1 files changed, 19 insertions, 0 deletions
diff --git a/packages/exec-backend/src/service.ts b/packages/exec-backend/src/service.ts
index 81ea5fa..6cfa9de 100644
--- a/packages/exec-backend/src/service.ts
+++ b/packages/exec-backend/src/service.ts
@@ -25,3 +25,22 @@ export type ExecBackendResolver = (computerId?: string) => ExecBackend;
  * activation by `host-bin`).
  */
 export const execBackendHandle = defineService<ExecBackendResolver>("exec-backend/resolver");
+
+/**
+ * A factory the `ssh` extension provides: given a computerId (SSH alias),
+ * returns the remote `ExecBackend`. Absent (ssh not loaded) → remote execution
+ * is unconfigured.
+ *
+ * This is a **consumer-defined handle**: `exec-backend` (a core extension)
+ * declares it, and the `ssh` extension (a standard extension, built in a later
+ * wave) `host.provideService`s it. That direction (standard → core, consumer
+ * defines / provider implements) is the only layering that keeps the kernel free
+ * of any concrete feature name — `exec-backend` owns the seam, `ssh` plugs in.
+ *
+ * The resolver looks this up LAZILY at resolve time (tool-execute time, after
+ * all extensions have activated), so missing-the-provider degrades gracefully
+ * rather than crashing activation.
+ */
+export const remoteExecBackendFactoryHandle = defineService<(computerId: string) => ExecBackend>(
+	"exec-backend/remote-factory",
+);