openship 0.6.5 → 0.6.7

package/dist/{chunk-7S4USQYF.js → chunk-DDFUESPJ.js}

@@ -2,19 +2,6 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
-import {
-  importMigratedSites
-} from "./chunk-6HOA5JT7.js";
-import {
-  completeHostEdge,
-  markStoppedProxyImported,
-  planAndApplyHostEdge,
-  previewHostEdge,
-  rollbackHostEdge
-} from "./chunk-HPXP6LXZ.js";
-import {
-  verifyHostChannel
-} from "./chunk-XRNRT37W.js";
 import {
   DEFAULT_REPO,
   PORTS_FILE,
@@ -40,9 +27,27 @@ import {
   resolveComposePorts,
   resolvePorts,
   sourceBuildDir,
+  verifyHostChannel
+} from "./chunk-PPEBIY5F.js";
+import {
+  bootstrapAdmin,
+  importMigratedSites,
+  internalFetch,
+  internalPost,
+  mintBareInternalToken,
+  waitHealthy
+} from "./chunk-RDXT4BQB.js";
+import {
   startUnitHint,
   thisHost
-} from "./chunk-QLX7NBEA.js";
+} from "./chunk-VQM6JHJB.js";
+import {
+  completeHostEdge,
+  markStoppedProxyImported,
+  planAndApplyHostEdge,
+  previewHostEdge,
+  rollbackHostEdge
+} from "./chunk-J2XM3QSP.js";
 import {
   AUTH_SECRET_FILE,
   DATA_DIR,
@@ -53,23 +58,25 @@ import {
 } from "./chunk-ELGRMZOW.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-E2X26PXR.js";
 import {
-  EDGE_CONTAINER_NAME,
   edgeCrashReason,
   edgeIsBroken
-} from "./chunk-WE7BXW6L.js";
+} from "./chunk-GIPJNNI5.js";
+import {
+  EDGE_CONTAINER_NAME
+} from "./chunk-UWEV6XTS.js";
 import {
   isValidEmail
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // src/commands/up.ts
 import { Command } from "commander";
 import chalk2 from "chalk";
 import ora from "ora";
 import { spawn } from "child_process";
-import { randomBytes as randomBytes2 } from "crypto";
-import { createWriteStream as createWriteStream2, existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { randomBytes } from "crypto";
+import { createWriteStream as createWriteStream2, existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
 
@@ -604,6 +611,7 @@ async function planUp(opts) {
       ...opts.hostControl === false ? { noHostControl: true } : {},
       ...opts.hostSshHost ? { hostSshHost: opts.hostSshHost } : {},
       ...opts.hostSshPort ? { hostSshPort: opts.hostSshPort } : {},
+      ...opts.hostSshUser ? { hostSshUser: opts.hostSshUser } : {},
       ...opts.resetSecrets ? { resetSecrets: true } : {},
       ...opts.mail ? { mail: true } : {}
     });
@@ -615,9 +623,23 @@ async function planUp(opts) {
       ...stack.buildFile ? [stack.buildFile] : [],
       ...stack.hostChannel ? [
         stack.hostChannel.keyPath,
-        `${stack.hostChannel.authKeysPath}${stack.hostChannel.viaSudo ? "  (via sudo)" : ""}  (authorizes that key for ${stack.hostChannel.user}'s host ops; --no-host-control skips it)`,
+        `${stack.hostChannel.authKeysPath}  (authorizes that key for ${stack.hostChannel.user}'s host ops; --no-host-control skips it)`,
+        // Say which route to root this channel will take, rather than repeating a root
+        // warning at a box that reaches root perfectly well via sudo. `sudo` is a
+        // supported shape now, not a degradation, and the preview is where an operator
+        // decides whether that is what they wanted.
+        ...stack.hostChannel.elevation === "sudo" ? [
+          `logs in as ${stack.hostChannel.user} and elevates with sudo for root host ops (no root login is created)`
+        ] : [],
         ...stack.hostChannel.rootUnavailable ? [
-          "\u26A0 host control needs root \u2014 this user isn't root and passwordless sudo isn't available, so mail/edge host ops will fail (re-run as root to fix)"
+          "\u26A0 host control needs root \u2014 this user isn't root and passwordless sudo isn't available, so mail/edge host ops will fail (re-run as root, or enable passwordless sudo, to fix)"
+        ] : [],
+        // A plan that named one account and then settled on another would read as the
+        // plan being wrong, and this run genuinely cannot know which: only a dial can
+        // establish whether sshd accepts the first account, and dialing means writing
+        // the key a dry run exists not to write (#527, previewHostChannel).
+        ...stack.hostChannel.fallbacks?.length ? [
+          `if this host's sshd refuses that account, falls back to ${stack.hostChannel.fallbacks.join(", ")} (pin one with --host-ssh-user)`
         ] : []
       ] : [],
       ...stack.mountDirs.map((d) => `${d}/  (edge routing state + certs)`),
@@ -768,87 +790,6 @@ function serviceWord(kind) {
   }
 }
 
