@judaharagao/opencode-ssh 1.1.0 → 1.2.1

package/README.md

@@ -12,6 +12,11 @@ SSH access plugin for OpenCode — secure remote command execution with command
 - 📤 **File Transfer** — Upload and download files via SCP/SFTP
 - 🎯 **Command Safety Checker** — Preview command safety before execution
 - ⚙️ **Configurable Policies** — Add custom blocklist/allowlist patterns
+- 🛤️ **Proxy Support** — `ProxyJump` and `ProxyCommand` from your ssh config
+- 🛡️ **Host Key Verification** — optional `strict_host_key` MITM protection via `known_hosts`
+- ⏳ **Rate Limiting** — per-host command rate limit and cooldown
+- 🔁 **Auto-Reconnect** — dropped sessions reconnect automatically on the next command
+- 🔐 **Credential Hygiene** — passwords are cleared from memory after a successful handshake
 
 ## Installation
 
@@ -48,15 +53,21 @@ Or with configuration:
 | `audit_enabled` | boolean | `true` | Enable audit logging |
 | `blocklist_extra` | string[] | `[]` | Additional regex patterns to block |
 | `allowlist` | string[] | `[]` | Additional allowed patterns (restricted mode) |
-| `ssh_config_path` | string | `~/.ssh/config` | Path to the SSH config file used to resolve host aliases, defaults, and auto-connect targets |
-| `auto_connect` | boolean | `false` | Connect automatically at startup to every `Host` entry in the ssh config that has a `HostName` |
+| `ssh_config_path` | string | `~/.ssh/config` | Path to the SSH config file used to resolve host aliases, defaults, proxies, and auto-connect targets |
+| `auto_connect` | boolean | `false` | Connect automatically at startup to every `Host` entry in the ssh config that has a `HostName` (with retry/backoff) |
+| `auto_reconnect` | boolean | `true` | Reconnect a dropped session automatically before the next `ssh.exec`/`ssh.upload`/`ssh.download` (key-authenticated sessions) |
+| `strict_host_key` | boolean | `false` | Reject connections whose host key is not an exact match in `~/.ssh/known_hosts` (MITM protection) |
+| `rate_limit_per_minute` | number | `120` | Max commands allowed per host per minute |
+| `cooldown_seconds` | number | `0` | Minimum delay (seconds) between commands on the same host |
 
 ## SSH Config Integration
 
 The plugin can reuse your existing `~/.ssh/config` (or a custom path via `ssh_config_path`):
 
 - **Host resolution** — `ssh.connect(host="myalias")` resolves the alias to its `HostName`, and automatically applies the `User`, `Port` and `IdentityFile` from the config. `username`, `port` and `auth_method`/`key_path` become optional when configured.
-- **Auto-connect** — with `"auto_connect": true`, the plugin connects at startup to every `Host` entry that has a `HostName`, using the configured key (or `~/.ssh/id_rsa`). Unreachable hosts are skipped without blocking startup.
+- **ProxyJump / ProxyCommand** — `ProxyJump` and `ProxyCommand` directives in the ssh config are honored, so connections route through bastion/jump hosts transparently.
+- **Auto-connect** — with `"auto_connect": true`, the plugin connects at startup to every `Host` entry that has a `HostName`, using the configured key (or `~/.ssh/id_rsa`). Unreachable hosts are retried with backoff and skipped without blocking startup.
+- **Missing file alert** — if `ssh_config_path` points to a file that does not exist, the plugin warns on connect instead of silently ignoring the setting.
 
 Example ssh config:
 
