Fix overlay SSH port mapping, connection retry, and error handling robustness

- Use tunnel-mapped SSH port for overlay mount instead of original port
- Add retry with exponential backoff for initial SSH/SFTP connection
- Add SSH connection timeout (10s) to prevent indefinite hangs
- Replace fmt.Sscanf with strconv.Atoi in toInt() for proper error handling
- Log malformed port mappings in devtunnel CLI instead of silently accepting
- Log process kill errors in devtunnel host restart
- Fix off-by-one in overlay retry attempt logging
- Add mapped_ssh_port output from tunnel connect actions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: yasithdev

internal/workflow/actions.go

@@ -130,6 +130,18 @@ func actionDevTunnelConnect(params map[string]any) (*ActionResult, error) {
 		"command_id": cmdID,
 		"port_map":   portMapStr,
 	}
+
+	// If ssh_port was provided, resolve the mapped local port for the overlay
+	if sshPort := toInt(params["ssh_port"]); sshPort != 0 {
+		if mapped, ok := portMap[sshPort]; ok {
+			result["mapped_ssh_port"] = mapped
+			log.Printf("[tunnel.devtunnel_connect] mapped SSH port %d -> %d", sshPort, mapped)
+		} else {
+			log.Printf("[tunnel.devtunnel_connect] warning: SSH port %d not found in port map", sshPort)
+			result["mapped_ssh_port"] = sshPort // fallback to original
+		}
+	}
+
 	return &result, nil
 }
 
@@ -316,10 +328,23 @@ func actionTunnelConnect(params map[string]any) (*ActionResult, error) {
 		portMapStr[strconv.Itoa(remote)] = local
 	}
 
-	return &ActionResult{
+	result := ActionResult{
 		"connection_id": cr.ConnectionID,
 		"port_map":      portMapStr,
-	}, nil
+	}
+
+	// If ssh_port was provided, resolve the mapped local port for the overlay
+	if sshPort := toInt(params["ssh_port"]); sshPort != 0 {
+		if mapped, ok := cr.PortMap[sshPort]; ok {
+			result["mapped_ssh_port"] = mapped
+			log.Printf("[tunnel.connect] mapped SSH port %d -> %d", sshPort, mapped)
+		} else {
+			log.Printf("[tunnel.connect] warning: SSH port %d not found in port map", sshPort)
+			result["mapped_ssh_port"] = sshPort
+		}
+	}
+
+	return &result, nil
 }
 
 // --- tunnel.disconnect (provider-agnostic) ---
@@ -384,9 +409,10 @@ func toInt(v any) int {
 	case float64:
 		return int(val)
 	case string:
-		// Support template-resolved numeric strings.
-		var n int
-		fmt.Sscanf(val, "%d", &n)
+		n, err := strconv.Atoi(strings.TrimSpace(val))
+		if err != nil {
+			return 0
+		}
 		return n
 	default:
 		return 0

subsystems/mount/overlayfs.go

@@ -180,11 +180,26 @@ func MountOverlayFS(sshAddr, remoteRoot, upperDir, mountDir string) (*OverlayFS,
 		User:            "linkspan",
 		Auth:            []ssh.AuthMethod{},
 		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+		Timeout:         10 * time.Second,
 	}
 
-	rsftp, err := newReconnectingSftpClient(sshAddr, sshConfig)
-	if err != nil {
-		return nil, err
+	// Retry the initial SSH/SFTP connection — tunnel forwarded ports may
+	// not be ready immediately after devtunnel connect reports them.
+	var rsftp *reconnectingSftpClient
+	delays := []time.Duration{0, 1 * time.Second, 2 * time.Second, 4 * time.Second, 8 * time.Second}
+	var lastErr error
+	for i, delay := range delays {
+		if delay > 0 {
+			log.Printf("[overlayfs] SSH to %s failed (attempt %d/%d), retrying in %s: %v", sshAddr, i+1, len(delays), delay, lastErr)
+			time.Sleep(delay)
+		}
+		rsftp, lastErr = newReconnectingSftpClient(sshAddr, sshConfig)
+		if lastErr == nil {
+			break
+		}
+	}
+	if lastErr != nil {
+		return nil, lastErr
 	}
 
 	root := &overlayNode{

subsystems/tunnel/devtunnel.go

@@ -130,7 +130,9 @@ func DevTunnelForward(tunnelName string, port int, authToken string) error {
 	// No -p flags needed — ports are registered via SDK and forwarded by the relay.
 	if devTunInfo.HostCmdID != "" {
 		log.Printf("devtunnel forward: restarting host for %q", tunnelName)
-		_ = pm.GlobalProcessManager.Kill(devTunInfo.HostCmdID)
+		if err := pm.GlobalProcessManager.Kill(devTunInfo.HostCmdID); err != nil {
+			log.Printf("devtunnel forward: failed to kill old host process %s: %v", devTunInfo.HostCmdID, err)
+		}
 
 		hostToken := devTunInfo.HostToken
 		if hostToken == "" {

subsystems/tunnel/devtunnel_cli.go

@@ -222,8 +222,12 @@ func CLIConnectTunnel(tunnelID string, accessToken string) (commandID string, po
 			// Parse port map from output
 			portMap = make(map[int]int) // remotePort → localPort
 			for _, match := range forwardRe.FindAllStringSubmatch(combined, -1) {
-				localPort, _ := strconv.Atoi(match[1])
-				remotePort, _ := strconv.Atoi(match[2])
+				localPort, err1 := strconv.Atoi(match[1])
+				remotePort, err2 := strconv.Atoi(match[2])
+				if err1 != nil || err2 != nil {
+					log.Printf("devtunnel cli: skipping malformed port mapping %q → %q", match[1], match[2])
+					continue
+				}
 				portMap[remotePort] = localPort
 			}
 			log.Printf("devtunnel cli: connect established for tunnel %s (ports=%v)", tunnelID, portMap)