npm - @openchambery/web - Versions diffs - 1.17.1 → 1.18.0 - Mend

@openchambery/web 1.17.1 → 1.18.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (130) hide show

package/dist/index.html CHANGED Viewed

@@ -552,23 +552,23 @@
         opacity: 0.72;
       }
     </style>
-    <script type="module" crossorigin src="/assets/main-CT0DuuLm.js"></script>
+    <script type="module" crossorigin src="/assets/main-D1Xze0xA.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-D6BTB4va.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-5agS8bsW.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-C_KCiMcY.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-BpjUSDz4.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-BzUEk1i7.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-DPNMIbF5.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-CBoBpJ1Z.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-l2R9muux.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-C1DaEMKR.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BYTA045F.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-JSaYFA5x.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-8zziWB78.css">
+    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-D8j1qRH4.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-tB3qLcfa.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-BtWi74Pm.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-oHrYIqHF.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <!-- Keep the startup layer outside #root. React replaces every child of

package/dist/mini-chat.html CHANGED Viewed

@@ -74,23 +74,23 @@
       }
     </style>
-    <script type="module" crossorigin src="/assets/miniChat-BP3OHqNF.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-Dxajshg_.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-D6BTB4va.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-5agS8bsW.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-C_KCiMcY.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-BpjUSDz4.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-BzUEk1i7.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-DPNMIbF5.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-CBoBpJ1Z.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-l2R9muux.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-C1DaEMKR.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BYTA045F.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-JSaYFA5x.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-8zziWB78.css">
+    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-D8j1qRH4.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-tB3qLcfa.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-BtWi74Pm.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-oHrYIqHF.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full">

package/dist/mobile.html CHANGED Viewed

@@ -63,23 +63,23 @@
       })();
     </script>
-    <script type="module" crossorigin src="/assets/mobile-BtwuDs-C.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-CisSv-ca.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-D6BTB4va.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-5agS8bsW.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-C_KCiMcY.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-BpjUSDz4.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-BzUEk1i7.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-DPNMIbF5.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-CBoBpJ1Z.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-l2R9muux.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-C1DaEMKR.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BYTA045F.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-JSaYFA5x.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-8zziWB78.css">
+    <link rel="modulepreload" crossorigin href="/assets/gitApiHttp-D8j1qRH4.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-tB3qLcfa.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-BtWi74Pm.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-oHrYIqHF.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/web",
-  "version": "1.17.1",
+  "version": "1.18.0",
   "private": false,
   "type": "module",
   "main": "./server/index.js",

package/server/index.d.ts CHANGED Viewed

@@ -21,6 +21,10 @@ export interface StartWebUiServerOptions {
   transcriptCacheDbPath?: string | null;
   messageQueueDbPath?: string | null;
   messageQueueAttachmentRoot?: string | null;
+  /** Live SSH local-forward ports for relay target-port routing (Electron). */
+  getSshRoutingTable?: () => { id: string; localPort: number }[];
+  /** Mint a stored SSH host clientToken for a ready session (Electron). */
+  mintSshHostToken?: (hostId: string) => Promise<string>;
 }
 export declare function startWebUiServer(

