@judaharagao/opencode-ssh 1.0.0 → 1.2.0

package/README.md

@@ -12,6 +12,11 @@ SSH access plugin for OpenCode — secure remote command execution with command
 - 📤 **File Transfer** — Upload and download files via SCP/SFTP
 - 🎯 **Command Safety Checker** — Preview command safety before execution
 - ⚙️ **Configurable Policies** — Add custom blocklist/allowlist patterns
+- 🛤️ **Proxy Support** — `ProxyJump` and `ProxyCommand` from your ssh config
+- 🛡️ **Host Key Verification** — optional `strict_host_key` MITM protection via `known_hosts`
+- ⏳ **Rate Limiting** — per-host command rate limit and cooldown
+- 🔁 **Auto-Reconnect** — dropped sessions reconnect automatically on the next command
+- 🔐 **Credential Hygiene** — passwords are cleared from memory after a successful handshake
 
 ## Installation
 
@@ -48,6 +53,37 @@ Or with configuration:
 | `audit_enabled` | boolean | `true` | Enable audit logging |
 | `blocklist_extra` | string[] | `[]` | Additional regex patterns to block |
 | `allowlist` | string[] | `[]` | Additional allowed patterns (restricted mode) |
+| `ssh_config_path` | string | `~/.ssh/config` | Path to the SSH config file used to resolve host aliases, defaults, proxies, and auto-connect targets |
+| `auto_connect` | boolean | `false` | Connect automatically at startup to every `Host` entry in the ssh config that has a `HostName` (with retry/backoff) |
+| `auto_reconnect` | boolean | `true` | Reconnect a dropped session automatically before the next `ssh.exec`/`ssh.upload`/`ssh.download` (key-authenticated sessions) |
+| `strict_host_key` | boolean | `false` | Reject connections whose host key is not an exact match in `~/.ssh/known_hosts` (MITM protection) |
+| `rate_limit_per_minute` | number | `120` | Max commands allowed per host per minute |
+| `cooldown_seconds` | number | `0` | Minimum delay (seconds) between commands on the same host |
+
+## SSH Config Integration
+
+The plugin can reuse your existing `~/.ssh/config` (or a custom path via `ssh_config_path`):
+
+- **Host resolution** — `ssh.connect(host="myalias")` resolves the alias to its `HostName`, and automatically applies the `User`, `Port` and `IdentityFile` from the config. `username`, `port` and `auth_method`/`key_path` become optional when configured.
+- **ProxyJump / ProxyCommand** — `ProxyJump` and `ProxyCommand` directives in the ssh config are honored, so connections route through bastion/jump hosts transparently.
+- **Auto-connect** — with `"auto_connect": true`, the plugin connects at startup to every `Host` entry that has a `HostName`, using the configured key (or `~/.ssh/id_rsa`). Unreachable hosts are retried with backoff and skipped without blocking startup.
+- **Missing file alert** — if `ssh_config_path` points to a file that does not exist, the plugin warns on connect instead of silently ignoring the setting.
+
+Example ssh config:
+
+```
+Host prod-web
+    HostName 10.0.0.10
+    User deploy
+    Port 2222
+    IdentityFile ~/.ssh/prod_key
+
+Host prod-db
+    HostName 10.0.0.50
+    ProxyJump jumpuser@bastion:2200
+```
+
+With `ssh.connect(host="prod-web")` the plugin connects to `deploy@10.0.0.10:2222` using `~/.ssh/prod_key`. `prod-db` is reached tunneled through `bastion`.
 
 ## Security Modes
 
@@ -136,6 +172,12 @@ ssh.audit_log(session_id="prod-server", command_filter="docker")
 
 ## Security
 
+### Host Key Verification
+With `"strict_host_key": true` the plugin verifies the remote server's host key against `~/.ssh/known_hosts` before completing the handshake:
+- a **matching** key → connection allowed;
+- a **changed** key (possible MITM) → connection refused;
+- an **unknown** host → connection refused (add the host key to `known_hosts` first, e.g. via `ssh-keyscan host >> ~/.ssh/known_hosts`).
+
 ### Destructive Commands (100% Blocked)
 These commands are **permanently blocked** with no exceptions:
 
