Fix Cloud discovery stalls and private address fallback

Sources/Auth/MacAuthComposition.swift

@@ -145,6 +145,7 @@ struct MacAuthComposition {
                 browserAppSessionSignInRelay.sessionWillTransition()
             },
             onSignedIn: {
+                await CmuxTuiSurfaceProviderRegistry.shared.resumeAfterSignIn()
                 await browserAppSessionSignInRelay.signedIn()
             }
         )

Sources/Cloud/CloudMachineLinkManager+PrivateRoute.swift

@@ -0,0 +1,53 @@
+import Foundation
+import Network
+
+extension CloudMachineLinkManager {
+    /// Selects a working family using the same SOCKS connector as port forwards.
+    /// The probe sends no daemon request and closes its stream before the real
+    /// encrypted link starts. Failed probes propagate to the caller's retry policy,
+    /// so the next attempt considers every current family again.
+    func resolvedPrivateRoute(
+        machineID: String,
+        through hub: CloudWireGuardHub.Ready,
+        fallbackRoute: String? = nil,
+        addresses freshAddresses: [String] = []
+    ) async throws -> String {
+        try Task.checkCancellation()
+        let freshAddresses = freshAddresses.map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
+            .filter { !$0.isEmpty }
+        let freshFamilies = Set(freshAddresses.map { $0.contains(":") })
+        // Attach can omit one family. Preserve that family from discovery, but
+        // never retain an old address in a family that attach has replaced.
+        let storedAddresses = privateAddresses(for: machineID).filter {
+            !freshFamilies.contains($0.contains(":"))
+        }
+        var seen = Set<String>()
+        let candidates = (freshAddresses + storedAddresses).filter { seen.insert($0).inserted }
+        let addresses = candidates.filter {
+            CloudWireGuardHub.routesHost($0, enrolledRoutes: hub.routes)
+        }
+        guard let primary = addresses.first else {
+            guard candidates.isEmpty,
+                  let route = fallbackRoute ?? privateRoute(for: machineID),
+                  let host = IPNetworkPrefix.routeHost(route),
+                  CloudWireGuardHub.routesHost(host, enrolledRoutes: hub.routes) else {
+                throw ManagerError.privateRouteRequired(machineID)
+            }
+            return route
+        }
+        // Fresh discovery or the enrolled routes can leave a single candidate.
+        // Use it directly rather than returning an older address-family route.
+        guard addresses.count > 1 else {
+            let host = primary.contains(":") ? "[\(primary)]" : primary
+            return "ws://\(host):1337/v1/link"
+        }
+        let connected = try await CloudHubConnector().connect(
+            endpoint: .unix(path: hub.socketPath),
+            target: CloudPortForwardTarget(host: primary, port: 1337, fallbackHosts: Array(addresses.dropFirst())),
+            queue: DispatchQueue.global(qos: .userInitiated)
+        )
+        connected.connection.cancel()
+        let host = connected.host.contains(":") ? "[\(connected.host)]" : connected.host
+        return "ws://\(host):1337/v1/link"
+    }
+}

Sources/Cloud/CloudMachineLinkManager.swift

@@ -47,6 +47,7 @@ actor CloudMachineLinkManager {
     /// Private routes come from the signed-in machine list. An enrolled client
     /// reconnects with this local fact and does not call the attach endpoint.
     private var privateRoutes: [String: String] = [:]
+    private var privateAddressCandidates: [String: [String]] = [:]
     private var links: [String: CloudMachineLink] = [:]
     private var connecting: [String: Task<CloudMachineLink.Connected, Error>] = [:]
     private var lastFailure: [String: (at: Date, error: String)] = [:]
@@ -97,14 +98,26 @@ actor CloudMachineLinkManager {
     var hasClient: Bool { clientURL != nil }
 
     func setPrivateAddress(_ address: String?, for machineID: String) {
-        guard let address = address?.trimmingCharacters(in: .whitespacesAndNewlines), !address.isEmpty else {
+        setPrivateAddresses(address.map { [$0] } ?? [], for: machineID)
+    }
+
+    func setPrivateAddresses(_ addresses: [String], for machineID: String) {
+        var seen = Set<String>()
+        let addresses = addresses.map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
+            .filter { !$0.isEmpty && seen.insert($0).inserted }
+        privateAddressCandidates[machineID] = addresses
+        guard let address = addresses.first else {
             privateRoutes[machineID] = nil
             return
         }
         let host = address.contains(":") ? "[\(address)]" : address
         privateRoutes[machineID] = "ws://\(host):1337/v1/link"
     }
 
