fix: harden SSH tunnel lifecycle

[NotReliable]

Summary

• tolerate ordinary multi-second latency when probing and reusing an SSH forward
• never request remote shutdown for an externally owned backend
• cover concurrent ensure calls and 100 reconnect cycles with constant child counts

Fixes #4144.

Why

The previous one-second request timeout and two-second reuse window could classify a temporarily slow forward as stale. Repeated callers would then replace the forward, increasing the chance that old child processes outlived the connection that created them.

This keeps the existing pending-map serialization, but gives a reusable tunnel a realistic bounded readiness window and makes external-backend ownership explicit in finalization.

Verification

• pnpm --filter @t3tools/ssh test — 27 passed
• pnpm exec vp run --filter @t3tools/ssh typecheck — passed
• pnpm exec vp check — passed (10 pre-existing unrelated React warnings)

The repository-wide vp run typecheck planner was also attempted, but this filtered checkout did not have the unrelated Marketing workspace's astro executable linked. The affected SSH package typecheck above is clean.

Note

Harden SSH tunnel lifecycle to prevent duplicate tunnels and skip remote stop for external backends

• ensureEnvironment now waits up to 15s (was 2s) for an existing tunnel's HTTP endpoint before deciding not to reuse it, preventing spurious duplicate tunnel creation under concurrency.
• The tunnel finalizer skips calling stopRemoteServer when remoteServerKind is 'external', only terminating the local tunnel process.
• SSH_READY_PROBE_TIMEOUT_MS is increased from 1,000ms to 5,000ms; SSH_EXISTING_TUNNEL_READY_TIMEOUT_MS (15,000ms) is introduced as a distinct constant.
• New tests in tunnel.test.ts validate single-tunnel concurrency and stable tunnel counts across 100 reconnect cycles.
• Behavioral Change: external backends no longer have their remote server stopped when a tunnel is closed.

^{Macroscope summarized 39db8ec. (Automatic summaries will resume when PR exits draft mode or review begins).}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 4dfa74b6-4dd0-43de-bdf9-1f6e3747ef7f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

We're closing this PR as we clean up the T3 Code backlog. Thank you for taking the time to put this together.

The same SSH tunnel lifecycle code is under active review in the open #4039 and its open follow-up #7639. We are keeping that work together instead of maintaining a separate implementation here.

If you believe we closed this in error, please reopen the PR and leave a comment explaining what we missed.