Run cmux iOS over authenticated Iroh transport

[azooz2003-bit]

Summary

• run the macOS host and iOS client over authenticated Iroh by default
• retain Tailscale and validated private-network routes as fallbacks
• add same-account broker discovery, pair grants, managed relays, offline LAN policy, and multistream lanes
• preserve active endpoints through transient broker failures and normalize legacy device UUID case without weakening device pinning

Verification

• swift test --package-path Packages/Shared/CmuxIrohTransport --scratch-path /tmp/cmux-iroh-final-553f (249 tests, 33 suites)
• tagged macOS irh2 build and isolated Simulator cmux-irh2-codex-151853
• authenticated Iroh pair grant, one active Mac session, and iOS terminal round trip: IROH_IOS_ROUNDTRIP_1551
• macOS 14 Intel compatibility run: https://github.com/manaflow-ai/cmux/actions/runs/29171266371
• no physical device used

Stack

• stacked on Secure Iroh route identity and fallback policy #7818
• requires the trust broker from Add the authenticated Iroh trust broker and relay minter #7840

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

High Risk
Large new authenticated transport surface (admission, grants, broker credentials, multistream QUIC) plus auth/session-transition behavior; mistakes affect remote attach security and sign-in/sign-out races.

Overview
This PR makes authenticated Iroh the primary iOS↔Mac attach path, introduced via a new CmuxIrohTransport package (QUIC control stream, acknowledged NAT admission, broker grants/offline pairing, managed relays, multistream terminal/event/artifact lanes, and Mac-side admission quotas). CMUXMobileCore gains request-aware byte transports (CmxByteTransportRequest), a cloudRendezvous disclosure boundary (relay URLs only off-device), opaque hex network profile IDs, tighter path-hint rules (no IPv4 link-local / native private hints), CmxTailscaleStatusPeerResolver for storing numeric peers from local tailscale status, CmxCredentialedHTTPSession (no redirect credential leakage), and bounded MobileSyncFrameCodec / MobileHostRPCWorkQuota decoding.

CLI cmux remotes add docs now describe resolving *.ts.net against the authenticated local peer map and persisting the peer’s numeric address. Auth changes serialize browser sign-out (HostBrowserSignOutCoordinator), expose signOutRevision, and treat token reads during active sign-in/sign-out as retryable instead of clearing session state. CI adds CmuxIrohTransport Swift tests and an Intel macOS 14 compat matrix row with targeted package tests.

^{Reviewed by Cursor Bugbot for commit b310583. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Default iOS↔Mac attach now runs over authenticated Iroh via CmuxIrohTransport, using a versioned multistream QUIC wire with an admission/NAT barrier and bounded peer streams. The iOS runtime owns endpoint/app‑instance identity, registers with signed challenges, rotates relay creds, caches verified offline policy, and defers activation until the signed‑in runtime is ready.

• New Features

  • Iroh wire/host: versioned lane headers; acknowledged admission and NAT barrier; bounded incoming QUIC streams; independent server‑events; admitted multistream host sessions with per‑binding quotas.
  • Runtime: supervised endpoint generations; account‑scoped endpoint/app‑instance IDs; signed registration and discovery bound to the local app instance; managed‑relay rotation with online/offline admission leases; authenticated Bonjour LAN fallback; pooled client sessions that evict remotely closed connections.
  • Core/security: request‑aware transports via CmxByteTransportRequest; CmxIrohByteTransport adapts admitted control lanes and exposes CmxIndependentEventByteStream; MobileSyncFrameCodec adds a decoded‑frame count limit; MobileHostRPCWorkQuota bounds host work; CmxCredentialedHTTPSession blocks credentialed redirects; CmxTailscaleStatusPeerResolver persists numeric peers; relay hints require native public‑internet scope; IPv4 link‑local rejected.
  • Relay policy and CI/Auth: persisted broker relay credentials and an optional custom relay profile override; HostBrowserSignOutCoordinator serializes sign‑out and exposes signOutRevision; token reads during session transitions are retryable; CI runs CmuxIrohTransport tests and adds an Intel macOS 14 row.

• Migration

  • cmux remotes add accepts numeric Tailscale IPv4/IPv6 or *.ts.net; MagicDNS resolves via the authenticated local peer map and stores the peer’s numeric address; plain LAN IPs, other hostnames, and loopback are rejected.
  • Cloud rendezvous, pairing QR, and paired‑Mac backups serialize relay URLs only.
  • CmxIrohNetworkProfileKey requires a canonical lowercase‑hex 32‑byte digest.

^{Written for commit b9bdb27. Summary will update on new commits.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.