fix(cloud): tell the truth about a machine-list server error instead of 'Cloud is unreachable' (#11597)

.github/workflows/ci.yml

@@ -323,6 +323,9 @@ jobs:
       - name: Validate universal nightly workflow
         run: bash ./tests/test_nightly_universal_build.sh
 
+      - name: Validate nightly auth callback plist rewrite
+        run: python3 tests/test_nightly_auth_callback_scheme.py
+
       - name: Validate cmux-tui client commit resolution
         run: ./tests/test_ci_resolve_cmux_tui_client_commit.sh
 

.github/workflows/nightly.yml

@@ -934,13 +934,13 @@ jobs:
             /usr/libexec/PlistBuddy -c "Set :CFBundleName ${CHANNEL_APP_NAME}" "$app_plist"
             /usr/libexec/PlistBuddy -c "Set :CFBundleDisplayName ${CHANNEL_APP_NAME}" "$app_plist"
             /usr/libexec/PlistBuddy -c "Set :CFBundleIdentifier ${bundle_id}" "$app_plist"
-            local url_type_name
-            url_type_name="$(/usr/libexec/PlistBuddy -c "Print :CFBundleURLTypes:1:CFBundleURLName" "$app_plist")"
-            if [[ "$url_type_name" != *.auth ]]; then
-              echo "Expected CFBundleURLTypes[1] to be the auth URL type, found: $url_type_name" >&2
-              exit 1
-            fi
-            /usr/libexec/PlistBuddy -c "Set :CFBundleURLTypes:1:CFBundleURLSchemes:0 ${CHANNEL_URL_SCHEME}" "$app_plist"
+            # Resolve the auth URL type by its semantic name/scheme. Xcode can
+            # reorder CFBundleURLTypes, so a numeric index silently changing
+            # the web or SSH scheme would strand the browser sign-in handoff.
+            python3 ./scripts/ci/set-nightly-auth-callback-scheme.py \
+              "$app_plist" \
+              "${CHANNEL_URL_SCHEME}" \
+              --base-scheme cmux
             /usr/libexec/PlistBuddy -c "Delete :SUPublicEDKey" "$app_plist" >/dev/null 2>&1 || true
             /usr/libexec/PlistBuddy -c "Delete :SUFeedURL" "$app_plist" >/dev/null 2>&1 || true
             /usr/libexec/PlistBuddy -c "Add :SUPublicEDKey string ${SPARKLE_PUBLIC_KEY}" "$app_plist"

CLI/CLISocketPathResolver.swift

@@ -226,12 +226,17 @@ struct CLISocketPathResolver {
 
     /// Resolves a socket using one ordered, liveness-aware discovery pass.
     ///
-    /// Explicit flag and environment paths are deliberately returned verbatim and are
-    /// never probed or rerouted. Implicit discovery only selects a path after a real
-    /// non-blocking connect succeeds; a stale socket file is never handed to the client.
+    /// Explicit flag paths are deliberately returned verbatim and are never probed or
+    /// rerouted. Ordinary environment paths keep that same compatibility behavior. A
+    /// side-effecting caller such as `vpn` passes an implicit source with
+    /// `allowCrossVariantFallback` disabled, which limits discovery to this build's
+    /// own socket and marker files. Implicit discovery only selects a path after a
+    /// real non-blocking connect succeeds; a stale socket file is never handed to the
+    /// client.
     func resolve(
         requestedPath: String,
-        source: CLISocketPathSource
+        source: CLISocketPathSource,
+        allowCrossVariantFallback: Bool = true
     ) -> CLISocketPathResolution {
         guard source == .implicitDefault else {
             return CLISocketPathResolution(
@@ -242,7 +247,10 @@ struct CLISocketPathResolver {
             )
         }
 
-        let candidates = Self.dedupe(candidatePaths(requestedPath: requestedPath))
+        let candidates = Self.dedupe(candidatePaths(
+            requestedPath: requestedPath,
+            allowCrossVariantFallback: allowCrossVariantFallback
+        ))
         let selectedPath = candidates.first { path in
             canConnect(to: path)
         }
@@ -254,7 +262,10 @@ struct CLISocketPathResolver {
         )
     }
 
-    private func candidatePaths(requestedPath: String) -> [String] {
+    private func candidatePaths(
+        requestedPath: String,
+        allowCrossVariantFallback: Bool
+    ) -> [String] {
         var candidates: [String] = []
         let variant = SocketPathMarkerFiles.variant(bundleIdentifier: bundleIdentifier, environment: environment)
         let ownDefaultPath = resolvedDefaultSocketPath()
@@ -263,6 +274,28 @@ struct CLISocketPathResolver {
         // tag-specific socket; for the stable CLI it is the primary stable socket.
         candidates.append(ownDefaultPath)
 
