Bump github.com/pkg/sftp from 1.13.9 to 1.13.10

Bumps [github.com/pkg/sftp](https://github.com/pkg/sftp) from 1.13.9 to 1.13.10.
- [Release notes](https://github.com/pkg/sftp/releases)
- [Commits](https://github.com/pkg/sftp/compare/v1.13.9...v1.13.10)

---
updated-dependencies:
- dependency-name: github.com/pkg/sftp
  dependency-version: 1.13.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

client/internal/debug/debug.go

@@ -480,6 +480,7 @@ func (g *BundleGenerator) addStatus() error {
 
 		fullStatus := g.statusRecorder.GetFullStatus()
 		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
+		protoFullStatus.Events = g.statusRecorder.GetEventHistory()
 		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, nbstatus.ConvertOptions{
 			Anonymize:     g.anonymize,
 			ProfileName:   profName,

client/mdm/canonical_loaders.go

@@ -22,7 +22,6 @@ var allKeys = []string{
 	KeyDisableMetricsCollection,
 	KeyAllowServerSSH,
 	KeyDisableAutoConnect,
-	KeyDisableAutostart,
 	KeyPreSharedKey,
 	KeyRosenpassEnabled,
 	KeyRosenpassPermissive,

client/mdm/policy.go

@@ -20,10 +20,10 @@ import (
 // names (lowerCamelCase) so the daemon can map a Policy key directly to a
 // configuration field.
 const (
-	KeyManagementURL         = "managementURL"
-	KeyDisableUpdateSettings = "disableUpdateSettings"
-	KeyDisableProfiles       = "disableProfiles"
-	KeyDisableNetworks       = "disableNetworks"
+	KeyManagementURL            = "managementURL"
+	KeyDisableUpdateSettings    = "disableUpdateSettings"
+	KeyDisableProfiles          = "disableProfiles"
+	KeyDisableNetworks          = "disableNetworks"
 	// KeyDisableAdvancedView gates the advanced-view section in the
 	// upcoming UI revision. UI-only: NOT stored on Config, not
 	// applied by applyMDMPolicy, not rejectable via SetConfig. The
@@ -37,16 +37,10 @@ const (
 	KeyDisableMetricsCollection = "disableMetricsCollection"
 	KeyAllowServerSSH           = "allowServerSSH"
 	KeyDisableAutoConnect       = "disableAutoConnect"
-	// KeyDisableAutostart suppresses the GUI's fresh-install
-	// launch-on-login default and marks the Settings toggle as
-	// MDM-managed. UI-only: NOT stored on Config and not applied by
-	// applyMDMPolicy; the GUI reads it directly and it appears in
-	// GetConfigResponse.mDMManagedFields when set.
-	KeyDisableAutostart    = "disableAutostart"
-	KeyPreSharedKey        = "preSharedKey"
-	KeyRosenpassEnabled    = "rosenpassEnabled"
-	KeyRosenpassPermissive = "rosenpassPermissive"
-	KeyWireguardPort       = "wireguardPort"
+	KeyPreSharedKey             = "preSharedKey"
+	KeyRosenpassEnabled         = "rosenpassEnabled"
+	KeyRosenpassPermissive      = "rosenpassPermissive"
+	KeyWireguardPort            = "wireguardPort"
 
 	// Split tunnel is modeled as a single conceptual policy with two
 	// registry/plist values. KeySplitTunnelMode is the discriminator

client/status/status.go

@@ -746,8 +746,6 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
 	}
 
-	pbFullStatus.Events = fullStatus.Events
-
 	return &pbFullStatus
 }
 

client/ui/autostart_default.go

@@ -1,107 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/mdm"
-	"github.com/netbirdio/netbird/client/ui/preferences"
-	"github.com/netbirdio/netbird/client/ui/services"
-)
-
-// autostartDefaultState carries the guard inputs of the one-time autostart
-// default decision so the decision itself stays a pure, testable function.
-type autostartDefaultState struct {
-	supported    bool
-	mdmDisabled  bool
-	priorInstall bool
-}
-
-// shouldEnableAutostartDefault applies the first-run guards in order and
-// returns whether autostart may be enabled, plus the reason when it may not.
-func shouldEnableAutostartDefault(s autostartDefaultState) (bool, string) {
-	switch {
-	case !s.supported:
-		return false, "autostart not supported on this platform"
-	case s.mdmDisabled:
-		return false, "autostart disabled by MDM policy"
-	case s.priorInstall:
-		return false, "existing NetBird installation"
-	}
-	return true, ""
-}
-
-// autostartDisabledByMDM reports whether the MDM policy manages the
-// disableAutostart key in a way that must suppress the default. An
-// unparseable managed value is treated as disabled to stay on the safe side.
-func autostartDisabledByMDM(policy *mdm.Policy) bool {
-	if !policy.HasKey(mdm.KeyDisableAutostart) {
-		return false
-	}
-	disabled, ok := policy.GetBool(mdm.KeyDisableAutostart)
-	return !ok || disabled
-}
-
-// netbirdFootprintExists reports whether the machine already carries NetBird
-// daemon config or state, meaning this is not a genuinely fresh install. It is
-// the update-safety gate for the autostart default: upgrading users always
-// have a footprint, so an update can never trigger a login-item write.
-func netbirdFootprintExists() bool {
-	candidates := []string{
-		profilemanager.DefaultConfigPath,
-		filepath.Join(profilemanager.DefaultConfigPathDir, "config.json"),
-		filepath.Join(profilemanager.DefaultConfigPathDir, "state.json"),
-	}
-	for _, path := range candidates {
-		if path != "" && fileExists(path) {
-			return true
-		}
-	}
-	return false
-}
-
-// applyAutostartDefault runs the one-time launch-on-login default for genuinely
-// fresh installs. The autostartInitialized marker is persisted before any
-// enable attempt so a crash mid-flow degrades to "never enabled" instead of
-// retrying login-item writes on every launch. A user's later disable in
-// Settings is never overridden: the marker guarantees at-most-once, ever.
-func applyAutostartDefault(ctx context.Context, autostart *services.Autostart, prefs *preferences.Store, prefsFileExisted bool) {
-	priorFootprint := netbirdFootprintExists() || prefsFileExisted
-
-	if prefs.Get().AutostartInitialized {
-		return
-	}
-	if err := prefs.SetAutostartInitialized(true); err != nil {
-		log.Warnf("persist autostart marker, skipping autostart default: %v", err)
-		return
-	}
-
-	state := autostartDefaultState{
-		supported:    autostart.Supported(ctx),
-		mdmDisabled:  autostartDisabledByMDM(mdm.LoadPolicy()),
-		priorInstall: priorFootprint,
-	}
-	enable, reason := shouldEnableAutostartDefault(state)
-	if !enable {
-		log.Debugf("skipping autostart default: %s", reason)
-		return
-	}
-
-	if err := autostart.SetEnabled(ctx, true); err != nil {
-		log.Warnf("enable autostart on fresh install: %v", err)
-		return
-	}
-	log.Info("autostart enabled by default on fresh install")
-}
-
-// fileExists reports whether path exists.
-func fileExists(path string) bool {
-	_, err := os.Stat(path)
-	return err == nil
-}