-// src/lib/loopback-api.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
-import { randomBytes } from "crypto";
-function ensureInternalToken() {
-  const path = INTERNAL_TOKEN_FILE;
-  if (existsSync4(path)) return readFileSync3(path, "utf8").trim();
-  mkdirSync5(OS_DIR, { recursive: true, mode: 448 });
-  const token = randomBytes(32).toString("hex");
-  writeFileSync4(path, token, { mode: 384 });
-  return token;
-}
-async function internalGet(port, path, token) {
-  try {
-    const res = await fetch(`http://127.0.0.1:${port}${path}`, {
-      headers: { "X-Internal-Token": token ?? ensureInternalToken() },
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!res.ok) return null;
-    return await res.json();
-  } catch {
-    return null;
-  }
-}
-async function internalPost(port, path, body, token) {
-  try {
-    const res = await fetch(`http://127.0.0.1:${port}${path}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "X-Internal-Token": token ?? ensureInternalToken() },
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(3e4)
-    });
-    const data = await res.json().catch(() => ({}));
-    return { ok: res.ok, data };
-  } catch (err) {
-    return { ok: false, data: { error: err.message } };
-  }
-}
-async function bootstrapAdmin(apiPort, admin, token) {
-  const { ok, data } = await internalPost(apiPort, "/api/system/bootstrap-admin", admin, token);
-  if (ok) return { ok: true };
-  if (data?.error === "An admin account already exists") return { ok: true, message: "already-exists" };
-  return { ok: false, message: data?.error || "failed" };
-}
-async function waitHealthy(apiPort, seconds = 90) {
-  for (let i = 0; i < seconds; i++) {
-    await new Promise((r) => setTimeout(r, 1e3));
-    try {
-      await fetch(`http://127.0.0.1:${apiPort}/api/health`, { signal: AbortSignal.timeout(2e3) });
-      return true;
-    } catch {
-    }
-  }
-  return false;
-}
-async function waitDashboard(dashPort, seconds = 45) {
-  for (let i = 0; i < seconds; i++) {
-    await new Promise((r) => setTimeout(r, 1e3));
-    try {
-      const res = await fetch(`http://127.0.0.1:${dashPort}/`, {
-        redirect: "manual",
-        signal: AbortSignal.timeout(2e3)
-      });
-      if (res.status > 0) return true;
-    } catch {
-    }
-  }
-  return false;
-}
-async function detectPublicIp() {
-  for (const url of ["https://api.ipify.org", "https://ifconfig.me/ip"]) {
-    try {
-      const res = await fetch(url, { signal: AbortSignal.timeout(3e3) });
-      if (!res.ok) continue;
-      const ip = (await res.text()).trim();
-      if (/^[0-9.]+$/.test(ip) || ip.includes(":")) return ip;
-    } catch {
-    }
-  }
-  return null;
-}
-
 // src/lib/instance-provision.ts
 var HeadlessInputError = class extends Error {
   code = "HEADLESS_INPUT";
@@ -927,10 +868,14 @@ async function bootstrapOrReset(port, admin, token) {
 async function drainProvisionStream(port, sessionId, token, onLog) {
   let detail;
   try {
-    const res = await fetch(`http://127.0.0.1:${port}/api/system/self-register/stream?id=${sessionId}`, {
-      headers: { "X-Internal-Token": token ?? ensureInternalToken() },
-      signal: AbortSignal.timeout(18e4)
-    });
+    const call = await internalFetch(
+      port,
+      `/api/system/self-register/stream?id=${sessionId}`,
+      { signal: AbortSignal.timeout(18e4) },
+      token
+    );
+    if (call.kind !== "response") return { completed: false, detail: call.detail };
+    const res = call.res;
     if (!res.body) return { completed: false };
     const reader = res.body.getReader();
     const decoder = new TextDecoder();
@@ -1100,10 +1045,10 @@ var DIST_DIR = dirname2(fileURLToPath(import.meta.url));
 var SERVER_DIR = join5(DIST_DIR, "server");
 function ensureAuthSecret() {
   const path = AUTH_SECRET_FILE;
-  if (existsSync5(path)) return readFileSync4(path, "utf8").trim();
-  mkdirSync6(OS_DIR, { recursive: true, mode: 448 });
-  const secret = randomBytes2(32).toString("hex");
-  writeFileSync5(path, secret, { mode: 384 });
+  if (existsSync4(path)) return readFileSync3(path, "utf8").trim();
+  mkdirSync5(OS_DIR, { recursive: true, mode: 448 });
+  const secret = randomBytes(32).toString("hex");
+  writeFileSync4(path, secret, { mode: 384 });
   return secret;
 }