package/server/index.js CHANGED Viewed

@@ -90,7 +90,7 @@ import { applyRuntimeCorsHeaders } from './lib/request-cors.js';
 import { createClientPairingRuntime } from './lib/client-auth/pairing.js';
 import { createPreviewProxyRuntime } from './lib/preview/proxy-runtime.js';
 import { attachRealtimeProxy } from './lib/realtime-proxy.js';
-import { createRelayService } from './lib/relay/service.js';
+import { createRelayService, isDesktopRelayHostRuntime } from './lib/relay/service.js';
 import { createRelayHostLock } from './lib/relay/host-lock.js';
 import { createProxyMiddleware, responseInterceptor } from 'http-proxy-middleware';
 import webPush from 'web-push';
@@ -1184,7 +1184,9 @@ async function main(options = {}) {
       if (h && h !== '127.0.0.1' && h !== 'localhost' && h !== '::1') lanHost = effectiveBindHost;
     }
     const lan = lanHost ? `http://${lanHost.includes(':') ? `[${lanHost}]` : lanHost}:${activePort}` : null;
-    return { local, lan, relayAvailable: true };
+    // Only the desktop host may advertise relay. Local `dev` / `web` / CLI
+    // servers must not present "Anywhere" as available or trigger a probe.
+    return { local, lan, relayAvailable: isDesktopRelayHostRuntime() };
   };
   // ALL direct LAN URLs this server is currently reachable on, for the
   // candidates-refresh endpoint: the address the requesting client already
@@ -1241,6 +1243,11 @@ async function main(options = {}) {
   const getDesktopRuntimeConfig = typeof options.getDesktopRuntimeConfig === 'function'
     ? options.getDesktopRuntimeConfig
     : null;
+  // Electron injects live SSH local-forward ports; non-desktop defaults to empty
+  // so relay target-port routing never falls back to an unvalidated port.
+  const getSshRoutingTable = typeof options.getSshRoutingTable === 'function'
+    ? options.getSshRoutingTable
+    : () => [];
   const sessionIndexDbPath = options.sessionIndexDbPath !== undefined
     ? options.sessionIndexDbPath
     : process.env.OPENCHAMBER_SESSION_INDEX_DB_PATH;
@@ -1417,7 +1424,7 @@ async function main(options = {}) {
     reconcileRelay: () => (relayServiceInstance ? relayServiceInstance.reconcile() : Promise.resolve()),
     getPairingTransports: async (req) => {
       const transports = resolvePairingTransports(req);
-      if (!relayServiceInstance) return transports;
+      if (!relayServiceInstance || !transports.relayAvailable) return transports;
       const relay = await relayServiceInstance.getStatus();
       return {
         ...transports,
@@ -1465,6 +1472,11 @@ async function main(options = {}) {
     sessionIndexService,
     sessionIndexSyncRuntime,
     transcriptCacheService,
+    getSshRoutingTable,
+    mintSshHostToken: typeof options.mintSshHostToken === 'function'
+      ? options.mintSshHostToken
+      : undefined,
+    getPairingSession: (id) => clientPairingRuntime.getPairingSession(id),
   });
   uiAuthController = bootstrapResult.uiAuthController;
   realtimeProxyRuntime = attachRealtimeProxy({
@@ -1488,6 +1500,7 @@ async function main(options = {}) {
     readSettingsStrict: readSettingsFromDiskStrict,
     remoteClientAuthRuntime,
     getLocalPort: () => tunnelRuntimeContext.getActivePort(),
+    getSshRoutingTable,
     // One relay host per machine: every instance sharing this data dir shares
     // the relay identity (serverId), so concurrent hosts evict each other at
     // the relay worker and devices land on a random local instance.
@@ -1626,18 +1639,19 @@ async function main(options = {}) {
   }
   // Only Electron (OPENCHAMBER_RUNTIME=desktop) opens a relay host-control
-  // socket. Other runtimes no-op reconcile. When allowed, demand-driven: run if
-  // any relay device/session exists, stop (and clear a stale enabled flag)
-  // otherwise.
-  void relayService.reconcile();
-  // Relay demand can change outside our routes: pending sessions expire, or a
-  // paired device is revoked, without hitting our management routes. Poll so
-  // the desktop host picks demand up (or drops it) within a minute.
-  const relayReconcileTimer = setInterval(() => {
+  // socket or polls relay demand. Local `dev` / `web` never reconcile, so they
+  // cannot inherit a leftover desktop env and start probing the relay.
+  let relayReconcileTimer = null;
+  if (isDesktopRelayHostRuntime()) {
     void relayService.reconcile();
-  }, 60_000);
-  relayReconcileTimer.unref?.();
+    // Relay demand can change outside our routes: pending sessions expire, or a
+    // paired device is revoked, without hitting our management routes. Poll so
+    // the desktop host picks demand up (or drops it) within a minute.
+    relayReconcileTimer = setInterval(() => {
+      void relayService.reconcile();
+    }, 60_000);
+    relayReconcileTimer.unref?.();
+  }
   return {
     expressApp: app,
@@ -1683,7 +1697,7 @@ async function main(options = {}) {
         console.warn('[message-queue] Failed to close durable database during shutdown');
       }
       realtimeProxyRuntime.stop();
-      clearInterval(relayReconcileTimer);
+      if (relayReconcileTimer) clearInterval(relayReconcileTimer);
       try {
         relayService.stop();
       } catch {

