[client] Read the extend flow's config and hint path in one lock

extendAuthSession took the config from stateSnapshot and the config path from a
second call, each acquiring the lock on its own. A profile switch landing
between the two swaps every field, which would authenticate with one profile's
config while reading the login hint from another profile's account file.

Replace configPathSnapshot with authSnapshot, which returns both from a single
critical section.

.github/dependabot.yml

@@ -3,8 +3,8 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
+      interval: "daily"
+    open-pull-requests-limit: 15
     groups:
       actions:
         patterns:
@@ -22,12 +22,9 @@ updates:
     directories:
       - "/"
     schedule:
-      interval: "weekly"
+      interval: "daily"
     open-pull-requests-limit: 15
     groups:
-      golang-x-packages:
-        patterns:
-          - "golang.org/x/*"
       aws-sdk:
         patterns:
           - "github.com/aws/aws-sdk-go-v2/*"

.github/pull_request_template.md

@@ -2,12 +2,6 @@
 
 ## Issue ticket number and link
 
-<!--
-Required for anything that changes behavior. Link the issue (or the validated
-discussion it came from) that the NetBird team already agreed on. See
-https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#ticket-first-pr-second
--->
-
 ## Stack
 
 <!-- branch-stack -->
@@ -18,9 +12,7 @@ https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#ticket-first-pr-s
 - [ ] Is a feature enhancement
 - [ ] It is a refactor
 - [ ] Created tests that fail without the change (if possible)
-- [ ] I ran and tested this change locally — I did not rely on CI to find out whether it works
-- [ ] This PR has a single purpose (not a fix + refactor + feature in one)
-- [ ] This change is a trivial fix, **OR** it links an issue the NetBird team agreed on beforehand. Changes to the public API, gRPC protocols, functionality behavior, CLI / service flags, or new features always need that agreement first. See [CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#ticket-first-pr-second).
+- [ ] This change does **not** modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — **OR** I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See [CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#discuss-changes-with-the-netbird-team-first).
 
 > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md).
 

CONTRIBUTING.md

@@ -1,6 +1,6 @@
 # Contributing to NetBird
 
-Thanks for your interest in contributing to NetBird.
+Thanks for your interest in contributing to NetBird. 
 
 There are many ways that you can contribute:
 - Reporting issues
@@ -10,69 +10,12 @@ There are many ways that you can contribute:
 
 If you haven't already, join our slack workspace [here](https://docs.netbird.io/slack-url), we would love to discuss topics that need community contribution and enhancements to existing features.
 
-## Ticket first, PR second
-
-**Open a ticket and wait for feedback before you open a pull request.** Every PR
-that changes behavior must link to an issue the NetBird team has agreed on. A PR
-that arrives without one may be closed and redirected to a discussion, no matter
-how good the code is.
-
-Issues in this repository are maintainer-curated work items, so the flow starts
-in [Discussions](https://github.com/netbirdio/netbird/discussions):
-
-1. **Open a discussion.** Use
-   [Issue Triage](https://github.com/netbirdio/netbird/discussions/new?category=issue-triage)
-   for a bug, regression, or unexpected behavior, and
-   [Ideas & Feature Requests](https://github.com/netbirdio/netbird/discussions/new?category=ideas-feature-requests)
-   for a feature, enhancement, or integration idea. Setup and usage questions
-   belong in
-   [Q&A / Support](https://github.com/netbirdio/netbird/discussions/new?category=q-a-support).
-   Never report a security vulnerability in public — follow the
-   [security policy](https://github.com/netbirdio/netbird/security/policy)
-   instead.
-2. **Wait for feedback.** DevRel validates and reproduces the report, and a
-   maintainer confirms the direction. We may ask for more detail or propose a
-   different approach. Validated discussions become issues.
-3. **Then write the code**, following the approach agreed in the issue, and open
-   the PR linking that issue.
-
-Trivial fixes — a typo, a broken link, a documentation correction, or a one-line
-fix that already has an issue — can go straight to a PR. Everything else starts
-with a ticket. When in doubt, ask in the discussion or on
-[Slack](https://docs.netbird.io/slack-url); an hour of conversation up front
-regularly saves a week of rework.
-
-### High-risk areas
-
-These always need the design discussed and agreed in the issue **before** you
-write code:
-
-- **Public API** — REST / management API, OpenAPI schema, dashboard-facing contracts
-- **gRPC protocols** — management, signal, relay, and client daemon protos
-- **Functionality behavior** — anything existing deployments would experience differently after an upgrade
-- **Peer connectivity** — ICE and NAT traversal, relay selection, WireGuard® and Rosenpass key handling
-- **Client system integration** — routing, firewall, DNS, and interface management
-- **Authentication and authorization** — IdP integration, tokens, permissions, cryptography
-- **CLI / service flags**, configuration file format, and daemon IPC
-- **Store and database schema** — models and migrations
-- **New features**
-
-These surfaces are NetBird's contract with operators, self-hosters, and
-downstream integrators, and changes to them have compatibility, security, and
-release-planning implications. Agreeing on the direction early lets the PR
-review focus on implementation rather than design.
-
-Typical bug fixes, internal refactors, documentation updates, and tests do not
-need a design discussion, but should still be tied to an issue so the work is
-visible and nobody duplicates it.
-
 ## Contents
 
 - [Contributing to NetBird](#contributing-to-netbird)
-    - [Ticket first, PR second](#ticket-first-pr-second)
-        - [High-risk areas](#high-risk-areas)
     - [Contents](#contents)
     - [Code of conduct](#code-of-conduct)
+    - [Discuss changes with the NetBird team first](#discuss-changes-with-the-netbird-team-first)
     - [Directory structure](#directory-structure)
     - [Development setup](#development-setup)
         - [Requirements](#requirements)
@@ -81,7 +24,6 @@ visible and nobody duplicates it.
         - [Build and start](#build-and-start)
         - [Test suite](#test-suite)
     - [Checklist before submitting a PR](#checklist-before-submitting-a-pr)
-    - [When we close a PR](#when-we-close-a-pr)
     - [Other project repositories](#other-project-repositories)
     - [Contributor License Agreement](#contributor-license-agreement)
 
@@ -92,66 +34,42 @@ Conduct which can be found in the file [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
 By participating, you are expected to uphold this code. Please report
 unacceptable behavior to community@netbird.io.
 
+## Discuss changes with the NetBird team first
+
+Changes to the **public API**, **gRPC protocols**, **functionality behavior**, **CLI / service flags**, or **new features** should be discussed with the NetBird team before you start the work. These surfaces are part of NetBird's contract with operators, self-hosters, and downstream integrators, and changes to them have compatibility, security, and release-planning implications that benefit from an early conversation.
+
+Open an issue or reach out on [Slack](https://docs.netbird.io/slack-url) to talk through what you have in mind. We'll help shape the change, flag any constraints we know about, and confirm the direction so the PR review can focus on implementation rather than design.
+
+Typical bug fixes, internal refactors, documentation updates, and tests do not need pre-discussion — open the PR directly.
+
 ## Directory structure
 
-The NetBird project monorepo keeps most of each component's code within its own
-directory, except for a few auxiliary or shared packages. Protocol definitions
-and the client-side service clients live under [/shared](/shared), because both
-the agent and the services import them.
+The NetBird project monorepo is organized to maintain most of its individual dependencies code within their directories, except for a few auxiliary or shared packages.
 
-**Agent**
+The most important directories are:
 
+- [/.github](/.github) - Github actions workflow files and issue templates
 - [/client](/client) - NetBird agent code
-- [/client/cmd](/client/cmd) - NetBird agent CLI code
+- [/client/cmd](/client/cmd) - NetBird agent cli code
 - [/client/internal](/client/internal) - NetBird agent business logic code
+- [/client/proto](/client/proto) - NetBird agent daemon GRPC proto files
 - [/client/server](/client/server) - NetBird agent daemon code for background execution
-- [/client/proto](/client/proto) - NetBird agent daemon gRPC proto files
-- [/client/iface](/client/iface) - WireGuard® interface code
-- [/client/firewall](/client/firewall) - Platform firewall backends (nftables, iptables, pf, WFP, userspace)
-- [/client/ssh](/client/ssh) - Built-in SSH server and client
-- [/client/ui](/client/ui) - NetBird agent UI code (Wails v3 + React)
-- [/client/android](/client/android), [/client/ios](/client/ios) - Mobile platform bindings
-- [/client/wasm](/client/wasm) - WebAssembly build of the agent
-- [/client/mdm](/client/mdm) - MDM-delivered policy handling
-- [/client/system](/client/system) - Host and system information collection
-
-**Control plane services**
-
+- [/client/ui](/client/ui) - NetBird agent UI code
+- [/encryption](/encryption) - Contain main encryption code for agent communication
+- [/iface](/iface) - Wireguard® interface code
+- [/infrastructure_files](/infrastructure_files) - Getting started files containing docker and template scripts
 - [/management](/management) - Management service code
+- [/management/client](/management/client) - Management service client code which is imported by the agent code
+- [/management/proto](/management/proto) - Management service GRPC proto files
 - [/management/server](/management/server) - Management service server code
 - [/management/server/http](/management/server/http) - Management service REST API code
-- [/management/server/store](/management/server/store) - Persistence layer and migrations
 - [/management/server/idp](/management/server/idp) - Management service IDP management code
-- [/management/server/peer](/management/server/peer), [/management/server/groups](/management/server/groups), [/management/server/networks](/management/server/networks), [/management/server/posture](/management/server/posture), [/management/server/permissions](/management/server/permissions) - Core domain packages
-- [/signal](/signal) - Signal service code
-- [/signal/peer](/signal/peer) - Signal service peer message logic
-- [/signal/server](/signal/server) - Signal service server code
-- [/relay](/relay) - Relay service code
-- [/relay/protocol](/relay/protocol) - Relay wire protocol
-- [/proxy](/proxy) - Identity-aware proxy used by Agent Network (LLM routing, ACME, access logs)
-- [/agent-network](/agent-network) - Agent Network overview and documentation
-- [/upload-server](/upload-server) - Debug bundle upload service
-
-**Shared code**
-
-- [/shared/management/proto](/shared/management/proto) - Management service gRPC proto files
-- [/shared/management/client](/shared/management/client) - Management service client code which is imported by the agent code
-- [/shared/management/http/api](/shared/management/http/api) - OpenAPI specification and generated REST API types
-- [/shared/signal/proto](/shared/signal/proto) - Signal service gRPC proto files
-- [/shared/signal/client](/shared/signal/client) - Signal service client code which is imported by the agent code
-- [/shared/relay](/shared/relay) - Relay client and shared relay types
-- [/shared/auth](/shared/auth), [/shared/sshauth](/shared/sshauth) - Shared authentication primitives
-- [/encryption](/encryption) - Contain main encryption code for agent communication
-- [/dns](/dns), [/route](/route), [/stun](/stun), [/sharedsock](/sharedsock), [/util](/util) - Shared networking and utility primitives
-- [/flow](/flow) - Flow event protocol shared by the agent and Management
-
-**Build, test, and packaging**
-
-- [/.github](/.github) - Github actions workflow files, issue templates, and the pull request template
-- [/e2e](/e2e) - End-to-end test suites and harness
-- [/infrastructure_files](/infrastructure_files) - Getting started files containing docker and template scripts
 - [/release_files](/release_files) - Files that goes into release packages
-- [/tools](/tools) - Development and maintenance tooling
+- [/signal](/signal) - Signal service code
+- [/signal/client](/signal/client) - Signal service client code which is imported by the agent code
+- [/signal/peer](/signal/peer) - Signal service peer message logic
+- [/signal/proto](/signal/proto) - Signal service GRPC proto files
+- [/signal/server](/signal/server) - Signal service server code
 
 
 ## Development setup
@@ -416,172 +334,23 @@ The installer `netbird-installer.exe` will be created in root directory.
 
 ### Test suite
 
-The host-safe unit tests run as a normal user and leave host networking
-untouched:
+The tests can be started via:
 
 ```
-make test-unit
+cd netbird
+go test -exec sudo ./...
 ```
-
-Tests that need root and mutate host networking (firewall, routing, interface
-management) carry the `privileged` build tag and run inside a
-`--privileged --cap-add=NET_ADMIN` Docker container:
-
-```
-make test-privileged
-```
-
-Narrow a privileged run with environment variables:
-
-```
-PRIV_RUN=TestNftablesManager PRIV_PKGS=./client/firewall/nftables/... make test-privileged
-```
-
-Single packages can be run directly, adding `-race` when the change touches
-shared state:
-
-```
-go test -race ./client/internal/dns/...
-```
-
 > On Windows use a powershell with administrator privileges
 
 ## Checklist before submitting a PR
-
-As a critical network service and open-source project, we must enforce a few
-things before submitting a pull request. The
-[pull request template](/.github/pull_request_template.md) mirrors this list —
-fill it in rather than deleting it.
-
-### Link the issue
-
-The PR description must link the agreed issue (or the validated discussion it
-came from). See [Ticket first, PR second](#ticket-first-pr-second).
-
-### Run it locally
-
-**If you can't run it, you can't submit it.** Build the affected components and
-exercise the change on a real setup — see [Build and start](#build-and-start).
-"CI will tell me" is not acceptable for a VPN agent that runs as root on other
-people's machines.
-
-### Green CI, and answer the bots
-
-We do not start reviewing while CI is red. Get the pipeline green first — a
-failing build, lint, or test means the PR is not ready for review.
-
-Alongside the test workflows, your PR is reviewed by CodeRabbit and scanned by
-SonarCloud, Snyk, and Codecov. Read what they report and either fix it or reply
-with why it does not apply; please do not resolve the threads without a
-response. They are not always right — this codebase has privileged,
-platform-specific, and concurrency-heavy paths that static analysis reads poorly
-— so push back when a finding is wrong rather than changing correct code to
-silence it. Security and dependency findings are the exception: treat those as
-real until shown otherwise. Do not edit workflows, thresholds, or scanner
-configuration to make a check pass.
-
-### One PR, one purpose
-
-Bug fix, refactor, feature: separate PRs. Mixed PRs are slow to review, hard to
-revert, and may be closed with a request to split them.
-
-### Keep it small
-
-Size is the strongest predictor of how long a PR waits for review. Aim for under
-roughly 400 changed lines across under 20 files. Past about 1000 lines or 50
-files, expect to be asked to split the change — and large PRs from outside the
-core team may be blocked until the scope has been agreed in a ticket. This is
-not only about reviewer time: NetBird's agent runs as root on other people's
-machines, and a sprawling diff cannot be reviewed with the care that deserves.
-
-Measure by hand-written code, excluding generated output, `go.sum`, and
-fixtures. If a change genuinely cannot be small — a protocol migration, a
-cross-component rename — agree the split in the issue before you start, and land
-it as a series of PRs that each build and make sense on their own.
-
-### Avoid force-pushing during review
-
-Once a PR is open, push new commits instead of rewriting history. A force-push
-detaches existing review comments from their lines, throws away the
-"changes since your last review" diff, and loses the CI history that showed
-which commit broke what. Since we squash on merge, there is nothing to gain from
-a tidy branch history.
-
-Force-pushing is sometimes unavoidable — rebasing to clear a real conflict, or
-removing a secret or large binary committed by mistake. When that happens, leave
-a comment on the PR so reviewers know their anchors moved.
-
-### Quality checks
-
-Run these from the repository root before pushing:
-
-```shell
-go fmt ./...
-make lint        # golangci-lint on files changed against origin/main
-make lint-all    # full-repository lint, matches CI
-make test-unit   # host-safe unit tests
-```
-
-`make setup-hooks` wires `make lint` into a pre-push hook so the fast lint runs
-automatically. If your change touches privileged paths (firewall, routing,
-interface management), also run `make test-privileged`, which executes the
-`privileged`-tagged suite inside a Docker container with `NET_ADMIN`.
-
-### Code standards
-
+As a critical network service and open-source project, we must enforce a few things before submitting the pull-requests:
 - Keep functions as simple as possible, with a single purpose
 - Use private functions and constants where possible
 - Comment on any new public functions
 - Add unit tests for any new public function
-- Comment the **why**, not the **what** — explain non-obvious decisions, invariants, and constraints, not the line below
-- Keep comments within 90 characters per line and roughly 250 characters per comment; when a block needs more explanation than that, extract a named function instead of writing a longer comment (see [AGENTS.md](AGENTS.md#length-budget))
-
-### PR title and commits
-
-PR titles must start with a bracketed tag, enforced by
-[pr-title-check.yml](/.github/workflows/pr-title-check.yml):
-
-```text
-[client] Authorize daemon IPC callers by their local identity
-[management,client] Add MDM policy support
-```
-
-Use a comma-separated list inside a single pair of brackets when a change spans
-components. The `allowedTags` array in
-[pr-title-check.yml](/.github/workflows/pr-title-check.yml) is the source of
-truth — at the time of writing it accepts `management`, `client`, `signal`,
-`proxy`, `relay`, `misc`, `infrastructure`, `self-hosted`, and `doc`.
-
-Commit subjects follow the same convention — keep them short and put the
-reasoning in the body, why before what, with no bullet list of files changed.
-
-Keep the PR description itself under 1000 words on top of the template text.
-Reviewers read the diff; the description explains what the diff cannot.
 
 > When pushing fixes to the PR comments, please push as separate commits; we will squash the PR before merging, so there is no need to squash it before pushing it, and we are more than okay with 10-100 commits in a single PR. This helps review the fixes to the requested changes.
 
-### Documentation
-
-User-facing changes need a matching PR in
-[netbirdio/docs](https://github.com/netbirdio/docs); link it in the PR
-description, or state why documentation is not needed.
-
-## When we close a PR
-
-We would rather redirect early than let a PR sit. We may close one if:
-
-- It changes behavior with no linked issue, or the approach was never agreed with a maintainer
-- The change was clearly never run or tested locally
-- CI has been red without a response
-- It mixes unrelated purposes, or the purpose is not clear
-- It is far too large to review and the scope was never agreed in a ticket
-- The author cannot answer questions about their own change — including PRs that read as unreviewed model output, where review turns into a relay between the maintainer and an LLM. Tooling is fine; unreviewed output is not, you are responsible for the code you sign your name to
-- There has been no activity for 14 days after we requested changes
-
-A closed PR is not a rejected idea. Take it back to the
-[discussion](https://github.com/netbirdio/netbird/discussions), settle the
-approach, and reopen the work from there.
-
 ## Other project repositories
 
 NetBird project is composed of 3 main repositories:

SECURITY.md

@@ -1,70 +1,12 @@
 # Security Policy
 
-NetBird's goal is to provide a secure network. The client runs as a privileged service on every machine it is installed on,
-so we take reports about it seriously and we publish what we fix.
+NetBird's goal is to provide a secure network. If you find a vulnerability or bug, please report it by opening an issue [here](https://github.com/netbirdio/netbird/issues/new?assignees=&labels=&template=bug-issue-report.md&title=) or by contacting us by email.
+
+There has yet to be an official bug bounty program for the NetBird project.
+
+## Supported Versions
+- We currently support only the latest version
 
 ## Reporting a Vulnerability
 
-**Please do not open a public issue for a security vulnerability.** Public issues are visible to everyone, including before
-a fix is available.
-
-Report security issues one of these two ways:
-
-- **GitHub private vulnerability reporting** — [open a private report](https://github.com/netbirdio/netbird/security/advisories/new)
-  on this repository. This is the preferred route: it keeps the discussion, the draft advisory, and the credit in one place.
-- **Email** — `security@netbird.io`.
-
-If the finding affects NetBird Cloud or our hosted infrastructure rather than the open-source code, email us rather than
-filing a repository report.
-
-### What to include
-
-A report is easier to act on when it contains:
-
-- The affected component (client, management, signal, relay, dashboard) and the version or commit you tested
-- The platform and configuration, where relevant — operating system, self-hosted or NetBird Cloud, container or host install
-- What an attacker needs before they can exploit it: network position, an account, local access, a specific privilege level
-- Steps to reproduce, and a proof of concept if you have one
-- The impact you believe it has
-
-Partial reports are still welcome. If you are unsure whether something is a security issue, send it to `security@netbird.io`
-and let us make that call.
-
-## What to expect from us
-
-- **We acknowledge your report** and tell you whether we can reproduce it.
-- **We work with you on severity and scope.** If we assess it differently than you do, we will explain why rather than
-  silently downgrade it.
-- **We fix and release**, then publish a [GitHub Security Advisory](https://github.com/netbirdio/netbird/security/advisories)
-  naming the affected version range and the patched version.
-- **We credit reporters who want to be credited.** Tell us the name or handle you would like used, or that you would rather
-  stay anonymous.
-- **We keep you in the loop** until the advisory is published.
-
-We ask that you give us a reasonable opportunity to ship a fix before disclosing the issue publicly, and that you avoid
-accessing, modifying, or exfiltrating data belonging to other people while testing. Testing against your own installation
-or your own account is always fine.
-
-## Supported Versions
-
-We support the latest release. Security fixes ship in the next version rather than as backports to older releases, so
-upgrading to the current release is how you get them.
-
-Release notifications are available by watching [releases](https://github.com/netbirdio/netbird/releases).
-
-## Published advisories
-
-Every vulnerability we fix is published as a GitHub Security Advisory on the
-[advisories page](https://github.com/netbirdio/netbird/security/advisories), including the affected version range, the
-patched version, and the reporter's credit. Advisories for the Go module are also distributed through the Go vulnerability
-database, so `govulncheck` will report them against your dependencies.
-
-## Bug bounty
-
-There is no official bug bounty program for the NetBird project. We credit reporters in advisories, and we are grateful for
-the work, but we cannot currently offer payment for reports.
-
-## Non-security bugs
-
-For bugs that are not security issues, please use the
-[issue tracker](https://github.com/netbirdio/netbird/discussions/new/choose).
+Please report security issues to `security@netbird.io`

client/android/client.go

@@ -76,6 +76,8 @@ type Client struct {
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
 	cacheDir      string
+	// Identifies the running profile for the SSO login hint; see profile_state.go.
+	cfgPath string
 
 	stateChangeMu    sync.Mutex
 	stateChangeSubID string
@@ -96,11 +98,12 @@ type Client struct {
 	extendCancel context.CancelFunc
 }
 
-func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cc *internal.ConnectClient) {
+func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cfgPath string, cc *internal.ConnectClient) {
 	c.stateMu.Lock()
 	defer c.stateMu.Unlock()
 	c.config = cfg
 	c.cacheDir = cacheDir
+	c.cfgPath = cfgPath
 	c.connectClient = cc
 }
 
@@ -110,6 +113,16 @@ func (c *Client) stateSnapshot() (*profilemanager.Config, string, *internal.Conn
 	return c.config, c.cacheDir, c.connectClient
 }
 
+// authSnapshot returns the config together with the path it was loaded from, in
+// one lock: the path identifies the profile whose account email backs the login
+// hint, so reading it separately could pair one profile's config with another's
+// hint when a profile switch lands in between.
+func (c *Client) authSnapshot() (*profilemanager.Config, string, *internal.ConnectClient) {
+	c.stateMu.RLock()
+	defer c.stateMu.RUnlock()
+	return c.config, c.cfgPath, c.connectClient
+}
+
 func (c *Client) getConnectClient() *internal.ConnectClient {
 	c.stateMu.RLock()
 	defer c.stateMu.RUnlock()
@@ -162,7 +175,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	defer c.ctxCancel()
 	c.ctxCancelLock.Unlock()
 
-	auth := NewAuthWithConfig(ctx, cfg)
+	auth := NewAuthWithConfig(ctx, cfg, cfgFile)
 	err = auth.login(urlOpener, isAndroidTV)
 	if err != nil {
 		return err
@@ -170,7 +183,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, connectClient)
+	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
 	// only once the fresh connect client is installed: until then Status()
@@ -211,7 +224,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, connectClient)
+	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
 
@@ -301,7 +314,7 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 	uploadCtx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 	defer cancel()
 
-	key, err := debug.UploadDebugBundle(uploadCtx, types.DefaultBundleURL, cfg.ManagementURL.String(), path, false)
+	key, err := debug.UploadDebugBundle(uploadCtx, types.DefaultBundleURL, cfg.ManagementURL.String(), path)
 	if err != nil {
 		return "", fmt.Errorf("upload debug bundle: %w", err)
 	}

client/android/login.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"fmt"
 
+	log "github.com/sirupsen/logrus"
+
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/system"
@@ -53,11 +55,14 @@ func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	}, nil
 }
 
-// NewAuthWithConfig instantiate Auth based on existing config
-func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config) *Auth {
+// NewAuthWithConfig instantiate Auth based on existing config. cfgPath is the
+// file the config was loaded from; it identifies the profile whose account email
+// backs the login_hint.
+func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config, cfgPath string) *Auth {
 	return &Auth{
-		ctx:    ctx,
-		config: config,
+		ctx:     ctx,
+		config:  config,
+		cfgPath: cfgPath,
 	}
 }
 
@@ -150,12 +155,14 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 	}
 
 	jwtToken := ""
+	email := ""
 	if needsLogin {
 		tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 		if err != nil {
 			return fmt.Errorf("interactive sso login failed: %v", err)
 		}
 		jwtToken = tokenInfo.GetTokenToUse()
+		email = tokenInfo.Email
 	}
 
 	err, _ = authClient.Login(a.ctx, "", jwtToken)
@@ -163,17 +170,42 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 		return fmt.Errorf("login failed: %v", err)
 	}
 
+	// Stored after Login, not before: a rejected token must not leave a hint
+	// pointing at an account that cannot be used.
+	if email != "" && a.cfgPath != "" {
+		if err := writeProfileEmail(a.cfgPath, email); err != nil {
+			log.Warnf("failed to store profile account email: %v", err)
+		}
+	}
+
 	go urlOpener.OnLoginSuccess()
 
 	return nil
 }
 
+// loginHintSetter is implemented by both concrete flows (PKCE and device code)
+// but absent from the OAuthFlow interface, hence the assertion below — the same
+// way internal/auth wires it in authenticateWithPKCEFlow.
+type loginHintSetter interface {
+	SetLoginHint(hint string)
+}
+
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
 	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
+	// An empty hint is deliberate, not a fallback: a fresh or logged-out profile
+	// leaves the choice to the IdP, which is how accounts get switched.
+	if a.cfgPath != "" {
+		if hint := readProfileEmail(a.cfgPath); hint != "" {
+			if setter, ok := oAuthFlow.(loginHintSetter); ok {
+				setter.SetLoginHint(hint)
+			}
+		}
+	}
+
 	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
 		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)

client/android/profile_manager.go

@@ -13,18 +13,17 @@ import (
 )
 
 const (
-	// Android-specific config filename (different from desktop default.json)
-	defaultConfigFilename = "netbird.cfg"
-	// Subdirectory for non-default profiles (must match Java Preferences.java)
-	profilesSubdir = "profiles"
 	// Android uses a single user context per app (non-empty username required by ServiceManager)
 	androidUsername = "android"
 )
 
 // Profile represents a profile for gomobile
 type Profile struct {
-	ID       string
-	Name     string
+	ID   string
+	Name string
+	// Email is the account this profile last logged in with, "" if it never
+	// completed an SSO login or was logged out. See profile_state.go.
+	Email    string
 	IsActive bool
 }
 
@@ -101,6 +100,7 @@ func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
 		profiles = append(profiles, &Profile{
 			ID:       p.ID.String(),
 			Name:     p.Name,
+			Email:    pm.profileEmail(p.ID.String()),
 			IsActive: p.IsActive,
 		})
 	}
@@ -123,7 +123,22 @@ func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to resolve active profile %q: %w", activeState.ID, err)
 	}
-	return &Profile{ID: prof.ID.String(), Name: prof.Name, IsActive: true}, nil
+	return &Profile{
+		ID:       prof.ID.String(),
+		Name:     prof.Name,
+		Email:    pm.profileEmail(prof.ID.String()),
+		IsActive: true,
+	}, nil
+}
+
+// profileEmail returns the account email recorded for a profile. Display-only, so
+// an unresolvable path degrades to "" rather than an error.
+func (pm *ProfileManager) profileEmail(id string) string {
+	configPath, err := pm.getProfileConfigPath(id)
+	if err != nil {
+		return ""
+	}
+	return readProfileEmail(configPath)
 }
 
 // SwitchProfile switches to a different profile
@@ -185,6 +200,11 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("failed to save config: %w", err)
 	}
 
+	// Not fatal: a stale hint costs an account switch, not the logout itself.
+	if err := removeProfileEmail(configPath); err != nil {
+		log.Warnf("failed to clear stored account email for profile %s: %v", id, err)
+	}
+
 	log.Infof("logged out from profile: %s", id)
 	return nil
 }

client/android/profile_state.go

@@ -0,0 +1,108 @@
+package android
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/util"
+)
+
+const (
+	// Android-specific config filename (different from desktop default.json)
+	defaultConfigFilename = "netbird.cfg"
+	// Subdirectory for non-default profiles (must match Java Preferences.java)
+	profilesSubdir = "profiles"
+	// profileAccountSuffix names the file holding the profile's account email.
+	// Deliberately not ".state.json", which desktop uses for the same data:
+	// there the email and the engine's state manager live in different
+	// directories, but on Android both resolve under files/, so sharing the name
+	// would have the two overwrite each other — the state manager rewrites the
+	// whole file from its own keys (see statemanager.Manager.PersistState), and
+	// this package's writer does the same in reverse.
+	profileAccountSuffix = ".account.json"
+)
+
+// profileAccountPathFor derives the account file path from a profile's config
+// path: netbird.cfg -> netbird.account.json, <id>.json -> <id>.account.json.
+//
+// Deriving from the config path rather than resolving the active profile keeps
+// the write on the profile the login actually ran for: Auth.login runs in a
+// goroutine, so the active profile can change under a flow already in flight.
+func profileAccountPathFor(configPath string) (string, error) {
+	if configPath == "" {
+		return "", fmt.Errorf("empty config path")
+	}
+
+	base := filepath.Base(configPath)
+	stem := strings.TrimSuffix(base, filepath.Ext(base))
+	if stem == "" || stem == "." {
+		return "", fmt.Errorf("config path %q has no filename stem", configPath)
+	}
+
+	return filepath.Join(filepath.Dir(configPath), stem+profileAccountSuffix), nil
+}
+
+// readProfileEmail returns the account email stored for the profile whose config
+// lives at configPath. A missing or unreadable file yields "", which leaves the
+// account choice to the IdP.
+func readProfileEmail(configPath string) string {
+	accountPath, err := profileAccountPathFor(configPath)
+	if err != nil {
+		log.Debugf("no profile account path for login hint: %v", err)
+		return ""
+	}
+
+	var state profilemanager.ProfileState
+	if _, err := util.ReadJson(accountPath, &state); err != nil {
+		if !os.IsNotExist(err) {
+			log.Debugf("failed to read profile account for login hint: %v", err)
+		}
+		return ""
+	}
+
+	return state.Email
+}
+
+// writeProfileEmail records the account email for the profile whose config lives
+// at configPath, so later logins can pass it as an OIDC login_hint. An empty
+// email is ignored rather than blanking what is already stored.
+func writeProfileEmail(configPath string, email string) error {
+	if email == "" {
+		return nil
+	}
+
+	accountPath, err := profileAccountPathFor(configPath)
+	if err != nil {
+		return fmt.Errorf("resolve profile account path: %w", err)
+	}
+
+	state := profilemanager.ProfileState{Email: email}
+	if err := util.WriteJsonWithRestrictedPermission(context.Background(), accountPath, state); err != nil {
+		return fmt.Errorf("write profile account: %w", err)
+	}
+
+	return nil
+}
+
+// removeProfileEmail drops the stored account email. Called on logout: while the
+// email is on disk it goes out as a login_hint, which would steer the next login
+// straight back into the account just logged out of. Mirrors the desktop UI's
+// RemoveProfileState call.
+func removeProfileEmail(configPath string) error {
+	accountPath, err := profileAccountPathFor(configPath)
+	if err != nil {
+		return fmt.Errorf("resolve profile account path: %w", err)
+	}
+
+	if err := os.Remove(accountPath); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove profile account: %w", err)
+	}
+
+	return nil
+}

client/android/profile_state_test.go

@@ -0,0 +1,161 @@
+package android
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestProfileAccountPathFor(t *testing.T) {
+	tests := []struct {
+		name       string
+		configPath string
+		want       string
+		wantErr    bool
+	}{
+		{
+			name:       "default profile",
+			configPath: "/data/data/io.netbird.client/files/netbird.cfg",
+			want:       "/data/data/io.netbird.client/files/netbird.account.json",
+		},
+		{
+			name:       "id profile",
+			configPath: "/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.json",
+			want:       "/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.account.json",
+		},
+		{
+			name:       "legacy name-keyed profile is handled the same way",
+			configPath: "/data/data/io.netbird.client/files/profiles/work.json",
+			want:       "/data/data/io.netbird.client/files/profiles/work.account.json",
+		},
+		{
+			name:       "empty path is rejected",
+			configPath: "",
+			wantErr:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := profileAccountPathFor(tt.configPath)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("expected an error, got path %q", got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tt.want {
+				t.Errorf("got %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestProfileAccountPathForDefaultDoesNotCollide(t *testing.T) {
+	root := "/data/data/io.netbird.client/files"
+
+	defaultAccount, err := profileAccountPathFor(filepath.Join(root, defaultConfigFilename))
+	if err != nil {
+		t.Fatalf("default profile: %v", err)
+	}
+
+	idAccount, err := profileAccountPathFor(filepath.Join(root, profilesSubdir, "abc123.json"))
+	if err != nil {
+		t.Fatalf("id profile: %v", err)
+	}
+
+	if defaultAccount == idAccount {
+		t.Fatalf("default and id profile share an account file: %q", defaultAccount)
+	}
+}
+
+// The account file must never land on the engine state file: on Android both
+// resolve under files/, and the state manager rewrites the whole file from its
+// own keys, so sharing a path would have the two overwrite each other. The
+// expected names here mirror ProfileManager.GetStateFilePath.
+func TestProfileAccountPathAvoidsEngineStateFile(t *testing.T) {
+	root := "/data/data/io.netbird.client/files"
+
+	cases := []struct {
+		configPath  string
+		engineState string
+	}{
+		{
+			configPath:  filepath.Join(root, defaultConfigFilename),
+			engineState: filepath.Join(root, "state.json"),
+		},
+		{
+			configPath:  filepath.Join(root, profilesSubdir, "abc123.json"),
+			engineState: filepath.Join(root, profilesSubdir, "abc123.state.json"),
+		},
+	}
+
+	for _, c := range cases {
+		account, err := profileAccountPathFor(c.configPath)
+		if err != nil {
+			t.Fatalf("%s: %v", c.configPath, err)
+		}
+		if account == c.engineState {
+			t.Errorf("account file collides with the engine state file: %q", account)
+		}
+	}
+}
+
+func TestWriteThenReadProfileEmail(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
+	if err := ensureDirFor(t, configPath); err != nil {
+		t.Fatalf("prepare dir: %v", err)
+	}
+
+	if got := readProfileEmail(configPath); got != "" {
+		t.Errorf("expected no email before a login, got %q", got)
+	}
+
+	const email = "user@example.com"
+	if err := writeProfileEmail(configPath, email); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	if got := readProfileEmail(configPath); got != email {
+		t.Errorf("got %q, want %q", got, email)
+	}
+
+	if err := removeProfileEmail(configPath); err != nil {
+		t.Fatalf("remove: %v", err)
+	}
+	if got := readProfileEmail(configPath); got != "" {
+		t.Errorf("expected no email after logout, got %q", got)
+	}
+
+	// Logout may run on a never-logged-in profile, so a second remove must pass.
+	if err := removeProfileEmail(configPath); err != nil {
+		t.Fatalf("second remove should be a no-op: %v", err)
+	}
+}
+
+func TestWriteProfileEmailIgnoresEmpty(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
+	if err := ensureDirFor(t, configPath); err != nil {
+		t.Fatalf("prepare dir: %v", err)
+	}
+
+	const email = "user@example.com"
+	if err := writeProfileEmail(configPath, email); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	if err := writeProfileEmail(configPath, ""); err != nil {
+		t.Fatalf("write empty: %v", err)
+	}
+
+	if got := readProfileEmail(configPath); got != email {
+		t.Errorf("empty write clobbered the stored email: got %q, want %q", got, email)
+	}
+}
+
+func ensureDirFor(t *testing.T, path string) error {
+	t.Helper()
+	return os.MkdirAll(filepath.Dir(path), 0o700)
+}

client/android/session.go

@@ -278,7 +278,7 @@ func (c *Client) endExtend() {
 }
 
 func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isAndroidTV bool) error {
-	cfg, _, cc := c.stateSnapshot()
+	cfg, cfgPath, cc := c.authSnapshot()
 	if cfg == nil || cc == nil {
 		return fmt.Errorf("engine is not running")
 	}
@@ -293,7 +293,10 @@ func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isA
 	}
 	defer authClient.Close()
 
-	a := &Auth{ctx: ctx, config: cfg}
+	// Passing the config path makes the flow pick up the login_hint: an extend
+	// renews the session of the account already signed in, so it must not stop to
+	// offer a choice.
+	a := NewAuthWithConfig(ctx, cfg, cfgPath)
 	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 	if err != nil {
 		return fmt.Errorf("interactive sso login failed: %v", err)

client/cmd/debug.go

@@ -29,9 +29,8 @@ const errCloseConnection = "Failed to close connection: %v"
 var (
 	logFileCount        uint32
 	systemInfoFlag      bool
-	uploadBundleFlag         bool
-	uploadBundleURLFlag      string
-	uploadBundleInsecureFlag bool
+	uploadBundleFlag    bool
+	uploadBundleURLFlag string
 )
 
 var debugCmd = &cobra.Command{
@@ -175,11 +174,10 @@ func debugBundle(cmd *cobra.Command, _ []string) error {
 	}
 	if uploadBundleFlag {
 		request.UploadURL = uploadBundleURLFlag
-		request.UploadInsecure = uploadBundleInsecureFlag
 	}
 	resp, err := client.DebugBundle(cmd.Context(), request)
 	if err != nil {
-		return daemonCallError("bundle debug", err)
+		return fmt.Errorf("failed to bundle debug: %v", status.Convert(err).Message())
 	}
 	cmd.Printf("Local file:\n%s\n", resp.GetPath())
 
@@ -375,11 +373,10 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 	}
 	if uploadBundleFlag {
 		request.UploadURL = uploadBundleURLFlag
-		request.UploadInsecure = uploadBundleInsecureFlag
 	}
 	resp, err := client.DebugBundle(cmd.Context(), request)
 	if err != nil {
-		return daemonCallError("bundle debug", err)
+		return fmt.Errorf("failed to bundle debug: %v", status.Convert(err).Message())
 	}
 
 	if needsRestoreUp {
@@ -527,12 +524,10 @@ func init() {
 	debugBundleCmd.Flags().BoolVarP(&systemInfoFlag, "system-info", "S", true, "Adds system information to the debug bundle")
 	debugBundleCmd.Flags().BoolVarP(&uploadBundleFlag, "upload-bundle", "U", false, "Uploads the debug bundle to a server")
 	debugBundleCmd.Flags().StringVar(&uploadBundleURLFlag, "upload-bundle-url", types.DefaultBundleURL, "Service URL to get an URL to upload the debug bundle")
-	debugBundleCmd.Flags().BoolVar(&uploadBundleInsecureFlag, "upload-bundle-insecure", false, "Allow uploading to an http or untrusted-TLS upload server (self-hosted); requires root")
 
 	forCmd.Flags().Uint32VarP(&logFileCount, "log-file-count", "C", 1, "Number of rotated log files to include in debug bundle")
 	forCmd.Flags().BoolVarP(&systemInfoFlag, "system-info", "S", true, "Adds system information to the debug bundle")
 	forCmd.Flags().BoolVarP(&uploadBundleFlag, "upload-bundle", "U", false, "Uploads the debug bundle to a server")
 	forCmd.Flags().StringVar(&uploadBundleURLFlag, "upload-bundle-url", types.DefaultBundleURL, "Service URL to get an URL to upload the debug bundle")
-	forCmd.Flags().BoolVar(&uploadBundleInsecureFlag, "upload-bundle-insecure", false, "Allow uploading to an http or untrusted-TLS upload server (self-hosted); requires root")
 	forCmd.Flags().Bool("capture", false, "Capture packets during the debug duration and include in bundle")
 }

client/configs/configs.go

@@ -6,11 +6,6 @@ import (
 	"runtime"
 )
 
-// UILogFile is the file name the desktop UI writes its log to. It is defined
-// here so the UI (writer), the daemon's RegisterUILog validation, and the debug
-// bundle collector all share one definition.
-const UILogFile = "gui-client.log"
-
 var StateDir string
 
 func init() {

client/firewall/nftables/legacy_rule_linux_test.go

@@ -1,60 +0,0 @@
-package nftables
-
-import (
-	"testing"
-
-	"github.com/google/nftables/expr"
-	"github.com/stretchr/testify/require"
-)
-
-func TestBuildLegacyRouteRuleExpressions(t *testing.T) {
-	sourcePayload := &expr.Payload{}
-	sourceCmp := &expr.Cmp{}
-	destinationPayload := &expr.Payload{}
-	destinationCmp := &expr.Cmp{}
-	nilSourceDestination := &expr.Payload{}
-	nilDestinationSource := &expr.Cmp{}
-
-	tests := []struct {
-		name        string
-		source      []expr.Any
-		destination []expr.Any
-		matches     []expr.Any
-	}{
-		{
-			name:        "both non-empty",
-			source:      []expr.Any{sourcePayload, sourceCmp},
-			destination: []expr.Any{destinationPayload, destinationCmp},
-			matches:     []expr.Any{sourcePayload, sourceCmp, destinationPayload, destinationCmp},
-		},
-		{
-			name:        "nil source",
-			destination: []expr.Any{nilSourceDestination},
-			matches:     []expr.Any{nilSourceDestination},
-		},
-		{
-			name:    "nil destination",
-			source:  []expr.Any{nilDestinationSource},
-			matches: []expr.Any{nilDestinationSource},
-		},
-		{
-			name: "both nil",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := buildLegacyRouteRuleExpressions(tt.source, tt.destination)
-
-			require.Len(t, got, len(tt.matches)+2)
-			for i, match := range tt.matches {
-				require.Same(t, match, got[i])
-			}
-
-			require.IsType(t, &expr.Counter{}, got[len(tt.matches)])
-			verdict, ok := got[len(tt.matches)+1].(*expr.Verdict)
-			require.True(t, ok)
-			require.Equal(t, expr.VerdictAccept, verdict.Kind)
-		})
-	}
-}

client/firewall/nftables/router_linux.go

@@ -953,17 +953,6 @@ func (r *router) addMSSClampingRules() error {
 	return r.conn.Flush()
 }
 
-func buildLegacyRouteRuleExpressions(sourceExp, destExp []expr.Any) []expr.Any {
-	exprs := make([]expr.Any, 0, len(sourceExp)+len(destExp)+2)
-	exprs = append(exprs, sourceExp...)
-	exprs = append(exprs, destExp...)
-	exprs = append(exprs,
-		&expr.Counter{},
-		&expr.Verdict{Kind: expr.VerdictAccept},
-	)
-	return exprs
-}
-
 // addLegacyRouteRule adds a legacy routing rule for mgmt servers pre route acls
 func (r *router) addLegacyRouteRule(pair firewall.RouterPair) error {
 	sourceExp, err := r.applyNetwork(pair.Source, nil, true)
@@ -976,7 +965,15 @@ func (r *router) addLegacyRouteRule(pair firewall.RouterPair) error {
 		return fmt.Errorf("apply destination: %w", err)
 	}
 
-	exprs := buildLegacyRouteRuleExpressions(sourceExp, destExp)
+	exprs := []expr.Any{
+		&expr.Counter{},
+		&expr.Verdict{
+			Kind: expr.VerdictAccept,
+		},
+	}
+
+	exprs = append(exprs, sourceExp...)
+	exprs = append(exprs, destExp...)
 
 	ruleKey := firewall.GenKey(firewall.ForwardingFormat, pair)
 

client/internal/debug/debug.go

@@ -229,6 +229,7 @@ scutil_dns.txt (macOS only):
 
 const (
 	clientLogFile = "client.log"
+	uiLogFile     = "gui-client.log"
 	errorLogFile  = "netbird.err"
 	stdoutLogFile = "netbird.out"
 
@@ -247,20 +248,6 @@ type MetricsExporter interface {
 	Export(w io.Writer) error
 }
 
-// LogOpener opens a log file for inclusion in the bundle. It exists so that log
-// files whose path was supplied by an IPC caller can be opened under a check
-// the daemon defines, instead of being opened with the daemon's privileges
-// unconditionally.
-type LogOpener func(path string) (*os.File, error)
-
-func openLogFile(path string) (*os.File, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, fmt.Errorf("open %s: %w", path, err)
-	}
-	return f, nil
-}
-
 type BundleGenerator struct {
 	anonymizer *anonymize.Anonymizer
 
@@ -270,7 +257,6 @@ type BundleGenerator struct {
 	syncResponse   *mgmProto.SyncResponse
 	logPath        string
 	uiLogPath      string
-	uiLogOpener    LogOpener
 	tempDir        string
 	statePath      string
 	cpuProfile     []byte
@@ -299,20 +285,14 @@ type GeneratorDependencies struct {
 	SyncResponse   *mgmProto.SyncResponse
 	LogPath        string
 	UILogPath      string // Absolute path to the desktop UI's gui-client.log, reported via RegisterUILog. Empty if no UI registered one.
-	// UILogOpener opens the UI log and its rotated siblings. The path comes from
-	// a local IPC caller, so the daemon must not open it with plain os.Open: the
-	// opener is where the caller's right to that file is enforced. Defaults to
-	// os.Open, which is only correct where the path is not caller-supplied
-	// (mobile).
-	UILogOpener   LogOpener
-	TempDir       string // Directory for temporary bundle zip files. If empty, os.TempDir() is used.
-	StatePath     string // Path to the state file. If empty, the ServiceManager default path is used.
-	CPUProfile    []byte
-	CapturePath   string
-	RefreshStatus func()
-	ClientMetrics MetricsExporter
-	DaemonVersion string
-	CliVersion    string
+	TempDir        string // Directory for temporary bundle zip files. If empty, os.TempDir() is used.
+	StatePath      string // Path to the state file. If empty, the ServiceManager default path is used.
+	CPUProfile     []byte
+	CapturePath    string
+	RefreshStatus  func()
+	ClientMetrics  MetricsExporter
+	DaemonVersion  string
+	CliVersion     string
 }
 
 func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGenerator {
@@ -322,11 +302,6 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		logFileCount = 1
 	}
 
-	uiLogOpener := deps.UILogOpener
-	if uiLogOpener == nil {
-		uiLogOpener = openLogFile
-	}
-
 	return &BundleGenerator{
 		anonymizer: anonymize.NewAnonymizer(anonymize.DefaultAddresses()),
 
@@ -335,7 +310,6 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		syncResponse:   deps.SyncResponse,
 		logPath:        deps.LogPath,
 		uiLogPath:      deps.UILogPath,
-		uiLogOpener:    uiLogOpener,
 		tempDir:        deps.TempDir,
 		statePath:      deps.StatePath,
 		cpuProfile:     deps.CPUProfile,
@@ -1022,11 +996,11 @@ func (g *BundleGenerator) addLogfile() error {
 
 	logDir := filepath.Dir(g.logPath)
 
-	if err := g.addSingleLogfile(openLogFile, g.logPath, clientLogFile); err != nil {
+	if err := g.addSingleLogfile(g.logPath, clientLogFile); err != nil {
 		return fmt.Errorf("add client log file to zip: %w", err)
 	}
 
-	g.addRotatedLogFiles(openLogFile, logDir, clientLogPrefix)
+	g.addRotatedLogFiles(logDir, clientLogPrefix)
 
 	stdErrLogPath := filepath.Join(logDir, errorLogFile)
 	stdoutLogPath := filepath.Join(logDir, stdoutLogFile)
@@ -1035,11 +1009,11 @@ func (g *BundleGenerator) addLogfile() error {
 		stdoutLogPath = darwinStdoutLogPath
 	}
 
-	if err := g.addSingleLogfile(openLogFile, stdErrLogPath, errorLogFile); err != nil {
+	if err := g.addSingleLogfile(stdErrLogPath, errorLogFile); err != nil {
 		log.Warnf("Failed to add %s to zip: %v", errorLogFile, err)
 	}
 
-	if err := g.addSingleLogfile(openLogFile, stdoutLogPath, stdoutLogFile); err != nil {
+	if err := g.addSingleLogfile(stdoutLogPath, stdoutLogFile); err != nil {
 		log.Warnf("Failed to add %s to zip: %v", stdoutLogFile, err)
 	}
 
@@ -1056,18 +1030,18 @@ func (g *BundleGenerator) addUILog() error {
 		return nil
 	}
 
-	if err := g.addSingleLogfile(g.uiLogOpener, g.uiLogPath, configs.UILogFile); err != nil {
+	if err := g.addSingleLogfile(g.uiLogPath, uiLogFile); err != nil {
 		return fmt.Errorf("add UI log file to zip: %w", err)
 	}
 
-	g.addRotatedLogFiles(g.uiLogOpener, filepath.Dir(g.uiLogPath), uiLogPrefix)
+	g.addRotatedLogFiles(filepath.Dir(g.uiLogPath), uiLogPrefix)
 
 	return nil
 }
 
 // addSingleLogfile adds a single log file to the archive
-func (g *BundleGenerator) addSingleLogfile(open LogOpener, logPath, targetName string) error {
-	logFile, err := open(logPath)
+func (g *BundleGenerator) addSingleLogfile(logPath, targetName string) error {
+	logFile, err := os.Open(logPath)
 	if err != nil {
 		return fmt.Errorf("open log file %s: %w", targetName, err)
 	}
@@ -1092,8 +1066,8 @@ func (g *BundleGenerator) addSingleLogfile(open LogOpener, logPath, targetName s
 }
 
 // addSingleLogFileGz adds a single gzipped log file to the archive
-func (g *BundleGenerator) addSingleLogFileGz(open LogOpener, logPath, targetName string) error {
-	f, err := open(logPath)
+func (g *BundleGenerator) addSingleLogFileGz(logPath, targetName string) error {
+	f, err := os.Open(logPath)
 	if err != nil {
 		return fmt.Errorf("open gz log file %s: %w", targetName, err)
 	}
@@ -1140,7 +1114,7 @@ func (g *BundleGenerator) addSingleLogFileGz(open LogOpener, logPath, targetName
 // addRotatedLogFiles adds rotated log files to the bundle based on logFileCount.
 // prefix is the base log name without extension (e.g. "client", "gui-client");
 // the glob matches both files rotated by us and by logrotate on linux.
-func (g *BundleGenerator) addRotatedLogFiles(open LogOpener, logDir, prefix string) {
+func (g *BundleGenerator) addRotatedLogFiles(logDir, prefix string) {
 	if g.logFileCount == 0 {
 		return
 	}
@@ -1180,9 +1154,9 @@ func (g *BundleGenerator) addRotatedLogFiles(open LogOpener, logDir, prefix stri
 	for i := 0; i < maxFiles; i++ {
 		name := filepath.Base(files[i])
 		if strings.HasSuffix(name, ".gz") {
-			err = g.addSingleLogFileGz(open, files[i], name)
+			err = g.addSingleLogFileGz(files[i], name)
 		} else {
-			err = g.addSingleLogfile(open, files[i], name)
+			err = g.addSingleLogfile(files[i], name)
 		}
 		if err != nil {
 			log.Warnf("failed to add rotated log %s: %v", name, err)

client/internal/debug/debug_ios.go

@@ -27,7 +27,7 @@ func (g *BundleGenerator) addPlatformLog() error {
 	}
 
 	swiftLogPath := filepath.Join(filepath.Dir(g.logPath), swiftLogFile)
-	if err := g.addSingleLogfile(openLogFile, swiftLogPath, swiftLogFile); err != nil {
+	if err := g.addSingleLogfile(swiftLogPath, swiftLogFile); err != nil {
 		// The Swift log is best-effort: the app may not have written it yet.
 		log.Warnf("failed to add %s to debug bundle: %v", swiftLogFile, err)
 	}

client/internal/debug/debug_logfiles_test.go

@@ -97,7 +97,7 @@ func runAddRotatedLogFilesPrefix(t *testing.T, dir, prefix string, logFileCount
 		archive:      zip.NewWriter(&buf),
 		logFileCount: logFileCount,
 	}
-	g.addRotatedLogFiles(openLogFile, dir, prefix)
+	g.addRotatedLogFiles(dir, prefix)
 	require.NoError(t, g.archive.Close())
 
 	zr, err := zip.NewReader(bytes.NewReader(buf.Bytes()), int64(buf.Len()))

client/internal/debug/uilog_test.go

@@ -1,64 +0,0 @@
-package debug
-
-import (
-	"archive/zip"
-	"bytes"
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/configs"
-)
-
-// bundleEntries generates a bundle with the given generator and returns the
-// set of entry names in the resulting archive.
-func bundleEntries(t *testing.T, g *BundleGenerator) map[string]struct{} {
-	t.Helper()
-
-	path, err := g.Generate()
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = os.Remove(path) })
-
-	data, err := os.ReadFile(path)
-	require.NoError(t, err)
-
-	zr, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
-	require.NoError(t, err)
-
-	names := make(map[string]struct{}, len(zr.File))
-	for _, f := range zr.File {
-		names[f.Name] = struct{}{}
-	}
-	return names
-}
-
-func TestBundleIncludesUILogWhenOpenerAllows(t *testing.T) {
-	path := filepath.Join(t.TempDir(), configs.UILogFile)
-	require.NoError(t, os.WriteFile(path, []byte("gui log"), 0600))
-
-	g := NewBundleGenerator(GeneratorDependencies{
-		UILogPath:   path,
-		UILogOpener: openLogFile,
-	}, BundleConfig{})
-
-	require.Contains(t, bundleEntries(t, g), configs.UILogFile)
-}
-
-// A UILogOpener that refuses (as the ownership check does for a foreign file)
-// keeps the UI log out of the bundle without failing bundle generation.
-func TestBundleExcludesUILogWhenOpenerRefuses(t *testing.T) {
-	path := filepath.Join(t.TempDir(), configs.UILogFile)
-	require.NoError(t, os.WriteFile(path, []byte("secret"), 0600))
-
-	g := NewBundleGenerator(GeneratorDependencies{
-		UILogPath: path,
-		UILogOpener: func(string) (*os.File, error) {
-			return nil, fmt.Errorf("not owned by the caller")
-		},
-	}, BundleConfig{})
-
-	require.NotContains(t, bundleEntries(t, g), configs.UILogFile)
-}

client/internal/debug/upload.go

@@ -3,12 +3,10 @@ package debug
 import (
 	"context"
 	"crypto/sha256"
-	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
-	neturl "net/url"
 	"os"
 
 	"github.com/netbirdio/netbird/upload-server/types"
@@ -16,80 +14,20 @@ import (
 
 const maxBundleUploadSize = 50 * 1024 * 1024
 
-// requireHTTPS refuses any URL the daemon would fetch or upload to that is not
-// https. The daemon runs as root and the bundle carries its logs and state, so a
-// plaintext hop is a place to intercept the bundle or the presigned redirect.
-// The server-side gate already enforces this for the desktop path; this also
-// covers the mobile and job-runner callers that reach this package directly.
-// Skipped when the caller opted into an insecure upload (self-hosted server).
-func requireHTTPS(what, rawURL string) error {
-	parsed, err := neturl.Parse(rawURL)
-	if err != nil {
-		return fmt.Errorf("parse %s: %w", what, err)
-	}
-	if parsed.Scheme != "https" {
-		return fmt.Errorf("%s must use https, got scheme %q", what, parsed.Scheme)
-	}
-	return nil
-}
-
-// uploadClient returns the HTTP client for the upload requests. The default
-// client verifies TLS and refuses a redirect that would downgrade to a non-https
-// hop, so a bundle can never leave over http after an https start. The insecure
-// variant accepts http and untrusted certificates, and is only reachable for a
-// privileged caller that passed --upload-bundle-insecure (see
-// requirePrivilegeForUploadURL).
-func uploadClient(insecure bool) *http.Client {
-	if !insecure {
-		return &http.Client{CheckRedirect: rejectInsecureRedirect}
-	}
-	return &http.Client{
-		Transport: &http.Transport{
-			//nolint:gosec // opt-in, privileged, self-hosted upload servers
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true, MinVersion: tls.VersionTLS12},
-		},
-	}
-}
-
-// rejectInsecureRedirect refuses a redirect to a non-https target and keeps the
-// standard library's 10-hop limit that a custom CheckRedirect would otherwise
-// disable.
-func rejectInsecureRedirect(req *http.Request, via []*http.Request) error {
-	if req.URL.Scheme != "https" {
-		return fmt.Errorf("refusing redirect to non-https URL %s", req.URL.Redacted())
-	}
-	if len(via) >= 10 {
-		return fmt.Errorf("stopped after 10 redirects")
-	}
-	return nil
-}
-
-func UploadDebugBundle(ctx context.Context, url, managementURL, filePath string, insecure bool) (key string, err error) {
-	if !insecure {
-		if err := requireHTTPS("upload service URL", url); err != nil {
-			return "", err
-		}
-	}
-
-	response, err := getUploadURL(ctx, url, managementURL, insecure)
+func UploadDebugBundle(ctx context.Context, url, managementURL, filePath string) (key string, err error) {
+	response, err := getUploadURL(ctx, url, managementURL)
 	if err != nil {
 		return "", err
 	}
 
-	if !insecure {
-		if err := requireHTTPS("upload URL from service", response.URL); err != nil {
-			return "", err
-		}
-	}
-
-	err = upload(ctx, filePath, response, insecure)
+	err = upload(ctx, filePath, response)
 	if err != nil {
 		return "", err
 	}
 	return response.Key, nil
 }
 
-func upload(ctx context.Context, filePath string, response *types.GetURLResponse, insecure bool) error {
+func upload(ctx context.Context, filePath string, response *types.GetURLResponse) error {
 	fileData, err := os.Open(filePath)
 	if err != nil {
 		return fmt.Errorf("open file: %w", err)
@@ -114,7 +52,7 @@ func upload(ctx context.Context, filePath string, response *types.GetURLResponse
 	req.ContentLength = stat.Size()
 	req.Header.Set("Content-Type", "application/octet-stream")
 
-	putResp, err := uploadClient(insecure).Do(req)
+	putResp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return fmt.Errorf("upload failed: %v", err)
 	}
@@ -127,23 +65,16 @@ func upload(ctx context.Context, filePath string, response *types.GetURLResponse
 	return nil
 }
 
-func getUploadURL(ctx context.Context, serviceURL string, managementURL string, insecure bool) (*types.GetURLResponse, error) {
-	parsed, err := neturl.Parse(serviceURL)
-	if err != nil {
-		return nil, fmt.Errorf("parse upload service URL: %w", err)
-	}
-	q := parsed.Query()
-	q.Set("id", getURLHash(managementURL))
-	parsed.RawQuery = q.Encode()
-
-	getReq, err := http.NewRequestWithContext(ctx, "GET", parsed.String(), nil)
+func getUploadURL(ctx context.Context, url string, managementURL string) (*types.GetURLResponse, error) {
+	id := getURLHash(managementURL)
+	getReq, err := http.NewRequestWithContext(ctx, "GET", url+"?id="+id, nil)
 	if err != nil {
 		return nil, fmt.Errorf("create GET request: %w", err)
 	}
 
 	getReq.Header.Set(types.ClientHeader, types.ClientHeaderValue)
 
-	resp, err := uploadClient(insecure).Do(getReq)
+	resp, err := http.DefaultClient.Do(getReq)
 	if err != nil {
 		return nil, fmt.Errorf("get presigned URL: %w", err)
 	}

client/internal/debug/upload_test.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"net"
 	"net/http"
-	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
@@ -44,7 +43,7 @@ func TestUpload(t *testing.T) {
 	fileContent := []byte("test file content")
 	err := os.WriteFile(file, fileContent, 0640)
 	require.NoError(t, err)
-	key, err := UploadDebugBundle(context.Background(), testURL+types.GetURLPath, testURL, file, true)
+	key, err := UploadDebugBundle(context.Background(), testURL+types.GetURLPath, testURL, file)
 	require.NoError(t, err)
 	id := getURLHash(testURL)
 	require.Contains(t, key, id+"/")
@@ -80,47 +79,3 @@ func waitForServer(t *testing.T, addr string) {
 	}
 	t.Fatalf("server did not start listening on %s in time", addr)
 }
-
-func TestRequireHTTPS(t *testing.T) {
-	require.NoError(t, requireHTTPS("upload URL", "https://upload.example/path"))
-	require.Error(t, requireHTTPS("upload URL", "http://upload.example/path"))
-	require.Error(t, requireHTTPS("upload URL", "ftp://upload.example/path"))
-	require.Error(t, requireHTTPS("upload URL", "://malformed"))
-}
-
-func TestRejectInsecureRedirect(t *testing.T) {
-	httpsReq, err := http.NewRequest(http.MethodGet, "https://a.example/", nil)
-	require.NoError(t, err)
-	require.NoError(t, rejectInsecureRedirect(httpsReq, nil), "https redirect target must be allowed")
-
-	httpReq, err := http.NewRequest(http.MethodGet, "http://a.example/", nil)
-	require.NoError(t, err)
-	require.Error(t, rejectInsecureRedirect(httpReq, nil), "http redirect target must be refused")
-
-	require.Error(t, rejectInsecureRedirect(httpsReq, make([]*http.Request, 10)), "the 10-redirect limit must be enforced")
-}
-
-// The secure client refuses to follow an https response that redirects to http,
-// so a bundle can't be downgraded onto plaintext mid-flight.
-func TestUploadClientRefusesHTTPSToHTTPRedirect(t *testing.T) {
-	plain := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-	t.Cleanup(plain.Close)
-
-	secure := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Redirect(w, r, plain.URL, http.StatusFound)
-	}))
-	t.Cleanup(secure.Close)
-
-	client := uploadClient(false)
-	// Trust the test server's cert without disabling verification globally.
-	client.Transport = secure.Client().Transport
-
-	resp, err := client.Get(secure.URL)
-	if resp != nil {
-		_ = resp.Body.Close()
-	}
-	require.Error(t, err, "redirect from https to http must be refused")
-	require.Contains(t, err.Error(), "non-https")
-}

client/internal/ipcauth/ownedfile.go

@@ -1,63 +0,0 @@
-package ipcauth
-
-import (
-	"fmt"
-	"os"
-)
-
-// OpenOwnedFile opens path for reading on behalf of the IPC caller identified by
-// id, and fails unless the opened file is a regular file that id owns.
-//
-// It exists for the paths a local caller hands to the daemon over the IPC. The
-// daemon runs as root, so opening such a path unchecked lets any local user read
-// any file through it. Ownership is the invariant that keeps the daemon from
-// reading, with its own privileges, a file the caller could not read itself: a
-// symlink or hard link planted at the path resolves to a file someone else owns
-// and is refused.
-//
-// The check is made against the open descriptor rather than the path, so
-// swapping the path between the check and the read cannot change the answer.
-//
-// A privileged caller is exempt: it can read the file directly, so refusing it
-// here would protect nothing. The regular-file requirement still applies to
-// everyone, since a fifo or device planted at the path is never a log file.
-func OpenOwnedFile(id Identity, path string) (*os.File, error) {
-	f, err := openForRead(path)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := checkOwnership(id, f); err != nil {
-		if cerr := f.Close(); cerr != nil {
-			return nil, fmt.Errorf("%w (close: %v)", err, cerr)
-		}
-		return nil, err
-	}
-
-	return f, nil
-}
-
-func checkOwnership(id Identity, f *os.File) error {
-	info, err := f.Stat()
-	if err != nil {
-		return fmt.Errorf("stat %s: %w", f.Name(), err)
-	}
-
-	if !info.Mode().IsRegular() {
-		return fmt.Errorf("%s is not a regular file", f.Name())
-	}
-
-	if IsPrivilegedCaller(id) {
-		return nil
-	}
-
-	owned, err := fileOwnedBy(id, f)
-	if err != nil {
-		return fmt.Errorf("read owner of %s: %w", f.Name(), err)
-	}
-	if !owned {
-		return fmt.Errorf("%s is not owned by the caller (%s)", f.Name(), id)
-	}
-
-	return nil
-}

client/internal/ipcauth/ownedfile_test.go

@@ -1,64 +0,0 @@
-package ipcauth
-
-import (
-	"io"
-	"os"
-	"path/filepath"
-	"runtime"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// otherIdentity is an unprivileged caller that owns nothing the test creates.
-func otherIdentity(t *testing.T) Identity {
-	t.Helper()
-	if runtime.GOOS == "windows" {
-		return Identity{SID: "S-1-5-21-1-2-3-1001"}
-	}
-	return Identity{UID: uint32(os.Geteuid() + 1), GID: uint32(os.Getegid() + 1)}
-}
-
-func TestOpenOwnedFileReadsFileOwnedByCaller(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "gui-client.log")
-	require.NoError(t, os.WriteFile(path, []byte("hello"), 0600))
-
-	id, err := CurrentProcessIdentity()
-	require.NoError(t, err)
-
-	f, err := OpenOwnedFile(id, path)
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = f.Close() })
-
-	content, err := io.ReadAll(f)
-	require.NoError(t, err)
-	require.Equal(t, "hello", string(content))
-}
-
-func TestOpenOwnedFileRefusesFileOwnedByAnother(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "gui-client.log")
-	require.NoError(t, os.WriteFile(path, []byte("secret"), 0600))
-
-	_, err := OpenOwnedFile(otherIdentity(t), path)
-	require.ErrorContains(t, err, "not owned by the caller")
-}
-
-func TestOpenOwnedFileRefusesNonRegularFile(t *testing.T) {
-	dir := t.TempDir()
-
-	// The caller owns the directory, so this is the regular-file requirement
-	// talking, not the ownership check.
-	id, err := CurrentProcessIdentity()
-	require.NoError(t, err)
-
-	_, err = OpenOwnedFile(id, dir)
-	require.ErrorContains(t, err, "not a regular file")
-}
-
-func TestOpenOwnedFileRefusesMissingFile(t *testing.T) {
-	id, err := CurrentProcessIdentity()
-	require.NoError(t, err)
-
-	_, err = OpenOwnedFile(id, filepath.Join(t.TempDir(), "absent.log"))
-	require.Error(t, err)
-}

client/internal/ipcauth/ownedfile_unix.go

@@ -1,35 +0,0 @@
-//go:build !windows
-
-package ipcauth
-
-import (
-	"fmt"
-	"os"
-	"syscall"
-)
-
-// openForRead opens a caller-supplied path without following a symlink at its
-// final component and without blocking: a fifo planted at the path would
-// otherwise stall the open until a writer appears, and the daemon holds a lock
-// while it collects the file.
-func openForRead(path string) (*os.File, error) {
-	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
-	if err != nil {
-		return nil, fmt.Errorf("open %s: %w", path, err)
-	}
-	return f, nil
-}
-
-func fileOwnedBy(id Identity, f *os.File) (bool, error) {
-	info, err := f.Stat()
-	if err != nil {
-		return false, err
-	}
-
-	stat, ok := info.Sys().(*syscall.Stat_t)
-	if !ok {
-		return false, fmt.Errorf("no owner information in %T", info.Sys())
-	}
-
-	return stat.Uid == id.UID, nil
-}

client/internal/ipcauth/ownedfile_unix_test.go

@@ -1,57 +0,0 @@
-//go:build !windows
-
-package ipcauth
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-// A symlink is the shape the arbitrary-read attempt takes: the caller owns the
-// link, the file it points at belongs to someone else.
-func TestOpenOwnedFileRefusesSymlink(t *testing.T) {
-	dir := t.TempDir()
-	target := filepath.Join(dir, "target.log")
-	require.NoError(t, os.WriteFile(target, []byte("secret"), 0600))
-
-	link := filepath.Join(dir, "gui-client.log")
-	require.NoError(t, os.Symlink(target, link))
-
-	id, err := CurrentProcessIdentity()
-	require.NoError(t, err)
-
-	_, err = OpenOwnedFile(id, link)
-	// O_NOFOLLOW on a symlink reports ELOOP on Linux/Darwin and EMLINK on FreeBSD.
-	if !errors.Is(err, syscall.ELOOP) && !errors.Is(err, syscall.EMLINK) {
-		t.Fatalf("symlink open: got %v, want ELOOP or EMLINK", err)
-	}
-}
-
-// A fifo would block the open until a writer showed up, stalling the daemon
-// while it holds its lock.
-func TestOpenOwnedFileRefusesFifoWithoutBlocking(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "gui-client.log")
-	require.NoError(t, syscall.Mkfifo(path, 0600))
-
-	id, err := CurrentProcessIdentity()
-	require.NoError(t, err)
-
-	done := make(chan error, 1)
-	go func() {
-		_, err := OpenOwnedFile(id, path)
-		done <- err
-	}()
-
-	select {
-	case err := <-done:
-		require.ErrorContains(t, err, "not a regular file")
-	case <-time.After(5 * time.Second):
-		t.Fatal("opening a fifo blocked")
-	}
-}

client/internal/ipcauth/ownedfile_windows.go

@@ -1,59 +0,0 @@
-//go:build windows
-
-package ipcauth
-
-import (
-	"fmt"
-	"os"
-
-	"golang.org/x/sys/windows"
-)
-
-// openForRead opens a caller-supplied path without following a reparse point at
-// it. FILE_FLAG_OPEN_REPARSE_POINT is the Windows analogue of O_NOFOLLOW: it
-// opens a symlink/junction itself rather than its target, so the regular-file
-// check in checkOwnership refuses a link the caller planted to redirect the
-// read. FILE_FLAG_BACKUP_SEMANTICS lets a directory open too (as os.Open does),
-// so a directory planted at the path is refused as non-regular rather than
-// erroring here. The share mode matches os.Open so a log being written stays
-// openable.
-func openForRead(path string) (*os.File, error) {
-	p, err := windows.UTF16PtrFromString(path)
-	if err != nil {
-		return nil, fmt.Errorf("convert path %s: %w", path, err)
-	}
-
-	handle, err := windows.CreateFile(
-		p,
-		windows.GENERIC_READ,
-		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
-		nil,
-		windows.OPEN_EXISTING,
-		windows.FILE_FLAG_OPEN_REPARSE_POINT|windows.FILE_FLAG_BACKUP_SEMANTICS,
-		0,
-	)
-	if err != nil {
-		return nil, fmt.Errorf("open %s: %w", path, err)
-	}
-
-	return os.NewFile(uintptr(handle), path), nil
-}
-
-// fileOwnedBy compares the file's owner SID with the caller's. Files an elevated
-// process creates are owned by BUILTIN\Administrators rather than by the user,
-// but such a caller is privileged and never reaches this check.
-func fileOwnedBy(id Identity, f *os.File) (bool, error) {
-	// x/sys/windows GetSecurityInfo frees the OS buffer itself and returns a
-	// Go-heap copy, so there is nothing to LocalFree here.
-	sd, err := windows.GetSecurityInfo(windows.Handle(f.Fd()), windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION)
-	if err != nil {
-		return false, fmt.Errorf("read security info: %w", err)
-	}
-
-	owner, _, err := sd.Owner()
-	if err != nil {
-		return false, fmt.Errorf("read owner: %w", err)
-	}
-
-	return id.SID != "" && owner.String() == id.SID, nil
-}

client/internal/ipcauth/ownedfile_windows_test.go

@@ -1,78 +0,0 @@
-//go:build windows
-
-package ipcauth
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/windows"
-)
-
-// fileOwnerSID reads the owner SID of path the same way OpenOwnedFile does, so
-// the test can construct an Identity that matches (or deliberately does not).
-func fileOwnerSID(t *testing.T, path string) string {
-	t.Helper()
-	f, err := os.Open(path)
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = f.Close() })
-
-	sd, err := windows.GetSecurityInfo(windows.Handle(f.Fd()), windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION)
-	require.NoError(t, err)
-	owner, _, err := sd.Owner()
-	require.NoError(t, err)
-	return owner.String()
-}
-
-// The allow branch of fileOwnedBy is the SID-equality path the legitimate GUI
-// flow depends on. Running elevated, a created file is owned by
-// BUILTIN\Administrators; an Identity carrying that SID with Elevated=false and
-// no groups is unprivileged by IsPrivileged (which reads the token, not the
-// SID's RID), so this exercises the real GetSecurityInfo equality rather than
-// the privileged-caller shortcut.
-func TestOpenOwnedFileWindowsOwnerMatchAllows(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "gui-client.log")
-	require.NoError(t, os.WriteFile(path, []byte("hello"), 0600))
-
-	ownerSID := fileOwnerSID(t, path)
-	id := Identity{SID: ownerSID}
-	require.False(t, id.IsPrivileged(), "identity built from the owner SID must be unprivileged for this to test the match path")
-
-	f, err := OpenOwnedFile(id, path)
-	require.NoError(t, err)
-	_ = f.Close()
-}
-
-func TestOpenOwnedFileWindowsOwnerMismatchRefuses(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "gui-client.log")
-	require.NoError(t, os.WriteFile(path, []byte("secret"), 0600))
-
-	other := Identity{SID: "S-1-5-21-9-9-9-9999"}
-	require.False(t, other.IsPrivileged())
-
-	_, err := OpenOwnedFile(other, path)
-	require.ErrorContains(t, err, "not owned by the caller")
-}
-
-// FILE_FLAG_OPEN_REPARSE_POINT must make OpenOwnedFile refuse a symlink the same
-// way O_NOFOLLOW does on Unix, so a planted link can't redirect the read to
-// another file. Creating a symlink needs a privilege the runner may lack, so the
-// test skips rather than fails when it can't.
-func TestOpenOwnedFileWindowsRefusesSymlink(t *testing.T) {
-	dir := t.TempDir()
-	target := filepath.Join(dir, "target.log")
-	require.NoError(t, os.WriteFile(target, []byte("secret"), 0600))
-
-	link := filepath.Join(dir, "gui-client.log")
-	if err := os.Symlink(target, link); err != nil {
-		t.Skipf("cannot create symlink (privilege not held?): %v", err)
-	}
-
-	id, err := CurrentProcessIdentity()
-	require.NoError(t, err)
-
-	_, err = OpenOwnedFile(id, link)
-	require.Error(t, err, "a symlink must be refused")
-}

client/ios/NetBirdSDK/client.go

@@ -262,7 +262,7 @@ func (c *Client) DebugBundle(anonymize bool) (string, error) {
 	uploadCtx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 	defer cancel()
 
-	key, err := debug.UploadDebugBundle(uploadCtx, types.DefaultBundleURL, cfg.ManagementURL.String(), path, false)
+	key, err := debug.UploadDebugBundle(uploadCtx, types.DefaultBundleURL, cfg.ManagementURL.String(), path)
 	if err != nil {
 		return "", fmt.Errorf("upload debug bundle: %w", err)
 	}

client/jobexec/executor.go

@@ -54,7 +54,7 @@ func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.
 		}
 	}()
 
-	key, err := debug.UploadDebugBundle(ctx, types.DefaultBundleURL, mgmURL, path, false)
+	key, err := debug.UploadDebugBundle(ctx, types.DefaultBundleURL, mgmURL, path)
 	if err != nil {
 		log.Errorf("failed to upload debug bundle: %v", err)
 		return "", fmt.Errorf("upload debug bundle: %w", err)

client/proto/daemon.pb.go

@@ -2771,18 +2771,14 @@ func (x *ForwardingRulesResponse) GetRules() []*ForwardingRule {
 
 // DebugBundler
 type DebugBundleRequest struct {
-	state        protoimpl.MessageState `protogen:"open.v1"`
-	Anonymize    bool                   `protobuf:"varint,1,opt,name=anonymize,proto3" json:"anonymize,omitempty"`
-	SystemInfo   bool                   `protobuf:"varint,3,opt,name=systemInfo,proto3" json:"systemInfo,omitempty"`
-	UploadURL    string                 `protobuf:"bytes,4,opt,name=uploadURL,proto3" json:"uploadURL,omitempty"`
-	LogFileCount uint32                 `protobuf:"varint,5,opt,name=logFileCount,proto3" json:"logFileCount,omitempty"`
-	CliVersion   string                 `protobuf:"bytes,6,opt,name=cliVersion,proto3" json:"cliVersion,omitempty"`
-	// uploadInsecure allows uploading to an http endpoint or one with an
-	// untrusted TLS certificate. Restricted to privileged callers; for
-	// self-hosted upload servers.
-	UploadInsecure bool `protobuf:"varint,7,opt,name=uploadInsecure,proto3" json:"uploadInsecure,omitempty"`
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Anonymize     bool                   `protobuf:"varint,1,opt,name=anonymize,proto3" json:"anonymize,omitempty"`
+	SystemInfo    bool                   `protobuf:"varint,3,opt,name=systemInfo,proto3" json:"systemInfo,omitempty"`
+	UploadURL     string                 `protobuf:"bytes,4,opt,name=uploadURL,proto3" json:"uploadURL,omitempty"`
+	LogFileCount  uint32                 `protobuf:"varint,5,opt,name=logFileCount,proto3" json:"logFileCount,omitempty"`
+	CliVersion    string                 `protobuf:"bytes,6,opt,name=cliVersion,proto3" json:"cliVersion,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DebugBundleRequest) Reset() {
@@ -2850,13 +2846,6 @@ func (x *DebugBundleRequest) GetCliVersion() string {
 	return ""
 }
 
-func (x *DebugBundleRequest) GetUploadInsecure() bool {
-	if x != nil {
-		return x.UploadInsecure
-	}
-	return false
-}
-
 type DebugBundleResponse struct {
 	state               protoimpl.MessageState `protogen:"open.v1"`
 	Path                string                 `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
@@ -7253,7 +7242,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x12translatedHostname\x18\x04 \x01(\tR\x12translatedHostname\x128\n" +
 	"\x0etranslatedPort\x18\x05 \x01(\v2\x10.daemon.PortInfoR\x0etranslatedPort\"G\n" +
 	"\x17ForwardingRulesResponse\x12,\n" +
-	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules\"\xdc\x01\n" +
+	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules\"\xb4\x01\n" +
 	"\x12DebugBundleRequest\x12\x1c\n" +
 	"\tanonymize\x18\x01 \x01(\bR\tanonymize\x12\x1e\n" +
 	"\n" +
@@ -7263,8 +7252,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\flogFileCount\x18\x05 \x01(\rR\flogFileCount\x12\x1e\n" +
 	"\n" +
 	"cliVersion\x18\x06 \x01(\tR\n" +
-	"cliVersion\x12&\n" +
-	"\x0euploadInsecure\x18\a \x01(\bR\x0euploadInsecure\"}\n" +
+	"cliVersion\"}\n" +
 	"\x13DebugBundleResponse\x12\x12\n" +
 	"\x04path\x18\x01 \x01(\tR\x04path\x12 \n" +
 	"\vuploadedKey\x18\x02 \x01(\tR\vuploadedKey\x120\n" +

client/proto/daemon.proto

@@ -536,10 +536,6 @@ message DebugBundleRequest {
   string uploadURL = 4;
   uint32 logFileCount = 5;
   string cliVersion = 6;
-  // uploadInsecure allows uploading to an http endpoint or one with an
-  // untrusted TLS certificate. Restricted to privileged callers; for
-  // self-hosted upload servers.
-  bool uploadInsecure = 7;
 }
 
 message DebugBundleResponse {

client/server/debug.go

@@ -7,62 +7,18 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"path/filepath"
 	"runtime/pprof"
-	"strings"
-	"time"
 
 	log "github.com/sirupsen/logrus"
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/internal/debug"
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/version"
 )
 
 // DebugBundle creates a debug bundle and returns the location.
-func (s *Server) DebugBundle(callerCtx context.Context, req *proto.DebugBundleRequest) (resp *proto.DebugBundleResponse, err error) {
-	if err := requirePrivilegeForUploadURL(callerCtx, req.GetUploadURL(), req.GetUploadInsecure()); err != nil {
-		return nil, err
-	}
-
-	// The UI log is opened as whoever asked for this bundle, so a caller only
-	// collects a log it owns (privileged callers excepted). ok is false on a
-	// socket that carries no identity, which skips the UI log.
-	callerID, callerIdentified := ipcauth.CallerIdentity(callerCtx)
-
-	path, managementURL, err := s.generateDebugBundle(req, uiLogOpener(callerID, callerIdentified))
-	if err != nil {
-		return nil, err
-	}
-
-	if req.GetUploadURL() == "" {
-		return &proto.DebugBundleResponse{Path: path}, nil
-	}
-
-	// The upload runs without s.mutex held: it does network I/O to a possibly
-	// slow destination and must not block the other RPCs that take the lock. The
-	// bounded context is a backstop against a hung connection.
-	uploadCtx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
-	defer cancel()
-	key, err := debug.UploadDebugBundle(uploadCtx, req.GetUploadURL(), managementURL, path, req.GetUploadInsecure())
-	if err != nil {
-		log.Errorf("failed to upload debug bundle to %s: %v", req.GetUploadURL(), err)
-		return &proto.DebugBundleResponse{Path: path, UploadFailureReason: err.Error()}, nil
-	}
-
-	log.Infof("debug bundle uploaded to %s with key %s", req.GetUploadURL(), key)
-
-	return &proto.DebugBundleResponse{Path: path, UploadedKey: key}, nil
-}
-
-// generateDebugBundle builds the bundle under s.mutex and returns its path plus
-// the management URL captured under the lock, so the caller can run the upload
-// without holding the lock.
-func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener debug.LogOpener) (path string, managementURL string, err error) {
+func (s *Server) DebugBundle(_ context.Context, req *proto.DebugBundleRequest) (resp *proto.DebugBundleResponse, err error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
@@ -112,7 +68,6 @@ func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener deb
 			SyncResponse:   syncResponse,
 			LogPath:        s.logFile,
 			UILogPath:      s.uiLogPath,
-			UILogOpener:    uiOpener,
 			CPUProfile:     cpuProfileData,
 			CapturePath:    capturePath,
 			RefreshStatus:  refreshStatus,
@@ -127,16 +82,23 @@ func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener deb
 		},
 	)
 
-	path, err = bundleGenerator.Generate()
+	path, err := bundleGenerator.Generate()
 	if err != nil {
-		return "", "", fmt.Errorf("generate debug bundle: %w", err)
+		return nil, fmt.Errorf("generate debug bundle: %w", err)
 	}
 
-	if s.config != nil && s.config.ManagementURL != nil {
-		managementURL = s.config.ManagementURL.String()
+	if req.GetUploadURL() == "" {
+		return &proto.DebugBundleResponse{Path: path}, nil
+	}
+	key, err := debug.UploadDebugBundle(context.Background(), req.GetUploadURL(), s.config.ManagementURL.String(), path)
+	if err != nil {
+		log.Errorf("failed to upload debug bundle to %s: %v", req.GetUploadURL(), err)
+		return &proto.DebugBundleResponse{Path: path, UploadFailureReason: err.Error()}, nil
 	}
 
-	return path, managementURL, nil
+	log.Infof("debug bundle uploaded to %s with key %s", req.GetUploadURL(), key)
+
+	return &proto.DebugBundleResponse{Path: path, UploadedKey: key}, nil
 }
 
 // GetLogLevel gets the current logging level for the server.
@@ -176,34 +138,12 @@ func (s *Server) SetLogLevel(_ context.Context, req *proto.SetLogLevelRequest) (
 // RegisterUILog records the desktop UI's absolute log path so DebugBundle can
 // collect the GUI log. The daemon runs as root and can't resolve the user's
 // config dir, so the UI reports it. Last-writer-wins (one UI per socket).
-//
-// The path arrives over an IPC any local user can reach and is later opened by
-// a root daemon, so it is constrained to the file name the UI writes and to a
-// local absolute path. Authorization happens when DebugBundle opens it: the
-// bundle refuses a file its requester does not own. A caller the daemon cannot
-// identify cannot register a path at all.
-func (s *Server) RegisterUILog(callerCtx context.Context, req *proto.RegisterUILogRequest) (*proto.RegisterUILogResponse, error) {
-	if _, ok := ipcauth.CallerIdentity(callerCtx); !ok {
-		return nil, gstatus.Error(codes.PermissionDenied,
-			"registering a UI log path requires a control channel that carries the caller's identity")
-	}
-
-	path := filepath.Clean(req.GetPath())
-	if !filepath.IsAbs(path) || filepath.Base(path) != uiLogFileName {
-		return nil, gstatus.Errorf(codes.InvalidArgument, "UI log path must be an absolute path ending in %s", uiLogFileName)
-	}
-	// filepath.IsAbs accepts a Windows UNC path (\\host\share\...) and a device
-	// path (\\.\, \\?\); opening one would make the root daemon reach a remote
-	// or device namespace. Require a plain local path.
-	if strings.HasPrefix(path, `\\`) {
-		return nil, gstatus.Error(codes.InvalidArgument, "UI log path must be a local path, not a UNC or device path")
-	}
-
+func (s *Server) RegisterUILog(_ context.Context, req *proto.RegisterUILogRequest) (*proto.RegisterUILogResponse, error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	s.uiLogPath = path
-	log.Infof("registered UI log path %s", s.uiLogPath)
+	s.uiLogPath = req.GetPath()
+	log.Infof("registered UI log path: %s", s.uiLogPath)
 
 	return &proto.RegisterUILogResponse{}, nil
 }

client/server/debug_gate.go

@@ -1,99 +0,0 @@
-//go:build !android && !ios
-
-package server
-
-import (
-	"context"
-	"fmt"
-	"net/url"
-	"os"
-	"strings"
-
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/configs"
-	"github.com/netbirdio/netbird/client/internal/debug"
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
-	"github.com/netbirdio/netbird/upload-server/types"
-)
-
-// uiLogFileName is the only file name the daemon accepts as a UI log path. The
-// UI (writer), this validation, and the bundle collector all read it from
-// configs so they cannot drift.
-const uiLogFileName = configs.UILogFile
-
-// uiLogOpener opens the registered UI log, and its rotated siblings, on behalf
-// of the caller requesting the bundle: OpenOwnedFile then collects the log only
-// when that caller owns it (or is privileged). identified is false on a socket
-// that carries no caller identity, in which case nothing is opened.
-func uiLogOpener(id ipcauth.Identity, identified bool) debug.LogOpener {
-	return func(path string) (*os.File, error) {
-		if !identified {
-			return nil, fmt.Errorf("bundle requester has no verified identity")
-		}
-		return ipcauth.OpenOwnedFile(id, path)
-	}
-}
-
-// requirePrivilegeForUploadURL restricts where the daemon may send a debug
-// bundle. The bundle holds the daemon's own logs and state, and the daemon
-// fetches the upload URL itself, so an unrestricted endpoint turns the daemon
-// into both an exfiltration channel and a request forwarder that reaches
-// services only it can talk to.
-//
-// The upload service NetBird publishes is open to any caller, since that is what
-// the CLI and the desktop UI use. Any other endpoint, self-hosted upload servers
-// included, requires a privileged caller. Plaintext is refused for everyone: the
-// daemon fetches the URL and then PUTs the bundle to whatever that fetch returns,
-// so an http hop is a place to intercept the bundle or the redirect.
-//
-// insecure relaxes transport security (http, or an untrusted TLS certificate)
-// for a self-hosted server. It weakens a root-privileged upload, so it is
-// refused for an unprivileged caller regardless of the host.
-func requirePrivilegeForUploadURL(ctx context.Context, rawURL string, insecure bool) error {
-	if rawURL == "" {
-		return nil
-	}
-
-	parsed, err := url.Parse(rawURL)
-	if err != nil {
-		return gstatus.Errorf(codes.InvalidArgument, "parse upload URL: %v", err)
-	}
-
-	// --insecure relaxes https to http or an untrusted certificate; it does not
-	// widen the URL to arbitrary schemes, so a host and http/https are required
-	// before the insecure branch takes over.
-	if parsed.Host == "" || (parsed.Scheme != "https" && parsed.Scheme != "http") {
-		return gstatus.Errorf(codes.InvalidArgument, "upload URL must be http or https with a host")
-	}
-
-	if insecure {
-		return denyPrivileged(ctx,
-			"uploading a debug bundle without transport security (--upload-bundle-insecure)",
-			ipcauth.ElevatedCommand("netbird debug bundle -U --upload-bundle-insecure --upload-bundle-url <url>"))
-	}
-
-	if parsed.Scheme != "https" {
-		return gstatus.Errorf(codes.InvalidArgument, "upload URL must use https, got scheme %q", parsed.Scheme)
-	}
-
-	if isDefaultUploadService(parsed) {
-		return nil
-	}
-
-	return denyPrivileged(ctx,
-		"uploading a debug bundle to an upload service other than the default one",
-		ipcauth.ElevatedCommand("netbird debug bundle -U --upload-bundle-url <url>"))
-}
-
-// isDefaultUploadService reports whether the URL points at the upload service
-// NetBird runs. Only the host is compared: the service's path may differ between
-// releases, and the host is what decides who receives the bundle.
-func isDefaultUploadService(parsed *url.URL) bool {
-	defaultURL, err := url.Parse(types.DefaultBundleURL)
-	if err != nil {
-		return false
-	}
-	return parsed.Scheme == defaultURL.Scheme && strings.EqualFold(parsed.Host, defaultURL.Host)
-}

client/server/debug_gate_test.go

@@ -1,157 +0,0 @@
-//go:build !android && !ios
-
-package server
-
-import (
-	"os"
-	"path/filepath"
-	"runtime"
-	"testing"
-
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/internal/ipcauth"
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/upload-server/types"
-)
-
-func TestRegisterUILogRefusesUnidentifiedCaller(t *testing.T) {
-	s := &Server{}
-
-	_, err := s.RegisterUILog(noIdentityCtx(), &proto.RegisterUILogRequest{
-		Path: filepath.Join(t.TempDir(), uiLogFileName),
-	})
-
-	if gstatus.Code(err) != codes.PermissionDenied {
-		t.Fatalf("code = %v, want PermissionDenied", gstatus.Code(err))
-	}
-}
-
-func TestRegisterUILogRefusesForeignPath(t *testing.T) {
-	secret := "/etc/shadow"
-	if runtime.GOOS == "windows" {
-		secret = `C:\Windows\System32\config\SAM`
-	}
-
-	tests := []struct {
-		name string
-		path string
-	}{
-		{"empty", ""},
-		{"relative", filepath.Join("netbird", uiLogFileName)},
-		{"another file", secret},
-		{"directory of the log", t.TempDir()},
-		{"unc path", `\\attacker\share\` + uiLogFileName},
-		{"device path", `\\.\C:\` + uiLogFileName},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			s := &Server{}
-
-			_, err := s.RegisterUILog(userCtx(), &proto.RegisterUILogRequest{Path: tc.path})
-
-			if gstatus.Code(err) != codes.InvalidArgument {
-				t.Fatalf("code = %v, want InvalidArgument", gstatus.Code(err))
-			}
-			if s.uiLogPath != "" {
-				t.Fatalf("path %q was recorded despite the refusal", s.uiLogPath)
-			}
-		})
-	}
-}
-
-func TestRegisterUILogRecordsPath(t *testing.T) {
-	s := &Server{}
-	path := filepath.Join(t.TempDir(), uiLogFileName)
-
-	if _, err := s.RegisterUILog(userCtx(), &proto.RegisterUILogRequest{Path: path}); err != nil {
-		t.Fatalf("register: %v", err)
-	}
-
-	if s.uiLogPath != path {
-		t.Fatalf("path = %q, want %q", s.uiLogPath, path)
-	}
-}
-
-// The UI log is opened as the bundle requester, so a second local user cannot
-// collect a log they do not own, and an unidentified requester collects nothing.
-func TestUILogOpenerBindsToRequester(t *testing.T) {
-	path := filepath.Join(t.TempDir(), uiLogFileName)
-	if err := os.WriteFile(path, []byte("log line"), 0600); err != nil {
-		t.Fatalf("write log: %v", err)
-	}
-
-	// A different unprivileged user than the file's owner: refused.
-	if _, err := uiLogOpener(unprivilegedIdentity(), true)(path); err == nil {
-		t.Fatal("expected a file the requester does not own to be refused")
-	}
-
-	// No verified identity: refused.
-	if _, err := uiLogOpener(ipcauth.Identity{}, false)(path); err == nil {
-		t.Fatal("expected an unidentified requester to be refused")
-	}
-
-	// The requester that owns the file: allowed. The test process created it, so
-	// its own identity is the owner (and a privileged runner is exempt anyway).
-	owner, err := ipcauth.CurrentProcessIdentity()
-	if err != nil {
-		t.Fatalf("current identity: %v", err)
-	}
-	f, err := uiLogOpener(owner, true)(path)
-	if err != nil {
-		t.Fatalf("expected the owning requester to be allowed, got %v", err)
-	}
-	_ = f.Close()
-}
-
-func TestRequirePrivilegeForUploadURL(t *testing.T) {
-	tests := []struct {
-		name     string
-		url      string
-		insecure bool
-		unprivOK bool
-		invalid  bool
-		rootAlso bool
-	}{
-		{name: "no upload", url: "", unprivOK: true},
-		{name: "default service", url: types.DefaultBundleURL, unprivOK: true},
-		{name: "default service, other path", url: "https://upload.debug.netbird.io/other", unprivOK: true},
-		{name: "loopback exfiltration endpoint", url: "https://127.0.0.1:8080/upload-url", rootAlso: true},
-		{name: "custom upload service", url: "https://attacker.example/upload-url", rootAlso: true},
-		{name: "plaintext default host", url: "http://upload.debug.netbird.io/upload-url", invalid: true},
-		{name: "plaintext custom host", url: "http://attacker.example/upload-url", invalid: true},
-		{name: "unsupported scheme", url: "file:///etc/shadow", invalid: true},
-		// insecure relaxes transport security; privileged only, whatever the host.
-		{name: "insecure http custom", url: "http://selfhosted.local/upload-url", insecure: true, rootAlso: true},
-		{name: "insecure https custom", url: "https://selfhosted.local/upload-url", insecure: true, rootAlso: true},
-		{name: "insecure default host", url: types.DefaultBundleURL, insecure: true, rootAlso: true},
-		// --insecure must not widen the URL to non-http(s) schemes or a hostless URL.
-		{name: "insecure file scheme", url: "file:///etc/shadow", insecure: true, invalid: true},
-		{name: "insecure hostless", url: "https:///upload-url", insecure: true, invalid: true},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			err := requirePrivilegeForUploadURL(userCtx(), tc.url, tc.insecure)
-
-			switch {
-			case tc.invalid:
-				if gstatus.Code(err) != codes.InvalidArgument {
-					t.Fatalf("code = %v, want InvalidArgument", gstatus.Code(err))
-				}
-				return
-			case tc.unprivOK:
-				assertAllowed(t, err)
-				return
-			default:
-				assertDenied(t, err)
-			}
-
-			if tc.rootAlso {
-				assertAllowed(t, requirePrivilegeForUploadURL(rootCtx(), tc.url, tc.insecure))
-			}
-		})
-	}
-}

client/server/lock_order_test.go

@@ -1,51 +0,0 @@
-package server
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// The daemon takes guardedConfigMu before s.mutex. authorizeAndPrepareLogin
-// takes s.mutex while holding guardedConfigMu, so a SetConfig that grabbed
-// s.mutex first and then waited for guardedConfigMu would deadlock the daemon
-// against a concurrent login: two unprivileged IPC calls are enough.
-//
-// The held guardedConfigMu below stands in for that login. While SetConfig waits
-// for it, s.mutex must stay free, otherwise the login waiting for s.mutex could
-// never release guardedConfigMu.
-func TestSetConfig_TakesGuardedConfigMuBeforeServerMutex(t *testing.T) {
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
-	s.guardedConfigMu.Lock()
-
-	done := make(chan error, 1)
-	go func() {
-		_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
-			ProfileName: profName,
-			Username:    username,
-		})
-		done <- err
-	}()
-
-	require.Never(t, func() bool {
-		if !s.mutex.TryLock() {
-			return true
-		}
-		s.mutex.Unlock()
-		return false
-	}, 500*time.Millisecond, 10*time.Millisecond,
-		"SetConfig held s.mutex while waiting for guardedConfigMu, which deadlocks against a concurrent login")
-
-	s.guardedConfigMu.Unlock()
-
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(5 * time.Second):
-		t.Fatal("SetConfig did not finish after guardedConfigMu was released")
-	}
-}

client/server/server.go

@@ -72,9 +72,6 @@ type Server struct {
 	// RegisterUILog. Guarded by mutex. Consumed by DebugBundle so the bundle
 	// can collect the GUI log even though the daemon runs as root and can't
 	// resolve the user's config dir. Last-writer-wins (one UI per socket).
-	// DebugBundle opens it on behalf of the bundle requester and refuses a file
-	// that caller does not own, so a local user cannot read another user's log
-	// or a root-only file through it.
 	uiLogPath string
 
 	oauthAuthFlow oauthAuthFlow
@@ -396,16 +393,6 @@ func (s *Server) loginAttempt(ctx context.Context, setupKey, jwtToken string) (i
 