@@ -66,9 +77,13 @@ Host prod-web
     User deploy
     Port 2222
     IdentityFile ~/.ssh/prod_key
+
+Host prod-db
+    HostName 10.0.0.50
+    ProxyJump jumpuser@bastion:2200
 ```
 
-With `ssh.connect(host="prod-web")` the plugin connects to `deploy@10.0.0.10:2222` using `~/.ssh/prod_key`.
+With `ssh.connect(host="prod-web")` the plugin connects to `deploy@10.0.0.10:2222` using `~/.ssh/prod_key`. `prod-db` is reached tunneled through `bastion`.
 
 ## Security Modes
 
@@ -157,6 +172,12 @@ ssh.audit_log(session_id="prod-server", command_filter="docker")
 
 ## Security
 
+### Host Key Verification
+With `"strict_host_key": true` the plugin verifies the remote server's host key against `~/.ssh/known_hosts` before completing the handshake:
+- a **matching** key → connection allowed;
+- a **changed** key (possible MITM) → connection refused;
+- an **unknown** host → connection refused (add the host key to `known_hosts` first, e.g. via `ssh-keyscan host >> ~/.ssh/known_hosts`).
+
 ### Destructive Commands (100% Blocked)
 These commands are **permanently blocked** with no exceptions:
 
@@ -183,7 +204,8 @@ These commands require your explicit approval each time:
 ### Credential Safety
 - Passwords and SSH keys are **never** stored in logs or output
 - Session info only contains host, username, and port
-- Credentials are held in memory only during the session
+- Passwords are cleared from memory right after a successful handshake
+- For this reason password-authenticated sessions do **not** auto-reconnect (re-issue `ssh.connect`); key-authenticated sessions reconnect automatically from the on-disk key
 - All sessions are destroyed when the plugin is disposed
 
 ## Audit Log

package/dist/config/schema.d.ts

@@ -27,6 +27,14 @@ export declare const SshPluginConfig: z.ZodObject<{
     ssh_config_path: z.ZodOptional<z.ZodString>;
     /** Auto-connect on plugin boot (requires saved session) */
     auto_connect: z.ZodDefault<z.ZodBoolean>;
+    /** Reconnect a dropped session automatically on the next command */
+    auto_reconnect: z.ZodDefault<z.ZodBoolean>;
+    /** Reject hosts whose key is not in known_hosts (MITM protection) */
+    strict_host_key: z.ZodDefault<z.ZodBoolean>;
+    /** Max commands allowed per host per minute (rate limiting) */
+    rate_limit_per_minute: z.ZodDefault<z.ZodNumber>;
+    /** Minimum delay in seconds between commands on the same host (cooldown) */
+    cooldown_seconds: z.ZodDefault<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
     mode: "full" | "restricted" | "read_only";
     max_sessions: number;
@@ -35,6 +43,10 @@ export declare const SshPluginConfig: z.ZodObject<{
     blocklist_extra: string[];
     allowlist: string[];
     auto_connect: boolean;
+    auto_reconnect: boolean;
+    strict_host_key: boolean;
+    rate_limit_per_minute: number;
+    cooldown_seconds: number;
     ssh_config_path?: string | undefined;
 }, {
     mode?: "full" | "restricted" | "read_only" | undefined;
@@ -45,6 +57,10 @@ export declare const SshPluginConfig: z.ZodObject<{
     allowlist?: string[] | undefined;
     ssh_config_path?: string | undefined;
     auto_connect?: boolean | undefined;
+    auto_reconnect?: boolean | undefined;
+    strict_host_key?: boolean | undefined;
+    rate_limit_per_minute?: number | undefined;
+    cooldown_seconds?: number | undefined;
 }>;
 export type SshPluginConfigType = z.infer<typeof SshPluginConfig>;
 export declare const DEFAULT_CONFIG: SshPluginConfigType;

package/dist/config/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,eAAO,MAAM,YAAY,gDAA8C,CAAA;AACvE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,eAAe;IAExB,0CAA0C;;IAG1C,sCAAsC;;IAGtC,yCAAyC;;IAGzC,sCAAsC;;IAGtC,2DAA2D;;IAG3D,qEAAqE;;IAGrE,8CAA8C;;IAG9C,2DAA2D;;;;;;;;;;;;;;;;;;;;EAGpD,CAAA;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEjE,eAAO,MAAM,cAAc,EAAE,mBAQ5B,CAAA"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,eAAO,MAAM,YAAY,gDAA8C,CAAA;AACvE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,eAAe;IAExB,0CAA0C;;IAG1C,sCAAsC;;IAGtC,yCAAyC;;IAGzC,sCAAsC;;IAGtC,2DAA2D;;IAG3D,qEAAqE;;IAGrE,8CAA8C;;IAG9C,2DAA2D;;IAG3D,oEAAoE;;IAGpE,qEAAqE;;IAGrE,+DAA+D;;IAG/D,4EAA4E;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGrE,CAAA;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEjE,eAAO,MAAM,cAAc,EAAE,mBAY5B,CAAA"}

package/dist/config/schema.js

