@openchambery/web 1.18.4-beta.1 → 1.18.4-beta.11

package/server/lib/relay/service.js

@@ -6,11 +6,11 @@
 // Routes are registered with the other OpenChamber feature routes, before the
 // generic OpenCode proxy, and are covered by the same global UI auth gate.
 //
-// Host gate: only the Electron desktop runtime may run a relay host
-// (OPENCHAMBER_RUNTIME=desktop, set before the in-process web server starts).
-// Plain `node server`, `dev:web:hmr`, VS Code, CLI, and browser clients must
-// never open the host-control socket, mint a relay identity, advertise a host
-// pairing candidate, or probe the relay. They may still be relay *clients*
+// Host gate: only the Electron desktop runtime or an SSH-managed remote server
+// may run a relay host (OPENCHAMBER_RUNTIME=desktop | ssh-remote).
+// Plain `node server`, `dev:web:hmr`, VS Code, ordinary CLI, and browser clients
+// must never open the host-control socket, mint a relay identity, advertise a
+// host pairing candidate, or probe the relay. They may still be relay *clients*
 // when connecting to another host.
 
 import express from 'express';
@@ -21,16 +21,22 @@ import { startRelayHost } from './host-client.js';
 export const DEFAULT_RELAY_URL = 'wss://relay.openchamber.dev/ws';
 
 export const RELAY_HOST_DESKTOP_ONLY_MESSAGE =
-  'Relay host is only available in the OpenChamber desktop app';
+  'Relay host is only available in the OpenChamber desktop app or an SSH-managed remote server';
 
 // Electron main sets this before importing the in-process web server.
 export const isDesktopRelayHostRuntime = (env = process.env) =>
   env?.OPENCHAMBER_RUNTIME === 'desktop';
 