 // Login uses setup key to prepare configuration for the daemon.
 func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigRequest) (*proto.SetConfigResponse, error) {
-	// Privilege gate: refuse the parts of the request that would let a local
-	// user turn the root daemon into a root shell. Held across the write so the
-	// config cannot gain the SSH server between the decision and the update.
-	//
-	// Taken before s.mutex: authorizeAndPrepareLogin takes s.mutex while holding
-	// guardedConfigMu, so acquiring the two in the other order here would let a
-	// concurrent login deadlock the daemon.
-	s.guardedConfigMu.Lock()
-	defer s.guardedConfigMu.Unlock()
-
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
@@ -430,6 +417,12 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		return nil, err
 	}
 
+	// Privilege gate: refuse the parts of the request that would let a local
+	// user turn the root daemon into a root shell. Held across the write so the
+	// config cannot gain the SSH server between the decision and the update.
+	s.guardedConfigMu.Lock()
+	defer s.guardedConfigMu.Unlock()
+
 	stored, err := s.storedProfileConfig(msg.ProfileName, msg.Username)
 	if err != nil {
 		return nil, err

client/ui/netbird-ui.rb.tmpl

@@ -29,13 +29,8 @@ cask "{{ $projectName }}" do
   end
 
   uninstall_preflight do
-    system_command "/bin/sh",
-                   args: ["-c", <<~CMD],
-                     launchctl bootout system/netbird 2>/dev/null || \
-                       launchctl unload /Library/LaunchDaemons/netbird.plist 2>/dev/null || true
-                     rm -f /Library/LaunchDaemons/netbird.plist
-                   CMD
-                   sudo: true
+    system_command "#{appdir}/Netbird UI.app/uninstaller.sh",
+                   sudo: false
   end
 
   name "Netbird UI"

client/ui/uilogpath.go

@@ -8,19 +8,21 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/configs"
 	"github.com/netbirdio/netbird/client/ui/guilog"
 )
 
+// uiLogFileName must stay in sync with the daemon's "gui-client*.log.*" glob
+// for rotated siblings (addUILog in client/internal/debug).
+const uiLogFileName = "gui-client.log"
+
 // uiLogPath returns the GUI log path with native separators, since the daemon
-// opens it directly for debug-bundle collection. The file name comes from
-// configs.UILogFile so the daemon validates and collects the same name.
+// opens it directly for debug-bundle collection.
 func uiLogPath() (string, error) {
 	dir, err := os.UserConfigDir()
 	if err != nil {
 		return "", err
 	}
-	return filepath.Join(dir, "netbird", configs.UILogFile), nil
+	return filepath.Join(dir, "netbird", uiLogFileName), nil
 }
 
 // newDebugLog builds the GUI debug log, disabled when userSetLogFile is set

combined/cmd/config.go

@@ -76,13 +76,6 @@ type ServerConfig struct {
 
 	SupportedSyncMessageVersions           *int           `yaml:"supportedSyncMessageVersions,omitempty"`
 	PerAccountSupportedSyncMessageVersions map[string]int `yaml:"perAccountSupportedSyncMessageVersions,omitempty"`
-
-	AgentNetwork AgentNetworkConfig `yaml:"agentNetwork"`
-}
-
-// AgentNetworkConfig contains agent-network (LLM gateway) configuration.
-type AgentNetworkConfig struct {
-	PricingDefaultsFile string `yaml:"pricingDefaultsFile"`
 }
 
 // TLSConfig contains TLS/HTTPS settings
@@ -730,9 +723,6 @@ func (c *CombinedConfig) ToManagementConfig() (*nbconfig.Config, error) {
 		EmbeddedIdP:                        embeddedIdP,
 		HighestSupportedSyncMessageVersion: c.Server.SupportedSyncMessageVersions,
 		PerAccountHighestSupportedSyncMessageVersion: c.Server.PerAccountSupportedSyncMessageVersions,
-		AgentNetwork: nbconfig.AgentNetwork{
-			PricingDefaultsFile: c.Server.AgentNetwork.PricingDefaultsFile,
-		},
 	}, nil
 }
 

combined/cmd/root.go

@@ -10,7 +10,6 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
-	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
@@ -25,7 +24,6 @@ import (
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/encryption"
-	agentnetworkpricing "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
 	mgmtServer "github.com/netbirdio/netbird/management/internals/server"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/telemetry"
@@ -290,11 +288,6 @@ func (s *serverInstances) createManagementServer(ctx context.Context, cfg *Combi
 		return fmt.Errorf("failed to ensure encryption key: %w", err)
 	}
 
-	if err := loadAgentNetworkPricing(ctx, mgmtConfig); err != nil {
-		cleanupSTUNListeners(s.stunListeners)
-		return fmt.Errorf("failed to load agent-network pricing defaults: %w", err)
-	}
-
 	LogConfigInfo(mgmtConfig)
 
 	s.mgmtSrv, err = createManagementServer(cfg, mgmtConfig)
@@ -629,32 +622,6 @@ func handleRelayWebSocket(w http.ResponseWriter, r *http.Request, acceptFn func(
 	acceptFn(conn)
 }
 
-// loadAgentNetworkPricing loads the management-side LLM pricing defaults
-// file for the combined server and starts its periodic reloader. An
-// explicitly configured PricingDefaultsFile is required to load (a typo
-// must fail startup rather than silently bill with built-ins the operator
-// believes they replaced); a relative path is resolved against the data
-// directory so a bare filename like "pricing.yaml" lands in the datadir
-// alongside the store. With no path configured, <datadir>/<DefaultFileName>
-// is probed and may be absent (compiled-in defaults serve).
-func loadAgentNetworkPricing(ctx context.Context, mgmtConfig *nbconfig.Config) error {
-	pricingPath := mgmtConfig.AgentNetwork.PricingDefaultsFile
-	required := pricingPath != ""
-	if !required {
-		pricingPath = agentnetworkpricing.DefaultFileName
-	}
-	if !filepath.IsAbs(pricingPath) {
-		pricingPath = filepath.Join(mgmtConfig.Datadir, pricingPath)
-	}
-
-	log.Infof("loading agent-network pricing defaults from %s (required: %v)", pricingPath, required)
-	if err := agentnetworkpricing.LoadFile(pricingPath, required); err != nil {
-		return err
-	}
-	agentnetworkpricing.StartReloader(ctx, agentnetworkpricing.ReloadInterval)
-	return nil
-}
-
 // logConfig prints all configuration parameters for debugging
 func logConfig(cfg *CombinedConfig) {
 	log.Info("=== Configuration ===")
@@ -731,25 +698,6 @@ func logManagementConfig(cfg *CombinedConfig) {
 		log.Infof("    Relay addresses: %v", cfg.Management.Relays.Addresses)
 		log.Infof("    Relay credentials TTL: %s", cfg.Management.Relays.CredentialsTTL)
 	}
-
-	logAgentNetworkConfig(cfg)
-}
-
-func logAgentNetworkConfig(cfg *CombinedConfig) {
-	log.Info("  Agent Network:")
-	pricingPath := cfg.Server.AgentNetwork.PricingDefaultsFile
-	configured := pricingPath != ""
-	if !configured {
-		pricingPath = agentnetworkpricing.DefaultFileName
-	}
-	if !filepath.IsAbs(pricingPath) {
-		pricingPath = filepath.Join(cfg.Management.DataDir, pricingPath)
-	}
-	if configured {
-		log.Infof("    Pricing defaults file: %s", pricingPath)
-	} else {
-		log.Infof("    Pricing defaults file: %s (default, optional)", pricingPath)
-	}
 }
 
 // logEnvVars logs all NB_ environment variables that are currently set

combined/config.yaml.example

@@ -134,16 +134,3 @@ server:
   #   trustedPeers: []                 # CIDRs of trusted peer networks (e.g. ["100.64.0.0/10"])
   #   accessLogRetentionDays: 7        # Days to retain HTTP access logs. 0 (or unset) defaults to 7. Negative values disable cleanup (logs kept indefinitely).
   #   accessLogCleanupIntervalHours: 24 # How often (in hours) to run the access-log cleanup job. 0 (or unset) is treated as "not set" and defaults to 24 hours; cleanup remains enabled. To disable cleanup, set accessLogRetentionDays to a negative value.
-
-  # Agent network (LLM gateway) settings (optional)
-  # agentNetwork:
-  #   # Path to the YAML file holding the default LLM pricing table. A relative
-  #   # path is resolved against dataDir, so a bare filename like "pricing.yaml"
-  #   # lands in the data directory. When empty, {dataDir}/defaults_llm_pricing.yaml
-  #   # is probed; if no file is present the compiled-in defaults are used.
-  #   # Schema: surface ("openai"/"anthropic"/"bedrock") -> model -> rates in USD
-  #   # per 1k tokens (input_per_1k, output_per_1k, and the optional
-  #   # cached_input_per_1k / cache_read_per_1k / cache_creation_per_1k). The file
-  #   # is re-read periodically (mtime poll). An explicitly configured path that
-  #   # fails to load fails startup; runtime reload errors keep the previous table.
-  #   pricingDefaultsFile: "pricing.yaml"

e2e/agentnetwork/chat_test.go

@@ -23,13 +23,8 @@ import (
 type per1k struct{ in, out, read, write float64 }
 
 // publishedPer1k hardcodes the vendors' PUBLISHED rates for the models the live matrix can drive,
-// keyed by the normalized model id the proxy stamps. Deliberately independent of NetBird's own
-// default pricing table so a wrong default rate or a broken normalization fails the run.
-//
-// These rates are also what providerRequest registers as the operator's per-model prices. Since
-// management now ships operator prices to the cost meter as a per-provider-record table that is
-// consulted BEFORE the surface defaults, registering the published rate is what keeps this matrix
-// asserting vendor rates — and exercises the per-record path at the same time.
+// keyed by the normalized model id the proxy stamps. Deliberately independent of the proxy's
+// pricing table so a wrong embedded rate or a broken normalization fails the run.
 var publishedPer1k = map[string]per1k{
 	"gpt-4o-mini":                 {0.00015, 0.0006, 0.000075, 0},
 	"gpt-4o":                      {0.0025, 0.01, 0.00125, 0},
@@ -40,22 +35,12 @@ var publishedPer1k = map[string]per1k{
 	"anthropic.claude-haiku-4-5":  {0.001, 0.005, 0.0001, 0.00125},
 	"anthropic.claude-sonnet-4-5": {0.003, 0.015, 0.0003, 0.00375},
 	"anthropic.claude-sonnet-4-6": {0.003, 0.015, 0.0003, 0.00375},
-	// Gateway-prefixed ids (Vercel AI Gateway, OpenRouter). A gateway model is not in
-	// NetBird's default table, so before operator pricing it could only be recorded at
-	// cost 0. The operator names it and prices it — at the underlying vendor's published
-	// rate, which is what the gateway charges through — so these rows are now priced.
-	"openai/gpt-4o-mini": {0.00015, 0.0006, 0.000075, 0},
-	"openai/gpt-4o":      {0.0025, 0.01, 0.00125, 0},
 }
 
 // rawCostVerificationSQL is the operator-facing double-check, run straight against the management
 // sqlite store: recompute each usage row's expected total and cache cost from its own persisted
 // token buckets and hardcoded published rates. OpenAI counts cached tokens as a subset of input;
 // Anthropic-shape providers count cache buckets additively.
-//
-// The rate rows must stay in sync with publishedPer1k — they are the same vendor rates the matrix
-// registers as operator prices. The join is on model, so rows written by other tests in this
-// package (which price their own made-up model ids) are simply not covered here.
 const rawCostVerificationSQL = `
 WITH rates(model, in_rate, out_rate, read_rate, write_rate) AS (
   VALUES
@@ -67,9 +52,7 @@ WITH rates(model, in_rate, out_rate, read_rate, write_rate) AS (
     ('kimi-k3',                     0.003,   0.015,  0.0003,   0.003),
     ('anthropic.claude-haiku-4-5',  0.001,   0.005,  0.0001,   0.00125),
     ('anthropic.claude-sonnet-4-5', 0.003,   0.015,  0.0003,   0.00375),
-    ('anthropic.claude-sonnet-4-6', 0.003,   0.015,  0.0003,   0.00375),
-    ('openai/gpt-4o-mini',          0.00015, 0.0006, 0.000075, 0.0),
-    ('openai/gpt-4o',               0.0025,  0.01,   0.00125,  0.0)
+    ('anthropic.claude-sonnet-4-6', 0.003,   0.015,  0.0003,   0.00375)
 )
 SELECT
   u.provider,
@@ -163,11 +146,6 @@ func verifyUsageRowsSQL(t *testing.T, srv *harness.Combined) {
 	require.Positive(t, verified, "raw SQL check must cover at least one usage row")
 	t.Logf("[sql] verified %d usage rows in store.db against published rates", verified)
 
-	// Gateway-prefixed model ids are absent from NetBird's default pricing table, so they are
-	// priced only because the operator registered and priced them on the provider record. Assert
-	// they are priced (not silently 0) — the join above already checked the exact figures for the
-	// ones this matrix drives. A gateway row at cost 0 means the per-record table never reached
-	// the cost meter, which is the regression this guards.
 	gwRows, err := db.Raw(`SELECT model,
 	  (input_cost_usd + cached_input_cost_usd + cache_creation_cost_usd + output_cost_usd) AS cost_usd
 	  FROM agent_network_request_usage WHERE model LIKE '%/%'`).Rows()
@@ -177,8 +155,8 @@ func verifyUsageRowsSQL(t *testing.T, srv *harness.Combined) {
 		var model string
 		var cost float64
 		require.NoError(t, gwRows.Scan(&model, &cost), "scan gateway usage row")
-		t.Logf("[sql] gateway %s: stored=$%.6f (priced from the operator's per-record rate)", model, cost)
-		assert.Positivef(t, cost, "gateway-prefixed model %q is priced on the provider record, so its cost must be > 0", model)
+		t.Logf("[sql] gateway %s: stored=$%.6f (must be 0 — deliberately unpriced)", model, cost)
+		assert.Zerof(t, cost, "gateway-prefixed model %q must store cost 0, never a guessed rate", model)
 	}
 	require.NoError(t, gwRows.Err(), "iterate gateway usage rows")
 }
@@ -199,6 +177,10 @@ func validateAccessLogCost(t *testing.T, pc providerCase, row api.AgentNetworkAc
 
 	rates, known := publishedPer1k[model]
 	if !known {
+		if strings.Contains(model, "/") {
+			assert.Zerof(t, row.CostUsd, "gateway-prefixed model %q is not priced so the cost meter must skip (cost 0)", model)
+			return
+		}
 		t.Logf("[cost] %s: no published rate on file for model %q (env-overridden?); skipping cost validation", pc.name, model)
 		return
 	}
@@ -355,17 +337,8 @@ func availableProviders() []providerCase {
 }
 
 // providerRequest builds a create request for a matrix provider: enabled, with
-// its model registered at the vendor's published rates for body-routed
-// providers, and no models for the path-routed Vertex (whose model lives in the
-// request path, so it prices from the defaults table management ships).
-//
-// The registered rates matter: management synthesizes them into the cost
-// meter's per-provider-record table, which is consulted before the surface
-// defaults, so these are the rates the proxy actually bills with. Registering
-// the published rate keeps the cost assertions vendor-anchored while covering
-// the operator-pricing path. A model with no published rate on file (an
-// env-overridden Bedrock profile) falls back to a nominal rate, and
-// validateAccessLogCost skips its cost check.
+// a uniquely-priced model for body-routed providers and none for the
+// path-routed Vertex (whose model lives in the request path).
 func providerRequest(pc providerCase) api.AgentNetworkProviderRequest {
 	req := api.AgentNetworkProviderRequest{
 		Name:        pc.name,
@@ -383,23 +356,9 @@ func providerRequest(pc providerCase) api.AgentNetworkProviderRequest {
 		if pc.kind == harness.WireBedrock {
 			modelID = catalogModel(pc)
 		}
-		model := api.AgentNetworkProviderModel{Id: modelID, InputPer1k: 0.001, OutputPer1k: 0.002}
-		if rates, known := publishedPer1k[catalogModel(pc)]; known {
-			model.InputPer1k = rates.in
-			model.OutputPer1k = rates.out
-			// Pin the cache rates too, rather than letting them inherit from the
-			// defaults table: a gateway-prefixed id has no default entry to
-			// inherit from, and an unset rate bills that bucket at the input
-			// rate, which would not match the published-rate recompute.
-			if rates.read > 0 {
-				model.CachedInputPer1k = ptr(rates.read) // OpenAI shape
-				model.CacheReadPer1k = ptr(rates.read)   // Anthropic / Bedrock shape
-			}
-			if rates.write > 0 {
-				model.CacheCreationPer1k = ptr(rates.write)
-			}
+		req.Models = &[]api.AgentNetworkProviderModel{
+			{Id: modelID, InputPer1k: 0.001, OutputPer1k: 0.002},
 		}
-		req.Models = &[]api.AgentNetworkProviderModel{model}
 	}
 	return req
 }

e2e/agentnetwork/custom_pricing_test.go

@@ -1,633 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"fmt"
-	"net/url"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gorm.io/driver/sqlite"
-	"gorm.io/gorm"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// The mock vLLM upstream (harness/vllm.go) always answers with this fixed usage
-// block, so every request drives deterministic token counts regardless of the
-// model the client asks for. The proxy prices off the REQUEST model, not the
-// upstream response model, so a made-up model id billed at operator rates lets
-// these tests assert exact costs without a real vendor key.
-const (
-	vllmPromptTokens     = 11
-	vllmCompletionTokens = 2
-)
-
-// pricedEnv is a connected single-provider agent-network deployment pointed at
-// the mock vLLM upstream, with the proxy and client up and the endpoint resolved
-// — ready to drive chat. All containers are torn down via t.Cleanup.
-type pricedEnv struct {
-	providerID string
-	groupID    string // source group of the policy; the client peer's auto-group
-	policyID   string // policy that authorises (and meters) the requests
-	upstream   string // provider upstream URL, needed to re-send on a PUT update
-	endpoint   string
-	proxyIP    string
-	client     *harness.Client
-	proxy      *harness.Proxy
-}
-
-// provisionPricedProvider brings up the full path for a cost test: a mock vLLM
-// upstream, a group + reusable setup key, one openai_api provider pointed at the
-// mock enumerating exactly the given models (with the operator's per-1k prices),
-// a policy whose token limit switches on usage metering, and a connected proxy +
-// client. The provider is created with the given models so the router dispatches
-// them to this provider and the cost meter bills at these rates.
-//
-// Passing nil models makes it a gateway-style catch-all: the router claims every
-// model, and since the synthesizer ships no per-provider-record pricing entry
-// for a provider that enumerates nothing, the shipped defaults table is the only
-// thing that can price the request. The policy sets no model guardrail, so the
-// proxy's per-provider allowlist backstop stays empty and any model routes.
-func provisionPricedProvider(t *testing.T, ctx context.Context, name string, models []api.AgentNetworkProviderModel) pricedEnv {
-	t.Helper()
-
-	vllm, err := harness.StartVLLM(ctx, srv)
-	require.NoError(t, err, "start mock vLLM upstream")
-	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
-
-	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-price-" + name})
-	require.NoError(t, err, "create group")
-	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
-
-	ephemeral := false
-	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
-		Name:       "e2e-price-" + name + "-client",
-		Type:       "reusable",
-		ExpiresIn:  86400,
-		UsageLimit: 0,
-		AutoGroups: []string{grp.Id},
-		Ephemeral:  &ephemeral,
-	})
-	require.NoError(t, err, "mint setup key")
-	require.NotEmpty(t, sk.Key, "setup key plaintext")
-
-	// The mock ignores auth, so a dummy key satisfies the "Bearer ${API_KEY}"
-	// template. openai_api is a known catalog provider; the enumerated model id
-	// need NOT be in the catalog — the operator names it and prices it here.
-	dummyKey := "sk-price-e2e"
-	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:             name,
-		ProviderId:       "openai_api",
-		UpstreamUrl:      vllm.URL,
-		ApiKey:           &dummyKey,
-		Enabled:          ptr(true),
-		BootstrapCluster: ptr(harness.AgentNetworkCluster),
-		Models:           &models,
-	})
-	require.NoError(t, err, "create provider")
-	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
-
-	// Uncapped token limit: never blocks the handful of tokens driven here, but
-	// switches on usage metering — the switch that makes consumption rows record.
-	enabled := true
-	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
-		Name:                   "e2e-price-" + name,
-		Enabled:                &enabled,
-		SourceGroups:           []string{grp.Id},
-		DestinationProviderIds: []string{prov.Id},
-		Limits: &api.AgentNetworkPolicyLimits{
-			TokenLimit: api.AgentNetworkPolicyTokenLimit{
-				Enabled:       true,
-				GroupCap:      10_000_000,
-				UserCap:       10_000_000,
-				WindowSeconds: 60,
-			},
-		},
-	})
-	require.NoError(t, err, "create policy")
-	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
-
-	settings, err := srv.GetSettings(ctx)
-	require.NoError(t, err, "read settings")
-	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
-
-	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-price-"+name+"-proxy")
-	require.NoError(t, err, "mint proxy token")
-	px, err := harness.StartProxy(ctx, srv, proxyToken)
-	require.NoError(t, err, "start proxy")
-	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
-
-	cl, err := harness.StartClient(ctx, srv, sk.Key)
-	require.NoError(t, err, "start client")
-	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
-
-	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
-	// Probe first: the GET resolves the endpoint and its first packet wakes the
-	// lazy proxy peer, so WaitProxyPeer then observes it connected.
-	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
-	require.NoError(t, err, "resolve endpoint to proxy IP")
-	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
-		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
-	}
-
-	return pricedEnv{
-		providerID: prov.Id,
-		groupID:    grp.Id,
-		policyID:   pol.Id,
-		upstream:   vllm.URL,
-		endpoint:   settings.Endpoint,
-		proxyIP:    proxyIP,
-		client:     cl,
-		proxy:      px,
-	}
-}
-
-// chatOnce drives one OpenAI-shaped chat for model through the tunnel, retrying
-// to absorb first-call tunnel/DNS jitter, and returns the response body.
-func chatOnce(t *testing.T, ctx context.Context, env pricedEnv, model, sessionID string) string {
-	t.Helper()
-	var code int
-	var body string
-	deadline := time.Now().Add(90 * time.Second)
-	for time.Now().Before(deadline) {
-		c, b, cerr := env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireChat, model, "Reply with exactly: pong", sessionID)
-		if cerr == nil {
-			code, body = c, b
-			if code == 200 {
-				break
-			}
-		}
-		time.Sleep(5 * time.Second)
-	}
-	require.Equal(t, 200, code,
-		"chat for %s must return 200; body: %s\n=== proxy logs ===\n%s", model, body, env.proxy.Logs(context.Background()))
-	return body
-}
-
-// findAccessLogBySession polls the access-log page for the row carrying sessionID.
-func findAccessLogBySession(t *testing.T, ctx context.Context, sessionID string) api.AgentNetworkAccessLog {
-	t.Helper()
-	var row api.AgentNetworkAccessLog
-	require.Eventually(t, func() bool {
-		logs, lerr := srv.ListAccessLogs(ctx)
-		if lerr != nil {
-			return false
-		}
-		for _, r := range logs.Data {
-			if r.SessionId != nil && *r.SessionId == sessionID {
-				row = r
-				return true
-			}
-		}
-		return false
-	}, 30*time.Second, 2*time.Second, "session id %q must be recorded in an access-log row", sessionID)
-	return row
-}
-
-// assertOpenAICostAtRates asserts an access-log row's token counts and every cost
-// bucket match the mock's fixed usage priced at the given operator rates. The
-// openai surface has no cache-write bucket and the mock reports no cache tokens,
-// so the whole cost is input + output; cache costs must be exactly zero.
-func assertOpenAICostAtRates(t *testing.T, row api.AgentNetworkAccessLog, inRate, outRate float64) {
-	t.Helper()
-	wantInput := float64(vllmPromptTokens) / 1000 * inRate
-	wantOutput := float64(vllmCompletionTokens) / 1000 * outRate
-	wantTotal := wantInput + wantOutput
-
-	model := ""
-	if row.Model != nil {
-		model = *row.Model
-	}
-	t.Logf("[cost] model=%s in=%d out=%d rates in/out=%.4f/%.4f stored input/output/total=$%.6f/$%.6f/$%.6f expected input/output/total=$%.6f/$%.6f/$%.6f",
-		model, row.InputTokens, row.OutputTokens, inRate, outRate,
-		row.InputCostUsd, row.OutputCostUsd, row.CostUsd, wantInput, wantOutput, wantTotal)
-
-	assert.EqualValues(t, vllmPromptTokens, row.InputTokens, "prompt tokens from the mock usage block")
-	assert.EqualValues(t, vllmCompletionTokens, row.OutputTokens, "completion tokens from the mock usage block")
-	assert.InDeltaf(t, wantInput, row.InputCostUsd, 1e-6, "input_cost_usd must be prompt tokens at the operator input rate")
-	assert.InDeltaf(t, wantOutput, row.OutputCostUsd, 1e-6, "output_cost_usd must be completion tokens at the operator output rate")
-	assert.InDeltaf(t, wantTotal, row.CostUsd, 1e-6, "cost_usd must be the sum of the priced buckets")
-	assert.Zerof(t, row.CachedInputCostUsd, "no cache-read tokens, so cached_input_cost_usd must be 0")
-	assert.Zerof(t, row.CacheCreationCostUsd, "openai surface has no cache-write bucket, so cache_creation_cost_usd must be 0")
-	assert.Zerof(t, row.CacheCostUsd, "no cache usage, so cache_cost_usd must be 0")
-	assert.InDeltaf(t, row.InputCostUsd+row.OutputCostUsd, row.CostUsd, 1e-9, "stored buckets must sum to cost_usd")
-}
-
-// verifyUsageRowForSession re-checks the persisted usage row for a session
-// directly in the management sqlite store — the same audit an operator runs on a
-// production store.db — asserting its cost buckets match the operator rates.
-func verifyUsageRowForSession(t *testing.T, sessionID string, inRate, outRate float64) {
-	t.Helper()
-	dbPath, err := srv.SnapshotStoreDB(t.TempDir())
-	require.NoError(t, err, "snapshot management sqlite store")
-
-	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
-	require.NoError(t, err, "open store snapshot")
-	sqlDB, err := db.DB()
-	require.NoError(t, err)
-	defer func() { _ = sqlDB.Close() }()
-
-	var provider, model string
-	var inTok, outTok, cachedTok, cacheCreateTok int64
-	var inCost, cachedInCost, cacheCreateCost, outCost float64
-	row := db.Raw(`SELECT provider, model, input_tokens, output_tokens, cached_input_tokens, cache_creation_tokens,
-	  input_cost_usd, cached_input_cost_usd, cache_creation_cost_usd, output_cost_usd
-	  FROM agent_network_request_usage WHERE session_id = ? ORDER BY timestamp DESC LIMIT 1`, sessionID).Row()
-	require.NoError(t, row.Scan(&provider, &model, &inTok, &outTok, &cachedTok, &cacheCreateTok,
-		&inCost, &cachedInCost, &cacheCreateCost, &outCost),
-		"a usage row must exist for session %q", sessionID)
-
-	wantInput := float64(inTok) / 1000 * inRate
-	wantOutput := float64(outTok) / 1000 * outRate
-	t.Logf("[sql] session=%s %s/%s in=%d out=%d stored input/cached/create/output=$%.6f/$%.6f/$%.6f/$%.6f",
-		sessionID, provider, model, inTok, outTok, inCost, cachedInCost, cacheCreateCost, outCost)
-	assert.EqualValues(t, vllmPromptTokens, inTok, "usage row prompt tokens")
-	assert.EqualValues(t, vllmCompletionTokens, outTok, "usage row completion tokens")
-	assert.InDeltaf(t, wantInput, inCost, 1e-6, "usage input_cost_usd must be prompt tokens at the operator input rate")
-	assert.InDeltaf(t, wantOutput, outCost, 1e-6, "usage output_cost_usd must be completion tokens at the operator output rate")
-	assert.Zerof(t, cachedInCost, "usage cached_input_cost_usd must be 0 (no cache usage)")
-	assert.Zerof(t, cacheCreateCost, "usage cache_creation_cost_usd must be 0 (no cache usage)")
-}
-
-// TestCustomModelPricing proves an operator can serve a model that is NOT in
-// NetBird's compiled catalog, at prices they type themselves, and that those
-// operator prices drive the recorded cost end to end — access log AND usage
-// ledger. The provider enumerates one made-up model id at deliberately odd rates
-// (no default entry could supply them), the client requests it, and every cost
-// bucket must equal the mock's fixed token counts multiplied by those rates.
-func TestCustomModelPricing(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
-	defer cancel()
-
-	const (
-		customModel = "e2e-custom-model" // absent from the compiled catalog
-		inRate      = 0.037              // odd rates so a stray default can't match
-		outRate     = 0.089
-	)
-
-	env := provisionPricedProvider(t, ctx, "custommodel", []api.AgentNetworkProviderModel{
-		{Id: customModel, InputPer1k: inRate, OutputPer1k: outRate},
-	})
-
-	sessionID := "e2e-session-custommodel"
-	body := chatOnce(t, ctx, env, customModel, sessionID)
-	require.Contains(t, body, "chat.completion", "body should be an OpenAI-compatible completion; got: %s", body)
-
-	row := findAccessLogBySession(t, ctx, sessionID)
-	require.NotNil(t, row.Model, "access-log row must carry the requested model")
-	assert.Equal(t, customModel, *row.Model, "the row must be stamped with the requested (custom) model, not the mock's response model")
-	assertOpenAICostAtRates(t, row, inRate, outRate)
-
-	// Metering: the uncapped token limit switches on usage recording, so the
-	// request must surface as a consumption row with positive tokens and cost.
-	require.Eventually(t, func() bool {
-		rows, lerr := srv.ListConsumption(ctx)
-		if lerr != nil {
-			return false
-		}
-		for _, r := range rows {
-			if r.TokensInput > 0 && r.TokensOutput > 0 && r.CostUsd > 0 {
-				return true
-			}
-		}
-		return false
-	}, 60*time.Second, 3*time.Second, "custom-model usage must be metered into a consumption row with positive cost")
-
-	// Final raw-SQL audit: bypass the API and re-verify the persisted usage row.
-	verifyUsageRowForSession(t, sessionID, inRate, outRate)
-}
-
-// TestPriceChangeUpdatesRecordedCost proves that changing a provider's model
-// price is reflected in the cost recorded for subsequent requests — in both the
-// access log and the usage ledger — while requests already priced at the old
-// rate keep their original cost. The update propagates to the connected proxy
-// live (a mapping push rebuilds the cost_meter chain with the new table), so no
-// reconnect or restart is needed; the test polls a fresh request until the new
-// rate lands.
-func TestPriceChangeUpdatesRecordedCost(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
-	defer cancel()
-
-	const (
-		customModel = "e2e-repriced-model"
-		inRateA     = 0.010
-		outRateA    = 0.020
-		inRateB     = 0.050 // 5x / 4x the original, so a repriced row is unmistakable
-		outRateB    = 0.080
-	)
-
-	env := provisionPricedProvider(t, ctx, "reprice", []api.AgentNetworkProviderModel{
-		{Id: customModel, InputPer1k: inRateA, OutputPer1k: outRateA},
-	})
-
-	// Phase 1 — request priced at the original rate A.
-	sessionA := "e2e-session-reprice-a"
-	chatOnce(t, ctx, env, customModel, sessionA)
-	rowA := findAccessLogBySession(t, ctx, sessionA)
-	assertOpenAICostAtRates(t, rowA, inRateA, outRateA)
-	verifyUsageRowForSession(t, sessionA, inRateA, outRateA)
-
-	// Change the model's price. The API key is omitted so the stored one is kept;
-	// the models array is re-sent with the new rates (PUT replaces the list).
-	// This reconciles synchronously and pushes a fresh cost_meter table to the
-	// already-connected proxy — no reconnect.
-	_, err := srv.UpdateProvider(ctx, env.providerID, api.AgentNetworkProviderRequest{
-		Name:        "reprice",
-		ProviderId:  "openai_api",
-		UpstreamUrl: env.upstream,
-		Enabled:     ptr(true),
-		Models: &[]api.AgentNetworkProviderModel{
-			{Id: customModel, InputPer1k: inRateB, OutputPer1k: outRateB},
-		},
-	})
-	require.NoError(t, err, "update provider price")
-
-	// Phase 2 — the push + chain rebuild is async, so drive fresh requests (each
-	// under its own session) until one is priced at the new rate B. Each iteration
-	// fires one request and waits for that session's row to be ingested before
-	// reading its cost, so an un-ingested row is never mistaken for "still rate A".
-	// The expected new input cost is unmistakably higher than rate A, so a
-	// lingering old-rate row can't satisfy the check.
-	wantInputB := float64(vllmPromptTokens) / 1000 * inRateB
-	var repriced api.AgentNetworkAccessLog
-	var lastSession string
-	deadline := time.Now().Add(90 * time.Second)
-	for time.Now().Before(deadline) {
-		lastSession = fmt.Sprintf("e2e-session-reprice-b-%d", time.Now().UnixNano())
-		code, _, cerr := env.client.Chat(ctx, env.endpoint, env.proxyIP, harness.WireChat, customModel, "Reply with exactly: pong", lastSession)
-		if cerr != nil || code != 200 {
-			time.Sleep(5 * time.Second)
-			continue
-		}
-		row := findAccessLogBySession(t, ctx, lastSession)
-		if inDelta(row.InputCostUsd, wantInputB, 1e-6) {
-			repriced = row
-			break
-		}
-		// Still priced at the old rate — the push hasn't landed yet; retry.
-		time.Sleep(5 * time.Second)
-	}
-	require.NotEmpty(t, repriced.Id, "a request after the price change must be priced at the new rate B; last input_cost_usd=$%.6f, wanted $%.6f\n=== proxy logs ===\n%s",
-		repriced.InputCostUsd, wantInputB, env.proxy.Logs(context.Background()))
-
-	assertOpenAICostAtRates(t, repriced, inRateB, outRateB)
-	verifyUsageRowForSession(t, lastSession, inRateB, outRateB)
-
-	// The original request keeps its original cost: repricing is not retroactive.
-	rowAStill := findAccessLogBySession(t, ctx, sessionA)
-	assertOpenAICostAtRates(t, rowAStill, inRateA, outRateA)
-	verifyUsageRowForSession(t, sessionA, inRateA, outRateA)
-}
-
-// TestPricingDefaultsFileDrivesCost proves the operator-supplied pricing
-// defaults file is what the proxy bills with. The harness configures
-// server.agentNetwork.pricingDefaultsFile as a BARE FILENAME and writes that
-// file into the bind-mounted datadir (see harness.PricingDefaultsFileName), so a
-// pass exercises the whole chain: combined yaml → ToManagementConfig →
-// pricing.LoadFile (relative path resolved against datadir) → DefaultTable →
-// the synthesizer's cost_meter defaults payload → the proxy's lookup.
-//
-// The provider enumerates NO models, so it is a catch-all route with no
-// per-provider-record pricing entry at all — the only rates that can price the
-// request are the shipped defaults. The model is a real catalog model whose
-// built-in rates the file replaces with deliberately odd values, so billing at
-// the compiled-in rates (i.e. the file never loaded) fails the assertions.
-func TestPricingDefaultsFileDrivesCost(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
-	defer cancel()
-
-	// nil models: a gateway-style provider claiming every model. The synthesizer
-	// ships no per-record entry for it, so the defaults table is its price list.
-	env := provisionPricedProvider(t, ctx, "defaultsfile", nil)
-
-	sessionID := "e2e-session-defaultsfile"
-	body := chatOnce(t, ctx, env, harness.PricedDefaultModel, sessionID)
-	require.Contains(t, body, "chat.completion", "body should be an OpenAI-compatible completion; got: %s", body)
-
-	row := findAccessLogBySession(t, ctx, sessionID)
-	require.NotNil(t, row.Model, "access-log row must carry the requested model")
-	assert.Equal(t, harness.PricedDefaultModel, *row.Model, "the row must be stamped with the requested model")
-
-	// The file's rates, not the compiled-in catalog rates for this model.
-	assertOpenAICostAtRates(t, row, harness.PricedDefaultInputPer1k, harness.PricedDefaultOutputPer1k)
-	verifyUsageRowForSession(t, sessionID, harness.PricedDefaultInputPer1k, harness.PricedDefaultOutputPer1k)
-}
-
-// TestPricingDefaultsFileLeavesOtherModelsAlone proves the defaults file merges
-// per entry rather than replacing the whole table: the file names exactly one
-// model, so a DIFFERENT catalog model must still bill at its compiled-in rates.
-// Without this, a file that shipped as a wholesale replacement would silently
-// zero-cost every model the operator didn't list, and TestPricingDefaultsFile-
-// DrivesCost alone would not notice.
-func TestPricingDefaultsFileLeavesOtherModelsAlone(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
-	defer cancel()
-
-	// gpt-4o-mini is a catalog model the pricing file does NOT mention, so it must
-	// keep its built-in rates. Pinned here independently of the catalog source so
-	// a rate change in either place surfaces as a failure to reconcile rather
-	// than passing silently.
-	const (
-		untouchedModel = "gpt-4o-mini"
-		builtinInRate  = 0.00015
-		builtinOutRate = 0.0006
-	)
-
-	env := provisionPricedProvider(t, ctx, "defaultsfileother", nil)
-
-	sessionID := "e2e-session-defaultsfile-other"
-	chatOnce(t, ctx, env, untouchedModel, sessionID)
-
-	row := findAccessLogBySession(t, ctx, sessionID)
-	assertOpenAICostAtRates(t, row, builtinInRate, builtinOutRate)
-	verifyUsageRowForSession(t, sessionID, builtinInRate, builtinOutRate)
-}
-
-// TestCustomModelAccessLogAttribution proves a custom (non-catalog) model is
-// handled correctly in the ACCESS LOG, not just in the cost columns. The other
-// tests here assert money; this one asserts the row's identity and attribution
-// dimensions — the columns the dashboard filters, groups and drills down on.
-//
-// A custom model id is the interesting case precisely because nothing in
-// NetBird's catalog describes it. Its provider vendor, parser surface, cost
-// buckets, and dashboard filterability all have to come from the operator's
-// provider record rather than from a compiled-in entry. So this checks:
-//
-//   - the row is stamped with the REQUESTED model id verbatim, not the mock
-//     upstream's response model (Qwen/Qwen2.5-0.5B-Instruct) and not a
-//     normalized or catalog-substituted id;
-//   - provider is the vendor SURFACE ("openai", from the catalog entry's
-//     ParserID) — a custom model does not change which wire shape was spoken;
-//   - resolved_provider_id / selected_policy_id / group_ids attribute the row to
-//     the operator's provider record, the authorising policy, and the caller's
-//     group, so spend on a custom model is attributable;
-//   - decision is "allow" with no deny reason, and the request dimensions
-//     (status 200, POST, the OpenAI chat path, non-stream, source IP, duration)
-//     are recorded;
-//   - management's SERVER-SIDE model filter finds the row by its custom id, so
-//     the model column is genuinely indexed and queryable rather than merely
-//     stored;
-//   - prompt/completion capture stays empty, since prompt collection is off by
-//     default and a custom model must not bypass that gate.
-func TestCustomModelAccessLogAttribution(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
-	defer cancel()
-
-	// A model id no catalog entry carries, at odd rates so its cost cannot come
-	// from anywhere but the provider record.
-	const (
-		customModel = "e2e-attribution-model-v9"
-		inRate      = 0.0271
-		outRate     = 0.0913
-	)
-
-	env := provisionPricedProvider(t, ctx, "attribution", []api.AgentNetworkProviderModel{
-		{Id: customModel, InputPer1k: inRate, OutputPer1k: outRate},
-	})
-
-	sessionID := "e2e-session-attribution"
-	body := chatOnce(t, ctx, env, customModel, sessionID)
-	require.Contains(t, body, "chat.completion", "body should be an OpenAI-compatible completion; got: %s", body)
-
-	row := findAccessLogBySession(t, ctx, sessionID)
-
-	// Identity: the requested model verbatim. The mock answers with its own
-	// served model id, so a row carrying that instead means the log is sourced
-	// from the response body rather than the parsed request.
-	require.NotNil(t, row.Model, "access-log row must carry the requested model")
-	assert.Equal(t, customModel, *row.Model,
-		"the row must be stamped with the requested custom model id verbatim, not the mock upstream's response model (%s)", harness.VLLMModel)
-
-	// Surface: a custom model id does not change the wire shape that was spoken.
-	// provider is the vendor surface from the catalog entry's parser, which is
-	// also the key the cost meter's cache formula switches on.
-	require.NotNil(t, row.Provider, "access-log row must carry the vendor surface")
-	assert.Equal(t, "openai", *row.Provider,
-		"openai_api's parser surface is openai, regardless of how exotic the model id is")
-
-	// Attribution: which provider record served it, which policy authorised it,
-	// and which group the authorisation came through. Without these, spend on a
-	// custom model can be seen but not attributed.
-	require.NotNil(t, row.ResolvedProviderId, "row must name the provider record that served the request")
-	assert.Equal(t, env.providerID, *row.ResolvedProviderId,
-		"the router stamps the operator's provider record id; a custom model must attribute to the record that enumerated it")
-	require.NotNil(t, row.SelectedPolicyId, "row must name the policy that authorised the request")
-	assert.Equal(t, env.policyID, *row.SelectedPolicyId,
-		"the policy carrying the token limit is the one that paid for the request")
-	require.NotNil(t, row.GroupIds, "row must carry the authorising group ids")
-	assert.Contains(t, *row.GroupIds, env.groupID,
-		"the caller's group is the policy's source group, so it must be the authorising group")
-
-	// Decision + request dimensions.
-	require.NotNil(t, row.Decision, "row must carry the policy decision")
-	assert.Equal(t, "allow", *row.Decision, "the uncapped policy allows this request")
-	if row.DenyReason != nil {
-		assert.Empty(t, *row.DenyReason, "an allowed request must carry no deny reason")
-	}
-	assert.Equal(t, 200, row.StatusCode, "the mock upstream answers 200")
-	if row.Method != nil {
-		assert.Equal(t, "POST", *row.Method, "a chat completion is a POST")
-	}
-	require.NotNil(t, row.Path, "row must record the request path")
-	assert.Equal(t, "/v1/chat/completions", *row.Path,
-		"the OpenAI chat path the client called, as seen by the proxy")
-	require.NotNil(t, row.Host, "row must record the host the client addressed")
-	assert.Equal(t, env.endpoint, *row.Host, "the agent-network endpoint the client resolved")
-	if row.Stream != nil {
-		assert.False(t, *row.Stream, "the harness sends a non-streaming request")
-	}
-	require.NotNil(t, row.SourceIp, "row must record the caller's tunnel IP")
-	assert.NotEmpty(t, *row.SourceIp, "the request arrived over the tunnel, so a source IP is known")
-
-	// Tokens and cost, so the attribution above is anchored to a real priced row
-	// rather than an empty shell that happens to carry the right ids.
-	assertOpenAICostAtRates(t, row, inRate, outRate)
-	assert.EqualValues(t, vllmPromptTokens+vllmCompletionTokens, row.TotalTokens,
-		"total_tokens is the mock's reported total")
-
-	// Prompt capture is off by default (account master switch), and a custom
-	// model must not bypass that gate.
-	if row.RequestPrompt != nil {
-		assert.Empty(t, *row.RequestPrompt, "prompt collection is off by default, so no prompt may be stored")
-	}
-	if row.ResponseCompletion != nil {
-		assert.Empty(t, *row.ResponseCompletion, "prompt collection is off by default, so no completion may be stored")
-	}
-
-	// Queryability: management's SERVER-SIDE model filter must find the row by
-	// its custom id. findAccessLogBySession above scans a page client-side, so
-	// this is the check that the model column is actually indexed and filterable
-	// — the dashboard's per-model drill-down on a custom model depends on it.
-	filtered, err := srv.ListAccessLogsFiltered(ctx, url.Values{"model": []string{customModel}})
-	require.NoError(t, err, "filter access logs by the custom model id")
-	require.Positive(t, filtered.TotalRecords, "the custom model must be findable via the server-side model filter")
-	foundSession := false
-	for _, r := range filtered.Data {
-		require.NotNil(t, r.Model, "filtered row must carry a model")
-		assert.Equal(t, customModel, *r.Model, "the model filter must not return rows for other models")
-		if r.SessionId != nil && *r.SessionId == sessionID {
-			foundSession = true
-		}
-	}
-	assert.True(t, foundSession, "the filtered page must include this test's request")
-
-	// Final raw-SQL audit of the parallel usage row: the ledger must carry the
-	// same custom model, surface, and provider-record attribution as the log.
-	verifyUsageAttributionForSession(t, sessionID, customModel, "openai", env.providerID, env.groupID)
-}
-
-// verifyUsageAttributionForSession checks the usage ledger's attribution columns
-// for a session directly in the management sqlite store — including the group
-// child row, which the API renders but which only exists if the proxy's
-// authorising-group CSV was parsed into normalised rows. The usage table is
-// written unconditionally (independent of the log-collection toggle), so this is
-// the record that must attribute spend even for accounts with logs off.
-func verifyUsageAttributionForSession(t *testing.T, sessionID, wantModel, wantProvider, wantProviderID, wantGroupID string) {
-	t.Helper()
-	dbPath, err := srv.SnapshotStoreDB(t.TempDir())
-	require.NoError(t, err, "snapshot management sqlite store")
-
-	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
-	require.NoError(t, err, "open store snapshot")
-	sqlDB, err := db.DB()
-	require.NoError(t, err)
-	defer func() { _ = sqlDB.Close() }()
-
-	var id, provider, model, resolvedProviderID, userID string
-	require.NoError(t, db.Raw(
-		`SELECT id, provider, model, resolved_provider_id, user_id
-		 FROM agent_network_request_usage WHERE session_id = ? ORDER BY timestamp DESC LIMIT 1`, sessionID).
-		Row().Scan(&id, &provider, &model, &resolvedProviderID, &userID),
-		"a usage row must exist for session %q", sessionID)
-
-	t.Logf("[sql] usage attribution session=%s id=%s provider=%s model=%s resolved_provider_id=%s user_id=%s",
-		sessionID, id, provider, model, resolvedProviderID, userID)
-	assert.Equal(t, wantModel, model, "usage row must carry the requested custom model")
-	assert.Equal(t, wantProvider, provider, "usage row must carry the vendor surface")
-	assert.Equal(t, wantProviderID, resolvedProviderID, "usage row must attribute to the operator's provider record")
-	assert.NotEmpty(t, userID, "the tunnel peer resolves to a principal, so the usage row must be attributable to it")
-
-	// The authorising group lands in the normalised child table, which is what
-	// the usage overview joins on to break spend down by group.
-	var groupIDs []string
-	require.NoError(t, db.Raw(
-		`SELECT group_id FROM agent_network_request_usage_group WHERE usage_id = ?`, id).
-		Scan(&groupIDs).Error, "read usage group child rows")
-	assert.Contains(t, groupIDs, wantGroupID,
-		"the authorising group must be normalised into a usage_group row so spend can be grouped by it")
-}
-
-// inDelta reports whether a and b are within tol of each other.
-func inDelta(a, b, tol float64) bool {
-	d := a - b
-	if d < 0 {
-		d = -d
-	}
-	return d <= tol
-}

e2e/harness/agentnetwork.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/url"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
 )
@@ -75,13 +74,6 @@ func (c *Combined) DeleteProvider(ctx context.Context, id string) error {
 	return anDelete(ctx, c, "/api/agent-network/providers/"+id)
 }
 
