Cloud VPN: app-managed WireGuard tunnel via a NetworkExtension system extension, on-demand only

.github/workflows/ci.yml

@@ -2308,6 +2308,12 @@ jobs:
       - name: Sanitize Swift package cache
         run: python3 scripts/ci/sanitize-xcode-source-packages-cache.py .spm-cache
 
+      - name: Set up Go for the Cloud tunnel extension
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: '1.26.x'
+          cache: false
+
       - name: Build universal app (Release)
         run: |
           set -euo pipefail

.github/workflows/cloud-vm-image-contract.yml

@@ -40,7 +40,7 @@ concurrency:
 
 jobs:
   contract:
-    runs-on: ubuntu-24.04
+    runs-on: ${{ vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}
     defaults:
       run:
         working-directory: web

.github/workflows/cmux-tui-artifacts.yml

@@ -41,9 +41,12 @@ on:
   workflow_dispatch: {}
 
 concurrency:
-  group: cmux-tui-artifacts-${{ github.ref }}
-  # Raw immutable objects are write-once. Queue a second dispatch instead of
-  # cancelling the first half-written publication.
+  # Main remains serialized because each main run also updates latest/. Branch
+  # dogfood runs publish commit-addressed objects only, so different commits
+  # can build in parallel instead of waiting behind an obsolete branch run.
+  group: cmux-tui-artifacts-${{ github.ref == 'refs/heads/main' && 'main' || github.sha }}
+  # Raw immutable objects are write-once. Queue a rerun of the same commit
+  # instead of cancelling a half-written publication.
   cancel-in-progress: false
 
 permissions: {}
@@ -64,6 +67,10 @@ jobs:
       version: 0.0.0-r2.sha-${{ github.sha }}
       package_npm: false
       package_pypi: false
+      # This lane publishes the raw cmux-tui, cmux-relay, and chatmux-relay
+      # binaries. The Cloudflare Worker is a separate deployment artifact and
+      # its npm audit must not block these commit-addressed files.
+      build_cloudflare_relay: false
       # The Rust machine relay has no Windows PTY backend yet. Keep Windows on
       # the Node rollback lane until a tested backend exists; do not publish a
       # misleading Rust machine package or manifest entry.

.github/workflows/cmux-tui-build-package.yml

@@ -74,7 +74,7 @@ jobs:
   plan-build:
     name: select binary targets
     runs-on: ${{ inputs.linux_runner != '' && inputs.linux_runner || vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}
-    timeout-minutes: 5
+    timeout-minutes: 15
     outputs:
       matrix: ${{ steps.targets.outputs.matrix }}
       linux_package_matrix: ${{ steps.targets.outputs.linux_package_matrix }}

.github/workflows/release.yml

@@ -43,6 +43,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          fetch-depth: 0
           submodules: recursive
 
       - name: Install zig
@@ -251,6 +252,13 @@ jobs:
           echo "Derived Sparkle public key: $DERIVED_PUBLIC_KEY"
           echo "SPARKLE_PUBLIC_KEY=$DERIVED_PUBLIC_KEY" >> "$GITHUB_ENV"
 
+      - name: Set up Go for the Cloud tunnel extension
+        if: steps.guard_release_assets.outputs.skip_all != 'true'
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: '1.26.x'
+          cache: false
+
       - name: Build universal app (Release)
         if: steps.guard_release_assets.outputs.skip_all != 'true'
         run: |
@@ -316,12 +324,20 @@ jobs:
           ./scripts/install-prebuilt-ghostty-cli-helper.sh \
             ghostty-cli-helper/ghostty \
             build-universal/Build/Products/Release/cmux.app
-          ./scripts/install-cmux-tui-client.sh build-universal/Build/Products/Release/cmux.app
+          cmux_tui_commit="$(git log -1 --format=%H -- cmux-tui ghostty .github/workflows/cmux-tui-artifacts.yml .github/workflows/cmux-tui-build-package.yml)"
+          test -n "$cmux_tui_commit"
+          ./scripts/install-cmux-tui-client.sh \
+            build-universal/Build/Products/Release/cmux.app \
+            --manifest-url "https://files.cmux.com/cmux-tui/${cmux_tui_commit}/manifest.json" \
+            --expected-commit "$cmux_tui_commit" \
+            --require-capability wireguard-hub
 
