu sync.Mutex
 	subs   []chan UIPreferences
@@ -157,6 +162,27 @@ func (s *Store) SetOnboardingCompleted(done bool) error {
 	return nil
 }
 
+// SetAutostartInitialized persists the one-time autostart decision marker.
+// No-op if unchanged.
+func (s *Store) SetAutostartInitialized(done bool) error {
+	s.mu.Lock()
+	if s.current.AutostartInitialized == done {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.AutostartInitialized = done
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
 // SetLanguage validates, persists, and broadcasts. No-op if unchanged.
 func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
 	if lang == "" {
@@ -206,13 +232,29 @@ func (s *Store) Subscribe() (<-chan UIPreferences, func()) {
 	return ch, unsubscribe
 }
 
+// ExistedAtLoad reports whether the backing preferences file was present on
+// disk when the store loaded. It distinguishes a user who ran a prior GUI
+// version from a brand-new OS user with no preferences yet.
+func (s *Store) ExistedAtLoad() bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.existedAtLoad
+}
+
 // load reads the file into current. A missing file is not an error (the
 // in-memory default stands); malformed contents return an error.
 func (s *Store) load() error {
-	if _, err := os.Stat(s.path); errors.Is(err, os.ErrNotExist) {
-		return nil
+	if _, err := os.Stat(s.path); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil
+		}
+		return fmt.Errorf("stat preferences: %w", err)
 	}
 
+	s.mu.Lock()
+	s.existedAtLoad = true
+	s.mu.Unlock()
+
 	var loaded UIPreferences
 	if _, err := util.ReadJson(s.path, &loaded); err != nil {
 		return err

client/ui/preferences/store_test.go

@@ -215,6 +215,46 @@ func TestStore_FileShapeIsJSON(t *testing.T) {
 	assert.Equal(t, i18n.LanguageCode("hu"), parsed.Language)
 }
 
+func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
+	withTempConfigDir(t)
+	emitter := &recordingEmitter{}
+	s, err := NewStore(nil, emitter)
+	require.NoError(t, err)
+
+	assert.False(t, s.Get().AutostartInitialized, "marker must default to false when no file is on disk")
+
+	require.NoError(t, s.SetAutostartInitialized(true))
+	assert.True(t, s.Get().AutostartInitialized, "Get should reflect the persisted marker")
+	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first marker write should broadcast")
+
+	// Re-setting the same value must be a no-op: no disk write, no broadcast.
+	require.NoError(t, s.SetAutostartInitialized(true))
+	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent marker write should not broadcast again")
+
+	// A fresh Store (new GUI launch) must see the marker so the autostart
+	// default decision never runs twice.
+	reloaded, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
+}
+
+func TestStore_ExistedAtLoad(t *testing.T) {
+	withTempConfigDir(t)
+
+	// Brand-new OS user: no preferences file on disk yet.
+	fresh, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.False(t, fresh.ExistedAtLoad(), "ExistedAtLoad must be false when no file is on disk")
+
+	// Persisting a value writes the file to disk.
+	require.NoError(t, fresh.SetLanguage("en"))
+
+	// A subsequent GUI launch reopens the now-present file.
+	reopened, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.True(t, reopened.ExistedAtLoad(), "ExistedAtLoad must be true after the store has persisted and is reopened")
+}
+
 func TestStore_ErrUnsupportedSentinel(t *testing.T) {
 	// Verifies callers can match on the sentinel error rather than parsing
 	// strings — protects against accidental %v -> %w changes that would

client/ui/services/connection.go

@@ -35,7 +35,7 @@ type LoginResult struct {
 	VerificationURIComplete string `json:"verificationUriComplete"`
 }
 
-// WaitSSOParams are the inputs to WaitSSOLogin.
+// WaitSSOParams are the inputs to waitSSOLogin.
 type WaitSSOParams struct {
 	UserCode string `json:"userCode"`
 	Hostname string `json:"hostname"`
@@ -125,23 +125,6 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	}, nil
 }
 
-func (s *Connection) WaitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return "", err
-	}
-	log.Infof("waiting for SSO login to complete")
-	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
-		UserCode: p.UserCode,
-		Hostname: p.Hostname,
-	})
-	if err != nil {
-		return "", s.classifyDaemonError(err)
-	}
-	log.Infof("SSO login completed, daemon reported success")
-	return resp.GetEmail(), nil
-}
-
 func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -162,6 +145,27 @@ func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	return nil
 }
 
+// WaitSSOLoginAndUp blocks until the SSO login completes and then brings the
+// connection up, both from the Go side. Keeping the post-login Up here rather
+// than as a frontend continuation is deliberate: during SSO the tray window is
+// hidden and the webview is suspended (macOS App Nap / hidden-window timer
+// throttling), so a frontend-driven Up would not run until the user woke the
+// window (e.g. by hovering the tray icon). Doing it in Go connects the moment
+// the daemon reports SSO success. Returns the authenticated user's email.
+func (s *Connection) WaitSSOLoginAndUp(ctx context.Context, wait WaitSSOParams, up UpParams) (string, error) {
+	email, err := s.waitSSOLogin(ctx, wait)
+	if err != nil {
+		return "", err
+	}
+	if err := ctx.Err(); err != nil {
+		return "", err
+	}
+	if err := s.Up(ctx, up); err != nil {
+		return "", err
+	}
+	return email, nil
+}
+
 func (s *Connection) Down(ctx context.Context) error {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -221,6 +225,26 @@ func (s *Connection) Logout(ctx context.Context, p LogoutParams) error {
 	return nil
 }
 
+// waitSSOLogin blocks until the daemon reports the SSO login result and returns
+// the authenticated user's email. It is unexported because the frontend drives
+// SSO through the exported WaitSSOLoginAndUp.
+func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	log.Infof("waiting for SSO login to complete")
+	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
+		UserCode: p.UserCode,
+		Hostname: p.Hostname,
+	})
+	if err != nil {
+		return "", s.classifyDaemonError(err)
+	}
+	log.Infof("SSO login completed, daemon reported success")
+	return resp.GetEmail(), nil
+}
+
 // classifyDaemonError maps a gRPC error to a localised ClientError.
 func (s *Connection) classifyDaemonError(err error) *ClientError {
 	return s.classifier.classify(err)

client/ui/services/settings.go

@@ -20,11 +20,12 @@ type MDMFields struct {
 	DisableServerRoutes      bool   `json:"disableServerRoutes"`
 	AllowServerSSH           *bool  `json:"allowServerSSH"`
 	DisableAutoConnect       bool   `json:"disableAutoConnect"`
+	DisableAutostart         bool   `json:"disableAutostart"`
 	BlockInbound             bool   `json:"blockInbound"`
 	DisableMetricsCollection bool   `json:"disableMetricsCollection"`
 	SplitTunnelMode          bool   `json:"splitTunnelMode"`
 	SplitTunnelApps          bool   `json:"splitTunnelApps"`
-	DisableAdvancedView bool `json:"disableAdvancedView"`
+	DisableAdvancedView      bool   `json:"disableAdvancedView"`
 }
 
 type Features struct {

e2e/agentnetwork/chat_test.go

@@ -91,7 +91,7 @@ func availableProviders() []providerCase {
 		if region == "" {
 			region = "us-east-1"
 		}
-		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: "us.anthropic.claude-haiku-4-5", kind: harness.WireMessages})
+		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: "us.anthropic.claude-haiku-4-5", kind: harness.WireBedrock})
 	}
 	return ps
 }
@@ -224,9 +224,12 @@ func TestProvidersMatrix(t *testing.T) {
 				var c int
 				var b string
 				var cerr error
-				if pc.kind == harness.WireVertex {
+				switch pc.kind {
+				case harness.WireVertex:
 					c, b, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model, "Reply with exactly: pong", sessionID)
-				} else {
+				case harness.WireBedrock:
+					c, b, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, pc.model, "Reply with exactly: pong", sessionID)
+				default:
 					c, b, cerr = cl.Chat(ctx, settings.Endpoint, proxyIP, pc.kind, pc.model, "Reply with exactly: pong", sessionID)
 				}
 				if cerr == nil {

