Cloud VPN: app-managed WireGuard tunnel via a NetworkExtension system extension, on-demand only - #11789

Merged

austinywang merged 105 commits into

mainfrom

issue-11760-vpn-networkextension

Sep 5, 2026

Commits on Sep 3, 2026

Cloud tunnel: vendor WireGuardKit and build the wireguard-go bridge

austinywang
and
claude
committed
bf973f6
Cloud tunnel: packet-tunnel system extension and on-demand app-managed VPN

austinywang
and
claude
committed
cea4a99
cmux vpn: app-managed shims when the app owns the tunnel

austinywang
and
claude
committed
d73b0e5
Release: declare the Cloud tunnel entitlements, reconcile them with the profile

austinywang
and
claude
committed
164ca89
build-wireguard-go: build the pinned module set in readonly mode

austinywang
and
claude
committed
14ae079
Merge origin/main into issue-11760-vpn-networkextension

austinywang
and
claude
committed
67dd76e
build-wireguard-go: require Go only for Release builds

austinywang
and
claude
committed
ebe4ce3
CloudTunnelCoordinator: adopt an already-connected tunnel; guard superseded cleanup

austinywang
and
claude
committed
5d4ce36
Cloud tunnel: one top-level type per file

austinywang
and
claude
committed
44a81f9
AppDelegate: adopt the three-parameter machine-create launcher closure

austinywang
and
claude
committed
15f5625
VMClientSocketCommands: share socketWorkerString with the tunnel verbs file

austinywang
and
claude
committed
37f1bd4
CloudTunnelCoordinator: stop inherited tunnels; back off after a failed start

austinywang
and
claude
committed
0549cf8
Cloud tunnel: lift nested Timing, Purpose, and the controller error to top-level types

austinywang
and
claude
committed
86e79ce
CloudTunnelCoordinatorTests: no await inside the ?? autoclosure

austinywang
and
claude
committed
c86cb48
Cloud tunnel: verify the real engine by its Go build info; prune dead broadcast subscribers eagerly

austinywang
and
claude
committed
96c183d
Cloud tunnel: serialize starts behind stops, fail fast on adopted-link drops, redact runtime keys, enroll once

austinywang
and
claude
committed
73ad55f
Merge origin/main into issue-11760-vpn-networkextension
austinywang
committed
babe628
Fix VPN status variable redeclaration
austinywang
committed
c12b3d8
Update Freestyle SDK pin test
austinywang
committed
36e4a92
Merge remote-tracking branch 'origin/main' into issue-11760-vpn-networkextension
lawrencecchen
committed
918f668

Commits on Sep 4, 2026

Merge remote-tracking branch 'origin/main' into issue-11760-vpn-networkextension
lawrencecchen
committed
e01cebb
fix(cloud): isolate dev VPN tunnels by build identity

