npm - @openchambery/web - Versions diffs - 1.18.3 → 1.18.4-beta.10 - Mend

@openchambery/web 1.18.3 → 1.18.4-beta.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (113) hide show

package/dist/index.html CHANGED Viewed

@@ -552,25 +552,25 @@
         opacity: 0.72;
       }
     </style>
-    <script type="module" crossorigin src="/assets/main-DcfiRQEP.js"></script>
+    <script type="module" crossorigin src="/assets/main-5R9S2b57.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-BJpkPwky.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-NfqK-HA7.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DwXJK4-j.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-aA40MHzB.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-CxUYRC6v.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-vZ7H8WKh.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-Cr3LE55y.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-VfMK9fdk.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-CXJwZIZe.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-jfes-HIU.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-CTaznShj.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-KDUc5mh2.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-DC0OJ777.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-DF4hiLrB.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-BWMVRpO_.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-Dbdlm5x1.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <!-- Keep the startup layer outside #root. React replaces every child of

package/dist/mini-chat.html CHANGED Viewed

@@ -74,25 +74,25 @@
       }
     </style>
-    <script type="module" crossorigin src="/assets/miniChat-BL9ppFy8.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-CExPRYpL.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-BJpkPwky.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-NfqK-HA7.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DwXJK4-j.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-aA40MHzB.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-CxUYRC6v.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-vZ7H8WKh.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-Cr3LE55y.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-VfMK9fdk.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-CXJwZIZe.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-jfes-HIU.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-CTaznShj.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-KDUc5mh2.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-DC0OJ777.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-DF4hiLrB.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-BWMVRpO_.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-Dbdlm5x1.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full">

package/dist/mobile.html CHANGED Viewed

@@ -63,25 +63,25 @@
       })();
     </script>
-    <script type="module" crossorigin src="/assets/mobile-BRxbjeRa.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-C7QGpUuZ.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-BJpkPwky.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-NfqK-HA7.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DwXJK4-j.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-aA40MHzB.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-CxUYRC6v.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-vZ7H8WKh.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-Cr3LE55y.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-VfMK9fdk.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-CXJwZIZe.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-jfes-HIU.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-CTaznShj.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-KDUc5mh2.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-DC0OJ777.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-DF4hiLrB.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-BWMVRpO_.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-Dbdlm5x1.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/web",
-  "version": "1.18.3",
+  "version": "1.18.4-beta.10",
   "private": false,
   "type": "module",
   "main": "./server/index.js",

package/server/index.d.ts CHANGED Viewed

@@ -21,10 +21,6 @@ export interface StartWebUiServerOptions {
   transcriptCacheDbPath?: string | null;
   messageQueueDbPath?: string | null;
   messageQueueAttachmentRoot?: string | null;
-  /** Live SSH local-forward ports for relay target-port routing (Electron). */
-  getSshRoutingTable?: () => { id: string; localPort: number }[];
-  /** Mint a stored SSH host clientToken for a ready session (Electron). */
-  mintSshHostToken?: (hostId: string) => Promise<string>;
   /**
    * Optional process-local lock for settings persistence (Electron in-process).
    * When provided, every settings write/migrate joins this exclusive chain so

