Merge commit from fork

src/backend/ssh/docker.ts

@@ -2138,12 +2138,19 @@ app.post("/docker/ssh/keepalive", async (req, res) => {
  */
 app.get("/docker/ssh/status", async (req, res) => {
   const sessionId = req.query.sessionId as string;
+  const userId = getRequestUserId(req);
 
   if (!sessionId) {
     return res.status(400).json({ error: "Session ID is required" });
   }
 
-  const isConnected = !!sshSessions[sessionId]?.isConnected;
+  if (!userId) {
+    return res.status(401).json({ error: "Authentication required" });
+  }
+
+  const session = sshSessions[sessionId];
+  const isConnected =
+    session?.userId === userId && session.isConnected === true;
 
   res.json({ success: true, connected: isConnected });
 });
@@ -2193,6 +2200,10 @@ app.get("/docker/validate/:sessionId", async (req, res) => {
     });
   }
 
+  if (session.userId !== userId) {
+    return res.status(403).json({ error: "Session access denied" });
+  }
+
   session.lastActive = Date.now();
   session.activeOperations++;