npm - @openchambery/web - Versions diffs - 1.18.4-beta.2 → 1.18.4-beta.21 - Mend

@openchambery/web 1.18.4-beta.2 → 1.18.4-beta.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (138) hide show

package/dist/index.html CHANGED Viewed

@@ -552,25 +552,25 @@
         opacity: 0.72;
       }
     </style>
-    <script type="module" crossorigin src="/assets/main-CoNVZvj1.js"></script>
+    <script type="module" crossorigin src="/assets/main-CttsY04u.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-BJpkPwky.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-DzwCfRqr.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DwXJK4-j.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-aA40MHzB.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-CxUYRC6v.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-6sclr7B6.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-Txp4xOVQ.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-C_FSEHKM.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-CXJwZIZe.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-jfes-HIU.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-CbeLpKPk.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BpPeXWIu.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-B9P24SI-.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-DF4hiLrB.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-MkHvmR2Q.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-Yqt5hwRm.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <!-- Keep the startup layer outside #root. React replaces every child of

package/dist/mini-chat.html CHANGED Viewed

@@ -74,25 +74,25 @@
       }
     </style>
-    <script type="module" crossorigin src="/assets/miniChat-CYd1PMdJ.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-CbXvcgmp.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-BJpkPwky.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-DzwCfRqr.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DwXJK4-j.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-aA40MHzB.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-CxUYRC6v.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-6sclr7B6.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-Txp4xOVQ.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-C_FSEHKM.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-CXJwZIZe.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-jfes-HIU.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-CbeLpKPk.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BpPeXWIu.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-B9P24SI-.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-DF4hiLrB.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-MkHvmR2Q.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-Yqt5hwRm.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full">

package/dist/mobile.html CHANGED Viewed

@@ -63,25 +63,25 @@
       })();
     </script>
-    <script type="module" crossorigin src="/assets/mobile-CJkbELE1.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-CXNz8Y5x.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-BJpkPwky.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-DzwCfRqr.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DwXJK4-j.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-aA40MHzB.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-CxUYRC6v.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-6sclr7B6.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-Txp4xOVQ.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-C_FSEHKM.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-CXJwZIZe.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-jfes-HIU.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-CbeLpKPk.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BpPeXWIu.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-B9P24SI-.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-DF4hiLrB.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-MkHvmR2Q.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-Yqt5hwRm.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/web",
-  "version": "1.18.4-beta.2",
+  "version": "1.18.4-beta.21",
   "private": false,
   "type": "module",
   "main": "./server/index.js",

package/server/index.d.ts CHANGED Viewed

@@ -21,10 +21,6 @@ export interface StartWebUiServerOptions {
   transcriptCacheDbPath?: string | null;
   messageQueueDbPath?: string | null;
   messageQueueAttachmentRoot?: string | null;
-  /** Live SSH local-forward ports for relay target-port routing (Electron). */
-  getSshRoutingTable?: () => { id: string; localPort: number }[];
-  /** Mint a stored SSH host clientToken for a ready session (Electron). */
-  mintSshHostToken?: (hostId: string) => Promise<string>;
   /**
    * Optional process-local lock for settings persistence (Electron in-process).
    * When provided, every settings write/migrate joins this exclusive chain so