package/server/index.js CHANGED Viewed

@@ -90,7 +90,7 @@ import { applyRuntimeCorsHeaders } from './lib/request-cors.js';
 import { createClientPairingRuntime } from './lib/client-auth/pairing.js';
 import { createPreviewProxyRuntime } from './lib/preview/proxy-runtime.js';
 import { attachRealtimeProxy } from './lib/realtime-proxy.js';
-import { createRelayService, isDesktopRelayHostRuntime } from './lib/relay/service.js';
+import { createRelayService, isRelayHostRuntime } from './lib/relay/service.js';
 import { createRelayHostLock } from './lib/relay/host-lock.js';
 import { createProxyMiddleware, responseInterceptor } from 'http-proxy-middleware';
 import webPush from 'web-push';
@@ -1184,9 +1184,10 @@ async function main(options = {}) {
       if (h && h !== '127.0.0.1' && h !== 'localhost' && h !== '::1') lanHost = effectiveBindHost;
     }
     const lan = lanHost ? `http://${lanHost.includes(':') ? `[${lanHost}]` : lanHost}:${activePort}` : null;
-    // Only the desktop host may advertise relay. Local `dev` / `web` / CLI
-    // servers must not present "Anywhere" as available or trigger a probe.
-    return { local, lan, relayAvailable: isDesktopRelayHostRuntime() };
+    // Only desktop / SSH-managed remote hosts may advertise relay. Local
+    // `dev` / `web` / ordinary CLI servers must not present "Anywhere" as
+    // available or trigger a probe.
+    return { local, lan, relayAvailable: isRelayHostRuntime() };
   };
   // ALL direct LAN URLs this server is currently reachable on, for the
   // candidates-refresh endpoint: the address the requesting client already
@@ -1248,11 +1249,6 @@ async function main(options = {}) {
   const getDesktopRuntimeConfig = typeof options.getDesktopRuntimeConfig === 'function'
     ? options.getDesktopRuntimeConfig
     : null;
-  // Electron injects live SSH local-forward ports; non-desktop defaults to empty
-  // so relay target-port routing never falls back to an unvalidated port.
-  const getSshRoutingTable = typeof options.getSshRoutingTable === 'function'
-    ? options.getSshRoutingTable
-    : () => [];
   const sessionIndexDbPath = options.sessionIndexDbPath !== undefined
     ? options.sessionIndexDbPath
     : process.env.OPENCHAMBER_SESSION_INDEX_DB_PATH;
@@ -1478,11 +1474,6 @@ async function main(options = {}) {
     sessionIndexService,
     sessionIndexSyncRuntime,
     transcriptCacheService,
-    getSshRoutingTable,
-    mintSshHostToken: typeof options.mintSshHostToken === 'function'
-      ? options.mintSshHostToken
-      : undefined,
-    getPairingSession: (id) => clientPairingRuntime.getPairingSession(id),
   });
   uiAuthController = bootstrapResult.uiAuthController;
   realtimeProxyRuntime = attachRealtimeProxy({
@@ -1506,7 +1497,6 @@ async function main(options = {}) {
     readSettingsStrict: readSettingsFromDiskStrict,
     remoteClientAuthRuntime,
     getLocalPort: () => tunnelRuntimeContext.getActivePort(),
-    getSshRoutingTable,
     // One relay host per machine: every instance sharing this data dir shares
     // the relay identity (serverId), so concurrent hosts evict each other at
     // the relay worker and devices land on a random local instance.
@@ -1644,15 +1634,16 @@ async function main(options = {}) {
     console.warn('[ScheduledTasks] Failed to start runtime:', error?.message || error);
   }
-  // Only Electron (OPENCHAMBER_RUNTIME=desktop) opens a relay host-control
-  // socket or polls relay demand. Local `dev` / `web` never reconcile, so they
-  // cannot inherit a leftover desktop env and start probing the relay.
+  // Only desktop / SSH-managed remotes (OPENCHAMBER_RUNTIME=desktop|ssh-remote)
+  // open a relay host-control socket or poll relay demand. Local `dev` / `web`
+  // never reconcile, so they cannot inherit a leftover desktop env and start
+  // probing the relay.
   let relayReconcileTimer = null;
-  if (isDesktopRelayHostRuntime()) {
+  if (isRelayHostRuntime()) {
     void relayService.reconcile();
     // Relay demand can change outside our routes: pending sessions expire, or a
     // paired device is revoked, without hitting our management routes. Poll so
-    // the desktop host picks demand up (or drops it) within a minute.
+    // the host picks demand up (or drops it) within a minute.
     relayReconcileTimer = setInterval(() => {
       void relayService.reconcile();
     }, 60_000);

package/server/lib/client-auth/pairing.js CHANGED Viewed

@@ -72,9 +72,6 @@ const publicSession = (session) => ({
   allowedClientKinds: session.allowedClientKinds,
   createdByClientId: session.createdByClientId,
   usesRelay: session.usesRelay === true,
-  // Optional SSH instance binding for mobile-over-relay host-token mint.
-  // Null when the pairing is for the desktop local origin (default).
-  sshHostId: session.sshHostId ?? null,
 });
 // A pending session is one that can still be redeemed: not used, not cancelled,
@@ -141,7 +138,6 @@ export const createClientPairingRuntime = ({
           allowedClientKinds: normalizeAllowedClientKinds(session.allowedClientKinds),
           createdByClientId: normalizeOptionalString(session.createdByClientId),
           usesRelay: session.usesRelay === true,
-          sshHostId: normalizeOptionalString(session.sshHostId),
         }))
         .filter((session) => session.secretHash.length > 0)
       : [],
@@ -180,7 +176,7 @@ export const createClientPairingRuntime = ({
     });
   };
-  const createPairingSession = async ({ label, allowedClientKinds, createdByClientId, usesRelay, sshHostId } = {}) => {
+  const createPairingSession = async ({ label, allowedClientKinds, createdByClientId, usesRelay } = {}) => {
     return withStoreMutation(async () => {
       const store = await readStore();
       sweepExpiredSessionsFromStore(store);
@@ -198,8 +194,6 @@ export const createClientPairingRuntime = ({
         allowedClientKinds: normalizeAllowedClientKinds(allowedClientKinds),
         createdByClientId: normalizeOptionalString(createdByClientId),
         usesRelay: usesRelay === true,
-        // Binds later ssh-host-token mint to this pairing; not used by redeem.
-        sshHostId: normalizeOptionalString(sshHostId),
       };
       store.sessions.push(session);
       await writeStore(store);