+// Desktop app, or an SSH-manager-started remote (`OPENCHAMBER_RUNTIME=ssh-remote`).
+export const isRelayHostRuntime = (env = process.env) => {
+  const runtime = env?.OPENCHAMBER_RUNTIME;
+  return runtime === 'desktop' || runtime === 'ssh-remote';
+};
+
 // Canonical form: ws(s)://host[:port]/path only. Reject credentials (userinfo)
 // so settings and pairing candidates never store secrets in the endpoint URL.
 // Strip query/fragment so persistence and candidates stay scheme/host/path.
-const canonicalizeRelayUrl = (value) => {
+export const canonicalizeRelayUrl = (value) => {
   if (typeof value !== 'string') return null;
   const trimmed = value.trim();
   if (!trimmed) return null;
@@ -69,7 +75,6 @@ const envRelayUrlOverride = () => {
  *   readSettingsFromDiskMigrated: () => Promise<object>,
  *   writeSettingsToDisk: (settings: object) => Promise<void>,
  *   getLocalPort: () => number,
- *   getSshRoutingTable?: () => { id: string, localPort: number }[],
  *   logger?: Pick<Console, 'warn'>,
  *   canHostRelay?: () => boolean,
  * }} deps
@@ -82,8 +87,6 @@ export const createRelayService = ({
   // regeneration — see identity.js/signing-key.js.
   readSettingsStrict,
   getLocalPort,
-  // Live SSH local-forward ports (Electron). Empty outside desktop.
-  getSshRoutingTable = () => [],
   // Returns true when any paired device or pending pairing session uses the
   // relay transport. The relay lifecycle is driven purely by this demand.
   hasRelayDemand = async () => false,
@@ -92,8 +95,8 @@ export const createRelayService = ({
   // evict each other at the relay worker ("Control replaced") and devices land
   // on a random instance. Optional: without it, behavior is pre-lock.
   hostLock = null,
-  // Host gate: false for non-Electron runtimes (dev server, CLI, VS Code, …).
-  canHostRelay = () => isDesktopRelayHostRuntime(),
+  // Host gate: false for non-host runtimes (dev server, ordinary CLI, VS Code, …).
+  canHostRelay = () => isRelayHostRuntime(),
   logger = console,
 }) => {
   const identityRuntime = createRelayIdentityRuntime({ crypto, readSettingsFromDiskMigrated, writeSettingsToDisk, readSettingsStrict });
@@ -211,7 +214,6 @@ export const createRelayService = ({
       relayUrl,
       identity,
       getLocalPort,
-      getSshRoutingTable,
       logger,
       onStatus: (next) => {
         status = next;
@@ -242,8 +244,12 @@ export const createRelayService = ({
   // Drive the relay lifecycle from demand: run it when a device or pending
   // session uses the relay, stop it when none remain. Called on startup and after
   // pairing/device changes, so the operator never toggles it manually.
-  // Non-desktop runtimes never host: skip entirely so a shared data dir with
+  // Non-host runtimes never host: skip entirely so a shared data dir with
   // Electron is not rewritten or claim-contested by dev/CLI servers.
+  // SSH-managed remotes (`ssh-remote`) may also keep an explicit
+  // `privateRelay.enabled` opt-in (e.g. `openchamber serve --relay-host`) even
+  // when no paired device is present yet — desktop still auto-clears enabled
+  // when demand drops.
   const reconcile = async () => {
     if (!hostAllowed()) {
       refuseHost();
@@ -258,6 +264,9 @@ export const createRelayService = ({
           const next = await readConfig();
           await start(next.relayUrl);
         }
+      } else if (config.enabled && !isDesktopRelayHostRuntime()) {
+        // Sticky opt-in on ssh-remote (and any future non-desktop host runtime).
+        if (!hostClient) await start(config.relayUrl);
       } else {
         if (config.enabled) await writeConfig({ enabled: false, relayUrl: config.relayUrl });
         stop();
@@ -270,8 +279,8 @@ export const createRelayService = ({
   // Stable server identity (base64url SHA-256 of the canonical public signing
   // JWK). Derived from a public key, so it is not a secret; clients use it to
   // verify that a learned/probed address belongs to this server before trusting
-  // it. Independent of whether the relay host is currently enabled. Off
-  // desktop this is null — minting identity is a desktop-host concern.
+  // it. Independent of whether the relay host is currently enabled. Off a host
+  // runtime this is null — minting identity is a desktop / ssh-remote concern.
   const getServerId = async () => {
     if (!hostAllowed()) return null;
     const identity = await identityRuntime.getRelayIdentity();
@@ -299,6 +308,9 @@ export const createRelayService = ({
       // another local process owns the machine's relay host claim.
       state: hostClient ? live.state : (status.state === 'standby' ? 'standby' : 'disabled'),
       serverId: identity.serverId,
+      // Public E2EE trust anchor. Desktop SSH attach uses this to persist a
+      // multi-transport host (local-forward + relay) without a pairing round-trip.
+      hostEncPubJwk: identity.hostEncPubJwk,
       connectedClients: live.connectedClients,
       relayUrl: config.relayUrl,
       relayUrlLocked: config.relayUrlLocked,

package/server/lib/relay/service.test.js

@@ -34,6 +34,7 @@ vi.mock('./host-client.js', () => ({
 import {
   createRelayService,
   DEFAULT_RELAY_URL,
+  isRelayHostRuntime,
   RELAY_HOST_DESKTOP_ONLY_MESSAGE,
 } from './service.js';
 
@@ -143,14 +144,14 @@ describe('relay service pairing endpoint', () => {
   });
 });
 
-describe('relay host desktop-only gate', () => {
+describe('relay host runtime gate', () => {
   afterEach(() => {
     relayMocks.starts.length = 0;
     relayMocks.stops.length = 0;
     relayMocks.identityReads = 0;
   });
 