package/server/index.js CHANGED Viewed

@@ -90,7 +90,7 @@ import { applyRuntimeCorsHeaders } from './lib/request-cors.js';
 import { createClientPairingRuntime } from './lib/client-auth/pairing.js';
 import { createPreviewProxyRuntime } from './lib/preview/proxy-runtime.js';
 import { attachRealtimeProxy } from './lib/realtime-proxy.js';
-import { createRelayService, isDesktopRelayHostRuntime } from './lib/relay/service.js';
+import { createRelayService, isRelayHostRuntime } from './lib/relay/service.js';
 import { createRelayHostLock } from './lib/relay/host-lock.js';
 import { createProxyMiddleware, responseInterceptor } from 'http-proxy-middleware';
 import webPush from 'web-push';
@@ -1184,9 +1184,10 @@ async function main(options = {}) {
       if (h && h !== '127.0.0.1' && h !== 'localhost' && h !== '::1') lanHost = effectiveBindHost;
     }
     const lan = lanHost ? `http://${lanHost.includes(':') ? `[${lanHost}]` : lanHost}:${activePort}` : null;
-    // Only the desktop host may advertise relay. Local `dev` / `web` / CLI
-    // servers must not present "Anywhere" as available or trigger a probe.
-    return { local, lan, relayAvailable: isDesktopRelayHostRuntime() };
+    // Only desktop / SSH-managed remote hosts may advertise relay. Local
+    // `dev` / `web` / ordinary CLI servers must not present "Anywhere" as
+    // available or trigger a probe.
+    return { local, lan, relayAvailable: isRelayHostRuntime() };
   };
   // ALL direct LAN URLs this server is currently reachable on, for the
   // candidates-refresh endpoint: the address the requesting client already
@@ -1248,11 +1249,6 @@ async function main(options = {}) {
   const getDesktopRuntimeConfig = typeof options.getDesktopRuntimeConfig === 'function'
     ? options.getDesktopRuntimeConfig
     : null;
-  // Electron injects live SSH local-forward ports; non-desktop defaults to empty
-  // so relay target-port routing never falls back to an unvalidated port.
-  const getSshRoutingTable = typeof options.getSshRoutingTable === 'function'
-    ? options.getSshRoutingTable
-    : () => [];
   const sessionIndexDbPath = options.sessionIndexDbPath !== undefined
     ? options.sessionIndexDbPath
     : process.env.OPENCHAMBER_SESSION_INDEX_DB_PATH;
@@ -1478,11 +1474,6 @@ async function main(options = {}) {
     sessionIndexService,
     sessionIndexSyncRuntime,
     transcriptCacheService,
-    getSshRoutingTable,
-    mintSshHostToken: typeof options.mintSshHostToken === 'function'
-      ? options.mintSshHostToken
-      : undefined,
-    getPairingSession: (id) => clientPairingRuntime.getPairingSession(id),
   });
   uiAuthController = bootstrapResult.uiAuthController;
   realtimeProxyRuntime = attachRealtimeProxy({
@@ -1506,7 +1497,6 @@ async function main(options = {}) {
     readSettingsStrict: readSettingsFromDiskStrict,
     remoteClientAuthRuntime,
     getLocalPort: () => tunnelRuntimeContext.getActivePort(),
-    getSshRoutingTable,
     // One relay host per machine: every instance sharing this data dir shares
     // the relay identity (serverId), so concurrent hosts evict each other at
     // the relay worker and devices land on a random local instance.
@@ -1644,15 +1634,16 @@ async function main(options = {}) {
     console.warn('[ScheduledTasks] Failed to start runtime:', error?.message || error);
   }
-  // Only Electron (OPENCHAMBER_RUNTIME=desktop) opens a relay host-control
-  // socket or polls relay demand. Local `dev` / `web` never reconcile, so they
-  // cannot inherit a leftover desktop env and start probing the relay.
+  // Only desktop / SSH-managed remotes (OPENCHAMBER_RUNTIME=desktop|ssh-remote)
+  // open a relay host-control socket or poll relay demand. Local `dev` / `web`
+  // never reconcile, so they cannot inherit a leftover desktop env and start
+  // probing the relay.
   let relayReconcileTimer = null;
-  if (isDesktopRelayHostRuntime()) {
+  if (isRelayHostRuntime()) {
     void relayService.reconcile();
     // Relay demand can change outside our routes: pending sessions expire, or a
     // paired device is revoked, without hitting our management routes. Poll so
-    // the desktop host picks demand up (or drops it) within a minute.
+    // the host picks demand up (or drops it) within a minute.
     relayReconcileTimer = setInterval(() => {
       void relayService.reconcile();
     }, 60_000);

