Add allow_match toggle and browser-detected country to reverse proxy access rules

.eslintrc.json

@@ -0,0 +1,13 @@
+{
+  "extends": ["next/core-web-vitals","prettier"],
+  "plugins": ["simple-import-sort"],
+  "rules": {
+    "simple-import-sort/imports": [
+      "warn",
+      {
+        "groups": [["^\\u0000", "^@?\\w", "^[^.]", "^\\."]]
+      }
+    ],
+    "simple-import-sort/exports": "warn"
+  }
+}

.github/workflows/build_and_push.yml

@@ -99,14 +99,12 @@ jobs:
             type=sha
 
       - name: Log in to Docker Hub
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.NB_DOCKER_USER }}
           password: ${{ secrets.NB_DOCKER_TOKEN }}
 
       - name: Log in to the GitHub Container registry
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -118,12 +116,11 @@ jobs:
         with:
           context: .
           file: docker/Dockerfile
-          push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+          push: true
           platforms: linux/amd64,linux/arm64,linux/arm
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
-      - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        run: |
+      - run: |
           echo '### Pushed tags' >> $GITHUB_STEP_SUMMARY
           echo '${{ steps.meta.outputs.tags }}' >> $GITHUB_STEP_SUMMARY

.github/workflows/bump-netbird.yml

@@ -1,81 +0,0 @@
-name: Bump netbird wasm client
-
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'NetBird release tag (e.g. v0.78.0)'
-        required: true
-        type: string
-
-concurrency:
-  group: ${{ github.workflow }}-${{ inputs.tag }}
-  cancel-in-progress: false
-
-jobs:
-  bump:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: main
-          token: ${{ secrets.NETBIRD_DEV_BOT_GITHUB_TOKEN }}
-
-      - name: Configure git
-        run: |
-          git config --global user.email "dev@netbird.io"
-          git config --global user.name "netbirddev"
-
-      # The tag rides in env and is validated before use, so a crafted dispatch
-      # input cannot expand into shell source or reach the sed expression.
-      - name: Update the default wasm path
-        id: bump
-        env:
-          TAG: ${{ inputs.tag }}
-        run: |
-          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Refusing tag '$TAG': expected vMAJOR.MINOR.PATCH"
-            exit 1
-          fi
-
-          sed -i "s|https://pkgs.netbird.io/wasm/client/v[0-9.]*|https://pkgs.netbird.io/wasm/client/${TAG}|" src/utils/config.ts
-
-          branch="bump-netbird-wasm-${TAG#v}"
-          echo "branch=${branch}" >> "$GITHUB_OUTPUT"
-
-          # The branch name is derived from the tag, so a re-dispatch of the
-          # same release would collide with the branch and pull request an
-          # earlier run left behind.
-          if git ls-remote --exit-code --heads origin "${branch}" >/dev/null 2>&1; then
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            echo "Branch ${branch} already exists, ${TAG} was handled by an earlier run"
-            exit 0
-          fi
-
-          git checkout -b "${branch}"
-          git add src/utils/config.ts
-          if git diff --cached --quiet; then
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            echo "Default wasm path already at ${TAG}, nothing to do"
-            exit 0
-          fi
-          echo "skip=false" >> "$GITHUB_OUTPUT"
-          git commit -m "Bump the WASM client to ${TAG}"
-          git push --set-upstream origin "${branch}"
-
-      - name: Create pull request
-        if: steps.bump.outputs.skip != 'true'
-        env:
-          GH_TOKEN: ${{ secrets.NETBIRD_DEV_BOT_GITHUB_TOKEN }}
-          TAG: ${{ inputs.tag }}
-          BRANCH: ${{ steps.bump.outputs.branch }}
-        run: |
-          gh pr create \
-            --base main \
-            --head "$BRANCH" \
-            --title "Bump the WASM client to ${TAG}" \
-            --body "Automated wasm path bump triggered by netbird release ${TAG}."

.github/workflows/e2e-test.yml

@@ -101,61 +101,17 @@ jobs:
           echo "Using reverse-proxy tag: $TAG"
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
-      - name: Restore geolocation database cache
-        id: geo-cache
-        uses: actions/cache/restore@v4
-        with:
-          path: e2e/environment/geo-cache
-          key: geolite-dbs-v1
-
-      - name: Build dashboard and set up test environment
+      - name: Setup test environment
         env:
           MANAGEMENT_IMAGE_TAG: ${{ steps.management_tag.outputs.tag }}
           REVERSE_PROXY_IMAGE_TAG: ${{ steps.reverse_proxy_tag.outputs.tag }}
-        # The docker environment (image pulls, Zitadel bootstrap) is
-        # network-bound and the Next build is CPU-bound, so they overlap.
-        # The build reads .test-config.json via the @/config/test alias,
-        # and create-test-env.sh renders that file only after the Zitadel
-        # bootstrap — so the build waits for it before starting.
-        run: |
-          (cd ./e2e/environment && bash create-test-env.sh) > env-setup.log 2>&1 &
-          ENV_PID=$!
-          until [ -s .test-config.json ] && jq empty .test-config.json 2>/dev/null; do
-            if ! kill -0 "$ENV_PID" 2>/dev/null; then break; fi
-            sleep 2
-          done
-          if ! [ -s .test-config.json ]; then
-            echo "::error::create-test-env.sh exited before rendering .test-config.json"
-            cat env-setup.log
-            exit 1
-          fi
-          # Lowest CPU priority: the containers must win the scheduler, or
-          # the build can starve management past the proxy-registration wait.
-          if ! nice -n 19 env APP_ENV=test npx next build; then
-            kill "$ENV_PID" 2>/dev/null || true
-            exit 1
-          fi
-          if ! wait "$ENV_PID"; then
-            echo "::error::Test environment setup failed"
-            cat env-setup.log
-            exit 1
-          fi
-          cat env-setup.log
-
-      # Saved right after env setup rather than in a post step, so a later
-      # test failure doesn't lose the cache.
-      - name: Save geolocation database cache
-        if: always() && steps.geo-cache.outputs.cache-hit != 'true' && hashFiles('e2e/environment/geo-cache/**') != ''
-        uses: actions/cache/save@v4
-        with:
-          path: e2e/environment/geo-cache
-          key: geolite-dbs-v1
+        run: cd ./e2e/environment && bash create-test-env.sh
 
       - name: Run Playwright tests
         id: playwright
         run: |
           set -o pipefail
-          npx playwright test --config=e2e/playwright.config.ts 2>&1 | tee playwright-output.log
+          npm run test:ci 2>&1 | tee playwright-output.log
 
       - name: Append Playwright summary to job summary
         if: always() && hashFiles('e2e/test-results/results.json') != ''

.github/workflows/unit-tests.yml

@@ -1,32 +0,0 @@
-name: Unit Tests
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-# Cancel superseded runs on the same ref so a new push doesn't queue behind an
-# outdated one (mirrors build_and_push.yml).
-concurrency:
-  group: unit-tests-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  vitest:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: setup-node
-        uses: actions/setup-node@v5
-        with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run unit tests
-        run: npm run test:unit

.gitignore

@@ -44,7 +44,6 @@ e2e/test-results/
 e2e/playwright-report/
 /test-results/
 /playwright-report/
-playwright-report*.zip
 .configs/.local-config.zitadel.json
 .configs/.staging-config.json
 .configs/.temp-config.json

docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.24
+FROM alpine:3.14
 
 RUN apk add --no-cache bash curl less ca-certificates git tzdata zip gettext \
     nginx curl supervisor certbot-nginx && \

e2e/CLAUDE.md

@@ -218,7 +218,6 @@ await visitByNavigation(page, "Policies");         // Click child
 | Notifications | `settings-notifications-email.spec.ts`, `settings-notifications-slack.spec.ts`, `settings-notifications-webhook.spec.ts` | `@notifications` |
 | Team | `team-users.spec.ts`, `team-service-users.spec.ts`, `team-users-approval-and-billing.spec.ts` | `@team` |
 | Setup Keys | `setup-keys.spec.ts` | `@setup-keys` |
-| Control Center | `control-center-*.spec.ts` (`-draft`, `-draft-connections`, `-draft-matrix`, `-draft-extras`, `-draft-install`, `-draft-remove`, `-draft-shortcuts`, `-deploy`, `-drilldown`, `-live`, `-peers`) | `@control-center` |
 
