[lawrencecchen]

Summary

This re-lands the Cloud Tunnel that the base-red revert #34198 took out, with the defects that made the revert necessary fixed. It replaces #34204: that branch was cut before #34198 merged, and moving it onto the new base needs a force push.

Takes back #34198: the revert was the base-red step; this is the re-land with the fixes, as the team rule asks (revert first, re-land with the fix second).

Commits:

1. 435c9fe475d: the twelve commits base red: revert 010ffb95c155 (Cloud Tunnel extension does not compile on the macOS 26.5 SDK) #34198 reverted, unchanged. Original work by lawrencecchen (direct push ad2c76731f28..cc33e089376e).
2. 0edd2750e1f, 0c7640fade4, 5858add9b28: the packet tunnel observes the network path with NWPathMonitor on its own utility queue (not the main thread), because NEProvider.defaultPath is not in the macOS 26.5 SDK. Same rule as before: the monitor's first path is the current one, so only a real change after it calls engine.networkChanged(). The rule is CloudTunnelPathChangeGate with CloudTunnelPathChangeGateTests. The extension writes Network.NWPath (NetworkExtension has a legacy NWPath).
3. e50417298c6 (red), then the fix: the extension enters the app only from embed-cloud-tunnel.sh, and only when it ships. Before, an unconditional Embed System Extensions copy phase embedded it in every build, the script deleted it in a Release build without CMUX_CLOUD_TUNNEL=YES, and Xcode's ValidateEmbeddedBinary then failed ("Couldn't load Info dictionary for ... cmux-cloud-tunnel.systemextension", fleet job 10b8f087c165db1fb4ad92df). The copy phase is gone. The script phase copies $BUILT_PRODUCTS_DIR/cmux-cloud-tunnel.systemextension in a Debug build or a Release build with CMUX_CLOUD_TUNNEL=YES, then stamps, signs and checks it as before. The target dependency stays, so the extension still compiles in every build.

The third defect of the push (4 indexing_slicing sites in cmux-wg-tun) was fixed in #34220, already on the base. The cmux-wg-tun pid-dependent utun test is #34248.

Changelog

none

Testing

• tests/test_embed_cloud_tunnel.sh: red at e50417298c6 with 3 failures (shipping and Debug builds embed nothing, and the project still has the Copy Files embed); green at the head. Run here (shell only, no build).
• python3 scripts/cmux-next/prepush-gate.py: no new violations.
• Full Release app build on the fleet, and the 3 CloudTunnel suites: see the comment with the job IDs.

Observed / Not run

• Observed: the shell test red and green; the prepush gate; the fleet results in the comment.
• Not run: a Release build with CMUX_CLOUD_TUNNEL=YES and a tunnel profile (that is the nightly channel's signing path), and a live tunnel on a Mac.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Re-lands the Cloud Tunnel system extension reverted in #34198, fixing the two defects that caused the revert: the packet tunnel now watches network path changes with NWPathMonitor instead of NEProvider.defaultPath (missing from the macOS 26.5 SDK), and the extension is embedded only when a build actually ships it, removing the unconditional Copy Files phase that broke ValidateEmbeddedBinary.

The independent reviews' reds are fixed as well: the CLI verbs take the house style (cloud tunnel-on, cloud tunnel-off, cloud tunnel-status) instead of the three-word cloud tunnel on|off|status, the three tunnel actions got their context-menu exemption, the project's copy-files section is back so the nightly build parser works, the generated ci-target-graph.json drift is reverted, and the "Cloud Tunnel" brand strings are recorded in the localization omission file. The nightly step coverage entry for the tunnel prep step is restored, and the action catalog, settings schema, and MDM docs regenerated from these changes.

Bug Fixes

• PacketTunnelProvider runs NWPathMonitor on its own serial queue; the first path is the current one, so only real changes call engine.networkChanged().
• The extension now enters the app only from embed-cloud-tunnel.sh: it copies it into Debug builds and Release builds with CMUX_CLOUD_TUNNEL=YES, and other Release builds never embed it.

^{Written for commit a8e2d43. Summary will update on new commits.}

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review a8e2d43: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr34262 -f ref=base-red-tunnel-reland-v2 -f platform=macos -f backend_mode=local

Passes: CI passes on a8e2d43cb4.

CI passes on a8e2d43cb4 (run 41770354817 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

web and size checks: green

Default changes

This pull request changes 1 default at a8e2d43cb482 (what everyone gets without configuring anything):

• setting.cloud.tunnel.enabled: (none) -> false (a new setting, off by default: passes on its own)

Every change is a new setting that defaults to off, the behavior from before it existed.

Regenerate the snapshot with python3 scripts/ci/defaults_guard.py snapshot.

[blacksmith-sh]

Found 3 test failures on Blacksmith runners:

Failures

Test	View Logs
test_live_typed_catalog_matches_every_registry (main.ContractRegistryTests.test_liv e_typed_catalog_matches_every_registry)/ test_live_typed_catalog_matches_every_registry (main.ContractRegistryTests.test_liv e_typed_catalog_matches_every_registry)	View Logs
test_live_typed_catalog_matches_every_registry (main.ContractRegistryTests.test_liv e_typed_catalog_matches_every_registry)/ test_live_typed_catalog_matches_every_registry (main.ContractRegistryTests.test_liv e_typed_catalog_matches_every_registry)	View Logs
test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)/ test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

For awareness: #34271 removes the stale Prepare the Cloud Tunnel extension entry from .github/nightly-step-coverage.json. The #34198 revert left that entry behind, and test_nightly_step_coverage turned release-notary red on base. This PR adds the step back, so it also needs to add that entry back: "Prepare the Cloud Tunnel extension": {"nightly_only": "checks the secret tunnel provisioning profile and writes signing entitlements for the signed app"} under build-sign-notarize-nightly.

[teamleaderleo]

Awareness note from an agent lane that does not own this PR; it is not a review or a request to take the PR over.

---

This re-land also repairs a current base build failure affecting #27490: #34198 removed settings.cloud.tunnel.enabled, settings.cloud.tunnel.enabled.help and settings.group.cloudTunnel translations while the generated settings schema retained those keys. String generation now reports 63 missing translations across 21 locales, stopping web bundles, gallery builds and native test setup before tests run. Example failed setup. The re-land commit 435c9fe475d3c8561f5d2caf282a39c9d5f04c49 restores all three keys in every locale. Sharing this as another affected build path; #27490 changes none of those files.

[lawrencecchen]

Fleet evidence at the head 7a93ec1:

• Full Release app build f60f80848172e2a6783119ad (aws-m4pro-7) is green ('Build complete.'). The xcodebuild steps for this target compile and validate after the extension target, so a green build means the extension compiled and no ValidateEmbeddedBinary error happened.
• Its artifact cmux.app.zip (9142 entries) has no Contents/Library/SystemExtensions: a Release build without CMUX_CLOUD_TUNNEL=YES no longer contains the extension.
• CloudTunnel suites step a4bca7e393aa3f40643130d2: CloudTunnelPathChangeGateTests, CloudTunnelConfigurationTests and CloudTunnelControllerTests all pass.
• Not seen: the per-step xcodebuild log. The controller keeps only the head and summary of a green build, and the job has no full log.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[lawrencecchen]

Fleet evidence at the exact head db6efa9 (after merging feat at 6767426 with scripts/merge-main.sh):

• Full Release app build de3892381fb4d72bfa6b4576 (aws-m4pro-4) is green ('Build complete.').
• cmux-tui cli::cloud_help::, step 9b513d5739c3531ecd478d21 (Linux): 10/10 pass, including help_lists_exactly_the_offered_cloud_verbs.
• Swift suites ActionContractTests, ActionSurfaceParityTests, CloudTunnelPathChangeGateTests, CloudTunnelConfigurationTests and CloudTunnelControllerTests, step e73b5aaa8aba0dcfa1a717b4 (macOS, aws-m4pro-4): all 5 pass.
• Here (shell and Python only): tests/test_ci_nightly_push_throttle.py PASS, tests/test_embed_cloud_tunnel.sh ok.

[lawrencecchen]

Review (claude-opus-reviewer): SHIP at a8e2d43

Independent review. The three earlier reds are fixed:

• generated drift exits 0 over all 79 changed files;
• the localization check against the base is within the debt baseline;
• test_nightly_step_coverage passes.

The action exports against a4f11cd only add the 3 tunnel actions (1346 to 1349 ids, none lost), and they are byte-identical to PR autofix run 41766647218's output.

The engine parses wg-quick only through cmux-wg's WgConfig. The PR adds no new Swift parser; CloudTunnelConfiguration.swift is unchanged from cc33e08, which is a known follow-up.

Also checked: cloud help lists exactly the 62 offered cloud verbs; there are no conflict markers; check-pbxproj passes; the throttle, embed and sign-gate shell tests pass; the prepush gate finds no new violations.

Base finding, not from this PR: tooling-tests bench/replayLogs.test.ts (#34382) is red at a4f11cd too.

Follow-ups, not reds: get the network-settings fields from WgConfig over FFI and delete the Swift subset parser; move the action.cloudSystemTunnel* titles out of the action.agent.share object in ActionCatalog.xcstrings (this was already in the original push).