package/server/lib/client-auth/pairing.test.js CHANGED Viewed

@@ -139,49 +139,4 @@ describe('client auth pairing runtime', () => {
     expect(ids).not.toContain(expired.pairing.id);
     expect(ids).toHaveLength(1);
   });
-  it('persists optional sshHostId and exposes it on query after redeem', async () => {
-    const { dir, runtime } = await makeRuntime();
-    const created = await runtime.createPairingSession({
-      allowedClientKinds: ['mobile'],
-      sshHostId: 'ssh-remote-1',
-    });
-    expect(created.pairing.sshHostId).toBe('ssh-remote-1');
-    const pending = await runtime.listPendingSessions();
-    expect(pending).toEqual(expect.arrayContaining([
-      expect.objectContaining({ id: created.pairing.id, sshHostId: 'ssh-remote-1', usedAt: null }),
-    ]));
-    const lookedUp = await runtime.getPairingSession(created.pairing.id);
-    expect(lookedUp).toMatchObject({ id: created.pairing.id, sshHostId: 'ssh-remote-1', usedAt: null });
-    const storePath = path.join(dir, 'pairing.json');
-    const storeBefore = JSON.parse(await fs.readFile(storePath, 'utf8'));
-    expect(storeBefore.sessions.find((s) => s.id === created.pairing.id)?.sshHostId).toBe('ssh-remote-1');
-    const redeemed = await runtime.redeemPairingSession({
-      pairingId: created.pairing.id,
-      secret: created.pairing.secret,
-      clientKind: 'mobile',
-    });
-    // Redeem still returns the desktop client token; sshHostId is metadata only.
-    expect(redeemed.token).toBe('token-1');
-    expect(redeemed.pairing).toMatchObject({
-      id: created.pairing.id,
-      sshHostId: 'ssh-remote-1',
-    });
-    expect(redeemed.pairing.usedAt).toBeTruthy();
-    const after = await runtime.getPairingSession(created.pairing.id);
-    expect(after).toMatchObject({
-      id: created.pairing.id,
-      sshHostId: 'ssh-remote-1',
-    });
-    expect(after.usedAt).toBeTruthy();
-    // Default pairing has null sshHostId.
-    const plain = await runtime.createPairingSession();
-    expect(plain.pairing.sshHostId).toBeNull();
-  });
 });