-// UpdateProvider replaces a provider by id (PUT). The API key may be omitted on
-// the request to keep the stored one; Models replaces the enumerated list, so
-// this is the path a test uses to change a model's price mid-run.
-func (c *Combined) UpdateProvider(ctx context.Context, id string, req api.AgentNetworkProviderRequest) (api.AgentNetworkProvider, error) {
-	return anRequest[api.AgentNetworkProvider](ctx, c, http.MethodPut, "/api/agent-network/providers/"+id, req)
-}
-
 // SetProviderEnabled toggles a provider's enabled flag, preserving its other
 // fields (the API key is omitted, which keeps the stored one). Used to run one
 // provider at a time so model→provider routing is unambiguous.
@@ -147,16 +139,3 @@ func (c *Combined) ListConsumption(ctx context.Context) ([]api.AgentNetworkConsu
 func (c *Combined) ListAccessLogs(ctx context.Context) (api.AgentNetworkAccessLogsResponse, error) {
 	return anRequest[api.AgentNetworkAccessLogsResponse](ctx, c, http.MethodGet, "/api/agent-network/access-logs", nil)
 }
-
-// ListAccessLogsFiltered returns the access-log page narrowed by the given
-// query parameters (e.g. model=..., session_id=..., provider_id=...). This
-// exercises management's server-side filtering rather than filtering client
-// side, so a row that is ingested but not indexed under the filtered column
-// surfaces as an empty page.
-func (c *Combined) ListAccessLogsFiltered(ctx context.Context, query url.Values) (api.AgentNetworkAccessLogsResponse, error) {
-	path := "/api/agent-network/access-logs"
-	if encoded := query.Encode(); encoded != "" {
-		path += "?" + encoded
-	}
-	return anRequest[api.AgentNetworkAccessLogsResponse](ctx, c, http.MethodGet, path, nil)
-}

e2e/harness/combined.go

@@ -93,19 +93,10 @@ func StartCombined(ctx context.Context) (*Combined, error) {
 		_ = net.Remove(ctx)
 		return nil, fmt.Errorf("write combined config: %w", err)
 	}
-	dataDir := filepath.Join(workDir, "data")
-	if err := os.MkdirAll(dataDir, 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Join(workDir, "data"), 0o755); err != nil {
 		_ = net.Remove(ctx)
 		return nil, fmt.Errorf("create datadir: %w", err)
 	}
-	// The config's agentNetwork.pricingDefaultsFile is a bare filename, so the
-	// server resolves it against the datadir; write it there. It is an explicitly
-	// configured path, so a failure to load fails the server's startup — which
-	// surfaces here as the /api/instance readiness wait timing out.
-	if err := os.WriteFile(filepath.Join(dataDir, PricingDefaultsFileName), []byte(pricingDefaultsYAML), 0o644); err != nil { //nolint:gosec // non-secret config, bind-mounted and read by the container
-		_ = net.Remove(ctx)
-		return nil, fmt.Errorf("write pricing defaults: %w", err)
-	}
 
 	req := testcontainers.ContainerRequest{
 		Image:          combinedImage,

e2e/harness/config.go

@@ -8,13 +8,6 @@ package harness
 // embedded IdP, local signal/relay/STUN, and a sqlite store under the mounted
 // data dir. exposedAddress is the address peers use to reach this container; it
 // is overridden per-run so the value matches the container's network alias.
-//
-// pricingDefaultsFile is deliberately a BARE FILENAME, not an absolute path: it
-// must resolve against dataDir (→ /nb/data/<name>), which is the resolution rule
-// the combined server applies. It is also an EXPLICITLY configured path, so the
-// server is required to load it — a broken path or malformed file fails startup
-// rather than silently falling back to the compiled-in rates, and TestMain then
-// fails with the container logs.
 const combinedConfigYAML = `server:
   listenAddress: ":8080"
   exposedAddress: "%s"
@@ -30,36 +23,4 @@ const combinedConfigYAML = `server:
     issuer: "%s"
   store:
     engine: "sqlite"
-  agentNetwork:
-    pricingDefaultsFile: "` + PricingDefaultsFileName + `"
-`
-
-const (
-	// PricingDefaultsFileName is the basename of the operator-supplied LLM
-	// pricing defaults file the combined server is configured to load. Written
-	// into the bind-mounted datadir by StartCombined.
-	PricingDefaultsFileName = "e2e_llm_pricing.yaml"
-
-	// PricedDefaultModel is a real catalog model (openai surface) whose rates the
-	// defaults file below REPLACES. Tests drive it against the mock vLLM upstream
-	// and assert the file's rates were billed, which is only true if the file
-	// travelled: config → LoadFile → DefaultTable → synthesizer → the proxy's
-	// cost_meter defaults table.
-	PricedDefaultModel = "gpt-4.1-mini"
-	// PricedDefaultInputPer1k / PricedDefaultOutputPer1k are deliberately odd
-	// values that no compiled-in catalog entry carries (gpt-4.1-mini ships as
-	// 0.0004 / 0.0016), so a test asserting them cannot pass on the built-in
-	// table.
-	PricedDefaultInputPer1k  = 0.0123
-	PricedDefaultOutputPer1k = 0.0456
-)
-
-// pricingDefaultsYAML is the operator-supplied pricing defaults file. Its schema
-// is surface -> model -> per-1k rates. Entries replace the compiled-in entry for
-// the same surface+model whole; every other model keeps its built-in rates, so
-// this file overriding one model must not disturb the rest of the table.
-const pricingDefaultsYAML = `openai:
-  gpt-4.1-mini:
-    input_per_1k: 0.0123
-    output_per_1k: 0.0456
 `

infrastructure_files/getting-started.sh

@@ -228,8 +228,6 @@ read_enable_crowdsec() {
   echo "CrowdSec checks client IPs against a community threat intelligence database" > /dev/stderr
   echo "and blocks known malicious sources before they reach your services." > /dev/stderr
   echo "A local CrowdSec LAPI container will be added to your deployment." > /dev/stderr
-  echo "It also enables the AppSec (WAF) endpoint, so services can inspect HTTP" > /dev/stderr
-  echo "requests for exploits. Both stay off per service until you enable them." > /dev/stderr
   echo -n "Enable CrowdSec? [y/N]: " > /dev/stderr
   read -r CHOICE < /dev/tty
 
@@ -499,8 +497,7 @@ generate_configuration_files() {
         # TCP ServersTransport for PROXY protocol v2 to the proxy backend
         render_traefik_dynamic > traefik-dynamic.yaml
         if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-          mkdir -p crowdsec/acquis.d
-          render_crowdsec_appsec_acquis > crowdsec/acquis.d/appsec.yaml
+          mkdir -p crowdsec
         fi
       fi
       ;;
@@ -534,23 +531,6 @@ generate_configuration_files() {
   return 0
 }
 
-# The AppSec (WAF) listener only exists if an appsec acquisition datasource is
-# configured. One datasource is one listener carrying one merged rule set: the
-# protocol has no rule-set selector, so per-service rule variation would need
-# either a second datasource on another port or pre_eval hooks filtering on
-# req.Host.
-render_crowdsec_appsec_acquis() {
-  cat <<EOF
-source: appsec
-listen_addr: 0.0.0.0:7422
-appsec_configs:
-  - crowdsecurity/appsec-default
-labels:
-  type: appsec
-EOF
-  return 0
-}
-
 start_services_and_show_instructions() {
   # For built-in Traefik, start containers immediately
   # For NPM, start containers first (NPM needs services running to create proxy)
@@ -762,11 +742,7 @@ render_docker_compose_traefik_builtin() {
     restart: unless-stopped
     networks: [netbird]
     environment:
-      # appsec-generic-rules is required alongside appsec-virtual-patching:
-      # the appsec-default config references crowdsecurity/generic-* and
-      # crowdsecurity/experimental-*, which only that collection provides, and
-      # the engine exits at startup if they are missing.
-      COLLECTIONS: crowdsecurity/linux crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules
+      COLLECTIONS: crowdsecurity/linux
     volumes:
       - ./crowdsec:/etc/crowdsec
       - crowdsec_db:/var/lib/crowdsec/data
@@ -1031,11 +1007,6 @@ EOF
     cat <<EOF
 NB_PROXY_CROWDSEC_API_URL=http://crowdsec:8080
 NB_PROXY_CROWDSEC_API_KEY=$CROWDSEC_BOUNCER_KEY
-# AppSec (WAF) request inspection. Separate endpoint from the LAPI above and
-# validated with the same bouncer key. Setting it makes the proxy advertise the
-# AppSec capability, which is what lets a service select appsec_mode; nothing is
-# inspected until a service opts in.
-NB_PROXY_CROWDSEC_APPSEC_URL=http://crowdsec:7422/
 EOF
   fi
 

management/cmd/management.go

@@ -23,7 +23,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"
 
 	"github.com/netbirdio/netbird/formatter/hook"
-	agentnetworkpricing "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
 	"github.com/netbirdio/netbird/management/internals/server"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
@@ -113,29 +112,6 @@ var (
 				mgmtSingleAccModeDomain = ""
 			}
 
-			// Load the management-side LLM pricing defaults file: an
-			// explicitly configured path is required to load (a typo must
-			// fail startup — the operator believes those rates are live);
-			// otherwise <datadir>/defaults_llm_pricing.yaml is probed and
-			// may be absent (compiled-in defaults serve). A relative path
-			// is resolved against the datadir so a bare filename lands
-			// alongside the store. Either way the path stays watched: the
-			// reloader picks up edits — and the file appearing later —
-			// without a restart.
-			pricingPath := config.AgentNetwork.PricingDefaultsFile
-			pricingRequired := pricingPath != ""
-			if !pricingRequired {
-				pricingPath = agentnetworkpricing.DefaultFileName
-			}
-			if !filepath.IsAbs(pricingPath) {
-				pricingPath = filepath.Join(config.Datadir, pricingPath)
-			}
-			log.Infof("loading agent-network pricing defaults from %s (required: %v)", pricingPath, pricingRequired)
-			if err := agentnetworkpricing.LoadFile(pricingPath, pricingRequired); err != nil {
-				return fmt.Errorf("load agent-network pricing defaults: %v", err)
-			}
-			agentnetworkpricing.StartReloader(ctx, agentnetworkpricing.ReloadInterval)
-
 			srv := newServer(&server.Config{
 				NbConfig:                    config,
 				DNSDomain:                   dnsDomain,

management/internals/modules/agentnetwork/catalog/catalog.go

@@ -7,28 +7,12 @@ package catalog
 import "github.com/netbirdio/netbird/shared/management/http/api"
 
 // Model is the in-memory representation of a catalog model.
-//
-// The three cache rates mirror the proxy cost meter's Entry semantics
-// (USD per 1k tokens; 0 = no rate configured, that bucket bills at
-// InputPer1k):
-//   - CachedInputPer1k: OpenAI-shape rate for cached prompt tokens
-//     (a SUBSET of input tokens). Typically 0.1-0.5x input.
-//   - CacheReadPer1k / CacheCreationPer1k: Anthropic-shape rates for
-//     the two ADDITIVE prompt-cache buckets. Typically 0.1x / 1.25x
-//     input.
-//
-// The catalog is the single default-pricing source: the agentnetwork
-// pricing package folds these models into per-surface tables that the
-// synthesizer ships to the proxy's cost_meter.
 type Model struct {
-	ID                 string
-	Label              string
-	InputPer1k         float64
-	OutputPer1k        float64
-	CachedInputPer1k   float64
-	CacheReadPer1k     float64
-	CacheCreationPer1k float64
-	ContextWindow      int
+	ID            string
+	Label         string
+	InputPer1k    float64
+	OutputPer1k   float64
+	ContextWindow int
 }
 
 // ProviderKind groups catalog entries for UI presentation. The split
@@ -81,17 +65,6 @@ type Provider struct {
 	// surface — the proxy middleware then falls back to URL sniffing
 	// or skips request-side enrichment.
 	ParserID string
-	// PricingSurfaces names the cost-meter pricing surfaces this
-	// provider's Models are priced under ("openai", "anthropic",
-	// "bedrock" — the llm.Parser surface the request parser stamps as
-	// llm.provider at billing time). NOT derivable from ParserID:
-	// bedrock_api and vertex_ai_api leave ParserID empty (URL-sniffed)
-	// yet price under "bedrock" / "anthropic", and kimi_api serves two
-	// body shapes so it prices under both. Nil for gateway/custom
-	// entries, which declare no models. Same (surface, model) pair
-	// contributed by two providers must carry identical rates — the
-	// pricing package's tests enforce that.
-	PricingSurfaces []string
 	// IdentityInjection, when non-nil, instructs the proxy to stamp
 	// the caller's NetBird identity onto upstream requests under the
 	// configured header names. Used for gateways like LiteLLM that
@@ -246,7 +219,6 @@ var providers = []Provider{
 		DefaultContentType: "application/json",
 		BrandColor:         "#10A37F",
 		ParserID:           "openai",
-		PricingSurfaces:    []string{"openai"},
 		// Pricing + context windows cross-checked against LiteLLM's
 		// model_prices_and_context_window.json. Notable corrections from
 		// earlier values: o4-mini repriced from $4/$16 to $1.10/$4.40
@@ -254,20 +226,20 @@ var providers = []Provider{
 		// family context windows split between 1.05M for full-size
 		// models and 272K for mini/nano/codex variants.
 		Models: []Model{
-			{ID: "gpt-5.5", Label: "GPT-5.5", InputPer1k: 0.005, OutputPer1k: 0.030, CachedInputPer1k: 0.0005, ContextWindow: 1050000},
-			{ID: "gpt-5.5-pro", Label: "GPT-5.5 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, CachedInputPer1k: 0.003, ContextWindow: 1050000},
-			{ID: "gpt-5.4", Label: "GPT-5.4", InputPer1k: 0.0025, OutputPer1k: 0.015, CachedInputPer1k: 0.00025, ContextWindow: 1050000},
-			{ID: "gpt-5.4-pro", Label: "GPT-5.4 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, CachedInputPer1k: 0.003, ContextWindow: 1050000},
-			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini", InputPer1k: 0.00075, OutputPer1k: 0.0045, CachedInputPer1k: 0.000075, ContextWindow: 272000},
-			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano", InputPer1k: 0.0002, OutputPer1k: 0.00125, CachedInputPer1k: 0.00002, ContextWindow: 272000},
-			{ID: "gpt-5.3-codex", Label: "GPT-5.3 Codex", InputPer1k: 0.00175, OutputPer1k: 0.014, CachedInputPer1k: 0.000175, ContextWindow: 272000},
-			{ID: "gpt-5.3-chat-latest", Label: "GPT-5.3 Chat", InputPer1k: 0.00175, OutputPer1k: 0.014, CachedInputPer1k: 0.000175, ContextWindow: 128000},
-			{ID: "o4-mini", Label: "o4-mini", InputPer1k: 0.0011, OutputPer1k: 0.0044, CachedInputPer1k: 0.000275, ContextWindow: 200000},
-			{ID: "gpt-4.1", Label: "GPT-4.1", InputPer1k: 0.002, OutputPer1k: 0.008, CachedInputPer1k: 0.0005, ContextWindow: 1047576},
-			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini", InputPer1k: 0.0004, OutputPer1k: 0.0016, CachedInputPer1k: 0.0001, ContextWindow: 1047576},
-			{ID: "gpt-4.1-nano", Label: "GPT-4.1 nano", InputPer1k: 0.0001, OutputPer1k: 0.0004, CachedInputPer1k: 0.000025, ContextWindow: 1047576},
-			{ID: "gpt-4o", Label: "GPT-4o", InputPer1k: 0.0025, OutputPer1k: 0.010, CachedInputPer1k: 0.00125, ContextWindow: 128000},
-			{ID: "gpt-4o-mini", Label: "GPT-4o mini", InputPer1k: 0.00015, OutputPer1k: 0.0006, CachedInputPer1k: 0.000075, ContextWindow: 128000},
+			{ID: "gpt-5.5", Label: "GPT-5.5", InputPer1k: 0.005, OutputPer1k: 0.030, ContextWindow: 1050000},
+			{ID: "gpt-5.5-pro", Label: "GPT-5.5 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, ContextWindow: 1050000},
+			{ID: "gpt-5.4", Label: "GPT-5.4", InputPer1k: 0.0025, OutputPer1k: 0.015, ContextWindow: 1050000},
+			{ID: "gpt-5.4-pro", Label: "GPT-5.4 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, ContextWindow: 1050000},
+			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini", InputPer1k: 0.00075, OutputPer1k: 0.0045, ContextWindow: 272000},
+			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano", InputPer1k: 0.0002, OutputPer1k: 0.00125, ContextWindow: 272000},
+			{ID: "gpt-5.3-codex", Label: "GPT-5.3 Codex", InputPer1k: 0.00175, OutputPer1k: 0.014, ContextWindow: 272000},
+			{ID: "gpt-5.3-chat-latest", Label: "GPT-5.3 Chat", InputPer1k: 0.00175, OutputPer1k: 0.014, ContextWindow: 128000},
+			{ID: "o4-mini", Label: "o4-mini", InputPer1k: 0.0011, OutputPer1k: 0.0044, ContextWindow: 200000},
+			{ID: "gpt-4.1", Label: "GPT-4.1", InputPer1k: 0.002, OutputPer1k: 0.008, ContextWindow: 1047576},
+			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini", InputPer1k: 0.0004, OutputPer1k: 0.0016, ContextWindow: 1047576},
+			{ID: "gpt-4.1-nano", Label: "GPT-4.1 nano", InputPer1k: 0.0001, OutputPer1k: 0.0004, ContextWindow: 1047576},
+			{ID: "gpt-4o", Label: "GPT-4o", InputPer1k: 0.0025, OutputPer1k: 0.010, ContextWindow: 128000},
+			{ID: "gpt-4o-mini", Label: "GPT-4o mini", InputPer1k: 0.00015, OutputPer1k: 0.0006, ContextWindow: 128000},
 			{ID: "gpt-4-turbo", Label: "GPT-4 Turbo", InputPer1k: 0.01, OutputPer1k: 0.03, ContextWindow: 128000},
 			{ID: "gpt-3.5-turbo", Label: "GPT-3.5 Turbo", InputPer1k: 0.0005, OutputPer1k: 0.0015, ContextWindow: 16385},
 			{ID: "text-embedding-3-large", Label: "text-embedding-3-large", InputPer1k: 0.00013, OutputPer1k: 0, ContextWindow: 8191},
@@ -285,7 +257,6 @@ var providers = []Provider{
 		DefaultContentType: "application/json",
 		BrandColor:         "#D97757",
 		ParserID:           "anthropic",
-		PricingSurfaces:    []string{"anthropic"},
 		// Per Anthropic's current model lineup. Pricing in USD per 1k
 		// tokens. Context windows: 4.6+ family is 1M; Haiku 4.5 stays at
 		// 200K. claude-3-7-sonnet and claude-3-5-haiku retired
@@ -296,14 +267,14 @@ var providers = []Provider{
 		// account to be on >= 30-day data retention or all requests
 		// 400.
 		Models: []Model{
-			{ID: "claude-fable-5", Label: "Claude Fable 5", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
-			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (deprecated, retires 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, CacheReadPer1k: 0.0015, CacheCreationPer1k: 0.01875, ContextWindow: 200000},
-			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
-			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 200000},
-			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5", InputPer1k: 0.001, OutputPer1k: 0.005, CacheReadPer1k: 0.0001, CacheCreationPer1k: 0.00125, ContextWindow: 200000},
+			{ID: "claude-fable-5", Label: "Claude Fable 5", InputPer1k: 0.010, OutputPer1k: 0.050, ContextWindow: 1000000},
+			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (deprecated, retires 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
+			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
+			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
+			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
 		},
 	},
 	{
@@ -317,19 +288,18 @@ var providers = []Provider{
 		DefaultContentType: "application/json",
 		BrandColor:         "#0078D4",
 		ParserID:           "openai",
-		PricingSurfaces:    []string{"openai"},
 		// Mirrors openai_api pricing — Azure resells OpenAI models at the
 		// same per-token rates, just under different deployment names.
 		Models: []Model{
-			{ID: "gpt-5.5", Label: "GPT-5.5 (Azure)", InputPer1k: 0.005, OutputPer1k: 0.030, CachedInputPer1k: 0.0005, ContextWindow: 1050000},
-			{ID: "gpt-5.4", Label: "GPT-5.4 (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.015, CachedInputPer1k: 0.00025, ContextWindow: 1050000},
-			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini (Azure)", InputPer1k: 0.00075, OutputPer1k: 0.0045, CachedInputPer1k: 0.000075, ContextWindow: 272000},
-			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano (Azure)", InputPer1k: 0.0002, OutputPer1k: 0.00125, CachedInputPer1k: 0.00002, ContextWindow: 272000},
-			{ID: "o4-mini", Label: "o4-mini (Azure)", InputPer1k: 0.0011, OutputPer1k: 0.0044, CachedInputPer1k: 0.000275, ContextWindow: 200000},
-			{ID: "gpt-4.1", Label: "GPT-4.1 (Azure)", InputPer1k: 0.002, OutputPer1k: 0.008, CachedInputPer1k: 0.0005, ContextWindow: 1047576},
-			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini (Azure)", InputPer1k: 0.0004, OutputPer1k: 0.0016, CachedInputPer1k: 0.0001, ContextWindow: 1047576},
-			{ID: "gpt-4o", Label: "GPT-4o (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.010, CachedInputPer1k: 0.00125, ContextWindow: 128000},
-			{ID: "gpt-4o-mini", Label: "GPT-4o mini (Azure)", InputPer1k: 0.00015, OutputPer1k: 0.0006, CachedInputPer1k: 0.000075, ContextWindow: 128000},
+			{ID: "gpt-5.5", Label: "GPT-5.5 (Azure)", InputPer1k: 0.005, OutputPer1k: 0.030, ContextWindow: 1050000},
+			{ID: "gpt-5.4", Label: "GPT-5.4 (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.015, ContextWindow: 1050000},
+			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini (Azure)", InputPer1k: 0.00075, OutputPer1k: 0.0045, ContextWindow: 272000},
+			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano (Azure)", InputPer1k: 0.0002, OutputPer1k: 0.00125, ContextWindow: 272000},
+			{ID: "o4-mini", Label: "o4-mini (Azure)", InputPer1k: 0.0011, OutputPer1k: 0.0044, ContextWindow: 200000},
+			{ID: "gpt-4.1", Label: "GPT-4.1 (Azure)", InputPer1k: 0.002, OutputPer1k: 0.008, ContextWindow: 1047576},
+			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini (Azure)", InputPer1k: 0.0004, OutputPer1k: 0.0016, ContextWindow: 1047576},
+			{ID: "gpt-4o", Label: "GPT-4o (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.010, ContextWindow: 128000},
+			{ID: "gpt-4o-mini", Label: "GPT-4o mini (Azure)", InputPer1k: 0.00015, OutputPer1k: 0.0006, ContextWindow: 128000},
 			{ID: "gpt-35-turbo", Label: "GPT-3.5 Turbo (Azure)", InputPer1k: 0.0005, OutputPer1k: 0.0015, ContextWindow: 16385},
 		},
 	},
@@ -343,9 +313,6 @@ var providers = []Provider{
 		AuthHeaderTemplate: "Bearer ${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#FF9900",
-		// ParserID stays empty (path-style dispatch via IsBedrockPathStyle);
-		// the request parser meters these under the "bedrock" surface.
-		PricingSurfaces: []string{"bedrock"},
 		// Anthropic models on Bedrock take the anthropic.* prefix and
 		// follow the same lineup / pricing as the first-party Anthropic
 		// catalog entry above. claude-3-7-sonnet and claude-3-5-haiku
@@ -355,13 +322,13 @@ var providers = []Provider{
 		// Llama 3.3 70B entry kept unchanged — LiteLLM tracks only
 		// per-region Llama 3 entries; standalone 3.3 not yet listed.
 		Models: []Model{
-			{ID: "anthropic.claude-opus-4-8", Label: "Claude Opus 4.8 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "anthropic.claude-opus-4-7", Label: "Claude Opus 4.7 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "anthropic.claude-opus-4-6", Label: "Claude Opus 4.6 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "anthropic.claude-opus-4-1", Label: "Claude Opus 4.1 (Bedrock, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, CacheReadPer1k: 0.0015, CacheCreationPer1k: 0.01875, ContextWindow: 200000},
-			{ID: "anthropic.claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
-			{ID: "anthropic.claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 200000},
-			{ID: "anthropic.claude-haiku-4-5", Label: "Claude Haiku 4.5 (Bedrock)", InputPer1k: 0.001, OutputPer1k: 0.005, CacheReadPer1k: 0.0001, CacheCreationPer1k: 0.00125, ContextWindow: 200000},
+			{ID: "anthropic.claude-opus-4-8", Label: "Claude Opus 4.8 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-7", Label: "Claude Opus 4.7 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-6", Label: "Claude Opus 4.6 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-1", Label: "Claude Opus 4.1 (Bedrock, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
+			{ID: "anthropic.claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
+			{ID: "anthropic.claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
+			{ID: "anthropic.claude-haiku-4-5", Label: "Claude Haiku 4.5 (Bedrock)", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
 			{ID: "meta.llama3-3-70b-instruct", Label: "Llama 3.3 70B (Bedrock)", InputPer1k: 0.00072, OutputPer1k: 0.00072, ContextWindow: 128000},
 			{ID: "amazon.nova-2-lite", Label: "Amazon Nova 2 Lite (Bedrock, preview)", InputPer1k: 0.0003, OutputPer1k: 0.0025, ContextWindow: 1000000},
 			{ID: "amazon.nova-pro", Label: "Amazon Nova Pro (Bedrock)", InputPer1k: 0.0008, OutputPer1k: 0.0032, ContextWindow: 300000},
@@ -391,10 +358,6 @@ var providers = []Provider{
 		AuthHeaderTemplate: "Bearer ${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#4285F4",
-		// ParserID stays empty (path-style dispatch via IsVertexPathStyle);
-		// Anthropic-on-Vertex requests are metered under the "anthropic"
-		// surface with the bare, unversioned model id.
-		PricingSurfaces: []string{"anthropic"},
 		// Vertex carries the model in the URL path and authenticates with a
 		// service-account-minted OAuth token (api_key = "keyfile::<base64 SA>").
 		// Only Anthropic-on-Vertex is metered today: the request parser maps the
@@ -406,14 +369,14 @@ var providers = []Provider{
 		// exists — the router denies unmeterable publishers rather than forward
 		// them uncounted.
 		Models: []Model{
-			{ID: "claude-fable-5", Label: "Claude Fable 5 (Vertex)", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
-			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (Vertex, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, CacheReadPer1k: 0.0015, CacheCreationPer1k: 0.01875, ContextWindow: 200000},
-			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
-			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 200000},
-			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5 (Vertex)", InputPer1k: 0.001, OutputPer1k: 0.005, CacheReadPer1k: 0.0001, CacheCreationPer1k: 0.00125, ContextWindow: 200000},
+			{ID: "claude-fable-5", Label: "Claude Fable 5 (Vertex)", InputPer1k: 0.010, OutputPer1k: 0.050, ContextWindow: 1000000},
+			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (Vertex, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
+			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
+			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
+			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5 (Vertex)", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
 		},
 	},
 	{
@@ -427,7 +390,6 @@ var providers = []Provider{
 		DefaultContentType: "application/json",
 		BrandColor:         "#FF7000",
 		ParserID:           "openai",
-		PricingSurfaces:    []string{"openai"},
 		// Pricing + context windows cross-checked against LiteLLM. Key
 		// gotchas the marketing page hides:
 		//   - `mistral-medium-latest` aliases to Medium 3.1 ($0.40/$2),
@@ -486,10 +448,6 @@ var providers = []Provider{
 		// model id "k3") is account-bound seat licensing rather than a
 		// meterable platform key, so it's deliberately not the default.
 		ParserID: "",
-		// Both body shapes are metered: /v1/chat/completions under
-		// "openai", /anthropic/v1/messages under "anthropic" — so the
-		// K3 entry is priced on both surfaces.
-		PricingSurfaces: []string{"openai", "anthropic"},
 		// Pricing per Moonshot's platform rates at K3 launch (July 2026):
 		// $3/$15 per MTok with $0.30 cached input, flat across the 1M-token
 		// window. kimi-k3 is the ONLY model the platform serves newer
@@ -500,14 +458,7 @@ var providers = []Provider{
 		// The consumer app's "K3 Swarm Max" mode is not an API SKU, so it
 		// doesn't appear here.
 		Models: []Model{
-			// Carries both cache shapes: Moonshot reports cache hits
-			// OpenAI-style on /v1/chat/completions (CachedInputPer1k)
-			// and Anthropic-style on /anthropic/v1/messages
-			// (CacheReadPer1k) — $0.30/MTok either way. Each surface's
-			// cost formula reads only its own field, so the superset
-			// entry prices both endpoints correctly. No cache-creation
-			// rate published; writes bill at the input rate.
-			{ID: "kimi-k3", Label: "Kimi K3", InputPer1k: 0.003, OutputPer1k: 0.015, CachedInputPer1k: 0.0003, CacheReadPer1k: 0.0003, ContextWindow: 1000000},
+			{ID: "kimi-k3", Label: "Kimi K3", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
 		},
 	},
 	{
@@ -807,28 +758,13 @@ func IsBedrockPathStyle(providerID string) bool {
 func (p Provider) ToAPIResponse() api.AgentNetworkCatalogProvider {
 	models := make([]api.AgentNetworkCatalogModel, 0, len(p.Models))
 	for _, m := range p.Models {
-		am := api.AgentNetworkCatalogModel{
+		models = append(models, api.AgentNetworkCatalogModel{
 			Id:            m.ID,
 			Label:         m.Label,
 			InputPer1k:    m.InputPer1k,
 			OutputPer1k:   m.OutputPer1k,
 			ContextWindow: m.ContextWindow,
-		}
-		// Cache rates are emitted only when configured so the dashboard
-		// can prefill them; 0 stays off the wire (absent = no rate).
-		if m.CachedInputPer1k > 0 {
-			v := m.CachedInputPer1k
-			am.CachedInputPer1k = &v
-		}
-		if m.CacheReadPer1k > 0 {
-			v := m.CacheReadPer1k
-			am.CacheReadPer1k = &v
-		}
-		if m.CacheCreationPer1k > 0 {
-			v := m.CacheCreationPer1k
-			am.CacheCreationPer1k = &v
-		}
-		models = append(models, am)
+		})
 	}
 	kind := api.AgentNetworkCatalogProviderKindProvider
 	switch p.Kind {
@@ -848,10 +784,6 @@ func (p Provider) ToAPIResponse() api.AgentNetworkCatalogProvider {
 		BrandColor:         p.BrandColor,
 		Models:             models,
 	}
-	if len(p.PricingSurfaces) > 0 {
-		surfaces := append([]string(nil), p.PricingSurfaces...)
-		resp.PricingSurfaces = &surfaces
-	}
 	if len(p.ExtraHeaders) > 0 {
 		extras := make([]api.AgentNetworkCatalogExtraHeader, 0, len(p.ExtraHeaders))
 		for _, h := range p.ExtraHeaders {

management/internals/modules/agentnetwork/handlers/providers_handler.go

@@ -7,7 +7,6 @@ package handlers
 
 import (
 	"encoding/json"
-	"math"
 	"net/http"
 	"net/url"
 	"strings"
@@ -16,7 +15,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/shared/management/http/api"
@@ -54,45 +52,11 @@ func (h *handler) getCatalogProviders(w http.ResponseWriter, r *http.Request) {
 	entries := catalog.All()
 	out := make([]api.AgentNetworkCatalogProvider, 0, len(entries))
 	for _, e := range entries {
-		resp := e.ToAPIResponse()
-		applyDefaultPricing(e, &resp)
-		out = append(out, resp)
+		out = append(out, e.ToAPIResponse())
 	}
 	util.WriteJSONObject(r.Context(), w, out)
 }
 
-// applyDefaultPricing overwrites the catalog response's model rates with
-// the LIVE default pricing table, which may differ from the compiled-in
-// catalog rates when the operator provides a defaults_llm_pricing.yaml.
-// This keeps the dashboard's model-row prefill identical to what the
-// proxy will actually bill — the same table the synthesizer ships.
-func applyDefaultPricing(cp catalog.Provider, resp *api.AgentNetworkCatalogProvider) {
-	if len(cp.PricingSurfaces) == 0 {
-		return
-	}
-	for i := range resp.Models {
-		m := &resp.Models[i]
-		e, ok := pricing.LookupDefault(cp.PricingSurfaces, m.Id)
-		if !ok {
-			continue
-		}
-		m.InputPer1k = e.InputPer1k
-		m.OutputPer1k = e.OutputPer1k
-		m.CachedInputPer1k = positiveRatePtr(e.CachedInputPer1k)
-		m.CacheReadPer1k = positiveRatePtr(e.CacheReadPer1k)
-		m.CacheCreationPer1k = positiveRatePtr(e.CacheCreationPer1k)
-	}
-}
-
-// positiveRatePtr renders a cache rate for the API: absent (nil) when
-// unset, matching the catalog response convention.
-func positiveRatePtr(v float64) *float64 {
-	if v <= 0 {
-		return nil
-	}
-	return &v
-}
-
 func (h *handler) getAllProviders(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -249,38 +213,5 @@ func validate(req *api.AgentNetworkProviderRequest, requireAPIKey bool) error {
 	if requireAPIKey && (req.ApiKey == nil || strings.TrimSpace(*req.ApiKey) == "") {
 		return status.Errorf(status.InvalidArgument, "api_key is required")
 	}
-	if req.Models != nil {
-		for i, m := range *req.Models {
-			if err := validateModel(i, m); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-// validateModel is the single ingress guard for operator-entered pricing:
-// these rates are synthesized into the proxy's cost_meter config verbatim,
-// and a negative or non-finite rate there would poison every cost the
-// proxy records, so reject at the API boundary.
-func validateModel(i int, m api.AgentNetworkProviderModel) error {
-	if strings.TrimSpace(m.Id) == "" {
-		return status.Errorf(status.InvalidArgument, "models[%d]: id is required", i)
-	}
-	rates := map[string]*float64{
-		"input_per_1k":          &m.InputPer1k,
-		"output_per_1k":         &m.OutputPer1k,
-		"cached_input_per_1k":   m.CachedInputPer1k,
-		"cache_read_per_1k":     m.CacheReadPer1k,
-		"cache_creation_per_1k": m.CacheCreationPer1k,
-	}
-	for field, v := range rates {
-		if v == nil {
-			continue
-		}
-		if *v < 0 || math.IsNaN(*v) || math.IsInf(*v, 0) {
-			return status.Errorf(status.InvalidArgument, "models[%d] (%s): %s must be a finite, non-negative USD rate", i, m.Id, field)
-		}
-	}
 	return nil
 }

management/internals/modules/agentnetwork/handlers/providers_handler_test.go

@@ -1,53 +0,0 @@
-package handlers
-
-import (
-	"math"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-func f(v float64) *float64 { return &v }
-
-// TestValidate_ModelRates guards the single ingress point for operator-entered
-// pricing. These rates flow verbatim into the proxy's cost_meter config at
-// synthesis time; the proxy treats a bad rate as a chain-build failure, so
-// rejecting here is what keeps an account's gateway from going down.
-func TestValidate_ModelRates(t *testing.T) {
-	base := func(models ...api.AgentNetworkProviderModel) *api.AgentNetworkProviderRequest {
-		key := "sk-test"
-		return &api.AgentNetworkProviderRequest{
-			ProviderId:  "openai_api",
-			Name:        "OpenAI",
-			UpstreamUrl: "https://api.openai.com",
-			ApiKey:      &key,
-			Models:      &models,
-		}
-	}
-
-	valid := api.AgentNetworkProviderModel{
-		Id: "gpt-4o", InputPer1k: 0.0025, OutputPer1k: 0.01,
-		CachedInputPer1k: f(0.00125),
-	}
-	require.NoError(t, validate(base(valid), true), "finite non-negative rates must pass")
-
-	zeroRates := api.AgentNetworkProviderModel{Id: "self-hosted-llama", InputPer1k: 0, OutputPer1k: 0}
-	require.NoError(t, validate(base(zeroRates), true), "explicit zero prices are allowed (free / self-hosted models)")
-
-	cases := map[string]api.AgentNetworkProviderModel{
-		"empty id":           {Id: "  ", InputPer1k: 0.001, OutputPer1k: 0.002},
-		"negative input":     {Id: "m", InputPer1k: -0.001, OutputPer1k: 0.002},
-		"negative output":    {Id: "m", InputPer1k: 0.001, OutputPer1k: -0.002},
-		"NaN input":          {Id: "m", InputPer1k: math.NaN(), OutputPer1k: 0.002},
-		"Inf output":         {Id: "m", InputPer1k: 0.001, OutputPer1k: math.Inf(1)},
-		"negative cached":    {Id: "m", InputPer1k: 0.001, OutputPer1k: 0.002, CachedInputPer1k: f(-1)},
-		"NaN cache read":     {Id: "m", InputPer1k: 0.001, OutputPer1k: 0.002, CacheReadPer1k: f(math.NaN())},
-		"Inf cache creation": {Id: "m", InputPer1k: 0.001, OutputPer1k: 0.002, CacheCreationPer1k: f(math.Inf(-1))},
-	}
-	for name, m := range cases {
-		assert.Error(t, validate(base(m), true), "case %q must be rejected", name)
-	}
-}

management/internals/modules/agentnetwork/pricing/defaults.go

@@ -1,156 +0,0 @@
-// Package pricing builds the default LLM pricing table the synthesizer
-// ships to the proxy's cost_meter middleware. The catalog is the single
-// source of default rates: every catalog provider's models are folded
-// into the pricing surfaces the provider declares (PricingSurfaces),
-// then a small supplemental list adds priced-but-not-operator-selectable
-// entries. Management is the sole pricing authority — the proxy carries
-// no embedded price list and bills exclusively from the table it is
-// sent.
-//go:generate go run gen.go
-
-package pricing
-
-import (
-	"sync"
-	"sync/atomic"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-)
-
-// Entry is a single model's pricing in USD per 1k tokens. This struct IS
-// the wire shape: the synthesizer marshals it verbatim into cost_meter's
-// ConfigJSON, and the proxy unmarshals the same field names.
-//
-// A zero rate means "no rate configured" — the proxy bills that cache
-// bucket at InputPer1k (identical semantics to the retired proxy-embedded
-// table). CachedInputPer1k is the OpenAI shape (cached prompt tokens are
-// a subset of input); CacheReadPer1k / CacheCreationPer1k are the
-// Anthropic shape (additive buckets).
-type Entry struct {
-	InputPer1k         float64 `json:"input_per_1k"`
-	OutputPer1k        float64 `json:"output_per_1k"`
-	CachedInputPer1k   float64 `json:"cached_input_per_1k,omitempty"`
-	CacheReadPer1k     float64 `json:"cache_read_per_1k,omitempty"`
-	CacheCreationPer1k float64 `json:"cache_creation_per_1k,omitempty"`
-}
-
-// supplementalDefaults are (surface, model) entries that are priced but
-// deliberately not operator-selectable in the catalog. Each carries a
-// reason; when one of these models joins a catalog lineup, delete the
-// row here — the collision test fails loudly if the rates ever disagree.
-var supplementalDefaults = map[string]map[string]Entry{
-	"openai": {
-		// GPT-5 (2025) family — kept for gateway requests using the
-		// unsuffixed ids; the dashboard offers only the 5.x lineup.
-		"gpt-5":      {InputPer1k: 0.00125, OutputPer1k: 0.01, CachedInputPer1k: 0.000125},
-		"gpt-5-mini": {InputPer1k: 0.00025, OutputPer1k: 0.002, CachedInputPer1k: 0.000025},
-		"gpt-5-nano": {InputPer1k: 0.00005, OutputPer1k: 0.0004, CachedInputPer1k: 0.000005},
-	},
-	"anthropic": {
-		// claude-opus-5 is not yet in the catalog lineup but gateway /
-		// grandfathered traffic uses it; priced so it isn't skipped.
-		"claude-opus-5": {InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625},
-		// "kimi-k3[1m]" is the 1M-context alias some Claude Code guides
-		// configure against Moonshot's Anthropic-compatible endpoint;
-		// priced identically to kimi-k3 so those requests aren't skipped.
-		"kimi-k3[1m]": {InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003},
-	},
-	"bedrock": {
-		"anthropic.claude-opus-5": {InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625},
-	},
-}
-
-var (
-	compiledOnce  sync.Once
-	compiledTable map[string]map[string]Entry
-	// mergedTable holds the current live table when a pricing defaults
-	// file is loaded: the file merged entry-whole over the compiled-in
-	// base. Nil while no file is loaded (or after the file is removed),
-	// in which case the compiled-in table serves. Swapped atomically by
-	// the file loader/reloader; readers never block.
-	mergedTable atomic.Pointer[map[string]map[string]Entry]
-)
-
-// DefaultTable returns the current default pricing table keyed
-// surface -> model -> Entry: the management-side defaults file (see
-// LoadFile / StartReloader) when one is loaded, merged over the
-// compiled-in catalog table, which alone serves as the fallback when no
-// file exists. The snapshot may change between calls as the file is
-// re-read — consumers (the synthesizer on every reconcile, the catalog
-// endpoint on every request) pick up fresh rates automatically. Callers
-// must not mutate the returned maps.
-func DefaultTable() map[string]map[string]Entry {
-	if t := mergedTable.Load(); t != nil {
-		return *t
-	}
-	return compiledBase()
-}
-
-// compiledBase returns the compiled-in table (catalog + supplementals),
-// built once.
-func compiledBase() map[string]map[string]Entry {
-	compiledOnce.Do(func() {
-		compiledTable = buildDefaultTable()
-	})
-	return compiledTable
-}
-
-func buildDefaultTable() map[string]map[string]Entry {
-	out := make(map[string]map[string]Entry)
-	for _, p := range catalog.All() {
-		for _, surface := range p.PricingSurfaces {
-			inner, ok := out[surface]
-			if !ok {
-				inner = make(map[string]Entry)
-				out[surface] = inner
-			}
-			for _, m := range p.Models {
-				// First writer wins; providers contributing the same
-				// (surface, model) must agree on rates — enforced by
-				// TestDefaultTable_NoConflictingContributions.
-				if _, dup := inner[m.ID]; dup {
-					continue
-				}
-				inner[m.ID] = entryFromCatalogModel(m)
-			}
-		}
-	}
-	for surface, models := range supplementalDefaults {
-		inner, ok := out[surface]
-		if !ok {
-			inner = make(map[string]Entry)
-			out[surface] = inner
-		}
-		for id, e := range models {
-			if _, dup := inner[id]; dup {
-				continue
-			}
-			inner[id] = e
-		}
-	}
-	return out
-}
-
-func entryFromCatalogModel(m catalog.Model) Entry {
-	return Entry{
-		InputPer1k:         m.InputPer1k,
-		OutputPer1k:        m.OutputPer1k,
-		CachedInputPer1k:   m.CachedInputPer1k,
-		CacheReadPer1k:     m.CacheReadPer1k,
-		CacheCreationPer1k: m.CacheCreationPer1k,
-	}
-}
-
-// LookupDefault returns the default entry for model on the first of the
-// given surfaces that prices it. Used by the synthesizer to seed a
-// per-provider entry with default cache rates before overlaying the
-// operator's stored prices.
-func LookupDefault(surfaces []string, model string) (Entry, bool) {
-	table := DefaultTable()
-	for _, s := range surfaces {
-		if e, ok := table[s][model]; ok {
-			return e, true
-		}
-	}
-	return Entry{}, false
-}