client/ui/autostart_default_test.go

@@ -1,125 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/netbirdio/netbird/client/mdm"
-)
-
-func TestShouldEnableAutostartDefault(t *testing.T) {
-	allPass := autostartDefaultState{
-		supported:    true,
-		mdmDisabled:  false,
-		priorInstall: false,
-	}
-
-	tests := []struct {
-		name       string
-		mutate     func(*autostartDefaultState)
-		wantEnable bool
-		wantReason string
-	}{
-		{
-			name:       "fresh install with all guards passing enables",
-			mutate:     func(*autostartDefaultState) {},
-			wantEnable: true,
-		},
-		{
-			name:       "unsupported platform skips",
-			mutate:     func(s *autostartDefaultState) { s.supported = false },
-			wantReason: "autostart not supported on this platform",
-		},
-		{
-			name:       "MDM disable skips",
-			mutate:     func(s *autostartDefaultState) { s.mdmDisabled = true },
-			wantReason: "autostart disabled by MDM policy",
-		},
-		{
-			name:       "existing installation (upgrade) skips",
-			mutate:     func(s *autostartDefaultState) { s.priorInstall = true },
-			wantReason: "existing NetBird installation",
-		},
-		{
-			name: "unsupported wins over every other guard",
-			mutate: func(s *autostartDefaultState) {
-				s.supported = false
-				s.mdmDisabled = true
-				s.priorInstall = true
-			},
-			wantReason: "autostart not supported on this platform",
-		},
-		{
-			name: "MDM disable wins over prior install",
-			mutate: func(s *autostartDefaultState) {
-				s.mdmDisabled = true
-				s.priorInstall = true
-			},
-			wantReason: "autostart disabled by MDM policy",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			state := allPass
-			tc.mutate(&state)
-			enable, reason := shouldEnableAutostartDefault(state)
-			assert.Equal(t, tc.wantEnable, enable, "enable decision should match for state %+v", state)
-			assert.Equal(t, tc.wantReason, reason, "skip reason should identify the failing guard")
-		})
-	}
-}
-
-func TestAutostartDisabledByMDM(t *testing.T) {
-	tests := []struct {
-		name   string
-		values map[string]any
-		want   bool
-	}{
-		{
-			name:   "empty policy does not disable",
-			values: nil,
-			want:   false,
-		},
-		{
-			name:   "unrelated managed keys do not disable",
-			values: map[string]any{mdm.KeyDisableAutoConnect: true},
-			want:   false,
-		},
-		{
-			name:   "disableAutostart true disables",
-			values: map[string]any{mdm.KeyDisableAutostart: true},
-			want:   true,
-		},
-		{
-			name:   "disableAutostart registry DWORD 1 disables",
-			values: map[string]any{mdm.KeyDisableAutostart: int64(1)},
-			want:   true,
-		},
-		{
-			name:   "disableAutostart string true disables",
-			values: map[string]any{mdm.KeyDisableAutostart: "true"},
-			want:   true,
-		},
-		{
-			name:   "disableAutostart explicit false allows",
-			values: map[string]any{mdm.KeyDisableAutostart: false},
-			want:   false,
-		},
-		{
-			name:   "unparseable managed value is treated as disabled",
-			values: map[string]any{mdm.KeyDisableAutostart: "not-a-bool"},
-			want:   true,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := autostartDisabledByMDM(mdm.NewPolicy(tc.values))
-			assert.Equal(t, tc.want, got, "MDM disable decision should match for values %v", tc.values)
-		})
-	}
-}

client/ui/frontend/src/lib/connection.ts

@@ -51,14 +51,7 @@ async function runSsoLogin(
     if (uri) await openBrowserLoginUri(uri);
 
     const cancelPromise = buildSsoCancelPromise(state, signal);
-    // Combine wait + up in Go so the connection comes up the moment SSO
-    // completes. During SSO the tray window is hidden and the webview is
-    // suspended, so a frontend-driven Up (a promise continuation) would not
-    // fire until the user woke the window (e.g. hovering the tray icon).
-    const waitPromise = Connection.WaitSSOLoginAndUp(
-        { userCode: result.userCode, hostname: "" },
-        { profileName: "", username: "" },
-    );
+    const waitPromise = Connection.WaitSSOLogin({ userCode: result.userCode, hostname: "" });
 
     try {
         await Promise.race([waitPromise, cancelPromise]);
@@ -96,13 +89,13 @@ export async function startConnection(onSettled?: () => void, signal?: AbortSign
         if (signal?.aborted) state.cancelled = true;
 
         if (!state.cancelled && result.needsSsoLogin) {
-            // runSsoLogin brings the connection up in Go once SSO completes.
             await runSsoLogin(result, state, signal);
-        } else {
-            if (!state.cancelled && signal?.aborted) state.cancelled = true;
-            if (!state.cancelled) {
-                await Connection.Up({ profileName: "", username: "" });
-            }
+        }
+
+        if (!state.cancelled && signal?.aborted) state.cancelled = true;
+
+        if (!state.cancelled) {
+            await Connection.Up({ profileName: "", username: "" });
         }
     } catch (e) {
         WindowManager.CloseBrowserLogin().catch(console.error);

client/ui/main.go

@@ -197,9 +197,6 @@ func main() {
 		// daemon may keep the main window from showing, so the OS toast is the
 		// only reliable signal the user gets.
 		go notifyIfDaemonOutdated(compat, notifier, localizer)
-		// One-time launch-on-login default for fresh installs; gated by the
-		// NetBird footprint check, MDM policy, and the persisted marker.
-		go applyAutostartDefault(context.Background(), services.NewAutostart(app.Autostart), prefStore, prefStore.ExistedAtLoad())
 	})
 
 	if err := app.Run(); err != nil {

client/ui/preferences/store.go

@@ -54,10 +54,6 @@ type UIPreferences struct {
 	Language            i18n.LanguageCode `json:"language"`
 	ViewMode            ViewMode          `json:"viewMode"`
 	OnboardingCompleted bool              `json:"onboardingCompleted"`
-	// AutostartInitialized records that the one-time autostart default
-	// decision has run for this OS user. It only ever transitions to true
-	// and is never reset, so the default-on flow runs at most once, ever.
-	AutostartInitialized bool `json:"autostartInitialized"`
 }
 
 // LanguageValidator rejects SetLanguage inputs with no shipped bundle.
@@ -76,9 +72,8 @@ type Emitter interface {
 type Store struct {
 	path string
 
-	mu            sync.RWMutex
-	current       UIPreferences
-	existedAtLoad bool
+	mu      sync.RWMutex
+	current UIPreferences
 
 	subsMu sync.Mutex
 	subs   []chan UIPreferences
@@ -162,27 +157,6 @@ func (s *Store) SetOnboardingCompleted(done bool) error {
 	return nil
 }
 
-// SetAutostartInitialized persists the one-time autostart decision marker.
-// No-op if unchanged.
-func (s *Store) SetAutostartInitialized(done bool) error {
-	s.mu.Lock()
-	if s.current.AutostartInitialized == done {
-		s.mu.Unlock()
-		return nil
-	}
-	next := s.current
-	next.AutostartInitialized = done
-	if err := s.persistLocked(next); err != nil {
-		s.mu.Unlock()
-		return fmt.Errorf("persist preferences: %w", err)
-	}
-	s.current = next
-	s.mu.Unlock()
-
-	s.broadcast(next)
-	return nil
-}
-
 // SetLanguage validates, persists, and broadcasts. No-op if unchanged.
 func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
 	if lang == "" {
@@ -232,29 +206,13 @@ func (s *Store) Subscribe() (<-chan UIPreferences, func()) {
 	return ch, unsubscribe
 }
 