@@ -27,6 +27,14 @@ export const SshPluginConfig = z
     ssh_config_path: z.string().optional(),
     /** Auto-connect on plugin boot (requires saved session) */
     auto_connect: z.boolean().default(false),
+    /** Reconnect a dropped session automatically on the next command */
+    auto_reconnect: z.boolean().default(true),
+    /** Reject hosts whose key is not in known_hosts (MITM protection) */
+    strict_host_key: z.boolean().default(false),
+    /** Max commands allowed per host per minute (rate limiting) */
+    rate_limit_per_minute: z.number().int().min(1).max(10000).default(120),
+    /** Minimum delay in seconds between commands on the same host (cooldown) */
+    cooldown_seconds: z.number().int().min(0).max(3600).default(0),
 })
     .strict();
 export const DEFAULT_CONFIG = {
@@ -37,5 +45,9 @@ export const DEFAULT_CONFIG = {
     blocklist_extra: [],
     allowlist: [],
     auto_connect: false,
+    auto_reconnect: true,
+    strict_host_key: false,
+    rate_limit_per_minute: 120,
+    cooldown_seconds: 0,
 };
 //# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;AAGvE;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,0CAA0C;IAC1C,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;IAElC,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAExD,yCAAyC;IACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,sCAAsC;IACtC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAExC,2DAA2D;IAC3D,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEhD,qEAAqE;IACrE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE1C,8CAA8C;IAC9C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEtC,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAA;AAIX,MAAM,CAAC,MAAM,cAAc,GAAwB;IACjD,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,CAAC;IACf,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,EAAE;IACnB,SAAS,EAAE,EAAE;IACb,YAAY,EAAE,KAAK;CACpB,CAAA"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;AAGvE;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,0CAA0C;IAC1C,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;IAElC,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAExD,yCAAyC;IACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,sCAAsC;IACtC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAExC,2DAA2D;IAC3D,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEhD,qEAAqE;IACrE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE1C,8CAA8C;IAC9C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEtC,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAExC,oEAAoE;IACpE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAEzC,qEAAqE;IACrE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE3C,+DAA+D;IAC/D,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAEtE,4EAA4E;IAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D,CAAC;KACD,MAAM,EAAE,CAAA;AAIX,MAAM,CAAC,MAAM,cAAc,GAAwB;IACjD,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,CAAC;IACf,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,EAAE;IACnB,SAAS,EAAE,EAAE;IACb,YAAY,EAAE,KAAK;IACnB,cAAc,EAAE,IAAI;IACpB,eAAe,EAAE,KAAK;IACtB,qBAAqB,EAAE,GAAG;IAC1B,gBAAgB,EAAE,CAAC;CACpB,CAAA"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;;;;;AA2BjD,wBAGC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;;;;;AAiCjD,wBAGC"}

package/dist/index.js

@@ -5,7 +5,12 @@ const SshPlugin = async (_ctx, options) => {
     // ── Resolve configuration ──
     const config = resolveConfig(options);
     // ── Create tools and hooks with resolved config ──
-    const tools = createSshTools(config.mode, config.max_sessions, config.default_timeout, config.blocklist_extra, config.ssh_config_path, config.auto_connect);
+    const tools = createSshTools(config.mode, config.max_sessions, config.default_timeout, config.blocklist_extra, config.ssh_config_path, config.auto_connect, {
+        strictHostKey: config.strict_host_key,
+        rateLimitPerMinute: config.rate_limit_per_minute,
+        cooldownSeconds: config.cooldown_seconds,
+        autoReconnect: config.auto_reconnect,
+    });
     const hooks = createSshHooks(config.mode, config.blocklist_extra);
     return {