package/server/lib/client-auth/pairing.js CHANGED Viewed

@@ -72,6 +72,9 @@ const publicSession = (session) => ({
   allowedClientKinds: session.allowedClientKinds,
   createdByClientId: session.createdByClientId,
   usesRelay: session.usesRelay === true,
+  // Optional SSH instance binding for mobile-over-relay host-token mint.
+  // Null when the pairing is for the desktop local origin (default).
+  sshHostId: session.sshHostId ?? null,
 });
 // A pending session is one that can still be redeemed: not used, not cancelled,
@@ -138,6 +141,7 @@ export const createClientPairingRuntime = ({
           allowedClientKinds: normalizeAllowedClientKinds(session.allowedClientKinds),
           createdByClientId: normalizeOptionalString(session.createdByClientId),
           usesRelay: session.usesRelay === true,
+          sshHostId: normalizeOptionalString(session.sshHostId),
         }))
         .filter((session) => session.secretHash.length > 0)
       : [],
@@ -176,7 +180,7 @@ export const createClientPairingRuntime = ({
     });
   };
-  const createPairingSession = async ({ label, allowedClientKinds, createdByClientId, usesRelay } = {}) => {
+  const createPairingSession = async ({ label, allowedClientKinds, createdByClientId, usesRelay, sshHostId } = {}) => {
     return withStoreMutation(async () => {
       const store = await readStore();
       sweepExpiredSessionsFromStore(store);
@@ -194,6 +198,8 @@ export const createClientPairingRuntime = ({
         allowedClientKinds: normalizeAllowedClientKinds(allowedClientKinds),
         createdByClientId: normalizeOptionalString(createdByClientId),
         usesRelay: usesRelay === true,
+        // Binds later ssh-host-token mint to this pairing; not used by redeem.
+        sshHostId: normalizeOptionalString(sshHostId),
       };
       store.sessions.push(session);
       await writeStore(store);

package/server/lib/client-auth/pairing.test.js CHANGED Viewed

@@ -139,4 +139,49 @@ describe('client auth pairing runtime', () => {
     expect(ids).not.toContain(expired.pairing.id);
     expect(ids).toHaveLength(1);
   });
+  it('persists optional sshHostId and exposes it on query after redeem', async () => {
+    const { dir, runtime } = await makeRuntime();
+    const created = await runtime.createPairingSession({
+      allowedClientKinds: ['mobile'],
+      sshHostId: 'ssh-remote-1',
+    });
+    expect(created.pairing.sshHostId).toBe('ssh-remote-1');
+    const pending = await runtime.listPendingSessions();
+    expect(pending).toEqual(expect.arrayContaining([
+      expect.objectContaining({ id: created.pairing.id, sshHostId: 'ssh-remote-1', usedAt: null }),
+    ]));
+    const lookedUp = await runtime.getPairingSession(created.pairing.id);
+    expect(lookedUp).toMatchObject({ id: created.pairing.id, sshHostId: 'ssh-remote-1', usedAt: null });
+    const storePath = path.join(dir, 'pairing.json');
+    const storeBefore = JSON.parse(await fs.readFile(storePath, 'utf8'));
+    expect(storeBefore.sessions.find((s) => s.id === created.pairing.id)?.sshHostId).toBe('ssh-remote-1');
+    const redeemed = await runtime.redeemPairingSession({
+      pairingId: created.pairing.id,
+      secret: created.pairing.secret,
+      clientKind: 'mobile',
+    });
+    // Redeem still returns the desktop client token; sshHostId is metadata only.
+    expect(redeemed.token).toBe('token-1');
+    expect(redeemed.pairing).toMatchObject({
+      id: created.pairing.id,
+      sshHostId: 'ssh-remote-1',
+    });
+    expect(redeemed.pairing.usedAt).toBeTruthy();
+    const after = await runtime.getPairingSession(created.pairing.id);
+    expect(after).toMatchObject({
+      id: created.pairing.id,
+      sshHostId: 'ssh-remote-1',
+    });
+    expect(after.usedAt).toBeTruthy();
+    // Default pairing has null sshHostId.
+    const plain = await runtime.createPairingSession();
+    expect(plain.pairing.sshHostId).toBeNull();
+  });
 });