management/internals/modules/agentnetwork/pricing/defaults_test.go

@@ -1,148 +0,0 @@
-package pricing
-
-import (
-	"math"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-)
-
-// TestDefaultTable_CoversEveryCatalogModel replaces the proxy's old
-// hand-maintained coverage list: because the table is built FROM the
-// catalog, drift is impossible by construction — this test guards the
-// fold itself (every catalog model of every surfaced provider resolves,
-// with exactly the catalog's rates).
-func TestDefaultTable_CoversEveryCatalogModel(t *testing.T) {
-	table := DefaultTable()
-	for _, p := range catalog.All() {
-		if len(p.PricingSurfaces) == 0 {
-			assert.Empty(t, p.Models, "catalog entry %s declares models but no pricing surfaces — those models would never be priced", p.ID)
-			continue
-		}
-		for _, surface := range p.PricingSurfaces {
-			byModel, ok := table[surface]
-			require.True(t, ok, "surface %q (provider %s) missing from default table", surface, p.ID)
-			for _, m := range p.Models {
-				e, ok := byModel[m.ID]
-				require.True(t, ok, "%s/%s (provider %s) missing from default table", surface, m.ID, p.ID)
-				assert.Equal(t, m.InputPer1k, e.InputPer1k, "%s/%s input rate", surface, m.ID)
-				assert.Equal(t, m.OutputPer1k, e.OutputPer1k, "%s/%s output rate", surface, m.ID)
-			}
-		}
-	}
-}
-
-// TestDefaultTable_NoConflictingContributions enforces the collision rule
-// documented on catalog.Provider.PricingSurfaces: when two catalog
-// providers contribute the same (surface, model) pair — azure/vertex
-// mirroring openai/anthropic, kimi on both surfaces — their rates must be
-// identical, because the surface-keyed table can only hold one entry.
-// If a provider ever diverges (e.g. Azure reprices a model), this fails
-// and the divergence must move to per-provider-record pricing.
-func TestDefaultTable_NoConflictingContributions(t *testing.T) {
-	type contribution struct {
-		providerID string
-		entry      Entry
-	}
-	seen := map[string]map[string]contribution{}
-	for _, p := range catalog.All() {
-		for _, surface := range p.PricingSurfaces {
-			if seen[surface] == nil {
-				seen[surface] = map[string]contribution{}
-			}
-			for _, m := range p.Models {
-				e := entryFromCatalogModel(m)
-				if prev, dup := seen[surface][m.ID]; dup {
-					assert.Equal(t, prev.entry, e,
-						"%s/%s: %s and %s contribute different rates", surface, m.ID, prev.providerID, p.ID)
-					continue
-				}
-				seen[surface][m.ID] = contribution{providerID: p.ID, entry: e}
-			}
-		}
-	}
-	// Supplemental entries must never shadow a catalog-contributed model —
-	// they exist precisely because the catalog does NOT list them.
-	for surface, models := range supplementalDefaults {
-		for id := range models {
-			_, fromCatalog := seen[surface][id]
-			assert.False(t, fromCatalog, "supplemental %s/%s is now in the catalog — delete the supplemental row", surface, id)
-		}
-	}
-}
-
-// TestDefaultTable_AllRatesFiniteNonNegative mirrors the proxy-side
-// NewTable validation so a bad catalog edit is caught here, at unit-test
-// time, rather than as a chain-build failure on every proxy.
-func TestDefaultTable_AllRatesFiniteNonNegative(t *testing.T) {
-	for surface, models := range DefaultTable() {
-		for id, e := range models {
-			for field, v := range map[string]float64{
-				"input":          e.InputPer1k,
-				"output":         e.OutputPer1k,
-				"cached_input":   e.CachedInputPer1k,
-				"cache_read":     e.CacheReadPer1k,
-				"cache_creation": e.CacheCreationPer1k,
-			} {
-				assert.False(t, v < 0 || math.IsNaN(v) || math.IsInf(v, 0),
-					"%s/%s: %s rate %v must be finite and non-negative", surface, id, field, v)
-			}
-		}
-	}
-}
-
-// TestDefaultTable_PinnedRates pins rates that previously drifted or are
-// easy to mis-enter (carried over from the proxy's retired
-// defaults_coverage_test), plus the supplemental entries.
-func TestDefaultTable_PinnedRates(t *testing.T) {
-	table := DefaultTable()
-
-	gpt54 := table["openai"]["gpt-5.4"]
-	assert.InDelta(t, 0.0025, gpt54.InputPer1k, 1e-9, "gpt-5.4 input")
-	assert.InDelta(t, 0.015, gpt54.OutputPer1k, 1e-9, "gpt-5.4 output")
-	assert.InDelta(t, 0.00025, gpt54.CachedInputPer1k, 1e-9, "gpt-5.4 cached input")
-
-	sonnet := table["bedrock"]["anthropic.claude-sonnet-4-5"]
-	assert.InDelta(t, 0.003, sonnet.InputPer1k, 1e-9, "bedrock sonnet-4-5 input")
-	assert.InDelta(t, 0.015, sonnet.OutputPer1k, 1e-9, "bedrock sonnet-4-5 output")
-	assert.InDelta(t, 0.0003, sonnet.CacheReadPer1k, 1e-9, "bedrock sonnet-4-5 cache read")
-	assert.InDelta(t, 0.00375, sonnet.CacheCreationPer1k, 1e-9, "bedrock sonnet-4-5 cache creation")
-
-	// Vertex Claude prices under "anthropic" with the bare id.
-	fable := table["anthropic"]["claude-fable-5"]
-	assert.InDelta(t, 0.010, fable.InputPer1k, 1e-9, "claude-fable-5 input")
-	assert.InDelta(t, 0.0125, fable.CacheCreationPer1k, 1e-9, "claude-fable-5 cache creation")
-
-	// Supplementals present on their surfaces.
-	for surface, ids := range map[string][]string{
-		"openai":    {"gpt-5", "gpt-5-mini", "gpt-5-nano"},
-		"anthropic": {"claude-opus-5", "kimi-k3[1m]", "kimi-k3"},
-		"bedrock":   {"anthropic.claude-opus-5"},
-	} {
-		for _, id := range ids {
-			_, ok := table[surface][id]
-			assert.True(t, ok, "%s/%s must be priced", surface, id)
-		}
-	}
-
-	// Embeddings bill input-only — output stays zero.
-	emb := table["openai"]["text-embedding-3-large"]
-	assert.Zero(t, emb.OutputPer1k, "embedding output rate must be zero")
-	assert.Positive(t, emb.InputPer1k, "embedding input rate must be set")
-}
-
-func TestLookupDefault_SurfaceOrder(t *testing.T) {
-	// kimi-k3 exists on both surfaces; first surface in the slice wins.
-	e, ok := LookupDefault([]string{"openai", "anthropic"}, "kimi-k3")
-	require.True(t, ok)
-	assert.InDelta(t, 0.003, e.InputPer1k, 1e-9)
-
-	_, ok = LookupDefault([]string{"bedrock"}, "gpt-4o")
-	assert.False(t, ok, "gpt-4o is not a bedrock model")
-
-	_, ok = LookupDefault(nil, "gpt-4o")
-	assert.False(t, ok, "no surfaces, no match")
-}

management/internals/modules/agentnetwork/pricing/exampleyaml.go

@@ -1,109 +0,0 @@
-package pricing
-
-import (
-	"bytes"
-	"fmt"
-	"sort"
-	"strconv"
-)
-
-// MarshalDefaultsYAML renders the built-in default pricing table (catalog
-// + supplementals, WITHOUT any operator override) as the YAML schema
-// LoadOverrideFile consumes. It backs the generated
-// defaults_llm_pricing.example.yaml so operators start from a file that
-// matches the compiled-in rates exactly; a golden test keeps the two in
-// sync. Output is deterministic (sorted surfaces and models).
-func MarshalDefaultsYAML() []byte {
-	var b bytes.Buffer
-	b.WriteString(exampleHeader)
-
-	table := buildDefaultTable()
-	surfaces := make([]string, 0, len(table))
-	for s := range table {
-		surfaces = append(surfaces, s)
-	}
-	sort.Strings(surfaces)
-
-	for _, surface := range surfaces {
-		fmt.Fprintf(&b, "\n%s:\n", surface)
-		models := table[surface]
-		ids := make([]string, 0, len(models))
-		for id := range models {
-			ids = append(ids, id)
-		}
-		sort.Strings(ids)
-		for _, id := range ids {
-			e := models[id]
-			fmt.Fprintf(&b, "  %s:\n", yamlKey(id))
-			fmt.Fprintf(&b, "    input_per_1k: %s\n", rate(e.InputPer1k))
-			fmt.Fprintf(&b, "    output_per_1k: %s\n", rate(e.OutputPer1k))
-			if e.CachedInputPer1k > 0 {
-				fmt.Fprintf(&b, "    cached_input_per_1k: %s\n", rate(e.CachedInputPer1k))
-			}
-			if e.CacheReadPer1k > 0 {
-				fmt.Fprintf(&b, "    cache_read_per_1k: %s\n", rate(e.CacheReadPer1k))
-			}
-			if e.CacheCreationPer1k > 0 {
-				fmt.Fprintf(&b, "    cache_creation_per_1k: %s\n", rate(e.CacheCreationPer1k))
-			}
-		}
-	}
-	return b.Bytes()
-}
-
-// rate renders a USD-per-1k rate without float noise ("0.00015", not
-// "0.000150000000...").
-func rate(v float64) string {
-	return strconv.FormatFloat(v, 'f', -1, 64)
-}
-
-// yamlKey quotes model ids that YAML would otherwise misparse (e.g.
-// "kimi-k3[1m]" starts a flow sequence unquoted).
-func yamlKey(id string) string {
-	for _, r := range id {
-		switch r {
-		case '[', ']', '{', '}', ':', '#', ',', '&', '*', '!', '|', '>', '\'', '"', '%', '@', '`':
-			return strconv.Quote(id)
-		}
-	}
-	return id
-}
-
-const exampleHeader = `# Default LLM pricing used by NetBird's Agent Network cost metering.
-# GENERATED from the management catalog — do not edit this file in the
-# repository; regenerate with:
-#
-#   go generate ./management/internals/modules/agentnetwork/pricing
-#
-# Operators: copy this file to <datadir>/defaults_llm_pricing.yaml (or
-# any path configured via management.json:
-#
-#   { "AgentNetwork": { "PricingDefaultsFile": "/path/defaults_llm_pricing.yaml" } }
-#
-# ) and adjust the entries you want to change. Management re-reads the
-# file periodically (mtime poll, every minute): the live table feeds the
-# proxies' cost metering and the dashboard's model-price prefill, so
-# edits apply without a restart. Your file only needs the entries you
-# want to change — but each entry REPLACES the built-in entry for that
-# surface+model whole, so repeat the cache rates you want to keep.
-# Unknown fields and negative or non-finite rates are rejected: at
-# startup that fails boot (for an explicitly configured path); at
-# runtime the previous table is kept and a warning is logged. Deleting
-# the file reverts to the built-in defaults below.
-#
-# Top-level keys are pricing surfaces — the parser shape requests are
-# metered under: "openai" (also Azure, Mistral, and OpenAI-compatible
-# gateways), "anthropic" (also Anthropic-on-Vertex), "bedrock"
-# (normalized ids, e.g. anthropic.claude-sonnet-4-5). Model keys must be
-# the normalized id the proxy meters (version/region suffixes stripped).
-#
-# Values are USD per 1_000 tokens. Optional cache fields:
-#   cached_input_per_1k    OpenAI shape: rate for cached prompt tokens
-#                          (a SUBSET of input tokens). Absent -> cached
-#                          portion bills at input_per_1k.
-#   cache_read_per_1k      Anthropic shape: rate for cache_read tokens
-#                          (ADDITIVE to input). Absent -> input rate.
-#   cache_creation_per_1k  Anthropic shape: rate for cache_creation
-#                          tokens (ADDITIVE to input). Absent -> input
-#                          rate.
-`

management/internals/modules/agentnetwork/pricing/gen.go

@@ -1,20 +0,0 @@
-//go:build ignore
-
-// Regenerates defaults_llm_pricing.example.yaml from the compiled-in
-// default pricing table. Run via:
-//
-//	go generate ./management/internals/modules/agentnetwork/pricing
-package main
-
-import (
-	"log"
-	"os"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
-)
-
-func main() {
-	if err := os.WriteFile("defaults_llm_pricing.example.yaml", pricing.MarshalDefaultsYAML(), 0o644); err != nil {
-		log.Fatalf("write defaults_llm_pricing.example.yaml: %v", err)
-	}
-}

management/internals/modules/agentnetwork/pricing/override.go

@@ -1,249 +0,0 @@
-package pricing
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"math"
-	"os"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"gopkg.in/yaml.v3"
-)
-
-// DefaultFileName is the basename probed under management's datadir when
-// AgentNetwork.PricingDefaultsFile doesn't configure an explicit path.
-const DefaultFileName = "defaults_llm_pricing.yaml"
-
-// ReloadInterval is the cadence at which the pricing file's mtime is
-// polled for changes.
-const ReloadInterval = time.Minute
-
-// maxFileBytes bounds the pricing file read so a misconfigured path
-// (pointed at a huge file) cannot exhaust process memory.
-const maxFileBytes = 4 << 20
-
-// pricingFile mirrors the on-disk YAML schema — the same schema the
-// proxy's retired embedded defaults_pricing.yaml used, so files written
-// for it keep working. Keys are pricing surfaces ("openai", "anthropic",
-// "bedrock"); nested keys are normalized model ids.
-type pricingFile map[string]map[string]struct {
-	InputPer1k         float64 `yaml:"input_per_1k"`
-	OutputPer1k        float64 `yaml:"output_per_1k"`
-	CachedInputPer1k   float64 `yaml:"cached_input_per_1k"`
-	CacheReadPer1k     float64 `yaml:"cache_read_per_1k"`
-	CacheCreationPer1k float64 `yaml:"cache_creation_per_1k"`
-}
-
-// fileState tracks the watched pricing file across reloads.
-var fileState struct {
-	mu    sync.Mutex
-	path  string
-	mtime int64
-}
-
-// LoadFile loads the management-side pricing defaults file and makes it
-// the live table (merged entry-whole over the compiled-in fallback; see
-// DefaultTable). The path stays registered for the periodic reloader, so
-// later edits — or the file (re)appearing after deletion — are picked up
-// without a restart.
-//
-// required governs the missing-file case: true for an explicitly
-// configured path (a typo must fail startup rather than silently bill
-// with built-ins the operator believes they replaced), false for the
-// conventional <datadir>/defaults_llm_pricing.yaml probe (absent file =
-// compiled-in defaults, still watched in case it appears). A file that
-// exists but is malformed is always an error at load time.
-func LoadFile(path string, required bool) error {
-	if path == "" {
-		return nil
-	}
-	fileState.mu.Lock()
-	fileState.path = path
-	fileState.mu.Unlock()
-
-	table, mtime, err := readFile(path)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) && !required {
-			log.Infof("agent-network pricing defaults file %s not present; serving built-in defaults", path)
-			return nil
-		}
-		return err
-	}
-	storeFileTable(table, mtime)
-	log.Infof("agent-network pricing defaults loaded from %s", path)
-	return nil
-}
-
-// StartReloader launches the periodic mtime-poll goroutine for the file
-// registered by LoadFile. Runtime failures are lenient — a parse error
-// keeps the previously loaded table and logs a warning; a deleted file
-// reverts to the compiled-in defaults — so a mid-edit save can never
-// take pricing down. Returns immediately when no path was registered.
-func StartReloader(ctx context.Context, interval time.Duration) {
-	fileState.mu.Lock()
-	path := fileState.path
-	fileState.mu.Unlock()
-	if path == "" {
-		return
-	}
-	if interval <= 0 {
-		interval = ReloadInterval
-	}
-	go func() {
-		t := time.NewTicker(interval)
-		defer t.Stop()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-t.C:
-				reload()
-			}
-		}
-	}()
-}
-
-// reload performs one mtime check + reload cycle.
-func reload() {
-	fileState.mu.Lock()
-	path, lastMtime := fileState.path, fileState.mtime
-	fileState.mu.Unlock()
-
-	log.Debugf("agent-network pricing defaults reload: checking %s for changes", path)
-
-	st, err := os.Stat(path)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			// File removed (or not yet created): serve compiled-in
-			// defaults and reset mtime so a future (re)appearance loads.
-			if mergedTable.Swap(nil) != nil {
-				log.Warnf("agent-network pricing defaults file %s removed; reverting to built-in defaults", path)
-			}
-			setMtime(0)
-			return
-		}
-		log.Warnf("agent-network pricing defaults reload: stat %s: %v", path, err)
-		return
-	}
-	if st.ModTime().UnixNano() == lastMtime {
-		log.Debugf("agent-network pricing defaults %s unchanged since last check", path)
-		return
-	}
-
-	table, mtime, err := readFile(path)
-	if err != nil {
-		// Keep the previously loaded table — never blank prices because
-		// an operator saved mid-edit.
-		log.Warnf("agent-network pricing defaults reload failed for %s (keeping previous table): %v", path, err)
-		return
-	}
-	storeFileTable(table, mtime)
-	log.Infof("agent-network pricing defaults reloaded from %s", path)
-}
-
-func readFile(path string) (map[string]map[string]Entry, int64, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, 0, fmt.Errorf("open pricing defaults %s: %w", path, err)
-	}
-	defer func() { _ = f.Close() }()
-
-	st, err := f.Stat()
-	if err != nil {
-		return nil, 0, fmt.Errorf("stat pricing defaults %s: %w", path, err)
-	}
-	data, err := io.ReadAll(io.LimitReader(f, maxFileBytes+1))
-	if err != nil {
-		return nil, 0, fmt.Errorf("read pricing defaults %s: %w", path, err)
-	}
-	if len(data) > maxFileBytes {
-		return nil, 0, fmt.Errorf("pricing defaults %s exceeds %d bytes", path, maxFileBytes)
-	}
-	table, err := parsePricingYAML(data)
-	if err != nil {
-		return nil, 0, fmt.Errorf("parse pricing defaults %s: %w", path, err)
-	}
-	return table, st.ModTime().UnixNano(), nil
-}
-
-// storeFileTable merges the parsed file over the compiled-in base and
-// publishes the result as the live table. File entries replace the
-// built-in entry for the same (surface, model) whole — they are not
-// field-merged — and surfaces/models the file doesn't mention keep the
-// built-in rates, so a partial file only needs the entries it changes.
-func storeFileTable(table map[string]map[string]Entry, mtime int64) {
-	base := compiledBase()
-	merged := make(map[string]map[string]Entry, len(base)+len(table))
-	for surface, models := range base {
-		inner := make(map[string]Entry, len(models))
-		for id, e := range models {
-			inner[id] = e
-		}
-		merged[surface] = inner
-	}
-	for surface, models := range table {
-		inner, ok := merged[surface]
-		if !ok {
-			inner = make(map[string]Entry, len(models))
-			merged[surface] = inner
-		}
-		for id, e := range models {
-			inner[id] = e
-		}
-	}
-	mergedTable.Store(&merged)
-	setMtime(mtime)
-}
-
-func setMtime(v int64) {
-	fileState.mu.Lock()
-	fileState.mtime = v
-	fileState.mu.Unlock()
-}
-
-// parsePricingYAML decodes and validates the pricing YAML. Unknown
-// fields are rejected (typos surface instead of silently pricing at 0)
-// and every rate must be a finite, non-negative USD amount — the same
-// constraints the HTTP API enforces on operator per-provider prices.
-func parsePricingYAML(data []byte) (map[string]map[string]Entry, error) {
-	dec := yaml.NewDecoder(bytes.NewReader(data))
-	dec.KnownFields(true)
-
-	var raw pricingFile
-	if err := dec.Decode(&raw); err != nil && !errors.Is(err, io.EOF) {
-		return nil, fmt.Errorf("decode yaml: %w", err)
-	}
-
-	out := make(map[string]map[string]Entry, len(raw))
-	for surface, models := range raw {
-		inner := make(map[string]Entry, len(models))
-		for model, e := range models {
-			for field, v := range map[string]float64{
-				"input_per_1k":          e.InputPer1k,
-				"output_per_1k":         e.OutputPer1k,
-				"cached_input_per_1k":   e.CachedInputPer1k,
-				"cache_read_per_1k":     e.CacheReadPer1k,
-				"cache_creation_per_1k": e.CacheCreationPer1k,
-			} {
-				if v < 0 || math.IsNaN(v) || math.IsInf(v, 0) {
-					return nil, fmt.Errorf("%s/%s: %s must be a finite, non-negative rate, got %v", surface, model, field, v)
-				}
-			}
-			inner[model] = Entry{
-				InputPer1k:         e.InputPer1k,
-				OutputPer1k:        e.OutputPer1k,
-				CachedInputPer1k:   e.CachedInputPer1k,
-				CacheReadPer1k:     e.CacheReadPer1k,
-				CacheCreationPer1k: e.CacheCreationPer1k,
-			}
-		}
-		out[surface] = inner
-	}
-	return out, nil
-}

management/internals/modules/agentnetwork/pricing/override_test.go

@@ -1,173 +0,0 @@
-package pricing
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// resetFileState snapshots and restores the package-level file state so
-// tests stay order-independent.
-func resetFileState(t *testing.T) {
-	t.Helper()
-	prevMerged := mergedTable.Load()
-	fileState.mu.Lock()
-	prevPath, prevMtime := fileState.path, fileState.mtime
-	fileState.mu.Unlock()
-	t.Cleanup(func() {
-		mergedTable.Store(prevMerged)
-		fileState.mu.Lock()
-		fileState.path, fileState.mtime = prevPath, prevMtime
-		fileState.mu.Unlock()
-	})
-}
-
-func writePricing(t *testing.T, path, yml string) {
-	t.Helper()
-	require.NoError(t, os.WriteFile(path, []byte(yml), 0o600))
-}
-
-func TestLoadFile_MergesOverCompiledDefaults(t *testing.T) {
-	resetFileState(t)
-	path := filepath.Join(t.TempDir(), DefaultFileName)
-	writePricing(t, path, `
-openai:
-  # Reprice a built-in model. The entry replaces the built-in WHOLE:
-  # omitting the cache rate here drops the built-in 0.00125 discount.
-  gpt-4o:
-    input_per_1k: 0.9
-    output_per_1k: 1.8
-  # A model NetBird doesn't know at all.
-  my-private-ft:
-    input_per_1k: 0.01
-    output_per_1k: 0.02
-    cached_input_per_1k: 0.005
-gemini:
-  gemini-pro:
-    input_per_1k: 0.00125
-    output_per_1k: 0.005
-`)
-	require.NoError(t, LoadFile(path, true))
-	table := DefaultTable()
-
-	gpt4o := table["openai"]["gpt-4o"]
-	assert.InDelta(t, 0.9, gpt4o.InputPer1k, 1e-9, "file rate replaces the compiled-in rate")
-	assert.Zero(t, gpt4o.CachedInputPer1k, "entries replace whole — omitted cache rate is dropped, not inherited")
-
-	ft := table["openai"]["my-private-ft"]
-	assert.InDelta(t, 0.005, ft.CachedInputPer1k, 1e-9, "unknown models are added to the surface")
-	_, ok := table["gemini"]["gemini-pro"]
-	assert.True(t, ok, "a surface the catalog doesn't declare can be added")
-
-	// Untouched entries keep compiled-in rates (catalog, other surface,
-	// supplemental).
-	assert.InDelta(t, 0.00015, table["openai"]["gpt-4o-mini"].InputPer1k, 1e-9, "unlisted model keeps compiled rate")
-	assert.InDelta(t, 0.003, table["anthropic"]["claude-sonnet-4-5"].InputPer1k, 1e-9, "unlisted surface untouched")
-	assert.InDelta(t, 0.00125, table["openai"]["gpt-5"].InputPer1k, 1e-9, "supplemental entries untouched")
-
-	// The synthesizer-facing lookup reads the live table too.
-	e, ok := LookupDefault([]string{"openai"}, "gpt-4o")
-	require.True(t, ok)
-	assert.InDelta(t, 0.9, e.InputPer1k, 1e-9, "LookupDefault serves the file-backed rate")
-}
-
-func TestLoadFile_MissingPath(t *testing.T) {
-	resetFileState(t)
-	missing := filepath.Join(t.TempDir(), DefaultFileName)
-
-	require.Error(t, LoadFile(missing, true),
-		"explicitly configured path that doesn't exist must fail startup")
-
-	require.NoError(t, LoadFile(missing, false),
-		"conventional datadir probe tolerates an absent file (compiled-in defaults serve)")
-	assert.Nil(t, mergedTable.Load(), "no file, no merged table")
-	fileState.mu.Lock()
-	path := fileState.path
-	fileState.mu.Unlock()
-	assert.Equal(t, missing, path, "the path stays registered so the reloader picks the file up when it appears")
-}
-
-func TestLoadFile_RejectsInvalid(t *testing.T) {
-	resetFileState(t)
-	dir := t.TempDir()
-	cases := map[string]string{
-		"unknown field (typo)": "openai:\n  gpt-4o:\n    input_per1k: 0.1\n",
-		"negative rate":        "openai:\n  gpt-4o:\n    input_per_1k: -0.1\n",
-		"non-numeric rate":     "openai:\n  gpt-4o:\n    input_per_1k: cheap\n",
-		"not a mapping":        "- just\n- a\n- list\n",
-	}
-	for name, yml := range cases {
-		path := filepath.Join(dir, DefaultFileName)
-		writePricing(t, path, yml)
-		assert.Error(t, LoadFile(path, true), "case %q must be rejected", name)
-	}
-}
-
-// TestReload_LifeCycle drives the reloader's single-shot reload through
-// its full lifecycle: file edit picked up on mtime change, a broken save
-// keeps the previous table, and file removal reverts to the compiled-in
-// defaults (then a re-created file loads again).
-func TestReload_LifeCycle(t *testing.T) {
-	resetFileState(t)
-	path := filepath.Join(t.TempDir(), DefaultFileName)
-	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: 0.5\n    output_per_1k: 1\n")
-	require.NoError(t, LoadFile(path, true))
-	require.InDelta(t, 0.5, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9)
-
-	// Edit: new mtime, new rates.
-	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: 0.7\n    output_per_1k: 1.4\n")
-	bumpMtime(t, path)
-	reload()
-	assert.InDelta(t, 0.7, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9, "edit must be picked up")
-
-	// Broken save: previous table survives.
-	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: -1\n")
-	bumpMtime(t, path)
-	reload()
-	assert.InDelta(t, 0.7, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9,
-		"a malformed save must keep the previously loaded table, never blank prices")
-
-	// Removal: compiled-in defaults serve again.
-	require.NoError(t, os.Remove(path))
-	reload()
-	assert.InDelta(t, 0.0025, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9,
-		"file removal reverts to the compiled-in rate")
-
-	// Re-created file loads without a restart.
-	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: 0.9\n    output_per_1k: 1.8\n")
-	bumpMtime(t, path)
-	reload()
-	assert.InDelta(t, 0.9, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9,
-		"a file appearing after removal (or after a missing-probe boot) must load")
-}
-
-// bumpMtime pushes the file's mtime forward past the previously recorded
-// value — timestamps can otherwise collide within the test's timescale.
-func bumpMtime(t *testing.T, path string) {
-	t.Helper()
-	st, err := os.Stat(path)
-	require.NoError(t, err)
-	next := st.ModTime().Add(2 * 1e9)
-	require.NoError(t, os.Chtimes(path, next, next))
-}
-
-// TestExampleYAML_InSyncWithBuiltins is the golden guard for
-// defaults_llm_pricing.example.yaml: the shipped example must stay
-// byte-identical to what the compiled-in table renders (catalog edits
-// require `go generate ./management/internals/modules/agentnetwork/pricing`)
-// and must round-trip through the same parser operators' files go
-// through, reproducing the compiled-in table exactly.
-func TestExampleYAML_InSyncWithBuiltins(t *testing.T) {
-	onDisk, err := os.ReadFile("defaults_llm_pricing.example.yaml")
-	require.NoError(t, err, "example file must exist next to the package")
-	require.Equal(t, string(MarshalDefaultsYAML()), string(onDisk),
-		"defaults_llm_pricing.example.yaml is stale — run: go generate ./management/internals/modules/agentnetwork/pricing")
-
-	parsed, err := parsePricingYAML(onDisk)
-	require.NoError(t, err, "the example must be a valid pricing defaults file")
-	assert.Equal(t, buildDefaultTable(), parsed,
-		"parsing the example must reproduce the compiled-in table exactly")
-}

management/internals/modules/agentnetwork/synthesizer.go

@@ -233,11 +233,6 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 		return nil, err
 	}
 
-	costMeterJSON, err := buildCostMeterConfigJSON(enabledProviders, groupIndex)
-	if err != nil {
-		return nil, err
-	}
-
 	mergedGuardrails := mergeGuardrails(enabledPolicies, guardrailsByID)
 	applyAccountCollectionControls(&mergedGuardrails, settings)
 	// The proxy guardrail is a per-provider fail-closed backstop; the
@@ -253,7 +248,7 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 	// Use the merged decision (account settings OR policy-required redaction),
 	// not the raw account flag, so a policy that mandates PII redaction is
 	// honored by the capture parsers even when the account toggle is off.
-	middlewares := buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, costMeterJSON, mergedGuardrails.PromptCapture.RedactPii, mergedGuardrails.PromptCapture.Enabled)
+	middlewares := buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, mergedGuardrails.PromptCapture.RedactPii, mergedGuardrails.PromptCapture.Enabled)
 
 	priv, pub, err := pickServiceSessionKeys(enabledProviders)
 	if err != nil {
@@ -705,7 +700,7 @@ func buildIdentityExtraHeaders(p *types.Provider, extras []catalog.ExtraHeader)
 // requests bound for gateways like LiteLLM that key budgets and
 // attribution off request headers. CanMutate is required so its
 // HeadersAdd / HeadersRemove pass the framework's mutation gate.
-func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, costMeterJSON []byte, redactPii, capturePromptContent bool) []rpservice.MiddlewareConfig {
+func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON []byte, redactPii, capturePromptContent bool) []rpservice.MiddlewareConfig {
 	// Both parsers receive an explicit capture flag derived from the account's
 	// enable_prompt_collection toggle; nil/unset would default to the legacy
 	// "always emit" behavior in the middleware, which is precisely what we
@@ -774,13 +769,10 @@ func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, cost
 			ConfigJSON: []byte("{}"),
 		},
 		{
-			// Carries the full pricing table (defaults + per-provider
-			// operator prices) so the proxy bills without an embedded
-			// price list; see buildCostMeterConfigJSON.
 			ID:         middlewareIDCostMeter,
 			Enabled:    true,
 			Slot:       rpservice.MiddlewareSlotOnResponse,
-			ConfigJSON: costMeterJSON,
+			ConfigJSON: []byte("{}"),
 		},
 		{
 			ID:         middlewareIDLLMResponseParser,

management/internals/modules/agentnetwork/synthesizer_pricing.go

@@ -1,131 +0,0 @@
-package agentnetwork
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	sharedllm "github.com/netbirdio/netbird/shared/llm"
-)
-
-// costMeterConfig is the JSON shape the proxy-side cost_meter middleware
-// expects (mirror-type pattern, same as routerConfig). The top-level
-// "pricing" wrapper is the feature-detection signal: an old proxy's config
-// struct ignores it as an unknown field, and a new proxy treats its
-// absence as "old management" (skips every cost computation and warns).
-type costMeterConfig struct {
-	Pricing *costMeterPricing `json:"pricing,omitempty"`
-}
-
-// costMeterPricing carries the full pricing table:
-//   - Defaults: surface ("openai"/"anthropic"/"bedrock") -> normalized
-//     model id -> rates. The full default table ships to every account —
-//     it is small (~10 KB) and keeps gateway-style providers (which
-//     enumerate no models) priced for every catalog model.
-//   - Providers: provider record id (matched against the
-//     llm.resolved_provider_id metadata llm_router stamps) -> normalized
-//     model id -> rates. Entries are fully materialized here at synth
-//     time — default cache rates already folded in — so the proxy does
-//     two map lookups and no merging.
-type costMeterPricing struct {
-	Defaults  map[string]map[string]pricing.Entry `json:"defaults,omitempty"`
-	Providers map[string]map[string]pricing.Entry `json:"providers,omitempty"`
-}
-
-// buildCostMeterConfigJSON assembles the cost_meter middleware config
-// from the default pricing table plus the operator's stored per-provider
-// model prices. Same orphan rule as the router: a provider no enabled
-// policy authorises is unreachable, so its prices are not shipped.
-//
-// Overlay semantics per model row:
-//   - The row's model id is normalized exactly the way the proxy's
-//     request parser normalizes the ids it meters (bedrock ARN/region/
-//     version stripping, vertex "@version" stripping), so the per-record
-//     lookup key compares equal to llm.model at billing time.
-//   - The entry starts from the default entry for that model (when one
-//     exists) to inherit cache rates the operator didn't state.
-//   - Operator input/output overlay verbatim — including an explicit 0,
-//     which prices the model as free (self-hosted / internal endpoints)
-//     rather than silently reverting to list price.
-//   - Cache-rate pointers overlay only when non-nil: nil means "inherit
-//     the default", an explicit 0 means "no discount, bill this bucket
-//     at the input rate".
-func buildCostMeterConfigJSON(providers []*types.Provider, groupIndex map[string][]string) ([]byte, error) {
-	cfg := costMeterConfig{Pricing: &costMeterPricing{
-		Defaults: pricing.DefaultTable(),
-	}}
-
-	perRecord := make(map[string]map[string]pricing.Entry)
-	for _, p := range providers {
-		if _, hasPolicy := groupIndex[p.ID]; !hasPolicy {
-			// Orphan: unreachable via the router, so unpriceable.
-			continue
-		}
-		if len(p.Models) == 0 {
-			// Gateway-style "claim every model" provider: the defaults
-			// table is its price list.
-			continue
-		}
-		entry, _ := catalog.Lookup(p.ProviderID)
-		models := make(map[string]pricing.Entry, len(p.Models))
-		for _, m := range p.Models {
-			id := normalizePricingModelID(p.ProviderID, m.ID)
-			if id == "" {
-				continue
-			}
-			if _, dup := models[id]; dup {
-				// First occurrence wins on post-normalization duplicates,
-				// matching providerModelIDs' dedup order for routing.
-				continue
-			}
-			models[id] = materializeEntry(entry.PricingSurfaces, id, m)
-		}
-		if len(models) > 0 {
-			perRecord[p.ID] = models
-		}
-	}
-	if len(perRecord) > 0 {
-		cfg.Pricing.Providers = perRecord
-	}
-
-	out, err := json.Marshal(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("marshal cost_meter middleware config: %w", err)
-	}
-	return out, nil
-}
-
-// normalizePricingModelID maps an operator-entered model id onto the
-// normalized id the proxy's request parser emits as llm.model — the key
-// the cost meter looks up at billing time.
-func normalizePricingModelID(catalogProviderID, modelID string) string {
-	switch {
-	case catalog.IsBedrockPathStyle(catalogProviderID):
-		return sharedllm.NormalizeBedrockModel(modelID)
-	case catalog.IsVertexPathStyle(catalogProviderID):
-		return sharedllm.NormalizeVertexModel(modelID)
-	default:
-		return modelID
-	}
-}
-
-// materializeEntry folds the default entry for (surfaces, model) — when
-// one exists — under the operator's stored prices, producing the fully
-// materialized wire entry.
-func materializeEntry(surfaces []string, normalizedID string, m types.ProviderModel) pricing.Entry {
-	e, _ := pricing.LookupDefault(surfaces, normalizedID) // zero Entry on miss
-	e.InputPer1k = m.InputPer1k
-	e.OutputPer1k = m.OutputPer1k
-	if m.CachedInputPer1k != nil {
-		e.CachedInputPer1k = *m.CachedInputPer1k
-	}
-	if m.CacheReadPer1k != nil {
-		e.CacheReadPer1k = *m.CacheReadPer1k
-	}
-	if m.CacheCreationPer1k != nil {
-		e.CacheCreationPer1k = *m.CacheCreationPer1k
-	}
-	return e
-}

management/internals/modules/agentnetwork/synthesizer_pricing_test.go

@@ -1,105 +0,0 @@
-package agentnetwork
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-)
-
-func fptr(v float64) *float64 { return &v }
-
-func decodeCostMeterConfig(t *testing.T, raw []byte) costMeterConfig {
-	t.Helper()
-	var cfg costMeterConfig
-	require.NoError(t, json.Unmarshal(raw, &cfg), "cost meter config must round-trip")
-	require.NotNil(t, cfg.Pricing, "pricing wrapper must be present")
-	return cfg
-}
-
-// TestBuildCostMeterConfig_BedrockModelNormalization: the operator may
-// paste region-prefixed, versioned, or ARN-wrapped Bedrock ids; the
-// per-record map must be keyed by the normalized id the request parser
-// emits as llm.model, or the lookup never hits at billing time.
-func TestBuildCostMeterConfig_BedrockModelNormalization(t *testing.T) {
-	bedrock := &types.Provider{
-		ID:         "prov-bedrock",
-		ProviderID: "bedrock_api",
-		Enabled:    true,
-		Models: []types.ProviderModel{
-			{ID: "eu.anthropic.claude-sonnet-4-5-20250929-v1:0", InputPer1k: 0.0033, OutputPer1k: 0.0165},
-			// Post-normalization duplicate of the row above under a
-			// different regional spelling — first occurrence wins.
-			{ID: "us.anthropic.claude-sonnet-4-5-20250929-v1:0", InputPer1k: 9.9, OutputPer1k: 9.9},
-		},
-	}
-	raw, err := buildCostMeterConfigJSON([]*types.Provider{bedrock}, map[string][]string{"prov-bedrock": {"grp"}})
-	require.NoError(t, err)
-	cfg := decodeCostMeterConfig(t, raw)
-
-	models := cfg.Pricing.Providers["prov-bedrock"]
-	require.Len(t, models, 1, "both spellings normalize to one model; first row wins")
-	e, ok := models["anthropic.claude-sonnet-4-5"]
-	require.True(t, ok, "key must be the normalized id the parser emits, not the operator's raw spelling")
-	assert.InDelta(t, 0.0033, e.InputPer1k, 1e-9, "first row's rate wins the dedup")
-	assert.InDelta(t, 0.0003, e.CacheReadPer1k, 1e-9, "cache read inherited from the bedrock default entry")
-	assert.InDelta(t, 0.00375, e.CacheCreationPer1k, 1e-9, "cache creation inherited from the bedrock default entry")
-}
-
-// TestBuildCostMeterConfig_CacheRateNilVsZero pins the pointer semantics:
-// nil inherits the default cache rate, explicit 0 clears it (that bucket
-// bills at the input rate on the proxy).
-func TestBuildCostMeterConfig_CacheRateNilVsZero(t *testing.T) {
-	p := &types.Provider{
-		ID:         "prov-oai",
-		ProviderID: "openai_api",
-		Enabled:    true,
-		Models: []types.ProviderModel{
-			{ID: "gpt-4o", InputPer1k: 0.002, OutputPer1k: 0.008},                                    // nil → inherit 0.00125
-			{ID: "gpt-4o-mini", InputPer1k: 0.0001, OutputPer1k: 0.0005, CachedInputPer1k: fptr(0)},  // explicit 0 → no discount
-			{ID: "my-custom-ft", InputPer1k: 0.01, OutputPer1k: 0.02, CachedInputPer1k: fptr(0.005)}, // unknown model, explicit rate
-		},
-	}
-	raw, err := buildCostMeterConfigJSON([]*types.Provider{p}, map[string][]string{"prov-oai": {"grp"}})
-	require.NoError(t, err)
-	cfg := decodeCostMeterConfig(t, raw)
-	models := cfg.Pricing.Providers["prov-oai"]
-
-	assert.InDelta(t, 0.00125, models["gpt-4o"].CachedInputPer1k, 1e-9, "nil cache pointer inherits the default rate")
-	assert.Zero(t, models["gpt-4o-mini"].CachedInputPer1k, "explicit 0 overrides the default (0.000075) — bucket bills at input rate")
-	custom := models["my-custom-ft"]
-	assert.InDelta(t, 0.005, custom.CachedInputPer1k, 1e-9, "unknown model keeps the operator's explicit cache rate")
-	assert.Zero(t, custom.CacheReadPer1k, "no default to inherit for a model outside the catalog")
-}
-
-// TestBuildCostMeterConfig_OrphanAndGatewayProviders: an orphan (no
-// authorising policy) is unreachable so its prices must not ship; a
-// gateway with no model rows relies on the defaults table and gets no
-// per-record entry.
-func TestBuildCostMeterConfig_OrphanAndGatewayProviders(t *testing.T) {
-	orphan := &types.Provider{
-		ID:         "prov-orphan",
-		ProviderID: "openai_api",
-		Enabled:    true,
-		Models:     []types.ProviderModel{{ID: "gpt-4o", InputPer1k: 1, OutputPer1k: 1}},
-	}
-	gateway := &types.Provider{
-		ID:         "prov-litellm",
-		ProviderID: "litellm_proxy",
-		Enabled:    true,
-		Models:     []types.ProviderModel{},
-	}
-	raw, err := buildCostMeterConfigJSON(
-		[]*types.Provider{orphan, gateway},
-		map[string][]string{"prov-litellm": {"grp"}}, // orphan has no policy
-	)
-	require.NoError(t, err)
-	cfg := decodeCostMeterConfig(t, raw)
-
-	assert.NotContains(t, cfg.Pricing.Providers, "prov-orphan", "orphan provider prices must not ship")
-	assert.NotContains(t, cfg.Pricing.Providers, "prov-litellm", "empty-models gateway needs no per-record entry")
-	assert.NotEmpty(t, cfg.Pricing.Defaults["openai"], "defaults still ship so the gateway's catalog-model traffic is priced")
-}

management/internals/modules/agentnetwork/synthesizer_test.go

@@ -33,17 +33,14 @@ func newSynthTestSettings() *types.Settings {
 
 func newSynthTestProvider() *types.Provider {
 	return &types.Provider{
-		ID:          "prov-1",
-		AccountID:   testAccountID,
-		ProviderID:  "openai_api",
-		Name:        "OpenAI",
-		UpstreamURL: "https://api.openai.com",
-		APIKey:      "sk-test-key",
-		Enabled:     true,
-		// Prices deliberately differ from the catalog's gpt-5.4 rates
-		// (0.0025/0.015) so pricing tests can prove the operator's
-		// stored price overlays the catalog default.
-		Models:            []types.ProviderModel{{ID: "gpt-5.4", InputPer1k: 0.004, OutputPer1k: 0.02}},
+		ID:                "prov-1",
+		AccountID:         testAccountID,
+		ProviderID:        "openai_api",
+		Name:              "OpenAI",
+		UpstreamURL:       "https://api.openai.com",
+		APIKey:            "sk-test-key",
+		Enabled:           true,
+		Models:            []types.ProviderModel{{ID: "gpt-5.4", InputPer1k: 0.0025, OutputPer1k: 0.015}},
 		SessionPrivateKey: "test-priv-key",
 		SessionPublicKey:  "test-pub-key",
 		CreatedAt:         time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
@@ -217,27 +214,7 @@ func TestSynthesizeServices_HappyPath(t *testing.T) {
 
 	assert.Equal(t, middlewareIDCostMeter, mws[6].ID, "seventh middleware is the cost meter")
 	assert.Equal(t, rpservice.MiddlewareSlotOnResponse, mws[6].Slot, "cost meter runs on_response")
-
-	var costCfg costMeterConfig
-	require.NoError(t, json.Unmarshal(mws[6].ConfigJSON, &costCfg), "cost meter config must unmarshal")
-	require.NotNil(t, costCfg.Pricing, "cost meter config must carry the pricing table — its absence tells the proxy management predates config-delivered pricing")
-
-	gpt4o, ok := costCfg.Pricing.Defaults["openai"]["gpt-4o"]
-	require.True(t, ok, "the full default table ships regardless of the account's providers")
-	assert.InDelta(t, 0.0025, gpt4o.InputPer1k, 1e-9, "default gpt-4o input rate comes from the catalog")
-
-	openaiPrices, ok := costCfg.Pricing.Providers[openai.ID]
-	require.True(t, ok, "operator-priced provider must have a per-record entry")
-	gpt54, ok := openaiPrices["gpt-5.4"]
-	require.True(t, ok, "operator's model row keys the per-record map")
-	assert.InDelta(t, 0.004, gpt54.InputPer1k, 1e-9, "operator input price overlays the catalog default (0.0025)")
-	assert.InDelta(t, 0.02, gpt54.OutputPer1k, 1e-9, "operator output price overlays the catalog default (0.015)")
-	assert.InDelta(t, 0.00025, gpt54.CachedInputPer1k, 1e-9, "cache rate the operator didn't state is inherited from the default entry")
-
-	opus, ok := costCfg.Pricing.Providers[anthropic.ID]["claude-opus-4-7"]
-	require.True(t, ok, "anthropic's model row keys its per-record map")
-	assert.Zero(t, opus.InputPer1k, "operator-stored zero prices ship verbatim — an explicit $0 model bills as free, it does not revert to list price")
-	assert.InDelta(t, 0.0005, opus.CacheReadPer1k, 1e-9, "cache rates still inherit from the default entry")
+	assert.Equal(t, []byte("{}"), mws[6].ConfigJSON, "cost meter carries an explicit empty config")
 
 	assert.Equal(t, middlewareIDLLMResponseParser, mws[7].ID, "eighth middleware is the response parser")
 	assert.Equal(t, rpservice.MiddlewareSlotOnResponse, mws[7].Slot, "response parser runs on_response")

management/internals/modules/agentnetwork/types/provider.go

@@ -14,24 +14,10 @@ import (
 // ProviderModel is one row in the provider's models list. The operator
 // pins the per-1k input/output price for cost tracking; ID is the
 // model identifier the upstream provider expects on the wire.
-//
-// The three cache rates are pointers because absence is meaningful: nil
-// means "inherit NetBird's default rate for this model" (folded in at
-// synthesis time), while an explicit 0 means "no discount — bill this
-// cache bucket at the input rate".
 type ProviderModel struct {
 	ID          string  `json:"id"`
 	InputPer1k  float64 `json:"input_per_1k"`
 	OutputPer1k float64 `json:"output_per_1k"`
-	// CachedInputPer1k is the OpenAI-shape rate for cached prompt tokens
-	// (a subset of input tokens).
-	CachedInputPer1k *float64 `json:"cached_input_per_1k,omitempty"`
-	// CacheReadPer1k is the Anthropic-shape rate for cache-read tokens
-	// (additive to input tokens).
-	CacheReadPer1k *float64 `json:"cache_read_per_1k,omitempty"`
-	// CacheCreationPer1k is the Anthropic-shape rate for cache-creation
-	// tokens (additive to input tokens).
-	CacheCreationPer1k *float64 `json:"cache_creation_per_1k,omitempty"`
 }
 