+    func privateAddresses(for machineID: String) -> [String] {
+        privateAddressCandidates[machineID] ?? []
+    }
+
     func privateRoute(for machineID: String) -> String? {
         privateRoutes[machineID]
     }
@@ -121,7 +134,7 @@ actor CloudMachineLinkManager {
             throw ManagerError.retryLater(failure.error)
         }
         guard let clientURL else { throw ManagerError.clientMissing }
-        guard let privateRoute = privateRoutes[machineID] else {
+        guard privateRoutes[machineID] != nil else {
             throw ManagerError.privateRouteRequired(machineID)
         }
         #if DEBUG
@@ -164,26 +177,22 @@ actor CloudMachineLinkManager {
             guard capabilities.contains(CloudTuiCommandLine.wireGuardHubCapability) else {
                 throw ManagerError.wireGuardHubUnsupported
             }
-            guard Self.usesWireGuardHub(route: privateRoute, clientCapabilities: capabilities, enrolledRoutes: []) else {
-                throw ManagerError.privateRouteRequired(privateRoute)
-            }
             guard let hub else { throw ManagerError.wireGuardHubMissing }
             let claim = try await hub.acquire()
-            guard Self.usesWireGuardHub(
-                route: privateRoute,
-                clientCapabilities: capabilities,
-                enrolledRoutes: claim.ready.routes
-            ) else {
-                await hub.release(claim.lease)
-                throw ManagerError.privateRouteRequired(privateRoute)
-            }
             let releaseLease: @Sendable () async -> Void = { await hub.release(claim.lease) }
+            let reachableRoute: String
+            do {
+                reachableRoute = try await resolvedPrivateRoute(machineID: machineID, through: claim.ready)
+            } catch {
+                await releaseLease()
+                throw error
+            }
             #if DEBUG
             cmuxDebugLog("cloud.link.wireguardHub machine=\(machineID) socket=\(claim.ready.socketPath)")
             #endif
             let connect = Task {
                 try await link.connect(
-                    route: privateRoute,
+                    route: reachableRoute,
                     session: session,
                     carrier: carrier,
                     timeout: connectTimeout,
@@ -275,12 +284,11 @@ actor CloudMachineLinkManager {
         lastFailure.removeAll()
     }
 
-    /// Drops links for machines that no longer exist.
-    func retain(machineIDs: Set<String>) async {
-        for id in links.keys where !machineIDs.contains(id) {
-            await disconnect(machineID: id)
-        }
+    /// Drops stale routing facts immediately. The registry owns and awaits
+    /// each removed machine's asynchronous link/forward teardown separately.
+    func retainAddresses(machineIDs: Set<String>) {
         privateRoutes = privateRoutes.filter { machineIDs.contains($0.key) }
+        privateAddressCandidates = privateAddressCandidates.filter { machineIDs.contains($0.key) }
     }
 
     /// Re-sends this Mac's theme to every connected machine (a Ghostty config reload

Sources/Cloud/PortForward/CloudHubConnection.swift

@@ -0,0 +1,7 @@
+import Network
+
+/// The successful private-address dial and the hub stream carrying its bytes.
+struct CloudHubConnection: Sendable {
+    let connection: NWConnection
+    let host: String
+}

