* Pick a private-capable proxy cluster when bootstrapping the agent network
The connect-provider wizard bootstraps the account's agent network
endpoint from a proxy cluster it auto-picks off /reverse-proxies/domains,
taking the first validated free domain. That list includes clusters that
cannot host the endpoint: the endpoint is a private service, reachable
only from connected peers and authorised by their tunnel identity, which
needs a cluster with at least one connected embedded proxy — the same
supports_private flag the Reverse Proxy modal gates NetBird-Only Access
on. Management refuses a bootstrap onto a cluster reporting it false, so
the wizard could propose a pick the API rejects, and the endpoint it
assigns is immutable.
Filter the candidates on supports_private before auto-picking, and give
the "nothing to pick" callout a second message for the case where
clusters exist but none of them has an embedded proxy — a different
problem from having no proxy at all, and a different fix.
Only an explicit false disqualifies a cluster: a management build that
predates the flag reports nothing at all, and dropping every cluster
there would block setup on a backend that would have accepted it.
Callout takes an optional data-testid so a spec can assert on the state
it announces rather than on its copy.
* Derive the bootstrap cluster instead of holding it in state
Nothing picks the bootstrap cluster: there is no selector, so the state
could only ever mirror the first usable entry of the domains list, with
an effect writing it back on arrival and a render pass to show it. Derive
it from that list instead, which drops the state, the effect and the two
resets that kept them in sync.
* Declare the e2e proxy private so a bootstrap cluster exists
The connect-provider wizard now offers only clusters whose proxies report
the private capability, because the agent network endpoint is a private
service and management refuses to bootstrap it anywhere else. The e2e
environment's reverse-proxy ran with NB_PROXY_PRIVATE at its default of
false, so with that filter in place no cluster qualified: the wizard
showed the no-cluster callout, Continue stayed disabled, and every spec
that walks through the wizard failed on the Models tab it could no longer
reach — agentgateway, Kimi and the refused-save spec.
Declare the capability on the primary proxy. The no-ports proxy stays
centralised, so the pick also has to skip past a cluster that does not
qualify, which is the case the wizard filter exists for.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sa3DsBDP3VciAi4PPG17L6
* Send the no-cluster callout to the agent network Clusters section
The callout told users to connect a proxy under Reverse Proxy, the generic
services page. Agent Network has its own Clusters tab under Configuration,
which is where a user setting up the agent network expects to manage the
clusters it runs on, so both messages link there instead. The tab and the
callout gate on the same permission (services read), so every role that
sees the callout can follow the link.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sa3DsBDP3VciAi4PPG17L6
* Say private capabilities, not embedded proxy, in the no-cluster callout
The requirement is a cluster with private capabilities, which is what the
supports_private flag reports. Tying the message to an embedded proxy named
one way of getting there as if it were the requirement itself, and pointed
users at the wrong fix. The callout now states the requirement and where to
connect such a cluster.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sa3DsBDP3VciAi4PPG17L6
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Disabled routing peers, network resources, policies and legacy routes were
only distinguishable by a faded row, and the fade also dimmed the controls
needed to re-enable them. Bring back the Active toggle column that was
hidden in #654, and add a cellClassName hook to DataTable with a shared
fadeDisabledRowCells helper that fades every cell of a disabled row except
the toggle and actions cells.
Bump next from 16.3.0 to 16.3.4 and refresh the transitive lockfile
entries that came with it (@next/* swc binaries, sharp 0.35.4,
rolldown, vitest, playwright).
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Remove the unreachable FirewallGPT module and the abandoned traffic-event
detail prototypes, along with the dependencies they were the sole consumers of.
FirewallGPT was disabled in 9d8d9ee4 by removing its trigger button, leaving
the modal mounted but impossible to open. TrafficEventDetails was never
imported anywhere, and it was the only consumer of TrafficEventChart.
Dependency changes:
- Drop @faker-js/faker, whose only usage was mock chart data in the removed
TrafficEventChart. This also resolves GHSA-qxc2-j82w-r537 without needing
the 9 -> 10 major upgrade.
- Drop react-confetti-explosion, only used by the removed
FirewallGPTSuccessModal.
- Bump @types/node to 20.19.43 so it satisfies the peer range of the vite
version pulled in by vitest, silencing an ERESOLVE warning on install.
Stays on the 20.x line to match the Node 20 used in CI.
- Add an allowScripts deny policy for the four packages with install scripts.
Both @axa-fr postinstalls are bare echo statements, fsevents ships a
prebuilt binary, and the unrs-resolver postinstall only verifies a binding
that optionalDependencies already installs.
Surfaces the two bundle parameters added to the management API: an
anonymization level (Default/Strict, shown when anonymization is enabled)
and an optional upload service URL that overrides the default upload
server. The upload URL is validated as an https URL before the job can be
submitted; both fields are omitted from the request when left at their
defaults so the peer applies its own.
