refactor(ports): own the remote route argv vocabulary in one place

The persisted SSH route argv now uses exported ports constants, and the CLI
parses the hidden mux helpers through the same constants instead of a
duplicated spelling. The session admission comment names the real
admission-less path: the direct local daemon socket.

commit: fbbc30c8ecadd232dcf318ca86ddfb507c98d5b2
author: brice · 14d ago · 2026-10-08 05:11 UTC
parent: 48eff4c
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

3 files · +19 -9

M internal/app/broker_offline_mux.go +3 -3


@@ -65,9 +65,9 @@ import (
65	65
66	66		const (
67	67		// brokerMuxStdioCommand is the hidden remote SSH stdio mux bridge.
68		-	brokerMuxStdioCommand = "_broker-mux-stdio"
	68	+	brokerMuxStdioCommand = ports.BrokerMuxStdioCommand
69	69		// brokerMuxQUICBootstrapCommand is the hidden remote QUIC mux bootstrap.
70		-	brokerMuxQUICBootstrapCommand = "_broker-mux-quic-bootstrap"
	70	+	brokerMuxQUICBootstrapCommand = ports.BrokerMuxQUICBootstrapCommand
71	71		// brokerMuxQUICProxyCommand is the hidden detached remote QUIC mux proxy.
72	72		brokerMuxQUICProxyCommand = "_broker-mux-quic-proxy"
73	73		)

@@ -105,7 +105,7 @@ const brokerDaemonStartArg = "--daemon-start"
105	105
106	106		// brokerScopeArg is the scope flag carried by every durable remote route argv
107	107		// (see ports.BrokerRouteForTransport). Stored routes keep it verbatim.
108		-	const brokerScopeArg = "--production"
	108	+	const brokerScopeArg = ports.BrokerRouteScopeArg
109	109
110	110		// brokerMuxOptions is the parsed hidden mux helper invocation.
111	111		type brokerMuxOptions struct {


@@ -65,9 +65,9 @@ import (
65			65
66		const (	66		const (
67		// brokerMuxStdioCommand is the hidden remote SSH stdio mux bridge.	67		// brokerMuxStdioCommand is the hidden remote SSH stdio mux bridge.
68	-	brokerMuxStdioCommand = "_broker-mux-stdio"	68	+	brokerMuxStdioCommand = ports.BrokerMuxStdioCommand
69		// brokerMuxQUICBootstrapCommand is the hidden remote QUIC mux bootstrap.	69		// brokerMuxQUICBootstrapCommand is the hidden remote QUIC mux bootstrap.
70	-	brokerMuxQUICBootstrapCommand = "_broker-mux-quic-bootstrap"	70	+	brokerMuxQUICBootstrapCommand = ports.BrokerMuxQUICBootstrapCommand
71		// brokerMuxQUICProxyCommand is the hidden detached remote QUIC mux proxy.	71		// brokerMuxQUICProxyCommand is the hidden detached remote QUIC mux proxy.
72		brokerMuxQUICProxyCommand = "_broker-mux-quic-proxy"	72		brokerMuxQUICProxyCommand = "_broker-mux-quic-proxy"
73		)	73		)

@@ -105,7 +105,7 @@ const brokerDaemonStartArg = "--daemon-start"
105			105
106		// brokerScopeArg is the scope flag carried by every durable remote route argv	106		// brokerScopeArg is the scope flag carried by every durable remote route argv
107		// (see ports.BrokerRouteForTransport). Stored routes keep it verbatim.	107		// (see ports.BrokerRouteForTransport). Stored routes keep it verbatim.
108	-	const brokerScopeArg = "--production"	108	+	const brokerScopeArg = ports.BrokerRouteScopeArg
109			109
110		// brokerMuxOptions is the parsed hidden mux helper invocation.	110		// brokerMuxOptions is the parsed hidden mux helper invocation.
111		type brokerMuxOptions struct {	111		type brokerMuxOptions struct {

