Ok. Just did a kill -9 of it, after adding     proxyManager.onDemandEnabled = YES;     NEOnDemandRuleConnect *connectOnDemand = [[NEOnDemandRuleConnect alloc] init];     connectOnDemand.interfaceTypeMatch = NEOnDemandRuleInterfaceTypeAny;     proxyManager.onDemandRules = @[         connectOnDemand,         ]; and it came back alive the next time I access the network.

Ok! I will try that later today. Fortunately it seems pretty easy (famous last words 😄).

I'm using NSXPCConnection. (The extension is in fact written in Swift, since I figured that'd be better, although weirdly I still sometimes get a segfault.)

I knew I had a reason for wondering about others, but I think that was just curiosity. The issue I'm trying to deal with is having the transparent proxy not come back automatically; I had thought I could use a daemon we have to try to start the VPN if it was not connected, but I'm not sure that is possible. (After the containing app loads the extension; the reason to see if it's already loaded is to send a message off to an agent, which would then open a url to cause the containing app to launch and load.)

macOS, so the app needn't be sandboxed. Sorry I didn't make that clear.

Ok, this seemed to do it for me.         persistentContainer = NSPersistentContainer(name: "DataModel")         let description = persistentContainer.persistentStoreDescriptions.first         description?.setOption(true as NSNumber, forKey: NSPersistentHistoryTrackingKey)         persistentContainer.loadPersistentStores { description, error in             if let error = error {                 fatalError("\(error)")             }         } I have a different class for CloudKit but I presume I could combine them more than I have. I finally found this answer.

No onDemandRules are set up. I just filed FB9970916.

(Sorry for the frequent comments.) If I sudo launchctl kickstart it, same behaviour. If I go into SysPrefs>Network and click on the Connect button, it works. Which is very similar to what I asked to begin with.

... no log messages, and my CLI program to try to connect to it via XPC hangs.

Oh! It did come back this time. But with absolutely no log messages. And it took more than 2 minutes.

The kill -9 just once. I just now did kill -9 $pid ; sleep 120 and I'll see what's going on. What information would be most useful in a bug report?

Ok, I just verified: I did a kill -9 $pid, and waited 30 seconds. Nothing in /var/log/system.log, and it didn't come back until I went into SysPrefs > Network, selected my now-disconnected VPN, and clicked on "Connect". I tested this on 21E230. Before clicking on "Connect," I did a ps to see if it had been started; it didn't show up.

Ok, so I am not doing anything wrong. 😄 (And yes, it's a subclass of NETransparentProxyProvider.) I already have logs when the subclass init's; I'll try adding one to main as well. And I'll also try waiting a moderate amount of time. Thank you! I feel much better because I wasn't missing something obvious!

Ok. There ended up being multiple instantiations of my NETransparentProxyProvider subclass. The first one, which was causing the problems, still had an XPC listener, and the anonymous XPC connection. In stopProxy, I added code to nil out the invalidation handler, invalidate them, and then set them to nil just for good measure. I must still be missing something, because I added a deinit method that logged it, and it's not being called. sigh. But! That is how it was being set to nil despite my observing it. I am much less frustrated now.

Ok. In stopProxy, I think I need to invalidate all of the XPC connections and listeners.