package/server/lib/opencode/DOCUMENTATION.md CHANGED Viewed

@@ -8,7 +8,7 @@ This module provides OpenCode server integration utilities for the web server ru
 - `packages/web/server/lib/opencode/auth.js`: provider authentication file operations.
 - `packages/web/server/lib/opencode/auth-state-runtime.js`: managed OpenCode server auth password/header runtime.
 - `packages/web/server/lib/opencode/cli-options.js`: CLI/environment option parsing for server startup arguments.
-- `packages/web/server/lib/opencode/cli-entry-runtime.js`: CLI entrypoint runtime that detects direct execution, forces `OPENCHAMBER_RUNTIME=web` (so `dev:server` cannot inherit a leftover desktop env and host a relay), parses CLI options, and starts server bootstrap.
+- `packages/web/server/lib/opencode/cli-entry-runtime.js`: CLI entrypoint runtime that detects direct execution, forces `OPENCHAMBER_RUNTIME=web` unless already `ssh-remote` (so `dev:server` cannot inherit a leftover desktop env and host a relay, while SSH-managed remotes may), parses CLI options, and starts server bootstrap.
 - `packages/web/server/lib/opencode/routes.js`: OpenCode/provider settings and auth-related route registration.
 - `packages/web/server/lib/opencode/lifecycle.js`: OpenCode process lifecycle runtime (startup, restart, readiness, health monitoring). Managed child env inherits the user shell environment unchanged; experimental flags such as `OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS` follow the user's own environment and are never injected by OpenChamber.
 - `packages/web/server/lib/opencode/managed-capabilities-runtime.js`: managed-child scheduled-task resources, config injection, rotating bridge identity, and bridge authorization.
@@ -33,7 +33,7 @@ This module provides OpenCode server integration utilities for the web server ru
 - `packages/web/server/lib/opencode/tunnel-wiring-runtime.js`: active loopback-port wiring shared by pairing/LAN URLs and the private relay host.
 - `packages/web/server/lib/opencode/startup-pipeline-runtime.js`: server startup tail orchestration runtime for terminal/proxy/static/start-listen flow.
 - `packages/web/server/lib/opencode/server-utils-runtime.js`: shared server runtime utilities for OpenCode proxy wiring, OpenCode port/readiness helpers, and snapshot fetchers.
-- `packages/web/server/lib/opencode/openchamber-routes.js`: OpenChamber update, models metadata, session-index, transcript-cache, and desktop SSH host-token route registration. Tokenless ready SSH hosts may mint a client token on demand via Electron `mintSshHostToken`, which authenticates to the forwarded remote with the in-memory tunnel UI password.
+- `packages/web/server/lib/opencode/openchamber-routes.js`: OpenChamber update, models metadata, session-index, and transcript-cache route registration.
 - `packages/web/server/lib/transcript-cache/`: opt-in Electron/local SQLite transcript cache (`/api/openchamber/transcript-cache`); default path is null so remote Web servers do not persist conversation bodies. See `transcript-cache/DOCUMENTATION.md`.
 - `packages/web/server/lib/opencode/pwa-manifest-routes.js`: PWA manifest route registration with recent-session shortcut resolution and short-lived caching.
 - `packages/web/server/lib/opencode/project-icon-routes.js`: project icon upload/read/discovery route registration and icon storage orchestration.
@@ -276,7 +276,7 @@ When adding or changing Host HTTP APIs that mobile/desktop clients reach over Pr
    - `DELETE /api/passkeys/:id`
    - `POST /api/auth/reset`
     - `POST /api/client-auth/pairing/sessions`: accepts an optional `relayUrl` when Relay is included. An owner UI session or the local `desktop-local` shell client may set a custom endpoint (other client bearers receive HTTP 403). Canonical form is `ws://`/`wss://` scheme/host/path: userinfo is rejected (HTTP 400); query and fragment are stripped and are not part of endpoint identity. The Host persists the switch and reconnects its control connection before returning the pairing-v2 Relay candidate; an `OPENCHAMBER_RELAY_URL` override stays authoritative.
-    - `GET /api/client-auth/pairing/transports`: returns direct transport availability. `relayAvailable` is true only for the Electron desktop host; local `dev` / `web` / CLI servers report false and omit Relay URL fields so the create-device dialog never defaults to Anywhere or probes the relay.
+    - `GET /api/client-auth/pairing/transports`: returns direct transport availability. `relayAvailable` is true for desktop and SSH-managed remote hosts (`OPENCHAMBER_RUNTIME=desktop|ssh-remote`); local `dev` / `web` / ordinary CLI servers report false and omit Relay URL fields so the create-device dialog never defaults to Anywhere or probes the relay.
    - `GET /connect`
    - `POST /api/system/probe-url`
    - `app.use('/api', ...)` auth/tunnel guard
@@ -297,7 +297,7 @@ When adding or changing Host HTTP APIs that mobile/desktop clients reach over Pr
   - Legacy `--tunnel` shorthand normalization
 ## Public exports (cli-entry-runtime.js)
-- `runCliEntryIfMain(dependencies)`: detects direct CLI execution, forces `OPENCHAMBER_RUNTIME=web` so a leftover desktop env cannot host or probe a relay, and runs server startup with parsed CLI options.
+- `runCliEntryIfMain(dependencies)`: detects direct CLI execution, forces `OPENCHAMBER_RUNTIME=web` (preserving `ssh-remote`) so a leftover desktop env cannot host or probe a relay, and runs server startup with parsed CLI options.
 ## Public exports (server-utils-runtime.js)
 - `createServerUtilsRuntime(dependencies)`: creates server utility runtime for OpenCode orchestration helpers.