austinywang
authored and
lawrencecchen
committed
d25126b
Merge remote-tracking branch 'origin/main' into issue-11760-vpn-networkextension
lawrencecchen
committed
41ad9da
ci: add fast notarized nightly dogfood path
lawrencecchen
committed
1ba9157
test(cloud): cover full Mac access revoke
lawrencecchen
committed
eed787f
ci: thin bundled clients in fast nightly builds
lawrencecchen
committed
1d94964
cloud: model Mac access grants and tunnel roles
lawrencecchen
committed
2f67f34
fix(ci): make tunnel engine verification deterministic
lawrencecchen
committed
ceaada0
test(release): require system-extension-safe app entitlements
lawrencecchen
committed
e05fa14
fix(release): sign packet tunnel apps for macOS system extensions
lawrencecchen
committed
a49b830
test(release): require tunnel profile
lawrencecchen
committed
5625d2a
fix(ci): smoke signed nightlies before notarization
lawrencecchen
committed
7de906c
feat(cloud): use private WireGuard access end to end
lawrencecchen
committed
c9272d3
Merge remote-tracking branch 'origin/issue-11760-vpn-networkextension' into issue-11760-vpn-networkextension
lawrencecchen
committed
795f564
style(cmux-tui): format WireGuard transport
lawrencecchen
committed
e46babe
fix(cli): preserve global socket diagnostics
lawrencecchen
committed
6568e6a
fix(release): keep hardened runtime on tunnel extension
lawrencecchen
committed
b9d648a
Merge remote-tracking branch 'origin/issue-11760-vpn-networkextension' into HEAD
lawrencecchen
committed
8803cfd
test(release): require matching WireGuard client
lawrencecchen
committed
fd2eb0f
Merge remote-tracking branch 'origin/issue-11760-vpn-networkextension' into issue-11760-vpn-networkextension
lawrencecchen
committed
c8ee2f1
fix(release): pin the private network client
lawrencecchen
committed
4eee10b
fix(dev): reject stale private network clients
lawrencecchen
committed
918c5a4
fix(ci): allow runner setup before artifact planning
lawrencecchen
committed
3926897
Merge remote-tracking branch 'origin/main' into issue-11760-vpn-networkextension
lawrencecchen
committed
fa0a8d7
test(cloud): require private-link port discovery
lawrencecchen
committed
0bed349
test(cmux-tui): require direct port inventory command
lawrencecchen
committed
d01b924
fix(cloud): discover ports over the private link
lawrencecchen
committed
9073047
style(cmux-tui): format port inventory command
lawrencecchen
committed
9343493
test(dev): require immutable client pin
lawrencecchen
committed
328bebe
fix(dev): pin private network client by URL
lawrencecchen
committed
87d1338
fix(ci): generate private link SDK bindings
lawrencecchen
committed
39f6540
test(cloud): cover Mac access revoke request
lawrencecchen
committed
9046bd2
fix(cloud): stop local access on revoke
lawrencecchen
committed
9400a28
test(cloud): cover tunnel child cleanup
lawrencecchen
committed
0e43efa
fix(cloud): fence tunnel helper lifetimes
lawrencecchen
committed
76a81f6
test(cloud): model mandatory private networks
lawrencecchen
committed
b64d4ea
test(cloud): cover link process teardown
lawrencecchen
committed
d184f1a
fix(cloud): reap link helpers before release
lawrencecchen
committed
dda0e65
test(sdk): track direct metadata command
lawrencecchen
committed
c172ed1
test(cloud): cover device mutation fencing
lawrencecchen
committed
668ec78
fix(cloud): serialize Mac access mutations
lawrencecchen
committed
a082f1d
fix(cloud): cover serial provider deadlines
lawrencecchen
committed
722bf5e
docs(cloud): remove obsolete host fallback
lawrencecchen
committed
5f72353
ci: decouple branch TUI artifacts from relay audit
lawrencecchen
committed
6ff34d9
test(cloud): keep tunnel status read-only
lawrencecchen
committed
7055d80
fix(cloud): keep tunnel status read-only
lawrencecchen
committed
ab557e4
ci: build fast nightly TUI client in app job
lawrencecchen
committed
13f9bd8
ci: route fast nightly through Blacksmith
lawrencecchen
committed
b2ba38f
test(cloud): cover tunnel error sanitization
lawrencecchen
committed
9769947
fix(cloud): harden Network Extension lifecycle
lawrencecchen
committed
0109c99
fix(cloud): capture tunnel redactor explicitly
lawrencecchen
committed
5ecbe52
test(ci): accept fast Nightly runner routing
lawrencecchen
committed
19404fd
fix(cloud): fail closed on unknown activation results
lawrencecchen
committed
d1d03c6
ci: build exact cmux-tui in Blacksmith reloads
lawrencecchen
committed
fced8d8
Merge remote-tracking branch 'origin/main' into issue-11760-vpn-networkextension
lawrencecchen
committed
4cb37f0
Merge remote-tracking branch 'origin/main' into issue-11760-vpn-networkextension
lawrencecchen
committed
5e17b5a
fix(cloud): clear new compiler warnings
lawrencecchen
committed
a04c14e
test(cloud): accept legacy tunnel response shape
lawrencecchen
committed
9f5256f
fix(cloud): tolerate older tunnel response fields
lawrencecchen
committed
b532202
ci: use available runner for fast nightly dogfood
lawrencecchen
committed
2d4c980
ci: honor configured runner for fast nightly builds
lawrencecchen
committed
9cce57c
fix(cmux-tui): refresh lockfile for wireguard transport
lawrencecchen
committed
4e895e1
test(cloud): accept digit in WireGuard key padding
lawrencecchen
committed
f1f2471
fix(cloud): accept all canonical WireGuard public keys
lawrencecchen
committed
7d3a160
fix(cloud): declare system extension usage description
lawrencecchen
committed
8930c55
ci: use Blacksmith for fast nightly dogfood
lawrencecchen
committed
2d05309
fix pending tunnel consumer and sanitize activation errors
austinywang
committed
0ea2dd1
Merge origin/main into cloud tunnel PR branch
austinywang
committed
0ecbf91
fix malformed localization catalog after main merge
austinywang
committed
df6def0
merge main localization catalog without formatting churn
austinywang
committed
c97fa2d
Merge remote-tracking branch 'origin/main' into issue-11760-vpn-networkextension
austinywang
committed
eda3854
refresh generated cmux-tui SDK bindings
austinywang
committed
e4bdb9e
fix web tunnel API compatibility after main merge
austinywang
committed
4b2d4fb

Commits on Sep 5, 2026