Stabilize the flaky Control Center and agentgateway e2e specs (#788)
Three separate causes behind the recent e2e failures.
The group view ranked every group in the account by peer count to decide what
to display, so with two workers it could land on a group another spec had just
created. openGroupView() selects the group by name instead.
Management now checks a provider's upstream URL when the provider is saved and
rejects it unless the URL returns a model list, so the agentgateway spec's
placeholder host stopped working. The test environment runs a stub that answers
the check.
The Backspace test blurred the group panel's search input before that input had
taken focus, so it reclaimed focus and swallowed the key.
The peer view matched policies only by source group membership, so a
policy whose source is the peer itself never appeared in that peer's
view. There was no group fallback either: a rule carrying a
sourceResource has its sources nulled on save, so the group check could
only ever return false for exactly these policies.
Such policies are reachable from the canvas itself, since dragging a
connection off a peer node writes a sourceResource rather than a group.
A user could create a peer-sourced policy, deploy it, drill into that
same peer and not see it.
Match rule.sourceResource against the peer id alongside the group check.
The rendering side needs no change, as select-peer-node is the peer and
its edge to the policy is drawn unconditionally. Draft mode is fixed
transitively: useDraft harvests visible policies from the live view's
nodes, and already draws a sourceResource peer as a source card.
A refused save closed the modal anyway, throwing away the key just typed — and
the API never returns one. Both paths now stop before closing. The failure was
also reported twice and, because notify() only reddens through its promise path,
both times as a success.
Load and submit now spin, say what they are waiting on, and stop taking clicks;
dismissal is refused mid-save, since the write lands regardless and would
otherwise close a session reopened in the meantime.
Discovery carries the record id and the form's URL together, so changing an
endpoint no longer demands the key back. A 422 from it was reported as
unreachable rather than unsupported — useApiCall rejects with { code, message }
and the hook read status, leaving the catalog fallback unreachable.
Discovered models arrived at zero: 0/0 was hardcoded for anything the catalog
lacked by exact id, which stopped being true once discovery returned real rates.
Bedrock felt all of it — its geography-prefixed ids never match by string.
A Playwright spec covers the refusal end to end.
* Add Agent Network Admin and Usage Viewer roles, gate Agent Network per submodule
The management server now ships two delegated roles (agent_network_admin,
usage_viewer) and reports agent_network submodule permissions
(agent_network.providers, .policies, .usage, .logs, .settings, ...) in
/users/current. The dashboard still gated the whole Agent Network section
on services.read, so the new roles saw either everything or nothing.
- register the agent_network module keys so PermissionsProvider fills
denied defaults and typed lookups work
- gate the Agent Network sidebar and pages per submodule: providers,
policies, usage (usage or logs read), configuration (settings)
- show the section when any child is permitted instead of services.read
- add both roles to the role selector, user/invite tables and badges
* Gate Usage and Clusters tabs by their own permissions
A caller holding only agent_network.logs.read landed on the Usage tab it
cannot read, and one holding only agent_network.usage.read could open
Access Logs. Show each tab only with its matching read permission and
fall back to the first permitted tab on deep links.
The Clusters tab is a reverse-proxy surface: its table and controls run
on the services permission, so agent_network.settings alone (e.g.
agent_network_admin) no longer surfaces it.
* Fall back to a known configuration tab for unknown query values
An unknown ?tab= value selected no content pane and left the
configuration page blank; unknown or unauthorized values now fall back
to Global Limits.
* Derive the configuration tab from the URL query
The ?tab= query was mirrored into local state through an effect, which
can lag a render behind the URL and duplicates the source of truth.
Derive the active tab from the query directly; trigger clicks already
push the query themselves, and onChange keeps pushing it for Radix's
keyboard navigation, which fires without a click.
* Derive the usage tab from the URL query
Same treatment as the configuration page: the ?tab= query was mirrored
into local state through an effect, duplicating the source of truth.
Derive the active tab from the query; onTabChange keeps pushing it so
clicks, deep links and back/forward all resolve the same way.
* Group user roles into General and Agent Network tabs
Tab the role dropdown by product surface, gate the Agent Network
roles and tab on the Agent Network surface being available, and
disable the role field for the owner unless the caller is an owner.
* Point agent network learn-more links at their docs pages
* Skip the domains lookup when the role can't read it
* Flatten the role selector and add a caller-scoped My Setup page
The role dropdown split General and Agent Network roles into tabs,
which reads as two products inside one field. Return to the single
flat list from main, keeping the surface gate (Agent Network roles
hidden when the surface is unavailable) and the owner protections.
Regular users had no way to see which providers and models their
policies allow or where to point their tools. Add
/agent-network/my-setup backed by the caller-scoped me/setup and
me/consumption endpoints: the endpoint with copy, per-provider
available models, the Configure Your Agent instructions flattened
inline from the connect modal, and the caller's own usage counters.