e2e/agentnetwork/guardrail_test.go

@@ -0,0 +1,168 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// catalogModel returns the normalized catalog id the proxy stamps for a
+// path-routed provider's configured model — the form the guardrail allowlist is
+// compared against (region prefix / @version stripped).
+func catalogModel(pc providerCase) string {
+	switch pc.kind {
+	case harness.WireBedrock:
+		return strings.TrimPrefix(pc.model, "us.")
+	case harness.WireVertex:
+		return strings.SplitN(pc.model, "@", 2)[0]
+	default:
+		return pc.model
+	}
+}
+
+// disallowedModel returns a valid-shaped model id for the provider that is NOT
+// the configured/allowed one, so the guardrail must reject it before the
+// request ever reaches the upstream.
+func disallowedModel(pc providerCase) string {
+	switch pc.kind {
+	case harness.WireBedrock:
+		return "us.anthropic.claude-opus-4-8"
+	case harness.WireVertex:
+		return "claude-opus-4-8@20250101"
+	default:
+		return "unlisted-model"
+	}
+}
+
+// sendModel drives one request for the given model through the provider's native
+// wire shape and returns the HTTP status.
+func sendModel(ctx context.Context, t *testing.T, cl *harness.Client, endpoint, proxyIP string, pc providerCase, model string) int {
+	t.Helper()
+	var code int
+	var err error
+	switch pc.kind {
+	case harness.WireBedrock:
+		code, _, err = cl.Bedrock(ctx, endpoint, proxyIP, model, "Reply with exactly: pong", "")
+	case harness.WireVertex:
+		code, _, err = cl.Vertex(ctx, endpoint, proxyIP, pc.project, pc.region, model, "Reply with exactly: pong", "")
+	default:
+		code, _, err = cl.Chat(ctx, endpoint, proxyIP, pc.kind, model, "Reply with exactly: pong", "")
+	}
+	require.NoError(t, err, "request must reach the proxy for %s", pc.name)
+	return code
+}
+
+// TestModelAllowlistEnforced provisions a Model Allowlist guardrail limiting each
+// path-routed provider (Bedrock, Vertex) to its configured model, then drives
+// requests over the tunnel: the allowed model returns 200 while a model outside
+// the allowlist is denied 403 by the guardrail before it reaches the upstream.
+// This is the coverage missing for #6751 — the model for these providers travels
+// in the URL path, and the allowlist must be enforced there.
+func TestModelAllowlistEnforced(t *testing.T) {
+	var providers []providerCase
+	for _, pc := range availableProviders() {
+		if pc.kind == harness.WireBedrock || pc.kind == harness.WireVertex {
+			providers = append(providers, pc)
+		}
+	}
+	if len(providers) == 0 {
+		t.Skip("no path-routed provider keys set (AWS_BEARER_TOKEN_BEDROCK / GOOGLE_VERTEX_*); source ~/.llm-keys")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-allowlist"})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-allowlist-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+
+	// Providers with their configured (allowed) models; the first bootstraps the cluster.
+	ids := make([]string, 0, len(providers))
+	allowed := make([]string, 0, len(providers))
+	for i, pc := range providers {
+		req := providerRequest(pc)
+		if i == 0 {
+			req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+		}
+		prov, perr := srv.CreateProvider(ctx, req)
+		require.NoError(t, perr, "create provider %s", pc.name)
+		id := prov.Id
+		ids = append(ids, id)
+		allowed = append(allowed, catalogModel(pc))
+		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), id) })
+	}
+
+	// Guardrail allowlisting exactly the configured models.
+	var gr api.AgentNetworkGuardrailRequest
+	gr.Name = "e2e-allowlist"
+	gr.Checks.ModelAllowlist.Enabled = true
+	gr.Checks.ModelAllowlist.Models = allowed
+	guard, err := srv.CreateGuardrail(ctx, gr)
+	require.NoError(t, err, "create guardrail")
+	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
+
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-allowlist",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: ids,
+		GuardrailIds:           &[]string{guard.Id},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings for endpoint")
+	require.NotEmpty(t, settings.Endpoint, "agent-network endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-proxy-allowlist")
+	require.NoError(t, err, "mint proxy token via CLI")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
+
+	for _, pc := range providers {
+		pc := pc
+		t.Run(pc.name, func(t *testing.T) {
+			// The admin's allowlisted model is served end to end.
+			assert.Equal(t, 200, sendModel(ctx, t, cl, settings.Endpoint, proxyIP, pc, pc.model),
+				"allowlisted model must be permitted for %s", pc.name)
+			// A model outside the allowlist is rejected by the guardrail (before
+			// the upstream), regardless of whether it is a real catalog model.
+			assert.Equal(t, 403, sendModel(ctx, t, cl, settings.Endpoint, proxyIP, pc, disallowedModel(pc)),
+				"model outside the allowlist must be denied for %s", pc.name)
+		})
+	}
+}

e2e/harness/agentnetwork.go

@@ -107,6 +107,17 @@ func (c *Combined) DeletePolicy(ctx context.Context, id string) error {
 	return anDelete(ctx, c, "/api/agent-network/policies/"+id)
 }
 
+// CreateGuardrail creates an agent-network guardrail (e.g. a model allowlist)
+// that can then be attached to a policy via its GuardrailIds.
+func (c *Combined) CreateGuardrail(ctx context.Context, req api.AgentNetworkGuardrailRequest) (api.AgentNetworkGuardrail, error) {
+	return anRequest[api.AgentNetworkGuardrail](ctx, c, http.MethodPost, "/api/agent-network/guardrails", req)
+}
+
+// DeleteGuardrail removes a guardrail by id.
+func (c *Combined) DeleteGuardrail(ctx context.Context, id string) error {
+	return anDelete(ctx, c, "/api/agent-network/guardrails/"+id)
+}
+
 // GetSettings returns the account's agent-network settings row. It exists only
 // after the first provider create bootstraps it.
 func (c *Combined) GetSettings(ctx context.Context) (api.AgentNetworkSettings, error) {

e2e/harness/client.go

@@ -194,6 +194,11 @@ const (
 	// WireVertex is the Anthropic-on-Vertex rawPredict shape: the client posts
 	// the full Vertex model path and the proxy mints the SA OAuth token.
 	WireVertex = "vertex"
+	// WireBedrock is the native AWS Bedrock InvokeModel shape: the model id
+	// travels in the URL path (/model/{id}/invoke), not the body, so the proxy
+	// routes by path. This is what a Bedrock SDK client sends and the shape the
+	// model-allowlist guardrail must enforce.
+	WireBedrock = "bedrock"
 )
 
 // Chat issues a chat-completion POST to the agent-network endpoint over the
@@ -226,6 +231,17 @@ func (cl *Client) Vertex(ctx context.Context, endpoint, proxyIP, project, region
 	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
 }
 
+// Bedrock issues a native AWS Bedrock InvokeModel POST over the tunnel. The
+// model id is carried in the request path (/model/{id}/invoke), so the proxy
+// routes by path; the body uses the bedrock anthropic_version rather than a
+// model field. A non-empty sessionID is sent as the universal x-session-id
+// header the proxy records.
+func (cl *Client) Bedrock(ctx context.Context, endpoint, proxyIP, model, prompt, sessionID string) (int, string, error) {
+	path := "/model/" + model + "/invoke"
+	body := fmt.Sprintf(`{"anthropic_version":"bedrock-2023-05-31","max_tokens":64,"messages":[{"role":"user","content":%q}]}`, prompt)
+	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
+}
+
 // withSessionID appends the x-session-id header when sessionID is non-empty.
 func withSessionID(headers []string, sessionID string) []string {
 	if sessionID == "" {

management/internals/modules/peers/ephemeral/manager/ephemeral.go

@@ -215,7 +215,7 @@ func (e *EphemeralManager) cleanup(ctx context.Context) {
 	}
 
 	for accountID, peerIDs := range peerIDsPerAccount {
-		log.WithContext(ctx).Tracef("cleanup: deleting %d ephemeral peers for account %s", len(peerIDs), accountID)
+		log.WithContext(ctx).Debugf("cleanup: deleting %d ephemeral peers for account %s: %s", len(peerIDs), accountID, peerIDs)
 		err := e.peersManager.DeletePeers(ctx, accountID, peerIDs, activity.SystemInitiator, true)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to delete ephemeral peers: %s", err)

management/internals/modules/peers/manager.go

@@ -184,6 +184,8 @@ func (m *managerImpl) DeletePeers(ctx context.Context, accountID string, peerIDs
 				return err
 			}
 
+			log.WithContext(ctx).Debugf("DeletePeers: deleted peer %s", peerID)
+
 			if !(peer.ProxyMeta.Embedded || peer.Meta.KernelVersion == "wasm") {
 				eventsToStore = append(eventsToStore, func() {
 					m.accountManager.StoreEvent(ctx, userID, peer.ID, accountID, activity.PeerRemovedByUser, peer.EventMeta(dnsDomain))
@@ -224,30 +226,6 @@ func (m *managerImpl) CreateProxyPeer(ctx context.Context, accountID string, pee
 		return nil
 	}
 
