Cloud link: resolve Worker hosts through the private credential relay
Cloud host dials in NEXT currently reach a placeholder resolver and report unreachable. This change connects the supervised link process to the signed-in app through a private Unix socket, fetching connect_info and minting a fresh scoped link token per dial. The install token stays in the app, and the app-provider route continues to refuse link_token.
Leo: “you need to do all that stuff we do not care about classic we care about our new cloud”
Tracks manaflow-ai/cmuxterm-hq#5390 and manaflow-ai/cmux-platform#89. The socket authenticates the expected link pid, process start time and executable; it is isolated by build and install generation. The path is passed explicitly to link ensure/serve and included in restart matching. Null network routes remain a separate network integration item.
Validation: published candidate 56c433a5be2a8169003de2b3f85c7dde65c5c201 passes the complete static prepush gate against merged base 180c255d2f386c33631491beebed4065647770d2, including architecture, concurrency, and crash checks. Process-scan check passes. The repaired head is published.
The Rust tree is unchanged since 2198fa0174964a046f6af08347d984702f9c30ec: macOS cmux-tui cargo check passed in fleet job e12e34745f8e1727d1868e97; focused resolver tests passed (9 tests, including the real socket round trip) at that source SHA, via snapshot 4d8df443659278beab445695d94877e4e6858268. That fleet job's Swift compile failed on continuation type inference, repaired in this candidate. Final-head Release frontend compile passed in fleet job 84f9f01fb0e0f6a2a36dbbdb (app 111.5 seconds; macOS-target cmux-tui check 19.9 seconds). The focused Swift relay suite has now been submitted. Independent Sol review: SHIP at 56c433a5be2a8169003de2b3f85c7dde65c5c201, with a P2 paused-refusal error-mapping follow-up to be filed; no blocking review finding.
The endpoint uses a short unique name tested against Darwin's normal temporary-directory length. Socket requests have bounded read/write deadlines and a maximum of 32 active operations; shutdown cancels owned tasks and generation-fences replies. The shared install-bound relay is constructed in the existing Cloud credentials module.
Network dependency: this resolver repair alone cannot connect to the deployed guest image. The receiver/grant/routing stack must be integrated and activated on a compatible NEXT Worker-created machine; no end-to-end connection result is claimed here.
Risk: credential carrier and lifecycle. CloudConfiguration.swift is unchanged.
No capture: this changes the private credential transport and launch wiring, with no UI layout or rendering changes.
Final head 83a911b1d44d2aa7cd9289b6f13ca3518d75e15c (merged with feat-cmux-next): link_token's expires_at is now integer milliseconds as the Worker returns it (Sol review finding), relay replies are read with Value::get (panic ratchet flat), plus rustfmt/clippy fixes. Fleet: cmux-link connect_info 4/4 and cmux-tui link:: 99/99, clippy -D warnings and the panic ratchet green (run); NEXT app + cmux-tui Release compile passed (fleet job 02a7ba0ff1458c3bae3ceec5, at the merged head before the Rust-only fixes); CloudCredentialRelayRefusalTests 9/9 (fleet step 124c826fc7d9c07bc70d4bd3). Review: SHIP at the final head (gpt-6.1-sol xhigh). Follow-ups: #30262.
Agent session: agent session