feat(ssh): rework remote instance setup and fix remote installs

Adding an SSH connection now starts from the hosts in the SSH config
instead of a blank command field, ports and install options sit behind
Advanced settings, and each connection reports one of three states with
the failure text and an action that resolves it.

Remote installs no longer touch the root-owned global npm prefix: npm is
pinned to a prefix under $HOME and bun is resolved at its known location,
because an SSH login shell exposes neither on PATH. The opencode CLI is
resolved the same way and handed to the remote server through
OPENCODE_BINARY, and the server is started and stopped through the
resolved binary rather than PATH — the HTTP shutdown route sits behind UI
authentication and never stopped anything.

A managed remote server can also be published to the remote machine's own
network. That requires a UI password, enforced in the form and again in
the SSH manager.

packages/ui/src/lib/i18n/messages/en.settings.ts

@@ -406,14 +406,14 @@ export const settingsDict = {
   'settings.remoteInstances.page.field.modePlaceholder': 'Select mode',
   'settings.remoteInstances.page.field.modeManaged': 'Start it for me',
   'settings.remoteInstances.page.field.modeExternal': 'Already running',
-  'settings.remoteInstances.page.field.preferredRemotePort': 'Preferred remote port',
-  'settings.remoteInstances.page.field.preferredRemotePortHint': 'Port to use on the remote machine. Leave empty to choose one automatically.',
+  'settings.remoteInstances.page.field.preferredRemotePort': 'Port on the remote machine',
+  'settings.remoteInstances.page.field.preferredRemotePortHint': 'Port OpenChamber uses on the remote machine. Leave empty to choose one automatically.',
   'settings.remoteInstances.page.field.keepServerRunning': 'Keep server running',
-  'settings.remoteInstances.page.field.keepServerRunningHint': 'Keep OpenChamber running on the remote machine after you disconnect.',
-  'settings.remoteInstances.page.field.bindHost': 'Bind host',
-  'settings.remoteInstances.page.field.bindHostHint': 'Where the local connection should listen. Use 127.0.0.1 or localhost unless you need LAN access.',
-  'settings.remoteInstances.page.field.preferredLocalPort': 'Preferred local port',
-  'settings.remoteInstances.page.field.preferredLocalPortHint': 'Local port to open for this connection. Leave empty to choose one automatically.',
+  'settings.remoteInstances.page.field.keepServerRunningHint': 'Leave the remote server running after you disconnect. When off, it is stopped on disconnect and started again the next time you connect.',
+  'settings.remoteInstances.page.field.bindHost': 'Reachable from',
+  'settings.remoteInstances.page.field.bindHostHint': 'Who can open the forwarded address on this computer. The remote machine itself stays reachable only through the SSH tunnel either way.',
+  'settings.remoteInstances.page.field.preferredLocalPort': 'Port on this computer',
+  'settings.remoteInstances.page.field.preferredLocalPortHint': 'Port opened on this computer for the tunnel. Leave empty to choose one automatically.',
   'settings.remoteInstances.page.field.forwardType': 'Forward type',
   'settings.remoteInstances.page.field.localHostPlaceholder': '127.0.0.1',
   'settings.remoteInstances.page.field.remoteHostPlaceholder': '127.0.0.1',
@@ -1235,8 +1235,8 @@ export const settingsDict = {
   'settings.remoteInstances.page.section.actionsDescription': 'Connect, reconnect, view logs, or remove this connection.',
   'settings.remoteInstances.page.section.remoteServer': 'OpenChamber on the remote machine',
   'settings.remoteInstances.page.section.remoteServerDescription': 'Choose how OpenChamber should run after SSH connects.',
-  'settings.remoteInstances.page.section.mainTunnel': 'Local access',
-  'settings.remoteInstances.page.section.mainTunnelDescription': 'Choose the local address used to open this remote OpenChamber server.',
+  'settings.remoteInstances.page.section.mainTunnel': 'Access from this computer',
+  'settings.remoteInstances.page.section.mainTunnelDescription': 'OpenChamber runs on the remote machine. These settings only control the address on this computer that forwards to it through the SSH tunnel.',
   'settings.remoteInstances.page.section.authentication': 'Authentication',
   'settings.remoteInstances.page.section.authenticationDescription': 'Optional credentials for SSH and the remote OpenChamber UI.',
   'settings.remoteInstances.page.section.portForwards': 'Port Forwards',
@@ -1249,8 +1249,6 @@ export const settingsDict = {
   'settings.remoteInstances.page.field.installMethod': 'Install method',
   'settings.remoteInstances.page.field.installMethodHint': 'How OpenChamber should be placed on the remote machine when this app starts it for you.',
   'settings.remoteInstances.page.field.selectInstallMethodPlaceholder': 'Select install method',
-  'settings.remoteInstances.page.field.installMethodDownloadRelease': 'Download release',
-  'settings.remoteInstances.page.field.installMethodUploadBundle': 'Upload bundle',