       - name: Verify binary architectures
         if: steps.guard_release_assets.outputs.skip_all != 'true'
         run: |
           set -euo pipefail
+          APP="build-universal/Build/Products/Release/cmux.app"
+          ./scripts/normalize-system-extension-bundle.sh "$APP" "7WLXT3NR37.com.cmuxterm.app.tunnel"
           APP_BINARY="build-universal/Build/Products/Release/cmux.app/Contents/MacOS/cmux"
           CLI_BINARY="build-universal/Build/Products/Release/cmux.app/Contents/Resources/bin/cmux"
           HELPER_BINARY="build-universal/Build/Products/Release/cmux.app/Contents/Resources/bin/ghostty"
@@ -337,6 +353,12 @@ jobs:
           [[ "$APP_ARCHS" == *arm64* && "$APP_ARCHS" == *x86_64* ]]
           [[ "$CLI_ARCHS" == *arm64* && "$CLI_ARCHS" == *x86_64* ]]
           [[ "$HELPER_ARCHS" == *arm64* && "$HELPER_ARCHS" == *x86_64* ]]
+          TUNNEL_BINARY="$APP/Contents/Library/SystemExtensions/7WLXT3NR37.com.cmuxterm.app.tunnel.systemextension/Contents/MacOS/cmuxTunnel"
+          [ -x "$TUNNEL_BINARY" ] || { echo "Cloud tunnel extension binary not found at $TUNNEL_BINARY" >&2; exit 1; }
+          TUNNEL_ARCHS="$(lipo -archs "$TUNNEL_BINARY")"
+          echo "Tunnel extension architectures: $TUNNEL_ARCHS"
+          [[ "$TUNNEL_ARCHS" == *arm64* && "$TUNNEL_ARCHS" == *x86_64* ]]
+          ./scripts/verify-tunnel-extension-engine.sh "$TUNNEL_BINARY"
           ./scripts/verify-diff-sidecar-artifact.sh "$DIFF_SIDECAR"
           [[ "$SDK_VERSION" == 26.* ]]
 
@@ -402,10 +424,35 @@ jobs:
           fi
           cp "$TMP_PROFILE" "$PROFILE_PATH"
 
+      - name: Embed Cloud tunnel extension provisioning profile
+        if: steps.guard_release_assets.outputs.skip_all != 'true'
+        env:
+          APPLE_RELEASE_TUNNEL_PROVISIONING_PROFILE_BASE64: ${{ secrets.APPLE_RELEASE_TUNNEL_PROVISIONING_PROFILE_BASE64 }}
+        run: |
+          set -euo pipefail
+          ./scripts/ci/embed-tunnel-extension-profile.sh \
+            "build-universal/Build/Products/Release/cmux.app" \
+            "7WLXT3NR37.com.cmuxterm.app.tunnel" \
+            "${APPLE_RELEASE_TUNNEL_PROVISIONING_PROFILE_BASE64:-}"
+
       - name: Strip release binaries
         if: steps.guard_release_assets.outputs.skip_all != 'true'
         run: ./scripts/strip-release-bundle.sh "build-universal/Build/Products/Release/cmux.app"
 
+      - name: Verify Cloud tunnel engine before signing
+        if: steps.guard_release_assets.outputs.skip_all != 'true'
+        run: |
+          set -euo pipefail
+          app="build-universal/Build/Products/Release/cmux.app"
+          sysext="$(find "$app/Contents/Library/SystemExtensions" -mindepth 1 -maxdepth 1 -name '*.systemextension' -print -quit 2>/dev/null || true)"
+          if [[ -z "$sysext" ]]; then
+            echo "::error::Cloud tunnel system extension is missing"
+            exit 1
+          fi
+          executable="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$sysext/Contents/Info.plist")"
+          binary="$sysext/Contents/MacOS/$executable"
+          ./scripts/verify-tunnel-extension-engine.sh "$binary"
+
       - name: Codesign app
         if: steps.guard_release_assets.outputs.skip_all != 'true'
         env:
@@ -422,6 +469,16 @@ jobs:
             cmux.release.entitlements \
             "$APPLE_SIGNING_IDENTITY"
 
