fix(api): store SSH password in tunnel record, return stable password

Root cause: every POST /ssh-tunnel call regenerated a new password and
set it on the container. Polling every 30s was invalidating the password
shown in the panel while the old hostname stayed cached in the frontend.

Fix: password is generated once per fresh tunnel start, stored in the
SshTunnelRecord, and returned consistently while the tunnel is alive.
A new password is only generated when the old tunnel actually dies.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: skulidropek

packages/api/src/http.ts

@@ -1261,18 +1261,12 @@ export const makeRouter = () => {
       Effect.gen(function*(_) {
         const { projectKey } = yield* _(projectKeyParams)
         const project = yield* _(getProjectItemByKey(projectKey))
-        const sshPassword = generateSshPassword()
-        yield* _(
-          enableContainerPasswordAuth(project.containerName, sshPassword).pipe(
-            Effect.orElse(() => Effect.void)
-          )
-        )
-        const hostname = yield* _(
-          startSshProjectTunnel(projectKey, project.sshPort).pipe(
-            Effect.orElse(() => Effect.succeed(null))
+        const result = yield* _(
+          startSshProjectTunnel(projectKey, project.sshPort, project.containerName).pipe(
+            Effect.orElse(() => Effect.succeed({ hostname: null, sshPassword: "" }))
           )
         )
-        return yield* _(jsonResponse({ hostname, sshPassword }, 200))
+        return yield* _(jsonResponse(result, 200))
       }).pipe(Effect.catchAll(errorResponse))
     )
   )

packages/api/src/services/ssh-project-tunnels.ts

@@ -19,12 +19,14 @@ import { Duration, Effect, Fiber } from "effect"
 import { ApiInternalError } from "../api/errors.js"
 import { parseTryCloudflareUrl } from "./panel-cloudflare-tunnel-core.js"
 import { parseLinuxDefaultGatewayIp } from "./project-port-proxy-core.js"
+import { generateSshPassword, enableContainerPasswordAuth } from "./ssh-password-setup.js"
 
 type SshTunnelRecord = {
   readonly homeDir: string
   process: ChildProcess | null
   processClosed: boolean
   hostname: string | null
+  sshPassword: string
   stopping: boolean
   stopFiber: Fiber.RuntimeFiber<void> | null
   stdoutRemainder: string
@@ -193,18 +195,22 @@ const waitForHostname = (
  */
 export const startSshProjectTunnel = (
   projectKey: string,
-  sshPort: number
-): Effect.Effect<string | null, ApiInternalError> =>
+  sshPort: number,
+  containerName: string
+): Effect.Effect<{ hostname: string | null; sshPassword: string }, ApiInternalError> =>
   Effect.gen(function*(_) {
     const existing = projectTunnelMap.get(projectKey)
     if (existing !== undefined && !existing.stopping && !existing.processClosed && existing.hostname !== null) {
-      return existing.hostname
+      return { hostname: existing.hostname, sshPassword: existing.sshPassword }
     }
     if (existing !== undefined) {
       yield* _(stopRecord(existing).pipe(Effect.orElse(() => Effect.void)))
       projectTunnelMap.delete(projectKey)
     }
 
+    const sshPassword = generateSshPassword()
+    yield* _(enableContainerPasswordAuth(containerName, sshPassword).pipe(Effect.orElse(() => Effect.void)))
+
     const localhostHost = yield* _(defaultLocalhostHost())
     const sshUrl = `ssh://${localhostHost}:${sshPort}`
     const homeDir = sshTunnelHomeDir(randomUUID())
@@ -213,6 +219,7 @@ export const startSshProjectTunnel = (
       hostname: null,
       process: null,
       processClosed: false,
+      sshPassword,
       stderrRemainder: "",
       stdoutRemainder: "",
       stopFiber: null,
@@ -239,7 +246,8 @@ export const startSshProjectTunnel = (
       })
     )
 
-    return yield* _(waitForHostname(record, startWaitAttempts))
+    const hostname = yield* _(waitForHostname(record, startWaitAttempts))
+    return { hostname, sshPassword }
   }).pipe(projectTunnelLock.withPermits(1))
 
 /**

packages/app/src/web/app-ready-terminal-pane.tsx

@@ -409,9 +409,7 @@ export const TerminalPane = (props: TerminalPaneProps): JSX.Element => {
             onFailure: () => { setCfState({ tag: "failed" }) },
             onSuccess: ({ hostname, sshPassword }) => {
               if (hostname === null) { setCfState({ tag: "failed" }); return }
-              setCfState((prev) =>
-                prev.tag === "ready" && prev.hostname === hostname ? prev : { tag: "ready", hostname, sshPassword }
-              )
+              setCfState({ tag: "ready", hostname, sshPassword })
             }
           })
         )