-	// Dedupe stale embedded peer records for the same (account, cluster).
-	// The proxy generates a fresh WireGuard keypair on every startup
-	// (proxy/internal/roundtrip/netbird.go), so without this sweep the
-	// prior embedded peer would linger forever — holding its CGNAT IP
-	// allocation, polluting other peers' rosters, and (most visibly)
-	// leaving the synth DNS pointing at the dead address. The
-	// (account, cluster) tuple identifies "the embedded peer for this
-	// proxy instance at this cluster"; any record matching that tuple
-	// with a different pubkey is by definition stale and must go.
-	staleIDs, err := m.findStaleEmbeddedProxyPeers(ctx, accountID, cluster, peerKey)
-	if err != nil {
-		return fmt.Errorf("scan for stale embedded proxy peers: %w", err)
-	}
-	if len(staleIDs) > 0 {
-		// userID="" + checkConnected=false: the deletion is initiated
-		// by management itself on behalf of the freshly-registering
-		// proxy, not by an end user; the stale peer may still be
-		// marked Connected from its prior session, but its session is
-		// dead by definition (its key no longer exists).
-		if err := m.DeletePeers(ctx, accountID, staleIDs, "", false); err != nil {
-			return fmt.Errorf("delete stale embedded proxy peers %v: %w", staleIDs, err)
-		}
-	}
-
 	name := fmt.Sprintf("proxy-%s", xid.New().String())
 	newPeer := &peer.Peer{
 		Ephemeral: true,
@@ -273,29 +251,3 @@ func (m *managerImpl) CreateProxyPeer(ctx context.Context, accountID string, pee
 
 	return nil
 }
-
-// findStaleEmbeddedProxyPeers returns the peer IDs of embedded proxy peer
-// records in accountID that target the same cluster but carry a different
-// WireGuard pubkey than the freshly-registering one. Used by CreateProxyPeer
-// to garbage-collect stale records left behind when the proxy restarts with a
-// regenerated keypair.
-func (m *managerImpl) findStaleEmbeddedProxyPeers(ctx context.Context, accountID, cluster, newKey string) ([]string, error) {
-	account, err := m.store.GetAccount(ctx, accountID)
-	if err != nil {
-		return nil, err
-	}
-	var stale []string
-	for _, p := range account.Peers {
-		if p == nil || !p.ProxyMeta.Embedded {
-			continue
-		}
-		if p.ProxyMeta.Cluster != cluster {
-			continue
-		}
-		if p.Key == newKey {
-			continue
-		}
-		stale = append(stale, p.ID)
-	}
-	return stale, nil
-}

management/internals/shared/grpc/token_mgr.go

@@ -161,6 +161,8 @@ func (m *TimeBasedAuthSecretsManager) SetupRefresh(ctx context.Context, accountI
 		m.turnCancelMap[peerID] = turnCancel
 		go m.refreshTURNTokens(ctx, accountID, peerID, turnCancel)
 		log.WithContext(ctx).Debugf("starting TURN refresh for %s", peerID)
+	} else {
+		log.WithContext(ctx).Debugf("no TURN configuration, skipping TURN refresh for %s", peerID)
 	}
 
 	if m.relayCfg != nil {
@@ -168,6 +170,8 @@ func (m *TimeBasedAuthSecretsManager) SetupRefresh(ctx context.Context, accountI
 		m.relayCancelMap[peerID] = relayCancel
 		go m.refreshRelayTokens(ctx, accountID, peerID, relayCancel)
 		log.WithContext(ctx).Tracef("starting relay refresh for %s", peerID)
+	} else {
+		log.WithContext(ctx).Tracef("no relay configuration, skipping relay refresh for %s", peerID)
 	}
 }
 

management/main.go

@@ -1,19 +1,24 @@
 package main
 
 import (
-	"log"
 	"net/http"
 	// nolint:gosec
 	_ "net/http/pprof"
 	"os"
 
+	log "github.com/sirupsen/logrus"
+
 	"github.com/netbirdio/netbird/management/cmd"
 )
 
 func main() {
-	go func() {
-		log.Println(http.ListenAndServe("localhost:6060", nil))
-	}()
+	if pprofAddr := os.Getenv("NB_PPROF_ADDR"); pprofAddr != "" {
+		log.Infof("pprof enabled, listening on: %s", pprofAddr)
+		go func() {
+			log.Println(http.ListenAndServe(pprofAddr, nil))
+		}()
+	}
+
 	if err := cmd.Execute(); err != nil {
 		os.Exit(1)
 	}

management/server/agentnetwork_proxypeer_restart_test.go

@@ -1,199 +0,0 @@
-package server
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/peers"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
-	agenttypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/permissions"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// TestAgentNetwork_ProxyRestart_PropagatesNewPeerAndDropsStale is the no-mock
-// regression guard for the bug the user reported: restarting the proxy creates
-// a fresh embedded peer with a NEW WireGuard public key (the proxy generates
-// the keypair on every startup at proxy/internal/roundtrip/netbird.go:312).
-// The PRIOR embedded peer record is never deleted on management, so the
-// account accumulates a stale peer holding a stale CGNAT IP. Other peers
-// in the account either keep routing to the dead IP, or — if synth DNS
-// picks the wrong record — never see the new IP at all.
-//
-// What this test exercises (no mocks):
-//   - real SQLite test store
-//   - real DefaultAccountManager, network-map controller, peer-update channels
-//   - real peers.Manager.CreateProxyPeer path (the very method the proxy
-//     invokes over gRPC on every startup)
-//   - real agentnetwork.Manager + synth chain so the client receives a
-//     concrete DNS record that must point at the LATEST proxy peer.
-//
-// Pre-fix expected behavior (red): two embedded peers exist after the
-// "restart"; the synth DNS record points at the stale one; the client
-// receives an update reflecting the new peer but the old one lingers.
-// Post-fix expected behavior (green): exactly one embedded peer exists
-// after restart (with the new key) AND the client's network map carries
-// the synth DNS pointing at that new peer's CGNAT IP.
-func TestAgentNetwork_ProxyRestart_PropagatesNewPeerAndDropsStale(t *testing.T) {
-	am, updateManager, err := createManager(t)
-	require.NoError(t, err, "createManager must succeed")
-	ctx := context.Background()
-
-	const (
-		accountID   = "an-restart-acct"
-		adminUserID = "an-restart-admin"
-		groupAID    = "an-restart-grp-A"
-		clusterAddr = "eu.proxy.netbird.io"
-		clientKey   = "BhRPtynAAYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
-		// Two different proxy pubkeys — the "before" and "after" of a
-		// proxy-process restart with fresh-keypair generation.
-		proxyKey1 = "Aaaaa1aaaaYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
-		proxyKey2 = "Bbbbb2bbbbYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
-	)
-
-	// --- Account scaffold ---
-	account := newAccountWithId(ctx, accountID, adminUserID, "an-restart.test", "", "", false)
-	require.NoError(t, am.Store.SaveAccount(ctx, account))
-
-	clientPeer := &nbpeer.Peer{
-		Key:      clientKey,
-		Name:     "an-restart-client",
-		DNSLabel: "an-restart-client",
-		Meta:     nbpeer.PeerSystemMeta{Hostname: "an-restart-client", GoOS: "linux", WtVersion: "development"},
-	}
-	addedClient, _, _, _, err := am.AddPeer(ctx, "", "", adminUserID, clientPeer, false)
-	require.NoError(t, err, "AddPeer for client must succeed")
-	require.NoError(t, am.MarkPeerConnected(ctx, clientKey, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
-		"MarkPeerConnected for the client peer must succeed (affected-peer fan-out skips disconnected peers)")
-
-	// Place the client in group A so the synth policy reaches it.
-	account, err = am.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Groups[groupAID] = &types.Group{ID: groupAID, Name: "groupA", Peers: []string{addedClient.ID}}
-	require.NoError(t, am.Store.SaveAccount(ctx, account), "SaveAccount must persist group A")
-
-	// --- Real peers + agent-network managers ---
-	permMgr := permissions.NewManager(am.Store)
-	peersMgr := peers.NewManager(am.Store, permMgr)
-	peersMgr.SetAccountManager(am)
-	peersMgr.SetNetworkMapController(am.networkMapController)
-	agentMgr := agentnetwork.NewManager(am.Store, permMgr, am, nil)
-
-	// Subscribe BEFORE any state-mutating call so we don't lose the update
-	// that contains the synth DNS record.
-	clientCh := updateManager.CreateChannel(ctx, addedClient.ID)
-	t.Cleanup(func() { updateManager.CloseChannel(ctx, addedClient.ID) })
-	drain(clientCh)
-
-	// --- First proxy startup: register peer key K1, then mark it
-	// connected. In production the proxy follows CreateProxyPeer with the
-	// regular sync stream which lands on MarkPeerConnected; the synth DNS
-	// path filters out peers that aren't Connected (types/account.go:323),
-	// so without this step no DNS record would be emitted.
-	require.NoError(t, peersMgr.CreateProxyPeer(ctx, accountID, proxyKey1, clusterAddr),
-		"first CreateProxyPeer (proxy startup) must succeed")
-
-	peer1ID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey1)
-	require.NoError(t, err, "proxy peer for K1 must be persisted after CreateProxyPeer")
-	require.NotEmpty(t, peer1ID)
-
-	require.NoError(t, am.MarkPeerConnected(ctx, proxyKey1, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
-		"MarkPeerConnected for K1 must succeed")
-
-	account, err = am.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	proxyIP1 := account.Peers[peer1ID].IP.String()
-	require.NotEmpty(t, proxyIP1, "K1 must have an assigned overlay IP")
-
-	// --- Provider + policy. CreateProvider / CreatePolicy trigger the
-	// agentnetwork reconcile which runs UpdateAccountPeers; the resulting
-	// NetworkMap delivered to the client carries the synth DNS record
-	// pointing at K1's IP. ---
-	provider, err := agentMgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
-		AccountID:   accountID,
-		ProviderID:  "openai_api",
-		Name:        "openai-test",
-		UpstreamURL: "https://api.openai.com",
-		APIKey:      "sk-test-key",
-		Enabled:     true,
-		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
-	}, clusterAddr)
-	require.NoError(t, err, "CreateProvider must succeed")
-
-	_, err = agentMgr.CreatePolicy(ctx, adminUserID, &agenttypes.Policy{
-		AccountID:              accountID,
-		Name:                   "p1",
-		Enabled:                true,
-		SourceGroups:           []string{groupAID},
-		DestinationProviderIDs: []string{provider.ID},
-	})
-	require.NoError(t, err, "CreatePolicy must succeed")
-
-	settings, err := am.Store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	fqdn := settings.Endpoint()
-
-	rdata1 := awaitZoneRData(clientCh, clusterAddr, fqdn, true)
-	require.Equal(t, proxyIP1, rdata1,
-		"client must receive a synth DNS record pointing at K1's overlay IP after the synth path runs")
-	drain(clientCh)
-
-	// --- Proxy restart: NEW keypair K2, same account, same cluster ---
-	require.NoError(t, peersMgr.CreateProxyPeer(ctx, accountID, proxyKey2, clusterAddr),
-		"second CreateProxyPeer (proxy restart with fresh keypair) must succeed")
-
-	peer2ID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey2)
-	require.NoError(t, err, "proxy peer for K2 must be persisted after restart")
-	require.NotEmpty(t, peer2ID)
-
-	require.NoError(t, am.MarkPeerConnected(ctx, proxyKey2, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
-		"MarkPeerConnected for K2 must succeed")
-
-	// In production the agent's sync stream pulls a fresh NetworkMap as
-	// part of its normal reconcile cadence; in this isolated test
-	// MarkPeerConnected's affected-peer fan-out can race the channel-side
-	// buffer in a way that swallows the synth-DNS-bearing update before
-	// our await reads it. Trigger an explicit account-wide fan-out so the
-	// assertion below tests what production actually delivers, not the
-	// in-test buffer race.
-	am.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourcePeer, Operation: types.UpdateOperationUpdate})
-
-	account, err = am.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	proxyIP2 := account.Peers[peer2ID].IP.String()
-	require.NotEmpty(t, proxyIP2, "K2 must have an assigned overlay IP")
-	require.NotEqual(t, proxyIP1, proxyIP2, "K2 must get a different overlay IP than K1 (sanity)")
-
-	// CRITICAL ASSERTION 1: K1 must no longer be in the store. The SqlStore
-	// returns ("", nil) for a missing key rather than NotFound, so assert
-	// on the returned ID being empty.
-	staleID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey1)
-	require.NoError(t, err, "GetPeerIDByKey for a missing peer must not error")
-	assert.Empty(t, staleID,
-		"stale embedded proxy peer K1 must be removed when a new embedded peer registers for the same (account, cluster); pre-fix this assertion fails because management never cleans up the prior peer record")
-
-	// CRITICAL ASSERTION 2: exactly one embedded proxy peer remains, and it
-	// is K2.
-	account, err = am.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	embeddedKeys := []string{}
-	for _, p := range account.Peers {
-		if p.ProxyMeta.Embedded {
-			embeddedKeys = append(embeddedKeys, p.Key)
-		}
-	}
-	assert.Equal(t, []string{proxyKey2}, embeddedKeys,
-		"after a proxy restart exactly one embedded proxy peer should remain — the one with the new key K2")
-
-	// CRITICAL ASSERTION 3: the synth DNS record the client receives now
-	// points at K2's IP, not K1's.
-	rdata2 := awaitZoneRData(clientCh, clusterAddr, fqdn, true)
-	assert.Equal(t, proxyIP2, rdata2,
-		"after proxy restart, the client's synth DNS record must point at the NEW embedded peer's IP, not the stale K1 IP")
-}

