@openchambery/web 1.18.4-beta.2 → 1.18.4-beta.20

package/server/lib/opencode/bootstrap-runtime.js

@@ -62,9 +62,6 @@ export const createBootstrapRuntime = (dependencies) => {
       sessionIndexService,
       sessionIndexSyncRuntime,
       transcriptCacheService,
-      getSshRoutingTable,
-      mintSshHostToken,
-      getPairingSession,
     } = options;
 
     const uiAuthController = createUiAuth({
@@ -154,9 +151,6 @@ export const createBootstrapRuntime = (dependencies) => {
       sessionIndexService,
       sessionIndexSyncRuntime,
       transcriptCacheService,
-      getSshRoutingTable,
-      mintSshHostToken,
-      getPairingSession,
       express,
     });
 

package/server/lib/opencode/cli-entry-runtime.js

@@ -17,7 +17,11 @@ export const runCliEntryIfMain = (dependencies) => {
   // OPENCHAMBER_RUNTIME=desktop from the parent shell — that would open a relay
   // host-control socket from `bun run dev` / `dev:server`. Electron sets desktop
   // before importing this module and never takes this CLI path.
-  process.env.OPENCHAMBER_RUNTIME = 'web';
+  // SSH-manager remotes set OPENCHAMBER_RUNTIME=ssh-remote (and may pass
+  // --relay-host); preserve that so the remote can host a private relay.
+  if (process.env.OPENCHAMBER_RUNTIME !== 'ssh-remote') {
+    process.env.OPENCHAMBER_RUNTIME = 'web';
+  }
 
   const cliOptions = parseServeCliOptions({
     argv: process.argv.slice(2),

package/server/lib/opencode/cli-entry-runtime.test.js

@@ -26,6 +26,23 @@ describe('cli-entry-runtime', () => {
     expect(startServer).toHaveBeenCalledTimes(1);
   });
 
+  it('preserves OPENCHAMBER_RUNTIME=ssh-remote on the direct node server path', () => {
+    process.env.OPENCHAMBER_RUNTIME = 'ssh-remote';
+    const startServer = vi.fn(async () => {});
+
+    runCliEntryIfMain({
+      process: { argv: ['node', '/tmp/server/index.js', '--port', '3001'], env: process.env, exit: vi.fn() },
+      currentFilename: '/tmp/server/index.js',
+      parseServeCliOptions: () => ({ port: 3001, host: undefined, uiPassword: null, apiOnly: false }),
+      defaultPort: 3001,
+      setExitOnShutdown: vi.fn(),
+      startServer,
+    });
+
+    expect(process.env.OPENCHAMBER_RUNTIME).toBe('ssh-remote');
+    expect(startServer).toHaveBeenCalledTimes(1);
+  });
+
   it('does not rewrite OPENCHAMBER_RUNTIME when imported as a library (Electron in-process)', () => {
     process.env.OPENCHAMBER_RUNTIME = 'desktop';
 

package/server/lib/opencode/core-routes.js

@@ -871,9 +871,6 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
         allowedClientKinds: req.body?.allowedClientKinds,
         createdByClientId: clientIdFromAuthContext(authContext),
         usesRelay,
-        // Optional SSH instance id: binds mobile ssh-host-token mint to this
-        // pairing after redeem. Does not affect redeem itself.
-        sshHostId: req.body?.sshHostId,
       });
       void reconcileRelay();
       res.setHeader('Cache-Control', 'no-store');

package/server/lib/opencode/core-routes.test.js

@@ -774,24 +774,9 @@ describe('core-routes', () => {
       allowedClientKinds: ['mobile'],
       createdByClientId: null,
       usesRelay: false,
-      sshHostId: undefined,
     });
   });
 