 ## Debugging
 

e2e/environment/.gitignore

@@ -9,6 +9,4 @@ proxy-no-ports.env
 proxy-certs/
 proxy-certs-no-ports/
 docker-compose.yml
-/machinekey
-geo-cache/
-geo-dump/
+/machinekey

e2e/environment/create-test-env.sh

@@ -61,13 +61,7 @@ wait_proxy_cluster() {
   SERVICE_NAME=${1:-reverse-proxy}
   echo -n "Waiting for $SERVICE_NAME to register with management "
   set +e
-  # 480s: management downloads its geolocation databases on first boot
-  # (the proxy specs need /locations/countries, so it cannot be disabled
-  # there), and a slow pkgs.netbird.io can stall that well past the old
-  # 120s budget. The proxies skip their download entirely via
-  # NB_PROXY_DISABLE_GEOLOCATION. The loop exits as soon as the sync
-  # lands, so healthy runs pay nothing.
-  local attempts=240
+  local attempts=60
   local i
   for ((i = 1; i <= attempts; i++)); do
     if $DOCKER_COMPOSE_COMMAND logs "$SERVICE_NAME" 2>&1 | grep -q "Initial mapping sync complete"; then
@@ -595,8 +589,6 @@ initEnvironment() {
   echo -e "\nCreating proxy access tokens...\n"
   init_proxy_tokens
 
-  exportGeoDatabases
-
   echo -e "\nStarting reverse proxy services...\n"
   $DOCKER_COMPOSE_COMMAND up -d reverse-proxy reverse-proxy-no-ports
 
@@ -768,41 +760,7 @@ ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE=$ZIDATE_TOKEN_EXPIRATION_DA
 EOF
 }
 
-# Copies management's geolocation databases out of its data volume into
-# ./geo-cache so CI can cache them across runs. Management has finished
-# loading them by the time its API serves requests. A no-op when the
-# cache already holds both files, and never fatal: a failed export just
-# means the next run downloads again.
-exportGeoDatabases() {
-  mkdir -p geo-cache
-  if compgen -G "geo-cache/GeoLite2-City_*.mmdb" > /dev/null \
-    && compgen -G "geo-cache/geonames_*.db" > /dev/null; then
-    return
-  fi
-  echo -e "\nExporting geolocation databases for caching...\n"
-  rm -rf geo-dump
-  if $DOCKER_COMPOSE_COMMAND cp management:/var/lib/netbird ./geo-dump; then
-    cp geo-dump/GeoLite2-City_*.mmdb geo-dump/geonames_*.db geo-cache/ 2>/dev/null \
-      || echo "WARN: no geolocation databases found in management data dir"
-    rm -rf geo-dump
-  else
-    echo "WARN: could not copy management data dir; geolocation databases not cached"
-  fi
-}
-
 renderDockerCompose() {
-  # Cached geolocation databases (restored by CI into ./geo-cache) are
-  # mounted into management's data dir so it skips the slow first-boot
-  # download from pkgs.netbird.io. With no cache the mounts are omitted
-  # and management downloads as before.
-  local geo_mounts=""
-  local f
-  for f in geo-cache/GeoLite2-City_*.mmdb geo-cache/geonames_*.db; do
-    [ -f "$f" ] || continue
-    geo_mounts+="
-      - ./${f}:/var/lib/netbird/$(basename "$f")"
-  done
-
   cat <<EOF
 version: "3.4"
 services:
@@ -836,7 +794,7 @@ services:
      - NB_TRAFFIC_FLOW_INTERVAL=20s
      - NB_SINGLE_INSTANCE_MODE=true
     volumes:
-      - netbird_management:/var/lib/netbird${geo_mounts}
+      - netbird_management:/var/lib/netbird
       - ./management.json:/etc/netbird/management.json
     command: [
       "--port", "80",
@@ -887,11 +845,6 @@ services:
     networks: [netbird]
     env_file:
       - ./proxy.env
-    environment:
-      # No spec exercises country-based enforcement, and skipping the
-      # GeoLite2 download removes a startup stall of up to 2 minutes
-      # when pkgs.netbird.io is slow.
-      - NB_PROXY_DISABLE_GEOLOCATION=true
     volumes:
       - ./proxy-certs:/certs:ro
     command: [
@@ -913,9 +866,6 @@ services:
     networks: [netbird]
     env_file:
       - ./proxy-no-ports.env
-    environment:
-      # See the primary proxy: no spec needs geo enforcement.
-      - NB_PROXY_DISABLE_GEOLOCATION=true
     volumes:
       # Distinct cert dir so this proxy has a distinct identity from the
       # primary proxy; a shared cert makes both register under the same

e2e/helpers/auth.ts

@@ -117,15 +117,7 @@ export async function loginToApp(
  * Use this instead of page.goto() for in-app navigation after loginToApp().
  */
 export async function navigateTo(page: Page, path: string) {
-  // A client-side route update still in flight from the previous test (the
-  // dashboard page is shared per worker) aborts the navigation. Retry once —
-  // by then the app-driven navigation has landed.
-  try {
-    await page.goto(path, { waitUntil: "domcontentloaded" });
-  } catch (e) {
-    if (!String(e).includes("ERR_ABORTED")) throw e;
-    await page.goto(path, { waitUntil: "domcontentloaded" });
-  }
+  await page.goto(path, { waitUntil: "domcontentloaded" });
   const modal = page.getByTestId("setup-netbird-modal");
   try {
     await modal.waitFor({ state: "visible", timeout: 3_000 });