-  it('does not start a host, claim, mint identity, or rewrite settings when reconcile runs off desktop', async () => {
+  it('does not start a host, claim, mint identity, or rewrite settings when reconcile runs off host runtime', async () => {
     const write = vi.fn(async (next) => next);
     const { service, settings } = createTestRelayService({
       canHostRelay: false,
@@ -175,7 +176,16 @@ describe('relay host desktop-only gate', () => {
     expect(relayMocks.identityReads).toBe(0);
   });
 
-  it('refuses relay pairing and enable off desktop', async () => {
+  it('includes the public E2EE trust anchor on host-capable status', async () => {
+    const { service } = createTestRelayService();
+    await expect(service.getStatus()).resolves.toMatchObject({
+      hostAllowed: true,
+      serverId: 'server-test',
+      hostEncPubJwk: { kty: 'EC', crv: 'P-256', x: 'x', y: 'y' },
+    });
+  });
+
+  it('refuses relay pairing and enable off host runtime', async () => {
     const { service, settings } = createTestRelayService({ canHostRelay: false });
     const app = express();
     service.registerRoutes(app);
@@ -204,6 +214,27 @@ describe('relay host desktop-only gate', () => {
     const previous = process.env.OPENCHAMBER_RUNTIME;
     process.env.OPENCHAMBER_RUNTIME = 'desktop';
     try {
+      expect(isRelayHostRuntime()).toBe(true);
+      const settings = createSettingsHarness();
+      const service = createRelayService({
+        crypto: {},
+        readSettingsFromDiskMigrated: settings.read,
+        writeSettingsToDisk: settings.write,
+        getLocalPort: () => 3000,
+      });
+      await service.ensureEnabledForPairing();
+      expect(relayMocks.starts).toEqual([DEFAULT_RELAY_URL]);
+    } finally {
+      if (previous === undefined) delete process.env.OPENCHAMBER_RUNTIME;
+      else process.env.OPENCHAMBER_RUNTIME = previous;
+    }
+  });
+
+  it('defaults canHostRelay from OPENCHAMBER_RUNTIME=ssh-remote', async () => {
+    const previous = process.env.OPENCHAMBER_RUNTIME;
+    process.env.OPENCHAMBER_RUNTIME = 'ssh-remote';
+    try {
+      expect(isRelayHostRuntime()).toBe(true);
       const settings = createSettingsHarness();
       const service = createRelayService({
         crypto: {},
@@ -219,10 +250,39 @@ describe('relay host desktop-only gate', () => {
     }
   });
 
-  it('defaults canHostRelay to false when OPENCHAMBER_RUNTIME is not desktop', async () => {
+  it('keeps an ssh-remote opt-in host running when demand is absent', async () => {
+    const previous = process.env.OPENCHAMBER_RUNTIME;
+    process.env.OPENCHAMBER_RUNTIME = 'ssh-remote';
+    try {
+      const settings = createSettingsHarness();
+      await settings.write({
+        privateRelay: { enabled: true, relayUrl: DEFAULT_RELAY_URL },
+      });
+      const service = createRelayService({
+        crypto: {},
+        readSettingsFromDiskMigrated: settings.read,
+        writeSettingsToDisk: settings.write,
+        getLocalPort: () => 3000,
+        hasRelayDemand: async () => false,
+      });
+
+      await service.reconcile();
+
+      expect(relayMocks.starts).toEqual([DEFAULT_RELAY_URL]);
+      expect(settings.current()).toMatchObject({
+        privateRelay: { enabled: true, relayUrl: DEFAULT_RELAY_URL },
+      });
+    } finally {
+      if (previous === undefined) delete process.env.OPENCHAMBER_RUNTIME;
+      else process.env.OPENCHAMBER_RUNTIME = previous;
+    }
+  });
+
+  it('defaults canHostRelay to false when OPENCHAMBER_RUNTIME is not a host runtime', async () => {
     const previous = process.env.OPENCHAMBER_RUNTIME;
     delete process.env.OPENCHAMBER_RUNTIME;
     try {
+      expect(isRelayHostRuntime()).toBe(false);
       const settings = createSettingsHarness();
       const service = createRelayService({
         crypto: {},

package/server/lib/relay/tunnel-host.js

@@ -35,14 +35,9 @@ const ALLOWED_WS_PATHS = new Set([
   '/api/dictation/ws',
 ]);
 
