Cloud: honor enrolled address families when selecting private routes

[austinywang]

Superseded by merged #12266. Its shared resolver covers the sole enrolled family, all-candidate eligibility, and stored-address fallback implemented here. Closing this stacked duplicate; #12268 owns the separate live provider-network reachability fix.

Cloud connections could keep an old IPv4 route even when the WireGuard hub enrolled only IPv6 (or vice versa). Select the sole enrolled address after filtering, and check all known candidates before rejecting a connection. Repeated vm tui connections also reuse the registry's saved address candidates when their endpoint payload omits network_addresses.

Stacked on #12267. This follow-up contains the route eligibility fix; the parent contains the dual-stack connection work and the failing regression tests.

Validation:

• The parent regression run reproduced both stale-IPv4 failures: https://github.com/manaflow-ai/cmux/actions/runs/34469774911
• The focused route-selection run on d7cdb3d322ec39583fb4731d72dfe843bfed02d7 was cancelled after confirming that merged Fix Cloud discovery stalls and private address fallback #12266 supersedes this implementation: https://github.com/manaflow-ai/cmux/actions/runs/34480011525
• Test wiring and workspace package grouping checks passed; git diff --check passed.
• Tagged fleet build passed on pushed HEAD d7cdb3d322ec39583fb4731d72dfe843bfed02d7; the downloaded bundle records CMUXCommit=d7cdb3d32. Build. The default development backend hostname does not resolve, so backend provisioning was disabled. Live Cloud connection dogfood remains pending.

Localization audit: no user-facing strings changed.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Note

^{Cursor Bugbot is generating a summary for commit d7cdb3d. Configure here.}

---

Summary by cubic

Fixes cloud private route selection so connections no longer keep a route for an address family the WireGuard hub didn't enroll. Now selects the sole enrolled candidate after filtering, and rejects only when no candidate matches.

• Repeated vm tui connections reuse the registry's saved address candidates when the endpoint payload omits network_addresses.
• Route selection now checks all known candidates before rejecting a connection.

^{Written for commit d7cdb3d. Summary will update on new commits.}

Latest investigation (Nightly 02d75978e4, September 10): the new VM daemon was running from creation, but the Nightly client dialed IPv4 only. Read-only probes through that same running WireGuard hub timed out after 8 seconds on IPv4 ports 1337 and 6901; IPv6 returned daemon HTTP 404 in 20 ms and desktop HTTP 200 in 48 ms. The UI subsequently reported the 60-second link timeout.

Upstream coordination: #12266 merged at 12:51 UTC and already includes a broader shared route resolver plus independent discovery. This stacked PR overlaps that merged work and should not be merged as a replacement. #12268 tracks the separate provider-network announcement fix and documents the interventions that restored the earlier VMs. The installed Nightly predates both changes.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cmux166	Ready	Preview	Sep 10, 2026 1:01pm UTC
cmux41	Ready	Preview	Sep 10, 2026 1:01pm UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: bd43d87a-5ac2-45cb-8f96-5cb87268d53f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}