npm - @openchambery/web - Versions diffs - 1.17.1-beta.11 → 1.17.1-beta.13 - Mend

@openchambery/web 1.17.1-beta.11 → 1.17.1-beta.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (133) hide show

package/dist/index.html CHANGED Viewed

@@ -552,23 +552,23 @@
         opacity: 0.72;
       }
     </style>
-    <script type="module" crossorigin src="/assets/main-BLqbjxPt.js"></script>
+    <script type="module" crossorigin src="/assets/main-q1V-_wWx.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-D6BTB4va.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-WQV8IuFw.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-C_KCiMcY.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-BpjUSDz4.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-BzUEk1i7.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-CFtygeYy.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-RE7NIkeq.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-BzyaU7-i.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-C1DaEMKR.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BYTA045F.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-JSaYFA5x.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-8zziWB78.css">
+    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-BswZXfrf.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-MQ285A_s.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-D4ETkuTj.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-DrgsP0XF.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <!-- Keep the startup layer outside #root. React replaces every child of

package/dist/mini-chat.html CHANGED Viewed

@@ -74,23 +74,23 @@
       }
     </style>
-    <script type="module" crossorigin src="/assets/miniChat-Cr9SuyZk.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-VXuyA8mS.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-D6BTB4va.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-WQV8IuFw.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-C_KCiMcY.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-BpjUSDz4.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-BzUEk1i7.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-CFtygeYy.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-RE7NIkeq.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-BzyaU7-i.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-C1DaEMKR.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BYTA045F.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-JSaYFA5x.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-8zziWB78.css">
+    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-BswZXfrf.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-MQ285A_s.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-D4ETkuTj.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-DrgsP0XF.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full">

package/dist/mobile.html CHANGED Viewed

@@ -63,23 +63,23 @@
       })();
     </script>
-    <script type="module" crossorigin src="/assets/mobile-Bp-qiKtn.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-CaKZM4y3.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-D6BTB4va.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-WQV8IuFw.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-C_KCiMcY.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-BpjUSDz4.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-BzUEk1i7.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-CFtygeYy.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-RE7NIkeq.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-BzyaU7-i.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-C1DaEMKR.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BYTA045F.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-JSaYFA5x.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-8zziWB78.css">
+    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-BswZXfrf.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-MQ285A_s.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-D4ETkuTj.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-DrgsP0XF.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/web",
-  "version": "1.17.1-beta.11",
+  "version": "1.17.1-beta.13",
   "private": false,
   "type": "module",
   "main": "./server/index.js",

package/server/index.d.ts CHANGED Viewed

@@ -21,6 +21,8 @@ export interface StartWebUiServerOptions {
   transcriptCacheDbPath?: string | null;
   messageQueueDbPath?: string | null;
   messageQueueAttachmentRoot?: string | null;
+  /** Live SSH local-forward ports for relay target-port routing (Electron). */
+  getSshRoutingTable?: () => { id: string; localPort: number }[];
 }
 export declare function startWebUiServer(

package/server/index.js CHANGED Viewed

@@ -1241,6 +1241,11 @@ async function main(options = {}) {
   const getDesktopRuntimeConfig = typeof options.getDesktopRuntimeConfig === 'function'
     ? options.getDesktopRuntimeConfig
     : null;
+  // Electron injects live SSH local-forward ports; non-desktop defaults to empty
+  // so relay target-port routing never falls back to an unvalidated port.
+  const getSshRoutingTable = typeof options.getSshRoutingTable === 'function'
+    ? options.getSshRoutingTable
+    : () => [];
   const sessionIndexDbPath = options.sessionIndexDbPath !== undefined
     ? options.sessionIndexDbPath
     : process.env.OPENCHAMBER_SESSION_INDEX_DB_PATH;
@@ -1465,6 +1470,8 @@ async function main(options = {}) {
     sessionIndexService,
     sessionIndexSyncRuntime,
     transcriptCacheService,
+    getSshRoutingTable,
+    getPairingSession: (id) => clientPairingRuntime.getPairingSession(id),
   });
   uiAuthController = bootstrapResult.uiAuthController;
   realtimeProxyRuntime = attachRealtimeProxy({
@@ -1488,6 +1495,7 @@ async function main(options = {}) {
     readSettingsStrict: readSettingsFromDiskStrict,
     remoteClientAuthRuntime,
     getLocalPort: () => tunnelRuntimeContext.getActivePort(),
+    getSshRoutingTable,
     // One relay host per machine: every instance sharing this data dir shares
     // the relay identity (serverId), so concurrent hosts evict each other at
     // the relay worker and devices land on a random local instance.