e2e/helpers/control-center.ts

@@ -1,235 +0,0 @@
-import { Page, Locator, expect } from "@playwright/test";
-import { navigateTo } from "./auth";
-import { clearScrollLock, setTestEdition } from "./utils";
-
-// The test build's billing modal backdrop swallows canvas clicks.
-async function disableCloudBilling(page: Page) {
-  await setTestEdition(page, "licensed");
-}
-
-export async function dismissBlockingOverlays(page: Page) {
-  await clearScrollLock(page);
-}
-
-export type FlowView = "peers" | "users" | "groups" | "networks";
-
-export async function openControlCenter(page: Page, tab?: FlowView) {
-  await disableCloudBilling(page);
-  await navigateTo(
-    page,
-    tab ? `/control-center?tab=${tab}` : "/control-center",
-  );
-  // The pane hides behind cc-prefit until the first fitView.
-  await expect(page.locator(".react-flow__pane")).toBeVisible();
-  await dismissBlockingOverlays(page);
-}
-
-export async function switchFlowView(page: Page, view: FlowView) {
-  await dismissBlockingOverlays(page);
-  await page.getByTestId(`cc-flow-${view}`).click({ force: true });
-  await expect(page.getByTestId(`cc-flow-${view}`)).toHaveAttribute(
-    "data-state",
-    "active",
-  );
-}
-
-export async function enterDraft(page: Page) {
-  await dismissBlockingOverlays(page);
-  await page.getByTestId("cc-mode-draft").click({ force: true });
-  await page.getByTestId("cc-draft-use-current-option").click({ force: true });
-  // Waiting for the Add button also guarantees draft mode is fully active.
-  await expect(page.getByTestId("cc-toolbar-add")).toBeVisible();
-}
-
-// Draft state is React-only, so a full page load discards it.
-export async function resetDraftState(page: Page) {
-  await openControlCenter(page);
-}
-
-export async function readDraftChanges(page: Page): Promise<any[]> {
-  return await page.evaluate(
-    () =>
-      (window as unknown as { __ccDraftChanges?: any[] }).__ccDraftChanges ??
-      [],
-  );
-}
-
-async function centerOf(locator: Locator) {
-  const box = await locator.boundingBox();
-  if (!box) throw new Error("element has no layout");
-  return { x: box.x + box.width / 2, y: box.y + box.height / 2 };
-}
-
-async function mouseDrag(
-  page: Page,
-  from: { x: number; y: number },
-  to: { x: number; y: number },
-) {
-  await page.mouse.move(from.x, from.y);
-  await page.mouse.down();
-  // Intermediate moves so drag thresholds see a realistic pointer path.
-  const steps = 12;
-  for (let i = 1; i <= steps; i++) {
-    await page.mouse.move(
-      from.x + ((to.x - from.x) * i) / steps,
-      from.y + ((to.y - from.y) * i) / steps,
-    );
-  }
-  await page.mouse.up();
-  // Let the drop handler commit the new node before callers assert on it.
-  await page.waitForTimeout(120);
-}
-
-// Networks share the Resources tab.
-function categoryForTemplate(templateTestId: string): string {
-  if (templateTestId.includes("peer")) return "peers";
-  if (templateTestId.includes("policy")) return "policies";
-  if (templateTestId.includes("group")) return "groups";
-  return "resources";
-}
-
-/** The panel drags via raw pointer events, not HTML5 DnD. */
-export async function dragTemplateToCanvas(
-  page: Page,
-  templateTestId: string,
-  target?: { x: number; y: number },
-  opts: { search?: string } = {},
-) {
-  const item = page.getByTestId(templateTestId);
-  // The panel only fades out, so read the toggle's state from aria-pressed.
-  const addButton = page.getByTestId("cc-toolbar-add");
-  if ((await addButton.getAttribute("aria-pressed")) !== "true") {
-    await addButton.click();
-    await expect(addButton).toHaveAttribute("aria-pressed", "true");
-  }
-  // Dispatch directly: the tab's hover tooltip intercepts a real pointer click.
-  await page
-    .getByTestId(`cc-category-${categoryForTemplate(templateTestId)}`)
-    .dispatchEvent("click");
-  // Picking a category clears the search box, so fill it after the switch.
-  if (opts.search) {
-    await page.getByPlaceholder(/Search components/).fill(opts.search);
-  }
-  await expect(item).toBeVisible();
-  await item.scrollIntoViewIfNeeded();
-  const pane = page.locator(".react-flow__pane");
-  const paneBox = await pane.boundingBox();
-  if (!paneBox) throw new Error("canvas pane not laid out");
-  const to = target ?? {
-    // Land right of the panel, roughly canvas center.
-    x: paneBox.x + paneBox.width * 0.6,
-    y: paneBox.y + paneBox.height * 0.5,
-  };
-  await mouseDrag(page, await centerOf(item), to);
-  // A resource drop opens an editor modal that Escape would dismiss.
-  if (!templateTestId.includes("resource")) {
-    await page.keyboard.press("Escape");
-  }
-}
-
-export function canvasNode(page: Page, dataIdPrefix: string) {
-  return page.locator(`.react-flow__node[data-id^="${dataIdPrefix}"]`);
-}
-
-/** `sr` (right) makes the node a policy SOURCE, `sl` (left) a DESTINATION. */
-export async function connectNodes(
-  page: Page,
-  source: Locator,
-  target: Locator,
-  handleSide: "sr" | "sl" = "sr",
-) {
-  // Connect handles fade in on node hover, so wait for a stable position.
-  await source.hover();
-  const handle = source.locator(
-    `.react-flow__handle[data-handleid="${handleSide}-connect"]`,
-  );
-  await expect(handle).toBeVisible();
-  await page.waitForTimeout(100);
-  // The target's handle only becomes connectable mid-drag, so pace and dwell.
-  const from = await centerOf(handle);
-  const to = await centerOf(target);
-  await page.mouse.move(from.x, from.y);
-  await page.mouse.down();
-  await page.waitForTimeout(50);
-  const steps = 20;
-  for (let i = 1; i <= steps; i++) {
-    await page.mouse.move(
-      from.x + ((to.x - from.x) * i) / steps,
-      from.y + ((to.y - from.y) * i) / steps,
-    );
-    await page.waitForTimeout(12);
-  }
-  await page.mouse.move(to.x, to.y);
-  await page.waitForTimeout(80);
-  await page.mouse.up();
-  await page.waitForTimeout(120);
-}
-
-export async function panePoint(page: Page, fx: number, fy: number) {
-  const pane = await page.locator(".react-flow__pane").boundingBox();
-  if (!pane) throw new Error("canvas pane not laid out");
-  return { x: pane.x + pane.width * fx, y: pane.y + pane.height * fy };
-}
-
-export async function createViaCanvasMenu(
-  page: Page,
-  action: string,
-  at?: { fx: number; fy: number },
-) {
-  const point = await panePoint(page, at?.fx ?? 0.6, at?.fy ?? 0.5);
-  await page.mouse.move(point.x, point.y);
-  await page.mouse.click(point.x, point.y, { button: "right" });
-  const menu = page.getByTestId("cc-canvas-context-menu");
-  await expect(menu).toBeVisible();
-  await menu.getByTestId(`cc-canvas-menu-${action}`).click();
-}
-
-export async function readDraftCanvas(page: Page): Promise<any | null> {
-  return await page.evaluate(
-    () =>
-      (window as unknown as { __ccDraftCanvas?: unknown }).__ccDraftCanvas ??
-      null,
-  );
-}
-
-export async function dragNodeOnto(page: Page, node: Locator, target: Locator) {
-  await mouseDrag(page, await centerOf(node), await centerOf(target));
-}
-
-export async function clickContextMenuItem(
-  page: Page,
-  node: Locator,
-  action: string,
-) {
-  await dismissBlockingOverlays(page);
-  // The menu's items detach when the node underneath it updates, so retry.
-  await expect(async () => {
-    await node.click({ button: "right" });
-    const menu = page.getByTestId("cc-node-context-menu");
-    await expect(menu).toBeVisible({ timeout: 2000 });
-    await menu.getByTestId(`cc-menu-${action}`).click({ timeout: 2000 });
-  }).toPass();
-}
-
-export function reviewButton(page: Page) {
-  return page.getByTestId("cc-draft-review");
-}
-
-export async function expectChangeCount(page: Page, count: number) {
-  if (count === 0) {
-    await expect(reviewButton(page)).toBeDisabled();
-  } else {
-    await expect(reviewButton(page)).toBeEnabled();
-    await expect(reviewButton(page)).toContainText(String(count));
-  }
-}
-
-/** Assumes both policy sides are already filled in. */
-export async function submitCreatePolicyModal(page: Page, name?: string) {
-  await page.getByTestId("policy-continue").click();
-  await page.getByTestId("policy-continue").click();
-  if (name) {
-    await page.getByTestId("policy-name").fill(name);
-  }
-  await page.getByTestId("submit-policy").click();
-}