The sidebar surfaces it for any role — limited view included —
whenever the caller's setup is configured, and stays hidden when
not, which is indistinguishable from no access by design.
* Fix delegated-role API errors and reuse the usage overview for My Usage
Field testing surfaced three problems. The policy and budget modals'
group selector fetched /networks/resources unconditionally, so an
agent_network_admin without the networks permission got a 403 and an
error toast on the policies page; gate the fetch on networks read.
Restricted users got no navigation at all, so the limited view could
never reach My Setup; render the sidebar for restricted users when
their setup is configured or their role reads an agent_network surface.
Roles below account admin also cannot read the account feature flag
(accounts read), so holding an explicit agent_network grant now counts
as proof the surface exists, while callers with accounts read keep the
flag as the source of truth.
My Usage rendered raw per-window counter rows, nothing like the admin
usage view; render it with the same chart-and-table component as the
admin overview, fed from the caller-scoped me/usage/overview endpoint
that returns the identical bucket shape filtered to the current user.
* Reuse the providers-page agent config on My Setup and self-scope Usage & Logs
My Setup now presents the endpoint exactly like the providers page — the
API Base URL badge with Copy and Agent Config opening the same modal
(provider ids come from the caller's me/setup answer instead of the
admin-permissioned provider context) — and drops the My Usage tab: the
regular Usage & Logs page now serves callers without the account-wide
grants too, showing their own data (the server pins the filters to them),
with the identity and provider filters trimmed since they'd be overridden.
usage_viewer gets working filters: the feature-flag fallback moves into
useAgentNetworkMode, AIProvidersProvider gates each fetch on its
submodule read grant so partially-granted roles don't fire 403s, and
GroupsProvider serves restricted roles that hold the groups read grant.
The limited view also gains the Peers link (the add-your-device page).
* Hide provider write actions from read-only viewers
usage_viewer now reads the provider list, but the page still offered every
write flow: Connect Provider, row-click edit, and the enable/disable/delete
menu. Clicking any of them opened the wizard, which - unable to read the
settings row - warned that Agent Network isn't set up even on configured
accounts. Each action is now gated on its own operation grant: the connect
button needs providers create, row-click edit needs update, and the menu
items need update/delete respectively (no menu at all without either).
* Restore the grouped role selector tabs
Bring back the General and Agent Network tabs in the role dropdown
from 3fbeb1e, undoing the flattening: the tabbed grouping keeps the
list readable as more surfaces ship their own delegated roles. The
surface gate (Agent Network roles hidden when the surface is
unavailable) and the owner protections are unchanged.
* Offer the provider and model filters to self-scoped callers
The providers endpoint now self-scopes on the server, so a configured
plain user fetches it too and the caller's own authorized providers back
the Provider and Model filter options on the self-scoped Usage & Logs
view. The identity filters stay hidden — the server pins user and group
to the caller regardless.
* Give the agent config a single home on Connect Agent
The endpoint card carried an Agent Config action on both the providers
page and the caller-scoped self-service page, so the same connect
snippets had two entry points. EndpointBadge now renders it only when
the caller passes providerIds, which is just the self-service page; the
providers page keeps the URL and Copy. The context-backed
AgentConnectModal wrapper is then unused, so it goes.
Rename that page from My Setup to Connect Agent in the sidebar,
breadcrumb and heading: My Setup was the only first-person label in the
navigation, and Connect Agent stays clear of the Configuration sibling.
* Simplify Bedrock config
* Inline the agent config on the Connect page
Drop the Agent Config modal: its snippets now render inline under the
endpoint card, so AgentConnectModal is just AgentConnectTabs and
EndpointBadge is back to the URL and Copy. Move the route to
/agent-network/connect and swap the hand-rolled provider list for the
standard DataTable. Follow the backend rename of me/setup to
agent-config.
* Show a policy's allowed models in the policies table
A policy's model restrictions live on the guardrails attached to it, so
the new Models column unions the enabled model allowlists: one chip for
a single model, a count with the names on hover past that, and a
Restrict badge opening the guardrails tab when nothing narrows the
policy. Clicking the column lands on that tab too.
Chip the models on the Connect Agent table instead of comma-joining
them, and capitalize the model counts across all three tables to match
the "2 Groups" chips on Peers.
* Point the Kimi e2e config assertions at the Connect Agent page
The Kimi-gated config surfaces moved: the Agent Config modal is gone and
the snippets render inline on /agent-network/connect, so the spec stopped
finding the button it used to click on the providers page. Navigate to the
Connect page instead.
That page's answer is caller-scoped — it only offers providers the
caller's own policies authorize — so the spec now grants the owner the
freshly connected provider through a dedicated group + policy, torn down
again (group detached from the owner first) before and after the run. The
backing GET /agent-network/agent-config ships with newer management
builds; on builds that predate it the suite skips, same as the existing
catalog and settings-bootstrap probes.