   'settings.remoteInstances.page.field.selectBindHostPlaceholder': 'Select bind host',
   'settings.remoteInstances.page.field.sshPasswordOptional': 'SSH password (optional)',
   'settings.remoteInstances.page.field.sshPasswordPlaceholder': 'Enter SSH password',
@@ -1274,7 +1272,44 @@ export const settingsDict = {
   'settings.remoteInstances.page.actions.enableForwardAria': 'Enable forward',
   'settings.remoteInstances.page.actions.openLocal': 'Open local',
   'settings.remoteInstances.page.actions.addForward': 'Add forward',
-  'settings.remoteInstances.page.import.sectionTitle': 'Saved SSH hosts',
+  'settings.remoteInstances.page.addDialog.description': 'Pick a host from your SSH config, or type the connection yourself.',
+  'settings.remoteInstances.page.addDialog.sourceLabel': 'Where the connection comes from',
+  'settings.remoteInstances.page.addDialog.tab.saved': 'From SSH config',
+  'settings.remoteInstances.page.addDialog.tab.manual': 'Type it myself',
+  'settings.remoteInstances.page.addDialog.searchPlaceholder': 'Search hosts',
+  'settings.remoteInstances.page.addDialog.emptySaved': 'No hosts found in your SSH config. Type the connection yourself instead.',
+  'settings.remoteInstances.page.addDialog.searchEmpty': 'No host matches this search.',
+  'settings.remoteInstances.page.addDialog.use': 'Use',
+  'settings.remoteInstances.page.state.notConnected': 'Not connected',
+  'settings.remoteInstances.page.state.connecting': 'Connecting',
+  'settings.remoteInstances.page.state.ready': 'Connected',
+  'settings.remoteInstances.page.state.problem': 'Needs attention',
+  'settings.remoteInstances.page.section.advanced': 'Advanced settings',
+  'settings.remoteInstances.page.section.advancedHint': 'Ports, install method, passwords and extra forwards. The defaults work for most connections.',
+  'settings.remoteInstances.page.field.installMethodAuto': 'Automatic',
+  'settings.remoteInstances.page.error.hint.noRuntime': 'The remote machine has neither bun nor npm. Install one of them there, or switch this connection to "Already running".',
+  'settings.remoteInstances.page.error.hint.noOpencode': 'The opencode CLI is not installed on the remote machine. Install it there (see opencode.ai), then connect again.',
+  'settings.remoteInstances.page.error.action.setUiPassword': 'Set UI password',
+  'settings.remoteInstances.page.error.action.pickRandomPort': 'Use another local port',
+  'settings.remoteInstances.page.error.action.setRemotePort': 'Set the remote port',
+  'settings.remoteInstances.page.validation.externalPortRequired': 'Set a remote port first. In "Already running" mode OpenChamber needs to know which port the server listens on.',
+  'settings.remoteInstances.page.empty.noInstances': 'No SSH connections yet.',
+  'settings.remoteInstances.page.field.uiPasswordRequired': 'UI password (required)',
+  'settings.remoteInstances.page.field.uiPasswordMissingForLan': 'Required while the remote server is reachable on its network.',
+  'settings.remoteInstances.page.field.remoteLanAccess': 'Reachable on the remote network',
+  'settings.remoteInstances.page.field.remoteLanAccessHint': 'Also let other devices on the remote machine’s network open this OpenChamber directly, without the SSH tunnel. A UI password is required.',
+  'settings.remoteInstances.page.field.remoteLanAccessWarning': 'Anyone on that network can reach the remote OpenChamber. It is protected only by the UI password below.',
+  'settings.remoteInstances.page.validation.remoteLanNeedsPassword': 'Set a UI password first. Publishing the remote OpenChamber to its network without one would leave it open to every device there.',
+  'settings.remoteInstances.page.field.bindHostOption.loopback': 'Only this computer (127.0.0.1)',
+  'settings.remoteInstances.page.field.bindHostOption.localhost': 'Only this computer (localhost)',
+  'settings.remoteInstances.page.field.bindHostOption.lan': 'Any device on my network (0.0.0.0)',
+  'settings.remoteInstances.page.field.sshPasswordHint': 'Only needed when this host asks for a password instead of accepting an SSH key.',
+  'settings.remoteInstances.page.field.uiPasswordHintManaged': 'Password to protect the remote OpenChamber UI. OpenChamber sets it on the server it starts for you.',
+  'settings.remoteInstances.page.field.uiPasswordHintExternal': 'Password of the OpenChamber server already running on the remote machine, used to sign in to it.',
+  'settings.remoteInstances.page.tunnelPreview.caption': 'This connection forwards:',
+  'settings.remoteInstances.page.empty.noInstancesWithOneImport': 'No SSH connections yet. 1 host is available to import from your SSH config.',
+  'settings.remoteInstances.page.empty.noInstancesWithImports': 'No SSH connections yet. {count} hosts are available to import from your SSH config.',
+  'settings.remoteInstances.page.state.loadingInstances': 'Loading connections...',
   'settings.remoteInstances.page.import.loading': 'Loading SSH hosts...',
   'settings.remoteInstances.page.import.noneFound': 'No SSH hosts found.',
   'settings.remoteInstances.page.import.noneAvailable': 'No SSH hosts available to import.',