package/server/lib/opencode/bootstrap-runtime.js CHANGED Viewed

@@ -62,9 +62,6 @@ export const createBootstrapRuntime = (dependencies) => {
       sessionIndexService,
       sessionIndexSyncRuntime,
       transcriptCacheService,
-      getSshRoutingTable,
-      mintSshHostToken,
-      getPairingSession,
     } = options;
     const uiAuthController = createUiAuth({
@@ -154,9 +151,6 @@ export const createBootstrapRuntime = (dependencies) => {
       sessionIndexService,
       sessionIndexSyncRuntime,
       transcriptCacheService,
-      getSshRoutingTable,
-      mintSshHostToken,
-      getPairingSession,
       express,
     });

package/server/lib/opencode/cli-entry-runtime.js CHANGED Viewed

@@ -17,7 +17,11 @@ export const runCliEntryIfMain = (dependencies) => {
   // OPENCHAMBER_RUNTIME=desktop from the parent shell — that would open a relay
   // host-control socket from `bun run dev` / `dev:server`. Electron sets desktop
   // before importing this module and never takes this CLI path.
-  process.env.OPENCHAMBER_RUNTIME = 'web';
+  // SSH-manager remotes set OPENCHAMBER_RUNTIME=ssh-remote (and may pass
+  // --relay-host); preserve that so the remote can host a private relay.
+  if (process.env.OPENCHAMBER_RUNTIME !== 'ssh-remote') {
+    process.env.OPENCHAMBER_RUNTIME = 'web';
+  }
   const cliOptions = parseServeCliOptions({
     argv: process.argv.slice(2),

package/server/lib/opencode/cli-entry-runtime.test.js CHANGED Viewed

@@ -26,6 +26,23 @@ describe('cli-entry-runtime', () => {
     expect(startServer).toHaveBeenCalledTimes(1);
   });
+  it('preserves OPENCHAMBER_RUNTIME=ssh-remote on the direct node server path', () => {
+    process.env.OPENCHAMBER_RUNTIME = 'ssh-remote';
+    const startServer = vi.fn(async () => {});
+    runCliEntryIfMain({
+      process: { argv: ['node', '/tmp/server/index.js', '--port', '3001'], env: process.env, exit: vi.fn() },
+      currentFilename: '/tmp/server/index.js',
+      parseServeCliOptions: () => ({ port: 3001, host: undefined, uiPassword: null, apiOnly: false }),
+      defaultPort: 3001,
+      setExitOnShutdown: vi.fn(),
+      startServer,
+    });
+    expect(process.env.OPENCHAMBER_RUNTIME).toBe('ssh-remote');
+    expect(startServer).toHaveBeenCalledTimes(1);
+  });
   it('does not rewrite OPENCHAMBER_RUNTIME when imported as a library (Electron in-process)', () => {
     process.env.OPENCHAMBER_RUNTIME = 'desktop';

package/server/lib/opencode/core-routes.js CHANGED Viewed

@@ -871,9 +871,6 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
         allowedClientKinds: req.body?.allowedClientKinds,
         createdByClientId: clientIdFromAuthContext(authContext),
         usesRelay,
-        // Optional SSH instance id: binds mobile ssh-host-token mint to this
-        // pairing after redeem. Does not affect redeem itself.
-        sshHostId: req.body?.sshHostId,
       });
       void reconcileRelay();
       res.setHeader('Cache-Control', 'no-store');

package/server/lib/opencode/core-routes.test.js CHANGED Viewed

@@ -774,24 +774,9 @@ describe('core-routes', () => {
       allowedClientKinds: ['mobile'],
       createdByClientId: null,
       usesRelay: false,
-      sshHostId: undefined,
     });
   });
-  it('forwards optional sshHostId into createPairingSession', async () => {
-    const { app, dependencies } = createPairingRouteApp();
-    await request(app)
-      .post('/api/client-auth/pairing/sessions')
-      .set('Host', 'runtime.example')
-      .send({ label: 'SSH phone', allowedClientKinds: ['mobile'], sshHostId: 'ssh-1', includeRelay: true })
-      .expect(201);
-    expect(dependencies.clientPairingRuntime.createPairingSession).toHaveBeenCalledWith(
-      expect.objectContaining({ sshHostId: 'ssh-1' }),
-    );
-  });
   it('advertises the caller-supplied serverUrl as the direct candidate over the request origin', async () => {
     const { app } = createPairingRouteApp();