* Hand the agent config to every account member
The agent-config answer withheld the endpoint from callers no policy
covers, so "account not set up" and "you have no access" were the same
shape. The dashboard shows every user the same connection config, so
Configured now tracks the account: once it has an endpoint every member
gets it, with an empty providers list for those no policy covers. That
list stays caller-scoped, and the endpoint authorizes nothing on its own
since the gateway still refuses every request no policy permits.
Rename the files and symbols the endpoint outgrew when it became
/agent-network/agent-config: me_handler.go, setup.go and types/setup.go
become agent_config.go, GetSetupForUser becomes GetAgentConfigForUser,
and the AgentNetworkMeSetup schema becomes AgentNetworkAgentConfig.
Regenerating types.gen.go from the untouched spec first reproduced it
byte for byte, so the generated diff is only these renames.
* Let the surface switch decide the Agent Network section
Connect Agent and Usage & Logs were visible on the caller's own setup
alone, so a deployment with Agent Network off still showed them, and the
route tree then 404d the links the nav had just rendered. The switch now
decides first.
The caller's agent config still stands in for the switch, but only for
callers who cannot read the config themselves - otherwise an account
holding an endpoint kept the surface on for its owner regardless.
* Collapse the two User types the merge left behind
Both sides of the merge declared a User type, in different regions of the
helper, so the merge took both without ever reporting a conflict and
Playwright refused to parse the file. One type now carries the union of
the fields the /users answer returns.
* Fix SNAPSHOT version display
* Fix e2e tests
* Fix e2e tests
* Fix version display
* Fix e2e
* Fix e2e
* Fix e2e
---------
Co-authored-by: braginini <bangvalo@gmail.com>
* Add multi-select bulk deletion for Access Control groups
* Add indeterminate group selection and permission-safe column visibility
* Background rule for checkbox component
* Better show when disabled
The generated Docker command used --rm, which removes the container on
stop. Combined with -d, the NetBird client would not survive a host
reboot despite the persistent netbird-client volume. Replace with
--restart=unless-stopped so the client reconnects automatically.
* Fix typo in PeerExpirationToggle component
* Fix the same typo in PeerActionCell
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Add a workflow bumping the WASM client on netbird releases
* Cover the pinned WASM client with an instantiation test
* Connect the pinned WASM client to management in the e2e suite
* Validate the dispatched tag before it reaches the shell and satisfy lint
* Sort the spec imports
* Clean up the registered peer even when the connect test fails
* Drive the dashboard's own remote-access flow instead of the client directly
* Mint the flow test's target peer by exposing a service
* Limit the wasm check to what the test environment can prove
* Give the wasm download and compile a realistic budget
* Hold the wasm client to the dashboard's initialization deadline
Loading a provider's models merged anything the catalog did not already carry
by exact id, and hardcoded both rates to zero on the way in. The comment gave
the reason: the discovery response carried no prices. That stopped being true
when the endpoint began returning the same rates the proxy bills with.
Bedrock feels all of it. Its listing returns geography-prefixed ids —
eu.anthropic.claude-opus-4-7 — while the catalog holds the bare
anthropic.claude-opus-4-7, so no Bedrock model ever matches by string and every
one of them takes this branch. Selecting one filled its row with $0, and the
form then warned that the model had no cost set, while the API had reported a
rate for it. Usage against it records nothing.
Exact-id matching stays. Collapsing a geography-prefixed id onto its catalog
entry would hand back the bare form, and only the prefixed one is invocable at
AWS.
The model picker only offered NetBird's compiled-in catalog, which goes stale as
vendors retire models and cannot reflect what an account is actually entitled to.
Adds a "Load models from provider" action backed by
`POST /agent-network/catalog/providers/models` (netbirdio/netbird#7246). Editing a
saved provider reuses the stored credential, so the masked key never reaches the
browser; creating a new one sends the key being typed. Discovered models merge into
the catalog options, with catalog entries winning a collision because they carry
pricing. A model the backend reports as unpriced is flagged and needs confirmation
before saving, so nothing is registered at a silent zero.
Two implementation notes: the unpriced warning renders once at list level rather
than per row, and the hook uses `ignoreError: true` so a provider-specific failure
is reported inline in the modal instead of as a global toast.
The HubSpot form behind the self-hosted Agent Network signup now has a
required company-scoped Country/Region field, so submissions without it
are rejected. Adds a searchable Country dropdown to the signup step and
includes the value as an objectTypeId 0-2 field.
Uses a static country list instead of /locations/countries since the
geolocation database may be absent on self-hosted deployments and the
HubSpot property expects full country names, not ISO codes.