@@ -162,7 +204,8 @@ These commands require your explicit approval each time:
 ### Credential Safety
 - Passwords and SSH keys are **never** stored in logs or output
 - Session info only contains host, username, and port
-- Credentials are held in memory only during the session
+- Passwords are cleared from memory right after a successful handshake
+- For this reason password-authenticated sessions do **not** auto-reconnect (re-issue `ssh.connect`); key-authenticated sessions reconnect automatically from the on-disk key
 - All sessions are destroyed when the plugin is disposed
 
 ## Audit Log

package/dist/config/schema.d.ts

@@ -27,6 +27,14 @@ export declare const SshPluginConfig: z.ZodObject<{
     ssh_config_path: z.ZodOptional<z.ZodString>;
     /** Auto-connect on plugin boot (requires saved session) */
     auto_connect: z.ZodDefault<z.ZodBoolean>;
+    /** Reconnect a dropped session automatically on the next command */
+    auto_reconnect: z.ZodDefault<z.ZodBoolean>;
+    /** Reject hosts whose key is not in known_hosts (MITM protection) */
+    strict_host_key: z.ZodDefault<z.ZodBoolean>;
+    /** Max commands allowed per host per minute (rate limiting) */
+    rate_limit_per_minute: z.ZodDefault<z.ZodNumber>;
+    /** Minimum delay in seconds between commands on the same host (cooldown) */
+    cooldown_seconds: z.ZodDefault<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
     mode: "full" | "restricted" | "read_only";
     max_sessions: number;
@@ -35,6 +43,10 @@ export declare const SshPluginConfig: z.ZodObject<{
     blocklist_extra: string[];
     allowlist: string[];
     auto_connect: boolean;
+    auto_reconnect: boolean;
+    strict_host_key: boolean;
+    rate_limit_per_minute: number;
+    cooldown_seconds: number;
     ssh_config_path?: string | undefined;
 }, {
     mode?: "full" | "restricted" | "read_only" | undefined;
@@ -45,6 +57,10 @@ export declare const SshPluginConfig: z.ZodObject<{
     allowlist?: string[] | undefined;
     ssh_config_path?: string | undefined;
     auto_connect?: boolean | undefined;
+    auto_reconnect?: boolean | undefined;
+    strict_host_key?: boolean | undefined;
+    rate_limit_per_minute?: number | undefined;
+    cooldown_seconds?: number | undefined;
 }>;
 export type SshPluginConfigType = z.infer<typeof SshPluginConfig>;
 export declare const DEFAULT_CONFIG: SshPluginConfigType;

package/dist/config/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,eAAO,MAAM,YAAY,gDAA8C,CAAA;AACvE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,eAAe;IAExB,0CAA0C;;IAG1C,sCAAsC;;IAGtC,yCAAyC;;IAGzC,sCAAsC;;IAGtC,2DAA2D;;IAG3D,qEAAqE;;IAGrE,8CAA8C;;IAG9C,2DAA2D;;;;;;;;;;;;;;;;;;;;EAGpD,CAAA;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEjE,eAAO,MAAM,cAAc,EAAE,mBAQ5B,CAAA"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,eAAO,MAAM,YAAY,gDAA8C,CAAA;AACvE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,eAAe;IAExB,0CAA0C;;IAG1C,sCAAsC;;IAGtC,yCAAyC;;IAGzC,sCAAsC;;IAGtC,2DAA2D;;IAG3D,qEAAqE;;IAGrE,8CAA8C;;IAG9C,2DAA2D;;IAG3D,oEAAoE;;IAGpE,qEAAqE;;IAGrE,+DAA+D;;IAG/D,4EAA4E;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGrE,CAAA;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEjE,eAAO,MAAM,cAAc,EAAE,mBAY5B,CAAA"}