package/server/lib/client-auth/pairing.js CHANGED Viewed

@@ -72,6 +72,9 @@ const publicSession = (session) => ({
   allowedClientKinds: session.allowedClientKinds,
   createdByClientId: session.createdByClientId,
   usesRelay: session.usesRelay === true,
+  // Optional SSH instance binding for mobile-over-relay host-token mint.
+  // Null when the pairing is for the desktop local origin (default).
+  sshHostId: session.sshHostId ?? null,
 });
 // A pending session is one that can still be redeemed: not used, not cancelled,
@@ -138,6 +141,7 @@ export const createClientPairingRuntime = ({
           allowedClientKinds: normalizeAllowedClientKinds(session.allowedClientKinds),
           createdByClientId: normalizeOptionalString(session.createdByClientId),
           usesRelay: session.usesRelay === true,
+          sshHostId: normalizeOptionalString(session.sshHostId),
         }))
         .filter((session) => session.secretHash.length > 0)
       : [],
@@ -176,7 +180,7 @@ export const createClientPairingRuntime = ({
     });
   };
-  const createPairingSession = async ({ label, allowedClientKinds, createdByClientId, usesRelay } = {}) => {
+  const createPairingSession = async ({ label, allowedClientKinds, createdByClientId, usesRelay, sshHostId } = {}) => {
     return withStoreMutation(async () => {
       const store = await readStore();
       sweepExpiredSessionsFromStore(store);
@@ -194,6 +198,8 @@ export const createClientPairingRuntime = ({
         allowedClientKinds: normalizeAllowedClientKinds(allowedClientKinds),
         createdByClientId: normalizeOptionalString(createdByClientId),
         usesRelay: usesRelay === true,
+        // Binds later ssh-host-token mint to this pairing; not used by redeem.
+        sshHostId: normalizeOptionalString(sshHostId),
       };
       store.sessions.push(session);
       await writeStore(store);

package/server/lib/client-auth/pairing.test.js CHANGED Viewed

@@ -139,4 +139,49 @@ describe('client auth pairing runtime', () => {
     expect(ids).not.toContain(expired.pairing.id);
     expect(ids).toHaveLength(1);
   });
+  it('persists optional sshHostId and exposes it on query after redeem', async () => {
+    const { dir, runtime } = await makeRuntime();
+    const created = await runtime.createPairingSession({
+      allowedClientKinds: ['mobile'],
+      sshHostId: 'ssh-remote-1',
+    });
+    expect(created.pairing.sshHostId).toBe('ssh-remote-1');
+    const pending = await runtime.listPendingSessions();
+    expect(pending).toEqual(expect.arrayContaining([
+      expect.objectContaining({ id: created.pairing.id, sshHostId: 'ssh-remote-1', usedAt: null }),
+    ]));
+    const lookedUp = await runtime.getPairingSession(created.pairing.id);
+    expect(lookedUp).toMatchObject({ id: created.pairing.id, sshHostId: 'ssh-remote-1', usedAt: null });
+    const storePath = path.join(dir, 'pairing.json');
+    const storeBefore = JSON.parse(await fs.readFile(storePath, 'utf8'));
+    expect(storeBefore.sessions.find((s) => s.id === created.pairing.id)?.sshHostId).toBe('ssh-remote-1');
+    const redeemed = await runtime.redeemPairingSession({
+      pairingId: created.pairing.id,
+      secret: created.pairing.secret,
+      clientKind: 'mobile',
+    });
+    // Redeem still returns the desktop client token; sshHostId is metadata only.
+    expect(redeemed.token).toBe('token-1');
+    expect(redeemed.pairing).toMatchObject({
+      id: created.pairing.id,
+      sshHostId: 'ssh-remote-1',
+    });
+    expect(redeemed.pairing.usedAt).toBeTruthy();
+    const after = await runtime.getPairingSession(created.pairing.id);
+    expect(after).toMatchObject({
+      id: created.pairing.id,
+      sshHostId: 'ssh-remote-1',
+    });
+    expect(after.usedAt).toBeTruthy();
+    // Default pairing has null sshHostId.
+    const plain = await runtime.createPairingSession();
+    expect(plain.pairing.sshHostId).toBeNull();
+  });
 });