-  it('forwards optional sshHostId into createPairingSession', async () => {
-    const { app, dependencies } = createPairingRouteApp();
-
-    await request(app)
-      .post('/api/client-auth/pairing/sessions')
-      .set('Host', 'runtime.example')
-      .send({ label: 'SSH phone', allowedClientKinds: ['mobile'], sshHostId: 'ssh-1', includeRelay: true })
-      .expect(201);
-
-    expect(dependencies.clientPairingRuntime.createPairingSession).toHaveBeenCalledWith(
-      expect.objectContaining({ sshHostId: 'ssh-1' }),
-    );
-  });
-
   it('advertises the caller-supplied serverUrl as the direct candidate over the request origin', async () => {
     const { app } = createPairingRouteApp();
 

package/server/lib/opencode/openchamber-routes.js

@@ -1,6 +1,5 @@
 import { registerSessionIndexRoutes } from '../session-index/routes.js';
 import { registerTranscriptCacheRoutes } from '../transcript-cache/routes.js';
-import { registerDesktopHostRoutes } from '../desktop-hosts/routes.js';
 import { registerConfigSyncRoutes } from '../config-sync/routes.js';
 
 export const registerOpenChamberRoutes = (app, dependencies) => {
@@ -18,21 +17,11 @@ export const registerOpenChamberRoutes = (app, dependencies) => {
     sessionIndexService,
     sessionIndexSyncRuntime,
     transcriptCacheService,
-    getSshRoutingTable,
-    mintSshHostToken,
-    getPairingSession,
     express,
   } = dependencies;
 
   registerSessionIndexRoutes(app, { sessionIndexService, sessionIndexSyncRuntime });
   registerTranscriptCacheRoutes(app, { transcriptCacheService });
-  registerDesktopHostRoutes(app, {
-    readSettingsFromDiskMigrated,
-    getSshRoutingTable,
-    mintSshHostToken,
-    getPairingSession,
-    express,
-  });
   registerConfigSyncRoutes(app, {
     readSettingsFromDiskMigrated,
     persistSettings,

package/server/lib/relay/DOCUMENTATION.md

@@ -6,7 +6,7 @@ The private relay lets an OpenChamber client (mobile app, browser, or another de
 
 Traffic is **end-to-end encrypted between the two endpoints** (client and host instance). The relay infrastructure forwards opaque ciphertext and cannot read application traffic — it is an untrusted transport, not a trusted middlebox.
 
-This module (`packages/web/server/lib/relay/`) is the **Host side** of the private relay. **Only the Electron desktop runtime may act as a relay host** (`OPENCHAMBER_RUNTIME=desktop`, set by Electron before it starts the in-process web server). Plain `node` / `dev:web:hmr` / CLI / VS Code web servers must not open the host-control socket, claim `relay-host.lock`, or advertise a host pairing candidate — even when they share the same data dir as desktop. Those processes may still run the API that *clients* use; mobile and other desktops remain **relay clients**. The **Client side** lives in `packages/ui/src/lib/relay/`. Hosted Relay instances may run in a Worker. The self-hosted **Relay server** belongs to `packages/relay-server/` and brokers Layer 1 connections.
+This module (`packages/web/server/lib/relay/`) is the **Host side** of the private relay. **Only the Electron desktop runtime or an SSH-managed remote server may act as a relay host** (`OPENCHAMBER_RUNTIME=desktop` or `ssh-remote`). Electron sets `desktop` before it starts the in-process web server; SSH manager sets `ssh-remote` when launching a managed remote `openchamber serve` (optionally with `--relay-host`). Plain `node` / `dev:web:hmr` / ordinary CLI / VS Code web servers must not open the host-control socket, claim `relay-host.lock`, or advertise a host pairing candidate — even when they share the same data dir as desktop. Those processes may still run the API that *clients* use; mobile and other desktops remain **relay clients**. The **Client side** lives in `packages/ui/src/lib/relay/`. Hosted Relay instances may run in a Worker. The self-hosted **Relay server** belongs to `packages/relay-server/` and brokers Layer 1 connections.
 
 ## The three layers
 
@@ -19,7 +19,7 @@ Traffic is modeled as three stacked layers. The relay understands only Layer 1;
 ## Entrypoints and structure
 