The desktop client reworked its UI in v0.75: the management server is now
asked for on the first-run "Set up NetBird" screen and lives under
Settings > General, so the "Settings > Advanced Settings" path the Windows
and macOS tabs described no longer exists. Move the copy into a shared
ManagementUrlStep, cover the already-installed case, and say "menu bar"
instead of "system tray" on macOS.
Fixes#732
* Remove unnecessary comment
Alpine 3.14 reached end of life in May 2023 and has received no security
fixes for roughly three years. nginx is installed from the Alpine repos
rather than pinned, so the base bump also moves nginx 1.20.2 -> 1.30.4,
certbot 1.16.0 -> 5.6.0 and supervisor 4.2.2 -> 4.3.0.
Alpine 3.24 carries security support until June 2028.
Verified by building and running this Dockerfile on 3.14, 3.23 and 3.24 and
comparing: the served index.html is byte-identical across all three, the CSP
response header hashes identically, `nginx -t` passes on the existing config,
and supervisord reaches the same state. /etc/crontabs/root and
/etc/nginx/http.d/ still exist on 3.24, so the `rm /etc/crontabs/root` step and
the config COPY paths are unaffected. Every certbot flag used by init_cert.sh
is still accepted by certbot 5.x.
Certificate issuance itself could not be exercised without a real domain, so
the certbot 1.x -> 5.x jump should get one staging issuance before rollout.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: upgrade to Next.js 16.3
Turbopack is now the default for both `next dev` and `next build`, so the
separate `turbo` script is redundant and has been dropped.
`next build` rewrites tsconfig `moduleResolution` to "bundler", which Next 16
expects.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: migrate ESLint to flat config
`next lint` was removed in Next 16, so `npm run lint` had been failing with
"Invalid project directory provided, no such directory: ./lint" since that
upgrade. eslint-config-next 16 also ships flat config only, which the old
.eslintrc.json could not consume.
Ignores .claude/ so stray worktree copies of the repo are not linted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: replace ip-cidr with ip-address to clear CVE advisories
ip-cidr pulled a vulnerable ip-address (GHSA-mwp4-54f8-5fhr, high: leading-zero
octets decoded as decimal while resolvers read them as octal, enabling SSRF;
GHSA-v2v4-37r5-5v8g, moderate: XSS in Address6 HTML methods). npm reported "no
fix available" because even the latest ip-cidr pins ip-address ^9.0.5, still
inside the vulnerable range.
ip-address 10.x was already a direct dependency and covers every use: its
isValid rejects leading-zero octets and validates mask ranges natively, and
isInSubnet replaces the one `new cidr().contains()` call site.
The new validators were differential-tested against the real ip-cidr over a
67-input corpus (134 checks) before removal, with no divergences; containment
was checked across 14 v4/v6/boundary/cross-family cases. `npm audit` now
reports 0 vulnerabilities.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: replace next-themes with an in-repo ThemeProvider
next-themes renders an inline <script> to set the theme before paint. It was
loaded through dynamic(ssr: false), so that script rendered on the client, where
React 19 never executes script tags and warns:
Encountered a script tag while rendering React component.
Upgrading would not have helped; 0.4.6 still renders the script
unconditionally. The script was also useless here: injected after hydration, it
could not prevent a flash, and postbuild.js hoists inline scripts out of the
export anyway.
The replacement keeps the same `netbird-theme` storage key and three-mode
support, and sets the theme class on <html> in the layout instead, so the
static export ships the correct theme in its first byte with no script at all.
Dropping the dynamic(ssr: false) wrapper removed an implicit prerender bailout
for the whole provider tree, which exposed isNetBirdCloud() reading
window.location during the build-time render; it is now guarded. The exported
HTML is byte-identical either way, since the page already bails to client
rendering.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: key the router children slot in the dashboard layout
React logged "Each child in a list should have a unique key prop. Check the
render method of DashboardPageContent." The App Router's segment element for
`children` arrives with a null key, which React flags once it is reconciled
alongside the Navigation sibling. Wrapping it in a keyed Fragment resolves it.
Verified in the browser both ways: with the Fragment the console is clean,
without it the warning returns.
Also applies the pending simple-import-sort fix for this file.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: match IPv4-mapped IPv6 hosts against IPv4 CIDRs
Regression from replacing ip-cidr. Its contains() normalised an IPv4-mapped
IPv6 address to the embedded v4 before the subnet check, so
contains("::ffff:10.0.0.5") on 10.0.0.0/24 returned true; isHostInCIDR returned
false. Verified against ip-cidr@3.1.0 directly.
This is reachable: isValidIP accepts "::ffff:10.0.0.5", so a mapped host entered
in ReverseProxyAddressInput against an IPv4 resource CIDR was wrongly rejected.