 var upCommand = new Command("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on (default: 4000, or the next free port if it's taken)").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port (default: 3001, or the next free port if it's taken)").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option(
@@ -1136,6 +1081,9 @@ var upCommand = new Command("up").description("Start Openship as a persistent se
 ).option(
   "--host-ssh-port <port>",
   "Compose mode: port the host's sshd listens on for host operations (default 22). Preserved across re-runs."
+).option(
+  "--host-ssh-user <name>",
+  "Compose mode: the host account the api container logs in as for host operations. Normally left unset \u2014 provisioning authorizes a key and DIALS to find an account this host's sshd actually accepts (root when invoked as root, otherwise the invoking user, falling back to $SUDO_USER when a root login is refused). Set this when neither is the account you want, or when sshd's rules mean neither works: the named account is used as-is and never falls back, so it must be able to log in over SSH and should have passwordless sudo (host operations elevate per command). Preserved across re-runs."
 ).option(
   "--open-host-firewall",
   "Compose mode: if the api container can't reach this machine's SSH port, add the host firewall rule that allows it (scoped to the container subnet, ufw/firewalld only). Without this the blocked channel is reported and left alone. Not implied by --yes."
@@ -1278,6 +1226,7 @@ async function runCompose(opts) {
     // so the containers would keep an environment the file no longer shows.
     hostSshHost: opts.hostSshHost,
     hostSshPort: opts.hostSshPort,
+    hostSshUser: opts.hostSshUser,
     resetSecrets: opts.resetSecrets,
     mail: opts.mail
   });
@@ -1332,6 +1281,7 @@ async function runCompose(opts) {
     // configured with rather than resetting it to host.docker.internal:22.
     hostSshHost: opts.hostSshHost,
     hostSshPort: opts.hostSshPort,
+    hostSshUser: opts.hostSshUser,
     resetSecrets: opts.resetSecrets,
     // Absent on a re-run keeps the install's mode (resolveEnvConfig), so this
     // never flips a mail box back to the platform shell.
@@ -1471,7 +1421,7 @@ async function runForeground(opts, source) {
     apiCwd = source.apiDir;
   } else {
     const serverEntry = join5(SERVER_DIR, "index.js");
-    if (!existsSync5(serverEntry)) {
+    if (!existsSync4(serverEntry)) {
       console.error(
         chalk2.red("\n  Bundled server not found in this install.") + chalk2.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
       );
@@ -1488,8 +1438,8 @@ async function runForeground(opts, source) {
   const publicUrl = effectivePublicUrl(opts.publicUrl);
   const managedEdge = Boolean(opts.managedEdge && publicUrl);
   const dataDir = opts.dataDir || DATA_DIR;
-  mkdirSync6(dataDir, { recursive: true });
-  mkdirSync6(LOG_DIR, { recursive: true });
+  mkdirSync5(dataDir, { recursive: true });
+  mkdirSync5(LOG_DIR, { recursive: true });
   const instanceLogPath = join5(LOG_DIR, "instance.log");
   const instanceLog = createWriteStream2(instanceLogPath, { flags: "w" });
   const env = {
@@ -1521,10 +1471,10 @@ async function runForeground(opts, source) {
     env.OPENSHIP_MIGRATIONS_DIR = join5(SERVER_DIR, "migrations");
     env.OPENSHIP_PGLITE_ASSETS_DIR = join5(SERVER_DIR, "pglite");
     const engineDir = join5(SERVER_DIR, "engine");
-    if (existsSync5(engineDir)) env.MAIL_SERVER_ENGINE_DIR = engineDir;
+    if (existsSync4(engineDir)) env.MAIL_SERVER_ENGINE_DIR = engineDir;
   }
   env.OPENSHIP_REQUIRE_AUTH = "true";
-  env.INTERNAL_TOKEN = ensureInternalToken();
+  env.INTERNAL_TOKEN = mintBareInternalToken();
   if (opts.mail) env.OPENSHIP_PRODUCT = "mail";
   if (!env.OPENSHIP_AUTH_MODE) env.OPENSHIP_AUTH_MODE = "local";
   env.OPENSHIP_API_HOST = "127.0.0.1";
@@ -1614,7 +1564,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.6.5"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.6.7"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -1738,13 +1688,6 @@ export {
   restart,
   serviceStatus,
   stop,
-  ensureInternalToken,
-  internalGet,
-  internalPost,
-  bootstrapAdmin,
-  waitHealthy,
-  waitDashboard,
-  detectPublicIp,
   headlessProvision,
   normalizeUrl,
   upCommand,