 Host side (`packages/web/server/lib/relay/`):
-- `service.js` — thin entrypoint: relay config (enabled flag + relay URL), the management routes (`GET/POST /api/openchamber/relay/{status,enable,disable}`), a `getPairingCandidate()` accessor (the relay transport candidate folded into pairing-v2 links when enabled, consumed by the pairing-session route in `core-routes.js`), and lifecycle wiring. Host lifecycle is gated to Electron: non-desktop runtimes (`bun run dev`, `dev:web:hmr`, CLI `serve`, VS Code, plain `node server`) report `state: 'unavailable'`, refuse `/relay/enable`, `/relay/disable`, and relay pairing with 403, never mint a relay identity, never advertise `relayAvailable`, and never call `startRelayHost`. Direct `node server/index.js` forces `OPENCHAMBER_RUNTIME=web` so a leftover desktop env cannot open the host-control socket. On desktop, started from `packages/web/server/index.js` only when demand/opt-in enables the relay. The relay endpoint defaults to the OpenChamber-hosted relay but can be pinned to a self-hosted relay via the `OPENCHAMBER_RELAY_URL` env var; when set it overrides the stored setting for the host connection, the pairing candidate, and status, so paired clients inherit the endpoint automatically. Endpoint identity is scheme/host/path only: accepted schemes are `ws://` and `wss://`; URLs with userinfo are rejected (no silent default fallback); query and fragment are stripped before persistence and pairing candidates. Custom endpoint persistence and Host control-connection switching are explicit authenticated management actions. Pairing creation with `relayUrl` requires an owner UI session or the local `desktop-local` shell client; `/relay/enable` follows its API auth gate.
+- `service.js` — thin entrypoint: relay config (enabled flag + relay URL), the management routes (`GET/POST /api/openchamber/relay/{status,enable,disable}`), a `getPairingCandidate()` accessor (the relay transport candidate folded into pairing-v2 links when enabled, consumed by the pairing-session route in `core-routes.js`), and lifecycle wiring. Host lifecycle is gated by `isRelayHostRuntime()` (`desktop` or `ssh-remote`): other runtimes (`bun run dev`, `dev:web:hmr`, ordinary CLI `serve`, VS Code, plain `node server`) report `state: 'unavailable'`, refuse `/relay/enable`, `/relay/disable`, and relay pairing with 403, never mint a relay identity, never advertise `relayAvailable`, and never call `startRelayHost`. Direct `node server/index.js` forces `OPENCHAMBER_RUNTIME=web` unless it is already `ssh-remote`, so a leftover desktop env cannot open the host-control socket. On host runtimes, started from `packages/web/server/index.js` when demand/opt-in enables the relay. Desktop auto-clears `privateRelay.enabled` when demand drops; `ssh-remote` keeps an explicit opt-in (e.g. `openchamber serve --relay-host`) sticky until disabled. The relay endpoint defaults to the OpenChamber-hosted relay but can be pinned to a self-hosted relay via the `OPENCHAMBER_RELAY_URL` env var; when set it overrides the stored setting for the host connection, the pairing candidate, and status, so paired clients inherit the endpoint automatically. Endpoint identity is scheme/host/path only: accepted schemes are `ws://` and `wss://`; URLs with userinfo are rejected (no silent default fallback); query and fragment are stripped before persistence and pairing candidates. Custom endpoint persistence and Host control-connection switching are explicit authenticated management actions. Pairing creation with `relayUrl` requires an owner UI session or the local `desktop-local` shell client; `/relay/enable` follows its API auth gate.
 - `identity.js` — the host's stable identity: the long-lived signing keypair (shared with the push relay, defines the routing id) plus a long-lived encryption keypair (the E2EE trust anchor). Reused across restarts; never rotated implicitly.
 - `signing-key.js` — storage/derivation of the signing keypair and the routing id, shared with the notifications runtime.
 - `host-client.js` — the long-lived connection manager: one outbound control connection to the relay, a per-client data connection for each connected device, reconnect/backoff, and the E2EE responder handshake per connection.
@@ -104,48 +104,6 @@ Relay mode plugs into the existing client transport layer rather than a parallel
 
 Catalog loaders (`loadProviders` / `loadAgents`) and assistant Query keys gate writes/caches on the **transport fingerprint**, not `runtimeKey`. On endpoint reset and same-device transport switch, `runtimeEndpointReset.ts` must set `useConfigStore.catalogTransportIdentity` to `getRuntimeTransportIdentity()`. Writing `detail.runtimeKey` there silently discards provider/agent catalog refreshes under Relay, which then hides capability-gated surfaces such as Assistants.
 
