#25493 cmux wg dial: a ProxyCommand that reaches a Cloud machine through the app's WireGuard hub

Leo (2026-10-25): "One command for a persistent machine: cmux cloud new-machine --persistent --size ..., with built-in bootstrap, no idle pause, and automatic acpmux and fleet-registry enrollment."

cmux wg dial --hub <unix socket> <host> <port>

This connects stdin and stdout to host:port on a Cloud machine, through the WireGuard hub the app already runs. ssh can use it as a ProxyCommand. cmux cloud enroll-machine (#25263) writes an ssh Host block that calls it, so ssh lane-vm-1 works from the Mac.

• It is split out of #25263 so that PR stays under 800 lines, and lands before it. The code is #25263's wg dial: run_wg_dial, bridge_through_hub, their three tests, and the help and spec lines.
• If no hub is running, it says so and exits non-zero.
• SIGINT, SIGTERM or SIGHUP ends the bridge, even on a quiet connection: the whole bridge (dial included) races the process's shutdown signal.

Observed / Not run

• Review: Codex gpt-6-astra at xhigh reviewed this code as part of #25263 (10 rounds, SHIP at 62769d83d06b529967b487cac46e9421583435cf), then SHIP at 70966f0398019a4b7de18ee08fd9a9ab1b6d826d for this split. The automated next-review then blocked on one finding (the dial ignored termination signals); d5db47f76d8a4c96e436891a44d29f92151dcbd7 fixes it, and a Codex gpt-6-astra xhigh pass on that head is SHIP.
• Rust tests wg_dial_takes_a_hub_a_host_and_a_port, wg_dial_bridges_stdio_through_the_hub and wg_dial_says_when_no_hub_runs, plus clippy, run in this PR's CI and a Linux fast-check run.

No capture: CLI-only.

Timers/loops: none. The bridge ends when either side closes or the process gets a shutdown signal.

Agent session: agent session

🤖 Generated with Claude Code