e2e/helpers/docker-peer.ts

@@ -1,94 +0,0 @@
-// Spins up a real NetBird peer in docker, registering via a setup key. The test
-// env has no signal/TURN, so the peer registers but stays offline. The client
-// MUST reach management directly (http://management:80); caddy breaks h2c.
-import { execFileSync } from "child_process";
-import { expect, type Page } from "@playwright/test";
-import {
-  createSetupKey,
-  deletePeersByPrefix,
-  deleteSetupKeysByPrefix,
-  listPeers,
-} from "./api";
-
-const NETWORK = "environment_netbird";
-const IMAGE = "netbirdio/netbird:latest";
-const MGMT_URL = "http://management:80";
-
-type RegisteredPeer = {
-  id: string;
-  name: string;
-  hostname: string;
-  connected: boolean;
-};
-
-// argv, not a shell string: the setup key comes back from the management API
-// and must never be parsed by a shell.
-function docker(args: string[]): string {
-  return execFileSync("docker", args, { stdio: ["ignore", "pipe", "pipe"] })
-    .toString()
-    .trim();
-}
-
-// `hostname` doubles as the container name and the peer's account name.
-export async function registerDockerPeer(
-  page: Page,
-  hostname: string,
-  autoGroupIds: string[] = [],
-): Promise<RegisteredPeer> {
-  const key = await createSetupKey(page, hostname, autoGroupIds);
-  return runDockerPeerWithKey(page, hostname, key.key);
-}
-
-// Runs a peer with an already-generated setup key instead of minting one.
-export async function runDockerPeerWithKey(
-  page: Page,
-  hostname: string,
-  key: string,
-): Promise<RegisteredPeer> {
-  removeDockerContainer(hostname);
-  docker([
-    "run",
-    "-d",
-    "--name",
-    hostname,
-    "--network",
-    NETWORK,
-    "--cap-add=NET_ADMIN",
-    "--cap-add=SYS_ADMIN",
-    "-e",
-    `NB_SETUP_KEY=${key}`,
-    "-e",
-    `NB_MANAGEMENT_URL=${MGMT_URL}`,
-    "-e",
-    `NB_HOSTNAME=${hostname}`,
-    IMAGE,
-  ]);
-  let found: RegisteredPeer | undefined;
-  await expect
-    .poll(
-      async () => {
-        found = ((await listPeers(page)) as RegisteredPeer[]).find(
-          (p) => p.name === hostname,
-        );
-        return !!found;
-      },
-      { timeout: 45_000, intervals: [2000, 2000, 3000] },
-    )
-    .toBe(true);
-  return found!;
-}
-
-// Peer and setup-key cleanup is the caller's responsibility.
-export function removeDockerContainer(hostname: string) {
-  try {
-    docker(["rm", "-f", hostname]);
-  } catch {
-    /* none */
-  }
-}
-
-export async function cleanupDockerPeer(page: Page, hostname: string) {
-  removeDockerContainer(hostname);
-  await deletePeersByPrefix(page, hostname);
-  await deleteSetupKeysByPrefix(page, hostname);
-}

e2e/helpers/utils.ts

@@ -5,8 +5,16 @@ export function generateRandomName(prefix?: string): string {
 }
 
 /**
- * Run an action and wait until every request matching `pattern` has settled,
- * plus a quiet window to catch chains where one response triggers the next.
+ * Run an action (click, goto, ...) and wait until every API request whose
+ * URL contains `pattern` has finished (response received or failed), plus a
+ * short quiet window to catch request chains where one response triggers
+ * the next fetch.
+ *
+ * Use this to make navigation deterministic: e.g. when opening the services
+ * page, the table only renders fully after /api/reverse-proxies/* calls
+ * return, so asserting on rows right after the click races the backend.
+ *
+ * Returns whatever the action returns.
  */
 export async function waitForApiCalls<T>(
   page: Page,
@@ -41,6 +49,8 @@ export async function waitForApiCalls<T>(
   try {
     const result = await action();
     const deadline = Date.now() + timeoutMs;
+    // Wait until: at least one matching request was seen (unless none ever
+    // fires), none are in flight, and the network has been quiet for quietMs.
     while (Date.now() < deadline) {
       const quietFor = Date.now() - lastActivity;
       if (inFlight === 0 && quietFor >= quietMs) {
@@ -56,6 +66,11 @@ export async function waitForApiCalls<T>(
   }
 }
 
+/**
+ * Apply a single-choice (radio) table filter via the new TableFilters UI:
+ * open the "Filters" popover, pick the filter by column id, then select the
+ * option by its visible label (e.g. "Active", "Inactive", "All").
+ */
 export async function applyRadioTableFilter(
   page: Page,
   filterId: string,
@@ -70,32 +85,19 @@ export async function applyRadioTableFilter(
 }
 
 /**
- * Call before navigating. The override persists for the whole browser context
- * and the page is shared per worker, so edition-dependent specs must set it.
- */
-export async function setTestEdition(
-  page: Page,
-  edition: "cloud" | "licensed" | "oss",
-) {
-  await page.evaluate((ed) => {
-    try {
-      window.localStorage.setItem("netbird-test-edition", ed);
-    } catch (e) {
-      /* storage unavailable */
-    }
-  }, edition);
-}
-
-/**
- * Some Radix modals leave scroll-lock, `pointer-events: none` or a stale
- * overlay div behind, blocking the entire page.
+ * Clear stale Radix scroll-lock and overlay from body.
+ * Some Radix modals leave `data-scroll-locked`, `pointer-events: none`,
+ * or a stale overlay div blocking the entire page.
  */
 export async function clearScrollLock(page: Page) {
   await page.evaluate(() => {
     document.body.removeAttribute("data-scroll-locked");
     document.body.style.removeProperty("pointer-events");
+    // Remove stale Radix dialog overlays that block pointer events
     document
-      .querySelectorAll('div[data-state="open"].fixed[class*="backdrop-blur"]')
+      .querySelectorAll(
+        'div[data-state="open"].fixed[class*="backdrop-blur"]',
+      )
       .forEach((el) => el.remove());
   });
 }

