fix: restore desktop remote authentication

Fixes switching and unlocking password-protected remote instances
Stores SSH forwarded host client tokens from saved UI passwords
Avoids unnecessary auth churn when no runtime headers are configured

packages/electron/ssh-manager.mjs

@@ -700,19 +700,84 @@ export class ElectronSshManager {
   }
 
   async updateHostUrl(instanceId, label, localUrl) {
+    return this.updateHostRuntime(instanceId, label, localUrl, '');
+  }
+
+  async updateHostRuntime(instanceId, label, localUrl, clientToken = '') {
     const root = readJsonRoot(this.settingsFilePath);
     const hosts = Array.isArray(root.desktopHosts) ? root.desktopHosts : [];
     const existing = hosts.find((entry) => entry?.id === instanceId);
+    const token = typeof clientToken === 'string' ? clientToken.trim() : '';
     if (existing) {
       existing.label = label;
       existing.url = localUrl;
+      existing.apiUrl = localUrl;
+      if (token) existing.clientToken = token;
     } else {
-      hosts.push({ id: instanceId, label, url: localUrl });
+      hosts.push({ id: instanceId, label, url: localUrl, apiUrl: localUrl, ...(token ? { clientToken: token } : {}) });
     }
     root.desktopHosts = hosts;
     await writeJsonRoot(this.settingsFilePath, root);
   }
 
+  async issueClientToken(localUrl, openchamberPassword) {
+    const password = typeof openchamberPassword === 'string' ? openchamberPassword.trim() : '';
+    if (!password) return '';
+
+    const loginResponse = await fetch(new URL('/auth/session', `${localUrl}/`).toString(), {
+      method: 'POST',
+      signal: AbortSignal.timeout(10_000),
+      headers: {
+        Accept: 'application/json',
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        password,
+        trustDevice: true,
+        issueClientToken: true,
+        clientLabel: 'OpenChamber Desktop SSH',
+      }),
+    });
+    if (!loginResponse.ok) {
+      throw new Error(`Configured OpenChamber UI password was rejected by forwarded server (status ${loginResponse.status})`);
+    }
+
+    const payload = await loginResponse.json().catch(() => null);
+    const token = typeof payload?.clientToken === 'string' ? payload.clientToken.trim() : '';
+    if (token) return token;
+
+    const cookie = this.extractCookieHeader(loginResponse);
+    if (!cookie) return '';
+
+    const tokenResponse = await fetch(new URL('/api/client-auth/clients', `${localUrl}/`).toString(), {
+      method: 'POST',
+      signal: AbortSignal.timeout(10_000),
+      headers: {
+        Accept: 'application/json',
+        'Content-Type': 'application/json',
+        Cookie: cookie,
+      },
+      body: JSON.stringify({ label: 'OpenChamber Desktop SSH' }),
+    });
+    if (!tokenResponse.ok) return '';
+    const tokenPayload = await tokenResponse.json().catch(() => null);
+    return typeof tokenPayload?.token === 'string' ? tokenPayload.token.trim() : '';
+  }
+
+  extractCookieHeader(response) {
+    const getSetCookie = typeof response.headers?.getSetCookie === 'function'
+      ? response.headers.getSetCookie.bind(response.headers)
+      : null;
+    const cookies = getSetCookie ? getSetCookie() : [];
+    const rawCookies = cookies.length > 0
+      ? cookies
+      : String(response.headers?.get?.('set-cookie') || '').split(/,(?=\s*[^;,=]+=[^;,]+)/);
+    return rawCookies
+      .map((cookie) => String(cookie || '').split(';')[0].trim())
+      .filter(Boolean)
+      .join('; ');
+  }
+
   async persistLocalPort(instanceId, localPort) {
     const root = readJsonRoot(this.settingsFilePath);
     const instances = Array.isArray(root.desktopSshInstances) ? root.desktopSshInstances : [];
@@ -1090,7 +1155,8 @@ export class ElectronSshManager {
 
     const localUrl = `http://127.0.0.1:${localPort}`;
     const label = instance.nickname?.trim() || parsed.destination || id;
-    await this.updateHostUrl(id, label, localUrl);
+    const clientToken = await this.issueClientToken(localUrl, this.configuredOpenChamberPassword(instance));
+    await this.updateHostRuntime(id, label, localUrl, clientToken);
     if (instance.localForward?.preferredLocalPort !== localPort) {
       await this.persistLocalPort(id, localPort);
     }