@serfab/cadre-host 1.14.0 → 1.15.0

package/dist/ui/index.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="color-scheme" content="light dark" />
     <title>cadre-host</title>
-    <script type="module" crossorigin src="./assets/index-4FWuU8ye.js"></script>
-    <link rel="stylesheet" crossorigin href="./assets/index-Di9Q4d01.css">
+    <script type="module" crossorigin src="./assets/index-Ccr2GjPT.js"></script>
+    <link rel="stylesheet" crossorigin href="./assets/index-BHd8CWZA.css">
   </head>
   <body>
     <div id="app"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serfab/cadre-host",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "type": "module",
   "description": "Self-hosted cadre node manager for basement-PC deployments",
   "main": "dist/index.js",
@@ -63,10 +63,9 @@
     "@libp2p/crypto": "^5.1.23",
     "@libp2p/interface": "^3.3.0",
     "@libp2p/peer-id": "^6.0.15",
-    "@multiformats/multiaddr": "^13.0.3",
-    "@serfab/cadre-cli": "^1.14.0",
-    "@serfab/cadre-core": "^1.14.0",
-    "@serfab/cadre-provider": "^1.14.0",
+    "@serfab/cadre-cli": "^1.15.0",
+    "@serfab/cadre-core": "^1.15.0",
+    "@serfab/cadre-provider": "^1.15.0",
     "commander": "^14.0.2",
     "debug": "^4.4.3",
     "fastify": "^5.7.1",

package/src/__tests__/cli.smoke.test.ts

@@ -42,7 +42,7 @@ describe('cadre-host CLI smoke test', () => {
       encoding: 'utf8',
     });
     // The built CLI reads package.json at runtime, so this holds even against a
-    // stale dist — it catches the version falling back to '0.0.0-unknown'.
+    // stale dist — it catches dist/package-version.js resolving the wrong path.
     const pkg = JSON.parse(
       readFileSync(resolve(here, '../../package.json'), 'utf8'),
     ) as { version: string };

package/src/__tests__/orchestrator-claim-secret.test.ts

@@ -93,7 +93,6 @@ describe('HostProcessOrchestrator claim secret', () => {
     await orch.createContainer({
       containerId: 'hn_claim',
       partyId: 'unclaimed',
-      bootstrapNodes: [],
       profile: 'storage',
       claimSecret: SECRET,
     });
@@ -105,7 +104,7 @@ describe('HostProcessOrchestrator claim secret', () => {
 
     // No secret, no variable: `cadre-cli start` treats a set-but-empty value as unset,
     // but the child must not even see the name.
-    await orch.createContainer({ containerId: 'hn_plain', partyId: 'p', bootstrapNodes: [], profile: 'storage' });
+    await orch.createContainer({ containerId: 'hn_plain', partyId: 'p', profile: 'storage' });
     const plain = JSON.parse(await waitForFile(join(rootDir, 'hn_plain', 'spawn-seen.json'))) as { secret: string | null };
     expect(plain.secret).toBeNull();
   });

