I did confirm, at least, that it keeps the same pid, although it calls init multiple times.

Yes. Or a daemon (which is what we're using). I have the daemon send an anonymous listener to the extension's NEMachService port.

Ah ha! Although I don't know how to deal with this yet. There are two distinct instantiations of my class! When stopProxy is called the first time... the object still has things going on. When the the VPN is reconnected, it creates a new one. Let's see what I can do with this information!

Ok. In stopProxy, I think I need to invalidate all of the XPC connections and listeners.

Ok. There ended up being multiple instantiations of my NETransparentProxyProvider subclass. The first one, which was causing the problems, still had an XPC listener, and the anonymous XPC connection. In stopProxy, I added code to nil out the invalidation handler, invalidate them, and then set them to nil just for good measure. I must still be missing something, because I added a deinit method that logged it, and it's not being called. sigh. But! That is how it was being set to nil despite my observing it. I am much less frustrated now.

Ok, so I am not doing anything wrong. 😄 (And yes, it's a subclass of NETransparentProxyProvider.) I already have logs when the subclass init's; I'll try adding one to main as well. And I'll also try waiting a moderate amount of time. Thank you! I feel much better because I wasn't missing something obvious!

Ok, I just verified: I did a kill -9 $pid, and waited 30 seconds. Nothing in /var/log/system.log, and it didn't come back until I went into SysPrefs > Network, selected my now-disconnected VPN, and clicked on "Connect". I tested this on 21E230. Before clicking on "Connect," I did a ps to see if it had been started; it didn't show up.

The kill -9 just once. I just now did kill -9 $pid ; sleep 120 and I'll see what's going on. What information would be most useful in a bug report?

Oh! It did come back this time. But with absolutely no log messages. And it took more than 2 minutes.

... no log messages, and my CLI program to try to connect to it via XPC hangs.

(Sorry for the frequent comments.) If I sudo launchctl kickstart it, same behaviour. If I go into SysPrefs>Network and click on the Connect button, it works. Which is very similar to what I asked to begin with.

No onDemandRules are set up. I just filed FB9970916.

Ok, this seemed to do it for me.         persistentContainer = NSPersistentContainer(name: "DataModel")         let description = persistentContainer.persistentStoreDescriptions.first         description?.setOption(true as NSNumber, forKey: NSPersistentHistoryTrackingKey)         persistentContainer.loadPersistentStores { description, error in             if let error = error {                 fatalError("\(error)")             }         } I have a different class for CloudKit but I presume I could combine them more than I have. I finally found this answer.

macOS, so the app needn't be sandboxed. Sorry I didn't make that clear.

I knew I had a reason for wondering about others, but I think that was just curiosity. The issue I'm trying to deal with is having the transparent proxy not come back automatically; I had thought I could use a daemon we have to try to start the VPN if it was not connected, but I'm not sure that is possible. (After the containing app loads the extension; the reason to see if it's already loaded is to send a message off to an agent, which would then open a url to cause the containing app to launch and load.)