management/server/http/handlers/accounts/accounts_handler.go

@@ -286,6 +286,21 @@ func (h *handler) updateAccountRequestSettings(req api.PutApiAccountsAccountIdJS
 	if req.Settings.MetricsPushEnabled != nil {
 		returnSettings.MetricsPushEnabled = *req.Settings.MetricsPushEnabled
 	}
+	if req.Settings.AgentNetworkOnly != nil {
+		returnSettings.AgentNetworkOnly = *req.Settings.AgentNetworkOnly
+	}
+	if req.Settings.DashboardFeatures != nil {
+		returnSettings.DashboardFeatures = &types.DashboardFeatures{
+			AgentNetwork: req.Settings.DashboardFeatures.AgentNetwork,
+		}
+	}
+
+	if returnSettings.AgentNetworkOnly &&
+		(returnSettings.DashboardFeatures == nil ||
+			returnSettings.DashboardFeatures.AgentNetwork == nil ||
+			!*returnSettings.DashboardFeatures.AgentNetwork) {
+		return nil, status.Errorf(status.InvalidArgument, "agent network only mode requires dashboard_features.agent_network to be enabled")
+	}
 
 	return returnSettings, nil
 }
@@ -417,6 +432,7 @@ func toAccountResponse(accountID string, settings *types.Settings, meta *types.A
 		AutoUpdateAlways:                &settings.AutoUpdateAlways,
 		Ipv6EnabledGroups:               &settings.IPv6EnabledGroups,
 		MetricsPushEnabled:              &settings.MetricsPushEnabled,
+		AgentNetworkOnly:                &settings.AgentNetworkOnly,
 		EmbeddedIdpEnabled:              &settings.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               &settings.LocalAuthDisabled,
 		LocalMfaEnabled:                 &settings.LocalMfaEnabled,
@@ -430,6 +446,11 @@ func toAccountResponse(accountID string, settings *types.Settings, meta *types.A
 		networkRangeV6Str := settings.NetworkRangeV6.String()
 		apiSettings.NetworkRangeV6 = &networkRangeV6Str
 	}
+	if settings.DashboardFeatures != nil {
+		apiSettings.DashboardFeatures = &api.AccountDashboardFeatures{
+			AgentNetwork: settings.DashboardFeatures.AgentNetwork,
+		}
+	}
 
 	apiOnboarding := api.AccountOnboarding{
 		OnboardingFlowPending: onboarding.OnboardingFlowPending,

