netbirdio/netbird · error

wait for extend session: %v

Error message

wait for extend session: %v

What it means

Wraps a failure of client.WaitExtendAuthSession, a long-poll gRPC call to the NetBird daemon (unix socket /var/run/netbird.sock or Windows named pipe) that blocks until the user finishes device-code auth in a browser. The error is either a transport failure (daemon stopped, connection dropped mid-wait, ctx cancelled via Ctrl+C) or a daemon-side error propagated from management while extending the login session (peer not connected, management unreachable).

Source

Thrown at client/cmd/login.go:219

	}

	startResp, err := client.RequestExtendAuthSession(ctx, req)
	if err != nil {
		return fmt.Errorf("start extend session: %v", err)
	}

	uri := startResp.GetVerificationURIComplete()
	if uri == "" {
		uri = startResp.GetVerificationURI()
	}
	openURL(cmd, uri, startResp.GetUserCode(), noBrowser, showQR)

	waitResp, err := client.WaitExtendAuthSession(ctx, &proto.WaitExtendAuthSessionRequest{
		DeviceCode: startResp.GetDeviceCode(),
		UserCode:   startResp.GetUserCode(),
	})
	if err != nil {
		return fmt.Errorf("wait for extend session: %v", err)
	}

	if ts := waitResp.GetSessionExpiresAt(); ts.IsValid() && !ts.AsTime().IsZero() {
		deadline := ts.AsTime().Local()
		cmd.Printf("Session extended. New expiry: %s\n", deadline.Format("2006-01-02 15:04:05 MST"))
	} else {
		// Management reported the peer is not eligible (e.g. login
		// expiration disabled on the account). Surface that fact
		// instead of pretending the call succeeded.
		cmd.Println("Session extension call completed, but the management server did not return a new deadline (peer may not be SSO-tracked or login expiration is disabled).")
	}
	return nil
}

func getActiveProfile(ctx context.Context, pm *profilemanager.ProfileManager, profileName string, username string) (*profilemanager.Profile, error) {
	// switch profile if provided

	if profileName != "" {

View on GitHub (pinned to 93e97f4bf1)

Solutions

  1. Check the daemon is running: 'netbird service status' (or systemctl status netbird) and 'netbird service start' if not; then rerun the command
  2. Inspect daemon logs (journalctl -u netbird or the daemon log file) for the underlying management error surfaced by the RPC
  3. Verify the daemon can reach the management URL (network, firewall, DNS) and that the peer shows Connected in 'netbird status'
  4. If the code expired or auth was aborted, rerun and complete the browser step promptly

Example fix

// before
waitResp, err := client.WaitExtendAuthSession(ctx, &proto.WaitExtendAuthSessionRequest{...})
if err != nil {
    return fmt.Errorf("wait for extend session: %v", err)
}

// after: distinguish user cancel / daemon down from server-side denial
waitResp, err := client.WaitExtendAuthSession(ctx, &proto.WaitExtendAuthSessionRequest{...})
if err != nil {
    switch status.Code(err) {
    case codes.Canceled:
        return fmt.Errorf("extend session canceled: %w", err)
    case codes.Unavailable:
        return fmt.Errorf("daemon unreachable, run 'netbird service start': %w", err)
    default:
        return fmt.Errorf("wait for extend session: %w", err)
    }
}
Defensive patterns

Strategy: try-catch

Validate before calling

// Probe the daemon before starting the extend flow
conn, err := DialClientGRPCServer(ctx, daemonAddr)
if err != nil {
    return fmt.Errorf("daemon not reachable: %w", err)
}
client := proto.NewDaemonServiceClient(conn)
if _, err := client.Status(ctx, &proto.StatusRequest{}); err != nil {
    return fmt.Errorf("daemon not ready: %w", err)
}

Try / catch

if err := waitExtend(ctx); err != nil {
    switch status.Code(err) {
    case codes.Canceled, codes.DeadlineExceeded:
        // user abort or expiry: safe to retry the whole flow
        return retryExtend(ctx)
    case codes.Unavailable:
        return fmt.Errorf("daemon down, run 'netbird service start': %w", err)
    default:
        return fmt.Errorf("wait for extend session: %w", err)
    }
}

Prevention

When it happens

Trigger: Calling 'netbird login --extend-session' (or the extend flow) and: cancelling the command before completing browser auth; daemon restarted or crashed while the CLI was blocked in WaitExtendAuthSession; device code expiring server-side; daemon not connected to management so the extension request fails.

Common situations: Daemon stopped mid-wait (netbird service stop, OOM kill, package upgrade restarting the service); management server unreachable from the daemon host; slow browser auth in SSH sessions where the code expires; running the CLI as a user without access to the daemon socket.

Related errors

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/3ab1f6e5b03b69dc. Report an issue: GitHub.