package/dist/config/schema.js

@@ -27,6 +27,14 @@ export const SshPluginConfig = z
     ssh_config_path: z.string().optional(),
     /** Auto-connect on plugin boot (requires saved session) */
     auto_connect: z.boolean().default(false),
+    /** Reconnect a dropped session automatically on the next command */
+    auto_reconnect: z.boolean().default(true),
+    /** Reject hosts whose key is not in known_hosts (MITM protection) */
+    strict_host_key: z.boolean().default(false),
+    /** Max commands allowed per host per minute (rate limiting) */
+    rate_limit_per_minute: z.number().int().min(1).max(10000).default(120),
+    /** Minimum delay in seconds between commands on the same host (cooldown) */
+    cooldown_seconds: z.number().int().min(0).max(3600).default(0),
 })
     .strict();
 export const DEFAULT_CONFIG = {
@@ -37,5 +45,9 @@ export const DEFAULT_CONFIG = {
     blocklist_extra: [],
     allowlist: [],
     auto_connect: false,
+    auto_reconnect: true,
+    strict_host_key: false,
+    rate_limit_per_minute: 120,
+    cooldown_seconds: 0,
 };
 //# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;AAGvE;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,0CAA0C;IAC1C,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;IAElC,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAExD,yCAAyC;IACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,sCAAsC;IACtC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAExC,2DAA2D;IAC3D,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEhD,qEAAqE;IACrE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE1C,8CAA8C;IAC9C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEtC,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAA;AAIX,MAAM,CAAC,MAAM,cAAc,GAAwB;IACjD,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,CAAC;IACf,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,EAAE;IACnB,SAAS,EAAE,EAAE;IACb,YAAY,EAAE,KAAK;CACpB,CAAA"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;AAGvE;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,0CAA0C;IAC1C,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;IAElC,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAExD,yCAAyC;IACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,sCAAsC;IACtC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAExC,2DAA2D;IAC3D,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEhD,qEAAqE;IACrE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE1C,8CAA8C;IAC9C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEtC,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAExC,oEAAoE;IACpE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAEzC,qEAAqE;IACrE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE3C,+DAA+D;IAC/D,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAEtE,4EAA4E;IAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D,CAAC;KACD,MAAM,EAAE,CAAA;AAIX,MAAM,CAAC,MAAM,cAAc,GAAwB;IACjD,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,CAAC;IACf,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,EAAE;IACnB,SAAS,EAAE,EAAE;IACb,YAAY,EAAE,KAAK;IACnB,cAAc,EAAE,IAAI;IACpB,eAAe,EAAE,KAAK;IACtB,qBAAqB,EAAE,GAAG;IAC1B,gBAAgB,EAAE,CAAC;CACpB,CAAA"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;;;;;AAyBjD,wBAGC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;;;;;AA4DjD,wBAGC"}

package/dist/index.js

@@ -1,11 +1,41 @@
 import { createSshTools } from "./tools.js";
 import { createSshHooks } from "./hooks.js";
 import { resolveConfig } from "./config/defaults.js";
-const SshPlugin = async (_ctx, options) => {
+/**
+ * Validate that the host opencode runtime exposes the tool-building API this
+ * plugin depends on. If the runtime is too old/incompatible, tools are
+ * disabled instead of crashing at call time.
+ */
+function validatePluginApi(ctx) {
+    const c = ctx;
+    if (!c || typeof c !== "object") {
+        return { ok: false, reason: "Plugin context is invalid" };
+    }
+    if (typeof c.tool !== "function") {
+        return { ok: false, reason: "ctx.tool is not available — runtime too old for tool-based plugins" };
+    }
+    const toolNs = c.tool;
+    if (!toolNs.schema || typeof toolNs.schema !== "object") {
+        return { ok: false, reason: "ctx.tool.schema (Zod-backed schema helpers) is missing — incompatible @opencode-ai/plugin" };
+    }
+    return { ok: true };
+}
+const SshPlugin = async (ctx, options) => {
     // ── Resolve configuration ──
     const config = resolveConfig(options);
+    // ── Compatibility check against the host runtime ──
+    const api = validatePluginApi(ctx);
+    if (!api.ok) {
+        console.warn(`[opencode-ssh] Plugin API incompatible: ${api.reason}. SSH tools are disabled.`);
+        return {};
+    }
     // ── Create tools and hooks with resolved config ──
-    const tools = createSshTools(config.mode, config.max_sessions, config.default_timeout, config.blocklist_extra);
+    const tools = createSshTools(config.mode, config.max_sessions, config.default_timeout, config.blocklist_extra, config.ssh_config_path, config.auto_connect, {
+        strictHostKey: config.strict_host_key,
+        rateLimitPerMinute: config.rate_limit_per_minute,
+        cooldownSeconds: config.cooldown_seconds,
+        autoReconnect: config.auto_reconnect,
+    });
     const hooks = createSshHooks(config.mode, config.blocklist_extra);
     return {
         tool: tools,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpD,MAAM,SAAS,GAAW,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;IAChD,8BAA8B;IAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,OAAkC,CAAC,CAAA;IAEhE,oDAAoD;IACpD,MAAM,KAAK,GAAG,cAAc,CAC1B,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,eAAe,CACvB,CAAA;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAA;IAEjE,OAAO;QACL,IAAI,EAAE,KAAK;QACX,GAAG,KAAK;KACT,CAAA;AACH,CAAC,CAAA;AAED,eAAe;IACb,EAAE,EAAE,cAAc;IAClB,MAAM,EAAE,SAAS;CAClB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpD;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,CAAC,GAAG,GAA0C,CAAA;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oEAAoE,EAAE,CAAA;IACpG,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,IAA4B,CAAA;IAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2FAA2F,EAAE,CAAA;IAC3H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,MAAM,SAAS,GAAW,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IAC/C,8BAA8B;IAC9B,MAAM,MAAM,GAAwB,aAAa,CAAC,OAAkC,CAAC,CAAA;IAErF,qDAAqD;IACrD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,2CAA2C,GAAG,CAAC,MAAM,2BAA2B,CAAC,CAAA;QAC9F,OAAO,EAAE,CAAA;IACX,CAAC;IAED,oDAAoD;IACpD,MAAM,KAAK,GAAG,cAAc,CAC1B,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,YAAY,EACnB;QACE,aAAa,EAAE,MAAM,CAAC,eAAe;QACrC,kBAAkB,EAAE,MAAM,CAAC,qBAAqB;QAChD,eAAe,EAAE,MAAM,CAAC,gBAAgB;QACxC,aAAa,EAAE,MAAM,CAAC,cAAc;KACrC,CACF,CAAA;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAA;IAEjE,OAAO;QACL,IAAI,EAAE,KAAK;QACX,GAAG,KAAK;KACT,CAAA;AACH,CAAC,CAAA;AAED,eAAe;IACb,EAAE,EAAE,cAAc;IAClB,MAAM,EAAE,SAAS;CAClB,CAAA"}