An IPv6 network still rejects a mapped host, so families do not leak. Checked
across 20 cases (6 mapped-host, 14 pre-existing), with the mapped expectations
taken from measured ip-cidr output.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: derive skeleton colors from the resolved theme
SkeletonTheme had the dark palette hardcoded, so a light theme would render
dark skeletons. The light values are the ones already defined on the
feature-light-theme branch rather than new invented colors.
resolvedTheme is tracked in state and updated from the existing apply(), so the
palette also follows the OS preference under "system".
Latent today, since DarkModeToggle disables both Light and System.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: center icons in collapsed navigation rail
Nav items have 24px of left padding (px-3 on the li plus px-3 on the
button), so with 16px icons the icon center lands at 32px. The 70px rail
centered at 35px, leaving icons 3px off. Narrow the rail to 64px so the
two line up, and match the content offset in PageContainer.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: use one plus icon across network tab Add buttons
The Resources and Routing Peers Add buttons used tabler's IconCirclePlus
while the Services tab used lucide's PlusCircle. Both were size 16, but
the two icon sets draw at different inner scales, so the glyphs read as
different sizes. Standardize on lucide.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adopts the new Agent Network settings contract:
- The management API replaced the implicit settings bootstrap — a
`bootstrap_cluster` hint on the first provider create — with an
explicit POST /agent-network/settings carrying the proxy cluster
address. The settings response now carries endpoint +
proxy_address + dedicated instead of cluster + subdomain.
- The provider wizard keeps its UX (auto-picking a validated cluster,
gating the first create on having one) but now bootstraps the
settings row with the explicit POST right before the first provider
create. A bootstrap failure keeps the wizard open and surfaces the
error — previously a failed bootstrap was swallowed server-side and
the account silently ended up with a provider but no endpoint. A 409
(concurrent bootstrap won) is treated as success, since the row
exists either way.
- Types updated accordingly; bootstrapAgentNetworkSettings is exposed
on the providers context. The onboarding provider step reuses the
same wizard, so it is covered by the same change.
Without this, the dashboard against a new management silently stops
bootstrapping accounts: provider create succeeds (the old hint is an
ignored unknown field), but no endpoint is ever assigned.
Self-hosted management versions can carry a numeric build suffix
(e.g. 0.76.3-31256681241) that overflows the sidebar box. Show the
semver only and move the full string into the hover tooltip alongside
the latest version. Pre-release labels like -rc.1 are preserved.
The onboarding survey opened a HubSpot booking modal for accounts with
50+ planned users. Removes the modal, its onboarding-call experiment
variants, the trigger in Onboarding.tsx, and the now-unused avatar.
Keeps src/cloud/cloud-hooks/useExperiment.ts, which this was the only
consumer of, for a future experiment.
* Handle agent-network settings defaults response
The management API now answers the settings GET with a defaults object
before the account is bootstrapped (empty cluster/subdomain/endpoint)
instead of a JSON null body. Normalize that shape to the existing null
settings signal so every consumer keeps a single not-bootstrapped check,
while still tolerating the null body and 404 from older backends.
* Pin the settings wire-shape normalization in a Playwright spec
The providers page must render the connect-first empty state for every
unbootstrapped settings shape the management API has answered with over
time (defaults object with an empty endpoint, JSON null body, 404) and
the endpoint badge once bootstrapped. The settings route is mocked per
test so the spec is independent of the backend build and of account
state left behind by other suites.
* Address review: no stale settings on 404, close context on setup failure
useFetchApi keeps the previous SWR data alongside the error, so a later
404 could expose stale settings through the memo; it now yields null
when the error is a 404 while still riding out transient failures on
the kept data. The wire-shapes spec closes its browser context when a
setup step throws before the close callback is handed to the test.
Zypper ignores the gpgkey= entry of a .repo file, so the yum snippet would
leave the repository key uninstalled on openSUSE. The new distro entry adds
the repository with GPG checking enabled and imports the key on refresh.
* Cover RPM-based distros and desktop app dependencies in the Linux tab
The manual-install section of the add-peer modal only covered Ubuntu via
APT. Replace the single Ubuntu accordion with a distro selector covering
Debian/Ubuntu (APT), Fedora (DNF), RHEL/AlmaLinux/Rocky (DNF), and Amazon
Linux (YUM).
The desktop app links GTK 4.10+ and WebKitGTK 6.0 but the released
netbird-ui packages do not declare them, so each desktop-app install line
names the packages explicitly and a callout states the minimum release
(Ubuntu 24.04, Debian 13, Fedora 43, RHEL 10 with EPEL). Distros without
the required stack get CLI-only instructions.
* Add e2e coverage for the Linux distro selector
* Add Kimi (Moonshot AI) provider support to Agent Network UI
Pairs with the management catalog's new kimi_api entry:
- kimi_api in the AIProviderId union and the access-log provider-id
normalization list.