Sources/Cloud/PortForward/CloudHubConnector.swift

@@ -0,0 +1,93 @@
+import Foundation
+import Network
+
+/// Connects to the first working private address through one claimed hub.
+/// A family can blackhole independently of the other after a VM joins its VPC.
+/// Race actual SOCKS CONNECT handshakes, retaining the winning stream and closing
+/// every loser before returning, so terminal and browser callers share the policy.
+struct CloudHubConnector: Sendable {
+    var timeout: Duration = .seconds(15)
+    /// A cancellable head start for the preferred family, driven by the injected clock.
+    var fallbackDelay: Duration = .milliseconds(250)
+    var clock: any Clock<Duration> = ContinuousClock()
+
+    #if compiler(>=6.2)
+    @concurrent
+    #else
+    @Sendable
+    #endif
+    func connect(
+        endpoint: NWEndpoint,
+        target: CloudPortForwardTarget,
+        queue: DispatchQueue
+    ) async throws -> CloudHubConnection {
+        let candidates = target.hosts.map { host in
+            CloudHubConnection(connection: NWConnection(to: endpoint, using: .tcp), host: host)
+        }
+        return try await withTaskCancellationHandler {
+            try await withThrowingTaskGroup(of: Result<CloudHubConnection, any Error>.self) { group in
+                for (index, candidate) in candidates.enumerated() {
+                    group.addTask {
+                        do {
+                            if index > 0 { try await clock.sleep(for: fallbackDelay) }
+                            try Task.checkCancellation()
+                            try await handshake(candidate.connection, host: candidate.host, port: target.port, queue: queue)
+                            try Task.checkCancellation()
+                            return .success(candidate)
+                        } catch {
+                            candidate.connection.cancel()
+                            return .failure(error)
+                        }
+                    }
+                }
+                defer { group.cancelAll() }
+                var lastError: any Error = CancellationError()
+                while let result = try await group.next() {
+                    switch result {
+                    case .success(let connected):
+                        for other in candidates where other.connection !== connected.connection {
+                            other.connection.cancel()
+                        }
+                        if Task.isCancelled {
+                            connected.connection.cancel()
+                            throw CancellationError()
+                        }
+                        return connected
+                    case .failure(let error):
+                        lastError = error
+                    }
+                }
+                throw lastError
+            }
+        } onCancel: {
+            for candidate in candidates { candidate.connection.cancel() }
+        }
+    }
+
+    #if compiler(>=6.2)
+    @concurrent
+    #else
+    @Sendable
+    #endif
+    private func handshake(_ connection: NWConnection, host: String, port: Int, queue: DispatchQueue) async throws {
+        try await withTaskCancellationHandler {
+            try await withThrowingTaskGroup(of: Void.self) { group in
+                group.addTask {
+                    try await connection.startAndWaitUntilReady(queue: queue)
+                    try await CloudPortForwardRelay.connect(connection, to: CloudPortForwardTarget(host: host, port: port))
+                }
+                group.addTask {
+                    // A real handshake deadline; completion cancels this child
+                    // and expiry cancels the socket to unblock Network callbacks.
+                    try await clock.sleep(for: timeout)
+                    connection.cancel()
+                    throw CloudPortForwardRelay.RelayError.handshakeTimedOut(timeout)
+                }
+                defer { group.cancelAll() }
+                try await group.next()
+            }
+        } onCancel: {
+            connection.cancel()
+        }
+    }
+}

Sources/Cloud/PortForward/CloudLoopbackPortForward.swift

@@ -38,6 +38,9 @@ actor CloudLoopbackPortForward {
     }
 
     private(set) var target: CloudPortForwardTarget
+    /// Prefer the last successful family for later HTTP/WebSocket connections;
+    /// a noVNC asset burst must not redial a blackholed family for every file.
+    private var preferredHost: String?
     /// The bound loopback port; 0 until ``start()`` returns.
     private(set) var localPort: UInt16 = 0
     private(set) var isListening = false
@@ -123,6 +126,7 @@ actor CloudLoopbackPortForward {
     /// changes.
     func retarget(_ newTarget: CloudPortForwardTarget) {
         target = newTarget
+        if let preferredHost, !newTarget.hosts.contains(preferredHost) { self.preferredHost = nil }
     }
 