package/dist/ssh/config.d.ts

@@ -0,0 +1,60 @@
+export interface SshConfigEntry {
+    /** Host patterns from the "Host" line (aliases / globs). */
+    patterns: string[];
+    /** Real hostname to connect to (HostName). */
+    hostName?: string;
+    /** User (User). */
+    user?: string;
+    /** Port (Port). */
+    port?: number;
+    /** Identity file (IdentityFile). */
+    identityFile?: string;
+    /** ProxyJump: comma-separated list of user@host:port hops. */
+    proxyJump?: string;
+    /** ProxyCommand: external command to open the tunnel. */
+    proxyCommand?: string;
+}
+export interface LoadedSshConfig {
+    entries: SshConfigEntry[];
+    path: string;
+    /** Whether the configured ssh config file exists on disk. */
+    exists: boolean;
+}
+/** Expand a leading `~` to the current user's home directory. */
+export declare function expandHomePath(p: string): string;
+/** Resolve the ssh config file path, using the override or ~/.ssh/config. */
+export declare function resolveSshConfigPath(configuredPath?: string): string;
+/**
+ * Parse the content of an OpenSSH config file.
+ * Handles `Host` blocks and `Match` blocks, and captures
+ * HostName / User / Port / IdentityFile directives.
+ */
+export declare function parseSshConfig(content: string): SshConfigEntry[];
+/**
+ * Find the first ssh config entry matching a host name.
+ * Prefers exact aliases, then falls back to `*`/`?` glob patterns.
+ */
+export declare function findHostConfig(entries: SshConfigEntry[], host: string): SshConfigEntry | undefined;
+/** Load and parse the ssh config file. Empty entry list if it does not exist. */
+export declare function loadSshConfig(configuredPath?: string): LoadedSshConfig;
+/**
+ * Parse a ProxyJump value ("user@host:port,user2@host2").
+ */
+export declare function parseProxyJump(value: string, defaultUser?: string, defaultKeyPath?: string): Array<{
+    host: string;
+    port: number;
+    username?: string;
+    keyPath?: string;
+}>;
+/**
+ * Concrete machines suitable for auto-connecting: `Host` entries that
+ * resolve to a real `HostName`.
+ */
+export declare function getAutoConnectHosts(configuredPath?: string): Array<{
+    alias: string;
+    hostName: string;
+    user?: string;
+    port?: number;
+    identityFile?: string;
+}>;
+//# sourceMappingURL=config.d.ts.map