package/server/lib/opencode/openchamber-routes.js CHANGED Viewed

@@ -1,6 +1,5 @@
 import { registerSessionIndexRoutes } from '../session-index/routes.js';
 import { registerTranscriptCacheRoutes } from '../transcript-cache/routes.js';
-import { registerDesktopHostRoutes } from '../desktop-hosts/routes.js';
 import { registerConfigSyncRoutes } from '../config-sync/routes.js';
 export const registerOpenChamberRoutes = (app, dependencies) => {
@@ -18,21 +17,11 @@ export const registerOpenChamberRoutes = (app, dependencies) => {
     sessionIndexService,
     sessionIndexSyncRuntime,
     transcriptCacheService,
-    getSshRoutingTable,
-    mintSshHostToken,
-    getPairingSession,
     express,
   } = dependencies;
   registerSessionIndexRoutes(app, { sessionIndexService, sessionIndexSyncRuntime });
   registerTranscriptCacheRoutes(app, { transcriptCacheService });
-  registerDesktopHostRoutes(app, {
-    readSettingsFromDiskMigrated,
-    getSshRoutingTable,
-    mintSshHostToken,
-    getPairingSession,
-    express,
-  });
   registerConfigSyncRoutes(app, {
     readSettingsFromDiskMigrated,
     persistSettings,

