Add authorized TCP pipe forwarding

docs/architecture.md

@@ -213,8 +213,13 @@ uses the dedicated `/geth/pipe/1` ALPN to write a byte message to a peer
 listener after the same endpoint/card and capability checks. `geth pipe recv
 <name>` drains local daemon-lifetime messages. `geth pipe listen <name> --node
 <node-id>` can also ask a peer to register a daemon-lifetime listener after
-checking `pipe.listen` on the same resource. Long-lived stdin/stdout streams and
-TCP/Unix forwarding are still future work.
+checking `pipe.listen` on the same resource. `geth pipe forward-tcp --listen
+127.0.0.1:<local-port> --node <node-id> --target 127.0.0.1:<remote-port>` runs a
+local loopback listener and opens one authorized `/geth/pipe/1` byte stream per
+accepted connection. The remote daemon validates endpoint/card binding and
+requires `pipe.forward` on `resource:pipe-tcp:<target>` before connecting to the
+remote loopback TCP target. TCP forwarding is loopback-only in the prototype;
+Unix socket forwarding is still future work.
 
 `geth-ssh-proxy` defines proxy target and connection metadata. `geth ssh proxy
 <node>` is a streaming command intended for OpenSSH `ProxyCommand`: the CLI

docs/roadmap.md

@@ -369,14 +369,21 @@ Goal: add authorized stream-oriented management workflows over Iroh.
   - `[x]` `geth pipe recv <name>` drains daemon-lifetime pipe messages.
   - `[x]` Remote pipe send requires `pipe.connect` on
     `resource:pipe:<name>`.
-  - `[ ]` Pipe connect carries bidirectional byte streams over Iroh.
-  - `[ ]` Streams close cleanly and propagate errors.
+  - `[x]` TCP forwarding carries bidirectional byte streams over Iroh.
+  - `[x]` TCP streams close cleanly and propagate errors through the local
+    forwarder logs.
 
-- `[ ]` TCP forwarding.
+- `[~]` TCP forwarding.
   Acceptance criteria:
-  - A local TCP listener can forward over an authorized Iroh pipe.
-  - Tests cover basic request/response forwarding.
-  - Forwarding is resource-scoped and can be disabled by auth.
+  - `[x]` A local loopback TCP listener can forward over an authorized Iroh
+    pipe with `geth pipe forward-tcp`.
+  - `[x]` The remote side connects only to explicit loopback socket addresses
+    in the prototype.
+  - `[x]` Forwarding is resource-scoped with `pipe.forward` on
+    `resource:pipe-tcp:<target>`.
+  - `[x]` Tests cover address validation and TCP pipe wire
+    request/response serialization.
+  - `[ ]` Tests cover a full two-node request/response forwarding exchange.
 
 - `[ ]` Unix socket forwarding where supported.
   Acceptance criteria: