subsystems/

Package devtunnels owns connecting a Dev Tunnels account and its HTTP surface.

OAuth middleware applies the shared exact-origin policy with CORS headers and establishes caller identity from one bearer channel; the browser-only sign-in routes also require an Origin.

A session's Dev Tunnel is part of the session state machine: deterministic ports, requested lifetime, remote Dev Tunnel validation, compensation, and the private per-run tokens all derive from session identity and state.

SSH host entries parse from a pasted ssh command restricted to connection options and allowlisted directives, and render to one OpenSSH stanza.