Clean up stale tunnel on app launch and quit

Kill any leftover tunnel helper from a previous session on startup,
preventing stale utun interfaces and routes from hijacking traffic.
Also tear down tunnel on app quit via willTerminateNotification.

Author: Geramy

apps/LemonadeNexusMac/Sources/LemonadeNexusMac/LemonadeNexusApp.swift

@@ -12,6 +12,12 @@ struct LemonadeNexusApp: App {
                 .frame(minWidth: 900, minHeight: 600)
                 .onAppear {
                     configureAppearance()
+                    // Clean up tunnel on app quit
+                    NotificationCenter.default.addObserver(
+                        forName: NSApplication.willTerminateNotification,
+                        object: nil, queue: .main) { _ in
+                            TunnelManager.shared.cleanupStaleHelper()
+                        }
                     if appState.autoDiscoveryEnabled {
                         Task {
                             await appState.discoverNearestServer()
@@ -87,6 +93,9 @@ struct LemonadeNexusApp: App {
     }
 
     private func configureAppearance() {
+        // Kill any stale tunnel helper from a previous session
+        TunnelManager.shared.cleanupStaleHelper()
+
         // Set the accent color globally
         NSApplication.shared.appearance = NSAppearance(named: .aqua)
 

apps/LemonadeNexusMac/Sources/LemonadeNexusMac/Services/TunnelManager.swift

@@ -15,6 +15,12 @@ final class TunnelManager: ObservableObject {
     private let configPath = "/tmp/lnsdk_wg0.json"
     private let pidPath = "/tmp/lnsdk_tunnel.pid"
 
+    /// Clean up any stale tunnel from a previous app session.
+    /// Called once on app launch before any tunnel operations.
+    func cleanupStaleHelper() {
+        killExistingHelper()
+    }
+
     /// Path to the tunnel helper binary (built alongside the main app).
     private var helperPath: String {
         // The helper binary is in the same directory as the main app binary