     /// Stops accepting and ends every connection. Returns once the listener
@@ -154,7 +158,12 @@ actor CloudLoopbackPortForward {
         let id = UUID()
         connections[id] = connection
         acceptedConnectionCount += 1
-        let target = self.target
+        let target: CloudPortForwardTarget
+        if let preferredHost {
+            target = CloudPortForwardTarget(host: preferredHost, port: self.target.port, fallbackHosts: self.target.hosts)
+        } else {
+            target = self.target
+        }
         let relay = self.relay
         let queue = self.queue
         Task { [weak self] in
@@ -165,11 +174,19 @@ actor CloudLoopbackPortForward {
                 await self?.connectionDidEnd(id)
                 return
             }
-            await relay.carry(connection, to: target, queue: queue)
+            await relay.carry(connection, to: target, queue: queue) { [weak self] host in
+                await self?.rememberSuccessfulHost(host, for: target)
+            }
             await self?.connectionDidEnd(id)
         }
     }
 
+    private func rememberSuccessfulHost(_ host: String, for attemptedTarget: CloudPortForwardTarget) {
+        guard !stopped, target.port == attemptedTarget.port,
+              Set(target.hosts) == Set(attemptedTarget.hosts) else { return }
+        preferredHost = host
+    }
+
     private func connectionDidEnd(_ id: UUID) {
         connections[id] = nil
     }

Sources/Cloud/PortForward/CloudPortForwardRelay.swift

@@ -29,7 +29,12 @@ struct CloudPortForwardRelay: Sendable {
 
     /// Returns when the connection has ended. A failure before the relay begins
     /// closes `client`, so a browser sees a connection error rather than a hang.
-    func carry(_ client: NWConnection, to target: CloudPortForwardTarget, queue: DispatchQueue) async {
+    func carry(
+        _ client: NWConnection,
+        to target: CloudPortForwardTarget,
+        queue: DispatchQueue,
+        onConnected: @Sendable (String) async -> Void = { _ in }
+    ) async {
         let claim: CloudHubSocketClaim
         do {
             claim = try await dialer.claimHubSocket()
@@ -38,12 +43,14 @@ struct CloudPortForwardRelay: Sendable {
             client.cancel()
             return
         }
-        let upstream = NWConnection(to: claim.endpoint, using: .tcp)
+        let upstream: NWConnection
         do {
-            try await handshake(upstream, to: target, queue: queue)
+            let connected = try await CloudHubConnector(timeout: handshakeTimeout, clock: clock)
+                .connect(endpoint: claim.endpoint, target: target, queue: queue)
+            upstream = connected.connection
+            await onConnected(connected.host)
         } catch {
             logger.error("SOCKS5 CONNECT to \(target.host, privacy: .private):\(target.port, privacy: .public) failed: \(CloudMachineLink.errorText(error), privacy: .public)")
-            upstream.cancel()
             client.cancel()
             await claim.release()
             return
@@ -52,27 +59,6 @@ struct CloudPortForwardRelay: Sendable {
         await claim.release()
     }
 
-    /// The hub connection and SOCKS5 exchange under ``handshakeTimeout``. The
-    /// deadline cancels the connection, which is what unblocks a stalled
-    /// receive; the loser of the race is discarded.
-    private func handshake(_ upstream: NWConnection, to target: CloudPortForwardTarget, queue: DispatchQueue) async throws {
-        let budget = handshakeTimeout
-        let clock = self.clock
-        try await withThrowingTaskGroup(of: Void.self) { group in
-            group.addTask {
-                try await upstream.startAndWaitUntilReady(queue: queue)
-                try await Self.connect(upstream, to: target)
-            }
-            group.addTask {
-                try await clock.sleep(for: budget)
-                upstream.cancel()
-                throw RelayError.handshakeTimedOut(budget)
-            }
-            defer { group.cancelAll() }
-            try await group.next()
-        }
-    }
-
     /// The SOCKS5 handshake on a ready hub connection; on return the stream
     /// carries the tunneled connection.
     static func connect(_ upstream: NWConnection, to target: CloudPortForwardTarget) async throws {

Sources/Cloud/PortForward/CloudPortForwardTarget.swift

@@ -5,4 +5,12 @@ import Foundation
 struct CloudPortForwardTarget: Sendable, Hashable {
     let host: String
     let port: Int
+    /// Other addresses advertised for this same machine. They are raced through
+    /// the same hub; the private network remains the only route.
+    var fallbackHosts: [String] = []
+
+    var hosts: [String] {
+        var seen = Set<String>()
+        return ([host] + fallbackHosts).filter { !$0.isEmpty && seen.insert($0).inserted }
+    }
 }