-// Client-selected SSH local-forward target (decimal port string). Valid only
-// when present in the injected routing table; never falls back to default port.
-const TARGET_PORT_HEADER = 'x-openchamber-target-port';
-
 // Hop-by-hop headers stripped from tunneled requests; `host` is set by fetch
 // to the loopback origin. content-length is dropped too because the body is
 // re-chunked through the tunnel and undici computes framing itself.
-// Target-port is host-routing metadata and must not reach the loopback origin.
 const STRIPPED_REQUEST_HEADERS = new Set([
   'connection',
   'keep-alive',
@@ -50,7 +45,6 @@ const STRIPPED_REQUEST_HEADERS = new Set([
   'upgrade',
   'host',
   'content-length',
-  TARGET_PORT_HEADER,
 ]);
 
 // Response framing headers that no longer apply once the body crosses the
@@ -86,40 +80,10 @@ const isWsOpenPayload = (parsed) =>
 
 const isWsClosePayload = (parsed) => Boolean(parsed && typeof parsed === 'object');
 
-const readHeaderValue = (headers, name) => {
-  if (!headers || typeof headers !== 'object') return undefined;
-  const want = name.toLowerCase();
-  for (const [key, value] of Object.entries(headers)) {
-    if (typeof key === 'string' && key.toLowerCase() === want) return value;
-  }
-  return undefined;
-};
-
-/**
- * Resolve loopback dial port from optional x-openchamber-target-port.
- * No header → defaultPort. Header present → only a routingTable hit is accepted;
- * miss/invalid returns null (caller must not fall back to defaultPort).
- * @param {Record<string, string> | undefined} requestHeaders
- * @param {number} defaultPort
- * @param {() => { id?: string, localPort?: number }[]} getSshRoutingTable
- * @returns {number | null}
- */
-export const resolveTargetPort = (requestHeaders, defaultPort, getSshRoutingTable) => {
-  const raw = readHeaderValue(requestHeaders, TARGET_PORT_HEADER);
-  if (raw === undefined || raw === null || raw === '') return defaultPort;
-  const parsed = typeof raw === 'number' ? raw : Number.parseInt(String(raw).trim(), 10);
-  if (!Number.isFinite(parsed) || parsed <= 0 || parsed > 65535) return null;
-  const table = typeof getSshRoutingTable === 'function' ? getSshRoutingTable() : [];
-  if (!Array.isArray(table)) return null;
-  const hit = table.some((entry) => Number(entry?.localPort) === parsed);
-  return hit ? parsed : null;
-};
-
 /**
  * @param {{
  *   connectionId: string,
  *   getLocalPort: () => number,
- *   getSshRoutingTable?: () => { id: string, localPort: number }[],
  *   sendFrame: (plaintextFrame: Uint8Array) => void | Promise<void>,
  *   getBufferedAmount: () => number,
  *   createWebSocket?: (url: string, protocols: string[] | undefined, options: { headers: Record<string, string> }) => import('ws').WebSocket,
@@ -128,7 +92,6 @@ export const resolveTargetPort = (requestHeaders, defaultPort, getSshRoutingTabl
 export const createTunnelHost = ({
   connectionId,
   getLocalPort,
-  getSshRoutingTable = () => [],
   sendFrame,
   getBufferedAmount,
   createWebSocket = (url, protocols, options) => new WebSocket(url, protocols, options),
@@ -235,13 +198,7 @@ export const createTunnelHost = ({
     const stream = streams.get(streamId);
     if (!stream || stream.kind !== 'http') return;
 
