@aaarc/handfree-ssh-mcp 1.0.2 → 1.0.3

package/README.md

@@ -268,7 +268,7 @@ Rules (enforced at config load — bad configs fail fast):
 - **Independent policy.** The target authenticates with its OWN `username` / `password` / `privateKey`, and its own `whitelist` / `blacklist` / `safeDirectory` / `allowed*Directories` apply. The jump host is purely transport.
 - **Jump host is still a normal server.** You can run tools against `bastion` directly; its connection is separate from the tunneling one.
 
-**Hot-reload note:** `jumpHost` is connection-level, not policy-level. Editing it in `servers.yaml` while the server is running will NOT take effect — the hot-reloader only refreshes whitelist / blacklist / `safeDirectory` / `allowed*Directories`. Restart the MCP server to pick up `jumpHost` changes.
+**Hot-reload note:** `jumpHost` is a connection-level field, so it hot-reloads. Editing a server's `jumpHost` (or any hop's connection fields) in `servers.yaml` resets the affected connection on the fly — the change takes effect on the next tool call, no restart needed. This is chain-aware: if an intermediate hop's host / port / credentials change, every target that tunnels through it is reset too.
 
 ### Connection lifecycle (connect / reconnect)
 

package/build/config/server.js

@@ -1,6 +1,6 @@
 export const SERVER_CONFIG = {
     name: "ssh-mcp-server",
-    version: "1.0.2",
+    version: "1.0.3",
 };
 export const SERVER_INSTRUCTIONS = `This server provides SSH access to servers loaded from OpenSSH config (~/.ssh/config by default) and optional YAML config/policy overlays.
 

package/build/services/ssh-connection-manager.js

@@ -116,18 +116,52 @@ export class SSHConnectionManager {
      */
     replaceConfig(configs, enabledServers) {
         const previous = this.configs;
-        const changedConnections = [];
+        // Pass 1: servers whose own connection fields changed (or that vanished).
+        const directlyChanged = new Set();
         for (const [name, oldConfig] of Object.entries(previous)) {
             const nextConfig = configs[name];
             if (!nextConfig || this.connectionFieldsChanged(oldConfig, nextConfig)) {
-                this.closeClient(name, true);
-                this.statusCache.delete(name);
-                changedConnections.push(name);
+                directlyChanged.add(name);
             }
         }
+        // Pass 2: a target must ALSO reset if any hop in its jump chain directly
+        // changed — otherwise it keeps tunneling through a stale intermediate hop.
+        // Walk both the old and new chains so topology shifts (added/removed hops)
+        // are covered too.
+        const toReset = new Set(directlyChanged);
+        for (const name of Object.keys(previous)) {
+            if (toReset.has(name))
+                continue;
+            if (this.jumpChainTouchesChanged(name, previous, directlyChanged) ||
+                this.jumpChainTouchesChanged(name, configs, directlyChanged)) {
+                toReset.add(name);
+            }
+        }
+        for (const name of toReset) {
+            this.closeClient(name, true);
+            this.statusCache.delete(name);
+        }
         this.setConfig(configs, enabledServers);
         Logger.log(`Hot-reloaded SSH config: ${Object.keys(configs).length} server(s), ` +
-            `${changedConnections.length} connection(s) reset`, "info");
+            `${toReset.size} connection(s) reset`, "info");
+    }
+    /**
+     * Walk `name`'s jump chain in `configMap` and report whether any hop is in the
+     * `changed` set. Guards against cycles defensively (config load rejects them).
+     * @private
+     */
+    jumpChainTouchesChanged(name, configMap, changed) {
+        const seen = new Set([name]);
+        let hop = configMap[name]?.jumpHost;
+        while (hop !== undefined) {
+            if (changed.has(hop))
+                return true;
+            if (seen.has(hop))
+                break;
+            seen.add(hop);
+            hop = configMap[hop]?.jumpHost;
+        }
+        return false;
     }
     /**
      * Set the root directory under which execute-command full-output logs are

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aaarc/handfree-ssh-mcp",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Handfree SSH MCP Server - A hands-free SSH automation tool via MCP protocol",
   "main": "build/index.js",
   "type": "module",