package/server/lib/desktop-hosts/routes.js ADDED Viewed

@@ -0,0 +1,152 @@
+// Desktop SSH host listing + short-lived token mint for mobile-over-relay.
+// Protected by the global /api UI auth gate (registerAuthAndAccessRoutes).
+// Never returns clientToken from the list endpoint; token is only issued via
+// POST /ssh-host-token for SSH instance hosts that already store one.
+/**
+ * @param {import('express').Express} app
+ * @param {{
+ *   readSettingsFromDiskMigrated: () => Promise<object>,
+ *   getSshRoutingTable?: () => { id: string, localPort: number }[],
+ *   getPairingSession?: (id: string) => Promise<{ id: string, sshHostId?: string | null, usedAt?: string | null } | null>,
+ *   express?: typeof import('express'),
+ *   logger?: Pick<Console, 'warn' | 'error'>,
+ * }} deps
+ */
+export const registerDesktopHostRoutes = (app, deps) => {
+  const {
+    readSettingsFromDiskMigrated,
+    getSshRoutingTable = () => [],
+    getPairingSession,
+    express,
+    logger = console,
+  } = deps;
+  const readSshInstanceIds = (settings) => {
+    const instances = Array.isArray(settings?.desktopSshInstances) ? settings.desktopSshInstances : [];
+    const ids = new Set();
+    for (const entry of instances) {
+      const id = typeof entry?.id === 'string' ? entry.id.trim() : '';
+      if (id) ids.add(id);
+    }
+    return ids;
+  };
+  const routingPortById = () => {
+    const table = typeof getSshRoutingTable === 'function' ? getSshRoutingTable() : [];
+    /** @type {Map<string, number>} */
+    const map = new Map();
+    if (!Array.isArray(table)) return map;
+    for (const entry of table) {
+      const id = typeof entry?.id === 'string' ? entry.id.trim() : '';
+      const localPort = Number(entry?.localPort);
+      if (!id || !Number.isFinite(localPort)) continue;
+      map.set(id, localPort);
+    }
+    return map;
+  };
+  app.get('/api/openchamber/desktop-hosts', async (_req, res) => {
+    try {
+      const settings = await readSettingsFromDiskMigrated();
+      const sshIds = readSshInstanceIds(settings);
+      const instances = Array.isArray(settings?.desktopSshInstances) ? settings.desktopSshInstances : [];
+      const hostsRaw = Array.isArray(settings?.desktopHosts) ? settings.desktopHosts : [];
+      /** @type {Map<string, { label?: string }>} */
+      const hostById = new Map();
+      for (const entry of hostsRaw) {
+        const id = typeof entry?.id === 'string' ? entry.id.trim() : '';
+        if (id) hostById.set(id, entry);
+      }
+      const livePorts = routingPortById();
+      const hosts = [];
+      for (const instance of instances) {
+        const id = typeof instance?.id === 'string' ? instance.id.trim() : '';
+        if (!id || !sshIds.has(id)) continue;
+        const stored = hostById.get(id);
+        const nickname = typeof instance?.nickname === 'string' ? instance.nickname.trim() : '';
+        const labelFromHost = typeof stored?.label === 'string' ? stored.label.trim() : '';
+        const label = labelFromHost || nickname || id;
+        const livePort = livePorts.get(id);
+        const preferred = Number(instance?.localForward?.preferredLocalPort);
+        const localPort = Number.isFinite(livePort)
+          ? livePort
+          : (Number.isFinite(preferred) ? preferred : 0);
+        hosts.push({
+          id,
+          label,
+          localPort,
+          reachable: Number.isFinite(livePort),
+        });
+      }
+      res.json({ hosts });
+    } catch (error) {
+      console.error('Failed to list desktop hosts:', error);
+      res.status(500).json({
+        error: error instanceof Error ? error.message : 'Failed to list desktop hosts',
+      });
+    }
+  });
+  const jsonParser = express && typeof express.json === 'function'
+    ? express.json({ limit: '16kb' })
+    : (_req, _res, next) => next();
+  app.post('/api/openchamber/ssh-host-token', jsonParser, async (req, res) => {
+    try {
+      res.setHeader('Cache-Control', 'no-store');
+      const hostId = typeof req.body?.hostId === 'string' ? req.body.hostId.trim() : '';
+      if (!hostId) {
+        return res.status(404).json({ error: 'host_not_found' });
+      }
+      const settings = await readSettingsFromDiskMigrated();
+      const sshIds = readSshInstanceIds(settings);
+      if (!sshIds.has(hostId)) {
+        return res.status(404).json({ error: 'host_not_found' });
+      }
+      const pairingId = typeof req.body?.pairingId === 'string' ? req.body.pairingId.trim() : '';
+      if (pairingId) {
+        // Bound mint: pairing must exist, target this host, and already be redeemed.
+        // Redeem itself still issues the desktop token; this gate only authorizes
+        // reading the SSH instance's stored clientToken.
+        const session = typeof getPairingSession === 'function'
+          ? await getPairingSession(pairingId)
+          : null;
+        const sessionHostId = typeof session?.sshHostId === 'string' ? session.sshHostId.trim() : '';
+        const redeemed = Boolean(session?.usedAt);
+        if (!session || sessionHostId !== hostId || !redeemed) {
+          return res.status(403).json({ error: 'pairing-mismatch' });
+        }
+      } else {
+        // Legacy unscoped mint — any authenticated bearer. Remove next cycle.
+        logger.warn?.(
+          '[desktop-hosts] POST /api/openchamber/ssh-host-token without pairingId is deprecated; bind mint to a redeemed pairing session',
+        );
+      }
+      const hostsRaw = Array.isArray(settings?.desktopHosts) ? settings.desktopHosts : [];
+      const host = hostsRaw.find((entry) => typeof entry?.id === 'string' && entry.id.trim() === hostId);
+      const token = typeof host?.clientToken === 'string' ? host.clientToken.trim() : '';
+      if (!token) {
+        return res.status(404).json({ error: 'host_not_found' });
+      }
+      const livePort = routingPortById().get(hostId);
+      const reachable = Number.isFinite(livePort);
+      res.json({
+        token,
+        localPort: reachable ? livePort : null,
+        reachable,
+      });
+    } catch (error) {
+      logger.error?.('Failed to issue ssh host token:', error);
+      res.status(500).json({
+        error: error instanceof Error ? error.message : 'Failed to issue ssh host token',
+      });
+    }
+  });
+};