-// ExistedAtLoad reports whether the backing preferences file was present on
-// disk when the store loaded. It distinguishes a user who ran a prior GUI
-// version from a brand-new OS user with no preferences yet.
-func (s *Store) ExistedAtLoad() bool {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	return s.existedAtLoad
-}
-
 // load reads the file into current. A missing file is not an error (the
 // in-memory default stands); malformed contents return an error.
 func (s *Store) load() error {
-	if _, err := os.Stat(s.path); err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return nil
-		}
-		return fmt.Errorf("stat preferences: %w", err)
+	if _, err := os.Stat(s.path); errors.Is(err, os.ErrNotExist) {
+		return nil
 	}
 
-	s.mu.Lock()
-	s.existedAtLoad = true
-	s.mu.Unlock()
-
 	var loaded UIPreferences
 	if _, err := util.ReadJson(s.path, &loaded); err != nil {
 		return err

client/ui/preferences/store_test.go

@@ -215,46 +215,6 @@ func TestStore_FileShapeIsJSON(t *testing.T) {
 	assert.Equal(t, i18n.LanguageCode("hu"), parsed.Language)
 }
 
-func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
-	withTempConfigDir(t)
-	emitter := &recordingEmitter{}
-	s, err := NewStore(nil, emitter)
-	require.NoError(t, err)
-
-	assert.False(t, s.Get().AutostartInitialized, "marker must default to false when no file is on disk")
-
-	require.NoError(t, s.SetAutostartInitialized(true))
-	assert.True(t, s.Get().AutostartInitialized, "Get should reflect the persisted marker")
-	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first marker write should broadcast")
-
-	// Re-setting the same value must be a no-op: no disk write, no broadcast.
-	require.NoError(t, s.SetAutostartInitialized(true))
-	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent marker write should not broadcast again")
-
-	// A fresh Store (new GUI launch) must see the marker so the autostart
-	// default decision never runs twice.
-	reloaded, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
-}
-
-func TestStore_ExistedAtLoad(t *testing.T) {
-	withTempConfigDir(t)
-
-	// Brand-new OS user: no preferences file on disk yet.
-	fresh, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.False(t, fresh.ExistedAtLoad(), "ExistedAtLoad must be false when no file is on disk")
-
-	// Persisting a value writes the file to disk.
-	require.NoError(t, fresh.SetLanguage("en"))
-
-	// A subsequent GUI launch reopens the now-present file.
-	reopened, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.True(t, reopened.ExistedAtLoad(), "ExistedAtLoad must be true after the store has persisted and is reopened")
-}
-
 func TestStore_ErrUnsupportedSentinel(t *testing.T) {
 	// Verifies callers can match on the sentinel error rather than parsing
 	// strings — protects against accidental %v -> %w changes that would

client/ui/services/connection.go

@@ -35,7 +35,7 @@ type LoginResult struct {
 	VerificationURIComplete string `json:"verificationUriComplete"`
 }
 
-// WaitSSOParams are the inputs to waitSSOLogin.
+// WaitSSOParams are the inputs to WaitSSOLogin.
 type WaitSSOParams struct {
 	UserCode string `json:"userCode"`
 	Hostname string `json:"hostname"`
@@ -125,6 +125,23 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	}, nil
 }
 
+func (s *Connection) WaitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	log.Infof("waiting for SSO login to complete")
+	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
+		UserCode: p.UserCode,
+		Hostname: p.Hostname,
+	})
+	if err != nil {
+		return "", s.classifyDaemonError(err)
+	}
+	log.Infof("SSO login completed, daemon reported success")
+	return resp.GetEmail(), nil
+}
+
 func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -145,27 +162,6 @@ func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	return nil
 }
 
-// WaitSSOLoginAndUp blocks until the SSO login completes and then brings the
-// connection up, both from the Go side. Keeping the post-login Up here rather
-// than as a frontend continuation is deliberate: during SSO the tray window is
-// hidden and the webview is suspended (macOS App Nap / hidden-window timer
-// throttling), so a frontend-driven Up would not run until the user woke the
-// window (e.g. by hovering the tray icon). Doing it in Go connects the moment
-// the daemon reports SSO success. Returns the authenticated user's email.
-func (s *Connection) WaitSSOLoginAndUp(ctx context.Context, wait WaitSSOParams, up UpParams) (string, error) {
-	email, err := s.waitSSOLogin(ctx, wait)
-	if err != nil {
-		return "", err
-	}
-	if err := ctx.Err(); err != nil {
-		return "", err
-	}
-	if err := s.Up(ctx, up); err != nil {
-		return "", err
-	}
-	return email, nil
-}
-
 func (s *Connection) Down(ctx context.Context) error {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -225,26 +221,6 @@ func (s *Connection) Logout(ctx context.Context, p LogoutParams) error {
 	return nil
 }
 
-// waitSSOLogin blocks until the daemon reports the SSO login result and returns
-// the authenticated user's email. It is unexported because the frontend drives
-// SSO through the exported WaitSSOLoginAndUp.
-func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return "", err
-	}
-	log.Infof("waiting for SSO login to complete")
-	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
-		UserCode: p.UserCode,
-		Hostname: p.Hostname,
-	})
-	if err != nil {
-		return "", s.classifyDaemonError(err)
-	}
-	log.Infof("SSO login completed, daemon reported success")
-	return resp.GetEmail(), nil
-}
-
 // classifyDaemonError maps a gRPC error to a localised ClientError.
 func (s *Connection) classifyDaemonError(err error) *ClientError {
 	return s.classifier.classify(err)

client/ui/services/settings.go

@@ -20,12 +20,11 @@ type MDMFields struct {
 	DisableServerRoutes      bool   `json:"disableServerRoutes"`
 	AllowServerSSH           *bool  `json:"allowServerSSH"`
 	DisableAutoConnect       bool   `json:"disableAutoConnect"`
-	DisableAutostart         bool   `json:"disableAutostart"`
 	BlockInbound             bool   `json:"blockInbound"`
 	DisableMetricsCollection bool   `json:"disableMetricsCollection"`
 	SplitTunnelMode          bool   `json:"splitTunnelMode"`
 	SplitTunnelApps          bool   `json:"splitTunnelApps"`
-	DisableAdvancedView      bool   `json:"disableAdvancedView"`
+	DisableAdvancedView bool `json:"disableAdvancedView"`
 }
 
 type Features struct {

go.mod

@@ -96,7 +96,7 @@ require (
 	github.com/pion/transport/v3 v3.1.1
 	github.com/pion/turn/v3 v3.0.1
 	github.com/pires/go-proxyproto v0.11.0
-	github.com/pkg/sftp v1.13.9
+	github.com/pkg/sftp v1.13.10
 	github.com/prometheus/client_golang v1.23.2
 	github.com/quic-go/quic-go v0.55.0
 	github.com/redis/go-redis/v9 v9.7.3

go.sum

@@ -561,8 +561,8 @@ github.com/pires/go-proxyproto v0.11.0/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.13.9 h1:4NGkvGudBL7GteO3m6qnaQ4pC0Kvf0onSVc9gR3EWBw=
-github.com/pkg/sftp v1.13.9/go.mod h1:OBN7bVXdstkFFN/gdnHPUb5TE8eb8G1Rp9wCItqjkkA=
+github.com/pkg/sftp v1.13.10 h1:+5FbKNTe5Z9aspU88DPIKJ9z2KZoaGCu6Sr6kKR/5mU=
+github.com/pkg/sftp v1.13.10/go.mod h1:bJ1a7uDhrX/4OII+agvy28lzRvQrmIQuaHrcI1HbeGA=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -727,11 +727,7 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
 golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
@@ -745,9 +741,6 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
 golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -764,10 +757,7 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
 golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
@@ -780,10 +770,6 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -816,25 +802,16 @@ golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -844,10 +821,7 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
 golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
@@ -861,8 +835,6 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
 golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

management/internals/modules/peers/ephemeral/manager/ephemeral.go

@@ -215,7 +215,7 @@ func (e *EphemeralManager) cleanup(ctx context.Context) {
 	}
 
 	for accountID, peerIDs := range peerIDsPerAccount {
-		log.WithContext(ctx).Debugf("cleanup: deleting %d ephemeral peers for account %s: %s", len(peerIDs), accountID, peerIDs)
+		log.WithContext(ctx).Tracef("cleanup: deleting %d ephemeral peers for account %s", len(peerIDs), accountID)
 		err := e.peersManager.DeletePeers(ctx, accountID, peerIDs, activity.SystemInitiator, true)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to delete ephemeral peers: %s", err)

management/internals/modules/peers/manager.go

@@ -184,8 +184,6 @@ func (m *managerImpl) DeletePeers(ctx context.Context, accountID string, peerIDs
 				return err
 			}
 
-			log.WithContext(ctx).Debugf("DeletePeers: deleted peer %s", peerID)
-
 			if !(peer.ProxyMeta.Embedded || peer.Meta.KernelVersion == "wasm") {
 				eventsToStore = append(eventsToStore, func() {
 					m.accountManager.StoreEvent(ctx, userID, peer.ID, accountID, activity.PeerRemovedByUser, peer.EventMeta(dnsDomain))
@@ -226,6 +224,30 @@ func (m *managerImpl) CreateProxyPeer(ctx context.Context, accountID string, pee
 		return nil
 	}
 
+	// Dedupe stale embedded peer records for the same (account, cluster).
+	// The proxy generates a fresh WireGuard keypair on every startup
+	// (proxy/internal/roundtrip/netbird.go), so without this sweep the
+	// prior embedded peer would linger forever — holding its CGNAT IP
+	// allocation, polluting other peers' rosters, and (most visibly)
+	// leaving the synth DNS pointing at the dead address. The
+	// (account, cluster) tuple identifies "the embedded peer for this
+	// proxy instance at this cluster"; any record matching that tuple
+	// with a different pubkey is by definition stale and must go.
+	staleIDs, err := m.findStaleEmbeddedProxyPeers(ctx, accountID, cluster, peerKey)
+	if err != nil {
+		return fmt.Errorf("scan for stale embedded proxy peers: %w", err)
+	}
+	if len(staleIDs) > 0 {
+		// userID="" + checkConnected=false: the deletion is initiated
+		// by management itself on behalf of the freshly-registering
+		// proxy, not by an end user; the stale peer may still be
+		// marked Connected from its prior session, but its session is
+		// dead by definition (its key no longer exists).
+		if err := m.DeletePeers(ctx, accountID, staleIDs, "", false); err != nil {
+			return fmt.Errorf("delete stale embedded proxy peers %v: %w", staleIDs, err)
+		}
+	}
+
 	name := fmt.Sprintf("proxy-%s", xid.New().String())
 	newPeer := &peer.Peer{
 		Ephemeral: true,
@@ -251,3 +273,29 @@ func (m *managerImpl) CreateProxyPeer(ctx context.Context, accountID string, pee
 
 	return nil
 }
+
+// findStaleEmbeddedProxyPeers returns the peer IDs of embedded proxy peer
+// records in accountID that target the same cluster but carry a different
+// WireGuard pubkey than the freshly-registering one. Used by CreateProxyPeer
+// to garbage-collect stale records left behind when the proxy restarts with a
+// regenerated keypair.
+func (m *managerImpl) findStaleEmbeddedProxyPeers(ctx context.Context, accountID, cluster, newKey string) ([]string, error) {
+	account, err := m.store.GetAccount(ctx, accountID)
+	if err != nil {
+		return nil, err
+	}
+	var stale []string
+	for _, p := range account.Peers {
+		if p == nil || !p.ProxyMeta.Embedded {
+			continue
+		}
+		if p.ProxyMeta.Cluster != cluster {
+			continue
+		}
+		if p.Key == newKey {
+			continue
+		}
+		stale = append(stale, p.ID)
+	}
+	return stale, nil
+}

management/internals/shared/grpc/token_mgr.go

@@ -161,8 +161,6 @@ func (m *TimeBasedAuthSecretsManager) SetupRefresh(ctx context.Context, accountI
 		m.turnCancelMap[peerID] = turnCancel
 		go m.refreshTURNTokens(ctx, accountID, peerID, turnCancel)
 		log.WithContext(ctx).Debugf("starting TURN refresh for %s", peerID)
-	} else {
-		log.WithContext(ctx).Debugf("no TURN configuration, skipping TURN refresh for %s", peerID)
 	}
 
 	if m.relayCfg != nil {
@@ -170,8 +168,6 @@ func (m *TimeBasedAuthSecretsManager) SetupRefresh(ctx context.Context, accountI
 		m.relayCancelMap[peerID] = relayCancel
 		go m.refreshRelayTokens(ctx, accountID, peerID, relayCancel)
 		log.WithContext(ctx).Tracef("starting relay refresh for %s", peerID)
-	} else {
-		log.WithContext(ctx).Tracef("no relay configuration, skipping relay refresh for %s", peerID)
 	}
 }
 