-    const targetPort = resolveTargetPort(request.headers, getLocalPort(), getSshRoutingTable);
-    if (targetPort === null) {
-      dropStream(streamId);
-      await syntheticResponse(streamId, 503, 'ssh-host-unreachable');
-      return;
-    }
-
+    const targetPort = getLocalPort();
     const hasBody = method !== 'GET' && method !== 'HEAD';
     let requestBody;
     if (hasBody) {
@@ -368,14 +325,7 @@ export const createTunnelHost = ({
       return;
     }
 
-    // Optional headers on WsOpen carry routing metadata (e.g. target-port).
-    // Same resolve rules as HTTP; miss refuses without falling back to default.
-    const targetPort = resolveTargetPort(open.headers, getLocalPort(), getSshRoutingTable);
-    if (targetPort === null) {
-      void sendAbort(streamId, 'ssh-host-unreachable');
-      return;
-    }
-
+    const targetPort = getLocalPort();
     const url = `ws://127.0.0.1:${targetPort}${open.path}${open.query ? `?${open.query}` : ''}`;
     // Present the loopback origin we're actually dialing. The server derives this
     // as a trusted same-origin candidate from the Host header (127.0.0.1:<port>),

package/server/lib/relay/tunnel-host.test.js

@@ -7,18 +7,17 @@
 // corrupted payload. This test must stay red until send serialization is fixed.
 // Production send path is intentionally not changed here.
 
-import { afterEach, describe, expect, it } from 'bun:test';
+import { describe, expect, it } from 'bun:test';
 
 import {
   MAX_TUNNEL_PAYLOAD_BYTES,
   TunnelFrameType,
   createFragmentAssembler,
-  decodeJsonPayload,
   decodeTunnelFrame,
   encodeJsonPayload,
   encodeTunnelFrame,
 } from './tunnel-codec.js';
-import { createTunnelHost, resolveTargetPort } from './tunnel-host.js';
+import { createTunnelHost } from './tunnel-host.js';
 