e2e/tests/agent-network-bootstrap-cluster.spec.ts

@@ -1,196 +0,0 @@
-/**
- * Agent Network bootstrap-cluster spec.
- *
- * The account's agent network endpoint is assigned once, from the proxy
- * cluster the connect-provider wizard pins it to, and it is immutable after
- * that. Not every live cluster can host it: the endpoint is a private service,
- * reachable only from connected peers and authorised by their tunnel identity,
- * which only a cluster with a connected embedded proxy (`netbird proxy`) can
- * serve. Management reports that per cluster as supports_private and refuses a
- * bootstrap onto a cluster without it.
- *
- * This spec pins the wizard's half of that contract: it picks a
- * private-capable cluster even when a centralised one is listed first, and it
- * blocks setup — with a message naming what is missing — when no listed
- * cluster qualifies. Both the settings and domains routes are mocked, so the
- * assertions do not depend on which clusters the test backend happens to have
- * connected, and no provider is created against it.
- */
-import { type Browser, expect, type Page, test } from "@playwright/test";
-import { loginToApp } from "../helpers/auth";
-
-const AGENT_NETWORK_CONFIG_KEY = "netbird-test-agent-network";
-
-// Listed first, and unusable: a centralised proxy cluster. Picking it is the
-// bug this spec guards against.
-const CENTRAL_CLUSTER = "central.proxy.netbird.io";
-// Listed second, and the only valid pick.
-const EMBEDDED_CLUSTER = "embedded.proxy.netbird.io";
-
-const UNBOOTSTRAPPED_DEFAULTS = {
-  endpoint: "",
-  proxy_address: "",
-  dedicated: false,
-  enable_log_collection: true,
-  enable_prompt_collection: false,
-  redact_pii: false,
-  access_log_retention_days: 30,
-};
-
-const BOOTSTRAPPED_SETTINGS = {
-  ...UNBOOTSTRAPPED_DEFAULTS,
-  endpoint: `violet.${EMBEDDED_CLUSTER}`,
-  proxy_address: EMBEDDED_CLUSTER,
-  created_at: "2026-01-01T00:00:00Z",
-  updated_at: "2026-01-01T00:00:00Z",
-};
-
-/** A free (cluster-backed) domain as /reverse-proxies/domains reports it. */
-function freeDomain(name: string, supportsPrivate: boolean) {
-  return {
-    id: name,
-    domain: name,
-    validated: true,
-    type: "free",
-    supports_private: supportsPrivate,
-    supports_custom_ports: true,
-    require_subdomain: true,
-  };
-}
-
-async function json(route: import("@playwright/test").Route, body: unknown) {
-  return route.fulfill({
-    status: 200,
-    contentType: "application/json",
-    body: JSON.stringify(body),
-  });
-}
-
-/**
- * Opens the providers page for an account that has not been bootstrapped,
- * with the given clusters on the domains endpoint. Returns the page plus a
- * promise-friendly getter for the bootstrap POST body, which is captured and
- * answered locally so the real backend is never mutated.
- */
-async function openWizard(
-  browser: Browser,
-  domains: ReturnType<typeof freeDomain>[],
-): Promise<{ page: Page; close: () => Promise<void> }> {
-  const context = await browser.newContext({
-    storageState: "e2e/fixtures/auth/owner.json",
-  });
-  try {
-    await context.addInitScript(
-      ([key, value]) => {
-        try {
-          window.localStorage.setItem(key as string, value as string);
-        } catch (e) {}
-      },
-      [AGENT_NETWORK_CONFIG_KEY, "enabled"],
-    );
-    const page = await context.newPage();
-
-    await page.route("**/api/agent-network/settings", (route) => {
-      const method = route.request().method();
-      if (method === "GET") return json(route, UNBOOTSTRAPPED_DEFAULTS);
-      if (method === "POST") return json(route, BOOTSTRAPPED_SETTINGS);
-      return route.continue();
-    });
-    await page.route("**/api/reverse-proxies/domains", (route) =>
-      route.request().method() === "GET"
-        ? json(route, domains)
-        : route.continue(),
-    );
-    // Keep the create hermetic: the wizard only reaches this once the
-    // bootstrap it does first has succeeded.
-    await page.route("**/api/agent-network/providers", (route) =>
-      route.request().method() === "POST"
-        ? json(route, { id: "prov-e2e", name: "e2e-provider" })
-        : route.continue(),
-    );
-
-    await loginToApp(page, "owner");
-    await page.goto("/agent-network/providers");
-    await page.keyboard.press("Escape");
-    return { page, close: () => context.close() };
-  } catch (e) {
-    await context.close();
-    throw e;
-  }
-}
-
-/** Fills the provider tab with the minimum a create needs. */
-async function fillProviderTab(page: Page) {
-  await page.getByPlaceholder("https://api.openai.com").fill("https://api.openai.com");
-  await page.getByPlaceholder("sk-...").first().fill("sk-e2e-bootstrap-key");
-}
-
-test.describe("Agent Network bootstrap cluster @agent-network", () => {
-  test("bootstraps onto a private-capable cluster, skipping a centralised one listed first", async ({
-    browser,
-  }) => {
-    const { page, close } = await openWizard(browser, [
-      freeDomain(CENTRAL_CLUSTER, false),
-      freeDomain(EMBEDDED_CLUSTER, true),
-    ]);
-    try {
-      await page
-        .getByRole("button", { name: "Connect Provider" })
-        .first()
-        .click({ force: true });
-
-      // The unusable cluster is listed, but it is not a blocker: a usable one
-      // exists, so the wizard proceeds without the warning.
-      await expect(
-        page.getByTestId("agent-network-no-cluster-callout"),
-      ).toHaveCount(0);
-
-      await fillProviderTab(page);
-
-      const bootstrap = page.waitForResponse(
-        (resp) =>
-          resp.url().includes("/agent-network/settings") &&
-          resp.request().method() === "POST",
-        { timeout: 30_000 },
-      );
-
-      await page.getByRole("button", { name: "Continue" }).click({ force: true });
-      await page
-        .getByRole("button", { name: "Connect Provider" })
-        .last()
-        .click({ force: true });
-
-      const payload = (await bootstrap).request().postDataJSON();
-      expect(payload.proxy_address).toBe(EMBEDDED_CLUSTER);
-    } finally {
-      await close();
-    }
-  });
-
-  test("blocks setup when no listed cluster has an embedded proxy", async ({
-    browser,
-  }) => {
-    const { page, close } = await openWizard(browser, [
-      freeDomain(CENTRAL_CLUSTER, false),
-    ]);
-    try {
-      await page
-        .getByRole("button", { name: "Connect Provider" })
-        .first()
-        .click({ force: true });
-
-      const callout = page.getByTestId("agent-network-no-cluster-callout");
-      await expect(callout).toBeVisible({ timeout: 10_000 });
-      await expect(callout).toContainText("embedded proxy");
-
-      // With nothing to pin to there is no bootstrap to make, so the wizard
-      // cannot advance — rather than sending a request management refuses.
-      await fillProviderTab(page);
-      await expect(
-        page.getByRole("button", { name: "Continue" }),
-      ).toBeDisabled();
-    } finally {
-      await close();
-    }
-  });
-});

