[zyjohn-design]

Fixes #8

Client tunnels left the desktop's local socket open after the target closed its side of the connection. Browsers reused that dead keep-alive connection, so the next request stayed pending forever. One example: the LiteLLM login after its 5-second idle timeout.

The relay in c2s-relay.ts now also closes the WebSocket when the outbound SSH channel emits end. Before, it only closed on close and error. The existing close handler then destroys the channel, and the desktop closes the local socket. This matches how ssh -D behaves.

Validation:

• New test in tests/backend/c2s-relay.test.ts half-closes the outbound stream of a LOCAL tunnel and expects the relay to close. It fails without the change and passes with it.
• npm test (153 passed), tsc -p ., npm run validate, npm run format:check.
• Applied the same change to a running Termix server. Through a DYNAMIC tunnel, an idle connection to LiteLLM now gets EOF after 5 s instead of never, and the login request returns normally.

This is independent of #7, which fixes the desktop-side first-data race.

[termix-triage-bot]

AI review | Looks safe to merge

Adds an end event listener to the outbound SSH channel stream to propagate half-closed connections to the WebSocket, fixing browser keep-alive hangs. The change is minimal, includes a targeted test, and follows all repo rules.

_{Reviewed f6f4f43. AI can be wrong, a maintainer still decides. Comment /termix review to run it again.}