package/server/lib/client-auth/pairing.js CHANGED Viewed

@@ -72,9 +72,6 @@ const publicSession = (session) => ({
   allowedClientKinds: session.allowedClientKinds,
   createdByClientId: session.createdByClientId,
   usesRelay: session.usesRelay === true,
-  // Optional SSH instance binding for mobile-over-relay host-token mint.
-  // Null when the pairing is for the desktop local origin (default).
-  sshHostId: session.sshHostId ?? null,
 });
 // A pending session is one that can still be redeemed: not used, not cancelled,
@@ -141,7 +138,6 @@ export const createClientPairingRuntime = ({
           allowedClientKinds: normalizeAllowedClientKinds(session.allowedClientKinds),
           createdByClientId: normalizeOptionalString(session.createdByClientId),
           usesRelay: session.usesRelay === true,
-          sshHostId: normalizeOptionalString(session.sshHostId),
         }))
         .filter((session) => session.secretHash.length > 0)
       : [],
@@ -180,7 +176,7 @@ export const createClientPairingRuntime = ({
     });
   };
-  const createPairingSession = async ({ label, allowedClientKinds, createdByClientId, usesRelay, sshHostId } = {}) => {
+  const createPairingSession = async ({ label, allowedClientKinds, createdByClientId, usesRelay } = {}) => {
     return withStoreMutation(async () => {
       const store = await readStore();
       sweepExpiredSessionsFromStore(store);
@@ -198,8 +194,6 @@ export const createClientPairingRuntime = ({
         allowedClientKinds: normalizeAllowedClientKinds(allowedClientKinds),
         createdByClientId: normalizeOptionalString(createdByClientId),
         usesRelay: usesRelay === true,
-        // Binds later ssh-host-token mint to this pairing; not used by redeem.
-        sshHostId: normalizeOptionalString(sshHostId),
       };
       store.sessions.push(session);
       await writeStore(store);

package/server/lib/client-auth/pairing.test.js CHANGED Viewed

@@ -139,49 +139,4 @@ describe('client auth pairing runtime', () => {
     expect(ids).not.toContain(expired.pairing.id);
     expect(ids).toHaveLength(1);
   });
-  it('persists optional sshHostId and exposes it on query after redeem', async () => {
-    const { dir, runtime } = await makeRuntime();
-    const created = await runtime.createPairingSession({
-      allowedClientKinds: ['mobile'],
-      sshHostId: 'ssh-remote-1',
-    });
-    expect(created.pairing.sshHostId).toBe('ssh-remote-1');
-    const pending = await runtime.listPendingSessions();
-    expect(pending).toEqual(expect.arrayContaining([
-      expect.objectContaining({ id: created.pairing.id, sshHostId: 'ssh-remote-1', usedAt: null }),
-    ]));
-    const lookedUp = await runtime.getPairingSession(created.pairing.id);
-    expect(lookedUp).toMatchObject({ id: created.pairing.id, sshHostId: 'ssh-remote-1', usedAt: null });
-    const storePath = path.join(dir, 'pairing.json');
-    const storeBefore = JSON.parse(await fs.readFile(storePath, 'utf8'));
-    expect(storeBefore.sessions.find((s) => s.id === created.pairing.id)?.sshHostId).toBe('ssh-remote-1');
-    const redeemed = await runtime.redeemPairingSession({
-      pairingId: created.pairing.id,
-      secret: created.pairing.secret,
-      clientKind: 'mobile',
-    });
-    // Redeem still returns the desktop client token; sshHostId is metadata only.
-    expect(redeemed.token).toBe('token-1');
-    expect(redeemed.pairing).toMatchObject({
-      id: created.pairing.id,
-      sshHostId: 'ssh-remote-1',
-    });
-    expect(redeemed.pairing.usedAt).toBeTruthy();
-    const after = await runtime.getPairingSession(created.pairing.id);
-    expect(after).toMatchObject({
-      id: created.pairing.id,
-      sshHostId: 'ssh-remote-1',
-    });
-    expect(after.usedAt).toBeTruthy();
-    // Default pairing has null sshHostId.
-    const plain = await runtime.createPairingSession();
-    expect(plain.pairing.sshHostId).toBeNull();
-  });
 });