e2e/tests/agent-network-cache-accounting.spec.ts

@@ -1,213 +0,0 @@
-/**
- * Agent Network prompt-cache accounting spec.
- *
- * Drives the Usage & Logs page against mocked agent-network endpoints whose
- * rows carry the cache fields (cached_input_tokens / cache_creation_tokens /
- * cache_cost_usd) plus the per-bucket cost breakdown, and verifies the hover
- * breakdowns: the access-log Tokens tooltip gains cache read/write rows and a
- * cache-aware total, the Cost tooltip lists one line per billed bucket, and
- * the usage overview's daily table
- * surfaces the day's cache buckets. Route mocks keep the spec hermetic, so it
- * passes against management builds that predate the cache fields.
- */
-import { test, expect, type Browser, type Page } from "@playwright/test";
-import { loginToApp, navigateTo } from "../helpers/auth";
-
-const AGENT_NETWORK_CONFIG_KEY = "netbird-test-agent-network";
-
-// The reported field scenario: a session-start request that wrote a ~32k-token
-// prompt cache, and a follow-up that read it back.
-const writeEntry = {
-  id: "anlog-cache-write",
-  service_id: "svc-e2e",
-  timestamp: new Date().toISOString(),
-  status_code: 200,
-  duration_ms: 29000,
-  input_tokens: 10,
-  output_tokens: 1472,
-  total_tokens: 33591,
-  cached_input_tokens: 0,
-  cache_creation_tokens: 32109,
-  cost_usd: 0.142519,
-  cache_cost_usd: 0.120409,
-  input_cost_usd: 0.00003,
-  cached_input_cost_usd: 0,
-  cache_creation_cost_usd: 0.120409,
-  output_cost_usd: 0.02208,
-  provider: "bedrock",
-  model: "anthropic.claude-sonnet-4-5",
-  session_id: "sess-cache-write",
-  decision: "allow",
-  stream: false,
-};
-
-const readEntry = {
-  ...writeEntry,
-  id: "anlog-cache-read",
-  output_tokens: 800,
-  total_tokens: 32919,
-  cached_input_tokens: 32109,
-  cache_creation_tokens: 0,
-  cost_usd: 0.021663,
-  cache_cost_usd: 0.009633,
-  input_cost_usd: 0.00003,
-  cached_input_cost_usd: 0.009633,
-  cache_creation_cost_usd: 0,
-  output_cost_usd: 0.012,
-  session_id: "sess-cache-read",
-};
-
-const todayBucket = {
-  period_start: new Date().toISOString().slice(0, 10),
-  input_tokens: 20,
-  output_tokens: 2272,
-  total_tokens: 66510,
-  cached_input_tokens: 32109,
-  cache_creation_tokens: 32109,
-  cost_usd: 0.164182,
-  cache_cost_usd: 0.130042,
-  input_cost_usd: 0.00006,
-  cached_input_cost_usd: 0.009633,
-  cache_creation_cost_usd: 0.120409,
-  output_cost_usd: 0.03408,
-};
-
-async function mockCacheUsage(page: Page) {
-  await page.route("**/api/agent-network/access-logs*", (route) =>
-    route.fulfill({
-      json: {
-        data: [writeEntry, readEntry],
-        page: 1,
-        page_size: 25,
-        total_records: 2,
-        total_pages: 1,
-      },
-    }),
-  );
-  await page.route("**/api/agent-network/usage/overview*", (route) =>
-    route.fulfill({ json: [todayBucket] }),
-  );
-}
-
-async function newUsagePage(browser: Browser): Promise<{
-  page: Page;
-  close: () => Promise<void>;
-}> {
-  const context = await browser.newContext({
-    storageState: "e2e/fixtures/auth/owner.json",
-  });
-  await context.addInitScript(
-    ([key, value]) => {
-      try {
-        window.localStorage.setItem(key as string, value as string);
-      } catch (e) {}
-    },
-    [AGENT_NETWORK_CONFIG_KEY, "enabled"],
-  );
-  const page = await context.newPage();
-  await mockCacheUsage(page);
-  await loginToApp(page, "owner");
-  return { page, close: () => context.close() };
-}
-
-// FullTooltip force-mounts its content, so a tooltip keeps its role=tooltip
-// element in the DOM after closing — a bare getByRole("tooltip") accumulates
-// every tooltip the test has ever opened. Radix puts role=tooltip on a
-// visually-hidden span and the open/closed flag on that span's parent
-// ("delayed-open"/"instant-open" vs "closed"), so match the parent that is
-// currently open. Its text covers both the visible copy and the hidden one.
-function tooltip(page: Page) {
-  return page.locator(
-    '[data-state="delayed-open"]:has(> [role="tooltip"]), [data-state="instant-open"]:has(> [role="tooltip"])',
-  );
-}
-
-// Radix's hoverable content holds a tooltip open while the pointer travels
-// toward it, so moving straight to the next cell can leave two open at once.
-// Escape dismisses the open one deterministically, wherever the pointer sits.
-async function closeTooltip(page: Page) {
-  await page.keyboard.press("Escape");
-  await expect(tooltip(page)).toHaveCount(0);
-}
-
-test.describe.serial("Agent Network cache accounting @agent-network", () => {
-  test("access-log hover breaks out prompt-cache tokens and cost", async ({
-    browser,
-  }) => {
-    const { page, close } = await newUsagePage(browser);
-    try {
-      await navigateTo(page, "/agent-network/usage?tab=access-logs");
-
-      const writeRow = page.getByRole("row").filter({ hasText: "$0.1425" });
-      await expect(writeRow).toBeVisible();
-
-      // Tokens tooltip: cache-write bucket plus a total that includes it.
-      await writeRow.getByText("1,472").hover();
-      await expect(tooltip(page)).toContainText("32,109");
-      await expect(tooltip(page)).toContainText("cache write");
-      await expect(tooltip(page)).toContainText("33,591");
-
-      // Cost tooltip: all four buckets are listed plus the total, including
-      // buckets that cost nothing — this request wrote the cache but never read
-      // it, so "cache read" is present with a $0.0000 amount.
-      await closeTooltip(page);
-      await writeRow.getByText("$0.1425").hover();
-      await expect(tooltip(page)).toContainText("input");
-      await expect(tooltip(page)).toContainText("cache read");
-      await expect(tooltip(page)).toContainText("cache write");
-      await expect(tooltip(page)).toContainText("output");
-      await expect(tooltip(page)).toContainText("$0.1204");
-      await expect(tooltip(page)).toContainText("$0.0221");
-      await expect(tooltip(page)).toContainText("$0.0000");
-      await expect(tooltip(page)).toContainText("total");
-
-      // The follow-up request reads the cache back: read bucket filled, write
-      // bucket still listed as a zero row.
-      // No exact match: the output count renders behind an sr-only "Output:" prefix.
-      const readRow = page.getByRole("row").filter({ hasText: "$0.0217" });
-      await closeTooltip(page);
-      await readRow.getByText("800").hover();
-      await expect(tooltip(page)).toContainText("cache read");
-      await expect(tooltip(page)).toContainText("32,919");
-      await expect(tooltip(page)).toContainText(/0\s*cache write/);
-    } finally {
-      await close();
-    }
-  });
-
-  test("usage overview daily table surfaces the day's cache buckets", async ({
-    browser,
-  }) => {
-    const { page, close } = await newUsagePage(browser);
-    try {
-      await navigateTo(page, "/agent-network/usage");
-
-      // Row-scoped on purpose: the hovers now repeat the cell's own figure on
-      // their total row, and FullTooltip force-mounts that content, so a
-      // page-wide getByText would match the cell and the tooltip both. Radix
-      // portals tooltip content to <body>, outside the row.
-      const dayRow = page.getByRole("row").filter({ hasText: "$0.16" });
-
-      // Total Tokens includes the additive cache buckets; hover splits them out
-      // in the same value-then-label rows the access-log table uses.
-      await expect(dayRow.getByText("66,510")).toBeVisible();
-      await dayRow.getByText("66,510").hover();
-      await expect(tooltip(page)).toContainText(/20\s*input/);
-      await expect(tooltip(page)).toContainText(/2,272\s*output/);
-      await expect(tooltip(page)).toContainText(/32,109\s*cache read/);
-      await expect(tooltip(page)).toContainText(/32,109\s*cache write/);
-      await expect(tooltip(page)).toContainText(/66,510\s*total/);
-
-      // Cost hover breaks the day into the same four billed buckets.
-      await closeTooltip(page);
-      await dayRow.getByText("$0.16", { exact: true }).hover();
-      await expect(tooltip(page)).toContainText(/\$0\.0001\s*input/);
-      await expect(tooltip(page)).toContainText(/\$0\.0341\s*output/);
-      await expect(tooltip(page)).toContainText(/\$0\.0096\s*cache read/);
-      await expect(tooltip(page)).toContainText(/\$0\.1204\s*cache write/);
-      await expect(tooltip(page)).toContainText(/\$0\.1642\s*total/);
-    } finally {
-      await close();
-    }
-  });
-});

e2e/tests/agent-network-kimi-provider.spec.ts

@@ -3,73 +3,32 @@
  *
  * Walks the Kimi provider lifecycle end to end against the real backend:
  * pick kimi_api from the catalog (prefilled host, catalog models with
- * pricing), connect it, then verify the Kimi-gated config surfaces on the
- * Connect Agent page (Kimi CLI tab, Kimi backend option in the Claude Code
- * tab) that only render when a Kimi provider is connected.
+ * pricing), connect it, then verify the Kimi-gated config surfaces in the
+ * "Configure Your Agent" modal (Kimi CLI tab, Kimi backend option in the
+ * Claude Code tab) that only render when a Kimi provider is connected.
  *
  * The kimi_api catalog entry ships with newer management builds. When the
  * backend under test predates it, the whole suite skips instead of failing —
  * same trade-off as the provider matrix in netbird's agent-network e2e
- * harness, which skips per-provider on missing credentials. The same applies
- * to the explicit settings bootstrap: connecting the first provider of an
- * account POSTs /agent-network/settings first, so on a build without that
- * endpoint the wizard cannot get as far as creating a provider.
+ * harness, which skips per-provider on missing credentials.
  *
  * The Agent Network menu is deployment-gated; the test build honors the
  * localStorage override (see testAgentNetworkOverride in utils/netbird.ts),
  * set via addInitScript on a dedicated context below.
  */
-import { type Browser, expect, type Page,test } from "@playwright/test";
-import {
-  createAgentNetworkPolicy,
-  createGroup,
-  deleteAgentNetworkPoliciesByPrefix,
-  deleteAgentNetworkProvidersByPrefix,
-  deleteGroup,
-  getCurrentUser,
-  listAgentNetworkCatalog,
-  listGroups,
-  supportsAgentNetworkAgentConfig,
-  supportsAgentNetworkSettingsBootstrap,
-  updateUserAutoGroups,
-} from "../helpers/api";
+import { test, expect, type Browser, type Page } from "@playwright/test";
 import { loginToApp } from "../helpers/auth";
 import { generateRandomName } from "../helpers/utils";
+import {
+  deleteAgentNetworkProvidersByPrefix,
+  listAgentNetworkCatalog,
+} from "../helpers/api";
 
 const AGENT_NETWORK_CONFIG_KEY = "netbird-test-agent-network";
 const KIMI_CATALOG_ID = "kimi_api";
 const KIMI_CATALOG_NAME = "Kimi (Moonshot AI) API";
 const PROVIDER_PREFIX = "e2e-kimi-";
 