- Provider modal: api.moonshot.ai host placeholder, upstream-URL help
explaining the OpenAI-shape (/v1) vs Anthropic-shape (/anthropic)
path choice, sk-... key placeholder.
- Configure Your Agent: Kimi backend option in the Claude Code tab
(JSON + shell modes), a Kimi variant in the Codex tab using
wire_api="chat", and a new Kimi CLI tab with the ~/.kimi/config.toml
provider setup. All Kimi surfaces render only when a kimi_api
provider is connected, and pre-select themselves when Kimi is the
only provider of its shape.
- Onboarding defaults to the Claude Code tab for Kimi providers.
* Add Kimi provider e2e spec
Walks the Kimi lifecycle against the real backend: select kimi_api from
the catalog (prefilled host, catalog model pricing), connect it, then
assert the Kimi-gated Configure Your Agent surfaces (Kimi CLI tab,
Claude Code kimi-k3 config, Codex wire_api=chat variant) and clean up
via new agent-network API helpers. Skips when the management build
under test has no kimi_api catalog entry, so it can merge ahead of the
backend and activate once the management-cloud image carries it.
* Remove Codex option for Kimi and align Claude Code config with Moonshot guide
Codex has no clear support against Moonshot's upstream, so the Kimi
variant is dropped from the Codex tab. The Claude Code Kimi snippet now
pins all default model tiers and the subagent model to kimi-k3 and
disables tool search, per Moonshot's Claude Code guide.
* Carry the /anthropic shape prefix in the agent base URL for Kimi
The Kimi provider keeps its default https://api.moonshot.ai upstream;
Claude Code and Kimi CLI select the Anthropic shape by appending
/anthropic to the endpoint base URL, which rides through to Moonshot.
One provider now serves both API shapes.
* Kimi CLI uses the bare endpoint base URL
Only Claude Code carries the /anthropic prefix; Kimi CLI's anthropic
provider type points at the bare endpoint.
* Kimi tooltip
* Make the Claude Code provider dropdown width flexible and tidy Kimi notes
* Make the Claude Code provider dropdown width flexible and tidy Kimi notes
* Restored the note on the Kimi CLI tab
---------
Co-authored-by: braginini <bangvalo@gmail.com>
When creating a network resource and adding a policy with a single peer
(sourceResource) as the source, the payload included both an empty
`sources: []` array and `sourceResource`, causing the backend to reject
it with "specify either sources or source resources not both".
`createPolicyForResource` always computed `sources` as an array while the
`...rule` spread carried `sourceResource` through. This mirrors the
existing destinations handling: gate `sources` on `rule.sourceResource`
so it becomes undefined (and is dropped during serialization) when a
source resource is set.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Make Agent Network menu available via dashboard_features.agent_network
Wire the new dashboard_features account setting into the dashboard at the API
level: add it to the Account settings interface (so settings updates round-trip
it) and have useAgentNetworkMode treat dashboard_features.agent_network === true
as enabling the Agent Network menu alongside the full dashboard. Unlike
agent_network_only it does not focus the dashboard, and it does not trigger the
onboarding flow. No settings-menu UI yet; the field is set via the API.
* Add e2e coverage for dashboard_features.agent_network menu availability
* Set dashboard_features for existing netbird.ai accounts
The signup-source flow only handled new accounts (agent_network_only) and
discarded the source for existing accounts, so nothing set dashboard_features.
Branch on account existence: new accounts get the focused view, existing
accounts get the Agent Network menu made available via
dashboard_features.agent_network. Adds e2e coverage for the existing-account
write.
* Also enable Agent Network menu for new netbird.ai accounts
New accounts got agent_network_only (focused) but not
dashboard_features.agent_network, so turning the focused view off later would
remove the Agent Network menu entirely. Set both on new accounts so disabling
focus degrades to menu-available rather than losing access.
* Match badged nav labels by substring in dashboard_features e2e
* Treat agent network deployment config as a floor over account setting
* Add agent network env x signup-source e2e matrix with a config override
Accounts that sign up through netbird.ai are focused on the Agent Network
surface and taken through the Agent Network onboarding. Reversible by the user
and a no-op for every other account.
- Capture ?signup_source=netbird.ai pre-auth (survives the OIDC redirect); once
authenticated, mark new accounts with settings.agent_network_only, awaiting
/accounts revalidation before clearing the source so the view never flips.
- useAgentNetworkMode() resolves the mode with nullish semantics: an explicit
account setting (true or false) wins over deployment config; when absent, a
pending netbird.ai signup or NETBIRD_AGENT_NETWORK_ONLY/_ENABLED decides.
Purely additive — unchanged behavior when the setting is absent.
- Navigation, the agent-network route guard, control-center, and fetch gates
read the resolver instead of the config flags.
- Onboarding: the form is chosen from signup_source synchronously, so netbird.ai
arrivals see the Agent Network signup form (now shown on cloud) and never the
regular form, even under a slow backend.