package/src/__tests__/orchestrator-env-scrub.test.ts

@@ -1,163 +1,160 @@
-/**
- * HostProcessOrchestrator env-scrub test — the manager's own `process.env` must
- * not leak `CADRE_*` config-override vars into spawned children.
- *
- * `launchChild` used to build each child's environment as
- * `{ ...process.env, ...extraEnv, <fixed per-child vars> }`, so ANY `CADRE_*`
- * var set on the manager (not just the ones the orchestrator deliberately
- * sets) reached every child. Because `@serfab/cadre-cli` treats an inherited
- * `CADRE_*` var as a config override that beats the per-child config file, a
- * `CADRE_PARTY_ID` set on the manager could silently pull every child into
- * that party.
- *
- * A fake CLI records the vars under test from its environment to a file so
- * the scrub is observable without a real cadre node.
- *
- * The same record carries `CADRE_LISTEN_ADDRS`, one of the vars the orchestrator
- * deliberately SETS: a child must be handed a WebSocket listener beside its TCP one,
- * on the ports its handle holds, or a phone cannot reach it.
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
-import { removeAllNodes } from './orchestrator-teardown.js';
-
-// Writes the vars under test (as seen in the child env) next to the startup token.
-const FAKE_CLI = `
-import fs from 'node:fs';
-import path from 'node:path';
-const args = process.argv.slice(2);
-const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
-const tokenPath = get('--startup-token-file');
-const token = process.env.CADRE_STARTUP_TOKEN ?? '';
-if (tokenPath) {
-  const dir = path.dirname(tokenPath);
-  const record = {
-    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID ?? null,
-    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH ?? null,
-    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT ?? null,
-    CADRE_LISTEN_ADDRS: process.env.CADRE_LISTEN_ADDRS ?? null,
-    DEBUG: process.env.DEBUG ?? null,
-  };
-  // Write then rename: the test polls for the file's existence, and must never read it half-written.
-  const seenPath = path.join(dir, 'env-seen.json');
-  try { fs.writeFileSync(seenPath + '.tmp', JSON.stringify(record), 'utf8'); fs.renameSync(seenPath + '.tmp', seenPath); } catch (e) { console.error(e); }
-  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
-}
-process.on('SIGTERM', () => process.exit(0));
-setInterval(() => {}, 1 << 30);
-`;
-
-let tmpRoot: string;
-let scriptPath: string;
-const orchestrators: HostProcessOrchestrator[] = [];
-let savedEnv: Record<string, string | undefined>;
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-env-scrub-'));
-  scriptPath = join(tmpRoot, 'fake-cli.mjs');
-  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
-  savedEnv = {
-    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID,
-    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH,
-    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT,
-    DEBUG: process.env.DEBUG,
-  };
-});
-
-afterEach(async () => {
-  try {
-    await removeAllNodes(orchestrators);
-  } finally {
-    await sleep(50);
-    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-    for (const [key, value] of Object.entries(savedEnv)) {
-      if (value === undefined) delete process.env[key];
-      else process.env[key] = value;
-    }
-  }
-});
-
-function makeOrchestrator(rootDir: string): HostProcessOrchestrator {
-  mkdirSync(rootDir, { recursive: true });
-  const orch = new HostProcessOrchestrator({
-    rootDir,
-    portRange: { start: 18000, end: 18499 },
-    stopTimeoutMs: 1500,
-    spawn: { entrypoint: scriptPath },
-  });
-  orchestrators.push(orch);
-  return orch;
-}
-
-async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (existsSync(path)) return readFileSync(path, 'utf8');
-    await sleep(50);
-  }
-  throw new Error(`file never appeared: ${path}`);
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((res) => setTimeout(res, ms));
-}
-
-describe('HostProcessOrchestrator child env scrub', () => {
-  it('does not leak manager CADRE_* config-override vars into children, but passes through non-CADRE vars', async () => {
-    process.env.CADRE_PARTY_ID = 'conflicting-party';
-    process.env.CADRE_STORAGE_PATH = '/tmp/should-not-leak';
-    // Not an ENV_MAPPINGS config override — read directly by the cli's `start`
-    // command — so it only stays scrubbed if the scrub is prefix-wide.
-    process.env.CADRE_ADMIN_PORT = '19999';
-    process.env.DEBUG = 'some:value';
-
-    const rootDir = join(tmpRoot, 'a');
-    const orch = makeOrchestrator(rootDir);
-    await orch.init();
-
-    await orch.createContainer({
-      containerId: 'child-1',
-      partyId: 'party-1',
-      bootstrapNodes: [],
-      profile: 'storage',
-    });
-    await orch.createContainer({
-      containerId: 'child-2',
-      partyId: 'party-2',
-      bootstrapNodes: [],
-      profile: 'storage',
-    });
-
-    const seen1 = JSON.parse(await waitForFile(join(rootDir, 'child-1', 'env-seen.json')));
-    const seen2 = JSON.parse(await waitForFile(join(rootDir, 'child-2', 'env-seen.json')));
-
-    for (const seen of [seen1, seen2]) {
-      expect(seen.CADRE_PARTY_ID).toBeNull();
-      expect(seen.CADRE_STORAGE_PATH).toBeNull();
-      expect(seen.CADRE_ADMIN_PORT).toBeNull();
-      expect(seen.DEBUG).toBe('some:value');
-    }
-  });
-
-  it('hands each child a TCP and a WebSocket listen address on its own ports', async () => {
-    const rootDir = join(tmpRoot, 'b');
-    const orch = makeOrchestrator(rootDir);
-    await orch.init();
-
-    await orch.createContainer({
-      containerId: 'child-1',
-      partyId: 'party-1',
-      bootstrapNodes: [],
-      profile: 'storage',
-    });
-
-    const seen = JSON.parse(await waitForFile(join(rootDir, 'child-1', 'env-seen.json')));
-    const ports = orch.getNode('child-1')!.ports;