package/server/lib/config-sync/config-sync.test.js CHANGED Viewed

@@ -14,6 +14,7 @@ import {
   assertTargetCapability,
   buildDefaultSyncSelections,
   buildRemoteSyncFinalizeScript,
+  buildRemoteSyncInventoryScript,
   buildRemoteSyncPrepareScript,
   createSshSyncTarget,
   filterPlanBySelections,
@@ -195,3 +196,54 @@ describe('generational prepare backups', () => {
     })).toThrow();
   });
 });
+describe('remote inventory script', () => {
+  it('emits SYNC_INVENTORY as valid JSON with quoted path values (regression: bare quotes broke JSON.parse)', async () => {
+    const home = await makeTempDir();
+    const configDir = path.join(home, '.config', 'opencode');
+    await fsp.mkdir(path.join(configDir, 'agents'), { recursive: true });
+    await fsp.writeFile(path.join(configDir, 'opencode.jsonc'), '{"a":1}\n');
+    await fsp.writeFile(path.join(configDir, 'AGENTS.md'), '# agents\n');
+    await fsp.writeFile(path.join(configDir, 'agents', 'helper.md'), 'x'.repeat(7));
+    await fsp.mkdir(path.join(home, '.local', 'share', 'opencode'), { recursive: true });
+    await fsp.writeFile(path.join(home, '.local', 'share', 'opencode', 'auth.json'), '{}\n');
+    const stdout = execFileSync('sh', ['-c', buildRemoteSyncInventoryScript()], {
+      env: { ...process.env, HOME: home },
+    });
+    const line = stdout.toString().split(/\r?\n/).find((entry) => entry.startsWith('SYNC_INVENTORY='));
+    expect(line).toBeTruthy();
+    // This threw SyntaxError ("Unexpected token") before path values were
+    // escaped for the surrounding shell double-quoted string.
+    const inventory = JSON.parse(line.slice('SYNC_INVENTORY='.length));
+    const files = inventory.files.map((entry) => entry.path);
+    expect(files).toContain('opencode.jsonc');
+    expect(files).toContain('AGENTS.md');
+    const directories = inventory.directories.map((entry) => entry.path);
+    expect(directories).toContain('agents');
+    expect(inventory.authFile).toEqual({ bytes: 3 });
+    for (const entry of inventory.files) {
+      expect(typeof entry.path).toBe('string');
+      expect(typeof entry.bytes).toBe('number');
+    }
+    for (const entry of inventory.directories) {
+      expect(typeof entry.path).toBe('string');
+      expect(typeof entry.fileCount).toBe('number');
+      expect(typeof entry.bytes).toBe('number');
+    }
+  });
+  it('still parses when nothing exists on the remote', async () => {
+    const home = await makeTempDir();
+    const stdout = execFileSync('sh', ['-c', buildRemoteSyncInventoryScript()], {
+      env: { ...process.env, HOME: home },
+    });
+    const line = stdout.toString().split(/\r?\n/).find((entry) => entry.startsWith('SYNC_INVENTORY='));
+    const inventory = JSON.parse(line.slice('SYNC_INVENTORY='.length));
+    expect(inventory.files).toEqual([]);
+    expect(inventory.directories).toEqual([]);
+    expect(inventory.agentsRoot).toBeNull();
+    expect(inventory.authFile).toBeNull();
+  });
+});

package/server/lib/config-sync/scripts.js CHANGED Viewed

@@ -12,6 +12,14 @@ import {
 const shellQuote = (value) => `'${String(value).replace(/'/g, `'\\''`)}'`;
+/**
+ * JSON.stringify yields bare double quotes, which terminate the surrounding
+ * shell double-quoted string in inventory lines. Escape them so the assembled
+ * SYNC_INVENTORY payload stays valid JSON after sh evaluation.
+ * @param {string} value
+ */
+const jsonShellEscape = (value) => JSON.stringify(value).replace(/"/g, '\\"');
 /**
  * Sanitize syncRunId for use as a single path segment under backup roots.
  * @param {string} syncRunId
@@ -202,7 +210,7 @@ export const buildRemoteSyncInventoryScript = () => {
     const quoted = shellQuote(rel);
     lines.push(`if [ -f "$CFG"/${quoted} ]; then`);
     lines.push(`  BYTES="$(wc -c < "$CFG"/${quoted} | tr -d ' ')"`);
-    lines.push(`  FILES="$FILES{\\"path\\":${JSON.stringify(rel)},\\"bytes\\":$BYTES},"`);
+    lines.push(`  FILES="$FILES{\\"path\\":${jsonShellEscape(rel)},\\"bytes\\":$BYTES},"`);
     lines.push('fi');
   }
   for (const rel of dirPaths) {
@@ -210,7 +218,7 @@ export const buildRemoteSyncInventoryScript = () => {
     lines.push(`if [ -d "$CFG"/${quoted} ]; then`);
     lines.push(`  COUNT="$(find "$CFG"/${quoted} -type f ! -path '*/node_modules/*' ! -name '*.backup' 2>/dev/null | wc -l | tr -d ' ')"`);
     lines.push(`  BYTES="$(find "$CFG"/${quoted} -type f ! -path '*/node_modules/*' ! -name '*.backup' -exec wc -c {} + 2>/dev/null | awk 'END{print $1+0}')"`);
-    lines.push(`  DIRS="$DIRS{\\"path\\":${JSON.stringify(rel)},\\"fileCount\\":$COUNT,\\"bytes\\":$BYTES},"`);
+    lines.push(`  DIRS="$DIRS{\\"path\\":${jsonShellEscape(rel)},\\"fileCount\\":$COUNT,\\"bytes\\":$BYTES},"`);
     lines.push('fi');
   }
   lines.push('AGENTS="null"');

package/server/lib/notifications/DOCUMENTATION.md CHANGED Viewed

@@ -77,9 +77,10 @@ This module provides notification message preparation utilities for the web serv
 ### Emitter runtime API (emitter-runtime.js)
 - `createNotificationEmitterRuntime(dependencies)`: creates runtime for unified notification emission channels.
 - Returned API:
-  - `writeSseEvent(res, payload)`
+  - `writeSseEvent(res, payload)` — best-effort SSE write with backpressure: when `res.write` returns `false`, the client is marked paused and further writes are skipped until `drain`; buffered bytes above `SSE_CLIENT_MAX_BUFFERED_BYTES` (2 MiB, aligned with relay-server) destroy the response. Authoritative data remains HTTP pull.
   - `emitDesktopNotification(payload)`
   - `broadcastUiNotification(payload)`
+- Exported constant: `SSE_CLIENT_MAX_BUFFERED_BYTES`
 ### Template runtime API (template-runtime.js)
 - `createNotificationTemplateRuntime(dependencies)`: creates shared notification/template runtime. Model-backed summarization was retired after the Zen provider became unavailable.

