[Bug]: Add Child fails with "ssh command exceeded 15000ms" when the Child is reached through a ProxyCommand such as cloudflared #6940

Client or integration

OpenCodex dashboard

Area

Proxy and routing

Summary

The final step of Add Child runs ocx connect --link on the Child under a fixed 15-second budget (APPLY_ADMISSION_TIMEOUT_MS in src/server/management/link-routes.ts). The budget includes SSH connection setup. For a host whose ~/.ssh/config entry uses ProxyCommand cloudflared access ssh --hostname %h, connection setup alone took 3.4 s per command, and Connect Child failed with ssh command exceeded 15000ms after the probe, the fingerprint confirmation and the version check had all succeeded.

The same machine linked on the first try through a direct Tailscale alias (0.27 s connection setup). The Remote Link guide names cloudflared as a supported ProxyCommand helper, so this route is expected to work.

Rollback was clean: the Home removed the link record and the Child stayed standalone and healthy.

Reproduction

1. Child: OpenCodex 2.83.0, reachable only through a ProxyCommand cloudflared access ssh alias.
2. time ssh -o BatchMode=yes <alias> true → about 3.4 s.
3. Home dashboard → Remote Link → Home → Add Child → choose the alias → Test connection → confirm fingerprint (succeeds, shows the Child version) → Connect Child.
4. After about 15 s: "Could not connect the remote computer to this Home … reason: ssh command exceeded 15000ms".
5. Add a direct alias to the same machine (Tailscale, about 0.27 s) and repeat: Connected.

Expected: the remote connect deadline accounts for connection setup (for example, scale it from the probe's measured latency, or give the remote command its own budget separate from the admission wait). If it still times out, name the phase that timed out and suggest a faster SSH route.

Version

Home 2.81.0 (OpenCodex Desktop); Child 2.83.0. APPLY_ADMISSION_TIMEOUT_MS = 15_000 is unchanged on dev 9b6f4b2632.

Operating system

Home macOS 27 arm64; Child macOS 27 arm64

Provider and model

No response

Logs or error output

원격 컴퓨터를 이 홈에 연결하지 못했습니다. 그 컴퓨터의 OpenCodex 서비스를 확인한 뒤 다시 시도하세요. 이유: ssh command exceeded 15000ms

Screenshots and supporting files

No response

Redacted configuration

Host child-cf
    HostName ssh.example.com
    User someone
    ProxyCommand /opt/homebrew/bin/cloudflared access ssh --hostname %h

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.