 // Provider is an Agent Network AI provider record persisted per account.
@@ -142,12 +128,9 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 	if req.Models != nil {
 		for _, m := range *req.Models {
 			p.Models = append(p.Models, ProviderModel{
-				ID:                 m.Id,
-				InputPer1k:         m.InputPer1k,
-				OutputPer1k:        m.OutputPer1k,
-				CachedInputPer1k:   copyFloatPtr(m.CachedInputPer1k),
-				CacheReadPer1k:     copyFloatPtr(m.CacheReadPer1k),
-				CacheCreationPer1k: copyFloatPtr(m.CacheCreationPer1k),
+				ID:          m.Id,
+				InputPer1k:  m.InputPer1k,
+				OutputPer1k: m.OutputPer1k,
 			})
 		}
 	}
@@ -181,12 +164,9 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 	models := make([]api.AgentNetworkProviderModel, 0, len(p.Models))
 	for _, m := range p.Models {
 		models = append(models, api.AgentNetworkProviderModel{
-			Id:                 m.ID,
-			InputPer1k:         m.InputPer1k,
-			OutputPer1k:        m.OutputPer1k,
-			CachedInputPer1k:   copyFloatPtr(m.CachedInputPer1k),
-			CacheReadPer1k:     copyFloatPtr(m.CacheReadPer1k),
-			CacheCreationPer1k: copyFloatPtr(m.CacheCreationPer1k),
+			Id:          m.ID,
+			InputPer1k:  m.InputPer1k,
+			OutputPer1k: m.OutputPer1k,
 		})
 	}
 	created := p.CreatedAt
@@ -221,27 +201,11 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 	return resp
 }
 
-// copyFloatPtr returns a fresh pointer to the same value, or nil. Keeps
-// stored models and API payloads from aliasing each other's rate fields.
-func copyFloatPtr(v *float64) *float64 {
-	if v == nil {
-		return nil
-	}
-	out := *v
-	return &out
-}
-
 // Copy returns a deep copy of the provider.
 func (p *Provider) Copy() *Provider {
 	clone := *p
 	if p.Models != nil {
-		clone.Models = make([]ProviderModel, len(p.Models))
-		for i, m := range p.Models {
-			m.CachedInputPer1k = copyFloatPtr(m.CachedInputPer1k)
-			m.CacheReadPer1k = copyFloatPtr(m.CacheReadPer1k)
-			m.CacheCreationPer1k = copyFloatPtr(m.CacheCreationPer1k)
-			clone.Models[i] = m
-		}
+		clone.Models = append([]ProviderModel(nil), p.Models...)
 	}
 	if p.ExtraValues != nil {
 		clone.ExtraValues = make(map[string]string, len(p.ExtraValues))

management/internals/modules/agentnetwork/wire_shape_test.go

@@ -103,12 +103,6 @@ func TestSynthesizedService_WireShape(t *testing.T) {
 
 	assert.Equal(t, middlewareIDCostMeter, mws[6].GetId(), "seventh middleware id")
 	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[6].GetSlot(), "cost meter slot")
-	var costCfg costMeterConfig
-	require.NoError(t, json.Unmarshal(mws[6].GetConfigJson(), &costCfg), "cost meter config JSON must decode from the wire")
-	require.NotNil(t, costCfg.Pricing, "the pricing table must travel on the wire — the proxy has no embedded price list to fall back to")
-	assert.NotEmpty(t, costCfg.Pricing.Defaults["openai"], "default table rides in every mapping")
-	assert.NotEmpty(t, costCfg.Pricing.Defaults["anthropic"], "default table covers all surfaces")
-	assert.NotEmpty(t, costCfg.Pricing.Defaults["bedrock"], "default table covers all surfaces")
 
 	assert.Equal(t, middlewareIDLLMResponseParser, mws[7].GetId(), "eighth middleware id")
 	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[7].GetSlot(), "response parser slot")

management/internals/modules/reverseproxy/domain/domain.go

@@ -23,9 +23,6 @@ type Domain struct {
 	// SupportsCrowdSec is populated at query time from proxy cluster capabilities.
 	// Not persisted.
 	SupportsCrowdSec *bool `gorm:"-"`
-	// SupportsAppSec is populated at query time from proxy cluster capabilities.
-	// Not persisted.
-	SupportsAppSec *bool `gorm:"-"`
 	// SupportsPrivate is populated at query time from proxy cluster capabilities. Not persisted.
 	SupportsPrivate *bool `gorm:"-"`
 }

management/internals/modules/reverseproxy/domain/manager/api.go

@@ -49,7 +49,6 @@ func domainToApi(d *domain.Domain) api.ReverseProxyDomain {
 		SupportsCustomPorts: d.SupportsCustomPorts,
 		RequireSubdomain:    d.RequireSubdomain,
 		SupportsCrowdsec:    d.SupportsCrowdSec,
-		SupportsAppsec:      d.SupportsAppSec,
 		SupportsPrivate:     d.SupportsPrivate,
 	}
 	if d.TargetCluster != "" {

management/internals/modules/reverseproxy/domain/manager/manager.go

@@ -35,7 +35,6 @@ type proxyManager interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
-	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
@@ -95,7 +94,6 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		d.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, cluster)
 		d.RequireSubdomain = m.proxyManager.ClusterRequireSubdomain(ctx, cluster)
 		d.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, cluster)
-		d.SupportsAppSec = m.proxyManager.ClusterSupportsAppSec(ctx, cluster)
 		d.SupportsPrivate = m.proxyManager.ClusterSupportsPrivate(ctx, cluster)
 		ret = append(ret, d)
 	}
@@ -113,7 +111,6 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		if d.TargetCluster != "" {
 			cd.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, d.TargetCluster)
 			cd.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, d.TargetCluster)
-			cd.SupportsAppSec = m.proxyManager.ClusterSupportsAppSec(ctx, d.TargetCluster)
 			cd.SupportsPrivate = m.proxyManager.ClusterSupportsPrivate(ctx, d.TargetCluster)
 		}
 		// Custom domains never require a subdomain by default since

management/internals/modules/reverseproxy/domain/manager/manager_test.go

@@ -40,10 +40,6 @@ func (m *mockProxyManager) ClusterSupportsCrowdSec(_ context.Context, _ string)
 	return nil
 }
 
-func (m *mockProxyManager) ClusterSupportsAppSec(_ context.Context, _ string) *bool {
-	return nil
-}
-
 func (m *mockProxyManager) ClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }

management/internals/modules/reverseproxy/proxy/manager.go

@@ -19,7 +19,6 @@ type Manager interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
-	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStale(ctx context.Context, inactivityDuration time.Duration) error
 	GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error)

management/internals/modules/reverseproxy/proxy/manager/controller.go

@@ -36,7 +36,7 @@ func NewGRPCController(proxyGRPCServer *nbgrpc.ProxyServiceServer, meter metric.
 // SendServiceUpdateToCluster sends a service update to a specific proxy cluster.
 func (c *GRPCController) SendServiceUpdateToCluster(ctx context.Context, accountID string, update *proto.ProxyMapping, clusterAddr string) {
 	c.proxyGRPCServer.SendServiceUpdateToCluster(ctx, update, clusterAddr)
-	c.metrics.IncrementServiceUpdateSendCount()
+	c.metrics.IncrementServiceUpdateSendCount(clusterAddr)
 }
 
 // GetOIDCValidationConfig returns the OIDC validation configuration from the gRPC server.
@@ -53,7 +53,7 @@ func (c *GRPCController) RegisterProxyToCluster(ctx context.Context, clusterAddr
 	proxySet.(*sync.Map).Store(proxyID, struct{}{})
 	log.WithContext(ctx).Debugf("Registered proxy %s to cluster %s", proxyID, clusterAddr)
 
-	c.metrics.IncrementProxyConnectionCount()
+	c.metrics.IncrementProxyConnectionCount(clusterAddr)
 
 	return nil
 }
@@ -67,7 +67,7 @@ func (c *GRPCController) UnregisterProxyFromCluster(ctx context.Context, cluster
 		proxySet.(*sync.Map).Delete(proxyID)
 		log.WithContext(ctx).Debugf("Unregistered proxy %s from cluster %s", proxyID, clusterAddr)
 
-		c.metrics.DecrementProxyConnectionCount()
+		c.metrics.DecrementProxyConnectionCount(clusterAddr)
 	}
 	return nil
 }

management/internals/modules/reverseproxy/proxy/manager/manager.go

@@ -21,7 +21,6 @@ type store interface {
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
-	GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetProxyByAccountID(ctx context.Context, accountID string) (*proxy.Proxy, error)
@@ -139,13 +138,6 @@ func (m Manager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string
 	return m.store.GetClusterSupportsCrowdSec(ctx, clusterAddr)
 }
 
-// ClusterSupportsAppSec returns whether all active proxies in the cluster have
-// a CrowdSec AppSec endpoint configured (unanimous). Returns nil when no proxy
-// has reported capabilities.
-func (m Manager) ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
-	return m.store.GetClusterSupportsAppSec(ctx, clusterAddr)
-}
-
 // ClusterSupportsPrivate reports whether any active proxy claims the private capability (nil = unreported).
 func (m Manager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
 	return m.store.GetClusterSupportsPrivate(ctx, clusterAddr)

management/internals/modules/reverseproxy/proxy/manager/manager_test.go

@@ -99,9 +99,6 @@ func (m *mockStore) GetClusterRequireSubdomain(_ context.Context, _ string) *boo
 func (m *mockStore) GetClusterSupportsCrowdSec(_ context.Context, _ string) *bool {
 	return nil
 }
-func (m *mockStore) GetClusterSupportsAppSec(_ context.Context, _ string) *bool {
-	return nil
-}
 func (m *mockStore) GetClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }

management/internals/modules/reverseproxy/proxy/manager/metrics.go

@@ -3,6 +3,7 @@ package manager
 import (
 	"context"
 
+	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/metric"
 )
 
@@ -47,16 +48,25 @@ func newMetrics(meter metric.Meter) (*metrics, error) {
 	}, nil
 }
 
-func (m *metrics) IncrementProxyConnectionCount() {
-	m.proxyConnectionCount.Add(context.Background(), 1)
+func (m *metrics) IncrementProxyConnectionCount(clusterAddr string) {
+	m.proxyConnectionCount.Add(context.Background(), 1,
+		metric.WithAttributes(
+			attribute.String("cluster", clusterAddr),
+		))
 }
 
-func (m *metrics) DecrementProxyConnectionCount() {
-	m.proxyConnectionCount.Add(context.Background(), -1)
+func (m *metrics) DecrementProxyConnectionCount(clusterAddr string) {
+	m.proxyConnectionCount.Add(context.Background(), -1,
+		metric.WithAttributes(
+			attribute.String("cluster", clusterAddr),
+		))
 }
 
-func (m *metrics) IncrementServiceUpdateSendCount() {
-	m.serviceUpdateSendCount.Add(context.Background(), 1)
+func (m *metrics) IncrementServiceUpdateSendCount(clusterAddr string) {
+	m.serviceUpdateSendCount.Add(context.Background(), 1,
+		metric.WithAttributes(
+			attribute.String("cluster", clusterAddr),
+		))
 }
 
 func (m *metrics) IncrementProxyHeartbeatCount() {

management/internals/modules/reverseproxy/proxy/manager_mock.go

@@ -50,6 +50,20 @@ func (mr *MockManagerMockRecorder) CleanupStale(ctx, inactivityDuration interfac
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupStale", reflect.TypeOf((*MockManager)(nil).CleanupStale), ctx, inactivityDuration)
 }
 
+// ClusterSupportsCustomPorts mocks base method.
+func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
+func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
+}
+
 // ClusterRequireSubdomain mocks base method.
 func (m *MockManager) ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -64,20 +78,6 @@ func (mr *MockManagerMockRecorder) ClusterRequireSubdomain(ctx, clusterAddr inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterRequireSubdomain", reflect.TypeOf((*MockManager)(nil).ClusterRequireSubdomain), ctx, clusterAddr)
 }
 
-// ClusterSupportsAppSec mocks base method.
-func (m *MockManager) ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ClusterSupportsAppSec", ctx, clusterAddr)
-	ret0, _ := ret[0].(*bool)
-	return ret0
-}
-
-// ClusterSupportsAppSec indicates an expected call of ClusterSupportsAppSec.
-func (mr *MockManagerMockRecorder) ClusterSupportsAppSec(ctx, clusterAddr interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsAppSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsAppSec), ctx, clusterAddr)
-}
-
 // ClusterSupportsCrowdSec mocks base method.
 func (m *MockManager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -92,20 +92,6 @@ func (mr *MockManagerMockRecorder) ClusterSupportsCrowdSec(ctx, clusterAddr inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCrowdSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCrowdSec), ctx, clusterAddr)
 }
 
-// ClusterSupportsCustomPorts mocks base method.
-func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
-	ret0, _ := ret[0].(*bool)
-	return ret0
-}
-
-// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
-func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
-}
-
 // ClusterSupportsPrivate mocks base method.
 func (m *MockManager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -135,35 +121,6 @@ func (mr *MockManagerMockRecorder) Connect(ctx, proxyID, sessionID, clusterAddre
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Connect", reflect.TypeOf((*MockManager)(nil).Connect), ctx, proxyID, sessionID, clusterAddress, ipAddress, accountID, capabilities)
 }
 
-// CountAccountProxies mocks base method.
-func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
-	ret0, _ := ret[0].(int64)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// CountAccountProxies indicates an expected call of CountAccountProxies.
-func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
-}
-
-// DeleteAccountCluster mocks base method.
-func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
-func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
-}
-
 // Disconnect mocks base method.
 func (m *MockManager) Disconnect(ctx context.Context, proxyID, sessionID string) error {
 	m.ctrl.T.Helper()
@@ -178,21 +135,6 @@ func (mr *MockManagerMockRecorder) Disconnect(ctx, proxyID, sessionID interface{
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Disconnect", reflect.TypeOf((*MockManager)(nil).Disconnect), ctx, proxyID, sessionID)
 }
 
-// GetAccountProxy mocks base method.
-func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
-	ret0, _ := ret[0].(*Proxy)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountProxy indicates an expected call of GetAccountProxy.
-func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
-}
-
 // GetActiveClusterAddresses mocks base method.
 func (m *MockManager) GetActiveClusterAddresses(ctx context.Context) ([]string, error) {
 	m.ctrl.T.Helper()
@@ -208,7 +150,6 @@ func (mr *MockManagerMockRecorder) GetActiveClusterAddresses(ctx interface{}) *g
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddresses", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddresses), ctx)
 }
 
-// GetActiveClusterAddressesForAccount mocks base method.
 func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, accountID string) ([]string, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetActiveClusterAddressesForAccount", ctx, accountID)
@@ -217,7 +158,6 @@ func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, a
 	return ret0, ret1
 }
 
-// GetActiveClusterAddressesForAccount indicates an expected call of GetActiveClusterAddressesForAccount.
 func (mr *MockManagerMockRecorder) GetActiveClusterAddressesForAccount(ctx, accountID interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddressesForAccount", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddressesForAccount), ctx, accountID)
@@ -237,6 +177,36 @@ func (mr *MockManagerMockRecorder) Heartbeat(ctx, p interface{}) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Heartbeat", reflect.TypeOf((*MockManager)(nil).Heartbeat), ctx, p)
 }
 
+// GetAccountProxy mocks base method.
+func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
+	ret0, _ := ret[0].(*Proxy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountProxy indicates an expected call of GetAccountProxy.
+func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
+}
+
+// CountAccountProxies mocks base method.
+func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CountAccountProxies indicates an expected call of CountAccountProxies.
+func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
+}
+
 // IsClusterAddressAvailable mocks base method.
 func (m *MockManager) IsClusterAddressAvailable(ctx context.Context, clusterAddress, accountID string) (bool, error) {
 	m.ctrl.T.Helper()
@@ -252,6 +222,20 @@ func (mr *MockManagerMockRecorder) IsClusterAddressAvailable(ctx, clusterAddress
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsClusterAddressAvailable", reflect.TypeOf((*MockManager)(nil).IsClusterAddressAvailable), ctx, clusterAddress, accountID)
 }
 
+// DeleteAccountCluster mocks base method.
+func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
+func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
+}
+
 // MockController is a mock of Controller interface.
 type MockController struct {
 	ctrl     *gomock.Controller

management/internals/modules/reverseproxy/proxy/proxy.go

@@ -20,9 +20,6 @@ type Capabilities struct {
 	RequireSubdomain *bool
 	// SupportsCrowdsec indicates whether this proxy has CrowdSec configured.
 	SupportsCrowdsec *bool
-	// SupportsAppsec indicates whether this proxy has a CrowdSec AppSec (WAF)
-	// endpoint configured.
-	SupportsAppsec *bool
 	// Private indicates whether this proxy supports inbound access via Wireguard
 	// tunnel and netbird-only authentication policies
 	Private *bool
@@ -77,6 +74,5 @@ type Cluster struct {
 	SupportsCustomPorts *bool
 	RequireSubdomain    *bool
 	SupportsCrowdSec    *bool
-	SupportsAppSec      *bool
 	Private             *bool
 }

management/internals/modules/reverseproxy/service/manager/api.go

@@ -204,7 +204,6 @@ func (h *handler) getClusters(w http.ResponseWriter, r *http.Request) {
 			SupportsCustomPorts: c.SupportsCustomPorts,
 			RequireSubdomain:    c.RequireSubdomain,
 			SupportsCrowdsec:    c.SupportsCrowdSec,
-			SupportsAppsec:      c.SupportsAppSec,
 			Private:             c.Private,
 		})
 	}

management/internals/modules/reverseproxy/service/manager/manager.go

@@ -82,7 +82,6 @@ type CapabilityProvider interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
-	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
@@ -138,7 +137,6 @@ func (m *Manager) GetClusters(ctx context.Context, accountID, userID string) ([]
 		clusters[i].SupportsCustomPorts = m.capabilities.ClusterSupportsCustomPorts(ctx, clusters[i].Address)
 		clusters[i].RequireSubdomain = m.capabilities.ClusterRequireSubdomain(ctx, clusters[i].Address)
 		clusters[i].SupportsCrowdSec = m.capabilities.ClusterSupportsCrowdSec(ctx, clusters[i].Address)
-		clusters[i].SupportsAppSec = m.capabilities.ClusterSupportsAppSec(ctx, clusters[i].Address)
 		clusters[i].Private = m.capabilities.ClusterSupportsPrivate(ctx, clusters[i].Address)
 	}
 

management/internals/modules/reverseproxy/service/service.go

@@ -165,18 +165,6 @@ type AccessRestrictions struct {
 	AllowedCountries []string `json:"allowed_countries,omitempty" gorm:"serializer:json"`
 	BlockedCountries []string `json:"blocked_countries,omitempty" gorm:"serializer:json"`
 	CrowdSecMode     string   `json:"crowdsec_mode,omitempty" gorm:"serializer:json"`
-	// AppSecMode is the CrowdSec AppSec (WAF) request inspection mode: "",
-	// "off", "enforce", or "observe". HTTP services only.
-	AppSecMode string `json:"appsec_mode,omitempty" gorm:"serializer:json"`
-}
-
-// isEmpty reports whether no restriction is configured. Both conversions drop
-// the object entirely in that case, so a field missing from this check is
-// silently discarded on the way to the API and the proxy.
-func (r AccessRestrictions) isEmpty() bool {
-	return len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
-		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" && r.AppSecMode == ""
 }
 
 // Copy returns a deep copy of the AccessRestrictions.
@@ -187,7 +175,6 @@ func (r AccessRestrictions) Copy() AccessRestrictions {
 		AllowedCountries: slices.Clone(r.AllowedCountries),
 		BlockedCountries: slices.Clone(r.BlockedCountries),
 		CrowdSecMode:     r.CrowdSecMode,
-		AppSecMode:       r.AppSecMode,
 	}
 }
 
@@ -821,17 +808,13 @@ func restrictionsFromAPI(r *api.AccessRestrictions) (AccessRestrictions, error)
 		}
 		res.CrowdSecMode = string(*r.CrowdsecMode)
 	}
-	if r.AppsecMode != nil {
-		if !r.AppsecMode.Valid() {
-			return AccessRestrictions{}, fmt.Errorf("invalid appsec_mode %q", *r.AppsecMode)
-		}
-		res.AppSecMode = string(*r.AppsecMode)
-	}
 	return res, nil
 }
 
 func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
-	if r.isEmpty() {
+	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
+		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
+		r.CrowdSecMode == "" {
 		return nil
 	}
 	res := &api.AccessRestrictions{}
@@ -851,15 +834,13 @@ func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 		mode := api.AccessRestrictionsCrowdsecMode(r.CrowdSecMode)
 		res.CrowdsecMode = &mode
 	}
-	if r.AppSecMode != "" {
-		mode := api.AccessRestrictionsAppsecMode(r.AppSecMode)
-		res.AppsecMode = &mode
-	}
 	return res
 }
 
 func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
-	if r.isEmpty() {
+	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
+		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
+		r.CrowdSecMode == "" {
 		return nil
 	}
 	return &proto.AccessRestrictions{
@@ -868,7 +849,6 @@ func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
 		AllowedCountries: r.AllowedCountries,
 		BlockedCountries: r.BlockedCountries,
 		CrowdsecMode:     r.CrowdSecMode,
-		AppsecMode:       r.AppSecMode,
 	}
 }
 
@@ -894,11 +874,6 @@ func (s *Service) Validate() error {
 	if err := validateAccessRestrictions(&s.Restrictions); err != nil {
 		return err
 	}
-	// AppSec inspects HTTP requests, so it cannot apply to the L4 modes, which
-	// forward opaque byte streams.
-	if appSecEnabled(s.Restrictions.AppSecMode) && s.Mode != ModeHTTP {
-		return fmt.Errorf("appsec_mode is only supported for HTTP services, got mode %q", s.Mode)
-	}
 	if err := s.validatePrivateRequirements(); err != nil {
 		return err
 	}
@@ -1267,27 +1242,10 @@ func validateCrowdSecMode(mode string) error {
 	}
 }
 
-func validateAppSecMode(mode string) error {
-	switch mode {
-	case "", "off", "enforce", "observe":
-		return nil
-	default:
-		return fmt.Errorf("appsec_mode %q is invalid", mode)
-	}
-}
-
-// appSecEnabled reports whether the mode asks for request inspection.
-func appSecEnabled(mode string) bool {
-	return mode == "enforce" || mode == "observe"
-}
-
 func validateAccessRestrictions(r *AccessRestrictions) error {
 	if err := validateCrowdSecMode(r.CrowdSecMode); err != nil {
 		return err
 	}
-	if err := validateAppSecMode(r.AppSecMode); err != nil {
-		return err
-	}
 
 	if len(r.AllowedCIDRs) > maxCIDREntries {
 		return fmt.Errorf("allowed_cidrs: exceeds maximum of %d entries", maxCIDREntries)

management/internals/modules/reverseproxy/service/service_test.go

@@ -26,17 +26,6 @@ func validProxy() *Service {
 	}
 }
 
-// validL4Proxy returns a service that passes validation in one of the L4 modes.
-func validL4Proxy(mode string) *Service {
-	rp := validProxy()
-	rp.Mode = mode
-	rp.ListenPort = 9000
-	rp.Targets = []*Target{
-		{TargetId: "peer-1", TargetType: TargetTypePeer, Host: "10.0.0.1", Port: 5432, Protocol: mode, Enabled: true},
-	}
-	return rp
-}
-
 func TestValidate_Valid(t *testing.T) {
 	require.NoError(t, validProxy().Validate())
 }
@@ -1326,68 +1315,3 @@ func TestValidate_Private_RejectsNonHTTPMode(t *testing.T) {
 	}}
 	assert.ErrorContains(t, rp.Validate(), "HTTP")
 }
-
-func TestRestrictions_AppSecMode_RoundTrip(t *testing.T) {
-	mode := api.AccessRestrictionsAppsecModeEnforce
-	apiIn := &api.AccessRestrictions{AppsecMode: &mode}
-
-	model, err := restrictionsFromAPI(apiIn)
-	require.NoError(t, err)
-	assert.Equal(t, "enforce", model.AppSecMode)
-
-	// appsec_mode alone must keep the restrictions object alive on both the API
-	// and proto legs: it is meaningful without any CIDR or country entry.
-	apiOut := restrictionsToAPI(model)
-	require.NotNil(t, apiOut, "appsec_mode alone must not collapse the restrictions to nil")
-	require.NotNil(t, apiOut.AppsecMode)
-	assert.Equal(t, api.AccessRestrictionsAppsecModeEnforce, *apiOut.AppsecMode)
-
-	protoOut := restrictionsToProto(model)
-	require.NotNil(t, protoOut, "appsec_mode alone must reach the proxy")
-	assert.Equal(t, "enforce", protoOut.AppsecMode)
-}
-
-func TestRestrictions_AppSecMode_EmptyIsOmitted(t *testing.T) {
-	model, err := restrictionsFromAPI(&api.AccessRestrictions{
-		AllowedCidrs: &[]string{"203.0.113.0/24"},
-	})
-	require.NoError(t, err)
-	assert.Empty(t, model.AppSecMode)
-
-	apiOut := restrictionsToAPI(model)
-	require.NotNil(t, apiOut)
-	assert.Nil(t, apiOut.AppsecMode, "empty appsec_mode is omitted from the API response")
-}
-
-func TestRestrictions_AppSecMode_CopyIsDeep(t *testing.T) {
-	original := AccessRestrictions{AppSecMode: "observe", CrowdSecMode: "enforce"}
-	assert.Equal(t, original, original.Copy(), "Copy must carry every mode field")
-}
-
-func TestValidate_RejectsInvalidAppSecMode(t *testing.T) {
-	rp := validProxy()
-	rp.Restrictions = AccessRestrictions{AppSecMode: "sometimes"}
-	assert.ErrorContains(t, rp.Validate(), "appsec_mode")
-}
-
-func TestValidate_RejectsAppSecOnL4Modes(t *testing.T) {
-	// AppSec inspects HTTP requests, so the L4 modes cannot honor it. Accepting
-	// the field there would report protection that never runs.
-	for _, mode := range []string{ModeTCP, ModeUDP, ModeTLS} {
-		t.Run(mode, func(t *testing.T) {
-			rp := validL4Proxy(mode)
-			rp.Restrictions = AccessRestrictions{AppSecMode: "enforce"}
-			assert.ErrorContains(t, rp.Validate(), "appsec_mode is only supported for HTTP services")
-		})
-	}
-}
-
-func TestValidate_AllowsAppSecOffOnL4Modes(t *testing.T) {
-	for _, mode := range []string{ModeTCP, ModeUDP, ModeTLS} {
-		t.Run(mode, func(t *testing.T) {
-			rp := validL4Proxy(mode)
-			rp.Restrictions = AccessRestrictions{AppSecMode: "off"}
-			require.NoError(t, rp.Validate(), "an explicit off must not be rejected on L4 services")
-		})
-	}
-}

management/internals/server/config/config.go

@@ -55,8 +55,6 @@ type Config struct {
 
 	ReverseProxy ReverseProxy
 
-	AgentNetwork AgentNetwork
-
 	// disable default all-to-all policy
 	DisableDefaultPolicy bool
 
@@ -187,25 +185,6 @@ type StoreConfig struct {
 	Engine types.Engine
 }
 
-// AgentNetwork contains agent-network (LLM gateway) configuration.
-type AgentNetwork struct {
-	// PricingDefaultsFile is the path to the YAML file holding the default
-	// LLM pricing table (defaults_llm_pricing.yaml). A relative path is
-	// resolved against <Datadir>, so a bare filename lands alongside the
-	// store. Empty falls back to probing <Datadir>/defaults_llm_pricing.yaml;
-	// with no file present the compiled-in defaults serve. Schema: surface ("openai"/"anthropic"/
-	// "bedrock") -> model -> rates in USD per 1k tokens (input_per_1k,
-	// output_per_1k, and the optional cached_input_per_1k /
-	// cache_read_per_1k / cache_creation_per_1k). File entries replace the
-	// compiled-in entry for the same surface+model whole; everything else
-	// keeps the compiled-in rates. The file is re-read periodically (mtime
-	// poll), and the live table feeds both the synthesizer (what proxies
-	// bill with) and the dashboard's catalog endpoint (what model rows
-	// prefill with). An explicitly configured path that fails to load
-	// fails startup; runtime reload errors keep the previous table.
-	PricingDefaultsFile string
-}
-
 // ReverseProxy contains reverse proxy configuration in front of management.
 type ReverseProxy struct {
 	// TrustedHTTPProxies represents a list of trusted HTTP proxies by their IP prefixes.

management/internals/shared/grpc/proxy.go

@@ -29,7 +29,6 @@ import (
 
 	"github.com/netbirdio/netbird/shared/management/domain"
 
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
@@ -37,6 +36,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/management/server/users"
 	proxyauth "github.com/netbirdio/netbird/proxy/auth"
@@ -506,7 +506,6 @@ func (s *ProxyServiceServer) registerProxyConnection(ctx context.Context, params
 			SupportsCustomPorts: c.SupportsCustomPorts,
 			RequireSubdomain:    c.RequireSubdomain,
 			SupportsCrowdsec:    c.SupportsCrowdsec,
-			SupportsAppsec:      c.SupportsAppsec,
 			Private:             c.Private,
 		}
 	}

management/server/store/sql_store.go

@@ -6439,7 +6439,6 @@ var validCapabilityColumns = map[string]struct{}{
 	"supports_custom_ports": {},
 	"require_subdomain":     {},
 	"supports_crowdsec":     {},
-	"supports_appsec":       {},
 	"private":               {},
 }
 
@@ -6470,14 +6469,6 @@ func (s *SqlStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr s
 	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_crowdsec")
 }
 
-// GetClusterSupportsAppSec returns whether all active proxies in the cluster
-// have a CrowdSec AppSec endpoint configured. Returns nil when no proxy
-// reported the capability. Unanimous for the same reason as CrowdSec: a single
-// proxy without AppSec would let requests through uninspected.
-func (s *SqlStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
-	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_appsec")
-}
-
 // getClusterUnanimousCapability returns an aggregated boolean capability
 // requiring all active proxies in the cluster to report true.
 func (s *SqlStore) getClusterUnanimousCapability(ctx context.Context, clusterAddr, column string) *bool {

management/server/store/sql_store_proxy_capability_test.go

@@ -1,119 +0,0 @@
-package store
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"runtime"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
-)
-
-// Capabilities travel proxy → gRPC → embedded gorm columns → aggregation → API.
-// A field dropped at any of those hops reads as "capability absent", which is
-// indistinguishable from a proxy that never reported it: the dashboard simply
-// hides the feature and nothing fails. These assertions cover the persistence
-// and aggregation hops.
-func TestSqlStore_ClusterCapabilityAggregation(t *testing.T) {
-	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	yes, no := true, false
-
-	tests := []struct {
-		name          string
-		reported      []*bool // one entry per connected proxy in the cluster
-		wantAppSec    *bool
-		wantAssertion string
-	}{
-		{
-			name:          "unreported stays unknown",
-			reported:      []*bool{nil},
-			wantAppSec:    nil,
-			wantAssertion: "an unreported capability must not read as false",
-		},
-		{
-			name:          "single proxy reporting true",
-			reported:      []*bool{&yes},
-			wantAppSec:    &yes,
-			wantAssertion: "a reported capability must survive persistence",
-		},
-		{
-			name:          "one proxy without it disables the cluster",
-			reported:      []*bool{&yes, &no},
-			wantAppSec:    &no,
-			wantAssertion: "capability must be unanimous, so a rolling upgrade cannot leave traffic uninspected",
-		},
-		{
-			name:          "one proxy yet to report disables the cluster",
-			reported:      []*bool{&yes, nil},
-			wantAppSec:    &no,
-			wantAssertion: "a proxy that has not reported must not count as capable",
-		},
-	}
-
-	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
-		ctx := context.Background()
-		for i, tt := range tests {
-			t.Run(tt.name, func(t *testing.T) {
-				cluster := fmt.Sprintf("cluster-%d.proxy.example", i)
-				for j, reported := range tt.reported {
-					require.NoError(t, store.SaveProxy(ctx, &proxy.Proxy{
-						ID:             fmt.Sprintf("proxy-%d-%d", i, j),
-						ClusterAddress: cluster,
-						Status:         proxy.StatusConnected,
-						LastSeen:       time.Now(),
-						Capabilities:   proxy.Capabilities{SupportsAppsec: reported},
-					}))
-				}
-
-				got := store.GetClusterSupportsAppSec(ctx, cluster)
-				if tt.wantAppSec == nil {
-					assert.Nil(t, got, tt.wantAssertion)
-					return
-				}
-				require.NotNil(t, got, tt.wantAssertion)
-				assert.Equal(t, *tt.wantAppSec, *got, tt.wantAssertion)
-			})
-		}
-	})
-}
-
-// AppSec and IP reputation are separate endpoints, so a cluster can have either
-// without the other. Gating one on the other would silently disable a feature
-// the operator configured.
-func TestSqlStore_ClusterCapabilitiesAreIndependent(t *testing.T) {
-	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
-		ctx := context.Background()
-		const cluster = "independent.proxy.example"
-		yes, no := true, false
-
-		require.NoError(t, store.SaveProxy(ctx, &proxy.Proxy{
-			ID:             "proxy-independent",
-			ClusterAddress: cluster,
-			Status:         proxy.StatusConnected,
-			LastSeen:       time.Now(),
-			Capabilities: proxy.Capabilities{
-				SupportsAppsec:   &yes,
-				SupportsCrowdsec: &no,
-			},
-		}))
-
-		appsec := store.GetClusterSupportsAppSec(ctx, cluster)
-		crowdsec := store.GetClusterSupportsCrowdSec(ctx, cluster)
-		require.NotNil(t, appsec)
-		require.NotNil(t, crowdsec)
-		assert.True(t, *appsec, "AppSec must not be gated on CrowdSec")
-		assert.False(t, *crowdsec, "CrowdSec must not be implied by AppSec")
-	})
-}

management/server/store/sql_store_service_test.go

@@ -133,42 +133,3 @@ func TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip(t *testing.T) {
 		assert.True(t, tg.Options.DisableAccessLog, "options disable access log")
 	})
 }
-
-// Restrictions are stored as a JSON blob, and the Postgres read path lists
-// columns by hand: a mode that is not read there is silently off on Postgres
-// while working in SQLite dev.
-func TestSqlStore_GetAccount_ServiceRestrictionsRoundtrip(t *testing.T) {
-	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
-		ctx := context.Background()
-		account := newAccountWithId(ctx, "account_svc_restrictions", "testuser", "")
-		require.NoError(t, store.SaveAccount(ctx, account))
-
-		svc := &rpservice.Service{
-			ID:        "svc-restrictions",
-			AccountID: account.Id,
-			Name:      "restricted-svc",
-			Domain:    "restricted.example",
-			Enabled:   true,
-			Mode:      rpservice.ModeHTTP,
-			Restrictions: rpservice.AccessRestrictions{
-				AllowedCIDRs: []string{"203.0.113.0/24"},
-				CrowdSecMode: "observe",
-				AppSecMode:   "enforce",
-			},
-		}
-		require.NoError(t, store.CreateService(ctx, svc))
-
-		loaded, err := store.GetAccount(ctx, account.Id)
-		require.NoError(t, err)
-		require.Len(t, loaded.Services, 1)
-
-		got := loaded.Services[0].Restrictions
-		assert.Equal(t, []string{"203.0.113.0/24"}, got.AllowedCIDRs, "restrictions allowed CIDRs")
-		assert.Equal(t, "observe", got.CrowdSecMode, "restrictions crowdsec mode")
-		assert.Equal(t, "enforce", got.AppSecMode, "restrictions appsec mode")
-	})
-}

management/server/store/store.go

@@ -321,7 +321,6 @@ type Store interface {
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
-	GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetAllProxies(ctx context.Context) ([]*proxy.Proxy, error)

management/server/store/store_mock.go

@@ -1835,20 +1835,6 @@ func (mr *MockStoreMockRecorder) GetClusterRequireSubdomain(ctx, clusterAddr int
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterRequireSubdomain", reflect.TypeOf((*MockStore)(nil).GetClusterRequireSubdomain), ctx, clusterAddr)
 }
 
-// GetClusterSupportsAppSec mocks base method.
-func (m *MockStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetClusterSupportsAppSec", ctx, clusterAddr)
-	ret0, _ := ret[0].(*bool)
-	return ret0
-}
-
-// GetClusterSupportsAppSec indicates an expected call of GetClusterSupportsAppSec.
-func (mr *MockStoreMockRecorder) GetClusterSupportsAppSec(ctx, clusterAddr interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterSupportsAppSec", reflect.TypeOf((*MockStore)(nil).GetClusterSupportsAppSec), ctx, clusterAddr)
-}
-
 // GetClusterSupportsCrowdSec mocks base method.
 func (m *MockStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()

proxy/cmd/proxy/cmd/root.go

@@ -79,11 +79,6 @@ var (
 	geoDataDir            string
 	crowdsecAPIURL        string
 	crowdsecAPIKey        string
-	appsecURL             string
-	appsecTimeout         time.Duration
-	appsecMaxBodyBytes    int64
-	captureBudgetBytes    int64
-	appsecMaxConcurrent   int
 )
 
 var rootCmd = &cobra.Command{
@@ -130,11 +125,6 @@ func init() {
 	rootCmd.Flags().StringVar(&geoDataDir, "geo-data-dir", envStringOrDefault("NB_PROXY_GEO_DATA_DIR", "/var/lib/netbird/geolocation"), "Directory for the GeoLite2 MMDB file (auto-downloaded if missing)")
 	rootCmd.Flags().StringVar(&crowdsecAPIURL, "crowdsec-api-url", envStringOrDefault("NB_PROXY_CROWDSEC_API_URL", ""), "CrowdSec LAPI URL for IP reputation checks")
 	rootCmd.Flags().StringVar(&crowdsecAPIKey, "crowdsec-api-key", envStringOrDefault("NB_PROXY_CROWDSEC_API_KEY", ""), "CrowdSec bouncer API key")
-	rootCmd.Flags().StringVar(&appsecURL, "crowdsec-appsec-url", envStringOrDefault("NB_PROXY_CROWDSEC_APPSEC_URL", ""), "CrowdSec AppSec (WAF) endpoint for HTTP request inspection, e.g. http://127.0.0.1:7422/ (reuses the bouncer API key)")
-	rootCmd.Flags().DurationVar(&appsecTimeout, "crowdsec-appsec-timeout", envDurationOrDefault("NB_PROXY_CROWDSEC_APPSEC_TIMEOUT", 0), "Timeout for a single AppSec inspection call (0 = 200ms)")
-	rootCmd.Flags().IntVar(&appsecMaxConcurrent, "crowdsec-appsec-max-concurrent", int(envInt64OrDefault("NB_PROXY_CROWDSEC_APPSEC_MAX_CONCURRENT", 0)), "Cap on AppSec inspections in flight; further requests are denied in enforce mode rather than queued (0 = 256, negative = no cap)")
-	rootCmd.Flags().Int64Var(&captureBudgetBytes, "capture-budget-bytes", envInt64OrDefault("NB_PROXY_CAPTURE_BUDGET_BYTES", 0), "Total in-flight request-body buffering across the proxy, shared by AppSec inspection and agent-network capture (0 = 256MiB)")
-	rootCmd.Flags().Int64Var(&appsecMaxBodyBytes, "crowdsec-appsec-max-body-bytes", envInt64OrDefault("NB_PROXY_CROWDSEC_APPSEC_MAX_BODY_BYTES", 0), "Cap on the request body mirrored to AppSec (0 = 64KiB, negative = headers and URI only)")
 }
 
 // Execute runs the root command.
@@ -228,59 +218,47 @@ func runServer(cmd *cobra.Command, args []string) error {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
 	defer stop()
 
-	srv := proxy.New(ctx, serverConfig(logger, proxyToken, parsedTrustedProxies, perf))
+	srv := proxy.New(ctx, proxy.Config{
+		ListenAddr:               addr,
+		Logger:                   logger,
+		Version:                  Version,
+		ManagementAddress:        mgmtAddr,
+		ProxyURL:                 proxyDomain,
+		ProxyToken:               proxyToken,
+		CertificateDirectory:     certDir,
+		CertificateFile:          certFile,
+		CertificateKeyFile:       certKeyFile,
+		GenerateACMECertificates: acmeCerts,
+		ACMEChallengeAddress:     acmeAddr,
+		ACMEDirectory:            acmeDir,
+		ACMEEABKID:               acmeEABKID,
+		ACMEEABHMACKey:           acmeEABHMACKey,
+		ACMEChallengeType:        acmeChallengeType,
+		DebugEndpointEnabled:     debugEndpoint,
+		DebugEndpointAddress:     debugEndpointAddr,
+		HealthAddr:               healthAddr,
+		ForwardedProto:           forwardedProto,
+		TrustedProxies:           parsedTrustedProxies,
+		CertLockMethod:           nbacme.CertLockMethod(certLockMethod),
+		WildcardCertDir:          wildcardCertDir,
+		WireguardPort:            wgPort,
+		Performance:              perf,
+		ProxyProtocol:            proxyProtocol,
+		PreSharedKey:             preSharedKey,
+		SupportsCustomPorts:      supportsCustomPorts,
+		RequireSubdomain:         requireSubdomain,
+		Private:                  private,
+		MaxDialTimeout:           maxDialTimeout,
+		MaxSessionIdleTimeout:    maxSessionIdleTimeout,
+		MappingBatchWatchdog:     envDurationOrDefault("NB_PROXY_MAPPING_BATCH_WATCHDOG", 0),
+		GeoDataDir:               geoDataDir,
+		CrowdSecAPIURL:           crowdsecAPIURL,
+		CrowdSecAPIKey:           crowdsecAPIKey,
+	})
 
 	return srv.ListenAndServe(ctx, addr)
 }
 
-// serverConfig maps the parsed flags and environment onto the proxy config.
-// Kept separate from runServer so registering a new flag does not grow the
-// startup path.
-func serverConfig(logger *log.Logger, proxyToken string, trustedProxyList *trustedproxy.List, perf embed.Performance) proxy.Config {
-	return proxy.Config{
-		ListenAddr:                   addr,
-		Logger:                       logger,
-		Version:                      Version,
-		ManagementAddress:            mgmtAddr,
-		ProxyURL:                     proxyDomain,
-		ProxyToken:                   proxyToken,
-		CertificateDirectory:         certDir,
-		CertificateFile:              certFile,
-		CertificateKeyFile:           certKeyFile,
-		GenerateACMECertificates:     acmeCerts,
-		ACMEChallengeAddress:         acmeAddr,
-		ACMEDirectory:                acmeDir,
-		ACMEEABKID:                   acmeEABKID,
-		ACMEEABHMACKey:               acmeEABHMACKey,
-		ACMEChallengeType:            acmeChallengeType,
-		DebugEndpointEnabled:         debugEndpoint,
-		DebugEndpointAddress:         debugEndpointAddr,
-		HealthAddr:                   healthAddr,
-		ForwardedProto:               forwardedProto,
-		TrustedProxies:               trustedProxyList,
-		CertLockMethod:               nbacme.CertLockMethod(certLockMethod),
-		WildcardCertDir:              wildcardCertDir,
-		WireguardPort:                wgPort,
-		Performance:                  perf,
-		ProxyProtocol:                proxyProtocol,
-		PreSharedKey:                 preSharedKey,
-		SupportsCustomPorts:          supportsCustomPorts,
-		RequireSubdomain:             requireSubdomain,
-		Private:                      private,
-		MaxDialTimeout:               maxDialTimeout,
-		MaxSessionIdleTimeout:        maxSessionIdleTimeout,
-		MappingBatchWatchdog:         envDurationOrDefault("NB_PROXY_MAPPING_BATCH_WATCHDOG", 0),
-		GeoDataDir:                   geoDataDir,
-		CrowdSecAPIURL:               crowdsecAPIURL,
-		CrowdSecAPIKey:               crowdsecAPIKey,
-		CrowdSecAppSecURL:            appsecURL,
-		CrowdSecAppSecTimeout:        appsecTimeout,
-		CrowdSecAppSecMaxBodyBytes:   appsecMaxBodyBytes,
-		CrowdSecAppSecMaxConcurrent:  appsecMaxConcurrent,
-		MiddlewareCaptureBudgetBytes: captureBudgetBytes,
-	}
-}
-
 func envBoolOrDefault(key string, def bool) bool {
 	v, exists := os.LookupEnv(key)
 	if !exists {
@@ -315,19 +293,6 @@ func envUint16OrDefault(key string, def uint16) uint16 {
 	return uint16(parsed)
 }
 