package/server/lib/notifications/emitter-runtime.js CHANGED Viewed

@@ -1,3 +1,41 @@
+// Align with relay-server per-connection queue cap (2 MiB).
+export const SSE_CLIENT_MAX_BUFFERED_BYTES = 2 * 1024 * 1024;
+const isSseResponseClosed = (res) => Boolean(res?.writableEnded || res?.destroyed);
+const getSseBufferedBytes = (res) => {
+  if (typeof res?.writableLength === 'number' && Number.isFinite(res.writableLength)) {
+    return res.writableLength;
+  }
+  const tracked = res?.__sseBufferedBytes;
+  return typeof tracked === 'number' && Number.isFinite(tracked) ? tracked : 0;
+};
+const attachSseDrainListener = (res) => {
+  if (res.__sseDrainAttached) {
+    return;
+  }
+  res.__sseDrainAttached = true;
+  res.once('drain', () => {
+    res.__ssePaused = false;
+    res.__sseBufferedBytes = 0;
+    res.__sseDrainAttached = false;
+    res.__ssePausedHeartbeatCycles = 0;
+  });
+};
+// Intentional resource protection for slow/zombie SSE clients.
+// SSE is best-effort; authoritative data is fetched over HTTP.
+const destroySseClientForBackpressure = (res) => {
+  try {
+    if (!res.destroyed) {
+      res.destroy();
+    }
+  } catch {
+    // ignore — cleanup must stay idempotent
+  }
+};
 export const createNotificationEmitterRuntime = (dependencies) => {
   const {
     process,
@@ -23,7 +61,46 @@ export const createNotificationEmitterRuntime = (dependencies) => {
   };
   const writeSseEvent = (res, payload) => {
-    res.write(`data: ${JSON.stringify(payload)}\n\n`);
+    if (!res || isSseResponseClosed(res)) {
+      throw new Error('SSE response closed');
+    }
+    // Drop while backpressured — SSE is best-effort; authoritative data is HTTP pull.
+    if (res.__ssePaused) {
+      return false;
+    }
+    const data = `data: ${JSON.stringify(payload)}\n\n`;
+    const byteLength = Buffer.byteLength(data);
+    let ok;
+    try {
+      ok = res.write(data);
+    } catch (error) {
+      destroySseClientForBackpressure(res);
+      throw error;
+    }
+    const bufferedBytes = ok === false
+      ? Math.max(getSseBufferedBytes(res), (res.__sseBufferedBytes || 0) + byteLength)
+      : getSseBufferedBytes(res);
+    res.__sseBufferedBytes = bufferedBytes;
+    if (bufferedBytes > SSE_CLIENT_MAX_BUFFERED_BYTES) {
+      // Intentional resource protection: a slow client must not unbounded-buffer
+      // response body in host memory. SSE is best-effort; authoritative data is
+      // fetched over HTTP.
+      destroySseClientForBackpressure(res);
+      throw new Error('SSE client buffer exceeded');
+    }
+    if (ok === false) {
+      res.__ssePaused = true;
+      attachSseDrainListener(res);
+      return false;
+    }
+    return true;
   };
   const emitDesktopNotification = (payload) => {