-    expect(seen.CADRE_LISTEN_ADDRS).toBe(`/ip4/0.0.0.0/tcp/${ports.p2p},/ip4/0.0.0.0/tcp/${ports.ws}/ws`);
-  });
-});
+/**
+ * HostProcessOrchestrator env-scrub test — the manager's own `process.env` must
+ * not leak `CADRE_*` config-override vars into spawned children.
+ *
+ * `launchChild` used to build each child's environment as
+ * `{ ...process.env, ...extraEnv, <fixed per-child vars> }`, so ANY `CADRE_*`
+ * var set on the manager (not just the ones the orchestrator deliberately
+ * sets) reached every child. Because `@serfab/cadre-cli` treats an inherited
+ * `CADRE_*` var as a config override that beats the per-child config file, a
+ * `CADRE_PARTY_ID` set on the manager could silently pull every child into
+ * that party.
+ *
+ * A fake CLI records the vars under test from its environment to a file so
+ * the scrub is observable without a real cadre node.
+ *
+ * The same record carries `CADRE_LISTEN_ADDRS`, one of the vars the orchestrator
+ * deliberately SETS: a child must be handed a WebSocket listener beside its TCP one,
+ * on the ports its handle holds, or a phone cannot reach it.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
+import { removeAllNodes } from './orchestrator-teardown.js';
+
+// Writes the vars under test (as seen in the child env) next to the startup token.
+const FAKE_CLI = `
+import fs from 'node:fs';
+import path from 'node:path';
+const args = process.argv.slice(2);
+const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
+const tokenPath = get('--startup-token-file');
+const token = process.env.CADRE_STARTUP_TOKEN ?? '';
+if (tokenPath) {
+  const dir = path.dirname(tokenPath);
+  const record = {
+    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID ?? null,
+    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH ?? null,
+    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT ?? null,
+    CADRE_LISTEN_ADDRS: process.env.CADRE_LISTEN_ADDRS ?? null,
+    DEBUG: process.env.DEBUG ?? null,
+  };
+  // Write then rename: the test polls for the file's existence, and must never read it half-written.
+  const seenPath = path.join(dir, 'env-seen.json');
+  try { fs.writeFileSync(seenPath + '.tmp', JSON.stringify(record), 'utf8'); fs.renameSync(seenPath + '.tmp', seenPath); } catch (e) { console.error(e); }
+  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
+}
+process.on('SIGTERM', () => process.exit(0));
+setInterval(() => {}, 1 << 30);
+`;
+
+let tmpRoot: string;
+let scriptPath: string;
+const orchestrators: HostProcessOrchestrator[] = [];
+let savedEnv: Record<string, string | undefined>;
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-env-scrub-'));
+  scriptPath = join(tmpRoot, 'fake-cli.mjs');
+  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
+  savedEnv = {
+    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID,
+    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH,
+    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT,
+    DEBUG: process.env.DEBUG,
+  };
+});
+
+afterEach(async () => {
+  try {
+    await removeAllNodes(orchestrators);
+  } finally {
+    await sleep(50);
+    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+    for (const [key, value] of Object.entries(savedEnv)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  }
+});
+
+function makeOrchestrator(rootDir: string): HostProcessOrchestrator {
+  mkdirSync(rootDir, { recursive: true });
+  const orch = new HostProcessOrchestrator({
+    rootDir,
+    portRange: { start: 18000, end: 18499 },
+    stopTimeoutMs: 1500,
+    spawn: { entrypoint: scriptPath },
+  });
+  orchestrators.push(orch);
+  return orch;
+}
+
+async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(path)) return readFileSync(path, 'utf8');
+    await sleep(50);
+  }
+  throw new Error(`file never appeared: ${path}`);
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((res) => setTimeout(res, ms));
+}
+
+describe('HostProcessOrchestrator child env scrub', () => {
+  it('does not leak manager CADRE_* config-override vars into children, but passes through non-CADRE vars', async () => {
+    process.env.CADRE_PARTY_ID = 'conflicting-party';
+    process.env.CADRE_STORAGE_PATH = '/tmp/should-not-leak';
+    // Not an ENV_MAPPINGS config override — read directly by the cli's `start`
+    // command — so it only stays scrubbed if the scrub is prefix-wide.
+    process.env.CADRE_ADMIN_PORT = '19999';
+    process.env.DEBUG = 'some:value';
+
+    const rootDir = join(tmpRoot, 'a');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    await orch.createContainer({
+      containerId: 'child-1',
+      partyId: 'party-1',
+      profile: 'storage',
+    });
+    await orch.createContainer({
+      containerId: 'child-2',
+      partyId: 'party-2',
+      profile: 'storage',
+    });
+
+    const seen1 = JSON.parse(await waitForFile(join(rootDir, 'child-1', 'env-seen.json')));
+    const seen2 = JSON.parse(await waitForFile(join(rootDir, 'child-2', 'env-seen.json')));
+
+    for (const seen of [seen1, seen2]) {
+      expect(seen.CADRE_PARTY_ID).toBeNull();
+      expect(seen.CADRE_STORAGE_PATH).toBeNull();
+      expect(seen.CADRE_ADMIN_PORT).toBeNull();
+      expect(seen.DEBUG).toBe('some:value');
+    }
+  });
+
+  it('hands each child a TCP and a WebSocket listen address on its own ports', async () => {
+    const rootDir = join(tmpRoot, 'b');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    await orch.createContainer({
+      containerId: 'child-1',
+      partyId: 'party-1',
+      profile: 'storage',
+    });
+
+    const seen = JSON.parse(await waitForFile(join(rootDir, 'child-1', 'env-seen.json')));
+    const ports = orch.getNode('child-1')!.ports;
+    expect(seen.CADRE_LISTEN_ADDRS).toBe(`/ip4/0.0.0.0/tcp/${ports.p2p},/ip4/0.0.0.0/tcp/${ports.ws}/ws`);
+  });
+});