management/server/agentnetwork_proxypeer_restart_test.go

@@ -0,0 +1,199 @@
+package server
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/peers"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	agenttypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// TestAgentNetwork_ProxyRestart_PropagatesNewPeerAndDropsStale is the no-mock
+// regression guard for the bug the user reported: restarting the proxy creates
+// a fresh embedded peer with a NEW WireGuard public key (the proxy generates
+// the keypair on every startup at proxy/internal/roundtrip/netbird.go:312).
+// The PRIOR embedded peer record is never deleted on management, so the
+// account accumulates a stale peer holding a stale CGNAT IP. Other peers
+// in the account either keep routing to the dead IP, or — if synth DNS
+// picks the wrong record — never see the new IP at all.
+//
+// What this test exercises (no mocks):
+//   - real SQLite test store
+//   - real DefaultAccountManager, network-map controller, peer-update channels
+//   - real peers.Manager.CreateProxyPeer path (the very method the proxy
+//     invokes over gRPC on every startup)
+//   - real agentnetwork.Manager + synth chain so the client receives a
+//     concrete DNS record that must point at the LATEST proxy peer.
+//
+// Pre-fix expected behavior (red): two embedded peers exist after the
+// "restart"; the synth DNS record points at the stale one; the client
+// receives an update reflecting the new peer but the old one lingers.
+// Post-fix expected behavior (green): exactly one embedded peer exists
+// after restart (with the new key) AND the client's network map carries
+// the synth DNS pointing at that new peer's CGNAT IP.
+func TestAgentNetwork_ProxyRestart_PropagatesNewPeerAndDropsStale(t *testing.T) {
+	am, updateManager, err := createManager(t)
+	require.NoError(t, err, "createManager must succeed")
+	ctx := context.Background()
+
+	const (
+		accountID   = "an-restart-acct"
+		adminUserID = "an-restart-admin"
+		groupAID    = "an-restart-grp-A"
+		clusterAddr = "eu.proxy.netbird.io"
+		clientKey   = "BhRPtynAAYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
+		// Two different proxy pubkeys — the "before" and "after" of a
+		// proxy-process restart with fresh-keypair generation.
+		proxyKey1 = "Aaaaa1aaaaYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
+		proxyKey2 = "Bbbbb2bbbbYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
+	)
+
+	// --- Account scaffold ---
+	account := newAccountWithId(ctx, accountID, adminUserID, "an-restart.test", "", "", false)
+	require.NoError(t, am.Store.SaveAccount(ctx, account))
+
+	clientPeer := &nbpeer.Peer{
+		Key:      clientKey,
+		Name:     "an-restart-client",
+		DNSLabel: "an-restart-client",
+		Meta:     nbpeer.PeerSystemMeta{Hostname: "an-restart-client", GoOS: "linux", WtVersion: "development"},
+	}
+	addedClient, _, _, _, err := am.AddPeer(ctx, "", "", adminUserID, clientPeer, false)
+	require.NoError(t, err, "AddPeer for client must succeed")
+	require.NoError(t, am.MarkPeerConnected(ctx, clientKey, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
+		"MarkPeerConnected for the client peer must succeed (affected-peer fan-out skips disconnected peers)")
+
+	// Place the client in group A so the synth policy reaches it.
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	account.Groups[groupAID] = &types.Group{ID: groupAID, Name: "groupA", Peers: []string{addedClient.ID}}
+	require.NoError(t, am.Store.SaveAccount(ctx, account), "SaveAccount must persist group A")
+
+	// --- Real peers + agent-network managers ---
+	permMgr := permissions.NewManager(am.Store)
+	peersMgr := peers.NewManager(am.Store, permMgr)
+	peersMgr.SetAccountManager(am)
+	peersMgr.SetNetworkMapController(am.networkMapController)
+	agentMgr := agentnetwork.NewManager(am.Store, permMgr, am, nil)
+
+	// Subscribe BEFORE any state-mutating call so we don't lose the update
+	// that contains the synth DNS record.
+	clientCh := updateManager.CreateChannel(ctx, addedClient.ID)
+	t.Cleanup(func() { updateManager.CloseChannel(ctx, addedClient.ID) })
+	drain(clientCh)
+
+	// --- First proxy startup: register peer key K1, then mark it
+	// connected. In production the proxy follows CreateProxyPeer with the
+	// regular sync stream which lands on MarkPeerConnected; the synth DNS
+	// path filters out peers that aren't Connected (types/account.go:323),
+	// so without this step no DNS record would be emitted.
+	require.NoError(t, peersMgr.CreateProxyPeer(ctx, accountID, proxyKey1, clusterAddr),
+		"first CreateProxyPeer (proxy startup) must succeed")
+
+	peer1ID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey1)
+	require.NoError(t, err, "proxy peer for K1 must be persisted after CreateProxyPeer")
+	require.NotEmpty(t, peer1ID)
+
+	require.NoError(t, am.MarkPeerConnected(ctx, proxyKey1, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
+		"MarkPeerConnected for K1 must succeed")
+
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	proxyIP1 := account.Peers[peer1ID].IP.String()
+	require.NotEmpty(t, proxyIP1, "K1 must have an assigned overlay IP")
+
+	// --- Provider + policy. CreateProvider / CreatePolicy trigger the
+	// agentnetwork reconcile which runs UpdateAccountPeers; the resulting
+	// NetworkMap delivered to the client carries the synth DNS record
+	// pointing at K1's IP. ---
+	provider, err := agentMgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
+		AccountID:   accountID,
+		ProviderID:  "openai_api",
+		Name:        "openai-test",
+		UpstreamURL: "https://api.openai.com",
+		APIKey:      "sk-test-key",
+		Enabled:     true,
+		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
+	}, clusterAddr)
+	require.NoError(t, err, "CreateProvider must succeed")
+
+	_, err = agentMgr.CreatePolicy(ctx, adminUserID, &agenttypes.Policy{
+		AccountID:              accountID,
+		Name:                   "p1",
+		Enabled:                true,
+		SourceGroups:           []string{groupAID},
+		DestinationProviderIDs: []string{provider.ID},
+	})
+	require.NoError(t, err, "CreatePolicy must succeed")
+
+	settings, err := am.Store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	fqdn := settings.Endpoint()
+
+	rdata1 := awaitZoneRData(clientCh, clusterAddr, fqdn, true)
+	require.Equal(t, proxyIP1, rdata1,
+		"client must receive a synth DNS record pointing at K1's overlay IP after the synth path runs")
+	drain(clientCh)
+
+	// --- Proxy restart: NEW keypair K2, same account, same cluster ---
+	require.NoError(t, peersMgr.CreateProxyPeer(ctx, accountID, proxyKey2, clusterAddr),
+		"second CreateProxyPeer (proxy restart with fresh keypair) must succeed")
+
+	peer2ID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey2)
+	require.NoError(t, err, "proxy peer for K2 must be persisted after restart")
+	require.NotEmpty(t, peer2ID)
+
+	require.NoError(t, am.MarkPeerConnected(ctx, proxyKey2, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
+		"MarkPeerConnected for K2 must succeed")
+
+	// In production the agent's sync stream pulls a fresh NetworkMap as
+	// part of its normal reconcile cadence; in this isolated test
+	// MarkPeerConnected's affected-peer fan-out can race the channel-side
+	// buffer in a way that swallows the synth-DNS-bearing update before
+	// our await reads it. Trigger an explicit account-wide fan-out so the
+	// assertion below tests what production actually delivers, not the
+	// in-test buffer race.
+	am.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourcePeer, Operation: types.UpdateOperationUpdate})
+
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	proxyIP2 := account.Peers[peer2ID].IP.String()
+	require.NotEmpty(t, proxyIP2, "K2 must have an assigned overlay IP")
+	require.NotEqual(t, proxyIP1, proxyIP2, "K2 must get a different overlay IP than K1 (sanity)")
+
+	// CRITICAL ASSERTION 1: K1 must no longer be in the store. The SqlStore
+	// returns ("", nil) for a missing key rather than NotFound, so assert
+	// on the returned ID being empty.
+	staleID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey1)
+	require.NoError(t, err, "GetPeerIDByKey for a missing peer must not error")
+	assert.Empty(t, staleID,
+		"stale embedded proxy peer K1 must be removed when a new embedded peer registers for the same (account, cluster); pre-fix this assertion fails because management never cleans up the prior peer record")
+
+	// CRITICAL ASSERTION 2: exactly one embedded proxy peer remains, and it
+	// is K2.
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	embeddedKeys := []string{}
+	for _, p := range account.Peers {
+		if p.ProxyMeta.Embedded {
+			embeddedKeys = append(embeddedKeys, p.Key)
+		}
+	}
+	assert.Equal(t, []string{proxyKey2}, embeddedKeys,
+		"after a proxy restart exactly one embedded proxy peer should remain — the one with the new key K2")
+
+	// CRITICAL ASSERTION 3: the synth DNS record the client receives now
+	// points at K2's IP, not K1's.
+	rdata2 := awaitZoneRData(clientCh, clusterAddr, fqdn, true)
+	assert.Equal(t, proxyIP2, rdata2,
+		"after proxy restart, the client's synth DNS record must point at the NEW embedded peer's IP, not the stale K1 IP")
+}