+      - name: Smoke launch signed app before notarization
+        if: steps.guard_release_assets.outputs.skip_all != 'true'
+        run: |
+          set -euo pipefail
+          # Catch macOS policy failures before the Apple ticket wait and DMG
+          # work. Direct execution is isolated from the runner's Dock state.
+          CMUX_SMOKE_DIRECT_EXEC=1 CMUX_SMOKE_DEBUG_LOGS=1 \
+            ./scripts/smoke-launch-macos-app.sh \
+            "build-universal/Build/Products/Release/cmux.app"
+
       - name: Notarize app
         if: steps.guard_release_assets.outputs.skip_all != 'true'
         env:

.github/workflows/reload-build.yml

@@ -100,6 +100,57 @@ jobs:
             echo "cmux-cua build script absent in source ref; skipping Rust provisioning"
           fi
 
+      # The app's Cloud machine path requires the wireguard-hub cmux-tui
+      # capability. Do this before Xcode or cache work, and pass the exact
+      # source-built binary into reload.sh. A rolling download can lag the app
+      # source and otherwise fails only after the full macOS build completes.
+      - name: Install Zig for bundled cmux-tui (macOS)
+        if: ${{ inputs.platform == 'macos' && hashFiles('cmux-tui/Cargo.toml') != '' }}
+        run: ./scripts/install-zig-ci.sh
+
+      - name: Build and validate exact cmux-tui client (macOS)
+        if: ${{ inputs.platform == 'macos' && hashFiles('cmux-tui/Cargo.toml') != '' }}
+        working-directory: cmux-tui
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/cmux-tui-target
+          CMUX_TUI_DISTRIBUTION_VERSION: 0.0.0-dev-${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          export PATH="$HOME/.cargo/bin:$PATH"
+          source_sha="$(git -C .. rev-parse HEAD)"
+          ghostty_sha="$(git -C ../ghostty rev-parse HEAD)"
+          export CMUX_TUI_BUILD_COMMIT="$source_sha"
+          export CMUX_TUI_GHOSTTY_COMMIT="$ghostty_sha"
+          target="$(rustc -vV | awk '/^host: / { print $2 }')"
+          case "$target" in
+            aarch64-apple-darwin|x86_64-apple-darwin) ;;
+            *) echo "unsupported macOS Rust host target: $target" >&2; exit 1 ;;
+          esac
+          cargo build -p cmux-tui --bin cmux-tui --release --locked --target "$target"
+          client="$CARGO_TARGET_DIR/$target/release/cmux-tui"
+          test -x "$client"
+          probe="$($client remote-probe --json)"
+          version="$($client --version)"
+          PROBE="$probe" VERSION="$version" EXPECTED_COMMIT="$source_sha" EXPECTED_GHOSTTY="$ghostty_sha" python3 - <<'PY'
+          import json
+          import os
+
+          probe = json.loads(os.environ["PROBE"])
+          version = os.environ["VERSION"]
+          expected = os.environ["EXPECTED_COMMIT"]
+          expected_ghostty = os.environ["EXPECTED_GHOSTTY"]
+          if probe.get("build_identity") != expected:
+              raise SystemExit(
+                  f"cmux-tui build identity {probe.get('build_identity')!r} != {expected!r}"
+              )
+          if "wireguard-hub" not in probe.get("capabilities", []):
+              raise SystemExit("cmux-tui client lacks wireguard-hub capability")
+          if expected_ghostty not in version:
+              raise SystemExit("cmux-tui client does not carry the checked-out Ghostty identity")
+          PY
+          echo "CMUX_TUI_CLIENT_LOCAL=$client" >> "$GITHUB_ENV"
+          echo "cmux-tui ready: $client"
+
       - name: Prepare macOS cache metadata
         if: ${{ inputs.platform == 'macos' }}
         id: cache_meta