 const textEncoder = new TextEncoder();
 const textDecoder = new TextDecoder();
@@ -224,250 +223,3 @@ describe('createTunnelHost WS fragment ordering', () => {
     }
   });
 });
-
-const collectHttpExchange = async (outbound, streamId) => {
-  await waitFor(() => outbound.some((frame) => {
-    const decoded = decodeTunnelFrame(frame);
-    return decoded.streamId === streamId
-      && (decoded.frameType === TunnelFrameType.StreamEnd
-        || decoded.frameType === TunnelFrameType.StreamAbort);
-  }));
-  let status = null;
-  /** @type {Uint8Array[]} */
-  const bodyChunks = [];
-  for (const raw of outbound) {
-    const frame = decodeTunnelFrame(raw);
-    if (frame.streamId !== streamId) continue;
-    if (frame.frameType === TunnelFrameType.HttpResponse) {
-      status = decodeJsonPayload(frame.payload, (v) => v && typeof v.status === 'number').status;
-    } else if (frame.frameType === TunnelFrameType.HttpBody) {
-      bodyChunks.push(frame.payload);
-    }
-  }
-  let body = null;
-  if (bodyChunks.length > 0) {
-    const total = bodyChunks.reduce((n, c) => n + c.length, 0);
-    const merged = new Uint8Array(total);
-    let off = 0;
-    for (const c of bodyChunks) {
-      merged.set(c, off);
-      off += c.length;
-    }
-    body = JSON.parse(textDecoder.decode(merged));
-  }
-  return { status, body };
-};
-
-describe('createTunnelHost SSH target-port routing', () => {
-  /** @type {typeof globalThis.fetch | undefined} */
-  let originalFetch;
-
-  afterEach(() => {
-    if (originalFetch) {
-      globalThis.fetch = originalFetch;
-      originalFetch = undefined;
-    }
-  });
-
-  const installFetchProbe = () => {
-    /** @type {{ url: string, headers: Record<string, string> }[]} */
-    const calls = [];
-    originalFetch = globalThis.fetch;
-    globalThis.fetch = async (url, init) => {
-      calls.push({
-        url: String(url),
-        headers: { ...(init?.headers || {}) },
-      });
-      return new Response(JSON.stringify({ ok: true }), {
-        status: 200,
-        headers: { 'content-type': 'application/json' },
-      });
-    };
-    return calls;
-  };
-
-  it('dials the routing-table port when x-openchamber-target-port is allowed', async () => {
-    const fetchCalls = installFetchProbe();
-    /** @type {Uint8Array[]} */
-    const outbound = [];
-    const host = createTunnelHost({
-      connectionId: 'test-conn',
-      getLocalPort: () => 3000,
-      getSshRoutingTable: () => [{ id: 'ssh-1', localPort: 41234 }],
-      sendFrame: (frame) => { outbound.push(frame); },
-      getBufferedAmount: () => 0,
-    });
-
-    const streamId = 11;
-    await host.handleFrame(encodeTunnelFrame(
-      TunnelFrameType.HttpRequest,
-      streamId,
-      encodeJsonPayload({
-        method: 'GET',
-        path: '/health',
-        query: '',
-        headers: { 'x-openchamber-target-port': '41234', accept: 'application/json' },
-      }),
-    ));
-
-    const exchange = await collectHttpExchange(outbound, streamId);
-    expect(exchange.status).toBe(200);
-    expect(fetchCalls).toHaveLength(1);
-    expect(fetchCalls[0].url).toBe('http://127.0.0.1:41234/health');
-    host.close();
-  });
-
-  it('returns 503 and does not fall back when target-port is unknown', async () => {
-    const fetchCalls = installFetchProbe();
-    /** @type {Uint8Array[]} */
-    const outbound = [];
-    const host = createTunnelHost({
-      connectionId: 'test-conn',
-      getLocalPort: () => 3000,
-      getSshRoutingTable: () => [{ id: 'ssh-1', localPort: 41234 }],
-      sendFrame: (frame) => { outbound.push(frame); },
-      getBufferedAmount: () => 0,
-    });
-
-    const streamId = 12;
-    await host.handleFrame(encodeTunnelFrame(
-      TunnelFrameType.HttpRequest,
-      streamId,
-      encodeJsonPayload({
-        method: 'GET',
-        path: '/health',
-        query: '',
-        headers: { 'x-openchamber-target-port': '9999' },
-      }),
-    ));
-
-    const exchange = await collectHttpExchange(outbound, streamId);
-    expect(exchange.status).toBe(503);
-    expect(exchange.body?.error).toBe('ssh-host-unreachable');
-    expect(fetchCalls).toHaveLength(0);
-    host.close();
-  });
-
-  it('strips x-openchamber-target-port before forwarding to loopback', async () => {
-    const fetchCalls = installFetchProbe();
-    /** @type {Uint8Array[]} */
-    const outbound = [];