-func envInt64OrDefault(key string, def int64) int64 {
-	v, exists := os.LookupEnv(key)
-	if !exists {
-		return def
-	}
-	parsed, err := strconv.ParseInt(v, 10, 64)
-	if err != nil {
-		log.Warnf("parse %s=%q: %v, using default %d", key, v, err, def)
-		return def
-	}
-	return parsed
-}
-
 func envDurationOrDefault(key string, def time.Duration) time.Duration {
 	v, exists := os.LookupEnv(key)
 	if !exists {

proxy/internal/appsec/body.go

@@ -1,163 +0,0 @@
-package appsec
-
-import (
-	"bytes"
-	"errors"
-	"io"
-	"mime"
-	"net/http"
-	"net/url"
-	"slices"
-	"strings"
-)
-
-// bufferBody reads up to limit+1 bytes from r.Body and always restores r.Body so
-// the request stays forwardable. oversize reports that the body exceeded limit, in
-// which case the returned prefix must not be used for inspection: the bytes are
-// only read so they can be replayed to the backend.
-func bufferBody(r *http.Request, limit int64) (body []byte, oversize bool, err error) {
-	original := r.Body
-	buf, readErr := io.ReadAll(io.LimitReader(original, limit+1))
-	if readErr != nil && !errors.Is(readErr, io.EOF) {
-		// Restore what was read so a downstream retry sees a consistent stream,
-		// then surface the failure.
-		r.Body = replay(buf, original)
-		return nil, false, readErr
-	}
-
-	if int64(len(buf)) > limit {
-		r.Body = replay(buf, original)
-		return nil, true, nil
-	}
-
-	// The whole body is buffered, so the original is drained and can be closed.
-	// A close error on a drained read-only body does not invalidate the bytes.
-	_ = original.Close()
-	r.Body = io.NopCloser(bytes.NewReader(buf))
-	// Framing is deliberately left as the client sent it. Rewriting a chunked
-	// request to a fixed Content-Length here would be invisible to the client
-	// but not to the rest of the chain: a later body capture with a smaller cap
-	// sees a known length over its cap and skips capture entirely, where an
-	// unknown length would have given it a truncated prefix. Inspecting a
-	// request must not change what any other layer gets to inspect.
-	return buf, false, nil
-}
-
-// replay returns a ReadCloser that yields the already-read prefix followed by
-// the remainder of the original stream, and closes the original.
-func replay(prefix []byte, rest io.ReadCloser) io.ReadCloser {
-	return struct {
-		io.Reader
-		io.Closer
-	}{
-		Reader: io.MultiReader(bytes.NewReader(prefix), rest),
-		Closer: rest,
-	}
-}
-
-// redactedPlaceholder replaces a credential value in the mirrored body. It is
-// inert for rule matching, and its fixed length leaks nothing about the secret.
-const redactedPlaceholder = "redacted"
-
-// redactFormFields returns the body to mirror for a URL-encoded form, with the
-// values of the named fields replaced. The proxy's own password / PIN login
-// form posts to the service path itself, so without this the plaintext
-// credential would reach the Security Engine.
-//
-// Only the credential values are removed, never the whole body: dropping the
-// body outright would let a caller exempt any payload from inspection just by
-// appending a field named "password". Everything else in the form stays
-// inspectable, which is the point.
-//
-// Returns body unchanged when it is not a URL-encoded form or carries none of
-// the fields.
-//
-// Substitution happens on the raw bytes rather than by re-encoding parsed
-// values. Re-encoding would drop pairs that url.ParseQuery rejects, so a
-// payload hidden in a malformed pair alongside a credential-named field would
-// never be inspected while a tolerant backend parser still acted on it. Working
-// byte-wise also avoids reordering keys and normalizing escapes, so the engine
-// sees the same bytes the backend will.
-//
-// Field names match case-sensitively, on purpose: the caller passes the exact
-// names the login handler reads via r.FormValue, and that lookup is itself
-// case-sensitive. A "Password" field is therefore never a credential as far as
-// the proxy is concerned, and redacting it would only blind the WAF to a value
-// the proxy does not own.
-func redactFormFields(contentType string, body []byte, fields []string) []byte {
-	if len(fields) == 0 || len(body) == 0 {
-		return body
-	}
-	media, _, err := mime.ParseMediaType(contentType)
-	if err != nil || media != "application/x-www-form-urlencoded" {
-		return body
-	}
-	return redactURLEncoded(body, fields)
-}
-
-// redactURLEncoded replaces the values of the named keys in a URL-encoded
-// key/value sequence, the shared syntax of a query string and a form body.
-func redactURLEncoded(raw []byte, fields []string) []byte {
-	// Split on "&" only, matching how Go's form parser delimits pairs.
-	segments := bytes.Split(raw, []byte("&"))
-	redacted := false
-	for i, segment := range segments {
-		rawKey, _, hasValue := bytes.Cut(segment, []byte("="))
-		if !hasValue {
-			continue
-		}
-		// Compare the decoded name, so an escaped spelling of the field
-		// ("pass%77ord") is redacted too: the reader decodes before looking it
-		// up. A key that fails to decode never reaches that reader either,
-		// since the parser drops the pair.
-		name, err := url.QueryUnescape(string(rawKey))
-		if err != nil || !slices.Contains(fields, name) {
-			continue
-		}
-		// Keep the key bytes as sent and replace only the value. Assigning a
-		// fresh slice leaves raw untouched, which matters: the caller restored
-		// the request body from the same buffer.
-		segments[i] = []byte(string(rawKey) + "=" + redactedPlaceholder)
-		redacted = true
-	}
-	if !redacted {
-		return raw
-	}
-	return bytes.Join(segments, []byte("&"))
-}
-
-// redactQuery replaces the values of the named query parameters in a raw query
-// string, leaving every other byte as sent.
-func redactQuery(rawQuery string, params []string) string {
-	if len(params) == 0 || rawQuery == "" {
-		return rawQuery
-	}
-	return string(redactURLEncoded([]byte(rawQuery), params))
-}
-
-// redactCookieHeader replaces the values of the named cookies in a Cookie
-// header, keeping the others intact: cookies are a zone WAF rules match on, so
-// dropping the whole header would cost real coverage.
-func redactCookieHeader(value string, names []string) string {
-	if len(names) == 0 || value == "" {
-		return value
-	}
-	parts := strings.Split(value, ";")
-	redacted := false
-	for i, part := range parts {
-		name, _, hasValue := strings.Cut(part, "=")
-		if !hasValue {
-			continue
-		}
-		// Cookie names are case-sensitive and are not percent-decoded.
-		if !slices.Contains(names, strings.TrimSpace(name)) {
-			continue
-		}
-		parts[i] = name + "=" + redactedPlaceholder
-		redacted = true
-	}
-	if !redacted {
-		return value
-	}
-	return strings.Join(parts, ";")
-}

proxy/internal/appsec/client.go

@@ -1,571 +0,0 @@
-// Package appsec implements the CrowdSec AppSec (WAF) side of the remediation
-// component protocol: each inspected HTTP request is mirrored to the Security
-// Engine's AppSec endpoint, which replies with an allow / ban / captcha verdict
-// for that request.
-//
-// This is a separate endpoint from the LAPI decision stream used by the
-// crowdsec package: LAPI answers "is this IP known bad", AppSec answers "is
-// this request an attack". The two are configured and enabled independently.
-package appsec
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"net/netip"
-	"net/url"
-	"strings"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/proxy/internal/netutil"
-	"github.com/netbirdio/netbird/proxy/internal/restrict"
-)
-
-// Header names the AppSec component reads off the mirrored request. IP, URI and
-// Verb are mandatory: the engine answers 500 when any of them is missing.
-const (
-	headerAPIKey        = "X-Crowdsec-Appsec-Api-Key" //nolint:gosec // G101: a header name, not a credential
-	headerIP            = "X-Crowdsec-Appsec-Ip"
-	headerURI           = "X-Crowdsec-Appsec-Uri"
-	headerVerb          = "X-Crowdsec-Appsec-Verb"
-	headerHost          = "X-Crowdsec-Appsec-Host"
-	headerUserAgent     = "X-Crowdsec-Appsec-User-Agent"
-	headerHTTPVersion   = "X-Crowdsec-Appsec-Http-Version"
-	headerTransactionID = "X-Crowdsec-Appsec-Transaction-Id"
-)
-
-// headerPrefix covers every protocol header. Any client-supplied header in this
-// namespace is dropped before forwarding so a caller cannot influence the
-// engine's view of its own address, or replay an API key.
-const headerPrefix = "X-Crowdsec-Appsec-"
-
-// Remediation actions the engine can return.
-const (
-	actionAllow   = "allow"
-	actionBan     = "ban"
-	actionCaptcha = "captcha"
-)
-
-const (
-	// DefaultTimeout matches the 200ms budget CrowdSec's remediation component
-	// spec sets for the blocking AppSec call.
-	DefaultTimeout = 200 * time.Millisecond
-	// MinTimeout and MaxTimeout bound the configured inspection timeout.
-	// Inspection is synchronous, so the upper bound is what keeps a
-	// mis-set value from parking every request to an inspected service on a
-	// slow engine; the lower bound keeps the call from timing out before the
-	// engine can realistically answer. Mirrors the per-middleware bounds the
-	// proxy already applies to in-path calls.
-	MinTimeout = 10 * time.Millisecond
-	MaxTimeout = 5 * time.Second
-	// DefaultMaxBodyBytes caps the request body mirrored to the engine.
-	// Requests with a larger body are inspected on headers and URI only.
-	DefaultMaxBodyBytes int64 = 64 << 10
-	// DefaultMaxConcurrent bounds inspections in flight toward the engine. The
-	// point is to fail fast instead of parking a goroutine per request for the
-	// whole timeout once the engine is saturated: a slow engine otherwise turns
-	// a traffic burst into a pile of waiters that all time out anyway. Sized so
-	// a healthy engine (single-digit milliseconds per call) never reaches it.
-	DefaultMaxConcurrent = 256
-	// MaxConcurrentLimit is the ceiling for that bound.
-	MaxConcurrentLimit = 4096
-	// MaxBodyBytesLimit is the ceiling for that cap. A single request can hold
-	// this much in memory; the shared Budget is what bounds the total across
-	// concurrent requests. Matches the proxy-wide body-capture ceiling.
-	MaxBodyBytesLimit int64 = 8 << 20
-	// maxResponseBytes bounds how much of a verdict response is read. The
-	// engine answers with a two-field JSON object, so anything beyond this is
-	// not a response we can act on.
-	maxResponseBytes int64 = 4 << 10
-)
-
-// Reasons the request body was not mirrored. Reported so an access-log reader
-// can distinguish "inspected and clean" from "never inspected", and so an
-// oversize opt-out is visible rather than silent.
-const (
-	BypassOversize = "oversize"
-	BypassUpgrade  = "upgrade"
-	BypassDisabled = "disabled"
-	BypassBudget   = "budget_exhausted"
-)
-
-// ErrUnavailable reports that the engine could not produce a verdict: the call
-// failed, timed out, or the engine rejected it (401 bad key, 500 malformed).
-// Distinguished from a block verdict so the caller can apply the per-service
-// mode: enforce fails closed, observe allows.
-var ErrUnavailable = errors.New("appsec engine unavailable")
-
-// Config configures a Client.
-type Config struct {
-	// URL is the AppSec endpoint, e.g. http://127.0.0.1:7422/.
-	URL string
-	// APIKey is the CrowdSec bouncer API key. The AppSec component validates it
-	// against LAPI, so the same key used for the decision stream works here.
-	APIKey string
-	// Timeout bounds a single inspection call. Zero means DefaultTimeout.
-	Timeout time.Duration
-	// MaxBodyBytes caps the mirrored request body. Zero means
-	// DefaultMaxBodyBytes; negative disables body forwarding entirely.
-	MaxBodyBytes int64
-	// MaxConcurrent bounds inspections in flight toward the engine. Zero means
-	// DefaultMaxConcurrent; negative disables the bound.
-	MaxConcurrent int
-	// Budget bounds the total body buffering in flight across all inspected
-	// requests. Nil disables that ceiling, which leaves the worst case at
-	// MaxBodyBytes times the concurrent request count; callers serving
-	// untrusted traffic should share the proxy-wide capture budget here.
-	Budget Budget
-	Logger *log.Entry
-}
-
-// Budget is the shared allowance for in-flight body buffering. Acquire reports
-// whether n bytes could be reserved; every successful Acquire is matched by a
-// Release of the same n. Satisfied by the proxy's capture budget, so AppSec and
-// the middleware body tap draw down one pool rather than two independent ones.
-type Budget interface {
-	Acquire(n int64) bool
-	Release(n int64)
-}
-
-// Client mirrors HTTP requests to a CrowdSec AppSec endpoint. It holds no
-// per-service state and is safe for concurrent use.
-type Client struct {
-	url          string
-	apiKey       string
-	maxBodyBytes int64
-	// sem bounds in-flight inspections. Nil when the bound is disabled.
-	sem    chan struct{}
-	budget Budget
-	http   *http.Client
-	logger *log.Entry
-}
-
-// New validates the config and returns a Client. The endpoint is not contacted
-// here: the engine may come up after the proxy.
-func New(cfg Config) (*Client, error) {
-	if cfg.URL == "" {
-		return nil, errors.New("appsec url is empty")
-	}
-	if cfg.APIKey == "" {
-		return nil, errors.New("appsec api key is empty")
-	}
-	parsed, err := url.Parse(cfg.URL)
-	if err != nil {
-		return nil, fmt.Errorf("parse appsec url: %w", err)
-	}
-	if parsed.Scheme != "http" && parsed.Scheme != "https" {
-		return nil, fmt.Errorf("appsec url scheme %q is not http(s)", parsed.Scheme)
-	}
-	if parsed.Host == "" {
-		return nil, errors.New("appsec url has no host")
-	}
-
-	logger := cfg.Logger
-	if logger == nil {
-		logger = log.NewEntry(log.StandardLogger())
-	}
-
-	timeout := cfg.Timeout
-	switch {
-	case timeout <= 0:
-		timeout = DefaultTimeout
-	case timeout < MinTimeout:
-		logger.Warnf("appsec timeout %s is below the minimum, using %s", timeout, MinTimeout)
-		timeout = MinTimeout
-	case timeout > MaxTimeout:
-		logger.Warnf("appsec timeout %s exceeds the maximum, using %s", timeout, MaxTimeout)
-		timeout = MaxTimeout
-	}
-
-	// A negative cap is meaningful: forward no body at all.
-	maxBody := cfg.MaxBodyBytes
-	switch {
-	case maxBody == 0:
-		maxBody = DefaultMaxBodyBytes
-	case maxBody > MaxBodyBytesLimit:
-		logger.Warnf("appsec max body %d exceeds the maximum, using %d", maxBody, MaxBodyBytesLimit)
-		maxBody = MaxBodyBytesLimit
-	}
-
-	maxConcurrent := cfg.MaxConcurrent
-	switch {
-	case maxConcurrent == 0:
-		maxConcurrent = DefaultMaxConcurrent
-	case maxConcurrent > MaxConcurrentLimit:
-		logger.Warnf("appsec max concurrent %d exceeds the maximum, using %d", maxConcurrent, MaxConcurrentLimit)
-		maxConcurrent = MaxConcurrentLimit
-	}
-	var sem chan struct{}
-	if maxConcurrent > 0 {
-		sem = make(chan struct{}, maxConcurrent)
-	}
-
-	return &Client{
-		url:          cfg.URL,
-		apiKey:       cfg.APIKey,
-		maxBodyBytes: maxBody,
-		sem:          sem,
-		budget:       cfg.Budget,
-		logger:       logger,
-		http: &http.Client{
-			Timeout: timeout,
-			Transport: &http.Transport{
-				MaxIdleConns:        100,
-				MaxIdleConnsPerHost: 32,
-				IdleConnTimeout:     90 * time.Second,
-			},
-		},
-	}, nil
-}
-
-// Request is one inspection request.
-type Request struct {
-	// HTTP is the in-flight client request. Inspect buffers and restores its
-	// body, so the request stays forwardable afterwards.
-	HTTP *http.Request
-	// ClientIP is the resolved client address (after trusted-proxy handling).
-	ClientIP netip.Addr
-	// TransactionID correlates the engine's alert with the proxy's access log
-	// entry. Empty lets the engine generate its own UUID.
-	TransactionID string
-	// RedactBodyFields lists form fields whose values are replaced before the
-	// body is mirrored. Used to keep credentials submitted to the proxy's own
-	// login form out of the engine while still inspecting the rest.
-	RedactBodyFields []string
-	// RedactHeaders, RedactCookies and RedactQueryParams name the credentials
-	// the proxy already withholds from backends: the header-auth values, its
-	// session cookie, and the OIDC session token. The engine logs and alerts on
-	// what it inspects, so mirroring them there would reintroduce the leak the
-	// upstream strippers exist to prevent. Only the values are replaced, so the
-	// surrounding headers, cookies and query stay inspectable.
-	RedactHeaders     []string
-	RedactCookies     []string
-	RedactQueryParams []string
-}
-
-// Result is the outcome of an inspection.
-type Result struct {
-	Verdict restrict.Verdict
-	// BodyBypass names why the request body was not mirrored, empty when it
-	// was (or when the request had none). The engine still saw the headers and
-	// URI, so this is a coverage note, not a failure.
-	BodyBypass string
-	// Release returns the buffered body's budget reservation. Never nil, so it
-	// is always safe to defer. It must run only once the request has been
-	// served, not when Inspect returns: the buffer stays alive as r.Body for
-	// the backend to read, so releasing earlier would let the budget admit
-	// buffering that is still resident.
-	Release func()
-}
-
-// noopRelease is the Release for inspections that reserved no budget.
-func noopRelease() {}
-
-// Inspect mirrors r to the AppSec engine and returns its verdict. A nil error
-// with restrict.Allow means the request passed. On failure it returns
-// DenyAppSecUnavailable wrapped with ErrUnavailable; the caller decides whether
-// that blocks, based on the per-service mode.
-func (c *Client) Inspect(ctx context.Context, req Request) (Result, error) {
-	if c == nil {
-		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: noopRelease}, ErrUnavailable
-	}
-	if req.HTTP == nil {
-		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: noopRelease}, fmt.Errorf("%w: nil request", ErrUnavailable)
-	}
-
-	// release is carried out to the caller rather than deferred here: the
-	// buffered body outlives this call as r.Body.
-	if !c.acquireSlot() {
-		// Deny rather than wave through: a flood must not be a way to switch
-		// inspection off. Enforce blocks, observe logs and allows, exactly as
-		// for an unreachable engine.
-		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: noopRelease},
-			fmt.Errorf("%w: %d inspections already in flight", ErrUnavailable, cap(c.sem))
-	}
-	defer c.releaseSlot()
-
-	body, bypass, release, err := c.readBody(req)
-	if err != nil {
-		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: release}, fmt.Errorf("%w: read body: %w", ErrUnavailable, err)
-	}
-
-	outbound, err := c.buildRequest(ctx, req, body)
-	if err != nil {
-		return Result{Verdict: restrict.DenyAppSecUnavailable, BodyBypass: bypass, Release: release}, fmt.Errorf("%w: %w", ErrUnavailable, err)
-	}
-
-	resp, err := c.http.Do(outbound)
-	if err != nil {
-		return Result{Verdict: restrict.DenyAppSecUnavailable, BodyBypass: bypass, Release: release}, fmt.Errorf("%w: %w", ErrUnavailable, err)
-	}
-	defer func() {
-		// Drain before closing. net/http only returns a connection to the idle
-		// pool once its body is read to EOF; closing with bytes outstanding
-		// discards it. Every verdict carries a JSON body, so skipping this
-		// would cost a fresh handshake per inspected request, inside the
-		// timeout budget.
-		if _, err := io.Copy(io.Discard, io.LimitReader(resp.Body, maxResponseBytes)); err != nil {
-			c.logger.Tracef("drain appsec response body: %v", err)
-		}
-		if err := resp.Body.Close(); err != nil {
-			c.logger.Tracef("close appsec response body: %v", err)
-		}
-	}()
-
-	verdict, err := c.verdict(resp)
-	return Result{Verdict: verdict, BodyBypass: bypass, Release: release}, err
-}
-
-// acquireSlot takes an in-flight slot without blocking, reporting false when
-// the engine is already at capacity.
-func (c *Client) acquireSlot() bool {
-	if c.sem == nil {
-		return true
-	}
-	select {
-	case c.sem <- struct{}{}:
-		return true
-	default:
-		return false
-	}
-}
-
-// releaseSlot returns the slot. Scoped to the engine call, not the request: the
-// buffered body outlives the call but the engine's attention does not.
-func (c *Client) releaseSlot() {
-	if c.sem == nil {
-		return
-	}
-	select {
-	case <-c.sem:
-	default:
-	}
-}
-
-// readBody buffers the body so it can be mirrored, always restoring it on the
-// original request. Returns nil when there is no body to forward: no body at
-// all, an upgrade request, or a body over the cap. A login form is forwarded
-// with its credential values redacted rather than suppressed.
-// release is never nil; the caller invokes it once the request has been served.
-func (c *Client) readBody(req Request) (body []byte, bypass string, release func(), err error) {
-	r := req.HTTP
-	if r.Body == nil || r.Body == http.NoBody {
-		return nil, "", noopRelease, nil
-	}
-	if c.maxBodyBytes < 0 {
-		return nil, BypassDisabled, noopRelease, nil
-	}
-	// A genuine upgrade request carries no body to inspect (net/http hands us
-	// http.NoBody, caught above); the hijacked stream is reached through
-	// Hijacker, never r.Body. The test has to be the forwarder's own, because a
-	// looser one would skip inspection for requests the forwarder still
-	// delivers to the backend with their body intact.
-	if netutil.IsUpgradeRequest(r.Header) {
-		return nil, BypassUpgrade, noopRelease, nil
-	}
-	// A Content-Length over the cap is known to be too large before reading.
-	if r.ContentLength > c.maxBodyBytes {
-		return nil, BypassOversize, noopRelease, nil
-	}
-
-	// Reserve the whole cap rather than the eventual length: the reservation
-	// has to be made before the body is read, and until then the only bound
-	// known is the cap. Skipping inspection when the pool is drained keeps a
-	// burst of large bodies from being an out-of-memory lever; the bypass is
-	// recorded so the gap in coverage is visible.
-	release = noopRelease
-	if c.budget != nil {
-		if !c.budget.Acquire(c.maxBodyBytes) {
-			c.logger.Debugf("appsec buffer budget exhausted, inspecting headers and URI only")
-			return nil, BypassBudget, noopRelease, nil
-		}
-		var once sync.Once
-		release = func() { once.Do(func() { c.budget.Release(c.maxBodyBytes) }) }
-	}
-
-	buffered, oversize, err := bufferBody(r, c.maxBodyBytes)
-	if err != nil {
-		// bufferBody restored r.Body from the bytes it did read, so the
-		// reservation stays held until the caller releases it.
-		return nil, "", release, err
-	}
-	// An oversize body was only partially read: a truncated prefix changes the
-	// engine's verdict in both directions, so inspect headers and URI only.
-	if oversize {
-		return nil, BypassOversize, release, nil
-	}
-	return redactFormFields(r.Header.Get("Content-Type"), buffered, req.RedactBodyFields), "", release, nil
-}
-
-// buildRequest assembles the mirrored request. Per the protocol it is a GET
-// when there is no body and a POST otherwise; bytes.Reader gives the outbound
-// request an accurate Content-Length, which the engine relies on to read the
-// body at all.
-func (c *Client) buildRequest(ctx context.Context, req Request, body []byte) (*http.Request, error) {
-	method := http.MethodGet
-	var payload io.Reader
-	if len(body) > 0 {
-		method = http.MethodPost
-		payload = bytes.NewReader(body)
-	}
-
-	outbound, err := http.NewRequestWithContext(ctx, method, c.url, payload)
-	if err != nil {
-		return nil, fmt.Errorf("build appsec request: %w", err)
-	}
-
-	r := req.HTTP
-	copyInspectableHeaders(outbound.Header, r.Header)
-	redactSecrets(outbound.Header, req)
-
-	outbound.Header.Set(headerAPIKey, c.apiKey)
-	outbound.Header.Set(headerIP, req.ClientIP.Unmap().String())
-	outbound.Header.Set(headerURI, mirroredURI(r.URL, req.RedactQueryParams))
-	outbound.Header.Set(headerVerb, r.Method)
-	outbound.Header.Set(headerHost, r.Host)
-	if ua := r.UserAgent(); ua != "" {
-		outbound.Header.Set(headerUserAgent, ua)
-	}
-	outbound.Header.Set(headerHTTPVersion, httpVersion(r))
-	if req.TransactionID != "" {
-		outbound.Header.Set(headerTransactionID, req.TransactionID)
-	}
-	return outbound, nil
-}
-
-// verdict maps the engine's response to a restrict.Verdict. 200 is a pass and
-// 401/500 are engine-side failures; every other status carries a remediation in
-// the body. The blocked status code is operator-configurable
-// (blocked_http_code), so the action field decides, not the status.
-func (c *Client) verdict(resp *http.Response) (restrict.Verdict, error) {
-	switch resp.StatusCode {
-	case http.StatusUnauthorized:
-		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: rejected api key", ErrUnavailable)
-	case http.StatusInternalServerError:
-		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: engine error", ErrUnavailable)
-	}
-
-	// Every status, 200 included, has to carry a decodable remediation. Taking a
-	// bare 200 as a pass would mean a URL pointing at anything that answers 200
-	// (a health endpoint, a load balancer's default page) silently allows every
-	// request while the service reports itself as enforcing.
-
-	var decoded struct {
-		Action string `json:"action"`
-	}
-	if err := json.NewDecoder(io.LimitReader(resp.Body, maxResponseBytes)).Decode(&decoded); err != nil {
-		// Every remediation carries a decodable action, so a response without
-		// one is not a verdict: most often the URL points at something that is
-		// not the AppSec endpoint, which answers 404 with HTML. Reported as
-		// unavailable rather than a ban so the access log names the real fault
-		// instead of sending an operator hunting for a rule that never fired.
-		// Enforce still blocks either way; only the recorded reason differs.
-		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: undecodable response (status %d): %w", ErrUnavailable, resp.StatusCode, err)
-	}
-
-	switch decoded.Action {
-	case actionAllow:
-		return restrict.Allow, nil
-	case actionCaptcha:
-		return restrict.DenyAppSecCaptcha, nil
-	case actionBan:
-		return restrict.DenyAppSecBan, nil
-	case "":
-		// Decodable JSON without a remediation is not a verdict either: the
-		// endpoint answered, but not as the engine. Same reasoning as an
-		// undecodable body, and the same reason to point at configuration.
-		return restrict.DenyAppSecUnavailable,
-			fmt.Errorf("%w: response carried no remediation (status %d)", ErrUnavailable, resp.StatusCode)
-	default:
-		// A remediation we do not implement still means the engine flagged the
-		// request, so deny.
-		c.logger.Debugf("unknown appsec action %q (status %d), treating as ban", decoded.Action, resp.StatusCode)
-		return restrict.DenyAppSecBan, nil
-	}
-}
-
-// copyInspectableHeaders copies the client's headers, which are what the WAF
-// rules actually match on, dropping hop-by-hop headers that describe the
-// proxy-to-engine connection rather than the client request, and any header in
-// the AppSec protocol namespace.
-func copyInspectableHeaders(dst, src http.Header) {
-	for name, values := range src {
-		if hopByHopHeaders[http.CanonicalHeaderKey(name)] {
-			continue
-		}
-		if strings.HasPrefix(http.CanonicalHeaderKey(name), headerPrefix) {
-			continue
-		}
-		dst[http.CanonicalHeaderKey(name)] = append([]string(nil), values...)
-	}
-	// Content-Length describes the mirrored payload, not the client's: net/http
-	// sets it from the body we actually attach. Content-Type is kept either way
-	// so rules matching on it still fire when the body was not forwarded.
-	dst.Del("Content-Length")
-}
-
-// redactSecrets replaces the credential values the proxy withholds from
-// backends, so the mirrored copy does not carry them either.
-func redactSecrets(dst http.Header, req Request) {
-	for _, name := range req.RedactHeaders {
-		// Presence, not Get: a header whose first value is empty still carries
-		// its later values to the engine, while the upstream strip deletes the
-		// name outright. Set collapses every value into the placeholder.
-		if len(dst.Values(name)) > 0 {
-			dst.Set(name, redactedPlaceholder)
-		}
-	}
-	// Every Cookie line, not just the first: a client may send several, and Get
-	// would leave the session cookie in any later one mirrored in the clear.
-	if cookies := dst.Values("Cookie"); len(cookies) > 0 {
-		redacted := make([]string, len(cookies))
-		for i, cookie := range cookies {
-			redacted[i] = redactCookieHeader(cookie, req.RedactCookies)
-		}
-		dst["Cookie"] = redacted
-	}
-}
-
-// mirroredURI renders the request target for the URI header, with the named
-// query parameter values replaced.
-func mirroredURI(u *url.URL, redactParams []string) string {
-	uri := u.RequestURI()
-	if u.RawQuery == "" || len(redactParams) == 0 {
-		return uri
-	}
-	redacted := redactQuery(u.RawQuery, redactParams)
-	if redacted == u.RawQuery {
-		return uri
-	}
-	// RequestURI is path + "?" + RawQuery; swap only the query part so the
-	// path keeps its original encoding.
-	return strings.TrimSuffix(uri, u.RawQuery) + redacted
-}
-
-var hopByHopHeaders = map[string]bool{
-	"Connection":          true,
-	"Keep-Alive":          true,
-	"Proxy-Authenticate":  true,
-	"Proxy-Authorization": true,
-	"Proxy-Connection":    true,
-	"Te":                  true,
-	"Trailer":             true,
-	"Transfer-Encoding":   true,
-	"Upgrade":             true,
-}
-
-// httpVersion renders the two-digit form the engine parses ("11", "20").
-func httpVersion(r *http.Request) string {
-	major, minor := r.ProtoMajor, r.ProtoMinor
-	if major < 0 || major > 9 || minor < 0 || minor > 9 {
-		return ""
-	}
-	return fmt.Sprintf("%d%d", major, minor)
-}

proxy/internal/auth/appsec_test.go

@@ -1,306 +0,0 @@
-package auth
-
-import (
-	"crypto/ed25519"
-	"encoding/base64"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/proxy/internal/appsec"
-	"github.com/netbirdio/netbird/proxy/internal/proxy"
-	"github.com/netbirdio/netbird/proxy/internal/restrict"
-	"github.com/netbirdio/netbird/proxy/internal/types"
-)
-
-// appsecEngine is a stub AppSec component returning a fixed remediation.
-func appsecEngine(t *testing.T, status int, body string) *httptest.Server {
-	t.Helper()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(status)
-		if body != "" {
-			_, _ = w.Write([]byte(body))
-		}
-	}))
-	t.Cleanup(srv.Close)
-	return srv
-}
-
-// serveWithAppSec runs a request through the middleware for a domain configured
-// with the given AppSec mode, returning the response and the captured metadata.
-func serveWithAppSec(t *testing.T, mode restrict.AppSecMode, client *appsec.Client, r *http.Request) (*httptest.ResponseRecorder, map[string]string, bool) {
-	t.Helper()
-
-	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	mw.SetAppSec(client)
-	require.NoError(t, mw.AddDomain("svc.example.com", DomainSettings{
-		AccountID:  types.AccountID("acct-1"),
-		ServiceID:  types.ServiceID("svc-1"),
-		AppSecMode: mode,
-	}))
-
-	reached := false
-	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		reached = true
-		w.WriteHeader(http.StatusOK)
-	}))
-
-	cd := proxy.NewCapturedData("req-1")
-	r = r.WithContext(proxy.WithCapturedData(r.Context(), cd))
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, r)
-
-	return rec, cd.GetMetadata(), reached
-}
-
-func appsecRequest() *http.Request {
-	r := httptest.NewRequest(http.MethodGet, "http://svc.example.com/?x=/etc/passwd", nil)
-	r.Host = "svc.example.com"
-	r.RemoteAddr = "203.0.113.7:44444"
-	return r
-}
-
-func TestCheckAppSec_EnforceBlocksBannedRequest(t *testing.T) {
-	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban","http_status":403}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
-
-	assert.Equal(t, http.StatusForbidden, rec.Code)
-	assert.False(t, reached, "a banned request must not reach the backend")
-	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
-	assert.NotContains(t, meta, "appsec_mode", "enforce is the default, only observe is annotated")
-}
-
-func TestCheckAppSec_ObserveAllowsAndRecordsVerdict(t *testing.T) {
-	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban","http_status":403}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecObserve, client, appsecRequest())
-
-	assert.Equal(t, http.StatusOK, rec.Code)
-	assert.True(t, reached, "observe mode must not block")
-	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
-	assert.Equal(t, "observe", meta["appsec_mode"])
-}
-
-func TestCheckAppSec_AllowedRequestPasses(t *testing.T) {
-	srv := appsecEngine(t, http.StatusOK, `{"action":"allow","http_status":200}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
-
-	assert.Equal(t, http.StatusOK, rec.Code)
-	assert.True(t, reached)
-	assert.NotContains(t, meta, "appsec_verdict", "a clean request records no verdict")
-}
-
-func TestCheckAppSec_OffSkipsInspection(t *testing.T) {
-	// An engine that would ban everything; the mode must keep us away from it.
-	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecOff, client, appsecRequest())
-
-	assert.Equal(t, http.StatusOK, rec.Code)
-	assert.True(t, reached)
-	assert.Empty(t, meta)
-}
-
-func TestCheckAppSec_EnforceFailsClosedWithoutClient(t *testing.T) {
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, nil, appsecRequest())
-
-	assert.Equal(t, http.StatusForbidden, rec.Code,
-		"enforce with no configured endpoint must deny rather than pass traffic uninspected")
-	assert.False(t, reached)
-	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
-}
-
-func TestCheckAppSec_ObserveAllowsWithoutClient(t *testing.T) {
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecObserve, nil, appsecRequest())
-
-	assert.Equal(t, http.StatusOK, rec.Code)
-	assert.True(t, reached)
-	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
-	assert.Equal(t, "observe", meta["appsec_mode"])
-}
-
-func TestCheckAppSec_EnforceFailsClosedWhenEngineUnreachable(t *testing.T) {
-	client, err := appsec.New(appsec.Config{URL: "http://127.0.0.1:1/", APIKey: "k"})
-	require.NoError(t, err)
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
-
-	assert.Equal(t, http.StatusForbidden, rec.Code)
-	assert.False(t, reached)
-	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
-}
-
-func TestCheckAppSec_InspectsOverlayTraffic(t *testing.T) {
-	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	// Requests arriving over the WireGuard overlay skip the geo and IP-reputation
-	// checks, but request content is just as inspectable.
-	r := appsecRequest()
-	r = r.WithContext(types.WithOverlayOrigin(r.Context()))
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
-
-	assert.Equal(t, http.StatusForbidden, rec.Code, "overlay traffic must still be inspected")
-	assert.False(t, reached)
-	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
-}
-
-func TestCheckAppSec_UnresolvableClientIPFailsClosed(t *testing.T) {
-	srv := appsecEngine(t, http.StatusOK, `{"action":"allow"}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	r := appsecRequest()
-	r.RemoteAddr = "not-an-address"
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
-
-	assert.Equal(t, http.StatusForbidden, rec.Code,
-		"the engine requires a client address; a request we cannot attribute must not pass")
-	assert.False(t, reached)
-	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
-}
-
-// The redaction sets are resolved from the domain's schemes at registration, so
-// what AppSec withholds cannot drift from what those schemes actually accept.
-func TestAddDomain_ResolvesRedactionSetsFromSchemes(t *testing.T) {
-	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	require.NoError(t, mw.AddDomain("svc.example.com", DomainSettings{
-		Schemes: []Scheme{
-			NewPassword(nil, "svc-1", "acct-1"),
-			NewHeader(nil, "svc-1", "acct-1", "X-Api-Key"),
-		},
-		SessionPublicKey:  base64.StdEncoding.EncodeToString(make([]byte, ed25519.PublicKeySize)),
-		SessionExpiration: time.Hour,
-		AppSecMode:        restrict.AppSecEnforce,
-	}))
-
-	mw.domainsMux.RLock()
-	config := mw.domains["svc.example.com"]
-	mw.domainsMux.RUnlock()
-
-	assert.Equal(t, []string{"password"}, config.redactBodyFields)
-	assert.Equal(t, []string{"X-Api-Key"}, config.redactHeaders)
-	// r.FormValue merges the query into the form, so a credential passed there
-	// authenticates and must be redacted alongside the OIDC session token.
-	assert.Equal(t, []string{"session_token", "password"}, config.redactQueryParams)
-}
-
-// countingBudget records reservations so a test can observe when the
-// middleware hands them back.
-type countingBudget struct {
-	mu        sync.Mutex
-	total     int64
-	used      int64
-	maxAtOnce int64
-}
-
-func (b *countingBudget) Acquire(n int64) bool {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	if b.used+n > b.total {
-		return false
-	}
-	b.used += n
-	if b.used > b.maxAtOnce {
-		b.maxAtOnce = b.used
-	}
-	return true
-}
-
-func (b *countingBudget) Release(n int64) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	b.used -= n
-}
-
-func (b *countingBudget) inUse() int64 {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return b.used
-}
-
-// The buffered body stays alive as r.Body until the backend has read it, so
-// Protect must hold the reservation for the whole request and return it only
-// once the handler chain has unwound. Releasing inside Inspect would let the
-// budget admit buffering that is still resident.
-func TestProtect_AppSecBudgetHeldForRequestAndReleasedAfter(t *testing.T) {
-	srv := appsecEngine(t, http.StatusOK, `{"action":"allow"}`)
-	budget := &countingBudget{total: 1 << 20}
-	client, err := appsec.New(appsec.Config{
-		URL:          srv.URL,
-		APIKey:       "k",
-		MaxBodyBytes: 4096,
-		Budget:       budget,
-	})
-	require.NoError(t, err)
-
-	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	mw.SetAppSec(client)
-	require.NoError(t, mw.AddDomain("svc.example.com", DomainSettings{
-		AccountID:  types.AccountID("acct-1"),
-		ServiceID:  types.ServiceID("svc-1"),
-		AppSecMode: restrict.AppSecEnforce,
-	}))
-
-	var inHandler int64
-	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// The backend reads the buffered body here, so the reservation must
-		// still be held at this point.
-		inHandler = budget.inUse()
-		_, _ = io.ReadAll(r.Body)
-		w.WriteHeader(http.StatusOK)
-	}))
-
-	r := httptest.NewRequest(http.MethodPost, "http://svc.example.com/", strings.NewReader("payload"))
-	r.Host = "svc.example.com"
-	cd := proxy.NewCapturedData("req-1")
-	r = r.WithContext(proxy.WithCapturedData(r.Context(), cd))
-
-	handler.ServeHTTP(httptest.NewRecorder(), r)
-
-	assert.Equal(t, int64(4096), inHandler, "the reservation must be held while the backend reads the body")
-	assert.Equal(t, int64(0), budget.inUse(), "Protect must release the reservation once the request is served")
-}
-
-// A denied request never reaches the backend, but Protect still has to hand the
-// reservation back or the pool leaks one cap per blocked request.
-func TestProtect_AppSecBudgetReleasedOnDeny(t *testing.T) {
-	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
-	budget := &countingBudget{total: 1 << 20}
-	client, err := appsec.New(appsec.Config{
-		URL:          srv.URL,
-		APIKey:       "k",
-		MaxBodyBytes: 4096,
-		Budget:       budget,
-	})
-	require.NoError(t, err)
-
-	r := httptest.NewRequest(http.MethodPost, "http://svc.example.com/", strings.NewReader("payload"))
-	r.Host = "svc.example.com"
-	rec, _, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
-
-	assert.False(t, reached, "a banned request must not reach the backend")
-	assert.Equal(t, http.StatusForbidden, rec.Code)
-	assert.Equal(t, int64(0), budget.inUse(), "a blocked request must not leak its reservation")
-}

proxy/internal/auth/header.go

@@ -39,11 +39,6 @@ func (Header) Type() auth.Method {
 	return auth.MethodHeader
 }
 
-// HeaderName returns the request header this scheme reads its credential from.
-func (h Header) HeaderName() string {
-	return h.headerName
-}
-
 // Authenticate checks for the configured header in the request. If absent,
 // returns empty (unauthenticated). If present, validates via gRPC.
 func (h Header) Authenticate(r *http.Request) (string, string, error) {

proxy/internal/auth/middleware.go

@@ -18,7 +18,6 @@ import (
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/proxy/auth"
-	"github.com/netbirdio/netbird/proxy/internal/appsec"
 	"github.com/netbirdio/netbird/proxy/internal/proxy"
 	"github.com/netbirdio/netbird/proxy/internal/restrict"
 	"github.com/netbirdio/netbird/proxy/internal/types"
@@ -26,11 +25,6 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-// sessionCookieNames is the cookie set AppSec redacts before mirroring: the
-// proxy's session cookie is a bearer credential for the service, and the
-// reverse proxy already strips it before forwarding upstream.
-var sessionCookieNames = []string{auth.SessionCookieName}
-
 // errValidationUnavailable indicates that session validation failed due to
 // an infrastructure error (e.g. gRPC unavailable), not an invalid token.
 var errValidationUnavailable = errors.New("session validation unavailable")
@@ -65,14 +59,6 @@ type DomainConfig struct {
 	IPRestrictions    *restrict.Filter
 	// Private routes the domain through ValidateTunnelPeer; failure → 403.
 	Private bool
-	// AppSecMode enables CrowdSec AppSec request inspection for this domain.
-	AppSecMode restrict.AppSecMode
-	// redact* name the credentials this domain's schemes accept, resolved once
-	// at registration. AppSec replaces their values before mirroring a request,
-	// matching what the reverse proxy strips before forwarding upstream.
-	redactBodyFields  []string
-	redactHeaders     []string
-	redactQueryParams []string
 }
 
 type validationResult struct {
@@ -96,9 +82,6 @@ type Middleware struct {
 	sessionValidator SessionValidator
 	geo              restrict.GeoResolver
 	tunnelCache      *tunnelValidationCache
-	// appsec is the shared CrowdSec AppSec client, nil when the proxy has no
-	// AppSec endpoint configured. Set once during startup, before serving.
-	appsec *appsec.Client
 }
 
 // NewMiddleware creates a new authentication middleware. The sessionValidator is
@@ -116,12 +99,6 @@ func NewMiddleware(logger *log.Logger, sessionValidator SessionValidator, geo re
 	}
 }
 
-// SetAppSec installs the shared CrowdSec AppSec client. Must be called during
-// startup, before the middleware serves any request.
-func (mw *Middleware) SetAppSec(client *appsec.Client) {
-	mw.appsec = client
-}
-
 // Protect wraps next with per-domain authentication and IP restriction checks.
 // Requests whose Host is not registered pass through unchanged.
 func (mw *Middleware) Protect(next http.Handler) http.Handler {
@@ -146,14 +123,6 @@ func (mw *Middleware) Protect(next http.Handler) http.Handler {
 			return
 		}
 
-		// Deferred, not released here: the inspected body stays alive as r.Body
-		// until the backend has read it, which happens inside next.ServeHTTP.
-		appSecAllowed, releaseAppSec := mw.checkAppSec(w, r, config)
-		defer releaseAppSec()
-		if !appSecAllowed {
-			return
-		}
-
 		// Private services bypass operator schemes and gate on tunnel peer.
 		if config.Private {
 			if mw.forwardWithTunnelPeer(w, r, host, config, next) {
@@ -293,134 +262,6 @@ func (mw *Middleware) checkIPRestrictions(w http.ResponseWriter, r *http.Request
 	return false
 }
 