-/**
- * Remove every fixture this spec creates: the policy granting the caller the
- * provider, the group carrying that grant (detached from the caller first —
- * a group referenced by a user's auto-groups refuses deletion), and the
- * provider itself. Runs before the test too, so leftovers from an interrupted
- * run never poison the next one.
- */
-async function cleanupKimiFixtures(page: Page) {
-  await deleteAgentNetworkPoliciesByPrefix(page, PROVIDER_PREFIX);
-  const fixtureGroups = (await listGroups(page)).filter((g) =>
-    g.name.startsWith(PROVIDER_PREFIX),
-  );
-  if (fixtureGroups.length > 0) {
-    const fixtureGroupIds = new Set(fixtureGroups.map((g) => g.id));
-    const caller = await getCurrentUser(page);
-    if ((caller.auto_groups ?? []).some((id) => fixtureGroupIds.has(id))) {
-      await updateUserAutoGroups(
-        page,
-        caller,
-        (caller.auto_groups ?? []).filter((id) => !fixtureGroupIds.has(id)),
-      );
-    }
-    for (const g of fixtureGroups) {
-      await deleteGroup(page, g.id);
-    }
-  }
-  await deleteAgentNetworkProvidersByPrefix(page, PROVIDER_PREFIX);
-}
-
 async function newAgentNetworkPage(browser: Browser): Promise<{
   page: Page;
   close: () => Promise<void>;
@@ -103,22 +62,8 @@ test.describe.serial("Agent Network Kimi provider @agent-network", () => {
         !catalog.some((c) => c.id === KIMI_CATALOG_ID),
         `management catalog has no ${KIMI_CATALOG_ID} entry`,
       );
-      test.skip(
-        !(await supportsAgentNetworkSettingsBootstrap(page)),
-        "management build has no POST /agent-network/settings, so the " +
-          "wizard cannot bootstrap the account before the first create",
-      );
-      // The Kimi-gated config surfaces live on the Connect Agent page, whose
-      // caller-scoped GET /agent-network/agent-config answer ships with
-      // newer management builds. The suite starts running once the backend
-      // under test carries it.
-      test.skip(
-        !(await supportsAgentNetworkAgentConfig(page)),
-        "management build has no GET /agent-network/agent-config, so the " +
-          "Connect Agent page cannot render the agent config",
-      );
 
-      await cleanupKimiFixtures(page);
+      await deleteAgentNetworkProvidersByPrefix(page, PROVIDER_PREFIX);
 
       await page.goto("/agent-network/providers");
       await page.keyboard.press("Escape");
@@ -165,70 +110,22 @@ test.describe.serial("Agent Network Kimi provider @agent-network", () => {
           resp.request().method() === "POST",
         { timeout: 30_000 },
       );
-      // On the account's first provider the wizard bootstraps the settings row
-      // first and only creates the provider once that succeeds. A rejected
-      // bootstrap therefore means no provider POST ever happens, which on its
-      // own surfaces only as the whole test timing out — race it so the real
-      // status is reported instead. 409 is not a rejection: it means a
-      // concurrent bootstrap won and the row exists, which the wizard treats as
-      // success and follows with the provider create, so matching it here would
-      // fail a run that is about to succeed.
-      const bootstrapRejected: Promise<never> = page
-        .waitForResponse(
-          (resp) =>
-            resp.url().includes("/agent-network/settings") &&
-            resp.request().method() === "POST" &&
-            resp.status() !== 409 &&
-            !resp.ok(),
-          { timeout: 30_000 },
-        )
-        .then(
-          (resp) => {
-            throw new Error(
-              `Agent Network settings bootstrap POST returned ${resp.status()}; ` +
-                "the provider was never created",
-            );
-          },
-          // Nothing matched: the bootstrap succeeded or wasn't needed. Never
-          // settle, leaving the race to the provider create.
-          () => new Promise<never>(() => {}),
-        );
       await page
         .getByRole("button", { name: "Connect Provider" })
         .last()
         .click({ force: true });
-      const created = await Promise.race([createResponse, bootstrapRejected]);
-      expect([200, 201]).toContain(created.status());
-      const createdProvider = (await created.json()) as { id: string };
+      expect([200, 201]).toContain((await createResponse).status());
 
       // Row lands in the providers table.
       await expect(page.getByText(providerName).first()).toBeVisible();
 
       // ---- Kimi-gated agent config surfaces ----
-      // The agent config lives inline on the Connect Agent page — the
-      // providers page keeps only the endpoint URL and Copy. That page's
-      // answer is caller-scoped: it offers only providers the caller's own
-      // policies authorize, so grant the caller the new provider through a
-      // dedicated group + policy (removed again by cleanupKimiFixtures).
-      const caller = await getCurrentUser(page);
-      const grantGroup = await createGroup(page, `${PROVIDER_PREFIX}grant`);
-      await updateUserAutoGroups(page, caller, [
-        ...(caller.auto_groups ?? []),
-        grantGroup.id,
-      ]);
-      await createAgentNetworkPolicy(page, {
-        name: `${PROVIDER_PREFIX}policy`,
-        source_groups: [grantGroup.id],
-        destination_provider_ids: [createdProvider.id],
-      });
+      await page
+        .getByRole("button", { name: "Agent Config" })
+        .click({ force: true });
 
-      await page.goto("/agent-network/connect");
-
-      // Kimi CLI tab only renders when a kimi_api provider is connected. The
-      // longer timeout covers the page's caller-scoped agent-config fetch.
-      await expect(page.getByRole("tab", { name: "Kimi CLI" })).toBeVisible({
-        timeout: 15_000,
-      });
+      // Kimi CLI tab only renders when a kimi_api provider is connected.
+      await expect(page.getByRole("tab", { name: "Kimi CLI" })).toBeVisible();
 
       // Claude Code tab's backend dropdown offers (and, with Kimi as the only
       // Anthropic-shaped provider, pre-selects) Kimi — its settings.json
@@ -257,8 +154,10 @@ test.describe.serial("Agent Network Kimi provider @agent-network", () => {
       await expect(page.getByText('wire_api = "responses"')).toBeVisible();
       await expect(page.getByText('wire_api = "chat"')).not.toBeVisible();
 
+      await page.keyboard.press("Escape");
+
       // ---- cleanup ----
-      await cleanupKimiFixtures(page);
+      await deleteAgentNetworkProvidersByPrefix(page, PROVIDER_PREFIX);
     } finally {
       await close();
     }

