When a worktree runs inside a Docker sandbox, its ports are only
reachable via the container's bridge IP. socat forwards host ports to
the container so the browser (over SSH) can reach them.
- New socat.ts module manages forwarding lifecycle (start/stop/reconcile)
- Polls for container after creation (non-blocking, up to 30s)
- Kills orphaned socat on startup before re-establishing forwards
- Cleans up on worktree removal and SIGINT/SIGTERM
- Extract readEnvLocal to env.ts to break circular import
- Change isPortListening to HTTP fetch (avoids socat false positives)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
a4b440a20d