package/server/lib/desktop-hosts/routes.test.js ADDED Viewed

@@ -0,0 +1,194 @@
+import { describe, expect, it, vi } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { registerDesktopHostRoutes } from './routes.js';
+const baseSettings = {
+  desktopSshInstances: [{ id: 'ssh-1' }, { id: 'ssh-2' }],
+  desktopHosts: [
+    { id: 'ssh-1', clientToken: 'ssh-token-1' },
+    { id: 'ssh-2', clientToken: 'ssh-token-2' },
+    { id: 'lan-other', clientToken: 'other-token' },
+  ],
+};
+const createApp = ({
+  settings = baseSettings,
+  getSshRoutingTable = () => [],
+  getPairingSession,
+  logger = { warn: vi.fn(), error: vi.fn() },
+} = {}) => {
+  const app = express();
+  registerDesktopHostRoutes(app, {
+    express,
+    readSettingsFromDiskMigrated: async () => settings,
+    getSshRoutingTable,
+    getPairingSession,
+    logger,
+  });
+  return { app, logger };
+};
+describe('desktop host routes', () => {
+  it('lists SSH hosts with reachable from the routing table and never returns clientToken', async () => {
+    const { app } = createApp({
+      settings: {
+        desktopSshInstances: [
+          { id: 'ssh-1', nickname: 'Remote A', localForward: { preferredLocalPort: 41001 } },
+          { id: 'ssh-2', nickname: 'Remote B', localForward: { preferredLocalPort: 41002 } },
+        ],
+        desktopHosts: [
+          { id: 'ssh-1', label: 'Remote A', clientToken: 'secret-a' },
+          { id: 'ssh-2', label: 'Remote B', clientToken: 'secret-b' },
+          { id: 'lan-other', label: 'Other', clientToken: 'secret-other' },
+        ],
+      },
+      getSshRoutingTable: () => [{ id: 'ssh-1', localPort: 41234 }],
+    });
+    const res = await request(app).get('/api/openchamber/desktop-hosts');
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({
+      hosts: [
+        { id: 'ssh-1', label: 'Remote A', localPort: 41234, reachable: true },
+        { id: 'ssh-2', label: 'Remote B', localPort: 41002, reachable: false },
+      ],
+    });
+    expect(JSON.stringify(res.body)).not.toContain('secret');
+    expect(JSON.stringify(res.body)).not.toContain('clientToken');
+  });
+  it('issues token with localPort/reachable when pairingId matches a redeemed session', async () => {
+    const getPairingSession = vi.fn(async (id) => {
+      if (id !== 'pair_ok') return null;
+      return { id: 'pair_ok', sshHostId: 'ssh-1', usedAt: '2026-01-01T00:00:00.000Z' };
+    });
+    const { app, logger } = createApp({
+      getSshRoutingTable: () => [{ id: 'ssh-1', localPort: 41234 }],
+      getPairingSession,
+    });
+    const ok = await request(app)
+      .post('/api/openchamber/ssh-host-token')
+      .send({ hostId: 'ssh-1', pairingId: 'pair_ok' });
+    expect(ok.status).toBe(200);
+    expect(ok.headers['cache-control']).toBe('no-store');
+    expect(ok.body).toEqual({
+      token: 'ssh-token-1',
+      localPort: 41234,
+      reachable: true,
+    });
+    expect(getPairingSession).toHaveBeenCalledWith('pair_ok');
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+  it('returns 403 when pairingId sshHostId does not match hostId', async () => {
+    const { app } = createApp({
+      getPairingSession: async () => ({
+        id: 'pair_x',
+        sshHostId: 'ssh-2',