+        // Side-effecting build-scoped commands must never silently cross into
+        // another app when their own listener is unavailable. Explicit socket
+        // paths remain pinned by `resolve` above; this branch governs only
+        // implicit discovery. The caller can still opt into the historical
+        // cross-variant fallback for read-only/general CLI commands.
+        guard allowCrossVariantFallback else {
+            // A stable release may have moved to its user-scoped socket, and a
+            // tagged build may use a reload-managed/custom path. Keep those
+            // paths available only when this variant itself published them;
+            // never accept an arbitrary environment path in the strict mode.
+            let ownMarkers = readLastSocketPaths(
+                bundleIdentifier: bundleIdentifier,
+                environment: environment
+            )
+            candidates.append(contentsOf: ownMarkers)
+            if Self.pathsMatch(requestedPath, ownDefaultPath)
+                || ownMarkers.contains(where: { Self.pathsMatch($0, requestedPath) }) {
+                candidates.append(requestedPath)
+            }
+            return candidates
+        }
+
         // A dead dev socket must not strand ambient commands. The stable primary
         // socket is the deterministic machine-wide fallback before any marker.
         candidates.append(resolvedStableDefaultSocketPath)

CLI/cmux.swift

@@ -5140,6 +5140,16 @@ struct CMUXCLI {
             return
         }
 
+        // `cmux vpn` talks to the selected app to mutate tunnel state. Running
+        // the CLI itself through sudo changes HOME/UID and can select a
+        // different socket, so fail with the actionable user-scoped command.
+        if command == "vpn", geteuid() == 0 {
+            throw CLIError(message: String(
+                localized: "cli.vpn.runAsUser",
+                defaultValue: "Run `cmux vpn` without `sudo`; cmux manages the required system approval itself."
+            ))
+        }
+
         // If the argument is a path (not a known command), open a workspace there.
         if shouldOpenAsPathArgument(command), explicitSocketPath == nil {
             try openPath(command)
@@ -5153,7 +5163,7 @@ struct CMUXCLI {
             bundleIdentifier: cliBundleIdentifier,
             environment: processEnv
         )
-        let socketPathSource: CLISocketPathSource
+        var socketPathSource: CLISocketPathSource
         if explicitSocketPath != nil {
             socketPathSource = .explicitFlag
         } else if envSocketPath != nil {
@@ -5174,9 +5184,17 @@ struct CMUXCLI {
             environment: processEnv,
             bundleIdentifier: cliBundleIdentifier
         )
+        // A terminal or tmux server can retain another build's socket path.
+        // VPN commands must resolve only this build's listener; explicit
+        // --socket remains an intentional escape hatch.
+        if command == "vpn",
+           socketPathSource == .environment {
+            socketPathSource = .implicitDefault
+        }
         let socketResolution = socketResolver.resolve(
             requestedPath: socketPath,
-            source: socketPathSource
+            source: socketPathSource,
+            allowCrossVariantFallback: command != "vpn"
         )
         if !socketResolution.hasLiveSocket,
            socketPathSource == .implicitDefault,
@@ -5460,7 +5478,8 @@ struct CMUXCLI {
                         resolvePath: {
                             socketResolver.resolve(
                                 requestedPath: socketPath,
-                                source: socketPathSource
+                                source: socketPathSource,
+                                allowCrossVariantFallback: command != "vpn"
                             ).selectedPath ?? socketPath
                         },
                         timeout: Self.restoreSocketStartupTimeoutSeconds

Packages/macOS/CmuxSettings/Sources/CmuxSettings/SocketControl/SocketControlSettings.swift

@@ -390,6 +390,12 @@ public struct SocketControlSettings {
         if inheritedBundleIdentifierConflicts(environment: environment, bundleIdentifier: bundleIdentifier) {
             return false
         }
+        // Nightly is a release channel even when a local dogfood build was
+        // compiled with DEBUG. Do not let a shell/tmux environment inherited
+        // from another app make its listener bind that app's socket.
+        if isNightlyBundleIdentifier(bundleIdentifier) {
+            return false
+        }
         if isDebugLikeBundleIdentifier(bundleIdentifier) || isStagingBundleIdentifier(bundleIdentifier) {
             return true
         }
@@ -426,6 +432,16 @@ public struct SocketControlSettings {
         return bundleIdentifier.hasPrefix("\(baseDebugBundleIdentifier).")
     }
 