management/server/http/handlers/accounts/accounts_handler_test.go

@@ -130,6 +130,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -158,6 +159,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -186,6 +188,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr("latest"),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -214,6 +217,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -242,6 +246,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -270,6 +275,109 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
+				EmbeddedIdpEnabled:              br(false),
+				LocalAuthDisabled:               br(false),
+				LocalMfaEnabled:                 br(false),
+			},
+			expectedArray: false,
+			expectedID:    accountID,
+		},
+		{
+			name:           "PutAccount OK enabling agent_network_only",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": true,\"dashboard_features\": {\"agent_network\": true}},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusOK,
+			expectedSettings: api.AccountSettings{
+				PeerLoginExpiration:             15552000,
+				PeerLoginExpirationEnabled:      true,
+				GroupsPropagationEnabled:        br(false),
+				JwtGroupsClaimName:              sr(""),
+				JwtGroupsEnabled:                br(false),
+				JwtAllowGroups:                  &[]string{},
+				RegularUsersViewBlocked:         false,
+				RoutingPeerDnsResolutionEnabled: br(false),
+				LazyConnectionEnabled:           br(false),
+				DnsDomain:                       sr(""),
+				AutoUpdateAlways:                br(false),
+				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(true),
+				DashboardFeatures: &api.AccountDashboardFeatures{
+					AgentNetwork: br(true),
+				},
+				EmbeddedIdpEnabled: br(false),
+				LocalAuthDisabled:  br(false),
+				LocalMfaEnabled:    br(false),
+			},
+			expectedArray: false,
+			expectedID:    accountID,
+		},
+		{
+			name:           "PutAccount fails enabling agent_network_only without dashboard_features",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": true},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusUnprocessableEntity,
+			expectedArray:  false,
+		},
+		{
+			name:           "PutAccount OK setting dashboard_features agent_network",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"dashboard_features\": {\"agent_network\": true}},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusOK,
+			expectedSettings: api.AccountSettings{
+				PeerLoginExpiration:             15552000,
+				PeerLoginExpirationEnabled:      true,
+				GroupsPropagationEnabled:        br(false),
+				JwtGroupsClaimName:              sr(""),
+				JwtGroupsEnabled:                br(false),
+				JwtAllowGroups:                  &[]string{},
+				RegularUsersViewBlocked:         false,
+				RoutingPeerDnsResolutionEnabled: br(false),
+				LazyConnectionEnabled:           br(false),
+				DnsDomain:                       sr(""),
+				AutoUpdateAlways:                br(false),
+				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
+				DashboardFeatures: &api.AccountDashboardFeatures{
+					AgentNetwork: br(true),
+				},
+				EmbeddedIdpEnabled: br(false),
+				LocalAuthDisabled:  br(false),
+				LocalMfaEnabled:    br(false),
+			},
+			expectedArray: false,
+			expectedID:    accountID,
+		},
+		{
+			name:           "PutAccount OK disabling agent_network_only again",
+			expectedBody:   true,
+			requestType:    http.MethodPut,
+			requestPath:    "/api/accounts/" + accountID,
+			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": false},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
+			expectedStatus: http.StatusOK,
+			expectedSettings: api.AccountSettings{
+				PeerLoginExpiration:             15552000,
+				PeerLoginExpirationEnabled:      true,
+				GroupsPropagationEnabled:        br(false),
+				JwtGroupsClaimName:              sr(""),
+				JwtGroupsEnabled:                br(false),
+				JwtAllowGroups:                  &[]string{},
+				RegularUsersViewBlocked:         false,
+				RoutingPeerDnsResolutionEnabled: br(false),
+				LazyConnectionEnabled:           br(false),
+				DnsDomain:                       sr(""),
+				AutoUpdateAlways:                br(false),
+				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
+				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),

management/server/peer.go

@@ -106,11 +106,13 @@ func (am *DefaultAccountManager) MarkPeerConnected(ctx context.Context, peerPubK
 	}
 	if !updated {
 		am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusConnect, telemetry.PeerStatusStale)
-		log.WithContext(ctx).Tracef("peer %s already has a newer session in store, skipping connect", peer.ID)
+		log.WithContext(ctx).Debugf("peer %s already has a newer session in store, skipping connect", peer.ID)
 		return nil
 	}
 	am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusConnect, telemetry.PeerStatusApplied)
 
+	log.WithContext(ctx).Debugf("mark peer %s connected", peer.ID)
+
 	if err = am.schedulePeerExpirations(ctx, accountID, peer); err != nil {
 		return err
 	}
@@ -180,12 +182,14 @@ func (am *DefaultAccountManager) MarkPeerDisconnected(ctx context.Context, peerP
 	}
 	if !updated {
 		am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusDisconnect, telemetry.PeerStatusStale)
-		log.WithContext(ctx).Tracef("peer %s session token mismatch on disconnect (token=%d), skipping",
+		log.WithContext(ctx).Debugf("peer %s session token mismatch on disconnect (token=%d), skipping",
 			peer.ID, sessionStartedAt)
 		return nil
 	}
 	am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusDisconnect, telemetry.PeerStatusApplied)
 
+	log.WithContext(ctx).Debugf("mark peer %s disconnected", peer.ID)
+
 	// Symmetric with MarkPeerConnected: when an embedded proxy peer goes
 	// offline, refresh the peers that had synthesized records pointing at
 	// it so they pull the stale entries instead of waiting out TTL.

management/server/store/sql_store.go

@@ -1605,7 +1605,8 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 			settings_jwt_groups_enabled, settings_jwt_groups_claim_name, settings_jwt_allow_groups,
 			settings_routing_peer_dns_resolution_enabled, settings_dns_domain, settings_network_range,
 			settings_network_range_v6, settings_ipv6_enabled_groups, settings_lazy_connection_enabled,
-			settings_local_mfa_enabled, settings_metrics_push_enabled,
+			settings_local_mfa_enabled, settings_metrics_push_enabled, settings_agent_network_only,
+			settings_dashboard_features,
 			-- Embedded ExtraSettings
 			settings_extra_peer_approval_enabled, settings_extra_user_approval_required,
 			settings_extra_integrated_validator, settings_extra_integrated_validator_groups
@@ -1629,6 +1630,8 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 		sLazyConnectionEnabled           sql.NullBool
 		sLocalMFAEnabled                 sql.NullBool
 		sMetricsPushEnabled              sql.NullBool
+		sAgentNetworkOnly                sql.NullBool
+		sDashboardFeatures               sql.NullString
 		sExtraPeerApprovalEnabled        sql.NullBool
 		sExtraUserApprovalRequired       sql.NullBool
 		sExtraIntegratedValidator        sql.NullString
@@ -1651,7 +1654,8 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 		&sJWTGroupsEnabled, &sJWTGroupsClaimName, &sJWTAllowGroups,
 		&sRoutingPeerDNSResolutionEnabled, &sDNSDomain, &sNetworkRange,
 		&sNetworkRangeV6, &sIPv6EnabledGroups, &sLazyConnectionEnabled,
-		&sLocalMFAEnabled, &sMetricsPushEnabled,
+		&sLocalMFAEnabled, &sMetricsPushEnabled, &sAgentNetworkOnly,
+		&sDashboardFeatures,
 		&sExtraPeerApprovalEnabled, &sExtraUserApprovalRequired,
 		&sExtraIntegratedValidator, &sExtraIntegratedValidatorGroups,
 	)
@@ -1720,6 +1724,14 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 	if sMetricsPushEnabled.Valid {
 		account.Settings.MetricsPushEnabled = sMetricsPushEnabled.Bool
 	}
+	if sAgentNetworkOnly.Valid {
+		account.Settings.AgentNetworkOnly = sAgentNetworkOnly.Bool
+	}
+	if sDashboardFeatures.Valid && sDashboardFeatures.String != "" {
+		if err := json.Unmarshal([]byte(sDashboardFeatures.String), &account.Settings.DashboardFeatures); err != nil {
+			log.WithContext(ctx).Warnf("failed to unmarshal dashboard features for account %s: %v", accountID, err)
+		}
+	}
 	if sJWTAllowGroups.Valid {
 		_ = json.Unmarshal([]byte(sJWTAllowGroups.String), &account.Settings.JWTAllowGroups)
 	}

management/server/store/sql_store_test.go

@@ -1245,6 +1245,61 @@ func TestSqlite_CreateAndGetObjectInTransaction(t *testing.T) {
 	assert.NoError(t, err)
 }
 
+func TestSqlStore_SaveAccountPersistsAgentNetworkOnly(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	account, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.False(t, account.Settings.AgentNetworkOnly, "setting should default to false")
+
+	account.Settings.AgentNetworkOnly = true
+	require.NoError(t, store.SaveAccount(context.Background(), account))
+
+	reloaded, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.True(t, reloaded.Settings.AgentNetworkOnly, "setting should survive a save/load round-trip")
+
+	reloaded.Settings.AgentNetworkOnly = false
+	require.NoError(t, store.SaveAccount(context.Background(), reloaded))
+
+	disabled, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.False(t, disabled.Settings.AgentNetworkOnly, "disabling should persist")
+}
+
+func TestSqlStore_SaveAccountPersistsDashboardFeatures(t *testing.T) {
+	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
+	t.Cleanup(cleanup)
+	require.NoError(t, err)
+
+	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
+	account, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.Nil(t, account.Settings.DashboardFeatures, "dashboard features should default to unset")
+
+	agentNetwork := true
+	account.Settings.DashboardFeatures = &types.DashboardFeatures{AgentNetwork: &agentNetwork}
+	require.NoError(t, store.SaveAccount(context.Background(), account))
+
+	reloaded, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.NotNil(t, reloaded.Settings.DashboardFeatures, "dashboard features should survive a save/load round-trip")
+	require.NotNil(t, reloaded.Settings.DashboardFeatures.AgentNetwork, "agent network flag should be set")
+	require.True(t, *reloaded.Settings.DashboardFeatures.AgentNetwork, "agent network flag should persist as true")
+
+	disabled := false
+	reloaded.Settings.DashboardFeatures = &types.DashboardFeatures{AgentNetwork: &disabled}
+	require.NoError(t, store.SaveAccount(context.Background(), reloaded))
+
+	reloadedDisabled, err := store.GetAccount(context.Background(), accountID)
+	require.NoError(t, err)
+	require.NotNil(t, reloadedDisabled.Settings.DashboardFeatures.AgentNetwork, "agent network flag should remain set")
+	require.False(t, *reloadedDisabled.Settings.DashboardFeatures.AgentNetwork, "explicit false should persist")
+}
+
 func TestSqlStore_GetAccountUsers(t *testing.T) {
 	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
 	t.Cleanup(cleanup)

management/server/types/networkmap_components.go

@@ -7,6 +7,7 @@ import (
 	"slices"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/netbirdio/netbird/client/ssh/auth"
@@ -42,6 +43,14 @@ type NetworkMapComponents struct {
 	PostureFailedPeers map[string]map[string]struct{}
 