package/server/lib/notifications/emitter-runtime.test.js CHANGED Viewed

@@ -1,6 +1,9 @@
 import { describe, expect, it, vi } from 'vitest';
-import { createNotificationEmitterRuntime } from './emitter-runtime.js';
+import {
+  createNotificationEmitterRuntime,
+  SSE_CLIENT_MAX_BUFFERED_BYTES,
+} from './emitter-runtime.js';
 const createRuntime = (overrides = {}) => createNotificationEmitterRuntime({
   process: { stdout: { write: vi.fn() } },
@@ -11,6 +14,59 @@ const createRuntime = (overrides = {}) => createNotificationEmitterRuntime({
   ...overrides,
 });
+const createMockSseResponse = ({ writeImpl } = {}) => {
+  const listeners = new Map();
+  let destroyed = false;
+  let writableEnded = false;
+  let bufferedBytes = 0;
+  const res = {
+    get destroyed() {
+      return destroyed;
+    },
+    get writableEnded() {
+      return writableEnded;
+    },
+    get writableLength() {
+      return bufferedBytes;
+    },
+    on(event, handler) {
+      listeners.set(event, handler);
+      return this;
+    },
+    once(event, handler) {
+      listeners.set(event, handler);
+      return this;
+    },
+    emit(event) {
+      const handler = listeners.get(event);
+      listeners.delete(event);
+      if (typeof handler === 'function') {
+        handler();
+      }
+    },
+    write(chunk) {
+      if (typeof writeImpl === 'function') {
+        return writeImpl(chunk, {
+          addBuffered(bytes) {
+            bufferedBytes += bytes;
+          },
+          getBuffered() {
+            return bufferedBytes;
+          },
+        });
+      }
+      return true;
+    },
+    destroy() {
+      destroyed = true;
+      this.emit('error');
+    },
+  };
+  return res;
+};
 describe('notification emitter runtime', () => {
   it('reports desktop delivery through the injected native callback', () => {
     const onDesktopNotification = vi.fn();
@@ -44,4 +100,41 @@ describe('notification emitter runtime', () => {
       },
     });
   });
+  it('pauses slow SSE clients when write returns false and skips further buffering until drain', () => {
+    const runtime = createRuntime();
+    let writeCount = 0;
+    const res = createMockSseResponse({
+      writeImpl(chunk, { addBuffered }) {
+        writeCount += 1;
+        addBuffered(Buffer.byteLength(String(chunk)));
+        return false;
+      },
+    });
+    expect(runtime.writeSseEvent(res, { type: 'a' })).toBe(false);
+    expect(res.__ssePaused).toBe(true);
+    expect(writeCount).toBe(1);
+    expect(runtime.writeSseEvent(res, { type: 'b' })).toBe(false);
+    expect(writeCount).toBe(1);
+    res.emit('drain');
+    expect(res.__ssePaused).toBe(false);
+    expect(runtime.writeSseEvent(res, { type: 'c' })).toBe(false);
+    expect(writeCount).toBe(2);
+  });
+  it('destroys an SSE client whose buffered bytes exceed the per-client cap', () => {
+    const runtime = createRuntime();
+    const res = createMockSseResponse({
+      writeImpl(chunk, { addBuffered }) {
+        addBuffered(SSE_CLIENT_MAX_BUFFERED_BYTES + Buffer.byteLength(String(chunk)));
+        return false;
+      },
+    });
+    expect(() => runtime.writeSseEvent(res, { type: 'overflow' })).toThrow(/buffer exceeded/);
+    expect(res.destroyed).toBe(true);
+  });
 });