management/server/http/handlers/accounts/accounts_handler.go

@@ -286,21 +286,6 @@ func (h *handler) updateAccountRequestSettings(req api.PutApiAccountsAccountIdJS
 	if req.Settings.MetricsPushEnabled != nil {
 		returnSettings.MetricsPushEnabled = *req.Settings.MetricsPushEnabled
 	}
-	if req.Settings.AgentNetworkOnly != nil {
-		returnSettings.AgentNetworkOnly = *req.Settings.AgentNetworkOnly
-	}
-	if req.Settings.DashboardFeatures != nil {
-		returnSettings.DashboardFeatures = &types.DashboardFeatures{
-			AgentNetwork: req.Settings.DashboardFeatures.AgentNetwork,
-		}
-	}
-
-	if returnSettings.AgentNetworkOnly &&
-		(returnSettings.DashboardFeatures == nil ||
-			returnSettings.DashboardFeatures.AgentNetwork == nil ||
-			!*returnSettings.DashboardFeatures.AgentNetwork) {
-		return nil, status.Errorf(status.InvalidArgument, "agent network only mode requires dashboard_features.agent_network to be enabled")
-	}
 
 	return returnSettings, nil
 }
@@ -432,7 +417,6 @@ func toAccountResponse(accountID string, settings *types.Settings, meta *types.A
 		AutoUpdateAlways:                &settings.AutoUpdateAlways,
 		Ipv6EnabledGroups:               &settings.IPv6EnabledGroups,
 		MetricsPushEnabled:              &settings.MetricsPushEnabled,
-		AgentNetworkOnly:                &settings.AgentNetworkOnly,
 		EmbeddedIdpEnabled:              &settings.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               &settings.LocalAuthDisabled,
 		LocalMfaEnabled:                 &settings.LocalMfaEnabled,
@@ -446,11 +430,6 @@ func toAccountResponse(accountID string, settings *types.Settings, meta *types.A
 		networkRangeV6Str := settings.NetworkRangeV6.String()
 		apiSettings.NetworkRangeV6 = &networkRangeV6Str
 	}
-	if settings.DashboardFeatures != nil {
-		apiSettings.DashboardFeatures = &api.AccountDashboardFeatures{
-			AgentNetwork: settings.DashboardFeatures.AgentNetwork,
-		}
-	}
 
 	apiOnboarding := api.AccountOnboarding{
 		OnboardingFlowPending: onboarding.OnboardingFlowPending,

management/server/http/handlers/accounts/accounts_handler_test.go

@@ -130,7 +130,6 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
-				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -159,7 +158,6 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
-				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -188,7 +186,6 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr("latest"),
 				MetricsPushEnabled:              br(false),
-				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -217,7 +214,6 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
-				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -246,7 +242,6 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
-				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -275,109 +270,6 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
 				MetricsPushEnabled:              br(false),
-				AgentNetworkOnly:                br(false),
-				EmbeddedIdpEnabled:              br(false),
-				LocalAuthDisabled:               br(false),
-				LocalMfaEnabled:                 br(false),
-			},
-			expectedArray: false,
-			expectedID:    accountID,
-		},
-		{
-			name:           "PutAccount OK enabling agent_network_only",
-			expectedBody:   true,
-			requestType:    http.MethodPut,
-			requestPath:    "/api/accounts/" + accountID,
-			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": true,\"dashboard_features\": {\"agent_network\": true}},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
-			expectedStatus: http.StatusOK,
-			expectedSettings: api.AccountSettings{
-				PeerLoginExpiration:             15552000,
-				PeerLoginExpirationEnabled:      true,
-				GroupsPropagationEnabled:        br(false),
-				JwtGroupsClaimName:              sr(""),
-				JwtGroupsEnabled:                br(false),
-				JwtAllowGroups:                  &[]string{},
-				RegularUsersViewBlocked:         false,
-				RoutingPeerDnsResolutionEnabled: br(false),
-				LazyConnectionEnabled:           br(false),
-				DnsDomain:                       sr(""),
-				AutoUpdateAlways:                br(false),
-				AutoUpdateVersion:               sr(""),
-				MetricsPushEnabled:              br(false),
-				AgentNetworkOnly:                br(true),
-				DashboardFeatures: &api.AccountDashboardFeatures{
-					AgentNetwork: br(true),
-				},
-				EmbeddedIdpEnabled: br(false),
-				LocalAuthDisabled:  br(false),
-				LocalMfaEnabled:    br(false),
-			},
-			expectedArray: false,
-			expectedID:    accountID,
-		},
-		{
-			name:           "PutAccount fails enabling agent_network_only without dashboard_features",
-			expectedBody:   true,
-			requestType:    http.MethodPut,
-			requestPath:    "/api/accounts/" + accountID,
-			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": true},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
-			expectedStatus: http.StatusUnprocessableEntity,
-			expectedArray:  false,
-		},
-		{
-			name:           "PutAccount OK setting dashboard_features agent_network",
-			expectedBody:   true,
-			requestType:    http.MethodPut,
-			requestPath:    "/api/accounts/" + accountID,
-			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"dashboard_features\": {\"agent_network\": true}},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
-			expectedStatus: http.StatusOK,
-			expectedSettings: api.AccountSettings{
-				PeerLoginExpiration:             15552000,
-				PeerLoginExpirationEnabled:      true,
-				GroupsPropagationEnabled:        br(false),
-				JwtGroupsClaimName:              sr(""),
-				JwtGroupsEnabled:                br(false),
-				JwtAllowGroups:                  &[]string{},
-				RegularUsersViewBlocked:         false,
-				RoutingPeerDnsResolutionEnabled: br(false),
-				LazyConnectionEnabled:           br(false),
-				DnsDomain:                       sr(""),
-				AutoUpdateAlways:                br(false),
-				AutoUpdateVersion:               sr(""),
-				MetricsPushEnabled:              br(false),
-				AgentNetworkOnly:                br(false),
-				DashboardFeatures: &api.AccountDashboardFeatures{
-					AgentNetwork: br(true),
-				},
-				EmbeddedIdpEnabled: br(false),
-				LocalAuthDisabled:  br(false),
-				LocalMfaEnabled:    br(false),
-			},
-			expectedArray: false,
-			expectedID:    accountID,
-		},
-		{
-			name:           "PutAccount OK disabling agent_network_only again",
-			expectedBody:   true,
-			requestType:    http.MethodPut,
-			requestPath:    "/api/accounts/" + accountID,
-			requestBody:    bytes.NewBufferString("{\"settings\": {\"peer_login_expiration\": 15552000,\"peer_login_expiration_enabled\": true,\"agent_network_only\": false},\"onboarding\": {\"onboarding_flow_pending\": true,\"signup_form_pending\": true}}"),
-			expectedStatus: http.StatusOK,
-			expectedSettings: api.AccountSettings{
-				PeerLoginExpiration:             15552000,
-				PeerLoginExpirationEnabled:      true,
-				GroupsPropagationEnabled:        br(false),
-				JwtGroupsClaimName:              sr(""),
-				JwtGroupsEnabled:                br(false),
-				JwtAllowGroups:                  &[]string{},
-				RegularUsersViewBlocked:         false,
-				RoutingPeerDnsResolutionEnabled: br(false),
-				LazyConnectionEnabled:           br(false),
-				DnsDomain:                       sr(""),
-				AutoUpdateAlways:                br(false),
-				AutoUpdateVersion:               sr(""),
-				MetricsPushEnabled:              br(false),
-				AgentNetworkOnly:                br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),

management/server/peer.go

@@ -106,13 +106,11 @@ func (am *DefaultAccountManager) MarkPeerConnected(ctx context.Context, peerPubK
 	}
 	if !updated {
 		am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusConnect, telemetry.PeerStatusStale)
-		log.WithContext(ctx).Debugf("peer %s already has a newer session in store, skipping connect", peer.ID)
+		log.WithContext(ctx).Tracef("peer %s already has a newer session in store, skipping connect", peer.ID)
 		return nil
 	}
 	am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusConnect, telemetry.PeerStatusApplied)
 
