Terminal without an open port: the agent calls back, and the SSH dialog shows its state

Bamboo reports where its SSH server listens. When a terminal is opened,
Hammerhead lists the session in the site's config and the agent connects out and
joins that connection to its SSH server; Hammerhead signs in over it. No port
resource or edge is involved. A site whose Bamboo does not report an SSH server
still works through an SSH port. The long poll now returns at once for a session
the agent has not been told about, so a request between two polls is not missed.

The SSH dialog shows whether the SSH server is running, says when no port is
needed, and offers the port only for an ordinary ssh client. Builds against Reef
v0.1.12 and Bamboo v0.1.9.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

store.go

@@ -210,6 +210,7 @@ type Server struct {
 	mailChecks map[string]model.MailCheck           // mail egress ID -> the edge's deliverability report
 	containers map[string][]model.Container         // by site ID
 	discovered map[string][]model.DiscoveredService // by site ID: suggested targets the agent found
+	terms      map[string]*pendingTerm              // terminal sessions waiting for an agent to call back, by session ID
 	changed    chan struct{}
 
 	tickets map[string]ticket
@@ -263,6 +264,7 @@ func New(dir string, opts Options) (*Server, error) {
 		mailChecks: map[string]model.MailCheck{},
 		containers: map[string][]model.Container{},
 		discovered: map[string][]model.DiscoveredService{},
+		terms:      map[string]*pendingTerm{},
 		changed:    make(chan struct{}),
 		tickets:    map[string]ticket{},
 		oauth:      map[string]oauthState{},
@@ -412,9 +414,15 @@ func (s *Server) bump() {
 }
 
 // wait blocks until the version moves past have, or 25s pass. It returns false on timeout.
-func (s *Server) wait(r *http.Request, have int64) bool {
+func (s *Server) wait(r *http.Request, have int64) bool { return s.waitUntil(r, have, nil) }
+
+// waitUntil is wait that also returns at once when ready (called with s.mu held) says there is
+// something to deliver that does not move the version, such as a terminal waiting for an agent.
+// Checking it under the same lock that takes the change channel is what keeps a request that
+// arrives between two polls from being missed.
+func (s *Server) waitUntil(r *http.Request, have int64, ready func() bool) bool {
 	s.mu.Lock()
-	if s.st.Version > have {
+	if s.st.Version > have || (ready != nil && ready()) {
 		s.mu.Unlock()
 		return true
 	}