-    const host = createTunnelHost({
-      connectionId: 'test-conn',
-      getLocalPort: () => 3000,
-      getSshRoutingTable: () => [{ id: 'ssh-1', localPort: 41234 }],
-      sendFrame: (frame) => { outbound.push(frame); },
-      getBufferedAmount: () => 0,
-    });
-
-    const streamId = 13;
-    await host.handleFrame(encodeTunnelFrame(
-      TunnelFrameType.HttpRequest,
-      streamId,
-      encodeJsonPayload({
-        method: 'GET',
-        path: '/api/version',
-        query: '',
-        headers: {
-          'x-openchamber-target-port': '41234',
-          authorization: 'Bearer client-token',
-        },
-      }),
-    ));
-
-    await collectHttpExchange(outbound, streamId);
-    expect(fetchCalls).toHaveLength(1);
-    expect(fetchCalls[0].headers['x-openchamber-target-port']).toBeUndefined();
-    expect(fetchCalls[0].headers.authorization).toBe('Bearer client-token');
-    expect(fetchCalls[0].headers['x-openchamber-relay-connection']).toBe('test-conn');
-    host.close();
-  });
-
-  it('dials the default local port when target-port header is absent', async () => {
-    const fetchCalls = installFetchProbe();
-    /** @type {Uint8Array[]} */
-    const outbound = [];
-    const host = createTunnelHost({
-      connectionId: 'test-conn',
-      getLocalPort: () => 3000,
-      getSshRoutingTable: () => [{ id: 'ssh-1', localPort: 41234 }],
-      sendFrame: (frame) => { outbound.push(frame); },
-      getBufferedAmount: () => 0,
-    });
-
-    const streamId = 14;
-    await host.handleFrame(encodeTunnelFrame(
-      TunnelFrameType.HttpRequest,
-      streamId,
-      encodeJsonPayload({
-        method: 'GET',
-        path: '/health',
-        query: '',
-        headers: { accept: 'application/json' },
-      }),
-    ));
-
-    await collectHttpExchange(outbound, streamId);
-    expect(fetchCalls).toHaveLength(1);
-    expect(fetchCalls[0].url).toBe('http://127.0.0.1:3000/health');
-    host.close();
-  });
-
-  it('WS open dials routing-table port and aborts on miss without fallback', async () => {
-    FakeWebSocket.reset();
-    /** @type {Uint8Array[]} */
-    const outbound = [];
-    const host = createTunnelHost({
-      connectionId: 'test-conn',
-      getLocalPort: () => 3000,
-      getSshRoutingTable: () => [{ id: 'ssh-1', localPort: 41234 }],
-      sendFrame: (frame) => { outbound.push(frame); },
-      getBufferedAmount: () => 0,
-      createWebSocket: (url, protocols) => new FakeWebSocket(url, protocols),
-    });
-
-    await host.handleFrame(encodeTunnelFrame(
-      TunnelFrameType.WsOpen,
-      21,
-      encodeJsonPayload({
-        path: '/api/event/ws',
-        query: '',
-        headers: { 'x-openchamber-target-port': '41234' },
-      }),
-    ));
-    expect(FakeWebSocket.instances).toHaveLength(1);
-    expect(FakeWebSocket.instances[0].url).toBe('ws://127.0.0.1:41234/api/event/ws');
-
-    await host.handleFrame(encodeTunnelFrame(
-      TunnelFrameType.WsOpen,
-      22,
-      encodeJsonPayload({
-        path: '/api/event/ws',
-        query: '',
-        headers: { 'x-openchamber-target-port': '9999' },
-      }),
-    ));
-    // Miss must not open another socket (no fallback to 3000).
-    expect(FakeWebSocket.instances).toHaveLength(1);
-    await waitFor(() => outbound.some((frame) => {
-      const decoded = decodeTunnelFrame(frame);
-      return decoded.streamId === 22 && decoded.frameType === TunnelFrameType.StreamAbort;
-    }));
-    const abort = outbound
-      .map((frame) => decodeTunnelFrame(frame))
-      .find((frame) => frame.streamId === 22 && frame.frameType === TunnelFrameType.StreamAbort);
-    expect(decodeJsonPayload(abort.payload, () => true).reason).toBe('ssh-host-unreachable');
-    host.close();
-  });
-});
-
-describe('resolveTargetPort', () => {
-  it('returns default when header is absent and null on table miss', () => {
-    const table = () => [{ id: 'ssh-1', localPort: 41234 }];
-    expect(resolveTargetPort({}, 3000, table)).toBe(3000);
-    expect(resolveTargetPort({ 'x-openchamber-target-port': '41234' }, 3000, table)).toBe(41234);
-    expect(resolveTargetPort({ 'X-OpenChamber-Target-Port': '41234' }, 3000, table)).toBe(41234);
-    expect(resolveTargetPort({ 'x-openchamber-target-port': '9999' }, 3000, table)).toBeNull();
-    expect(resolveTargetPort({ 'x-openchamber-target-port': 'not-a-port' }, 3000, table)).toBeNull();
-  });
-});