package/server/lib/opencode/DOCUMENTATION.md CHANGED Viewed

@@ -8,7 +8,7 @@ This module provides OpenCode server integration utilities for the web server ru
 - `packages/web/server/lib/opencode/auth.js`: provider authentication file operations.
 - `packages/web/server/lib/opencode/auth-state-runtime.js`: managed OpenCode server auth password/header runtime.
 - `packages/web/server/lib/opencode/cli-options.js`: CLI/environment option parsing for server startup arguments.
-- `packages/web/server/lib/opencode/cli-entry-runtime.js`: CLI entrypoint runtime that detects direct execution, forces `OPENCHAMBER_RUNTIME=web` (so `dev:server` cannot inherit a leftover desktop env and host a relay), parses CLI options, and starts server bootstrap.
+- `packages/web/server/lib/opencode/cli-entry-runtime.js`: CLI entrypoint runtime that detects direct execution, forces `OPENCHAMBER_RUNTIME=web` unless already `ssh-remote` (so `dev:server` cannot inherit a leftover desktop env and host a relay, while SSH-managed remotes may), parses CLI options, and starts server bootstrap.
 - `packages/web/server/lib/opencode/routes.js`: OpenCode/provider settings and auth-related route registration.
 - `packages/web/server/lib/opencode/lifecycle.js`: OpenCode process lifecycle runtime (startup, restart, readiness, health monitoring). Managed child env inherits the user shell environment unchanged; experimental flags such as `OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS` follow the user's own environment and are never injected by OpenChamber.
 - `packages/web/server/lib/opencode/managed-capabilities-runtime.js`: managed-child scheduled-task resources, config injection, rotating bridge identity, and bridge authorization.
@@ -33,7 +33,7 @@ This module provides OpenCode server integration utilities for the web server ru
 - `packages/web/server/lib/opencode/tunnel-wiring-runtime.js`: active loopback-port wiring shared by pairing/LAN URLs and the private relay host.
 - `packages/web/server/lib/opencode/startup-pipeline-runtime.js`: server startup tail orchestration runtime for terminal/proxy/static/start-listen flow.
 - `packages/web/server/lib/opencode/server-utils-runtime.js`: shared server runtime utilities for OpenCode proxy wiring, OpenCode port/readiness helpers, and snapshot fetchers.
-- `packages/web/server/lib/opencode/openchamber-routes.js`: OpenChamber update, models metadata, session-index, transcript-cache, and desktop SSH host-token route registration. Tokenless ready SSH hosts may mint a client token on demand via Electron `mintSshHostToken`, which authenticates to the forwarded remote with the in-memory tunnel UI password.
+- `packages/web/server/lib/opencode/openchamber-routes.js`: OpenChamber update, models metadata, session-index, and transcript-cache route registration.
 - `packages/web/server/lib/transcript-cache/`: opt-in Electron/local SQLite transcript cache (`/api/openchamber/transcript-cache`); default path is null so remote Web servers do not persist conversation bodies. See `transcript-cache/DOCUMENTATION.md`.
 - `packages/web/server/lib/opencode/pwa-manifest-routes.js`: PWA manifest route registration with recent-session shortcut resolution and short-lived caching.
 - `packages/web/server/lib/opencode/project-icon-routes.js`: project icon upload/read/discovery route registration and icon storage orchestration.
@@ -276,7 +276,7 @@ When adding or changing Host HTTP APIs that mobile/desktop clients reach over Pr
    - `DELETE /api/passkeys/:id`
    - `POST /api/auth/reset`
     - `POST /api/client-auth/pairing/sessions`: accepts an optional `relayUrl` when Relay is included. An owner UI session or the local `desktop-local` shell client may set a custom endpoint (other client bearers receive HTTP 403). Canonical form is `ws://`/`wss://` scheme/host/path: userinfo is rejected (HTTP 400); query and fragment are stripped and are not part of endpoint identity. The Host persists the switch and reconnects its control connection before returning the pairing-v2 Relay candidate; an `OPENCHAMBER_RELAY_URL` override stays authoritative.
-    - `GET /api/client-auth/pairing/transports`: returns direct transport availability. `relayAvailable` is true only for the Electron desktop host; local `dev` / `web` / CLI servers report false and omit Relay URL fields so the create-device dialog never defaults to Anywhere or probes the relay.
+    - `GET /api/client-auth/pairing/transports`: returns direct transport availability. `relayAvailable` is true for desktop and SSH-managed remote hosts (`OPENCHAMBER_RUNTIME=desktop|ssh-remote`); local `dev` / `web` / ordinary CLI servers report false and omit Relay URL fields so the create-device dialog never defaults to Anywhere or probes the relay.
    - `GET /connect`
    - `POST /api/system/probe-url`
    - `app.use('/api', ...)` auth/tunnel guard
@@ -297,7 +297,7 @@ When adding or changing Host HTTP APIs that mobile/desktop clients reach over Pr
   - Legacy `--tunnel` shorthand normalization
 ## Public exports (cli-entry-runtime.js)
-- `runCliEntryIfMain(dependencies)`: detects direct CLI execution, forces `OPENCHAMBER_RUNTIME=web` so a leftover desktop env cannot host or probe a relay, and runs server startup with parsed CLI options.
+- `runCliEntryIfMain(dependencies)`: detects direct CLI execution, forces `OPENCHAMBER_RUNTIME=web` (preserving `ssh-remote`) so a leftover desktop env cannot host or probe a relay, and runs server startup with parsed CLI options.
 ## Public exports (server-utils-runtime.js)
 - `createServerUtilsRuntime(dependencies)`: creates server utility runtime for OpenCode orchestration helpers.