package/server/lib/relay/DOCUMENTATION.md CHANGED Viewed

@@ -6,7 +6,7 @@ The private relay lets an OpenChamber client (mobile app, browser, or another de
 Traffic is **end-to-end encrypted between the two endpoints** (client and host instance). The relay infrastructure forwards opaque ciphertext and cannot read application traffic — it is an untrusted transport, not a trusted middlebox.
-This module (`packages/web/server/lib/relay/`) is the **Host side** of the private relay. **Only the Electron desktop runtime may act as a relay host** (`OPENCHAMBER_RUNTIME=desktop`, set by Electron before it starts the in-process web server). Plain `node` / `dev:web:hmr` / CLI / VS Code web servers must not open the host-control socket, claim `relay-host.lock`, or advertise a host pairing candidate — even when they share the same data dir as desktop. Those processes may still run the API that *clients* use; mobile and other desktops remain **relay clients**. The **Client side** lives in `packages/ui/src/lib/relay/`. Hosted Relay instances may run in a Worker. The self-hosted **Relay server** belongs to `packages/relay-server/` and brokers Layer 1 connections.
+This module (`packages/web/server/lib/relay/`) is the **Host side** of the private relay. **Only the Electron desktop runtime or an SSH-managed remote server may act as a relay host** (`OPENCHAMBER_RUNTIME=desktop` or `ssh-remote`). Electron sets `desktop` before it starts the in-process web server; SSH manager sets `ssh-remote` when launching a managed remote `openchamber serve` (optionally with `--relay-host`). Plain `node` / `dev:web:hmr` / ordinary CLI / VS Code web servers must not open the host-control socket, claim `relay-host.lock`, or advertise a host pairing candidate — even when they share the same data dir as desktop. Those processes may still run the API that *clients* use; mobile and other desktops remain **relay clients**. The **Client side** lives in `packages/ui/src/lib/relay/`. Hosted Relay instances may run in a Worker. The self-hosted **Relay server** belongs to `packages/relay-server/` and brokers Layer 1 connections.
 ## The three layers
@@ -19,7 +19,7 @@ Traffic is modeled as three stacked layers. The relay understands only Layer 1;
 ## Entrypoints and structure
 Host side (`packages/web/server/lib/relay/`):
-- `service.js` — thin entrypoint: relay config (enabled flag + relay URL), the management routes (`GET/POST /api/openchamber/relay/{status,enable,disable}`), a `getPairingCandidate()` accessor (the relay transport candidate folded into pairing-v2 links when enabled, consumed by the pairing-session route in `core-routes.js`), and lifecycle wiring. Host lifecycle is gated to Electron: non-desktop runtimes (`bun run dev`, `dev:web:hmr`, CLI `serve`, VS Code, plain `node server`) report `state: 'unavailable'`, refuse `/relay/enable`, `/relay/disable`, and relay pairing with 403, never mint a relay identity, never advertise `relayAvailable`, and never call `startRelayHost`. Direct `node server/index.js` forces `OPENCHAMBER_RUNTIME=web` so a leftover desktop env cannot open the host-control socket. On desktop, started from `packages/web/server/index.js` only when demand/opt-in enables the relay. The relay endpoint defaults to the OpenChamber-hosted relay but can be pinned to a self-hosted relay via the `OPENCHAMBER_RELAY_URL` env var; when set it overrides the stored setting for the host connection, the pairing candidate, and status, so paired clients inherit the endpoint automatically. Endpoint identity is scheme/host/path only: accepted schemes are `ws://` and `wss://`; URLs with userinfo are rejected (no silent default fallback); query and fragment are stripped before persistence and pairing candidates. Custom endpoint persistence and Host control-connection switching are explicit authenticated management actions. Pairing creation with `relayUrl` requires an owner UI session or the local `desktop-local` shell client; `/relay/enable` follows its API auth gate.
+- `service.js` — thin entrypoint: relay config (enabled flag + relay URL), the management routes (`GET/POST /api/openchamber/relay/{status,enable,disable}`), a `getPairingCandidate()` accessor (the relay transport candidate folded into pairing-v2 links when enabled, consumed by the pairing-session route in `core-routes.js`), and lifecycle wiring. Host lifecycle is gated by `isRelayHostRuntime()` (`desktop` or `ssh-remote`): other runtimes (`bun run dev`, `dev:web:hmr`, ordinary CLI `serve`, VS Code, plain `node server`) report `state: 'unavailable'`, refuse `/relay/enable`, `/relay/disable`, and relay pairing with 403, never mint a relay identity, never advertise `relayAvailable`, and never call `startRelayHost`. Direct `node server/index.js` forces `OPENCHAMBER_RUNTIME=web` unless it is already `ssh-remote`, so a leftover desktop env cannot open the host-control socket. On host runtimes, started from `packages/web/server/index.js` when demand/opt-in enables the relay. Desktop auto-clears `privateRelay.enabled` when demand drops; `ssh-remote` keeps an explicit opt-in (e.g. `openchamber serve --relay-host`) sticky until disabled. The relay endpoint defaults to the OpenChamber-hosted relay but can be pinned to a self-hosted relay via the `OPENCHAMBER_RELAY_URL` env var; when set it overrides the stored setting for the host connection, the pairing candidate, and status, so paired clients inherit the endpoint automatically. Endpoint identity is scheme/host/path only: accepted schemes are `ws://` and `wss://`; URLs with userinfo are rejected (no silent default fallback); query and fragment are stripped before persistence and pairing candidates. Custom endpoint persistence and Host control-connection switching are explicit authenticated management actions. Pairing creation with `relayUrl` requires an owner UI session or the local `desktop-local` shell client; `/relay/enable` follows its API auth gate.
 - `identity.js` — the host's stable identity: the long-lived signing keypair (shared with the push relay, defines the routing id) plus a long-lived encryption keypair (the E2EE trust anchor). Reused across restarts; never rotated implicitly.
 - `signing-key.js` — storage/derivation of the signing keypair and the routing id, shared with the notifications runtime.
 - `host-client.js` — the long-lived connection manager: one outbound control connection to the relay, a per-client data connection for each connected device, reconnect/backoff, and the E2EE responder handshake per connection.
@@ -104,48 +104,6 @@ Relay mode plugs into the existing client transport layer rather than a parallel
 Catalog loaders (`loadProviders` / `loadAgents`) and assistant Query keys gate writes/caches on the **transport fingerprint**, not `runtimeKey`. On endpoint reset and same-device transport switch, `runtimeEndpointReset.ts` must set `useConfigStore.catalogTransportIdentity` to `getRuntimeTransportIdentity()`. Writing `detail.runtimeKey` there silently discards provider/agent catalog refreshes under Relay, which then hides capability-gated surfaces such as Assistants.
-## SSH host routing
-Mobile (and other relay clients) can reach a desktop's **SSH-forwarded remote OpenChamber instances** through the same private-relay tunnel that already reaches the desktop's local loopback origin. Routing is host-side only: the client selects a target local-forward port; the tunnel dispatcher dials that port on `127.0.0.1` when — and only when — it is present in the live SSH routing table.
-### Header contract
-- Header name: `x-openchamber-target-port`
-- Value: decimal port number string (e.g. `"41234"`)
-- HTTP: carried on the tunneled request headers
-- WebSocket: optional `headers` field on the `WsOpen` payload (same header name/value)
-- The dispatcher **strips** this header before forwarding to loopback (it is routing metadata, not an upstream header)
-### Resolution rules (`resolveTargetPort` in `tunnel-host.js`)
-| Condition | Result |
-|---|---|
-| Header absent | Dial `getLocalPort()` (desktop local origin) — unchanged default behavior |
-| Header present and `localPort` is in `getSshRoutingTable()` | Dial that port |
-| Header present but port missing/invalid/not in table | **Do not** fall back to the default port |
-HTTP miss → synthetic **503** with body `{ error: 'ssh-host-unreachable', …, source: 'relay-tunnel-host' }`.
-WS miss → stream abort with reason `ssh-host-unreachable`.
-### Routing table (authoritative in memory)
-- Electron injects `getSshRoutingTable: () => sshManager.getRoutingTable()` into `startWebUiServer`.
-- Table entries are `{ id, localPort }` for SSH sessions whose status phase is **`ready`** and whose `localPort` is finite.
-- Degraded / connecting / disconnected sessions are absent. Settings.json is **not** the allowlist for dialing — only the live table is.
-- Non-desktop runtimes default to `() => []`.
-### Companion HTTP APIs (authenticated `/api` gate)
-- `GET /api/openchamber/desktop-hosts` → `{ hosts: [{ id, label, localPort, reachable }] }` for configured SSH instances. `reachable` is true iff the host id is in the routing table. **Never returns `clientToken`.**
-- `POST /api/openchamber/ssh-host-token` body `{ hostId }` → `{ token }` from `settings.json` `desktopHosts[].clientToken` for SSH instance hosts only. Missing / non-SSH / no token → **404**. Response includes `Cache-Control: no-store`.
-### Security invariants (do not regress)
-- Path allowlists (`isAllowedHttpPath` / `ALLOWED_WS_PATHS`) are **not** relaxed for SSH targets.
-- The dispatcher **never injects credentials**; the client still authenticates with its own bearer / `oc_url_token` against the target instance.
-- Port legitimacy is solely the in-memory routing table, not client-supplied trust and not settings alone.
-- List endpoints must not leak `clientToken`; token mint is a separate authenticated POST.
 ## Design invariants (do not regress)
 - The relay never sees plaintext application traffic; it sees only routing metadata (routing id, connection identifiers, timestamps, coarse counts).
@@ -154,6 +112,6 @@ WS miss → stream abort with reason `ssh-host-unreachable`.
 - The host dispatcher never injects credentials; the server authenticates each tunneled request.
 - The tunnel is transparent to the app: adding relay support to a feature should not require the feature to know the relay exists — it goes through the shared runtime transport helpers.
 - The two implementations stay byte-compatible and the wire format is versioned/negotiated so mixed client/host app versions degrade gracefully rather than break.
-- SSH target-port routing never falls back to the default local port on a routing-table miss (see "SSH host routing").
+- Tunneled HTTP/WS always dial `getLocalPort()` on loopback; there is no client-selected target-port override on the host dispatcher.
 For the operational rules that keep future changes (new WebSocket endpoints, transport refactors, terminal/voice porting) from breaking this, load the `relay-transport` skill.