-## SSH host routing
-
-Mobile (and other relay clients) can reach a desktop's **SSH-forwarded remote OpenChamber instances** through the same private-relay tunnel that already reaches the desktop's local loopback origin. Routing is host-side only: the client selects a target local-forward port; the tunnel dispatcher dials that port on `127.0.0.1` when — and only when — it is present in the live SSH routing table.
-
-### Header contract
-
-- Header name: `x-openchamber-target-port`
-- Value: decimal port number string (e.g. `"41234"`)
-- HTTP: carried on the tunneled request headers
-- WebSocket: optional `headers` field on the `WsOpen` payload (same header name/value)
-- The dispatcher **strips** this header before forwarding to loopback (it is routing metadata, not an upstream header)
-
-### Resolution rules (`resolveTargetPort` in `tunnel-host.js`)
-
-| Condition | Result |
-|---|---|
-| Header absent | Dial `getLocalPort()` (desktop local origin) — unchanged default behavior |
-| Header present and `localPort` is in `getSshRoutingTable()` | Dial that port |
-| Header present but port missing/invalid/not in table | **Do not** fall back to the default port |
-
-HTTP miss → synthetic **503** with body `{ error: 'ssh-host-unreachable', …, source: 'relay-tunnel-host' }`.  
-WS miss → stream abort with reason `ssh-host-unreachable`.
-
-### Routing table (authoritative in memory)
-
-- Electron injects `getSshRoutingTable: () => sshManager.getRoutingTable()` into `startWebUiServer`.
-- Table entries are `{ id, localPort }` for SSH sessions whose status phase is **`ready`** and whose `localPort` is finite.
-- Degraded / connecting / disconnected sessions are absent. Settings.json is **not** the allowlist for dialing — only the live table is.
-- Non-desktop runtimes default to `() => []`.
-
-### Companion HTTP APIs (authenticated `/api` gate)
-
-- `GET /api/openchamber/desktop-hosts` → `{ hosts: [{ id, label, localPort, reachable }] }` for configured SSH instances. `reachable` is true iff the host id is in the routing table. **Never returns `clientToken`.**
-- `POST /api/openchamber/ssh-host-token` body `{ hostId }` → `{ token }` from `settings.json` `desktopHosts[].clientToken` for SSH instance hosts only. Missing / non-SSH / no token → **404**. Response includes `Cache-Control: no-store`.
-
-### Security invariants (do not regress)
-
-- Path allowlists (`isAllowedHttpPath` / `ALLOWED_WS_PATHS`) are **not** relaxed for SSH targets.
-- The dispatcher **never injects credentials**; the client still authenticates with its own bearer / `oc_url_token` against the target instance.
-- Port legitimacy is solely the in-memory routing table, not client-supplied trust and not settings alone.
-- List endpoints must not leak `clientToken`; token mint is a separate authenticated POST.
-
 ## Design invariants (do not regress)
 
 - The relay never sees plaintext application traffic; it sees only routing metadata (routing id, connection identifiers, timestamps, coarse counts).
@@ -154,6 +112,6 @@ WS miss → stream abort with reason `ssh-host-unreachable`.
 - The host dispatcher never injects credentials; the server authenticates each tunneled request.
 - The tunnel is transparent to the app: adding relay support to a feature should not require the feature to know the relay exists — it goes through the shared runtime transport helpers.
 - The two implementations stay byte-compatible and the wire format is versioned/negotiated so mixed client/host app versions degrade gracefully rather than break.
-- SSH target-port routing never falls back to the default local port on a routing-table miss (see "SSH host routing").
+- Tunneled HTTP/WS always dial `getLocalPort()` on loopback; there is no client-selected target-port override on the host dispatcher.
 
 For the operational rules that keep future changes (new WebSocket endpoints, transport refactors, terminal/voice porting) from breaking this, load the `relay-transport` skill.

package/server/lib/relay/host-client.js

@@ -54,14 +54,12 @@ const resolveBatchWindowMs = (option) => {
  *   identity: { serverId: string, hostEncPrivateKey: CryptoKey, signRelayAuth: (role: string, connectionId?: string | null) => { ts: number, sig: string, pk: string } },
  *   localPort?: number,
  *   getLocalPort?: () => number,
- *   getSshRoutingTable?: () => { id: string, localPort: number }[],
  *   onStatus?: (status: { state: string, lastError: string | null, connectedClients: number }) => void,
  *   logger?: Pick<Console, 'warn'>,
  * }} options
  */
-export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, getSshRoutingTable = () => [], onStatus, logger = console, batchWindowMs, batch }) => {
+export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, onStatus, logger = console, batchWindowMs, batch }) => {
   const resolveLocalPort = typeof getLocalPort === 'function' ? getLocalPort : () => localPort;
-  const resolveSshRoutingTable = typeof getSshRoutingTable === 'function' ? getSshRoutingTable : () => [];
   const localBatch = batch !== false;
   const resolvedBatchWindowMs = resolveBatchWindowMs(batchWindowMs);
 