package/dist/ssh/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/ssh/config.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CA0DhE;AAaD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAelG;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,eAAe,CAItE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,MAAM,GACtB,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B5E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,CAAC,EAAE,MAAM,GACtB,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBjG"}

package/dist/ssh/config.js

@@ -0,0 +1,174 @@
+/**
+ * SSH config (~/.ssh/config) parser.
+ * Reads alias, HostName, User, Port and IdentityFile so ssh.connect
+ * can reuse your normal SSH configuration and auto_connect knows what to hook.
+ */
+import { readFileSync, existsSync } from "fs";
+import { resolve as pathResolve } from "path";
+/** Expand a leading `~` to the current user's home directory. */
+export function expandHomePath(p) {
+    if (p.startsWith("~/")) {
+        return pathResolve(process.env.HOME || "", p.slice(2));
+    }
+    return p;
+}
+/** Resolve the ssh config file path, using the override or ~/.ssh/config. */
+export function resolveSshConfigPath(configuredPath) {
+    if (configuredPath && configuredPath.trim()) {
+        const p = configuredPath.trim();
+        return p.startsWith("~/") ? expandHomePath(p) : pathResolve(p);
+    }
+    return pathResolve(process.env.HOME || "", ".ssh", "config");
+}
+/**
+ * Parse the content of an OpenSSH config file.
+ * Handles `Host` blocks and `Match` blocks, and captures
+ * HostName / User / Port / IdentityFile directives.
+ */
+export function parseSshConfig(content) {
+    const entries = [];
+    let current = null;
+    for (const rawLine of content.split("\n")) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const match = line.match(/^(\S+)\s+(.+)$/);
+        if (!match)
+            continue;
+        const key = match[1].toLowerCase();
+        const value = match[2].trim();
+        if (key === "host") {
+            const tokens = value.match(/"[^"]*"|\S+/g) || [];
+            current = {
+                patterns: tokens.map((t) => t.startsWith('"') && t.endsWith('"') ? t.slice(1, -1) : t),
+            };
+            entries.push(current);
+            continue;
+        }
+        if (key === "match") {
+            current = { patterns: [] };
+            entries.push(current);
+            continue;
+        }
+        if (!current)
+            continue;
+        switch (key) {
+            case "hostname":
+                current.hostName = value;
+                break;
+            case "user":
+                current.user = value;
+                break;
+            case "port": {
+                const num = Number.parseInt(value, 10);
+                if (!Number.isNaN(num))
+                    current.port = num;
+                break;
+            }
+            case "identityfile":
+                current.identityFile = value;
+                break;
+            case "proxyjump":
+                current.proxyJump = value;
+                break;
+            case "proxycommand":
+                current.proxyCommand = value;
+                break;
+        }
+    }
+    return entries;
+}
+/** Turn an OpenSSH Host pattern (may contain `*` / `?`) into a RegExp. */
+function hostPatternToRegex(pattern) {
+    let out = "";
+    for (const ch of pattern) {
+        if (ch === "*")
+            out += ".*";
+        else if (ch === "?")
+            out += ".";
+        else
+            out += ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    }
+    return new RegExp(`^${out}$`, "i");
+}
+/**
+ * Find the first ssh config entry matching a host name.
+ * Prefers exact aliases, then falls back to `*`/`?` glob patterns.
+ */
+export function findHostConfig(entries, host) {
+    const normalized = host.toLowerCase();
+    for (const entry of entries) {
+        for (const pattern of entry.patterns) {
+            if (pattern.toLowerCase() === normalized)
+                return entry;
+        }
+    }
+    for (const entry of entries) {
+        for (const pattern of entry.patterns) {
+            if (pattern.includes("*") || pattern.includes("?")) {
+                if (hostPatternToRegex(pattern).test(host))
+                    return entry;
+            }
+        }
+    }
+    return undefined;
+}
+/** Load and parse the ssh config file. Empty entry list if it does not exist. */
+export function loadSshConfig(configuredPath) {
+    const path = resolveSshConfigPath(configuredPath);
+    if (!existsSync(path))
+        return { entries: [], path, exists: false };
+    return { entries: parseSshConfig(readFileSync(path, "utf-8")), path, exists: true };
+}
+/**
+ * Parse a ProxyJump value ("user@host:port,user2@host2").
+ */
+export function parseProxyJump(value, defaultUser, defaultKeyPath) {
+    return value
+        .split(",")
+        .map((hop) => hop.trim())
+        .filter(Boolean)
+        .map((hop) => {
+        let user;
+        let rest = hop;
+        if (hop.includes("@")) {
+            const at = hop.lastIndexOf("@");
+            user = hop.slice(0, at);
+            rest = hop.slice(at + 1);
+        }
+        let port = 22;
+        let host = rest;
+        const colon = rest.match(/^(.*):(\d+)$/);
+        if (colon) {
+            host = colon[1];
+            port = Number(colon[2]);
+        }
+        return {
+            host,
+            port,
+            username: user || defaultUser,
+            keyPath: defaultKeyPath,
+        };
+    });
+}
+/**
+ * Concrete machines suitable for auto-connecting: `Host` entries that
+ * resolve to a real `HostName`.
+ */
+export function getAutoConnectHosts(configuredPath) {
+    const { entries } = loadSshConfig(configuredPath);
+    const hosts = [];
+    for (const entry of entries) {
+        if (entry.patterns.length > 0 && entry.hostName) {
+            hosts.push({
+                alias: entry.patterns[0],
+                hostName: entry.hostName,
+                user: entry.user,
+                port: entry.port,
+                identityFile: entry.identityFile,
+            });
+        }
+    }
+    return hosts;
+}
+//# sourceMappingURL=config.js.map

