From 6798b718de057ad5ededdfb4c659bfbe853aa934 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 19 Jun 2026 17:56:25 +0100
Subject: [PATCH] fix(ssh): pin tunnel listener to loopback

---
 src/infra/ssh-tunnel.test.ts | 4 ++--
 src/infra/ssh-tunnel.ts      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/infra/ssh-tunnel.test.ts b/src/infra/ssh-tunnel.test.ts
index fca56c2e921f..2ceba9709827 100644
--- a/src/infra/ssh-tunnel.test.ts
+++ b/src/infra/ssh-tunnel.test.ts
@@ -70,7 +70,7 @@ describe("startSshPortForward", () => {
   function spawnFakeSshListening() {
     mocks.spawn.mockImplementation((_cmd: string, args: string[]) => {
       const forwardSpec = args[args.indexOf("-L") + 1] ?? "";
-      const localPort = Number(forwardSpec.split(":")[0]);
+      const localPort = Number(forwardSpec.split(":")[1]);
       const server = net.createServer();
       server.on("error", () => {});
       openServers.push(server);
@@ -146,7 +146,7 @@ describe("startSshPortForward", () => {
     expect(tunnel.localPort).toBeGreaterThan(0);
     expect(mocks.spawn).toHaveBeenCalledWith(
       "/usr/bin/ssh",
-      expect.arrayContaining(["-L", `${tunnel.localPort}:127.0.0.1:18789`]),
+      expect.arrayContaining(["-L", `127.0.0.1:${tunnel.localPort}:127.0.0.1:18789`]),
       expect.anything(),
     );
 
diff --git a/src/infra/ssh-tunnel.ts b/src/infra/ssh-tunnel.ts
index 763a495487a2..a6c9e945a60e 100644
--- a/src/infra/ssh-tunnel.ts
+++ b/src/infra/ssh-tunnel.ts
@@ -132,7 +132,7 @@ export async function startSshPortForward(opts: {
   const args = [
     "-N",
     "-L",
-    `${localPort}:127.0.0.1:${opts.remotePort}`,
+    `127.0.0.1:${localPort}:127.0.0.1:${opts.remotePort}`,
     "-p",
     String(parsed.port),
     "-o",