Update open threads — host-based IDE deferred, Caddy root cause documented

OPEN_THREADS.md

@@ -95,32 +95,37 @@ Working flow:
 5. all live code-server HTTP + WS traffic proxied through `/__ide/:id/*`
 6. API proxies to `http://<container-ip>:8080`
 
-### Host-based IDE URL — Caddy edge (BLOCKED)
+### Host-based IDE URL — deferred
 
 Goal: open IDE on `dev-<vmid>.zerolaghub.dev` instead of raw API IP.
 
+State: reverted — Caddy removed, back to working path-based flow.
+
+Root cause understood: Express resolves relative redirects using the `Host`
+header. Without `header_up Host {host}` in Caddy, the bootstrap redirect fires
+as `http://10.60.0.245:4000/__ide/6070/` instead of staying on the clean hostname.
+
+When revisiting, the full Caddyfile block needed is:
+
 ```
-Browser → dev-6070.zerolaghub.dev → Caddy → 127.0.0.1:4000 → API
+{
+    auto_https off
+}
+
+http://dev-*.zerolaghub.dev {
+    @dev host dev-*.zerolaghub.dev
+    reverse_proxy @dev 127.0.0.1:4000 {
+        header_up Host {host}
+    }
+}
 ```
 
-State:
+`header_up Host {host}` is the critical line — without it Express loses the
-- API env vars set: `DEV_IDE_HOST_SUFFIX=zerolaghub.dev`, `DEV_IDE_RETURN_HOSTED_URL=true`
+hostname on every redirect.
-- API generating correct absolute URL: `http://dev-6070.zerolaghub.dev/?token=...`
-- Caddyfile block correct:
-  ```
-  http://dev-*.zerolaghub.dev {
-      @dev host dev-*.zerolaghub.dev
-      reverse_proxy @dev 127.0.0.1:4000
-  }
-  ```
-- `auto_https off` global option added
 
-Blocking issue: browser HSTS cache forces `zerolaghub.dev` subdomains to HTTPS
+API env vars already set and working:
-regardless of Caddy config. Need to clear Chrome HSTS cache:
+- `DEV_IDE_HOST_SUFFIX=zerolaghub.dev`
-- `chrome://net-internals/#hsts`
+- `DEV_IDE_RETURN_HOSTED_URL=true`
-- Delete `zerolaghub.dev` and `dev-6070.zerolaghub.dev`
-
-Resume here next session.
 
 ### Local Dev Access (Headscale/Tailscale — Future)
 
@@ -148,6 +153,7 @@ Completed:
 - `/__ide/:id/*` — live tunnel proxy (HTTP + WS, target-bound)
 - dev routing experiment removed (`devRouting.js`, `devDePublisher.js` deleted)
 - host-based URL generation (`DEV_IDE_HOST_SUFFIX`, `DEV_IDE_RETURN_HOSTED_URL`)
+- `handleHostedProxy` — host-based routing via `Host` header vmid extraction
 
 Outstanding: