#12148 cloud: explain the tunnel approval wait in the port pane, add cmux.sh proxy URLs

Clicking a Cloud port in NIGHTLY showed "Connecting to vm-…:8000…" forever. Cause: com.cmuxterm.app.nightly.tunnel was activated waiting for user (System Settings approval), requirePrivateNetworkUse has no deadline, and the pane got no state feedback. An end user had no way to know what to do.

Overlay. The gate (CloudPrivateNetworkGate) now reports each CloudTunnelState it waits through. On .awaitingApproval, CloudBrowserPaneOpener replaces the spinner with an overlay: why this port needs the VPN extension (private address, what macOS blocks), the exact System Settings path, and buttons Open System Settings, Check Again (re-runs the whole open; joins the in-flight start), and Open through cmux.sh instead. System Settings opens automatically the first time. Failures show Try Again instead of "close this pane and reopen". Buttons reach the app through SurfaceBrowserPlaceholderBridge, a WKScriptMessageHandler that accepts only main-frame about: documents carrying a live per-pane token.

Proxy URL. Port row context menu gains Copy Proxy URL (cmux.sh) and Open Proxy URL (cmux.sh). Both call POST /api/vm/publications (idempotent, personal access mode) and use <vm>--<org>--<port>.cmux.sh.

Auto sign-in. BrowserAppSessionController.request(externalDestinationURL:) reuses the native→web cookie handoff but navigates the primed isolated store to the publication URL, so the forward-auth bounce to /cloud/access finds the account signed in and returns to the page. Falls back to a plain pane when there is no session.

Tests: CloudTunnelCoordinatorTests (state callback), CmuxTuiSurfaceProviderTests (overlay content, retry page, bridge acceptance rules, opener bookkeeping).

Verification limits: DEV builds have no NetworkExtension entitlement, so in a tagged DEV build the port click lands on the failure page with Try Again + cmux.sh button (bridge path proven); the approval overlay itself renders from the same page builder (screenshot in PR). Dev backend has no CMUX_VM_PUBLICATION_FORWARD_AUTH_SECRET, so publication creation there returns forward_auth_not_configured; the proxy and auto sign-in path needs NIGHTLY/prod dogfood.

https://claude.ai/code/session_01QBFjuF4W1uQ9p4XVy8BiyF

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

[!NOTE]
Medium Risk
Touches VPN gating, WebKit message handling, and auth cookie handoff for external URLs; mistakes could affect tunnel UX or session isolation, but changes are scoped to cloud browser flows with tests.

Overview
Cloud port panes no longer sit on Connecting… indefinitely when the VPN extension is waiting on a one-time macOS approval. The private-network gate streams tunnel state while it waits; CloudBrowserPaneOpener swaps in an approval overlay (why the tunnel is needed, System Settings steps, Open System Settings, Check Again, optional Open through cmux.sh instead) and wires actions through SurfaceBrowserPlaceholderBridge (main-frame about: + per-pane token). Failures with a live opener get Try Again / proxy instead of “close and reopen.”

Port rows gain Copy/Open Proxy URL (cmux.sh) via idempotent personal publications (CloudPortProxy). makeAuthenticatedBrowserPane and request(externalDestinationURL:) prime an isolated WebKit store with cmux cookies but navigate to the publication URL so forward-auth works without a login form. Desktop/VNC keeps proxy disabled so tokens are not exposed on the public route.

^{Reviewed by Cursor Bugbot for commit 3ce1eb4f1aef6ac0252e7338f6b160c1c84b0821. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Fixes the Cloud port pane getting stuck on a forever "Connecting" spinner when the macOS VPN extension approval is pending. The pane now shows an overlay that explains why the tunnel is blocked, gives the exact System Settings path, and offers Open System Settings, Check Again, and "Open through cmux.sh instead" actions.

Bug Fixes

• Tunnel gate now reports each waiting state, so the pane can react to .awaitingApproval with instructions instead of a silent spinner.
• System Settings opens automatically the first time the approval overlay appears; failures show Try Again instead of "close and reopen".
• Pane openers are retained by the provider until the page loads or the pane closes, so the retry loop and bridge token survive past pane creation.

New Features

• Port row context menu gains Copy Proxy URL (cmux.sh) and Open Proxy URL (cmux.sh) actions.
• Proxy URLs are personal publications (<vm>--<org>--<port>.cmux.sh) that need no tunnel and are created idempotently.
• Opening a proxy URL signs in automatically via the existing cmux session handoff, so the sign-in bounce completes without a login form.

Summary by CodeRabbit

• New Features
  • Added a guided Cloud Tunnel approval screen with setup steps, retry controls, and a direct link to the relevant System Settings.
  • Added options to copy or open authenticated proxy URLs for forwarded ports.
  • Added proxy-based fallback access when direct Cloud browser connections are unavailable.
  • Cloud browser panes now display tunnel connection progress and actionable approval or retry states.
  • Added authenticated browser navigation for external Cloud destinations.
  • Added English and Japanese translations for new Cloud Tunnel and proxy actions.