PR #34262 - manaflow-ai/cmux

Summary

This re-lands the Cloud Tunnel that the base-red revert #34198 took out, with the defects that made the revert necessary fixed. It replaces #34204: that branch was cut before #34198 merged, and moving it onto the new base needs a force push.

Takes back #34198: the revert was the base-red step; this is the re-land with the fixes, as the team rule asks (revert first, re-land with the fix second).

Commits:

435c9fe475d: the twelve commits #34198 reverted, unchanged. Original work by lawrencecchen (direct push ad2c76731f28..cc33e089376e).
0edd2750e1f, 0c7640fade4, 5858add9b28: the packet tunnel observes the network path with NWPathMonitor on its own utility queue (not the main thread), because NEProvider.defaultPath is not in the macOS 26.5 SDK. Same rule as before: the monitor's first path is the current one, so only a real change after it calls engine.networkChanged(). The rule is CloudTunnelPathChangeGate with CloudTunnelPathChangeGateTests. The extension writes Network.NWPath (NetworkExtension has a legacy NWPath).
e50417298c6 (red), then the fix: the extension enters the app only from embed-cloud-tunnel.sh, and only when it ships. Before, an unconditional Embed System Extensions copy phase embedded it in every build, the script deleted it in a Release build without CMUX_CLOUD_TUNNEL=YES, and Xcode's ValidateEmbeddedBinary then failed ("Couldn't load Info dictionary for ... cmux-cloud-tunnel.systemextension", fleet job 10b8f087c165db1fb4ad92df). The copy phase is gone. The script phase copies $BUILT_PRODUCTS_DIR/cmux-cloud-tunnel.systemextension in a Debug build or a Release build with CMUX_CLOUD_TUNNEL=YES, then stamps, signs and checks it as before. The target dependency stays, so the extension still compiles in every build.

The third defect of the push (4 indexing_slicing sites in cmux-wg-tun) was fixed in #34220, already on the base. The cmux-wg-tun pid-dependent utun test is #34248.

Changelog

none

Testing

tests/test_embed_cloud_tunnel.sh: red at e50417298c6 with 3 failures (shipping and Debug builds embed nothing, and the project still has the Copy Files embed); green at the head. Run here (shell only, no build).
python3 scripts/cmux-next/prepush-gate.py: no new violations.
Full Release app build on the fleet, and the 3 CloudTunnel suites: see the comment with the job IDs.

Observed / Not run

Observed: the shell test red and green; the prepush gate; the fleet results in the comment.
Not run: a Release build with CMUX_CLOUD_TUNNEL=YES and a tunnel profile (that is the nightly channel's signing path), and a live tunnel on a Mac.

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Re-lands the Cloud Tunnel system extension reverted in #34198, fixing the two defects that caused the revert: the packet tunnel now watches network path changes with NWPathMonitor instead of NEProvider.defaultPath (missing from the macOS 26.5 SDK), and the extension is embedded only when a build actually ships it, removing the unconditional Copy Files phase that broke ValidateEmbeddedBinary.

The independent reviews' reds are fixed as well: the CLI verbs take the house style (cloud tunnel-on, cloud tunnel-off, cloud tunnel-status) instead of the three-word cloud tunnel on|off|status, the three tunnel actions got their context-menu exemption, the project's copy-files section is back so the nightly build parser works, the generated ci-target-graph.json drift is reverted, and the "Cloud Tunnel" brand strings are recorded in the localization omission file. The nightly step coverage entry for the tunnel prep step is restored, and the action catalog, settings schema, and MDM docs regenerated from these changes.

Bug Fixes

PacketTunnelProvider runs NWPathMonitor on its own serial queue; the first path is the current one, so only real changes call engine.networkChanged().
The extension now enters the app only from embed-cloud-tunnel.sh: it copies it into Debug builds and Release builds with CMUX_CLOUD_TUNNEL=YES, and other Release builds never embed it.