Function resolve_ssh_gateway

crates/openshell-core/src/forward.rs:711–748

Resolve the SSH gateway host and port for a sandbox connection. If the server-provided gateway host is a loopback address, use the host and port from the cluster endpoint instead so the client connects to the right machine. The server returns its internal bind address (e.g. 0.0.0.0:8080) which may not be reachable from outside — the cluster URL has the actual Docker-mapped or tunnel port.

(
    gateway_host: &str,
    gateway_port: u16,
    cluster_url: &str,
)

/// which may not be reachable from outside — the cluster URL has the actual
/// Docker-mapped or tunnel port.
pub fn resolve_ssh_gateway(
    gateway_host: &str,
    gateway_port: u16,
    cluster_url: &str,
) -> (String, u16) {
    let is_loopback = gateway_host == "127.0.0.1"
        || gateway_host == "0.0.0.0"
        || gateway_host == "localhost"
        || gateway_host == "::1";

    if !is_loopback {
        return (gateway_host.to_string(), gateway_port);
    }

    // Extract host and port from the cluster URL. The cluster URL represents
    // the externally reachable endpoint (e.g. Docker port-mapped address).
    if let Ok(url) = url::Url::parse(cluster_url)
        && let Some(host) = url.host_str()
    {
        let cluster_port = url.port_or_known_default().unwrap_or(gateway_port);
        let cluster_is_loopback =
            host == "127.0.0.1" || host == "0.0.0.0" || host == "localhost" || host == "::1";
        if !cluster_is_loopback {
            // Remote cluster: use the remote host but keep the cluster URL port.
            return (host.to_string(), cluster_port);
        }
        // Both endpoints loopback. The unspecified addresses (0.0.0.0 / ::)
        // are bind-only — they aren't valid connect targets and aren't in TLS
        // cert SANs, so fall back to the cluster URL's host (which the CLI
        // is already using to reach the gateway).
        if gateway_host == "0.0.0.0" || gateway_host == "::" {
            return (host.to_string(), cluster_port);
        }
        return (gateway_host.to_string(), cluster_port);
    }

    (gateway_host.to_string(), gateway_port)
}

/// Format a gateway URL, bracketing IPv6 literals when needed.
pub fn format_gateway_url(scheme: &str, host: &str, port: u16) -> String {