Automatic port forwarding #9

What

A server started on the Agent, such as npm run dev on port 5173, opens at localhost:5173 on the Client with no setup.

Today

• ssh shares one connection across calls only over iroh, through RemoteCommand.shared in crates/ally-cli/src/ssh.rs. Direct routes open a new connection each time.
• RemoteCommand.forward forwards one fixed port for a whole command, used only to sign in to tools.
• Nothing lists the ports work on the Agent listens on.

How

1. Share the ssh connection on every route, not only iroh, so ports can be added to it while it runs.
2. The Agent reports listening ports. A new Request::Ports returns each TCP port that a process in an Ally job listens on: port, bind address, job, and program. It wraps ss on Linux and lsof on a macOS Agent, and matches processes to jobs through their process tree. Ports that Docker containers publish are included, labeled Docker. Raises control::VERSION.
3. Automatic forwarding during ally run and ally attach.
   • The Client asks for ports every 2 seconds over the open control connection, adds each new one with ssh -O forward -L, and removes it with ssh -O cancel when it closes.
   • Forwards last only while run or attach is connected.
   • Forwards listen on 127.0.0.1 only, and target the address the server listens on (127.0.0.1 or [::1]).
   • If the port is taken on the Client, the next free one is used and named.
   • run prints ▶ Forwarding archbox:5173 to localhost:5173 once.
   • In attach, the session bar lists the ports, and a short tmux message appears when one is added.
4. ally forward <port> forwards any Agent port until Ctrl C, for a server left running after detaching. ally ports lists what is forwarded.
5. Menu bar. Lists forwarded ports, and a click opens the browser. Notifies the first time a job listens on a port, with the address to open.

The waiting for input notification moved to #136.

Done When

• A server started in a run or a session opens in the Client's browser over the local network, tailnet, and iroh.
• A port a Docker container publishes opens on the Client.
• Ollama's port 11434 opens on the Client.
• Starting npm run dev in a session notifies with the address to open.

Folds in #21.