package/src/__tests__/orchestrator-handle-contract.ts

@@ -87,7 +87,7 @@ export function describeHandleContract<O extends ContractOrchestrator>(
     });
 
     // Launching over a live child hands its ports to a second child that then
-    // dies on them, while the caller records the new dockerId and seed token.
+    // dies on them, while the caller records the new dockerId.
     it('refuses to re-spawn a container whose previous child is still running', async () => {
       const orch = harness.make();
       const first = await spawn(orch, CONTAINER);

package/src/__tests__/orchestrator-node-identity.test.ts

@@ -95,7 +95,6 @@ describe('HostProcessOrchestrator node identity', () => {
     await orch.createContainer({
       containerId: 'hosted-1',
       partyId: 'party-P',
-      bootstrapNodes: [],
       profile: 'storage',
     });
 
@@ -114,7 +113,6 @@ describe('HostProcessOrchestrator node identity', () => {
     const first = await orch.createContainer({
       containerId: 'hosted-2',
       partyId: 'party-P',
-      bootstrapNodes: [],
       profile: 'storage',
     });
     const workdir = join(rootDir, 'hosted-2');
@@ -127,7 +125,6 @@ describe('HostProcessOrchestrator node identity', () => {
     await orch.createContainer({
       containerId: 'hosted-2',
       partyId: 'party-P',
-      bootstrapNodes: [],
       profile: 'storage',
     });
 
@@ -143,7 +140,6 @@ describe('HostProcessOrchestrator node identity', () => {
     const created = await orch.createContainer({
       containerId: 'hosted-3',
       partyId: 'party-P',
-      bootstrapNodes: [],
       profile: 'storage',
     });
     const identityPath = join(rootDir, 'hosted-3', 'identity.key');
@@ -170,7 +166,6 @@ describe('HostProcessOrchestrator node identity', () => {
 
     const request = {
       partyId: 'party-P',
-      bootstrapNodes: [],
       profile: 'storage' as const,
     };
     await expect(orch.createContainer({ ...request, containerId: 'hosted-bad' })).rejects.toThrow();

package/src/__tests__/orchestrator-push.test.ts

@@ -30,7 +30,7 @@ setInterval(() => {}, 1 << 30);
 const FCM = { projectId: 'proj', clientEmail: 'svc@proj.iam', privateKey: 'FCM-SECRET-PEM' };
 const APNS = { keyId: 'KID', teamId: 'TEAM', bundleId: 'com.example.app', privateKey: 'APNS-SECRET-P8', production: false };
 /** A storage node — the one profile whose spawn carries push. */
-const NODE = { containerId: 'n1', partyId: 'p', bootstrapNodes: [], profile: 'storage' as const };
+const NODE = { containerId: 'n1', partyId: 'p', profile: 'storage' as const };
 
 let tmpRoot: string;
 let scriptPath: string;
@@ -129,10 +129,10 @@ describe('HostProcessOrchestrator push injection', () => {
     const orch = makeOrchestrator(rootDir, async () => ({ fcm: FCM, apns: APNS, cooldownMs: 1000 }));
     await orch.init();
 