@@ -190,7 +188,6 @@ export const startRelayHost = ({ relayUrl, identity, localPort, getLocalPort, ge
           entry.tunnel = createTunnelHost({
             connectionId,
             getLocalPort: resolveLocalPort,
-            getSshRoutingTable: resolveSshRoutingTable,
             getBufferedAmount: () => socket.bufferedAmount,
             sendFrame: (plaintextFrame) => {
               if (dataSockets.get(connectionId) !== entry || socket.readyState !== WebSocket.OPEN) return;

package/server/lib/relay/service.js

@@ -6,11 +6,11 @@
 // Routes are registered with the other OpenChamber feature routes, before the
 // generic OpenCode proxy, and are covered by the same global UI auth gate.
 //
-// Host gate: only the Electron desktop runtime may run a relay host
-// (OPENCHAMBER_RUNTIME=desktop, set before the in-process web server starts).
-// Plain `node server`, `dev:web:hmr`, VS Code, CLI, and browser clients must
-// never open the host-control socket, mint a relay identity, advertise a host
-// pairing candidate, or probe the relay. They may still be relay *clients*
+// Host gate: only the Electron desktop runtime or an SSH-managed remote server
+// may run a relay host (OPENCHAMBER_RUNTIME=desktop | ssh-remote).
+// Plain `node server`, `dev:web:hmr`, VS Code, ordinary CLI, and browser clients
+// must never open the host-control socket, mint a relay identity, advertise a
+// host pairing candidate, or probe the relay. They may still be relay *clients*
 // when connecting to another host.
 
 import express from 'express';
@@ -21,16 +21,22 @@ import { startRelayHost } from './host-client.js';
 export const DEFAULT_RELAY_URL = 'wss://relay.openchamber.dev/ws';
 
 export const RELAY_HOST_DESKTOP_ONLY_MESSAGE =
-  'Relay host is only available in the OpenChamber desktop app';
+  'Relay host is only available in the OpenChamber desktop app or an SSH-managed remote server';
 
 // Electron main sets this before importing the in-process web server.
 export const isDesktopRelayHostRuntime = (env = process.env) =>
   env?.OPENCHAMBER_RUNTIME === 'desktop';
 
