fix(link): gate join credential on tunnel survival

[luvs01]

Motivation

• Prevent a local port-squatting race where an attacker can bind the selected loopback port and receive the issued x-opencodex-api-key before the SSH tunnel actually owns the forward.
• Ensure enrollment only proceeds when the client-owned SSH tunnel is observed to survive its initial spawn window so credential delivery and connect/commit steps are bound to the authenticated transport.

Description

• Add a short spawn-grace (JOIN_TUNNEL_SPAWN_GRACE_MS) and require the spawned tunnel handle to be observed before issuing credential-bearing readiness probes by changing waitForReady to accept a ClientLinkTunnelHandle and racing readiness probes against tunnel.exited.
• Race every fetch of the loopback /readyz endpoint with tunnel exit so an exited tunnel short-circuits enrollment and triggers the existing rollback flow instead of delivering the key.
• Pass the tunnel handle through joinHome so the readiness gate can monitor the supervisor handle returned by spawnClientLinkTunnel and fail fast on tunnel termination.
• Add a regression test in tests/server/link-join-route.test.ts proving that an already-exited tunnel does not receive the issued key, that issuance is revoked, and that rollback behavior remains intact.
• Document the tunnel-survival contract in structure/runtime.md to record the architectural expectation for client-initiated Remote Link enrollment.

Testing

• Ran the focused unit tests: ./node_modules/.bin/bun test tests/server/link-join-route.test.ts, which passed (11 tests, 0 failures) under the repository-pinned Bun used in CI emulation.
• Ran typecheck: ./node_modules/.bin/bun run typecheck, which passed.
• Ran structure gate: ./node_modules/.bin/bun run structure:check, which passed after the small structure/runtime.md update.
• Ran privacy scan: ./node_modules/.bin/bun run privacy:scan, which passed.
• Note: the older system Bun (1.2.14) in this environment lacked an export used by the repo tooling; the focused test suite and checks were executed successfully with the repository-pinned Bun used above.

---

Codex Task

---

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a8496f4b-8883-41bd-8c14-5981a3f96dad

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[luvs01]

이관됨: lidge-jun#6042

[luvs01]

동일 수정이 상류 저장소에 제출되어 이 포크 PR의 목적은 달성됐습니다.