CLI/CMUXCLI+VMTui.swift

@@ -5,13 +5,14 @@ import Foundation
 /// shares — `cmux vm shell|new|fork|restore|base open|base reset`, the Machines
 /// panel, and the sidebar cloud button all land in `openVMTuiWorkspace`.
 ///
-/// The control plane returns a tokenized `/v1/link` route and, for a device that has
-/// not enrolled with this machine's daemon yet, a single-use invitation. A workspace
+/// The app uses the machine's private `/v1/link` route through its user-space
+/// WireGuard hub. Only a device that has not enrolled with this machine's
+/// daemon asks the control plane for a single-use invitation. A workspace
 /// pane runs the hidden `vm-tui-connect` helper, which hands the terminal to the
 /// local cmux-tui client (`remote connect`) and, while the client claims the
 /// invitation, asks the control plane to approve the pending enrollment through the
-/// app socket. After the first enrollment the device key lives in the client's state
-/// directory and later attaches need only a fresh route.
+/// app socket. After the first enrollment the device key and private route are
+/// local facts. Later attaches make no connection or approval request.
 extension CMUXCLI {
     struct VMTuiConnectConfig: Codable {
         let vmId: String
@@ -22,6 +23,9 @@ extension CMUXCLI {
         let clientPath: String
         let stateDir: String
         let deviceName: String
+        /// The app's WireGuard hub socket for a private-network route (`--wireguard-hub`);
+        /// Required for every Cloud VM route.
+        var wireguardHubSocket: String? = nil
     }
 
     /// How an entrypoint wants the machine's workspace shaped; the session itself is
@@ -54,9 +58,6 @@ extension CMUXCLI {
         let updatedAtUnix: Int
     }
 
-    static let vmTuiApprovalPollSeconds: TimeInterval = 2
-    static let vmTuiApprovalTimeoutSeconds: TimeInterval = 5 * 60
-
     static var vmTuiUsage: String {
         """
         Usage: cmux vm tui <id> [--window <id|ref|index>]
@@ -241,12 +242,6 @@ extension CMUXCLI {
     /// stay alive until that split lands; it is closed right after.
     static let vmPlainTerminalPlaceholderCommand = "sleep 60"
 
-    /// The shared cloud open path (`vmOpenShell`) calls this first for every entrypoint.
-    /// Returns nil only when the control plane says the machine's deployment does not
-    /// run cmux-tui at all (providers that predate the migration), so the caller may
-    /// fall back to their transport. Any other failure — including a machine that
-    /// reports it attaches through cmux-tui only — surfaces as-is; nothing falls back
-    /// to a websocket attach the backend will refuse.
     /// True when `workspaceRaw` (a UUID or handle) is the selected workspace of the
     /// window in question. Unknown (socket error, no such workspace) reads as false:
     /// when in doubt, do not move focus.
@@ -260,37 +255,6 @@ extension CMUXCLI {
         return candidates.contains { $0.caseInsensitiveCompare(workspaceRaw) == .orderedSame }
     }
 
