fix: sync scoped ssh runtime deploy env

scripts/src/deploy.ts

@@ -10,6 +10,7 @@ import { startJob } from "./jobs";
 import { coreInternalFetch } from "./microservices";
 import { codeQueueSourceImportPreflight, codeQueueSourceSubdir } from "./code-queue-source-guard";
 import { d601K3sGuardShellLines, d601NativeKubeconfig } from "./d601-k3s-guard";
+import { composeRuntimeEnvValue } from "./runtime-env";
 import {
   compareDeployJsonExecutorMirrors,
   deployJsonCommitImage,
@@ -1513,13 +1514,18 @@ function devK3sPrepullImages(service: UniDeskMicroserviceConfig): string[] {
 }
 
 function syncDevFrontendAuthScript(config: UniDeskConfig): string {
+  const sshClientToken = composeRuntimeEnvValue("UNIDESK_SSH_CLIENT_TOKEN");
+  if (sshClientToken === null) throw new Error("UNIDESK_SSH_CLIENT_TOKEN must be present in .state/docker-compose.env before deploying dev frontend");
+  const sshClientRouteAllowlist = composeRuntimeEnvValue("UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST") ?? "G14,G14:*,D601,D601:*";
   const data = {
     AUTH_USERNAME: Buffer.from(config.auth.username, "utf8").toString("base64"),
     AUTH_PASSWORD: Buffer.from(config.auth.password, "utf8").toString("base64"),
     SESSION_SECRET: Buffer.from(config.auth.sessionSecret, "utf8").toString("base64"),
+    UNIDESK_SSH_CLIENT_TOKEN: Buffer.from(sshClientToken, "utf8").toString("base64"),
   };
   const runtimeConfig = {
     SESSION_TTL_SECONDS: String(config.auth.sessionTtlSeconds),
+    UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST: sshClientRouteAllowlist,
   };
   return [
     "set -euo pipefail",