-// checkAppSec mirrors the request to the CrowdSec AppSec engine when the domain
-// enables inspection. Returns false when the request was blocked and a response
-// has been written.
-//
-// The returned release frees the body-buffering budget the inspection reserved
-// and is never nil. It must run only after the request has been served, since
-// the buffered body stays alive as r.Body for the backend to read.
-//
-// Every non-allow remediation blocks with 403, captcha included: the proxy has
-// no challenge flow to serve. The distinct verdict is still recorded so the
-// access log shows which remediation the engine actually chose.
-//
-// Unlike the geo and IP-reputation checks, this runs for overlay traffic too:
-// AppSec inspects request content, which is just as meaningful when the caller
-// reached the proxy through the WireGuard tunnel.
-func (mw *Middleware) checkAppSec(w http.ResponseWriter, r *http.Request, config DomainConfig) (bool, func()) {
-	if !config.AppSecMode.Enabled() {
-		return true, func() {}
-	}
-
-	verdict, release := mw.inspectAppSec(r, config)
-	if verdict == restrict.Allow {
-		return true, release
-	}
-
-	observe := config.AppSecMode == restrict.AppSecObserve
-	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
-		cd.SetMetadata("appsec_verdict", verdict.String())
-		if observe {
-			cd.SetMetadata("appsec_mode", "observe")
-		}
-	}
-
-	if observe {
-		mw.logger.Debugf("AppSec observe: would block %s for %s (%s)", r.RemoteAddr, r.Host, verdict)
-		return true, release
-	}
-
-	mw.markDenied(r, verdict.String())
-	mw.logger.Debugf("AppSec: %s for %s %s", verdict, r.Host, r.RemoteAddr)
-	http.Error(w, "Forbidden", http.StatusForbidden)
-	return false, release
-}
-
-// inspectAppSec runs the AppSec call and returns its verdict. Failures come
-// back as DenyAppSecUnavailable regardless of mode so observe mode still
-// records that inspection did not happen; the caller decides what blocks. The
-// returned release is never nil.
-func (mw *Middleware) inspectAppSec(r *http.Request, config DomainConfig) (restrict.Verdict, func()) {
-	// Mode requested but the proxy has no AppSec endpoint configured. Management
-	// gates this on the cluster capability; a stale mapping can still arrive.
-	if mw.appsec == nil {
-		mw.logger.Debugf("AppSec mode %q requested for %s but no AppSec endpoint is configured", config.AppSecMode, r.Host)
-		return restrict.DenyAppSecUnavailable, func() {}
-	}
-
-	clientIP := mw.resolveClientIP(r)
-	if !clientIP.IsValid() {
-		// The engine requires a client address, and a request whose source we
-		// cannot establish is exactly the kind we must not wave through.
-		mw.logger.Debugf("AppSec: cannot resolve client address for %q", r.RemoteAddr)
-		return restrict.DenyAppSecUnavailable, func() {}
-	}
-
-	req := appsec.Request{
-		HTTP:              r,
-		ClientIP:          clientIP,
-		RedactBodyFields:  config.redactBodyFields,
-		RedactHeaders:     config.redactHeaders,
-		RedactCookies:     sessionCookieNames,
-		RedactQueryParams: config.redactQueryParams,
-	}
-	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
-		req.TransactionID = cd.GetRequestID()
-	}
-
-	result, err := mw.appsec.Inspect(r.Context(), req)
-	if err != nil {
-		mw.logger.Debugf("AppSec inspection failed for %s: %v", r.Host, err)
-	}
-	// Record when the body went uninspected: headers and URI were still
-	// checked, but an operator reading the log should not read a clean verdict
-	// as "the payload was examined". Oversize is reachable by padding, so its
-	// absence from the log would hide a deliberate opt-out.
-	if result.BodyBypass != "" {
-		if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
-			cd.SetMetadata("appsec_body_bypass", result.BodyBypass)
-		}
-	}
-	return result.Verdict, result.Release
-}
-
-// credentialFormFields lists the login form fields whose values are redacted
-// from the mirrored body, so a password or PIN submitted to the proxy's own
-// login form never reaches the Security Engine.
-func credentialFormFields(schemes []Scheme) []string {
-	var fields []string
-	for _, s := range schemes {
-		switch s.Type() {
-		case auth.MethodPassword:
-			fields = append(fields, passwordFormId)
-		case auth.MethodPIN:
-			fields = append(fields, pinFormId)
-		}
-	}
-	return fields
-}
-
-// credentialHeaders lists the request headers whose values are redacted from
-// the mirrored request. A header-auth scheme carries a session token the proxy
-// validates and never forwards upstream, so the engine must not see it either.
-func credentialHeaders(schemes []Scheme) []string {
-	var names []string
-	for _, s := range schemes {
-		// Structural, not a concrete Header assertion: if the scheme is ever
-		// registered as a pointer, a type assertion would quietly stop matching
-		// and the header would start reaching the engine again.
-		named, ok := s.(interface{ HeaderName() string })
-		if !ok {
-			continue
-		}
-		if name := named.HeaderName(); name != "" {
-			names = append(names, name)
-		}
-	}
-	return names
-}
-
 // resolveClientIP extracts the real client IP from CapturedData, falling back to r.RemoteAddr.
 func (mw *Middleware) resolveClientIP(r *http.Request) netip.Addr {
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
@@ -440,18 +281,12 @@ func (mw *Middleware) resolveClientIP(r *http.Request) netip.Addr {
 	return addr.Unmap()
 }
 
-// markDenied records the deny reason on the captured data so the access log
-// attributes the response to the proxy rather than the backend.
-func (mw *Middleware) markDenied(r *http.Request, reason string) {
+// blockIPRestriction sets captured data fields for an IP-restriction block event.
+func (mw *Middleware) blockIPRestriction(r *http.Request, reason string) {
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
 		cd.SetOrigin(proxy.OriginAuth)
 		cd.SetAuthMethod(reason)
 	}
-}
-
-// blockIPRestriction sets captured data fields for an IP-restriction block event.
-func (mw *Middleware) blockIPRestriction(r *http.Request, reason string) {
-	mw.markDenied(r, reason)
 	mw.logger.Debugf("IP restriction: %s for %s", reason, r.RemoteAddr)
 }
 
@@ -802,61 +637,45 @@ func wasCredentialSubmitted(r *http.Request, method auth.Method) bool {
 	case auth.MethodPassword:
 		return r.FormValue("password") != ""
 	case auth.MethodOIDC:
-		return r.URL.Query().Get(sessionTokenParam) != ""
+		return r.URL.Query().Get("session_token") != ""
 	}
 	return false
 }
 
-// DomainSettings is the per-domain configuration AddDomain applies.
-type DomainSettings struct {
-	Schemes []Scheme
-	// SessionPublicKey is the base64-encoded ed25519 key used to verify session
-	// cookies. Required when Schemes is non-empty.
-	SessionPublicKey  string
-	SessionExpiration time.Duration
-	AccountID         types.AccountID
-	ServiceID         types.ServiceID
-	IPRestrictions    *restrict.Filter
-	// Private forces ValidateTunnelPeer enforcement (403 on failure) regardless
-	// of the schemes list.
-	Private    bool
-	AppSecMode restrict.AppSecMode
-}
-
-// AddDomain registers authentication schemes for the given domain. With schemes
-// a valid session public key is required.
-func (mw *Middleware) AddDomain(domain string, settings DomainSettings) error {
-	credentialFields := credentialFormFields(settings.Schemes)
-	config := DomainConfig{
-		AccountID:        settings.AccountID,
-		ServiceID:        settings.ServiceID,
-		IPRestrictions:   settings.IPRestrictions,
-		Private:          settings.Private,
-		AppSecMode:       settings.AppSecMode,
-		redactBodyFields: credentialFields,
-		redactHeaders:    credentialHeaders(settings.Schemes),
-		// A credential can arrive in the query too: r.FormValue merges the URL
-		// query into the form, so "?password=..." authenticates just as a form
-		// post does and must not be mirrored in the clear either.
-		redactQueryParams: append([]string{sessionTokenParam}, credentialFields...),
+// AddDomain registers authentication schemes for the given domain. With schemes a valid session public key is required.
+// private=true forces ValidateTunnelPeer enforcement (403 on failure) regardless of the schemes list.
+func (mw *Middleware) AddDomain(domain string, schemes []Scheme, publicKeyB64 string, expiration time.Duration, accountID types.AccountID, serviceID types.ServiceID, ipRestrictions *restrict.Filter, private bool) error {
+	if len(schemes) == 0 {
+		mw.domainsMux.Lock()
+		defer mw.domainsMux.Unlock()
+		mw.domains[domain] = DomainConfig{
+			AccountID:      accountID,
+			ServiceID:      serviceID,
+			IPRestrictions: ipRestrictions,
+			Private:        private,
+		}
+		return nil
 	}
 
-	if len(settings.Schemes) > 0 {
-		pubKeyBytes, err := base64.StdEncoding.DecodeString(settings.SessionPublicKey)
-		if err != nil {
-			return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
-		}
-		if len(pubKeyBytes) != ed25519.PublicKeySize {
-			return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
-		}
-		config.Schemes = settings.Schemes
-		config.SessionPublicKey = pubKeyBytes
-		config.SessionExpiration = settings.SessionExpiration
+	pubKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyB64)
+	if err != nil {
+		return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
+	}
+	if len(pubKeyBytes) != ed25519.PublicKeySize {
+		return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
 	}
 
 	mw.domainsMux.Lock()
 	defer mw.domainsMux.Unlock()
-	mw.domains[domain] = config
+	mw.domains[domain] = DomainConfig{
+		Schemes:           schemes,
+		SessionPublicKey:  pubKeyBytes,
+		SessionExpiration: expiration,
+		AccountID:         accountID,
+		ServiceID:         serviceID,
+		IPRestrictions:    ipRestrictions,
+		Private:           private,
+	}
 	return nil
 }
 
@@ -911,10 +730,10 @@ func (mw *Middleware) validateSessionToken(ctx context.Context, host, token stri
 // parameter removed so it doesn't linger in the browser's address bar or history.
 func stripSessionTokenParam(u *url.URL) string {
 	q := u.Query()
-	if !q.Has(sessionTokenParam) {
+	if !q.Has("session_token") {
 		return u.RequestURI()
 	}
-	q.Del(sessionTokenParam)
+	q.Del("session_token")
 	clean := *u
 	clean.RawQuery = q.Encode()
 	return clean.RequestURI()

proxy/internal/auth/middleware_test.go

@@ -64,7 +64,7 @@ func TestAddDomain_ValidKey(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false)
 	require.NoError(t, err)
 
 	mw.domainsMux.RLock()
@@ -81,7 +81,7 @@ func TestAddDomain_EmptyKey(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", []Scheme{scheme}, "", time.Hour, "", "", nil, false)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -95,7 +95,7 @@ func TestAddDomain_InvalidBase64(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: "not-valid-base64!!!", SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", []Scheme{scheme}, "not-valid-base64!!!", time.Hour, "", "", nil, false)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "decode session public key")
 
@@ -110,7 +110,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 
 	shortKey := base64.StdEncoding.EncodeToString([]byte("tooshort"))
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: shortKey, SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", []Scheme{scheme}, shortKey, time.Hour, "", "", nil, false)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -123,7 +123,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 func TestAddDomain_NoSchemes_NoKeyRequired(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false)
 	require.NoError(t, err, "domains with no auth schemes should not require a key")
 
 	mw.domainsMux.RLock()
@@ -139,8 +139,8 @@ func TestAddDomain_OverwritesPreviousConfig(t *testing.T) {
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp1.PublicKey, SessionExpiration: time.Hour}))
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp2.PublicKey, SessionExpiration: 2 * time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp2.PublicKey, 2*time.Hour, "", "", nil, false))
 
 	mw.domainsMux.RLock()
 	config := mw.domains["example.com"]
@@ -156,7 +156,7 @@ func TestRemoveDomain(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	mw.RemoveDomain("example.com")
 
@@ -180,7 +180,7 @@ func TestProtect_UnknownDomainPassesThrough(t *testing.T) {
 
 func TestProtect_DomainWithNoSchemesPassesThrough(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -197,7 +197,7 @@ func TestProtect_UnauthenticatedRequestIsBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -218,7 +218,7 @@ func TestProtect_HostWithPortIsMatched(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -239,7 +239,7 @@ func TestProtect_ValidSessionCookiePassesThrough(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
 	require.NoError(t, err)
@@ -272,7 +272,7 @@ func TestProtect_SessionCookieGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	groups := []string{"engineering", "sre"}
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, groups, nil, time.Hour)
@@ -337,7 +337,7 @@ func TestProtect_PrivateService_TunnelPeerGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	// Private service: no operator schemes — auth gates solely on the tunnel peer.
-	require.NoError(t, mw.AddDomain("agent.example.com", DomainSettings{SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
+	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14")) // CGNAT tunnel source
@@ -377,7 +377,7 @@ func TestProtect_PrivateService_TunnelPeerDenied(t *testing.T) {
 	}}
 	mw := NewMiddleware(log.StandardLogger(), validator, nil)
 	kp := generateTestKeyPair(t)
-	require.NoError(t, mw.AddDomain("agent.example.com", DomainSettings{SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
+	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14"))
@@ -405,7 +405,7 @@ func TestProtect_ExpiredSessionCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	// Sign a token that expired 1 second ago.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, -time.Second)
@@ -431,7 +431,7 @@ func TestProtect_WrongDomainCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	// Token signed for a different domain audience.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "other.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -458,7 +458,7 @@ func TestProtect_WrongKeyCookieIsRejected(t *testing.T) {
 	kp2 := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp1.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
 
 	// Token signed with a different private key.
 	token, err := sessionkey.SignToken(kp2.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -495,7 +495,7 @@ func TestProtect_SchemeAuthRedirectsWithCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -548,7 +548,7 @@ func TestProtect_FailedAuthDoesNotSetCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -584,7 +584,7 @@ func TestProtect_MultipleSchemes(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{pinScheme, passwordScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{pinScheme, passwordScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -614,7 +614,7 @@ func TestProtect_InvalidTokenFromSchemeReturns400(t *testing.T) {
 			return "invalid-jwt-token", "", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -638,7 +638,7 @@ func TestAddDomain_RandomBytes32NotEd25519(t *testing.T) {
 	key := base64.StdEncoding.EncodeToString(randomBytes)
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	err = mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: key, SessionExpiration: time.Hour})
+	err = mw.AddDomain("example.com", []Scheme{scheme}, key, time.Hour, "", "", nil, false)
 	require.NoError(t, err, "any 32-byte key should be accepted at registration time")
 }
 
@@ -647,10 +647,10 @@ func TestAddDomain_InvalidKeyDoesNotCorruptExistingConfig(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	// Attempt to overwrite with an invalid key.
-	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: "bad", SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", []Scheme{scheme}, "bad", time.Hour, "", "", nil, false)
 	require.Error(t, err)
 
 	// The original valid config should still be intact.
@@ -674,7 +674,7 @@ func TestProtect_FailedPinAuthCapturesAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -701,7 +701,7 @@ func TestProtect_FailedPasswordAuthCapturesAuthMethod(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -728,7 +728,7 @@ func TestProtect_NoCredentialsDoesNotCaptureAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -815,7 +815,8 @@ func TestWasCredentialSubmitted(t *testing.T) {
 func TestCheckIPRestrictions_UnparseableAddress(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}})})
+	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}}), false)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -850,7 +851,8 @@ func TestCheckIPRestrictions_UsesCapturedDataClientIP(t *testing.T) {
 	// trusted proxies), checkIPRestrictions should use that IP, not RemoteAddr.
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}})})
+	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}}), false)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -890,7 +892,8 @@ func TestCheckIPRestrictions_NilGeoWithCountryRules(t *testing.T) {
 	// Geo is nil, country restrictions are configured: must deny (fail-close).
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}})})
+	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}}), false)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -913,10 +916,11 @@ func TestCheckIPRestrictions_NilGeoWithCountryRules(t *testing.T) {
 func TestCheckIPRestrictions_OverlayOriginSkipsCountryRules(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{
-		AllowedCIDRs:     []string{"100.64.0.0/10"},
-		AllowedCountries: []string{"US"},
-	})})
+	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
+		restrict.ParseFilter(restrict.FilterConfig{
+			AllowedCIDRs:     []string{"100.64.0.0/10"},
+			AllowedCountries: []string{"US"},
+		}), false)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -949,7 +953,8 @@ func TestCheckIPRestrictions_OverlayOriginSkipsCountryRules(t *testing.T) {
 func TestCheckIPRestrictions_OverlayOriginRespectsCIDR(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}})})
+	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}}), false)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -977,7 +982,7 @@ func TestProtect_OIDCOnlyRedirectsDirectly(t *testing.T) {
 			return "", oidcURL, nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1006,7 +1011,7 @@ func TestProtect_OIDCWithOtherMethodShowsLoginPage(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{oidcScheme, pinScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{oidcScheme, pinScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1050,7 +1055,7 @@ func TestProtect_HeaderAuth_ForwardsOnSuccess(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	var backendCalled bool
 	capturedData := proxy.NewCapturedData("")
@@ -1093,7 +1098,7 @@ func TestProtect_HeaderAuth_MissingHeaderFallsThrough(t *testing.T) {
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
 	// Also add a PIN scheme so we can verify fallthrough behavior.
 	pinScheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr, pinScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr, pinScheme}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1113,7 +1118,7 @@ func TestProtect_HeaderAuth_WrongValueReturns401(t *testing.T) {
 		return &proto.AuthenticateResponse{Success: false}, nil
 	}}
 	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -1136,7 +1141,7 @@ func TestProtect_HeaderAuth_InfraErrorReturns502(t *testing.T) {
 		return nil, errors.New("gRPC unavailable")
 	}}
 	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1153,7 +1158,7 @@ func TestProtect_HeaderAuth_SubsequentRequestUsesSessionCookie(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
@@ -1213,7 +1218,7 @@ func TestProtect_HeaderAuth_MultipleValuesSameHeader(t *testing.T) {
 
 	// Single Header scheme (as if one entry existed), but the mock checks both values.
 	hdr := NewHeader(mock, "svc1", "acc1", "Authorization")
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	var backendCalled bool
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -1271,7 +1276,7 @@ func TestProtect_OIDCOnPlainHTTP_BlockedWith400(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1295,7 +1300,7 @@ func TestProtect_OIDCOverTLS_NotBlocked(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1315,7 +1320,7 @@ func TestProtect_NonOIDCSchemes_PlainHTTP_NotBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1345,7 +1350,7 @@ func TestProtect_TunnelPeerFastPath_RequiresInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1380,7 +1385,7 @@ func TestProtect_TunnelPeerFastPath_TakesPathWithInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 

proxy/internal/auth/oidc.go

@@ -13,10 +13,6 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-// sessionTokenParam is the query parameter the management server uses to hand
-// the minted session token back to the proxy after an OIDC login.
-const sessionTokenParam = "session_token"
-
 type urlGenerator interface {
 	GetOIDCURL(context.Context, *proto.GetOIDCURLRequest, ...grpc.CallOption) (*proto.GetOIDCURLResponse, error)
 }
@@ -47,7 +43,7 @@ func (o OIDC) Authenticate(r *http.Request) (string, string, error) {
 	// Check for the session_token query param (from OIDC redirects).
 	// The management server passes the token in the URL because it cannot set
 	// cookies for the proxy's domain (cookies are domain-scoped per RFC 6265).
-	if token := r.URL.Query().Get(sessionTokenParam); token != "" {
+	if token := r.URL.Query().Get("session_token"); token != "" {
 		return token, "", nil
 	}
 

proxy/internal/auth/tunnel_lookup_test.go

@@ -44,7 +44,7 @@ func (s *stubSessionValidator) ValidateTunnelPeer(_ context.Context, in *proto.V
 func newTunnelMiddleware(t *testing.T, validator SessionValidator) *Middleware {
 	t.Helper()
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("svc.example", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1"}))
+	require.NoError(t, mw.AddDomain("svc.example", nil, "", 0, "acct-1", "svc-1", nil, false))
 	return mw
 }
 
@@ -235,8 +235,8 @@ func TestForwardWithTunnelPeer_RoutesAccountIDIntoCacheKey(t *testing.T) {
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
 
-	require.NoError(t, mw.AddDomain("svc-a.example", DomainSettings{AccountID: "acct-a", ServiceID: "svc-a"}))
-	require.NoError(t, mw.AddDomain("svc-b.example", DomainSettings{AccountID: "acct-b", ServiceID: "svc-b"}))
+	require.NoError(t, mw.AddDomain("svc-a.example", nil, "", 0, "acct-a", "svc-a", nil, false))
+	require.NoError(t, mw.AddDomain("svc-b.example", nil, "", 0, "acct-b", "svc-b", nil, false))
 
 	// The fast-path requires the inbound-listener marker on the context.
 	// The peerstore lookup itself is account-agnostic at this level
@@ -299,7 +299,7 @@ func TestForwardWithTunnelPeer_LocalLookupShortCircuitDoesNotPopulateCache(t *te
 
 func TestPrivateService_FailsClosedOnTunnelPeerFailure(t *testing.T) {
 	mw := NewMiddleware(log.New(), nil, nil)
-	require.NoError(t, mw.AddDomain("private.svc", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
+	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -328,7 +328,7 @@ func TestPrivateService_ForwardsOnTunnelPeerSuccess(t *testing.T) {
 		},
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("private.svc", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
+	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {

proxy/internal/llm/bedrock_model.go

@@ -0,0 +1,38 @@
+package llm
+
+import (
+	"regexp"
+	"strings"
+)
+
+// bedrockRegionPrefixes are the cross-region inference-profile prefixes that
+// front a Bedrock model id (e.g. "eu.anthropic.claude-...").
+var bedrockRegionPrefixes = []string{"us.", "eu.", "apac.", "global."}
+
+// bedrockVersionSuffix matches the trailing "-vN[:N]" or "-YYYYMMDD-vN[:N]"
+// version/throughput suffix of a Bedrock model id.
+var bedrockVersionSuffix = regexp.MustCompile(`-(\d{8}-)?v\d+(:\d+)?$`)
+
+// NormalizeBedrockModel strips an ARN wrapper, a cross-region inference-profile
+// prefix, and the version/throughput suffix from a Bedrock model id so it
+// matches the catalog/pricing key, e.g.
+// "eu.anthropic.claude-sonnet-4-5-20250929-v1:0" -> "anthropic.claude-sonnet-4-5"
+// and the inference-profile ARN's last segment likewise. It is the single
+// source of truth shared by the request parser (which normalizes the request
+// model from the URL path) and the router (which normalizes the operator's
+// registered Bedrock model ids so both sides compare equal).
+func NormalizeBedrockModel(modelID string) string {
+	m := modelID
+	if strings.HasPrefix(m, "arn:") {
+		if i := strings.LastIndex(m, "/"); i >= 0 {
+			m = m[i+1:]
+		}
+	}
+	for _, p := range bedrockRegionPrefixes {
+		if strings.HasPrefix(m, p) {
+			m = m[len(p):]
+			break
+		}
+	}
+	return bedrockVersionSuffix.ReplaceAllString(m, "")
+}

proxy/internal/llm/bedrock_model_test.go

@@ -11,8 +11,6 @@ func TestNormalizeBedrockModel(t *testing.T) {
 		"eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
 		"us.anthropic.claude-haiku-4-5":                "anthropic.claude-haiku-4-5",
 		"us.anthropic.claude-opus-4-8-20250101-v1:0":   "anthropic.claude-opus-4-8",
-		"apac.anthropic.claude-haiku-4-5-v1:0":         "anthropic.claude-haiku-4-5",
-		"amazon.nova-2-lite-v1:0":                      "amazon.nova-2-lite",
 		"anthropic.claude-sonnet-4-5-20250929-v1:0":    "anthropic.claude-sonnet-4-5",
 		"meta.llama3-3-70b-instruct-v1:0":              "meta.llama3-3-70b-instruct",
 		"amazon.nova-pro-v1:0":                         "amazon.nova-pro",
@@ -23,14 +21,3 @@ func TestNormalizeBedrockModel(t *testing.T) {
 		require.Equal(t, want, NormalizeBedrockModel(in), "normalize %q", in)
 	}
 }
-
-func TestNormalizeVertexModel(t *testing.T) {
-	cases := map[string]string{
-		"claude-sonnet-4-5@20250929": "claude-sonnet-4-5",
-		"claude-haiku-4-5":           "claude-haiku-4-5",
-		"gpt-4o@2024-08-06":          "gpt-4o",
-	}
-	for in, want := range cases {
-		require.Equal(t, want, NormalizeVertexModel(in), "normalize %q", in)
-	}
-}

proxy/internal/llm/fixtures/pricing.yaml

@@ -0,0 +1,59 @@
+# Realistic-pricing starter for llm_observability. Drop this into the
+# directory you point the proxy at via --plugin-data-dir, then reference it
+# from the target's plugin config:
+#
+#   plugins:
+#     - id: llm_observability
+#       enabled: true
+#       params:
+#         pricing_path: pricing.yaml
+#
+# Values are USD per 1_000 tokens. Public list prices drift; treat this as a
+# starting point and keep your production copy current.
+
+openai:
+  # GPT-5 family
+  gpt-5:
+    input_per_1k: 0.00125
+    output_per_1k: 0.01
+  gpt-5-mini:
+    input_per_1k: 0.00025
+    output_per_1k: 0.002
+  gpt-5-nano:
+    input_per_1k: 0.00005
+    output_per_1k: 0.0004
+  gpt-5.4:
+    input_per_1k: 0.00125
+    output_per_1k: 0.01
+  # GPT-4o family
+  gpt-4o:
+    input_per_1k: 0.0025
+    output_per_1k: 0.01
+  gpt-4o-mini:
+    input_per_1k: 0.00015
+    output_per_1k: 0.0006
+  # Embeddings
+  text-embedding-3-large:
+    input_per_1k: 0.00013
+    output_per_1k: 0
+  text-embedding-3-small:
+    input_per_1k: 0.00002
+    output_per_1k: 0
+
+anthropic:
+  # Claude 4.x family
+  claude-opus-4-7:
+    input_per_1k: 0.015
+    output_per_1k: 0.075
+  claude-sonnet-4-7:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+  claude-sonnet-4-6:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+  claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+  claude-haiku-4-5:
+    input_per_1k: 0.0008
+    output_per_1k: 0.004

proxy/internal/llm/model.go

@@ -1,21 +0,0 @@
-package llm
-
-import (
-	sharedllm "github.com/netbirdio/netbird/shared/llm"
-)
-
-// NormalizeBedrockModel strips an ARN wrapper, a cross-region inference-profile
-// prefix, and the version/throughput suffix from a Bedrock model id so it
-// matches the catalog/pricing key. Thin delegate to the shared implementation
-// (shared/llm), which management also uses at synthesis time so both sides of
-// the pricing / routing contract normalize identically.
-func NormalizeBedrockModel(modelID string) string {
-	return sharedllm.NormalizeBedrockModel(modelID)
-}
-
-// NormalizeVertexModel strips the "@version" suffix from a Vertex AI model id
-// so it matches the catalog/pricing key. Thin delegate to shared/llm, kept
-// beside NormalizeBedrockModel for the same contract reason.
-func NormalizeVertexModel(modelID string) string {
-	return sharedllm.NormalizeVertexModel(modelID)
-}

proxy/internal/llm/pricing/defaults_coverage_test.go

@@ -0,0 +1,65 @@
+package pricing
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestDefaultTable_FirstPartyModelCoverage guards the embedded defaults against
+// silent drift/gaps: every metered first-party model the management catalog
+// enumerates must resolve to a price, and a few rates that previously drifted
+// are pinned to their LiteLLM-validated values. Keep this list in step with the
+// catalog (management/server/agentnetwork/catalog) when adding models.
+func TestDefaultTable_FirstPartyModelCoverage(t *testing.T) {
+	tbl := DefaultTable()
+	require.NotNil(t, tbl, "embedded default pricing table must load")
+
+	mustPrice := map[string][]string{
+		// openai parser covers openai_api, azure_openai_api, and mistral_api.
+		"openai": {
+			"gpt-5.5", "gpt-5.5-pro", "gpt-5.4", "gpt-5.4-mini", "gpt-5.4-nano",
+			"gpt-5.3-codex", "gpt-5.3-chat-latest", "o4-mini",
+			"gpt-4.1", "gpt-4.1-mini", "gpt-4.1-nano", "gpt-4o", "gpt-4o-mini",
+			"gpt-4-turbo", "gpt-3.5-turbo", "gpt-35-turbo",
+			"text-embedding-3-large", "text-embedding-3-small",
+			"mistral-large-latest", "mistral-medium-3-5", "codestral-2508",
+			"ministral-8b-latest", "mistral-embed",
+		},
+		"anthropic": {
+			"claude-fable-5", "claude-opus-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6",
+			"claude-opus-4-1", "claude-sonnet-4-6", "claude-sonnet-4-5", "claude-haiku-4-5",
+		},
+		// bedrock keys are the normalized ids the request parser emits.
+		"bedrock": {
+			"anthropic.claude-opus-5", "anthropic.claude-opus-4-8", "anthropic.claude-opus-4-7", "anthropic.claude-opus-4-6",
+			"anthropic.claude-opus-4-1", "anthropic.claude-sonnet-4-6", "anthropic.claude-sonnet-4-5",
+			"anthropic.claude-haiku-4-5", "meta.llama3-3-70b-instruct",
+			"amazon.nova-pro", "amazon.nova-lite", "amazon.nova-micro", "amazon.nova-2-lite",
+		},
+	}
+	for provider, models := range mustPrice {
+		for _, m := range models {
+			_, ok := tbl.Cost(provider, m, 1000, 1000, 0, 0)
+			assert.True(t, ok, "%s/%s must be priced in the embedded defaults", provider, m)
+		}
+	}
+
+	// Pin per-direction rates independently (input-only then output-only) so a
+	// swap or skew of input<->output that preserves the combined total is still
+	// caught — these are rates that previously drifted or are easy to mis-enter.
+	in, ok := tbl.Cost("openai", "gpt-5.4", 1000, 0, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.0025, in, 1e-9, "gpt-5.4 input = 0.0025 per 1k")
+	out, ok := tbl.Cost("openai", "gpt-5.4", 0, 1000, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.015, out, 1e-9, "gpt-5.4 output = 0.015 per 1k")
+
+	in, ok = tbl.Cost("bedrock", "anthropic.claude-sonnet-4-5", 1000, 0, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.003, in, 1e-9, "bedrock sonnet-4-5 input = 0.003 per 1k")
+	out, ok = tbl.Cost("bedrock", "anthropic.claude-sonnet-4-5", 0, 1000, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.015, out, 1e-9, "bedrock sonnet-4-5 output = 0.015 per 1k")
+}

proxy/internal/llm/pricing/defaults_pricing.yaml

@@ -1,196 +1,66 @@
-# Default LLM pricing used by NetBird's Agent Network cost metering.
-# GENERATED from the management catalog — do not edit this file in the
-# repository; regenerate with:
+# Embedded default pricing for llm_observability. Compiled into the proxy
+# binary via go:embed in pricing.go; cost annotation works out of the box
+# without any operator action.
 #
-#   go generate ./management/internals/modules/agentnetwork/pricing
+# Operators override entries by dropping a pricing.yaml into --plugin-data-dir
+# (or whichever basename is given via params.pricing_path). The override file
+# only needs entries the operator wants to change; missing entries fall
+# through to these defaults.
 #
-# Operators: copy this file to <datadir>/defaults_llm_pricing.yaml (or
-# any path configured via management.json:
+# Values are USD per 1_000 tokens. Public list prices drift; ship a fresh
+# binary or override individual entries via the override file as needed.
 #
-#   { "AgentNetwork": { "PricingDefaultsFile": "/path/defaults_llm_pricing.yaml" } }
-#
-# ) and adjust the entries you want to change. Management re-reads the
-# file periodically (mtime poll, every minute): the live table feeds the
-# proxies' cost metering and the dashboard's model-price prefill, so
-# edits apply without a restart. Your file only needs the entries you
-# want to change — but each entry REPLACES the built-in entry for that
-# surface+model whole, so repeat the cache rates you want to keep.
-# Unknown fields and negative or non-finite rates are rejected: at
-# startup that fails boot (for an explicitly configured path); at
-# runtime the previous table is kept and a warning is logged. Deleting
-# the file reverts to the built-in defaults below.
-#
-# Top-level keys are pricing surfaces — the parser shape requests are
-# metered under: "openai" (also Azure, Mistral, and OpenAI-compatible
-# gateways), "anthropic" (also Anthropic-on-Vertex), "bedrock"
-# (normalized ids, e.g. anthropic.claude-sonnet-4-5). Model keys must be
-# the normalized id the proxy meters (version/region suffixes stripped).
-#
-# Values are USD per 1_000 tokens. Optional cache fields:
-#   cached_input_per_1k    OpenAI shape: rate for cached prompt tokens
-#                          (a SUBSET of input tokens). Absent -> cached
-#                          portion bills at input_per_1k.
-#   cache_read_per_1k      Anthropic shape: rate for cache_read tokens
-#                          (ADDITIVE to input). Absent -> input rate.
-#   cache_creation_per_1k  Anthropic shape: rate for cache_creation
-#                          tokens (ADDITIVE to input). Absent -> input
-#                          rate.
-
-anthropic:
-  claude-fable-5:
-    input_per_1k: 0.01
-    output_per_1k: 0.05
-    cache_read_per_1k: 0.001
-    cache_creation_per_1k: 0.0125
-  claude-haiku-4-5:
-    input_per_1k: 0.001
-    output_per_1k: 0.005
-    cache_read_per_1k: 0.0001
-    cache_creation_per_1k: 0.00125
-  claude-opus-4-1:
-    input_per_1k: 0.015
-    output_per_1k: 0.075
-    cache_read_per_1k: 0.0015
-    cache_creation_per_1k: 0.01875
-  claude-opus-4-6:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  claude-opus-4-7:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  claude-opus-4-8:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  claude-opus-5:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  claude-sonnet-4-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  claude-sonnet-4-6:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  kimi-k3:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cached_input_per_1k: 0.0003
-    cache_read_per_1k: 0.0003
-  "kimi-k3[1m]":
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-
-bedrock:
-  amazon.nova-2-lite:
-    input_per_1k: 0.0003
-    output_per_1k: 0.0025
-  amazon.nova-lite:
-    input_per_1k: 0.00006
-    output_per_1k: 0.00024
-  amazon.nova-micro:
-    input_per_1k: 0.000035
-    output_per_1k: 0.00014
-  amazon.nova-pro:
-    input_per_1k: 0.0008
-    output_per_1k: 0.0032
-  anthropic.claude-haiku-4-5:
-    input_per_1k: 0.001
-    output_per_1k: 0.005
-    cache_read_per_1k: 0.0001
-    cache_creation_per_1k: 0.00125
-  anthropic.claude-opus-4-1:
-    input_per_1k: 0.015
-    output_per_1k: 0.075
-    cache_read_per_1k: 0.0015
-    cache_creation_per_1k: 0.01875
-  anthropic.claude-opus-4-6:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  anthropic.claude-opus-4-7:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  anthropic.claude-opus-4-8:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  anthropic.claude-opus-5:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  anthropic.claude-sonnet-4-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  anthropic.claude-sonnet-4-6:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  meta.llama3-3-70b-instruct:
-    input_per_1k: 0.00072
-    output_per_1k: 0.00072
+# Optional cache fields:
+#   cached_input_per_1k    OpenAI: rate for prompt_tokens_details.cached_tokens
+#                          (a SUBSET of prompt_tokens). Typically 0.5x input.
+#                          Absent → cached portion bills at input_per_1k.
+#   cache_read_per_1k      Anthropic: rate for cache_read_input_tokens
+#                          (ADDITIVE to input_tokens). Typically 0.1x input.
+#                          Absent → cache reads bill at input_per_1k.
+#   cache_creation_per_1k  Anthropic: rate for cache_creation_input_tokens
+#                          (ADDITIVE to input_tokens). Typically 1.25x input.
+#                          Absent → cache writes bill at input_per_1k.
 
 openai:
-  codestral-2508:
-    input_per_1k: 0.0003
-    output_per_1k: 0.0009
-  codestral-latest:
-    input_per_1k: 0.001
-    output_per_1k: 0.003
-  devstral-medium-latest:
-    input_per_1k: 0.0004
-    output_per_1k: 0.002
-  devstral-small-latest:
-    input_per_1k: 0.0001
-    output_per_1k: 0.0003
-  gpt-3.5-turbo:
-    input_per_1k: 0.0005
-    output_per_1k: 0.0015
-  gpt-35-turbo:
-    input_per_1k: 0.0005
-    output_per_1k: 0.0015
-  gpt-4-turbo:
-    input_per_1k: 0.01
+  # OpenAI + OpenAI-compatible providers (openai_api, azure_openai_api,
+  # mistral_api, and the openai-parser gateways) all emit llm.provider="openai",
+  # so their models are priced here. Kept in sync with the management catalog;
+  # rates cross-checked against LiteLLM model_prices_and_context_window.json.
+
+  # GPT-5.x family — cache reads 10% of input (0.1x).
+  gpt-5.5:
+    input_per_1k: 0.005
     output_per_1k: 0.03
-  gpt-4.1:
-    input_per_1k: 0.002
-    output_per_1k: 0.008
     cached_input_per_1k: 0.0005
-  gpt-4.1-mini:
-    input_per_1k: 0.0004
-    output_per_1k: 0.0016
-    cached_input_per_1k: 0.0001
-  gpt-4.1-nano:
-    input_per_1k: 0.0001
-    output_per_1k: 0.0004
-    cached_input_per_1k: 0.000025
-  gpt-4o:
+  gpt-5.5-pro:
+    input_per_1k: 0.03
+    output_per_1k: 0.18
+    cached_input_per_1k: 0.003
+  gpt-5.4:
     input_per_1k: 0.0025
-    output_per_1k: 0.01
-    cached_input_per_1k: 0.00125
-  gpt-4o-mini:
-    input_per_1k: 0.00015
-    output_per_1k: 0.0006
+    output_per_1k: 0.015
+    cached_input_per_1k: 0.00025
+  gpt-5.4-pro:
+    input_per_1k: 0.03
+    output_per_1k: 0.18
+    cached_input_per_1k: 0.003
+  gpt-5.4-mini:
+    input_per_1k: 0.00075
+    output_per_1k: 0.0045
     cached_input_per_1k: 0.000075
+  gpt-5.4-nano:
+    input_per_1k: 0.0002
+    output_per_1k: 0.00125
+    cached_input_per_1k: 0.00002
+  gpt-5.3-codex:
+    input_per_1k: 0.00175
+    output_per_1k: 0.014
+    cached_input_per_1k: 0.000175
+  gpt-5.3-chat-latest:
+    input_per_1k: 0.00175
+    output_per_1k: 0.014
+    cached_input_per_1k: 0.000175
+  # GPT-5 (2025) family — kept for gateway requests using the unsuffixed ids.
   gpt-5:
     input_per_1k: 0.00125
     output_per_1k: 0.01
@@ -203,80 +73,226 @@ openai:
     input_per_1k: 0.00005
     output_per_1k: 0.0004
     cached_input_per_1k: 0.000005
-  gpt-5.3-chat-latest:
-    input_per_1k: 0.00175
-    output_per_1k: 0.014
-    cached_input_per_1k: 0.000175
-  gpt-5.3-codex:
-    input_per_1k: 0.00175
-    output_per_1k: 0.014
-    cached_input_per_1k: 0.000175
-  gpt-5.4:
-    input_per_1k: 0.0025
-    output_per_1k: 0.015
-    cached_input_per_1k: 0.00025
-  gpt-5.4-mini:
-    input_per_1k: 0.00075
-    output_per_1k: 0.0045
-    cached_input_per_1k: 0.000075
-  gpt-5.4-nano:
-    input_per_1k: 0.0002
-    output_per_1k: 0.00125
-    cached_input_per_1k: 0.00002
-  gpt-5.4-pro:
-    input_per_1k: 0.03
-    output_per_1k: 0.18
-    cached_input_per_1k: 0.003
-  gpt-5.5:
-    input_per_1k: 0.005
-    output_per_1k: 0.03
-    cached_input_per_1k: 0.0005
-  gpt-5.5-pro:
-    input_per_1k: 0.03
-    output_per_1k: 0.18
-    cached_input_per_1k: 0.003
-  kimi-k3:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cached_input_per_1k: 0.0003
-    cache_read_per_1k: 0.0003
-  magistral-medium-latest:
-    input_per_1k: 0.002
-    output_per_1k: 0.005
-  magistral-small-latest:
-    input_per_1k: 0.0005
-    output_per_1k: 0.0015
-  ministral-3-14b-2512:
-    input_per_1k: 0.0002
-    output_per_1k: 0.0002
-  ministral-3-3b-2512:
-    input_per_1k: 0.0001
-    output_per_1k: 0.0001
-  ministral-8b-latest:
-    input_per_1k: 0.00015
-    output_per_1k: 0.00015
-  mistral-embed:
-    input_per_1k: 0.0001
-    output_per_1k: 0
-  mistral-large-latest:
-    input_per_1k: 0.0005
-    output_per_1k: 0.0015
-  mistral-medium-3-5:
-    input_per_1k: 0.0015
-    output_per_1k: 0.0075
-  mistral-medium-latest:
-    input_per_1k: 0.0004
-    output_per_1k: 0.002
-  mistral-small-latest:
-    input_per_1k: 0.00006
-    output_per_1k: 0.00018
   o4-mini:
     input_per_1k: 0.0011
     output_per_1k: 0.0044
     cached_input_per_1k: 0.000275
+  # GPT-4.1 family — cache reads 25% of input.
+  gpt-4.1:
+    input_per_1k: 0.002
+    output_per_1k: 0.008
+    cached_input_per_1k: 0.0005
+  gpt-4.1-mini:
+    input_per_1k: 0.0004
+    output_per_1k: 0.0016
+    cached_input_per_1k: 0.0001
+  gpt-4.1-nano:
+    input_per_1k: 0.0001
+    output_per_1k: 0.0004
+    cached_input_per_1k: 0.000025
+  # GPT-4o family — cache reads 50% of input (0.5x).
+  gpt-4o:
+    input_per_1k: 0.0025
+    output_per_1k: 0.01
+    cached_input_per_1k: 0.00125
+  gpt-4o-mini:
+    input_per_1k: 0.00015
+    output_per_1k: 0.0006
+    cached_input_per_1k: 0.000075
+  # Older GPT — no prompt caching.
+  gpt-4-turbo:
+    input_per_1k: 0.01
+    output_per_1k: 0.03
+  gpt-3.5-turbo:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  gpt-35-turbo: # Azure deployment alias of gpt-3.5-turbo
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  # Embeddings — no caching, no output tokens.
   text-embedding-3-large:
     input_per_1k: 0.00013
     output_per_1k: 0
   text-embedding-3-small:
     input_per_1k: 0.00002
     output_per_1k: 0
+
+  # Mistral (mistral_api) — routed via the openai parser; no prompt caching.
+  mistral-large-latest:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  mistral-medium-latest:
+    input_per_1k: 0.0004
+    output_per_1k: 0.002
+  mistral-medium-3-5:
+    input_per_1k: 0.0015
+    output_per_1k: 0.0075
+  mistral-small-latest:
+    input_per_1k: 0.00006
+    output_per_1k: 0.00018
+  magistral-medium-latest:
+    input_per_1k: 0.002
+    output_per_1k: 0.005
+  magistral-small-latest:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  devstral-medium-latest:
+    input_per_1k: 0.0004
+    output_per_1k: 0.002
+  devstral-small-latest:
+    input_per_1k: 0.0001
+    output_per_1k: 0.0003
+  codestral-2508:
+    input_per_1k: 0.0003
+    output_per_1k: 0.0009
+  codestral-latest:
+    input_per_1k: 0.001
+    output_per_1k: 0.003
+  ministral-3-14b-2512:
+    input_per_1k: 0.0002
+    output_per_1k: 0.0002
+  ministral-8b-latest:
+    input_per_1k: 0.00015
+    output_per_1k: 0.00015
+  ministral-3-3b-2512:
+    input_per_1k: 0.0001
+    output_per_1k: 0.0001
+  mistral-embed:
+    input_per_1k: 0.0001
+    output_per_1k: 0
+
+  # Kimi / Moonshot AI (kimi_api) — OpenAI-compatible /v1 endpoint. Moonshot
+  # reports cache hits OpenAI-style when present; cached input is 10% of
+  # input ($0.30 vs $3.00 per MTok). kimi-k3 is the only model the platform
+  # serves newer accounts (K2-era ids and kimi-latest 404), matching the
+  # management catalog.
+  kimi-k3:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cached_input_per_1k: 0.0003
+
+anthropic:
+  # Claude 4.x family — cache reads ≈10% of input, cache writes ≈125% of input.
+  # Pricing source: Anthropic's current published rates per million tokens,
+  # divided by 1000 for the per-1k figures stored here.
+  claude-fable-5:
+    input_per_1k: 0.010
+    output_per_1k: 0.050
+    cache_read_per_1k: 0.001
+    cache_creation_per_1k: 0.0125
+  claude-opus-5:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-8:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-7:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-6:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-1:
+    input_per_1k: 0.015
+    output_per_1k: 0.075
+    cache_read_per_1k: 0.0015
+    cache_creation_per_1k: 0.01875
+  claude-sonnet-4-6:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  claude-haiku-4-5:
+    input_per_1k: 0.001
+    output_per_1k: 0.005
+    cache_read_per_1k: 0.0001
+    cache_creation_per_1k: 0.00125
+
+  # Kimi / Moonshot AI (kimi_api) via the Anthropic-compatible endpoint
+  # (/anthropic/v1/messages — the official Claude Code setup). Same rates
+  # as the OpenAI-shape entry above. "kimi-k3[1m]" is the model id some
+  # Claude Code guides set for the 1M-context alias; priced identically so
+  # cost metering doesn't silently skip those requests.
+  kimi-k3:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+  "kimi-k3[1m]":
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+
+bedrock:
+  # AWS Bedrock model ids, normalised by the request parser (cross-region
+  # inference-profile prefix + version/throughput suffix stripped), e.g.
+  # eu.anthropic.claude-sonnet-4-5-20250929-v1:0 -> anthropic.claude-sonnet-4-5.
+  # Anthropic-on-Bedrock keeps the additive cache buckets (read ≈0.1x input,
+  # write ≈1.25x input); Nova / Llama report no cache, so cost is input+output.
+  anthropic.claude-opus-5:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-8:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-7:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-6:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-1:
+    input_per_1k: 0.015
+    output_per_1k: 0.075
+    cache_read_per_1k: 0.0015
+    cache_creation_per_1k: 0.01875
+  anthropic.claude-sonnet-4-6:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  anthropic.claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  anthropic.claude-haiku-4-5:
+    input_per_1k: 0.001
+    output_per_1k: 0.005
+    cache_read_per_1k: 0.0001
+    cache_creation_per_1k: 0.00125
+  meta.llama3-3-70b-instruct:
+    input_per_1k: 0.00072
+    output_per_1k: 0.00072
+  amazon.nova-2-lite:
+    input_per_1k: 0.0003
+    output_per_1k: 0.0025
+  amazon.nova-pro:
+    input_per_1k: 0.0008
+    output_per_1k: 0.0032
+  amazon.nova-lite:
+    input_per_1k: 0.00006
+    output_per_1k: 0.00024
+  amazon.nova-micro:
+    input_per_1k: 0.000035
+    output_per_1k: 0.00014