package/dist/{chunk-6FH4AXVY.js → chunk-E2X26PXR.js}

@@ -8,7 +8,7 @@ import {
   getLocalShellPath,
   logEntry,
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-H3WT3A6R.js";
 
 // ../../packages/adapters/src/system/local-executor.ts
 import { exec, spawn } from "child_process";

package/dist/{chunk-XVOBL7BC.js → chunk-FYPFEDPZ.js}

@@ -7,7 +7,7 @@ import {
   COMPONENT_INSTALLERS,
   checkAll,
   checkComponents
-} from "./chunk-7334NSJL.js";
+} from "./chunk-ZPJ74LXE.js";
 
 // ../../packages/adapters/src/system/state.ts
 var DEFAULT_STATE_PATH = "/etc/openship/setup-state.json";

package/dist/{chunk-WFRXYWK2.js → chunk-FZ6QCF6B.js}

@@ -4,18 +4,20 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-H3WT3A6R.js";
 import {
-  assessHostSupport,
-  classifyDistro,
   formatDuration,
   isRemoteConnectionError,
+  systemDebug
+} from "./chunk-N5YZMO33.js";
+import {
+  assessHostSupport,
+  classifyDistro,
   parseOsRelease,
   parseSystemArch,
   parseSystemOs,
-  safeErrorMessage,
-  systemDebug
-} from "./chunk-LEYSL46B.js";
+  safeErrorMessage
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/elevated-executor.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-VHMOQL5Y.js → chunk-GGIAIGUL.js}