M internal/ports/broker_store.go +13 -4


@@ -90,14 +90,23 @@ func (r BrokerRouteSpec) Clone() BrokerRouteSpec {
90	90		return r
91	91		}
92	92
93		-	// BrokerRouteForTransport maps the closed legacy policy transport vocabulary
94		-	// to canonical remote routes.
	93	+	// Remote helper argv vocabulary. Durable SSH routes store this argv verbatim,
	94	+	// so these spellings are part of the persisted route contract; the CLI parses
	95	+	// the same constants.
	96	+	const (
	97	+	BrokerMuxStdioCommand = "_broker-mux-stdio"
	98	+	BrokerMuxQUICBootstrapCommand = "_broker-mux-quic-bootstrap"
	99	+	BrokerRouteScopeArg = "--production"
	100	+	)
	101	+
	102	+	// BrokerRouteForTransport maps the closed policy transport vocabulary to the
	103	+	// canonical remote route.
95	104		func BrokerRouteForTransport(transport, endpoint string) (BrokerRouteSpec, error) {
96	105		switch transport {
97	106		case "ssh-stdio", "stdio":
98		-	return BrokerRouteSpec{Kind: BrokerRouteSSHStdio, Target: endpoint, Argv: []string{"vev", "_broker-mux-stdio", "--production"}}, nil
	107	+	return BrokerRouteSpec{Kind: BrokerRouteSSHStdio, Target: endpoint, Argv: []string{"vev", BrokerMuxStdioCommand, BrokerRouteScopeArg}}, nil
99	108		case "ssh-quic", "quic":
100		-	return BrokerRouteSpec{Kind: BrokerRouteSSHQUIC, Target: endpoint, Argv: []string{"vev", "_broker-mux-quic-bootstrap", "--production"}}, nil
	109	+	return BrokerRouteSpec{Kind: BrokerRouteSSHQUIC, Target: endpoint, Argv: []string{"vev", BrokerMuxQUICBootstrapCommand, BrokerRouteScopeArg}}, nil
101	110		default:
102	111		return BrokerRouteSpec{}, fmt.Errorf("ports: unsupported broker transport %q", transport)
103	112		}

 	return r
 }
-// BrokerRouteForTransport maps the closed legacy policy transport vocabulary
+// Remote helper argv vocabulary. Durable SSH routes store this argv verbatim,
-// to canonical remote routes.
+// so these spellings are part of the persisted route contract; the CLI parses
+// the same constants.
+const (
+	BrokerMuxStdioCommand         = "_broker-mux-stdio"
+	BrokerMuxQUICBootstrapCommand = "_broker-mux-quic-bootstrap"
+	BrokerRouteScopeArg           = "--production"
+)
+// BrokerRouteForTransport maps the closed policy transport vocabulary to the
+// canonical remote route.
 func BrokerRouteForTransport(transport, endpoint string) (BrokerRouteSpec, error) {
 	switch transport {
 	case "ssh-stdio", "stdio":
-		return BrokerRouteSpec{Kind: BrokerRouteSSHStdio, Target: endpoint, Argv: []string{"vev", "_broker-mux-stdio", "--production"}}, nil
+		return BrokerRouteSpec{Kind: BrokerRouteSSHStdio, Target: endpoint, Argv: []string{"vev", BrokerMuxStdioCommand, BrokerRouteScopeArg}}, nil
 	case "ssh-quic", "quic":
-		return BrokerRouteSpec{Kind: BrokerRouteSSHQUIC, Target: endpoint, Argv: []string{"vev", "_broker-mux-quic-bootstrap", "--production"}}, nil
+		return BrokerRouteSpec{Kind: BrokerRouteSSHQUIC, Target: endpoint, Argv: []string{"vev", BrokerMuxQUICBootstrapCommand, BrokerRouteScopeArg}}, nil
 	default:
 		return BrokerRouteSpec{}, fmt.Errorf("ports: unsupported broker transport %q", transport)
 	}

M internal/ports/session_admission.go +3 -2


@@ -165,8 +165,9 @@ func (a SessionAdmission) Clone() SessionAdmission {
165	165		// SessionAdmissionProvider is the optional boundary-safe port a typed accepted
166	166		// server connection implements when the accepting side stamped admission
167	167		// metadata onto it. A daemon-consuming use case asserts it structurally; a
168		-	// connection built by a legacy constructor that carries no provisioned
169		-	// admission reports ok=false rather than a zero admission.
	168	+	// connection accepted without provisioned admission (the direct local daemon
	169	+	// socket used by broker-less list and stop commands) reports ok=false rather
	170	+	// than a zero admission, and the daemon applies standard Hello validation.
170	171		//
171	172		// The returned value is a defensive copy: mutating it never alters the
172	173		// connection's admitted authority, and concurrent readers each receive their


@@ -165,8 +165,9 @@ func (a SessionAdmission) Clone() SessionAdmission {
165		// SessionAdmissionProvider is the optional boundary-safe port a typed accepted	165		// SessionAdmissionProvider is the optional boundary-safe port a typed accepted
166		// server connection implements when the accepting side stamped admission	166		// server connection implements when the accepting side stamped admission
167		// metadata onto it. A daemon-consuming use case asserts it structurally; a	167		// metadata onto it. A daemon-consuming use case asserts it structurally; a
168	-	// connection built by a legacy constructor that carries no provisioned	168	+	// connection accepted without provisioned admission (the direct local daemon
169	-	// admission reports ok=false rather than a zero admission.	169	+	// socket used by broker-less list and stop commands) reports ok=false rather
			170	+	// than a zero admission, and the daemon applies standard Hello validation.
170		//	171		//
171		// The returned value is a defensive copy: mutating it never alters the	172		// The returned value is a defensive copy: mutating it never alters the
172		// connection's admitted authority, and concurrent readers each receive their	173		// connection's admitted authority, and concurrent readers each receive their