When forwarding multiple ports concurrently with gh cs ports forward, the dev-tunnels TunnelManager mutates shared state on the Tunnel object in buildUri(), which isn't goroutine-safe. This causes a fatal error: concurrent map writes panic.

Root cause

ForwardPorts runs all port forwards concurrently via errgroup, sharing a single CodespaceConnection. The shallow copy in NewPortForwarder means all forwarders share the same TunnelManager and Tunnel pointers, so concurrent calls to GetTunnelPort / CreateTunnelPort race on the shared map.

Fix

• Added a *sync.Mutex (ManagerMu) to CodespaceConnection (as a pointer so it survives the struct value copy in NewPortForwarder)
• Locked around all TunnelManager operations that touch the shared Tunnel object
• Connect and RefreshPorts already have their own synchronization and are left outside the lock

Test

Added TestConcurrentForwardPortDoesNotRace which forwards 10 ports concurrently from a shared connection, reproducing the race detected by go test -race.