macOS UI does not recover when the LaunchDaemon is unloaded; Connect silently does nothing

[core3750x]

Summary

On macOS, the NetBird tray UI can start while the system daemon is not registered with launchd. The tray menu loads slowly, and clicking Connect produces no visible response. Reinstalling the same NetBird package fixes the problem because the installer starts the service as root.

The UI should detect this state and either recover the installed LaunchDaemon or show an actionable error instead of silently ignoring Connect.

Environment

• macOS (Apple Silicon)
• NetBird PKG installation
• NetBird UI / CLI: v0.73.2
• Installed app: /Applications/NetBird.app
• LaunchDaemon plist: /Library/LaunchDaemons/netbird.plist

Observed state

The app and service definition are installed, but the launchd job and daemon socket are absent:

$ launchctl print system/netbird
Bad request.
Could not find service "netbird" in domain for system

$ ls /var/run/netbird.sock
ls: /var/run/netbird.sock: No such file or directory

The CLI confirms that its gRPC connection cannot reach the daemon:

grpc: addrConn.createTransport failed to connect to
{Addr: "/var/run/netbird.sock" ...}
Err: transport: Error while dialing: dial unix /var/run/netbird.sock:
connect: no such file or directory

The last daemon log entries show a clean shutdown and no later restart:

service is down
shutdown signal received
stopped NetBird service

At the same time:

• /Library/LaunchDaemons/netbird.plist still exists and is owned by root:wheel.
• /usr/local/bin/netbird correctly points to the binary inside NetBird.app.
• KeepAlive is enabled in the plist, but that cannot help after the job has been booted out of launchd.
• Starting only NetBird.app leaves the daemon unavailable.
• Clicking Connect in the UI is a silent no-op.

Reproduction / recovery

1. Install NetBird from the macOS PKG and connect normally.
2. Reach a state where the NetBird LaunchDaemon has been unloaded while its plist remains installed (this happened after the UI had been fully quit; the exact actor that unloads the job still needs instrumentation).
3. Start NetBird.app again.
4. Open the tray menu and click Connect.

Actual: the UI remains running but cannot connect to the daemon, and Connect gives no actionable feedback.

Expected: the UI should clearly identify that the installed daemon is unavailable. Ideally it should invoke a supported privileged recovery flow; at minimum it should explain that the service must be started and surface the exact recovery action.

Manual recovery, without reinstalling:

sudo /usr/local/bin/netbird service start

Reinstalling the exact same v0.73.2 package also recovers the client. Its post-install log explains why:

/usr/local/bin/netbird service start
NetBird service has been started

Code notes

In v0.73.2, tray Quit only calls systray.Quit() (client/ui/event_handler.go), so the current evidence does not prove that Quit itself unloads the daemon. The robust bug is the missing recovery/actionable-error path when the UI is launched with an installed but unloaded daemon.

main has a rewritten Wails UI and already models this state as DaemonUnavailable, so the fix should target the current UI rather than the removed v0.73.2 systray implementation.

Acceptance criteria

• Starting the macOS UI with an installed but unloaded NetBird LaunchDaemon does not leave Connect as a silent no-op.
• The tray clearly distinguishes daemon-unavailable from ordinary disconnected state.
• Clicking Connect in daemon-unavailable state either starts/re-registers the service through a supported privileged mechanism or shows an actionable recovery message.
• Add automated coverage for Connect while status is DaemonUnavailable where practical.
• Do not expose configuration, peer identifiers, management URLs, or other sensitive data in diagnostics.