package/dist/ssh/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/ssh/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAA;AAC7C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAA;AA0B7C,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,cAAuB;IAC1D,IAAI,cAAc,IAAI,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAA;QAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,IAAI,OAAO,GAA0B,IAAI,CAAA;IAEzC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,SAAQ;QAEpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAE7B,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;YAChD,OAAO,GAAG;gBACR,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1D;aACF,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;YAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,SAAQ;QAEtB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,UAAU;gBACb,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAA;gBACxB,MAAK;YACP,KAAK,MAAM;gBACT,OAAO,CAAC,IAAI,GAAG,KAAK,CAAA;gBACpB,MAAK;YACP,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;gBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,GAAG,GAAG,CAAA;gBAC1C,MAAK;YACP,CAAC;YACD,KAAK,cAAc;gBACjB,OAAO,CAAC,YAAY,GAAG,KAAK,CAAA;gBAC5B,MAAK;YACP,KAAK,WAAW;gBACd,OAAO,CAAC,SAAS,GAAG,KAAK,CAAA;gBACzB,MAAK;YACP,KAAK,cAAc;gBACjB,OAAO,CAAC,YAAY,GAAG,KAAK,CAAA;gBAC5B,MAAK;QACT,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,GAAG;YAAE,GAAG,IAAI,IAAI,CAAA;aACtB,IAAI,EAAE,KAAK,GAAG;YAAE,GAAG,IAAI,GAAG,CAAA;;YAC1B,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,CAAC,CAAA;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAyB,EAAE,IAAY;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;QACxD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAA;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,cAAuB;IACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAA;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAClE,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AACrF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,WAAoB,EACpB,cAAuB;IAEvB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,IAAI,IAAwB,CAAA;QAC5B,IAAI,IAAI,GAAG,GAAG,CAAA;QACd,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACvB,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC1B,CAAC;QACD,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,IAAI,IAAI,GAAG,IAAI,CAAA;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACf,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACzB,CAAC;QACD,OAAO;YACL,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,IAAI,IAAI,WAAW;YAC7B,OAAO,EAAE,cAAc;SACxB,CAAA;IACH,CAAC,CAAC,CAAA;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,cAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;IACjD,MAAM,KAAK,GAAoG,EAAE,CAAA;IAEjH,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/ssh/connection.d.ts