+// Desktop app, or an SSH-manager-started remote (`OPENCHAMBER_RUNTIME=ssh-remote`).
+export const isRelayHostRuntime = (env = process.env) => {
+  const runtime = env?.OPENCHAMBER_RUNTIME;
+  return runtime === 'desktop' || runtime === 'ssh-remote';
+};
+
 // Canonical form: ws(s)://host[:port]/path only. Reject credentials (userinfo)
 // so settings and pairing candidates never store secrets in the endpoint URL.
 // Strip query/fragment so persistence and candidates stay scheme/host/path.
-const canonicalizeRelayUrl = (value) => {
+export const canonicalizeRelayUrl = (value) => {
   if (typeof value !== 'string') return null;
   const trimmed = value.trim();
   if (!trimmed) return null;
@@ -69,7 +75,6 @@ const envRelayUrlOverride = () => {
  *   readSettingsFromDiskMigrated: () => Promise<object>,
  *   writeSettingsToDisk: (settings: object) => Promise<void>,
  *   getLocalPort: () => number,
- *   getSshRoutingTable?: () => { id: string, localPort: number }[],
  *   logger?: Pick<Console, 'warn'>,
  *   canHostRelay?: () => boolean,
  * }} deps
@@ -82,8 +87,6 @@ export const createRelayService = ({
   // regeneration — see identity.js/signing-key.js.
   readSettingsStrict,
   getLocalPort,
-  // Live SSH local-forward ports (Electron). Empty outside desktop.
-  getSshRoutingTable = () => [],
   // Returns true when any paired device or pending pairing session uses the
   // relay transport. The relay lifecycle is driven purely by this demand.
   hasRelayDemand = async () => false,
@@ -92,8 +95,8 @@ export const createRelayService = ({
   // evict each other at the relay worker ("Control replaced") and devices land
   // on a random instance. Optional: without it, behavior is pre-lock.
   hostLock = null,
-  // Host gate: false for non-Electron runtimes (dev server, CLI, VS Code, …).
-  canHostRelay = () => isDesktopRelayHostRuntime(),
+  // Host gate: false for non-host runtimes (dev server, ordinary CLI, VS Code, …).
+  canHostRelay = () => isRelayHostRuntime(),
   logger = console,
 }) => {
   const identityRuntime = createRelayIdentityRuntime({ crypto, readSettingsFromDiskMigrated, writeSettingsToDisk, readSettingsStrict });
@@ -211,7 +214,6 @@ export const createRelayService = ({
       relayUrl,
       identity,
       getLocalPort,
-      getSshRoutingTable,
       logger,
       onStatus: (next) => {
         status = next;
@@ -242,8 +244,12 @@ export const createRelayService = ({
   // Drive the relay lifecycle from demand: run it when a device or pending
   // session uses the relay, stop it when none remain. Called on startup and after
   // pairing/device changes, so the operator never toggles it manually.
-  // Non-desktop runtimes never host: skip entirely so a shared data dir with
+  // Non-host runtimes never host: skip entirely so a shared data dir with
   // Electron is not rewritten or claim-contested by dev/CLI servers.
+  // SSH-managed remotes (`ssh-remote`) may also keep an explicit
+  // `privateRelay.enabled` opt-in (e.g. `openchamber serve --relay-host`) even
+  // when no paired device is present yet — desktop still auto-clears enabled
+  // when demand drops.
   const reconcile = async () => {
     if (!hostAllowed()) {
       refuseHost();
@@ -258,6 +264,9 @@ export const createRelayService = ({
           const next = await readConfig();
           await start(next.relayUrl);
         }
+      } else if (config.enabled && !isDesktopRelayHostRuntime()) {
+        // Sticky opt-in on ssh-remote (and any future non-desktop host runtime).
+        if (!hostClient) await start(config.relayUrl);
       } else {
         if (config.enabled) await writeConfig({ enabled: false, relayUrl: config.relayUrl });
         stop();
@@ -270,8 +279,8 @@ export const createRelayService = ({
   // Stable server identity (base64url SHA-256 of the canonical public signing
   // JWK). Derived from a public key, so it is not a secret; clients use it to
   // verify that a learned/probed address belongs to this server before trusting
-  // it. Independent of whether the relay host is currently enabled. Off
-  // desktop this is null — minting identity is a desktop-host concern.
+  // it. Independent of whether the relay host is currently enabled. Off a host
+  // runtime this is null — minting identity is a desktop / ssh-remote concern.
   const getServerId = async () => {
     if (!hostAllowed()) return null;
     const identity = await identityRuntime.getRelayIdentity();
@@ -299,6 +308,9 @@ export const createRelayService = ({
       // another local process owns the machine's relay host claim.
       state: hostClient ? live.state : (status.state === 'standby' ? 'standby' : 'disabled'),
       serverId: identity.serverId,
+      // Public E2EE trust anchor. Desktop SSH attach uses this to persist a
+      // multi-transport host (local-forward + relay) without a pairing round-trip.
+      hostEncPubJwk: identity.hostEncPubJwk,
       connectedClients: live.connectedClients,
       relayUrl: config.relayUrl,
       relayUrlLocked: config.relayUrlLocked,

package/server/lib/relay/service.test.js

@@ -34,6 +34,7 @@ vi.mock('./host-client.js', () => ({
 import {
   createRelayService,
   DEFAULT_RELAY_URL,
+  isRelayHostRuntime,
   RELAY_HOST_DESKTOP_ONLY_MESSAGE,
 } from './service.js';
 
@@ -143,14 +144,14 @@ describe('relay service pairing endpoint', () => {
   });
 });
 
-describe('relay host desktop-only gate', () => {
+describe('relay host runtime gate', () => {
   afterEach(() => {
     relayMocks.starts.length = 0;
     relayMocks.stops.length = 0;
     relayMocks.identityReads = 0;
   });
 
-  it('does not start a host, claim, mint identity, or rewrite settings when reconcile runs off desktop', async () => {
+  it('does not start a host, claim, mint identity, or rewrite settings when reconcile runs off host runtime', async () => {
     const write = vi.fn(async (next) => next);
     const { service, settings } = createTestRelayService({
       canHostRelay: false,
@@ -175,7 +176,16 @@ describe('relay host desktop-only gate', () => {
     expect(relayMocks.identityReads).toBe(0);
   });
 