- Client Settings gains an "Agent Network focused view" opt-out toggle.
- E2E coverage for focused-view menu/routes and onboarding form selection.
* feat: default billing to EUR only, preserve USD for active subscribers
Removes the USD/EUR currency selector from Plans & Billing. New
subscriptions, MSP tenants, and distributor customers now default to
EUR; any existing active USD subscription keeps its real currency so
its price stays accurate.
Also fixes a latent bug where MSP/distributor per-tenant pricing was
computed off the admin's own account currency instead of each
tenant's, pins AWS Marketplace checkout to USD since it's a separate
billing rail, and removes an unused dead TotalCost stub from the MSP
Tenants table.
* move currency helper into provider
* force usd for aws
* fix flaky setup key test
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Show management API request id in error notifications
Newer management servers return an X-Request-Id header on every response,
including errors. Surface it in the error toast so it can be quoted in
support tickets.
- api.tsx: read X-Request-Id from the response and attach it to the
rejected ErrorResponse (both the JSON-body and status-text paths).
- Notification.tsx: render a copyable "Request ID" line whenever an error
carries one, covering the promise-based mutation notifications.
- ErrorBoundary.tsx: thread the request id through for GET/fetch errors.
The line is only shown when the header is present, so older servers that
do not send it are unaffected. Adds an e2e spec covering both cases.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016B2yLBeDK3kvX2FvhqcWk8
* docs: add request-id error toast screenshots for PR
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016B2yLBeDK3kvX2FvhqcWk8
* test: expose X-Request-Id via CORS in e2e mock
The dashboard reads the request id from a cross-origin response, so the
browser only surfaces the header to JS when the response lists it in
Access-Control-Expose-Headers. Mirror a CORS-enabled management server in
the mock so the test exercises the dashboard logic rather than the header
being filtered out cross-origin.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016B2yLBeDK3kvX2FvhqcWk8
* test: assert error toast via data-testid instead of text
Add a notification-title testid to the toast and target it with
getByTestId in the request-id spec, following the repo convention of
selecting by data-testid rather than brittle visible text.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Add Metrics settings tab with metrics push toggle
Add a dedicated Metrics tab to Settings with a toggle for enabling
anonymous performance metrics collection. Moves metrics out of the
Clients tab into its own tab with description and docs link.
* Update docs link
* fix(docker): reload nginx after patching CSP header
nginx is started by supervisord (priority 100) before init_react_envs.sh
(priority 201) and is never reloaded afterwards, so it keeps serving the
static default.conf CSP that has no connect-src. Over plain HTTP this blocks
OIDC discovery and the management API, breaking browser SSH/RDP auth.
Reload nginx at the end of the init script so the dynamically built CSP
header takes effect.
* Update docker/init_react_envs.sh
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix(docker): log nginx -t output on failed CSP reload
When the reload never succeeds, run nginx -t before exiting so the logs show
whether the patched config is invalid or nginx never came up.
* conditionally emit `upgrade-insecure-requests` in CSP
---------
Co-authored-by: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: mlsmaycon <mlsmaycon@gmail.com>
NetBird Dashboard is NetBirds Management server UI. It allows users to signin, view setup keys and manage peers. This image is **not ready** for production use.
## Tags
```latest``` ```vX.X.X``` not available yet.
```main``` built on every PR being merged to the repository
NetBird Dashboard is NetBird's management server UI.
## Tags
Each published image tag also has a rootless variant with the `-rootless`
suffix. For example, `main` is also published as `main-rootless`.
## How to use this image
HTTP run:
HTTP:
```shell
docker run -d --rm -p 80:80 wiretrustee/dashboard:main
docker run -d --rm -p 80:80 netbirdio/dashboard:main
```
Using SSL certificate from Let's Encrypt®:
Using an SSL certificate from Let's Encrypt:
```shell
docker run -d --rm -p 80:80 -p 443:443 \
-e LETSENCRYPT_DOMAIN=app.mydomain.com \
-e LETSENCRYPT_EMAIL=hello@mydomain.com \
netbirdio/dashboard:main
```
> For SSL generation, you need to run this image in a server with proper public IP and a domain name pointing to it.
For certificate generation, the server needs a public IP and a domain name
pointing to it.
### Rootless and OpenShift
The rootless image listens on port `8080`, runs as UID `10001` by default, and
supports OpenShift's arbitrary UID when the container retains GID `0`:
Loaded 20 of 542 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
TechHutTV
Maycon SantosandClaude Fable 5.1
Jack Carter
Pascal Fischer
Eduard GertandClaude Opus 5
Nicolas Frati
Daneyon Hansen
Brandon Hopkins
Shaban Mohammedsaani Hassan
Viktor Liu
Brad Ison
Bethuel Mmbaga
Zoltan Papp
Max Bruch