-	log.WithContext(ctx).Debugf("mark peer %s connected", peer.ID)
-
 	if err = am.schedulePeerExpirations(ctx, accountID, peer); err != nil {
 		return err
 	}
@@ -182,14 +180,12 @@ func (am *DefaultAccountManager) MarkPeerDisconnected(ctx context.Context, peerP
 	}
 	if !updated {
 		am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusDisconnect, telemetry.PeerStatusStale)
-		log.WithContext(ctx).Debugf("peer %s session token mismatch on disconnect (token=%d), skipping",
+		log.WithContext(ctx).Tracef("peer %s session token mismatch on disconnect (token=%d), skipping",
 			peer.ID, sessionStartedAt)
 		return nil
 	}
 	am.metrics.AccountManagerMetrics().CountPeerStatusUpdate(telemetry.PeerStatusDisconnect, telemetry.PeerStatusApplied)
 
-	log.WithContext(ctx).Debugf("mark peer %s disconnected", peer.ID)
-
 	// Symmetric with MarkPeerConnected: when an embedded proxy peer goes
 	// offline, refresh the peers that had synthesized records pointing at
 	// it so they pull the stale entries instead of waiting out TTL.

management/server/store/sql_store.go

@@ -1605,8 +1605,7 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 			settings_jwt_groups_enabled, settings_jwt_groups_claim_name, settings_jwt_allow_groups,
 			settings_routing_peer_dns_resolution_enabled, settings_dns_domain, settings_network_range,
 			settings_network_range_v6, settings_ipv6_enabled_groups, settings_lazy_connection_enabled,
-			settings_local_mfa_enabled, settings_metrics_push_enabled, settings_agent_network_only,
-			settings_dashboard_features,
+			settings_local_mfa_enabled, settings_metrics_push_enabled,
 			-- Embedded ExtraSettings
 			settings_extra_peer_approval_enabled, settings_extra_user_approval_required,
 			settings_extra_integrated_validator, settings_extra_integrated_validator_groups
@@ -1630,8 +1629,6 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 		sLazyConnectionEnabled           sql.NullBool
 		sLocalMFAEnabled                 sql.NullBool
 		sMetricsPushEnabled              sql.NullBool
-		sAgentNetworkOnly                sql.NullBool
-		sDashboardFeatures               sql.NullString
 		sExtraPeerApprovalEnabled        sql.NullBool
 		sExtraUserApprovalRequired       sql.NullBool
 		sExtraIntegratedValidator        sql.NullString
@@ -1654,8 +1651,7 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 		&sJWTGroupsEnabled, &sJWTGroupsClaimName, &sJWTAllowGroups,
 		&sRoutingPeerDNSResolutionEnabled, &sDNSDomain, &sNetworkRange,
 		&sNetworkRangeV6, &sIPv6EnabledGroups, &sLazyConnectionEnabled,
-		&sLocalMFAEnabled, &sMetricsPushEnabled, &sAgentNetworkOnly,
-		&sDashboardFeatures,
+		&sLocalMFAEnabled, &sMetricsPushEnabled,
 		&sExtraPeerApprovalEnabled, &sExtraUserApprovalRequired,
 		&sExtraIntegratedValidator, &sExtraIntegratedValidatorGroups,
 	)
@@ -1724,14 +1720,6 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 	if sMetricsPushEnabled.Valid {
 		account.Settings.MetricsPushEnabled = sMetricsPushEnabled.Bool
 	}
-	if sAgentNetworkOnly.Valid {
-		account.Settings.AgentNetworkOnly = sAgentNetworkOnly.Bool
-	}
-	if sDashboardFeatures.Valid && sDashboardFeatures.String != "" {
-		if err := json.Unmarshal([]byte(sDashboardFeatures.String), &account.Settings.DashboardFeatures); err != nil {
-			log.WithContext(ctx).Warnf("failed to unmarshal dashboard features for account %s: %v", accountID, err)
-		}
-	}
 	if sJWTAllowGroups.Valid {
 		_ = json.Unmarshal([]byte(sJWTAllowGroups.String), &account.Settings.JWTAllowGroups)
 	}

management/server/store/sql_store_test.go

@@ -1245,61 +1245,6 @@ func TestSqlite_CreateAndGetObjectInTransaction(t *testing.T) {
 	assert.NoError(t, err)
 }
 
-func TestSqlStore_SaveAccountPersistsAgentNetworkOnly(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	account, err := store.GetAccount(context.Background(), accountID)
-	require.NoError(t, err)
-	require.False(t, account.Settings.AgentNetworkOnly, "setting should default to false")
-
-	account.Settings.AgentNetworkOnly = true
-	require.NoError(t, store.SaveAccount(context.Background(), account))
-
-	reloaded, err := store.GetAccount(context.Background(), accountID)
-	require.NoError(t, err)
-	require.True(t, reloaded.Settings.AgentNetworkOnly, "setting should survive a save/load round-trip")
-
-	reloaded.Settings.AgentNetworkOnly = false
-	require.NoError(t, store.SaveAccount(context.Background(), reloaded))
-
-	disabled, err := store.GetAccount(context.Background(), accountID)
-	require.NoError(t, err)
-	require.False(t, disabled.Settings.AgentNetworkOnly, "disabling should persist")
-}
-
-func TestSqlStore_SaveAccountPersistsDashboardFeatures(t *testing.T) {
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/store.sql", t.TempDir())
-	t.Cleanup(cleanup)
-	require.NoError(t, err)
-
-	accountID := "bf1c8084-ba50-4ce7-9439-34653001fc3b"
-	account, err := store.GetAccount(context.Background(), accountID)
-	require.NoError(t, err)
-	require.Nil(t, account.Settings.DashboardFeatures, "dashboard features should default to unset")
-
-	agentNetwork := true
-	account.Settings.DashboardFeatures = &types.DashboardFeatures{AgentNetwork: &agentNetwork}
-	require.NoError(t, store.SaveAccount(context.Background(), account))
-
-	reloaded, err := store.GetAccount(context.Background(), accountID)
-	require.NoError(t, err)
-	require.NotNil(t, reloaded.Settings.DashboardFeatures, "dashboard features should survive a save/load round-trip")
-	require.NotNil(t, reloaded.Settings.DashboardFeatures.AgentNetwork, "agent network flag should be set")
-	require.True(t, *reloaded.Settings.DashboardFeatures.AgentNetwork, "agent network flag should persist as true")
-
-	disabled := false
-	reloaded.Settings.DashboardFeatures = &types.DashboardFeatures{AgentNetwork: &disabled}
-	require.NoError(t, store.SaveAccount(context.Background(), reloaded))
-
-	reloadedDisabled, err := store.GetAccount(context.Background(), accountID)
-	require.NoError(t, err)
-	require.NotNil(t, reloadedDisabled.Settings.DashboardFeatures.AgentNetwork, "agent network flag should remain set")
-	require.False(t, *reloadedDisabled.Settings.DashboardFeatures.AgentNetwork, "explicit false should persist")
-}
-
 func TestSqlStore_GetAccountUsers(t *testing.T) {
 	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "../testdata/extended-store.sql", t.TempDir())
 	t.Cleanup(cleanup)

management/server/types/settings.go

@@ -76,15 +76,6 @@ type Settings struct {
 	// MetricsPushEnabled globally enables or disables client metrics push for the account
 	MetricsPushEnabled bool `gorm:"default:false"`
 