-  it('refuses relay pairing and enable off desktop', async () => {
+  it('includes the public E2EE trust anchor on host-capable status', async () => {
+    const { service } = createTestRelayService();
+    await expect(service.getStatus()).resolves.toMatchObject({
+      hostAllowed: true,
+      serverId: 'server-test',
+      hostEncPubJwk: { kty: 'EC', crv: 'P-256', x: 'x', y: 'y' },
+    });
+  });
+
+  it('refuses relay pairing and enable off host runtime', async () => {
     const { service, settings } = createTestRelayService({ canHostRelay: false });
     const app = express();
     service.registerRoutes(app);
@@ -204,6 +214,27 @@ describe('relay host desktop-only gate', () => {
     const previous = process.env.OPENCHAMBER_RUNTIME;
     process.env.OPENCHAMBER_RUNTIME = 'desktop';
     try {
+      expect(isRelayHostRuntime()).toBe(true);
+      const settings = createSettingsHarness();
+      const service = createRelayService({
+        crypto: {},
+        readSettingsFromDiskMigrated: settings.read,
+        writeSettingsToDisk: settings.write,
+        getLocalPort: () => 3000,
+      });
+      await service.ensureEnabledForPairing();
+      expect(relayMocks.starts).toEqual([DEFAULT_RELAY_URL]);
+    } finally {
+      if (previous === undefined) delete process.env.OPENCHAMBER_RUNTIME;
+      else process.env.OPENCHAMBER_RUNTIME = previous;
+    }
+  });
+
+  it('defaults canHostRelay from OPENCHAMBER_RUNTIME=ssh-remote', async () => {
+    const previous = process.env.OPENCHAMBER_RUNTIME;
+    process.env.OPENCHAMBER_RUNTIME = 'ssh-remote';
+    try {
+      expect(isRelayHostRuntime()).toBe(true);
       const settings = createSettingsHarness();
       const service = createRelayService({
         crypto: {},
@@ -219,10 +250,39 @@ describe('relay host desktop-only gate', () => {
     }
   });
 
-  it('defaults canHostRelay to false when OPENCHAMBER_RUNTIME is not desktop', async () => {
+  it('keeps an ssh-remote opt-in host running when demand is absent', async () => {
+    const previous = process.env.OPENCHAMBER_RUNTIME;
+    process.env.OPENCHAMBER_RUNTIME = 'ssh-remote';
+    try {
+      const settings = createSettingsHarness();
+      await settings.write({
+        privateRelay: { enabled: true, relayUrl: DEFAULT_RELAY_URL },
+      });
+      const service = createRelayService({
+        crypto: {},
+        readSettingsFromDiskMigrated: settings.read,
+        writeSettingsToDisk: settings.write,
+        getLocalPort: () => 3000,
+        hasRelayDemand: async () => false,
+      });
+
+      await service.reconcile();
+
+      expect(relayMocks.starts).toEqual([DEFAULT_RELAY_URL]);
+      expect(settings.current()).toMatchObject({
+        privateRelay: { enabled: true, relayUrl: DEFAULT_RELAY_URL },
+      });
+    } finally {
+      if (previous === undefined) delete process.env.OPENCHAMBER_RUNTIME;
+      else process.env.OPENCHAMBER_RUNTIME = previous;
+    }
+  });
+
+  it('defaults canHostRelay to false when OPENCHAMBER_RUNTIME is not a host runtime', async () => {
     const previous = process.env.OPENCHAMBER_RUNTIME;
     delete process.env.OPENCHAMBER_RUNTIME;
     try {
+      expect(isRelayHostRuntime()).toBe(false);
       const settings = createSettingsHarness();
       const service = createRelayService({
         crypto: {},

package/server/lib/relay/tunnel-host.js

@@ -35,14 +35,9 @@ const ALLOWED_WS_PATHS = new Set([
   '/api/dictation/ws',
 ]);
 
