Sep 17, 2025
diff --git a/Coder-Desktop/VPN/PacketTunnelProvider.swift b/Coder-Desktop/VPN/PacketTunnelProvider.swift
 import CoderSDK
 import NetworkExtension
 import os
 import VPNLib

        return nil
    }

    override func startTunnel(
        options _: [String: NSObject]?
    ) async throws {
        globalHelperXPCClient.ptp = self
        guard let proto = protocolConfiguration as? NETunnelProviderProtocol,
              let baseAccessURL = proto.serverAddress
        else {
            logger.error("startTunnel called with nil protocolConfiguration")
            throw makeNSError(suffix: "PTP", desc: "Missing Configuration")
        }
        // HACK: We can't write to the system keychain, and the NE can't read the user keychain.
        guard let token = proto.providerConfiguration?["token"] as? String else {
            logger.error("startTunnel called with nil token")
            throw makeNSError(suffix: "PTP", desc: "Missing Token")
        }
        let headers = proto.providerConfiguration?["literalHeaders"] as? Data
        logger.debug("retrieved token & access URL")
        guard let tunFd = tunnelFileDescriptor else {
            logger.error("startTunnel called with nil tunnelFileDescriptor")
            throw makeNSError(suffix: "PTP", desc: "Missing Tunnel File Descriptor")
        }
        try await globalHelperXPCClient.startDaemon(
            accessURL: .init(string: baseAccessURL)!,
            token: token,
            tun: FileHandle(fileDescriptor: tunFd),
            headers: headers
        )
    }
           options: [String : NSObject]?,
           completionHandler: @Sendable @escaping (Error?) -> Void
       ) {
           // Make a Sendable copy of the completion handler to avoid crossing concurrency domains with a non-Sendable closure
           let complete: @Sendable (Error?) -> Void = { error in
               // Always bounce completion back to the main actor as NetworkExtension expects callbacks on the provider's queue/main.
               Task { @MainActor in completionHandler(error) }
           }
           globalHelperXPCClient.ptp = self

           // Resolve everything you need BEFORE hopping to async, so the Task
           // doesn’t need to capture `self` or `options`.
           guard let proto = protocolConfiguration as? NETunnelProviderProtocol,
                 let baseAccessURL = proto.serverAddress
           else {
               logger.error("startTunnel called with nil protocolConfiguration")
               complete(makeNSError(suffix: "PTP", desc: "Missing Configuration"))
               return
           }

           guard let token = proto.providerConfiguration?["token"] as? String else {
               logger.error("startTunnel called with nil token")
               complete(makeNSError(suffix: "PTP", desc: "Missing Token"))
               return
           }

           let headers = proto.providerConfiguration?["literalHeaders"] as? Data

           guard let tunFd = tunnelFileDescriptor else {
               logger.error("startTunnel called with nil tunnelFileDescriptor")
               complete(makeNSError(suffix: "PTP", desc: "Missing Tunnel File Descriptor"))
               return
           }

           // Bridge to async work
           Task.detached {
               do {
                   try await globalHelperXPCClient.startDaemon(
                       accessURL: URL(string: baseAccessURL)!,
                       token: token,
                       tun: FileHandle(fileDescriptor: tunFd),
                       headers: headers
                   )
                   complete(nil)
               } catch {
                   complete(error)
               }
           }
       }

    override func stopTunnel(
        with _: NEProviderStopReason
        try await setTunnelNetworkSettings(currentSettings)
    }
 }
Original file line number	Diff line number	Diff line change
		@@ -1,5 +1,5 @@
		import CoderSDK
		import NetworkExtension
Check warning on line 2 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ test `add '@preconcurrency' to treat 'Sendable'-related errors from module 'NetworkExtension' as warnings`
		import os
		import VPNLib