-	// AgentNetworkOnly limits the dashboard to the Agent Network surface for this account.
-	// Set for accounts created via netbird.ai signups; users can disable it later.
-	AgentNetworkOnly bool `gorm:"default:false"`
-
-	// DashboardFeatures holds per-account dashboard section visibility overrides.
-	// It serializes to a single JSON column so new sections can be added without
-	// a schema change.
-	DashboardFeatures *DashboardFeatures `gorm:"serializer:json"`
-
 	// EmbeddedIdpEnabled indicates if the embedded identity provider is enabled.
 	// This is a runtime-only field, not stored in the database.
 	EmbeddedIdpEnabled bool `gorm:"-"`
@@ -123,7 +114,6 @@ func (s *Settings) Copy() *Settings {
 		AutoUpdateAlways:                s.AutoUpdateAlways,
 		IPv6EnabledGroups:               slices.Clone(s.IPv6EnabledGroups),
 		MetricsPushEnabled:              s.MetricsPushEnabled,
-		AgentNetworkOnly:                s.AgentNetworkOnly,
 		EmbeddedIdpEnabled:              s.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               s.LocalAuthDisabled,
 		LocalMfaEnabled:                 s.LocalMfaEnabled,
@@ -131,31 +121,9 @@ func (s *Settings) Copy() *Settings {
 	if s.Extra != nil {
 		settings.Extra = s.Extra.Copy()
 	}
-	if s.DashboardFeatures != nil {
-		settings.DashboardFeatures = s.DashboardFeatures.Copy()
-	}
 	return settings
 }
 
-// DashboardFeatures holds per-account dashboard section visibility overrides.
-// Nil fields are unset and follow the default dashboard behavior; an explicit
-// value forces that section shown or hidden for the account.
-type DashboardFeatures struct {
-	// AgentNetwork, when set, forces the Agent Network menu shown (true) or
-	// hidden (false) regardless of the deployment feature flag.
-	AgentNetwork *bool `json:"agent_network,omitempty"`
-}
-
-// Copy returns a deep copy of the DashboardFeatures struct.
-func (d *DashboardFeatures) Copy() *DashboardFeatures {
-	c := &DashboardFeatures{}
-	if d.AgentNetwork != nil {
-		v := *d.AgentNetwork
-		c.AgentNetwork = &v
-	}
-	return c
-}
-
 type ExtraSettings struct {
 	// PeerApprovalEnabled enables or disables the need for peers bo be approved by an administrator
 	PeerApprovalEnabled bool

shared/management/http/api/openapi.yml

@@ -375,12 +375,6 @@ components:
           description: Enables or disables client metrics push for all peers in the account
           type: boolean
           example: false
-        agent_network_only:
-          description: Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later. Enabling this requires dashboard_features.agent_network to be true in the same request.
-          type: boolean
-          example: false
-        dashboard_features:
-          $ref: '#/components/schemas/AccountDashboardFeatures'
         embedded_idp_enabled:
           description: Indicates whether the embedded identity provider (Dex) is enabled for this account. This is a read-only field.
           type: boolean
@@ -409,14 +403,6 @@ components:
         - regular_users_view_blocked
         - peer_expose_enabled
         - peer_expose_groups
-    AccountDashboardFeatures:
-      description: Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
-      type: object
-      properties:
-        agent_network:
-          description: Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies. Must be true when agent_network_only is enabled.
-          type: boolean
-          example: true
     AccountExtraSettings:
       type: object
       properties:
@@ -10504,7 +10490,7 @@ paths:
         - EDR Intune Integrations
       summary: Delete EDR Intune Integration
       description: Deletes an EDR Intune Integration by its ID.
-      operationId: deleteEDRIntuneIntegration
+      operationId: deleteIntegration
       responses:
         '200':
           description: Integration deleted successfully. Returns an empty object.
@@ -12588,7 +12574,7 @@ paths:
         - Event Streaming Integrations
       summary: Delete Event Streaming Integration
       description: Deletes an event streaming integration by its ID.
-      operationId: deleteEventStreamingIntegration
+      operationId: deleteIntegration
       responses:
         '200':
           description: Integration deleted successfully. Returns an empty object.

shared/management/http/api/types.gen.go

@@ -1612,12 +1612,6 @@ type Account struct {
 	Settings   AccountSettings   `json:"settings"`
 }
 
-// AccountDashboardFeatures Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
-type AccountDashboardFeatures struct {
-	// AgentNetwork Controls the Agent Network menu for the account regardless of the deployment feature flag. When true the menu is shown, when false it is hidden, and when omitted the default behavior applies. Must be true when agent_network_only is enabled.
-	AgentNetwork *bool `json:"agent_network,omitempty"`
-}
-
 // AccountExtraSettings defines model for AccountExtraSettings.
 type AccountExtraSettings struct {
 	// NetworkTrafficLogsEnabled Enables or disables network traffic logging. If enabled, all network traffic events from peers will be stored.
@@ -1653,18 +1647,12 @@ type AccountRequest struct {
 
 // AccountSettings defines model for AccountSettings.
 type AccountSettings struct {
-	// AgentNetworkOnly Limits the dashboard to the Agent Network surface for this account. Set for accounts created via netbird.ai signups and can be disabled later. Enabling this requires dashboard_features.agent_network to be true in the same request.
-	AgentNetworkOnly *bool `json:"agent_network_only,omitempty"`
-
 	// AutoUpdateAlways When true, updates are installed automatically in the background. When false, updates require user interaction from the UI.
 	AutoUpdateAlways *bool `json:"auto_update_always,omitempty"`
 
 	// AutoUpdateVersion Set Clients auto-update version. "latest", "disabled", or a specific version (e.g "0.50.1")
 	AutoUpdateVersion *string `json:"auto_update_version,omitempty"`
 
-	// DashboardFeatures Per-account dashboard section visibility overrides. Omitted keys follow the default dashboard behavior.
-	DashboardFeatures *AccountDashboardFeatures `json:"dashboard_features,omitempty"`
-
 	// DnsDomain Allows to define a custom dns domain for the account
 	DnsDomain *string `json:"dns_domain,omitempty"`
 

shared/relay/client/early_msg_buffer.go

@@ -10,7 +10,7 @@ import (
 
 const (
 	earlyMsgTTL      = 5 * time.Second
-	earlyMsgCapacity = 10000
+	earlyMsgCapacity = 1000
 )
 
 // earlyMsgBuffer buffers transport messages that arrive before the corresponding