-// Client-selected SSH local-forward target (decimal port string). Valid only
-// when present in the injected routing table; never falls back to default port.
-const TARGET_PORT_HEADER = 'x-openchamber-target-port';
-
 // Hop-by-hop headers stripped from tunneled requests; `host` is set by fetch
 // to the loopback origin. content-length is dropped too because the body is
 // re-chunked through the tunnel and undici computes framing itself.
-// Target-port is host-routing metadata and must not reach the loopback origin.
 const STRIPPED_REQUEST_HEADERS = new Set([
   'connection',
   'keep-alive',
@@ -50,7 +45,6 @@ const STRIPPED_REQUEST_HEADERS = new Set([
   'upgrade',
   'host',
   'content-length',
-  TARGET_PORT_HEADER,
 ]);
 
 // Response framing headers that no longer apply once the body crosses the
@@ -86,40 +80,10 @@ const isWsOpenPayload = (parsed) =>
 
 const isWsClosePayload = (parsed) => Boolean(parsed && typeof parsed === 'object');
 
-const readHeaderValue = (headers, name) => {
-  if (!headers || typeof headers !== 'object') return undefined;
-  const want = name.toLowerCase();
-  for (const [key, value] of Object.entries(headers)) {
-    if (typeof key === 'string' && key.toLowerCase() === want) return value;
-  }
-  return undefined;
-};
-
-/**
- * Resolve loopback dial port from optional x-openchamber-target-port.
- * No header → defaultPort. Header present → only a routingTable hit is accepted;
- * miss/invalid returns null (caller must not fall back to defaultPort).
- * @param {Record<string, string> | undefined} requestHeaders
- * @param {number} defaultPort
- * @param {() => { id?: string, localPort?: number }[]} getSshRoutingTable
- * @returns {number | null}
- */
-export const resolveTargetPort = (requestHeaders, defaultPort, getSshRoutingTable) => {
-  const raw = readHeaderValue(requestHeaders, TARGET_PORT_HEADER);
-  if (raw === undefined || raw === null || raw === '') return defaultPort;
-  const parsed = typeof raw === 'number' ? raw : Number.parseInt(String(raw).trim(), 10);
-  if (!Number.isFinite(parsed) || parsed <= 0 || parsed > 65535) return null;
-  const table = typeof getSshRoutingTable === 'function' ? getSshRoutingTable() : [];
-  if (!Array.isArray(table)) return null;
-  const hit = table.some((entry) => Number(entry?.localPort) === parsed);
-  return hit ? parsed : null;
-};
-
 /**
  * @param {{
  *   connectionId: string,
  *   getLocalPort: () => number,
- *   getSshRoutingTable?: () => { id: string, localPort: number }[],
  *   sendFrame: (plaintextFrame: Uint8Array) => void | Promise<void>,
  *   getBufferedAmount: () => number,
  *   createWebSocket?: (url: string, protocols: string[] | undefined, options: { headers: Record<string, string> }) => import('ws').WebSocket,
@@ -128,7 +92,6 @@ export const resolveTargetPort = (requestHeaders, defaultPort, getSshRoutingTabl
 export const createTunnelHost = ({
   connectionId,
   getLocalPort,
-  getSshRoutingTable = () => [],
   sendFrame,
   getBufferedAmount,
   createWebSocket = (url, protocols, options) => new WebSocket(url, protocols, options),
@@ -235,13 +198,7 @@ export const createTunnelHost = ({
     const stream = streams.get(streamId);
     if (!stream || stream.kind !== 'http') return;
 
-    const targetPort = resolveTargetPort(request.headers, getLocalPort(), getSshRoutingTable);
-    if (targetPort === null) {
-      dropStream(streamId);
-      await syntheticResponse(streamId, 503, 'ssh-host-unreachable');
-      return;
-    }
-
+    const targetPort = getLocalPort();
     const hasBody = method !== 'GET' && method !== 'HEAD';
     let requestBody;
     if (hasBody) {
@@ -368,14 +325,7 @@ export const createTunnelHost = ({
       return;
     }
 
-    // Optional headers on WsOpen carry routing metadata (e.g. target-port).
-    // Same resolve rules as HTTP; miss refuses without falling back to default.
-    const targetPort = resolveTargetPort(open.headers, getLocalPort(), getSshRoutingTable);
-    if (targetPort === null) {
-      void sendAbort(streamId, 'ssh-host-unreachable');
-      return;
-    }
-
+    const targetPort = getLocalPort();
     const url = `ws://127.0.0.1:${targetPort}${open.path}${open.query ? `?${open.query}` : ''}`;
     // Present the loopback origin we're actually dialing. The server derives this
     // as a trusted same-origin candidate from the Host header (127.0.0.1:<port>),