@@ -3,97 +3,51 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
-  connectSshClient,
+  probeTcpDetailed
+} from "./chunk-R4VDPFLS.js";
+import {
   getTarCreateEnv,
+  prepareSourceTarArgs
+} from "./chunk-2ANV5ZQ5.js";
+import {
+  connectSshClient,
   openDockerDialStdioChannel,
   openSftp,
   openSshUnixSocket,
-  prepareSourceTarArgs,
   reconcileKnownHosts
-} from "./chunk-5OUWIPOB.js";
+} from "./chunk-5T4UVOM3.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-E2X26PXR.js";
 import {
   emitBufferedLines,
   flushBufferedLines,
   hasLocalCommand,
   logEntry,
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-H3WT3A6R.js";
 import {
-  HOST_CHANNEL_NOT_PROVISIONED,
-  HOST_CHANNEL_UNPROVISIONED,
   HostChannelUnavailableError,
   SshDisconnectedError,
-  TRANSFER_EXCLUDES,
   commandForError,
+  isSshAuthError
+} from "./chunk-N5YZMO33.js";
+import {
+  HOST_CHANNEL_AUTH_REJECTED,
+  HOST_CHANNEL_NOT_PROVISIONED,
+  HOST_CHANNEL_UNPROVISIONED,
+  TRANSFER_EXCLUDES,
   explainHostChannelCause,
   formatBytes,
+  hostChannelAccount,
   hostFirewallRule,
   safeErrorMessage
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-2VSW6Q6C.js";
 
 // ../../packages/adapters/src/system/executor.ts
 import { existsSync, readFileSync } from "fs";
 import { networkInterfaces } from "os";
 