@@ -1,7 +1,9 @@
+import { type ProxySpec } from "./proxy.js";
 export interface SshConnectionConfig {
     host: string;
     port: number;
-    username: string;
+    /** SSH username, resolved from args or the ssh config. */
+    username?: string;
     authMethod: "password" | "key";
     password?: string;
     keyPath?: string;
@@ -10,6 +12,16 @@ export interface SshConnectionConfig {
     timeout?: number;
     /** Connection alias for display */
     alias?: string;
+    /** Reject hosts whose key is not (an identical match) in known_hosts. */
+    strictHostKey?: boolean;
+    /** Custom path to a known_hosts file. */
+    knownHostsPath?: string;
+    /** SSH config default path, used to locate known_hosts next to it. */
+    sshConfigPath?: string;
+    /** ProxyJump / ProxyCommand support. */
+    proxy?: ProxySpec;
+    /** Automatically reconnect a dropped session on the next exec/sftp. */
+    autoReconnect?: boolean;
 }
 export interface SshConnectionInfo {
     id: string;
@@ -25,21 +37,28 @@ export declare class SshConnection {
     private _connected;
     private _connectedAt?;
     private _lastActivity?;
-    private _reconnectAttempts;
-    private _maxReconnectAttempts;
+    private _maxAttempts;
+    private _attempts;
+    private _proxyCleanup?;
+    private _hostKeyVerdict?;
     constructor(id: string, config: SshConnectionConfig);
     get id(): string;
     get config(): SshConnectionConfig;
     get connected(): boolean;
     get connectedAt(): Date | undefined;
     get lastActivity(): Date | undefined;
+    /** Result of the last known_hosts check (undefined when disabled). */
+    get hostKeyVerdict(): "ok" | "changed" | "unknown" | undefined;
     /**
-     * Connect to the SSH server.
+     * Connect to the SSH server, with bounded retries.
      */
     connect(): Promise<void>;
+    private connectWithBackoff;
+    private buildConnectConfig;
+    private openConnection;
     /**
-     * Execute a command on the remote server.
-     * Returns a stream for real-time output.
+     * Execute a command on the remote server. Automatically reconnects a
+     * dropped session before running.
      */
     exec(command: string, options?: {
         cwd?: string;
@@ -58,7 +77,8 @@ export declare class SshConnection {
         timeout?: number;
     }): NodeJS.ReadableStream | null;
     /**
-     * Get an SFTP session for file transfers.
+     * Get an SFTP session for file transfers. Automatically reconnects a
+     * dropped session before returning.
      */
     sftp(): Promise<any>;
     /**

package/dist/ssh/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/ssh/connection.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,UAAU,GAAG,KAAK,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,mBAAmB,CAAA;IAC3B,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,GAAG,CAAQ;IACnB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,YAAY,CAAC,CAAM;IAC3B,OAAO,CAAC,aAAa,CAAC,CAAM;IAC5B,OAAO,CAAC,kBAAkB,CAAI;IAC9B,OAAO,CAAC,qBAAqB,CAAI;gBAErB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB;IAMnD,IAAI,EAAE,IAAI,MAAM,CAEf;IAED,IAAI,MAAM,IAAI,mBAAmB,CAEhC;IAED,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,WAAW,IAAI,IAAI,GAAG,SAAS,CAElC;IAED,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA+D9B;;;OAGG;IACG,IAAI,CACR,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IA8D/F;;OAEG;IACH,UAAU,CACR,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,MAAM,CAAC,cAAc,GAAG,IAAI;IAgB/B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAgB1B;;OAEG;IACH,UAAU,IAAI,IAAI;IAOlB;;OAEG;IACH,OAAO,IAAI,iBAAiB;CAgB7B"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/ssh/connection.ts"],"names":[],"mappings":"AAKA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAA;AAEzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,UAAU,GAAG,KAAK,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yEAAyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wCAAwC;IACxC,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,mBAAmB,CAAA;IAC3B,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAID,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,GAAG,CAAQ;IACnB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,YAAY,CAAC,CAAM;IAC3B,OAAO,CAAC,aAAa,CAAC,CAAM;IAC5B,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,SAAS,CAAI;IACrB,OAAO,CAAC,aAAa,CAAC,CAAY;IAClC,OAAO,CAAC,eAAe,CAAC,CAA8B;gBAE1C,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB;IAOnD,IAAI,EAAE,IAAI,MAAM,CAEf;IAED,IAAI,MAAM,IAAI,mBAAmB,CAEhC;IAED,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,WAAW,IAAI,IAAI,GAAG,SAAS,CAElC;IAED,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED,sEAAsE;IACtE,IAAI,cAAc,IAAI,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAE7D;IAED;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAahB,kBAAkB;YAclB,kBAAkB;YA0DlB,cAAc;IA2B5B;;;OAGG;IACG,IAAI,CACR,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAgE/F;;OAEG;IACH,UAAU,CACR,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,MAAM,CAAC,cAAc,GAAG,IAAI;IAgB/B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAqB1B;;OAEG;IACH,UAAU,IAAI,IAAI;IASlB;;OAEG;IACH,OAAO,IAAI,iBAAiB;CAgB7B"}