 	RouterPeers map[string]*nbpeer.Peer
+
+	routesByPeerOnce sync.Once
+	routesByPeerIdx  map[string][]routeIndexEntry
+}
+
+type routeIndexEntry struct {
+	route    *route.Route
+	viaGroup bool
 }
 
 type AccountSettingsInfo struct {
@@ -530,33 +539,43 @@ func (c *NetworkMapComponents) getRoutingPeerRoutes(peerID string) (enabledRoute
 		disabledRoutes = append(disabledRoutes, r)
 	}
 
-	for _, r := range c.Routes {
-		for _, groupID := range r.PeerGroups {
-			group := c.GetGroupInfo(groupID)
-			if group == nil {
-				continue
-			}
-			for _, id := range group.Peers {
-				if id != peerID {
-					continue
-				}
-
-				newPeerRoute := r.Copy()
-				newPeerRoute.Peer = id
-				newPeerRoute.PeerGroups = nil
-				newPeerRoute.ID = route.ID(string(r.ID) + ":" + id)
-				takeRoute(newPeerRoute)
-				break
-			}
-		}
-		if r.Peer == peerID {
-			takeRoute(r.Copy())
+	for _, entry := range c.routesByPeer()[peerID] {
+		if entry.viaGroup {
+			newPeerRoute := entry.route.Copy()
+			newPeerRoute.PeerGroups = nil
+			newPeerRoute.ID = route.ID(string(entry.route.ID) + ":" + peerID)
+			takeRoute(newPeerRoute)
+			continue
 		}
+		takeRoute(entry.route.Copy())
 	}
 
 	return enabledRoutes, disabledRoutes
 }
 
+func (c *NetworkMapComponents) routesByPeer() map[string][]routeIndexEntry {
+	c.routesByPeerOnce.Do(func() {
+		idx := make(map[string][]routeIndexEntry)
+		for _, r := range c.Routes {
+			for _, groupID := range r.PeerGroups {
+				group := c.GetGroupInfo(groupID)
+				if group == nil {
+					continue
+				}
+				for _, id := range group.Peers {
+					idx[id] = append(idx[id], routeIndexEntry{route: r, viaGroup: true})
+				}
+			}
+			if r.Peer != "" {
+				idx[r.Peer] = append(idx[r.Peer], routeIndexEntry{route: r})
+			}
+		}
+		c.routesByPeerIdx = idx
+	})
+
+	return c.routesByPeerIdx
+}
+
 func (c *NetworkMapComponents) filterRoutesByGroups(routes []*route.Route, groupListMap LookupMap) []*route.Route {
 	var filteredRoutes []*route.Route
 	for _, r := range routes {

management/server/types/settings.go

@@ -76,6 +76,15 @@ type Settings struct {
 	// MetricsPushEnabled globally enables or disables client metrics push for the account
 	MetricsPushEnabled bool `gorm:"default:false"`
 
+	// AgentNetworkOnly limits the dashboard to the Agent Network surface for this account.
+	// Set for accounts created via netbird.ai signups; users can disable it later.
+	AgentNetworkOnly bool `gorm:"default:false"`
+
+	// DashboardFeatures holds per-account dashboard section visibility overrides.
+	// It serializes to a single JSON column so new sections can be added without
+	// a schema change.
+	DashboardFeatures *DashboardFeatures `gorm:"serializer:json"`
+
 	// EmbeddedIdpEnabled indicates if the embedded identity provider is enabled.
 	// This is a runtime-only field, not stored in the database.
 	EmbeddedIdpEnabled bool `gorm:"-"`
@@ -114,6 +123,7 @@ func (s *Settings) Copy() *Settings {
 		AutoUpdateAlways:                s.AutoUpdateAlways,
 		IPv6EnabledGroups:               slices.Clone(s.IPv6EnabledGroups),
 		MetricsPushEnabled:              s.MetricsPushEnabled,
+		AgentNetworkOnly:                s.AgentNetworkOnly,
 		EmbeddedIdpEnabled:              s.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               s.LocalAuthDisabled,
 		LocalMfaEnabled:                 s.LocalMfaEnabled,
@@ -121,9 +131,31 @@ func (s *Settings) Copy() *Settings {
 	if s.Extra != nil {
 		settings.Extra = s.Extra.Copy()
 	}
+	if s.DashboardFeatures != nil {
+		settings.DashboardFeatures = s.DashboardFeatures.Copy()
+	}
 	return settings
 }
 
+// DashboardFeatures holds per-account dashboard section visibility overrides.
+// Nil fields are unset and follow the default dashboard behavior; an explicit
+// value forces that section shown or hidden for the account.
+type DashboardFeatures struct {
+	// AgentNetwork, when set, forces the Agent Network menu shown (true) or
+	// hidden (false) regardless of the deployment feature flag.
+	AgentNetwork *bool `json:"agent_network,omitempty"`
+}
+
+// Copy returns a deep copy of the DashboardFeatures struct.
+func (d *DashboardFeatures) Copy() *DashboardFeatures {
+	c := &DashboardFeatures{}
+	if d.AgentNetwork != nil {
+		v := *d.AgentNetwork
+		c.AgentNetwork = &v
+	}
+	return c
+}
+
 type ExtraSettings struct {
 	// PeerApprovalEnabled enables or disables the need for peers bo be approved by an administrator
 	PeerApprovalEnabled bool

proxy/internal/middleware/builtin/llm_guardrail/middleware.go

@@ -25,6 +25,14 @@ const (
 	denyCodeModel    = "llm_policy.model_blocked"
 	denyReasonModel  = "model_blocked"
 	denyMessageModel = "model is not in the policy allowlist"
+	// Deny reason used when an allowlist is configured but the request model
+	// could not be determined. URL/path-routed providers (AWS Bedrock, Google
+	// Vertex, ...) carry the model outside the JSON body, so a request shape the
+	// parser does not recognise reaches the guardrail with no model. Such a
+	// request must be denied (fail closed), never waved through.
+	denyCodeModelUnknown    = "llm_policy.model_unknown"
+	denyReasonModelUnknown  = "model_unknown"
+	denyMessageModelUnknown = "request model could not be determined for the policy allowlist"
 )
 
 // Middleware enforces the model allowlist and optionally captures the
@@ -108,23 +116,37 @@ func (m *Middleware) evaluateAllowlist(model string, modelPresent bool) *middlew
 	if len(m.cfg.ModelAllowlist) == 0 {
 		return nil
 	}
-	if !modelPresent {
-		return nil
+	// Fail closed: with an allowlist configured, a request whose model the
+	// upstream parser could not extract (absent or empty) must be denied rather
+	// than allowed. This is what enforces the allowlist for URL/path-routed
+	// providers (Bedrock, Vertex, ...) whose model lives outside the JSON body.
+	if !modelPresent || normaliseModel(model) == "" {
+		return denyModel("", denyCodeModelUnknown, denyMessageModelUnknown, denyReasonModelUnknown)
 	}
 	if m.modelInAllowlist(model) {
 		return nil
 	}
+	return denyModel(model, denyCodeModel, denyMessageModel, denyReasonModel)
+}
+
+// denyModel builds a 403 deny Output for a model-allowlist rejection. model is
+// included in the details only when non-empty.
+func denyModel(model, code, message, reason string) *middleware.Output {
+	details := map[string]string{}
+	if model != "" {
+		details["model"] = model
+	}
 	return &middleware.Output{
 		Decision:   middleware.DecisionDeny,
 		DenyStatus: 403,
 		DenyReason: &middleware.DenyReason{
-			Code:    denyCodeModel,
-			Message: denyMessageModel,
-			Details: map[string]string{"model": model},
+			Code:    code,
+			Message: message,
+			Details: details,
 		},
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
-			{Key: middleware.KeyLLMPolicyReason, Value: denyReasonModel},
+			{Key: middleware.KeyLLMPolicyReason, Value: reason},
 		},
 	}
 }

proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go

@@ -102,13 +102,44 @@ func TestAllowlistCaseInsensitive(t *testing.T) {
 	}
 }
 
-func TestAllowlistMissingModelKeyAllows(t *testing.T) {
+func TestAllowlistMissingModelKeyDenies(t *testing.T) {
+	// Fail closed: with an allowlist configured, a request whose model the
+	// parser could not extract (URL/path-routed providers such as Bedrock or
+	// Vertex whose shape wasn't recognised) must be denied, not allowed.
 	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
 	out, err := mw.Invoke(context.Background(), newInput())
 	require.NoError(t, err)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "missing model key must allow even with non-empty allowlist")
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "absent model must be denied when an allowlist is set")
+	assert.Equal(t, 403, out.DenyStatus, "deny status must be 403")
+	require.NotNil(t, out.DenyReason, "deny reason must be populated")
+	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
 	dec, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
-	assert.Equal(t, "allow", dec, "decision must be allow when model key is absent")
+	assert.Equal(t, "deny", dec, "decision must be deny when model key is absent")
+	reason, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyReason)
+	assert.Equal(t, "model_unknown", reason, "reason metadata must be model_unknown")
+}
+
+func TestAllowlistEmptyModelValueDenies(t *testing.T) {
+	// A present-but-empty model is as undeterminable as an absent one.
+	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
+	out, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "   "},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "empty model must be denied when an allowlist is set")
+	require.NotNil(t, out.DenyReason, "deny reason must be populated")
+	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
+}
+
+func TestAllowlistEmptyListAllowsMissingModel(t *testing.T) {
+	// Without an allowlist there is nothing to enforce, so a missing model is
+	// still allowed — the fail-closed rule only applies when a list is set.
+	mw := New(Config{})
+	out, err := mw.Invoke(context.Background(), newInput())
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "no allowlist must allow even without a model")
 }
 
 func TestPromptCaptureDisabledEmitsNoPrompt(t *testing.T) {

proxy/internal/middleware/builtin/llm_request_parser/guardrail_allowlist_test.go

@@ -0,0 +1,106 @@
+package llm_request_parser
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+)
+
+// runParserGuardrail runs the request parser then the model-allowlist guardrail
+// in SlotOnRequest order, threading the parser's metadata into the guardrail the
+// same way the real chain does. It returns the guardrail decision so tests can
+// assert allowlist enforcement for URL/path-routed providers end to end.
+func runParserGuardrail(t *testing.T, url string, body []byte, allowlist []string) *middleware.Output {
+	t.Helper()
+	parser := newMiddleware(t)
+	parsed, err := parser.Invoke(context.Background(), &middleware.Input{
+		Slot: middleware.SlotOnRequest,
+		URL:  url,
+		Body: body,
+	})
+	require.NoError(t, err, "parser must not error")
+
+	guard := llm_guardrail.New(llm_guardrail.Config{ModelAllowlist: allowlist})
+	out, err := guard.Invoke(context.Background(), &middleware.Input{
+		Slot:     middleware.SlotOnRequest,
+		Metadata: parsed.Metadata,
+	})
+	require.NoError(t, err, "guardrail must not error")
+	require.NotNil(t, out, "guardrail must return an output")
+	return out
+}
+
+// TestModelAllowlist_URLRoutedProviders validates that the model allowlist is
+// enforced for providers whose model travels in the URL path (AWS Bedrock,
+// Google Vertex) rather than the JSON body. The "unknown action" case is the
+// regression guard for #6751: a Bedrock request shape the parser cannot map to a
+// model must fail closed under an allowlist instead of bypassing it.
+func TestModelAllowlist_URLRoutedProviders(t *testing.T) {
+	const bedrockBody = `{"anthropic_version":"bedrock-2023-05-31","messages":[{"role":"user","content":"hi"}]}`
+	const vertexBody = `{"anthropic_version":"vertex-2023-10-16","messages":[{"role":"user","content":"hi"}]}`
+
+	tests := []struct {
+		name      string
+		url       string
+		body      string
+		allowlist []string
+		decision  middleware.Decision
+		denyCode  string
+	}{
+		{
+			name:      "bedrock allowed model passes",
+			url:       "https://bedrock-runtime.us-east-1.amazonaws.com/model/us.anthropic.claude-haiku-4-5-v1:0/invoke",
+			body:      bedrockBody,
+			allowlist: []string{"anthropic.claude-haiku-4-5"},
+			decision:  middleware.DecisionAllow,
+		},
+		{
+			name:      "bedrock disallowed model denied",
+			url:       "https://bedrock-runtime.us-east-1.amazonaws.com/model/us.anthropic.claude-opus-4-8-v1:0/invoke",
+			body:      bedrockBody,
+			allowlist: []string{"anthropic.claude-haiku-4-5"},
+			decision:  middleware.DecisionDeny,
+			denyCode:  "llm_policy.model_blocked",
+		},
+		{
+			name:      "bedrock unknown action fails closed",
+			url:       "https://bedrock-runtime.us-east-1.amazonaws.com/model/us.anthropic.claude-opus-4-8-v1:0/some-future-action",
+			body:      bedrockBody,
+			allowlist: []string{"anthropic.claude-haiku-4-5"},
+			decision:  middleware.DecisionDeny,
+			denyCode:  "llm_policy.model_unknown",
+		},
+		{
+			name:      "vertex disallowed model denied",
+			url:       "/v1/projects/p/locations/global/publishers/anthropic/models/claude-opus-4-8@20250101:rawPredict",
+			body:      vertexBody,
+			allowlist: []string{"claude-haiku-4-5"},
+			decision:  middleware.DecisionDeny,
+			denyCode:  "llm_policy.model_blocked",
+		},
+		{
+			name:      "vertex allowed model passes",
+			url:       "/v1/projects/p/locations/global/publishers/anthropic/models/claude-haiku-4-5@20250101:rawPredict",
+			body:      vertexBody,
+			allowlist: []string{"claude-haiku-4-5"},
+			decision:  middleware.DecisionAllow,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			out := runParserGuardrail(t, tt.url, []byte(tt.body), tt.allowlist)
+			assert.Equal(t, tt.decision, out.Decision, "unexpected decision for %s", tt.name)
+			if tt.decision == middleware.DecisionDeny {
+				require.NotNil(t, out.DenyReason, "deny reason must be set for %s", tt.name)
+				assert.Equal(t, 403, out.DenyStatus, "deny status must be 403 for %s", tt.name)
+				assert.Equal(t, tt.denyCode, out.DenyReason.Code, "deny code for %s", tt.name)
+			}
+		})
+	}
+}

shared/management/http/api/openapi.yml

@@ -375,6 +375,12 @@ components:
           description: Enables or disables client metrics push for all peers in the account
           type: boolean
           example: false
+        agent_network_only:
+          description: Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later. Enabling this requires dashboard_features.agent_network to be true in the same request.
+          type: boolean
+          example: false
+        dashboard_features:
+          $ref: '#/components/schemas/AccountDashboardFeatures'
         embedded_idp_enabled:
           description: Indicates whether the embedded identity provider (Dex) is enabled for this account. This is a read-only field.
           type: boolean
@@ -403,6 +409,14 @@ components:
         - regular_users_view_blocked
         - peer_expose_enabled
         - peer_expose_groups
+    AccountDashboardFeatures:
+      description: Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
+      type: object
+      properties:
+        agent_network:
+          description: Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies. Must be true when agent_network_only is enabled.
+          type: boolean
+          example: true
     AccountExtraSettings:
       type: object
       properties:
@@ -10490,7 +10504,7 @@ paths:
         - EDR Intune Integrations
       summary: Delete EDR Intune Integration
       description: Deletes an EDR Intune Integration by its ID.
-      operationId: deleteIntegration
+      operationId: deleteEDRIntuneIntegration
       responses:
         '200':
           description: Integration deleted successfully. Returns an empty object.
@@ -12574,7 +12588,7 @@ paths:
         - Event Streaming Integrations
       summary: Delete Event Streaming Integration
       description: Deletes an event streaming integration by its ID.
-      operationId: deleteIntegration
+      operationId: deleteEventStreamingIntegration
       responses:
         '200':
           description: Integration deleted successfully. Returns an empty object.

shared/management/http/api/types.gen.go

@@ -1612,6 +1612,12 @@ type Account struct {
 	Settings   AccountSettings   `json:"settings"`
 }
 
+// AccountDashboardFeatures Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
+type AccountDashboardFeatures struct {
+	// AgentNetwork Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies. Must be true when agent_network_only is enabled.
+	AgentNetwork *bool `json:"agent_network,omitempty"`
+}
+
 // AccountExtraSettings defines model for AccountExtraSettings.
 type AccountExtraSettings struct {
 	// NetworkTrafficLogsEnabled Enables or disables network traffic logging. If enabled, all network traffic events from peers will be stored.
@@ -1647,12 +1653,18 @@ type AccountRequest struct {
 
 // AccountSettings defines model for AccountSettings.
 type AccountSettings struct {
+	// AgentNetworkOnly Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later. Enabling this requires dashboard_features.agent_network to be true in the same request.
+	AgentNetworkOnly *bool `json:"agent_network_only,omitempty"`
+
 	// AutoUpdateAlways When true, updates are installed automatically in the background. When false, updates require user interaction from the UI.
 	AutoUpdateAlways *bool `json:"auto_update_always,omitempty"`
 