Expand DownExpand Up		@@ -43,34 +43,56 @@
		return nil
		}

		override func startTunnel(
Check failure on line 46 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ test `declaration 'startTunnel(options:completionHandler:)' has a type with different sendability from any potential overrides`
		options _: [String: NSObject]?
		) async throws {
		globalHelperXPCClient.ptp = self
		guard let proto = protocolConfiguration as? NETunnelProviderProtocol,
		let baseAccessURL = proto.serverAddress
		else {
		logger.error("startTunnel called with nil protocolConfiguration")
		throw makeNSError(suffix: "PTP", desc: "Missing Configuration")
		}
		// HACK: We can't write to the system keychain, and the NE can't read the user keychain.
		guard let token = proto.providerConfiguration?["token"] as? String else {
		logger.error("startTunnel called with nil token")
		throw makeNSError(suffix: "PTP", desc: "Missing Token")
		}
		let headers = proto.providerConfiguration?["literalHeaders"] as? Data
		logger.debug("retrieved token & access URL")
		guard let tunFd = tunnelFileDescriptor else {
		logger.error("startTunnel called with nil tunnelFileDescriptor")
		throw makeNSError(suffix: "PTP", desc: "Missing Tunnel File Descriptor")
		}
		try await globalHelperXPCClient.startDaemon(
		accessURL: .init(string: baseAccessURL)!,
		token: token,
		tun: FileHandle(fileDescriptor: tunFd),
		headers: headers
		)
		}
		options: [String : NSObject]?,
Check warning on line 47 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ fmt `Add or remove space around operators or delimiters. (spaceAroundOperators)` Check warning on line 47 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ fmt `Indent code in accordance with the scope level. (indent)` Check failure on line 47 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ lint `Parameter 'options' is unused; consider removing or replacing it with '_' (unused_parameter)` Check failure on line 47 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ lint `Colons should be next to the identifier when specifying a type and next to the key in dictionary literals (colon)`
		completionHandler: @Sendable @escaping (Error?) -> Void
Check warning on line 48 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ fmt `Indent code in accordance with the scope level. (indent)`
		) {
Check warning on line 49 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ fmt `Indent code in accordance with the scope level. (indent)`
		// Make a Sendable copy of the completion handler to avoid crossing concurrency domains with a non-Sendable closure
Check warning on line 50 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ fmt `Indent code in accordance with the scope level. (indent)` Check failure on line 50 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ lint `Line should be 120 characters or less; currently it has 126 characters (line_length)`
		let complete: @Sendable (Error?) -> Void = { error in
Check warning on line 51 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ fmt `Indent code in accordance with the scope level. (indent)`
		// Always bounce completion back to the main actor as NetworkExtension expects callbacks on the provider's queue/main.
Check warning on line 52 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ fmt `Indent code in accordance with the scope level. (indent)` Check failure on line 52 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ lint `Line should be 120 characters or less; currently it has 133 characters (line_length)`
		Task { @MainActor in completionHandler(error) }
Check warning on line 53 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ fmt `Indent code in accordance with the scope level. (indent)`
		}
Check warning on line 54 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ fmt `Indent code in accordance with the scope level. (indent)`
		globalHelperXPCClient.ptp = self
Check warning on line 55 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ fmt `Indent code in accordance with the scope level. (indent)`

		// Resolve everything you need BEFORE hopping to async, so the Task
		// doesn’t need to capture `self` or `options`.
		guard let proto = protocolConfiguration as? NETunnelProviderProtocol,
		let baseAccessURL = proto.serverAddress
		else {
		logger.error("startTunnel called with nil protocolConfiguration")
		complete(makeNSError(suffix: "PTP", desc: "Missing Configuration"))
		return
		}

		guard let token = proto.providerConfiguration?["token"] as? String else {
		logger.error("startTunnel called with nil token")
		complete(makeNSError(suffix: "PTP", desc: "Missing Token"))
		return
		}

		let headers = proto.providerConfiguration?["literalHeaders"] as? Data

		guard let tunFd = tunnelFileDescriptor else {
		logger.error("startTunnel called with nil tunnelFileDescriptor")
		complete(makeNSError(suffix: "PTP", desc: "Missing Tunnel File Descriptor"))
		return
		}

		// Bridge to async work
		Task.detached {
		do {
		try await globalHelperXPCClient.startDaemon(
		accessURL: URL(string: baseAccessURL)!,
		token: token,
		tun: FileHandle(fileDescriptor: tunFd),
		headers: headers
		)
		complete(nil)
		} catch {
		complete(error)
		}
		}
		}

		override func stopTunnel(
		with _: NEProviderStopReason
Expand DownExpand Up		@@ -111,3 +133,4 @@
		try await setTunnelNetworkSettings(currentSettings)
		}
		}

Check failure on line 136 in Coder-Desktop/VPN/PacketTunnelProvider.swift View workflow job for this annotation GitHub Actions/ lint `Files should have a single trailing newline (trailing_newline)`