package/server/lib/desktop-hosts/routes.js ADDED Viewed

@@ -0,0 +1,157 @@
+// Desktop SSH host listing + short-lived token mint for mobile-over-relay.
+// Protected by the global /api UI auth gate (registerAuthAndAccessRoutes).
+// Never returns clientToken from the list endpoint; token is only issued via
+// POST /ssh-host-token. Tokenless ready hosts may mint on demand.
+/**
+ * @param {import('express').Express} app
+ * @param {{
+ *   readSettingsFromDiskMigrated: () => Promise<object>,
+ *   getSshRoutingTable?: () => { id: string, localPort: number }[],
+ *   mintSshHostToken?: (hostId: string) => Promise<string>,
+ *   getPairingSession?: (id: string) => Promise<{ id: string, sshHostId?: string | null, usedAt?: string | null } | null>,
+ *   express?: typeof import('express'),
+ *   logger?: Pick<Console, 'warn' | 'error'>,
+ * }} deps
+ */
+export const registerDesktopHostRoutes = (app, deps) => {
+  const {
+    readSettingsFromDiskMigrated,
+    getSshRoutingTable = () => [],
+    mintSshHostToken,
+    getPairingSession,
+    express,
+    logger = console,
+  } = deps;
+  const readSshInstanceIds = (settings) => {
+    const instances = Array.isArray(settings?.desktopSshInstances) ? settings.desktopSshInstances : [];
+    const ids = new Set();
+    for (const entry of instances) {
+      const id = typeof entry?.id === 'string' ? entry.id.trim() : '';
+      if (id) ids.add(id);
+    }
+    return ids;
+  };
+  const routingPortById = () => {
+    const table = typeof getSshRoutingTable === 'function' ? getSshRoutingTable() : [];
+    /** @type {Map<string, number>} */
+    const map = new Map();
+    if (!Array.isArray(table)) return map;
+    for (const entry of table) {
+      const id = typeof entry?.id === 'string' ? entry.id.trim() : '';
+      const localPort = Number(entry?.localPort);
+      if (!id || !Number.isFinite(localPort)) continue;
+      map.set(id, localPort);
+    }
+    return map;
+  };
+  app.get('/api/openchamber/desktop-hosts', async (_req, res) => {
+    try {
+      const settings = await readSettingsFromDiskMigrated();
+      const sshIds = readSshInstanceIds(settings);
+      const instances = Array.isArray(settings?.desktopSshInstances) ? settings.desktopSshInstances : [];
+      const hostsRaw = Array.isArray(settings?.desktopHosts) ? settings.desktopHosts : [];
+      /** @type {Map<string, { label?: string }>} */
+      const hostById = new Map();
+      for (const entry of hostsRaw) {
+        const id = typeof entry?.id === 'string' ? entry.id.trim() : '';
+        if (id) hostById.set(id, entry);
+      }
+      const livePorts = routingPortById();
+      const hosts = [];
+      for (const instance of instances) {
+        const id = typeof instance?.id === 'string' ? instance.id.trim() : '';
+        if (!id || !sshIds.has(id)) continue;
+        const stored = hostById.get(id);
+        const nickname = typeof instance?.nickname === 'string' ? instance.nickname.trim() : '';
+        const labelFromHost = typeof stored?.label === 'string' ? stored.label.trim() : '';
+        const label = labelFromHost || nickname || id;
+        const livePort = livePorts.get(id);
+        const preferred = Number(instance?.localForward?.preferredLocalPort);