package/server/lib/relay/host-client.js CHANGED Viewed

@@ -54,14 +54,12 @@ const resolveBatchWindowMs = (option) => {
  *   identity: { serverId: string, hostEncPrivateKey: CryptoKey, signRelayAuth: (role: string, connectionId?: string | null) => { ts: number, sig: string, pk: string } },
  *   localPort?: number,
  *   getLocalPort?: () => number,
- *   getSshRoutingTable?: () => { id: string, localPort: number }[],
  *   onStatus?: (status: { state: string, lastError: string | null, connectedClients: number }) => void,
  *   logger?: Pick<Console, 'warn'>,
  * }} options
  */
-export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, getSshRoutingTable = () => [], onStatus, logger = console, batchWindowMs, batch }) => {
+export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, onStatus, logger = console, batchWindowMs, batch }) => {
   const resolveLocalPort = typeof getLocalPort === 'function' ? getLocalPort : () => localPort;
-  const resolveSshRoutingTable = typeof getSshRoutingTable === 'function' ? getSshRoutingTable : () => [];
   const localBatch = batch !== false;
   const resolvedBatchWindowMs = resolveBatchWindowMs(batchWindowMs);
@@ -190,7 +188,6 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, ge
           entry.tunnel = createTunnelHost({
             connectionId,
             getLocalPort: resolveLocalPort,
-            getSshRoutingTable: resolveSshRoutingTable,
             getBufferedAmount: () => socket.bufferedAmount,
             sendFrame: (plaintextFrame) => {
               if (dataSockets.get(connectionId) !== entry || socket.readyState !== WebSocket.OPEN) return;