+        usedAt: '2026-01-01T00:00:00.000Z',
+      }),
+    });
+    const res = await request(app)
+      .post('/api/openchamber/ssh-host-token')
+      .send({ hostId: 'ssh-1', pairingId: 'pair_x' });
+    expect(res.status).toBe(403);
+    expect(res.body).toEqual({ error: 'pairing-mismatch' });
+  });
+  it('returns 403 when pairing session is not redeemed', async () => {
+    const { app } = createApp({
+      getPairingSession: async () => ({
+        id: 'pair_pending',
+        sshHostId: 'ssh-1',
+        usedAt: null,
+      }),
+    });
+    const res = await request(app)
+      .post('/api/openchamber/ssh-host-token')
+      .send({ hostId: 'ssh-1', pairingId: 'pair_pending' });
+    expect(res.status).toBe(403);
+    expect(res.body).toEqual({ error: 'pairing-mismatch' });
+  });
+  it('returns 403 when pairingId is unknown', async () => {
+    const { app } = createApp({
+      getPairingSession: async () => null,
+    });
+    const res = await request(app)
+      .post('/api/openchamber/ssh-host-token')
+      .send({ hostId: 'ssh-1', pairingId: 'pair_missing' });
+    expect(res.status).toBe(403);
+    expect(res.body).toEqual({ error: 'pairing-mismatch' });
+  });
+  it('allows legacy mint without pairingId and logs a deprecation warning', async () => {
+    const { app, logger } = createApp({
+      getSshRoutingTable: () => [{ id: 'ssh-1', localPort: 41234 }],
+    });
+    const ok = await request(app)
+      .post('/api/openchamber/ssh-host-token')
+      .send({ hostId: 'ssh-1' });
+    expect(ok.status).toBe(200);
+    expect(ok.headers['cache-control']).toBe('no-store');
+    expect(ok.body).toEqual({
+      token: 'ssh-token-1',
+      localPort: 41234,
+      reachable: true,
+    });
+    expect(logger.warn).toHaveBeenCalledTimes(1);
+    expect(String(logger.warn.mock.calls[0][0])).toMatch(/deprecated/i);
+  });
+  it('returns reachable false and localPort null when routing table misses', async () => {
+    const { app } = createApp({
+      getSshRoutingTable: () => [],
+      getPairingSession: async () => ({
+        id: 'pair_ok',
+        sshHostId: 'ssh-1',
+        usedAt: '2026-01-01T00:00:00.000Z',
+      }),
+    });
+    const res = await request(app)
+      .post('/api/openchamber/ssh-host-token')
+      .send({ hostId: 'ssh-1', pairingId: 'pair_ok' });
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({
+      token: 'ssh-token-1',
+      localPort: null,
+      reachable: false,
+    });
+  });
+  it('returns 404 for missing / non-SSH / tokenless hosts', async () => {
+    const { app } = createApp();
+    const missing = await request(app)
+      .post('/api/openchamber/ssh-host-token')
+      .send({ hostId: 'missing' });
+    expect(missing.status).toBe(404);
+    const nonSsh = await request(app)
+      .post('/api/openchamber/ssh-host-token')
+      .send({ hostId: 'lan-other' });
+    expect(nonSsh.status).toBe(404);
+    const { app: noTokenApp } = createApp({
+      settings: {
+        desktopSshInstances: [{ id: 'ssh-empty' }],
+        desktopHosts: [{ id: 'ssh-empty' }],
+      },
+    });
+    const noToken = await request(noTokenApp)
+      .post('/api/openchamber/ssh-host-token')
+      .send({ hostId: 'ssh-empty' });
+    expect(noToken.status).toBe(404);
+  });
+});