+        const localPort = Number.isFinite(livePort)
+          ? livePort
+          : (Number.isFinite(preferred) ? preferred : 0);
+        hosts.push({
+          id,
+          label,
+          localPort,
+          reachable: Number.isFinite(livePort),
+        });
+      }
+      res.json({ hosts });
+    } catch (error) {
+      console.error('Failed to list desktop hosts:', error);
+      res.status(500).json({
+        error: error instanceof Error ? error.message : 'Failed to list desktop hosts',
+      });
+    }
+  });
+  const jsonParser = express && typeof express.json === 'function'
+    ? express.json({ limit: '16kb' })
+    : (_req, _res, next) => next();
+  app.post('/api/openchamber/ssh-host-token', jsonParser, async (req, res) => {
+    try {
+      res.setHeader('Cache-Control', 'no-store');
+      const hostId = typeof req.body?.hostId === 'string' ? req.body.hostId.trim() : '';
+      if (!hostId) {
+        return res.status(404).json({ error: 'host_not_found' });
+      }
+      const settings = await readSettingsFromDiskMigrated();
+      const sshIds = readSshInstanceIds(settings);
+      if (!sshIds.has(hostId)) {
+        return res.status(404).json({ error: 'host_not_found' });
+      }
+      const pairingId = typeof req.body?.pairingId === 'string' ? req.body.pairingId.trim() : '';
+      if (pairingId) {
+        // Bound mint: pairing must exist, target this host, and already be redeemed.
+        // Redeem itself still issues the desktop token; this gate only authorizes
+        // reading the SSH instance's stored clientToken.
+        const session = typeof getPairingSession === 'function'
+          ? await getPairingSession(pairingId)
+          : null;
+        const sessionHostId = typeof session?.sshHostId === 'string' ? session.sshHostId.trim() : '';
+        const redeemed = Boolean(session?.usedAt);
+        if (!session || sessionHostId !== hostId || !redeemed) {
+          return res.status(403).json({ error: 'pairing-mismatch' });
+        }
+      } else {
+        // Legacy unscoped mint — any authenticated bearer. Remove next cycle.
+        logger.warn?.(
+          '[desktop-hosts] POST /api/openchamber/ssh-host-token without pairingId is deprecated; bind mint to a redeemed pairing session',
+        );
+      }
+      const hostsRaw = Array.isArray(settings?.desktopHosts) ? settings.desktopHosts : [];
+      const host = hostsRaw.find((entry) => typeof entry?.id === 'string' && entry.id.trim() === hostId);
+      let token = typeof host?.clientToken === 'string' ? host.clientToken.trim() : '';
+      if (!token && typeof mintSshHostToken === 'function') {
+        token = String(await mintSshHostToken(hostId) || '').trim();
+      }
+      if (!token) {
+        return res.status(404).json({ error: 'host_not_found' });
+      }
+      const livePort = routingPortById().get(hostId);
+      const reachable = Number.isFinite(livePort);
+      res.json({
+        token,
+        localPort: reachable ? livePort : null,
+        reachable,
+      });
+    } catch (error) {
+      logger.error?.('Failed to issue ssh host token:', error);
+      res.status(500).json({
+        error: error instanceof Error ? error.message : 'Failed to issue ssh host token',
+      });
+    }
+  });
+};