-    await orch.createContainer({ containerId: 'storage-1', partyId: 'p', bootstrapNodes: [], profile: 'storage' });
+    await orch.createContainer({ containerId: 'storage-1', partyId: 'p', profile: 'storage' });
     expect(readChildConfig(rootDir, 'storage-1').push).toEqual({ fcm: FCM, apns: APNS, cooldownMs: 1000 });
 
-    await orch.createContainer({ containerId: 'txn-1', partyId: 'p', bootstrapNodes: [], profile: 'transaction' });
+    await orch.createContainer({ containerId: 'txn-1', partyId: 'p', profile: 'transaction' });
     expect(readChildConfig(rootDir, 'txn-1').push).toBeUndefined();
   });
 });

package/src/__tests__/orchestrator.test.ts

@@ -119,7 +119,6 @@ function makeRequest(containerId: string, opts: { profile?: 'storage' | 'transac
   return {
     containerId,
     partyId: 'party-' + containerId,
-    bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
     profile: opts.profile ?? 'transaction' as 'storage' | 'transaction',
   };
 }
@@ -556,9 +555,9 @@ describe('HostProcessOrchestrator.isRunning', () => {
  *
  * The incident this guards against: the respawn supervisor asked `isRunning`
  * during that window, got `false`, and re-spawned the container. The re-spawn
- * released and reused the same ports, rotated the seed token, and returned
- * success; the second child then died on the port the first still held, leaving
- * the host's records naming a dead child and the live one refusing every seed.
+ * released and reused the same ports and returned success; the second child
+ * then died on the port the first still held, leaving the host's records naming
+ * a dead child while the live one ran with no handle naming it.
  */
 describe('HostProcessOrchestrator re-spawn over a child that is still starting', () => {
   const TOKEN_DELAY_MS = 3000;
@@ -911,7 +910,6 @@ describe('child survives orchestrator exit', () => {
       const request = {
         containerId: 'cross1',
         partyId: 'party-cross1',
-        bootstrapNodes: ['/ip4/127.0.0.1/tcp/4001/p2p/12D3KooWA9hbnKrRnPRSPTRkzXqTHzGE8YpJ3JHZmQ5tGwLRTMmp'],
         profile: 'transaction',
       };
       const payload = {

package/src/__tests__/ui-access.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest';
+
+import { currentLogin, isHeadless, uiAccessLines } from '../bin/ui-access.js';
+
+describe('isHeadless', () => {
+  it('is true over SSH on any platform, and on Linux without a display', () => {
+    expect(isHeadless('darwin', { SSH_CONNECTION: '1.2.3.4 5 6.7.8.9 22' })).toBe(true);
+    expect(isHeadless('linux', {})).toBe(true);
+    expect(isHeadless('linux', { DISPLAY: ':0' })).toBe(false);
+    expect(isHeadless('linux', { WAYLAND_DISPLAY: 'wayland-0' })).toBe(false);
+    expect(isHeadless('darwin', {})).toBe(false);
+  });
+});
+
+describe('uiAccessLines', () => {
+  it('gives the URL on a desktop, and the SSH forward (same port both sides) when headless', () => {
+    expect(uiAccessLines(8765, false)).toEqual(['Open the UI: http://127.0.0.1:8765']);
+    const lines = uiAccessLines(8765, true, { user: 'kyle', host: 'kjeib' });
+    expect(lines).toContain('  ssh -L 8765:127.0.0.1:8765 kyle@kjeib');
+    expect(lines.join('\n')).toContain('http://127.0.0.1:8765');
+  });
+});
+
+describe('currentLogin', () => {
+  it('over SSH, names the server address and port the client connected to', () => {
+    const who = currentLogin({ SSH_CONNECTION: '198.51.100.20 51234 203.0.113.7 2222' });
+    expect(who).toMatchObject({ host: '203.0.113.7', sshPort: 2222 });
+    expect(uiAccessLines(8765, true, who)[1]).toBe(`  ssh -p 2222 -L 8765:127.0.0.1:8765 ${who.user}@203.0.113.7`);
+  });
+});