package/server/lib/opencode/bootstrap-runtime.js CHANGED Viewed

@@ -61,6 +61,8 @@ export const createBootstrapRuntime = (dependencies) => {
       sessionIndexService,
       sessionIndexSyncRuntime,
       transcriptCacheService,
+      getSshRoutingTable,
+      getPairingSession,
     } = options;
     const uiAuthController = createUiAuth({
@@ -149,6 +151,9 @@ export const createBootstrapRuntime = (dependencies) => {
       sessionIndexService,
       sessionIndexSyncRuntime,
       transcriptCacheService,
+      getSshRoutingTable,
+      getPairingSession,
+      express,
     });
     return {

package/server/lib/opencode/core-routes.js CHANGED Viewed

@@ -871,6 +871,9 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
         allowedClientKinds: req.body?.allowedClientKinds,
         createdByClientId: clientIdFromAuthContext(authContext),
         usesRelay,
+        // Optional SSH instance id: binds mobile ssh-host-token mint to this
+        // pairing after redeem. Does not affect redeem itself.
+        sshHostId: req.body?.sshHostId,
       });
       void reconcileRelay();
       res.setHeader('Cache-Control', 'no-store');

package/server/lib/opencode/core-routes.test.js CHANGED Viewed

@@ -774,9 +774,24 @@ describe('core-routes', () => {
       allowedClientKinds: ['mobile'],
       createdByClientId: null,
       usesRelay: false,
+      sshHostId: undefined,
     });
   });
+  it('forwards optional sshHostId into createPairingSession', async () => {
+    const { app, dependencies } = createPairingRouteApp();
+    await request(app)
+      .post('/api/client-auth/pairing/sessions')
+      .set('Host', 'runtime.example')
+      .send({ label: 'SSH phone', allowedClientKinds: ['mobile'], sshHostId: 'ssh-1', includeRelay: true })
+      .expect(201);
+    expect(dependencies.clientPairingRuntime.createPairingSession).toHaveBeenCalledWith(
+      expect.objectContaining({ sshHostId: 'ssh-1' }),
+    );
+  });
   it('advertises the caller-supplied serverUrl as the direct candidate over the request origin', async () => {
     const { app } = createPairingRouteApp();