+    /// Returns whether a bundle identifier belongs to the Nightly release channel.
+    ///
+    /// - Parameter bundleIdentifier: The app bundle identifier to classify.
+    /// - Returns: `true` for the untagged Nightly bundle and its scoped variants.
+    public static func isNightlyBundleIdentifier(_ bundleIdentifier: String?) -> Bool {
+        guard let bundleIdentifier = normalizedBundleIdentifier(bundleIdentifier) else { return false }
+        return bundleIdentifier == SocketPathMarkerFiles.nightlyBundleIdentifier
+            || bundleIdentifier.hasPrefix("\(SocketPathMarkerFiles.nightlyBundleIdentifier).")
+    }
+
     /// Whether the bundle identifier is a staging build identifier.
     public static func isStagingBundleIdentifier(_ bundleIdentifier: String?) -> Bool {
         guard let bundleIdentifier else { return false }

Packages/macOS/CmuxSettings/Tests/CmuxSettingsTests/SocketControl/SocketControlSettingsTests.swift

@@ -109,6 +109,30 @@ import CmuxSettings
         #expect(path == "/tmp/cmux-custom.sock")
     }
 
+    @Test func nightlyBuildIgnoresAnInheritedSocketOverride() {
+        let untagged = SocketControlSettings.socketPath(
+            environment: [
+                "CMUX_SOCKET_PATH": "/tmp/cmux-debug-from-dev.sock",
+            ],
+            bundleIdentifier: "com.cmuxterm.app.nightly",
+            isDebugBuild: true,
+            currentUserID: 501,
+            probeStableDefaultPathEntry: { _ in .missing }
+        )
+        let tagged = SocketControlSettings.socketPath(
+            environment: [
+                "CMUX_SOCKET_PATH": "/tmp/cmux-debug-from-dev.sock",
+            ],
+            bundleIdentifier: "com.cmuxterm.app.nightly.vpn-probe",
+            isDebugBuild: true,
+            currentUserID: 501,
+            probeStableDefaultPathEntry: { _ in .missing }
+        )
+
+        #expect(untagged == "/tmp/cmux-nightly.sock")
+        #expect(tagged == "/tmp/cmux-nightly-vpn-probe.sock")
+    }
+
     @Test func bareDebugXCTestLaunchUsesScopedSocketFallback() {
         let environment = [
             "XCTestConfigurationFilePath": "/tmp/Test-cmux-unit-2026.06.17.xctestconfiguration",

Resources/Localizable.xcstrings

@@ -115367,6 +115367,23 @@
         }
       }
     },
+    "cli.vpn.runAsUser": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Run `cmux vpn` without `sudo`; cmux asks for sudo only when it changes the tunnel or /etc/hosts."
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "`sudo` を付けずに `cmux vpn` を実行してください。トンネルまたは /etc/hosts を変更するときだけ cmux が sudo を求めます。"
+          }
+        }
+      }
+    },
     "cli.vpn.down": {
       "extractionState": "manual",
       "localizations": {
@@ -236847,6 +236864,23 @@
         }
       }
     },
+    "machines.requiresPro.stale": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Cloud plan required — showing last known"
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Cloudプランが必要です — 既知の状態を表示中"
+          }
+        }
+      }
+    },
     "machines.requiresPro.title": {
       "extractionState": "manual",
       "localizations": {
@@ -237083,6 +237117,23 @@
         }
       }
     },
+    "machines.sessionRejected.stale": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Cloud session rejected — showing last known"
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "クラウドセッションが拒否されました — 既知の状態を表示中"
+          }
+        }
+      }
+    },
     "machines.sessionRejected.title": {
       "extractionState": "manual",
       "localizations": {
@@ -237142,6 +237193,74 @@
         }
       }
     },
+    "machines.serverError.retry": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Retry"
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "再試行"
+          }
+        }
+      }
+    },
+    "machines.serverError.subtitle": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Your machines are still there. cmux couldn’t load them just now. Retry in a moment."
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "マシンはそのまま残っています。cmux は今すぐ読み込めませんでした。しばらくしてから再試行してください。"
+          }
+        }
+      }
+    },
+    "machines.serverError.stale": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Cloud load failed — showing last known"
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Cloud の読み込みに失敗 — 最後に確認した状態を表示中"
+          }
+        }
+      }
+    },
+    "machines.serverError.title": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Cloud couldn’t load machines"
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Cloud のマシンを読み込めません"
+          }
+        }
+      }
+    },
     "machines.unavailable.retry": {
       "extractionState": "manual",
       "localizations": {