-// ../../packages/adapters/src/system/reachability.ts
-import { connect } from "net";
-import { request } from "http";
-function classifyDialError(code) {
-  switch (code) {
-    case "ECONNREFUSED":
-    case "ECONNRESET":
-      return "refused";
-    case "ENOTFOUND":
-    case "EAI_AGAIN":
-      return "unresolved";
-    case "EHOSTUNREACH":
-    case "ENETUNREACH":
-    case "ENETDOWN":
-      return "no_route";
-    // The kernel's own connect timeout, i.e. our `timeout` reported for us.
-    case "ETIMEDOUT":
-      return "timeout";
-    default:
-      return "error";
-  }
-}
-function probeTcpDetailed(host, port, timeoutMs = 2500) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const done = (result, socket2) => {
-      if (settled) return;
-      settled = true;
-      try {
-        socket2?.destroy();
-      } catch {
-      }
-      resolve(result);
-    };
-    const socket = connect({ host, port });
-    socket.setTimeout(timeoutMs);
-    socket.once("connect", () => done({ ok: true }, socket));
-    socket.once(
-      "timeout",
-      () => done({ ok: false, reason: "timeout", message: `no response within ${timeoutMs}ms` }, socket)
-    );
-    socket.once("error", (err) => {
-      const errno = err;
-      done(
-        {
-          ok: false,
-          reason: classifyDialError(errno.code),
-          ...errno.code ? { code: errno.code } : {},
-          ...errno.message ? { message: errno.message } : {}
-        },
-        socket
-      );
-    });
-  });
-}
-
 // ../../packages/adapters/src/system/ssh-executor.ts
 import { createReadStream } from "fs";
 import { mkdtemp as mkdtemp2, rm as fsRm2, stat } from "fs/promises";
@@ -1625,7 +1579,7 @@ function hostChannelPort() {
   return Number.isInteger(raw) && raw > 0 && raw < 65536 ? raw : 22;
 }
 function hostChannelUser() {
-  return process.env.OPENSHIP_HOST_SSH_USER?.trim() || "root";
+  return hostChannelAccount(process.env);
 }
 function readHostChannelKey(keyPath) {
   let contents;
@@ -1670,6 +1624,80 @@ function explainDialFailure(probe, host, port, target) {
   const cidr = containerBridgeCidr();
   return { hint, rule: hostFirewallRule("unknown", cidr ? [cidr] : [], port) };
 }
+var AUTH_MEMO_OK_MS = 3e4;
+var AUTH_MEMO_FAIL_MS = 5e3;
+var authMemo = null;
+function invalidateHostChannelAuth() {
+  authMemo = null;
+}
+function probeForwarding(client, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (verdict) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(verdict);
+    };
+    const timer = setTimeout(() => finish("unknown"), timeoutMs);
+    timer.unref?.();
+    try {
+      client.forwardOut("127.0.0.1", 0, "127.0.0.1", 1, (err, stream) => {
+        if (stream) {
+          stream.destroy();
+          finish("ok");
+          return;
+        }
+        const reason = err?.reason;
+        const message = err?.message;
+        if (reason === 1 || reason === 3) return finish("blocked");
+        if (typeof message === "string" && /administratively prohibited/i.test(message)) {
+          return finish("blocked");
+        }
+        finish("ok");
+      });
+    } catch {
+      finish("unknown");
+    }
+  });
+}
+async function verifyHostChannelAuth(config) {
+  const memoKey = `${config.username}@${config.host}:${config.port}#${config.privateKey.length}`;
+  if (authMemo?.key === memoKey && authMemo.expires > Date.now()) {
+    return authMemo.hint ? { hint: authMemo.hint, forwarding: authMemo.forwarding } : { forwarding: authMemo.forwarding };
+  }
+  let hint = null;
+  let forwarding = "unknown";
+  try {
+    const { connectSshClient: connectSshClient2 } = await import("./ssh-client-625VWGKP.js");
+    const client = await connectSshClient2({
+      host: config.host,
+      port: config.port,
+      username: config.username,
+      privateKey: config.privateKey,
+      readyTimeoutMs: config.timeoutMs,
+      // Load-bearing: it selects describeSshAuthFailure's host-channel wording, so the
+      // hint an operator reads here is the same sentence the deploy log gives them.
+      hostChannel: true
+    });
+    forwarding = await probeForwarding(
+      client,
+      config.timeoutMs
+    );
+    client.end();
+  } catch (err) {
+    if (isSshAuthError(err)) {
+      hint = err instanceof Error ? err.message : HOST_CHANNEL_AUTH_REJECTED;
+    }
+  }
+  authMemo = {
+    key: memoKey,
+    hint,
+    forwarding,
+    expires: Date.now() + (hint ? AUTH_MEMO_FAIL_MS : AUTH_MEMO_OK_MS)
+  };
+  return hint ? { hint, forwarding } : { forwarding };
+}
 async function hostChannelHealth(timeoutMs = 2500) {
   if (hostControlDisabled()) {
     return {
@@ -1692,32 +1720,48 @@ async function hostChannelHealth(timeoutMs = 2500) {
   const port = hostChannelPort();
   const target = `${hostChannelUser()}@${host}:${port}`;
   const keyPath = process.env.OPENSHIP_HOST_SSH_KEY?.trim();
+  let privateKey;
   if (keyPath) {
-    const { reason } = readHostChannelKey(keyPath);
-    if (reason) {
+    const read = readHostChannelKey(keyPath);
+    if (read.reason) {
       return {
         ok: false,
         code: "key_unreadable",
         host,
         port,
         target,
-        hint: `${reason} ${HOST_CHANNEL_NOT_PROVISIONED}`
+        hint: `${read.reason} ${HOST_CHANNEL_NOT_PROVISIONED}`
       };
     }
+    privateKey = read.key;
   }
   const probe = await probeTcpDetailed(host, port, timeoutMs);
-  if (probe.ok) {
-    return { ok: true, code: "ok", host, port, target };
+  if (!probe.ok) {
+    return {
+      ok: false,
+      code: "unreachable",
+      host,
+      port,
+      target,
+      cause: probe.reason,
+      ...explainDialFailure(probe, host, port, target)
+    };
   }
-  return {
-    ok: false,
-    code: "unreachable",
-    host,
-    port,
-    target,
-    cause: probe.reason,
-    ...explainDialFailure(probe, host, port, target)
-  };
+  let forwarding = "unknown";
+  if (privateKey) {
+    const verdict = await verifyHostChannelAuth({
+      host,
+      port,
+      username: hostChannelUser(),
+      privateKey,
+      timeoutMs
+    });
+    if (verdict.hint) {
+      return { ok: false, code: "auth_rejected", host, port, target, hint: verdict.hint };
+    }
+    forwarding = verdict.forwarding;
+  }
+  return { ok: true, code: "ok", host, port, target, forwarding };
 }
 function unavailableExecutor(reason, code = "not_configured") {
   const refuse = async () => {
@@ -1787,6 +1831,7 @@ export {
   setHostControlOverride,
   hostControlDisabled,
   containerBridgeCidr,
+  invalidateHostChannelAuth,
   hostChannelHealth,
   unavailableExecutor,
   createHostExecutor