e2e/tests/agent-network-settings-shapes.spec.ts

@@ -1,145 +0,0 @@
-/**
- * Agent Network settings wire-shape spec.
- *
- * The management API signals "account not bootstrapped" differently by
- * generation: current servers answer GET /agent-network/settings with the
- * defaults object carrying an empty endpoint/proxy_address, older ones with
- * 200 + a JSON null body, and the oldest with a 404.
- * useAgentNetworkSettings normalizes all three to the same null-settings
- * signal, and this spec pins that: the providers page must render the
- * connect-first endpoint placeholder for every unbootstrapped shape, and the
- * endpoint badge once the account is bootstrapped. The settings route is
- * mocked per test, so the assertions do not depend on the backend build or
- * on account state left behind by other suites.
- */
-import { test, expect, type Browser, type Page } from "@playwright/test";
-import { loginToApp } from "../helpers/auth";
-
-const AGENT_NETWORK_CONFIG_KEY = "netbird-test-agent-network";
-
-const EMPTY_STATE_TEXT =
-  "Connect your first provider to set up your agent network endpoint.";
-
-const BOOTSTRAPPED_ENDPOINT = "violet.eu.proxy.netbird.io";
-
-// The defaults object current servers return for an account that has not been
-// bootstrapped yet: the mutable settings carry their default values, the
-// endpoint/proxy_address identity is empty, and there are no timestamps because
-// no row has been persisted.
-const UNBOOTSTRAPPED_DEFAULTS = {
-  endpoint: "",
-  proxy_address: "",
-  dedicated: false,
-  enable_log_collection: true,
-  enable_prompt_collection: false,
-  redact_pii: false,
-  access_log_retention_days: 30,
-};
-
-const BOOTSTRAPPED_SETTINGS = {
-  endpoint: BOOTSTRAPPED_ENDPOINT,
-  proxy_address: "eu.proxy.netbird.io",
-  dedicated: false,
-  enable_log_collection: true,
-  enable_prompt_collection: false,
-  redact_pii: false,
-  access_log_retention_days: 30,
-  created_at: "2026-01-01T00:00:00Z",
-  updated_at: "2026-01-01T00:00:00Z",
-};
-
-async function mockSettingsResponse(
-  page: Page,
-  response: { status: number; body: string },
-) {
-  await page.route("**/api/agent-network/settings", (route) => {
-    if (route.request().method() !== "GET") return route.continue();
-    return route.fulfill({
-      status: response.status,
-      contentType: "application/json",
-      body: response.body,
-    });
-  });
-}
-
-async function openProvidersPage(
-  browser: Browser,
-  settingsResponse: { status: number; body: string },
-): Promise<{ page: Page; close: () => Promise<void> }> {
-  const context = await browser.newContext({
-    storageState: "e2e/fixtures/auth/owner.json",
-  });
-  // Close the context on any setup failure — the caller only receives the
-  // close callback once setup succeeds.
-  try {
-    await context.addInitScript(
-      ([key, value]) => {
-        try {
-          window.localStorage.setItem(key as string, value as string);
-        } catch (e) {}
-      },
-      [AGENT_NETWORK_CONFIG_KEY, "enabled"],
-    );
-    const page = await context.newPage();
-    await mockSettingsResponse(page, settingsResponse);
-    await loginToApp(page, "owner");
-    await page.goto("/agent-network/providers");
-    await page.keyboard.press("Escape");
-    return { page, close: () => context.close() };
-  } catch (e) {
-    await context.close();
-    throw e;
-  }
-}
-
-const UNBOOTSTRAPPED_SHAPES: {
-  name: string;
-  response: { status: number; body: string };
-}[] = [
-  {
-    name: "defaults object with empty endpoint (current servers)",
-    response: { status: 200, body: JSON.stringify(UNBOOTSTRAPPED_DEFAULTS) },
-  },
-  {
-    name: "200 with JSON null body (older servers)",
-    response: { status: 200, body: "null" },
-  },
-  {
-    name: "404 (oldest servers)",
-    response: {
-      status: 404,
-      body: JSON.stringify({ message: "settings not found", code: 404 }),
-    },
-  },
-];
-
-test.describe("Agent Network settings wire shapes @agent-network", () => {
-  for (const shape of UNBOOTSTRAPPED_SHAPES) {
-    test(`unbootstrapped account renders the empty state: ${shape.name}`, async ({
-      browser,
-    }) => {
-      const { page, close } = await openProvidersPage(browser, shape.response);
-      try {
-        await expect(page.getByText(EMPTY_STATE_TEXT)).toBeVisible();
-        await expect(page.getByText(BOOTSTRAPPED_ENDPOINT)).toHaveCount(0);
-      } finally {
-        await close();
-      }
-    });
-  }
-
-  test("bootstrapped account renders the endpoint instead of the empty state", async ({
-    browser,
-  }) => {
-    const { page, close } = await openProvidersPage(browser, {
-      status: 200,
-      body: JSON.stringify(BOOTSTRAPPED_SETTINGS),
-    });
-    try {
-      await expect(page.getByText(BOOTSTRAPPED_ENDPOINT)).toBeVisible();
-      await expect(page.getByText(EMPTY_STATE_TEXT)).toHaveCount(0);
-    } finally {
-      await close();
-    }
-  });
-});

e2e/tests/control-center-deploy.spec.ts

@@ -1,88 +0,0 @@
-import { expect, type Response } from "@playwright/test";
-import { test } from "../helpers/fixtures";
-import { deleteGroup, deletePolicyById, listPolicies } from "../helpers/api";
-import {
-  canvasNode,
-  connectNodes,
-  createViaCanvasMenu,
-  enterDraft,
-  expectChangeCount,
-  resetDraftState,
-  reviewButton,
-} from "../helpers/control-center";
-
-test.describe.serial("Control Center Deploy @control-center", () => {
-  test.beforeEach(async ({ dashboardAsOwner: page }) => {
-    await resetDraftState(page);
-  });
-
-  test("Deploys a group+group+policy draft to the account in dependency order", async ({
-    dashboardAsOwner: page,
-  }) => {
-    test.setTimeout(60_000);
-    await enterDraft(page);
-
-    await createViaCanvasMenu(page, "new-group", { fx: 0.3, fy: 0.4 });
-    await createViaCanvasMenu(page, "new-group", { fx: 0.3, fy: 0.7 });
-    const groups = canvasNode(page, "group-new-");
-    await expect(groups).toHaveCount(2);
-
-    await createViaCanvasMenu(page, "new-policy", { fx: 0.65, fy: 0.5 });
-    const policy = canvasNode(page, "policy-new-");
-    await expect(policy).toHaveCount(1);
-
-    // g0 as source, g1 as destination → a complete, trackable policy.
-    await connectNodes(page, groups.nth(0), policy, "sr");
-    await connectNodes(page, groups.nth(1), policy, "sl");
-    await expectChangeCount(page, 3);
-
-    // The canvas assigns generic names, so capture the ids for exact cleanup.
-    const createdGroupIds: string[] = [];
-    const createdPolicyIds: string[] = [];
-    const collectCreatedIds = async (resp: Response) => {
-      if (resp.request().method() !== "POST") return;
-      const url = resp.url();
-      if (url.includes("/api/groups")) {
-        const b = await resp.json().catch(() => null);
-        if (b?.id) createdGroupIds.push(b.id);
-      } else if (url.includes("/api/policies")) {
-        const b = await resp.json().catch(() => null);
-        if (b?.id) createdPolicyIds.push(b.id);
-      }
-    };
-    page.on("response", collectCreatedIds);
-
-    await reviewButton(page).click();
-    await expect(page.getByTestId("cc-deploy")).toBeVisible();
-    await page.getByTestId("cc-deploy").click({ force: true });
-
-    // Deploy finishes by exiting the draft back to live.
-    await expect(page.getByTestId("cc-toolbar-add")).not.toBeVisible({
-      timeout: 30_000,
-    });
-
-    try {
-      await expect.poll(() => createdGroupIds.length).toBe(2);
-      await expect.poll(() => createdPolicyIds.length).toBe(1);
-
-      // Real group ids in the deployed policy prove the groups were created
-      // before it.
-      const policies = await listPolicies(page);
-      const deployed = policies.find((p) => p.id === createdPolicyIds[0]);
-      expect(deployed).toBeTruthy();
-      const rule = deployed!.rules[0];
-      const refIds = [
-        ...(rule.sources ?? []),
-        ...(rule.destinations ?? []),
-      ].map((x: any) => (typeof x === "string" ? x : x?.id));
-      for (const gid of createdGroupIds) expect(refIds).toContain(gid);
-    } finally {
-      // The owner page is worker-scoped, so an attached listener would keep
-      // reading response bodies for every later test on this worker.
-      page.off("response", collectCreatedIds);
-      // Policy first: a group in use can't be deleted.
-      for (const pid of createdPolicyIds) await deletePolicyById(page, pid);
-      for (const gid of createdGroupIds) await deleteGroup(page, gid);
-    }
-  });
-});