-    func openVMShellViaCmuxTuiIfAvailable(
-        vmId: String,
-        windowRaw: String?,
-        options: VMTuiOpenOptions = VMTuiOpenOptions(),
-        client: SocketClient
-    ) throws -> VMTuiOpenResult? {
-        do {
-            return try openVMTuiWorkspace(vmId: vmId, windowRaw: windowRaw, options: options, client: client)
-        } catch let error as CLIError where Self.isCmuxTuiUnavailable(error) {
-            return nil
-        }
-    }
-
-    /// Backend code the control plane returns when a machine refuses the legacy attach
-    /// because it runs cmux-tui only; it means "use cmux-tui", never "fall back".
-    static let vmAttachTransportUnsupportedCode = "vm_attach_transport_unsupported"
-
-    static func isCmuxTuiUnavailable(_ error: CLIError) -> Bool {
-        if error.vmBackendCode == vmAttachTransportUnsupportedCode {
-            return false
-        }
-        let text = error.message.lowercased()
-        if text.contains(vmAttachTransportUnsupportedCode) || text.contains("cmux-tui only") {
-            return false
-        }
-        return text.contains("not enabled for this deployment")
-            || text.contains("not supported by this deployment")
-            || text.contains("does not run the cmux-tui")
-            || text.contains("unknown method")
-    }
-
     func runVMTuiCommand(rest: [String], windowRaw: String?, client: SocketClient, jsonOutput: Bool) throws {
         if rest.contains("--help") || rest.contains("-h") {
             print(Self.vmTuiUsage)
@@ -333,10 +297,8 @@ extension CMUXCLI {
     ) throws -> VMTuiOpenResult {
         let startedAt = Date()
         let known = Self.loadVMTuiDevices()[vmId]
-        // Probe the local client before asking the control plane: what it can do
-        // (`capabilities`) decides which machine host the route points at. A missing
-        // client is still only reported once the machine is confirmed reachable
-        // through cmux-tui, so deployments without the daemon fall back cleanly.
+        // Probe the local client before asking the app for connection data. Its
+        // WireGuard capability is mandatory for every Cloud VM route.
         let clientPath = locateCmuxTuiClient()
         let clientProbe = clientPath.flatMap { Self.cmuxTuiClientProbe(at: $0) }
         var infoParams: [String: Any] = ["id": vmId]
@@ -386,7 +348,8 @@ extension CMUXCLI {
                 invitationId: invitationId,
                 clientPath: clientPath,
                 stateDir: stateDir.path,
-                deviceName: Self.vmTuiDeviceName()
+                deviceName: Self.vmTuiDeviceName(),
+                wireguardHubSocket: info["wireguard_hub_socket"] as? String
             )
             let configURL = FileManager.default.temporaryDirectory
                 .appendingPathComponent("cmux-vm-tui-\(UUID().uuidString.lowercased()).json")
@@ -549,6 +512,9 @@ extension CMUXCLI {
         if let inviteFilePath, !inviteFilePath.isEmpty {
             arguments += ["--invite-file", inviteFilePath]
         }
+        if let hubSocket = config.wireguardHubSocket, !hubSocket.isEmpty {
+            arguments += ["--wireguard-hub", hubSocket]
+        }
         return arguments
     }
 
@@ -658,8 +624,8 @@ extension CMUXCLI {
     // MARK: - cmux vm-tui-approve --id <vm> --invitation-id <id> [--invite-file <path>]  (detached)
 
     /// Approves a pending cmux-tui enrollment through the app while the pane's client
-    /// claims the invitation. Silent: it owns no terminal. Ends when the claim is
-    /// approved or `vmTuiApprovalTimeoutSeconds` pass, and deletes the invite file
+    /// claims the invitation. Silent: it owns no terminal. The app makes one request;
+    /// the VM waits for the claim on its local daemon socket. The invite file is deleted
     /// either way.
     func runVMTuiApprove(commandArgs: [String], client: SocketClient) throws {
         let (vmIdOpt, rest0) = parseOption(commandArgs, name: "--id")
@@ -673,20 +639,15 @@ extension CMUXCLI {
                 try? FileManager.default.removeItem(atPath: inviteFileOpt)
             }
         }
-        let deadline = Date().addingTimeInterval(Self.vmTuiApprovalTimeoutSeconds)
-        while Date() < deadline {
-            Thread.sleep(forTimeInterval: Self.vmTuiApprovalPollSeconds)
-            guard let result = try? client.sendV2(
-                method: "vm.cmux_remote_approve",
-                params: ["id": vmId, "invitation_id": invitationId],
-                responseTimeout: 60
-            ) else { continue }
-            if (result["state"] as? String) == "approved" {
-                if let fingerprint = result["device_fingerprint"] as? String, !fingerprint.isEmpty {
-                    Self.saveVMTuiDevice(vmId: vmId, deviceFingerprint: fingerprint)
-                }
-                return
-            }
+        guard let result = try? client.sendV2(
+            method: "vm.cmux_remote_approve",
+            params: ["id": vmId, "invitation_id": invitationId],
+            responseTimeout: 75
+        ) else { return }
+        if (result["state"] as? String) == "approved",
+           let fingerprint = result["device_fingerprint"] as? String,
+           !fingerprint.isEmpty {
+            Self.saveVMTuiDevice(vmId: vmId, deviceFingerprint: fingerprint)
         }
     }
 }