 	// AutoUpdateVersion Set Clients auto-update version. "latest", "disabled", or a specific version (e.g "0.50.1")
 	AutoUpdateVersion *string `json:"auto_update_version,omitempty"`
 
+	// DashboardFeatures Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
+	DashboardFeatures *AccountDashboardFeatures `json:"dashboard_features,omitempty"`
+
 	// DnsDomain Allows to define a custom dns domain for the account
 	DnsDomain *string `json:"dns_domain,omitempty"`
 

shared/relay/client/early_msg_buffer.go

@@ -10,7 +10,7 @@ import (
 
 const (
 	earlyMsgTTL      = 5 * time.Second
-	earlyMsgCapacity = 1000
+	earlyMsgCapacity = 10000
 )
 
 // earlyMsgBuffer buffers transport messages that arrive before the corresponding

shared/signal/client/client.go

@@ -51,10 +51,17 @@ type CredentialPayload struct {
 	WgListenPort    int
 	Credential      *Credential
 	RosenpassPubKey []byte
-	RosenpassAddr   string
-	RelaySrvAddress string
-	RelaySrvIP      netip.Addr
-	SessionID       []byte
+	// RosenpassPubKeyHash is the SHA256 of the sender's own RosenpassPubKey (empty
+	// when Rosenpass is disabled). RosenpassPubKey may be omitted when the peer has
+	// already acknowledged this hash. See RosenpassConfig in the proto.
+	RosenpassPubKeyHash []byte
+	// RosenpassPubKeyAck is the SHA256 of the remote peer's key the sender holds
+	// cached; empty means "send me the full key".
+	RosenpassPubKeyAck []byte
+	RosenpassAddr      string
+	RelaySrvAddress    string
+	RelaySrvIP         netip.Addr
+	SessionID          []byte
 }
 
 // UnMarshalCredential parses the credentials from the message and returns a Credential instance
@@ -78,8 +85,10 @@ func MarshalCredential(myKey wgtypes.Key, remoteKey string, p CredentialPayload)
 		WgListenPort:   uint32(p.WgListenPort),
 		NetBirdVersion: version.NetbirdVersion(),
 		RosenpassConfig: &proto.RosenpassConfig{
-			RosenpassPubKey:     p.RosenpassPubKey,
-			RosenpassServerAddr: p.RosenpassAddr,
+			RosenpassPubKey:                 p.RosenpassPubKey,
+			RosenpassServerAddr:             p.RosenpassAddr,
+			RosenpassPubKeyHash:             p.RosenpassPubKeyHash,
+			AcknowledgedRosenpassPubKeyHash: p.RosenpassPubKeyAck,
 		},
 		SessionId: p.SessionID,
 	}

shared/signal/proto/signalexchange.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v3.21.12
+// 	protoc        v6.33.1
 // source: signalexchange.proto
 
 package proto
@@ -399,6 +399,17 @@ type RosenpassConfig struct {
 	RosenpassPubKey []byte `protobuf:"bytes,1,opt,name=rosenpassPubKey,proto3" json:"rosenpassPubKey,omitempty"`
 	// rosenpassServerAddr is an IP:port of the rosenpass service
 	RosenpassServerAddr string `protobuf:"bytes,2,opt,name=rosenpassServerAddr,proto3" json:"rosenpassServerAddr,omitempty"`
+	// rosenpassPubKeyHash is the SHA256 of the sender's own rosenpassPubKey. It is
+	// always set when Rosenpass is enabled and lets the receiver detect (via a
+	// per-peer cache) whether it already holds the sender's full public key,
+	// avoiding re-sending the large key on every offer/answer.
+	RosenpassPubKeyHash []byte `protobuf:"bytes,3,opt,name=rosenpassPubKeyHash,proto3" json:"rosenpassPubKeyHash,omitempty"`
+	// acknowledgedRosenpassPubKeyHash is the SHA256 of the remote peer's rosenpassPubKey
+	// that the sender currently holds cached. When it matches the receiver's own key hash
+	// the receiver may omit its full rosenpassPubKey from the message. Empty means the
+	// sender does not have the remote key and needs it sent in full. Absent from peers
+	// that predate this field, which keeps them receiving the full key as before.
+	AcknowledgedRosenpassPubKeyHash []byte `protobuf:"bytes,4,opt,name=acknowledgedRosenpassPubKeyHash,proto3" json:"acknowledgedRosenpassPubKeyHash,omitempty"`
 }
 
 func (x *RosenpassConfig) Reset() {
@@ -447,6 +458,20 @@ func (x *RosenpassConfig) GetRosenpassServerAddr() string {
 	return ""
 }
 
+func (x *RosenpassConfig) GetRosenpassPubKeyHash() []byte {
+	if x != nil {
+		return x.RosenpassPubKeyHash
+	}
+	return nil
+}
+
+func (x *RosenpassConfig) GetAcknowledgedRosenpassPubKeyHash() []byte {
+	if x != nil {
+		return x.AcknowledgedRosenpassPubKeyHash
+	}
+	return nil
+}
+
 var File_signalexchange_proto protoreflect.FileDescriptor
 
 var file_signalexchange_proto_rawDesc = []byte{
@@ -506,27 +531,35 @@ var file_signalexchange_proto_rawDesc = []byte{
 	0x65, 0x72, 0x49, 0x50, 0x4a, 0x04, 0x08, 0x09, 0x10, 0x0a, 0x22, 0x2e, 0x0a, 0x04, 0x4d, 0x6f,
 	0x64, 0x65, 0x12, 0x1b, 0x0a, 0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01,
 	0x28, 0x08, 0x48, 0x00, 0x52, 0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x88, 0x01, 0x01, 0x42,
-	0x09, 0x0a, 0x07, 0x5f, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x22, 0x6d, 0x0a, 0x0f, 0x52, 0x6f,
-	0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x28, 0x0a,
-	0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73,
-	0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e,
-	0x70, 0x61, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x32, 0xb9, 0x01, 0x0a, 0x0e, 0x53, 0x69,
-	0x67, 0x6e, 0x61, 0x6c, 0x45, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x4c, 0x0a, 0x04,
-	0x53, 0x65, 0x6e, 0x64, 0x12, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63,
-	0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65,
-	0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65,
-	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x59, 0x0a, 0x0d, 0x43, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x20, 0x2e, 0x73, 0x69,
-	0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63,
-	0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e,
-	0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45,
-	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22,
-	0x00, 0x28, 0x01, 0x30, 0x01, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x09, 0x0a, 0x07, 0x5f, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x22, 0xe9, 0x01, 0x0a, 0x0f, 0x52,
+	0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x28,
+	0x0a, 0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61,
+	0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65,
+	0x6e, 0x70, 0x61, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f,
+	0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x48, 0x61, 0x73,
+	0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61,
+	0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x48, 0x61, 0x73, 0x68, 0x12, 0x48, 0x0a, 0x1f,
+	0x61, 0x63, 0x6b, 0x6e, 0x6f, 0x77, 0x6c, 0x65, 0x64, 0x67, 0x65, 0x64, 0x52, 0x6f, 0x73, 0x65,
+	0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x48, 0x61, 0x73, 0x68, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x1f, 0x61, 0x63, 0x6b, 0x6e, 0x6f, 0x77, 0x6c, 0x65, 0x64,
+	0x67, 0x65, 0x64, 0x52, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b,
+	0x65, 0x79, 0x48, 0x61, 0x73, 0x68, 0x32, 0xb9, 0x01, 0x0a, 0x0e, 0x53, 0x69, 0x67, 0x6e, 0x61,
+	0x6c, 0x45, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x4c, 0x0a, 0x04, 0x53, 0x65, 0x6e,
+	0x64, 0x12, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e,
+	0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68,
+	0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x59, 0x0a, 0x0d, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61,
+	0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
+	0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67,
+	0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72,
+	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01,
+	0x30, 0x01, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

shared/signal/proto/signalexchange.proto

@@ -86,4 +86,15 @@ message RosenpassConfig {
   bytes rosenpassPubKey = 1;
   // rosenpassServerAddr is an IP:port of the rosenpass service
   string rosenpassServerAddr = 2;
+  // rosenpassPubKeyHash is the SHA256 of the sender's own rosenpassPubKey. It is
+  // always set when Rosenpass is enabled and lets the receiver detect (via a
+  // per-peer cache) whether it already holds the sender's full public key,
+  // avoiding re-sending the large key on every offer/answer.
+  bytes rosenpassPubKeyHash = 3;
+  // acknowledgedRosenpassPubKeyHash is the SHA256 of the remote peer's rosenpassPubKey
+  // that the sender currently holds cached. When it matches the receiver's own key hash
+  // the receiver may omit its full rosenpassPubKey from the message. Empty means the
+  // sender does not have the remote key and needs it sent in full. Absent from peers
+  // that predate this field, which keeps them receiving the full key as before.
+  bytes acknowledgedRosenpassPubKeyHash = 4;
 }