         tool: tools,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpD,MAAM,SAAS,GAAW,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;IAChD,8BAA8B;IAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,OAAkC,CAAC,CAAA;IAEhE,oDAAoD;IACpD,MAAM,KAAK,GAAG,cAAc,CAC1B,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,YAAY,CACpB,CAAA;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAA;IAEjE,OAAO;QACL,IAAI,EAAE,KAAK;QACX,GAAG,KAAK;KACT,CAAA;AACH,CAAC,CAAA;AAED,eAAe;IACb,EAAE,EAAE,cAAc;IAClB,MAAM,EAAE,SAAS;CAClB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpD,MAAM,SAAS,GAAW,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;IAChD,8BAA8B;IAC9B,MAAM,MAAM,GAAwB,aAAa,CAAC,OAAkC,CAAC,CAAA;IAErF,oDAAoD;IACpD,MAAM,KAAK,GAAG,cAAc,CAC1B,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,YAAY,EACnB;QACE,aAAa,EAAE,MAAM,CAAC,eAAe;QACrC,kBAAkB,EAAE,MAAM,CAAC,qBAAqB;QAChD,eAAe,EAAE,MAAM,CAAC,gBAAgB;QACxC,aAAa,EAAE,MAAM,CAAC,cAAc;KACrC,CACF,CAAA;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAA;IAEjE,OAAO;QACL,IAAI,EAAE,KAAK;QACX,GAAG,KAAK;KACT,CAAA;AACH,CAAC,CAAA;AAED,eAAe;IACb,EAAE,EAAE,cAAc;IAClB,MAAM,EAAE,SAAS;CAClB,CAAA"}

package/dist/ssh/config.d.ts

@@ -9,10 +9,16 @@ export interface SshConfigEntry {
     port?: number;
     /** Identity file (IdentityFile). */
     identityFile?: string;
+    /** ProxyJump: comma-separated list of user@host:port hops. */
+    proxyJump?: string;
+    /** ProxyCommand: external command to open the tunnel. */
+    proxyCommand?: string;
 }
 export interface LoadedSshConfig {
     entries: SshConfigEntry[];
     path: string;
+    /** Whether the configured ssh config file exists on disk. */
+    exists: boolean;
 }
 /** Expand a leading `~` to the current user's home directory. */
 export declare function expandHomePath(p: string): string;
@@ -31,6 +37,15 @@ export declare function parseSshConfig(content: string): SshConfigEntry[];
 export declare function findHostConfig(entries: SshConfigEntry[], host: string): SshConfigEntry | undefined;
 /** Load and parse the ssh config file. Empty entry list if it does not exist. */
 export declare function loadSshConfig(configuredPath?: string): LoadedSshConfig;
+/**
+ * Parse a ProxyJump value ("user@host:port,user2@host2").
+ */
+export declare function parseProxyJump(value: string, defaultUser?: string, defaultKeyPath?: string): Array<{
+    host: string;
+    port: number;
+    username?: string;
+    keyPath?: string;
+}>;
 /**
  * Concrete machines suitable for auto-connecting: `Host` entries that
  * resolve to a real `HostName`.

package/dist/ssh/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/ssh/config.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAoDhE;AAaD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAelG;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,eAAe,CAItE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,CAAC,EAAE,MAAM,GACtB,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBjG"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/ssh/config.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CA0DhE;AAaD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAelG;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,eAAe,CAItE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,MAAM,GACtB,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B5E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,CAAC,EAAE,MAAM,GACtB,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBjG"}

package/dist/ssh/config.js

@@ -68,6 +68,12 @@ export function parseSshConfig(content) {
             case "identityfile":
                 current.identityFile = value;
                 break;
+            case "proxyjump":
+                current.proxyJump = value;
+                break;
+            case "proxycommand":
+                current.proxyCommand = value;
+                break;
         }
     }
     return entries;
@@ -111,8 +117,39 @@ export function findHostConfig(entries, host) {
 export function loadSshConfig(configuredPath) {
     const path = resolveSshConfigPath(configuredPath);
     if (!existsSync(path))
-        return { entries: [], path };
-    return { entries: parseSshConfig(readFileSync(path, "utf-8")), path };
+        return { entries: [], path, exists: false };
+    return { entries: parseSshConfig(readFileSync(path, "utf-8")), path, exists: true };
+}
+/**
+ * Parse a ProxyJump value ("user@host:port,user2@host2").
+ */
+export function parseProxyJump(value, defaultUser, defaultKeyPath) {
+    return value
+        .split(",")
+        .map((hop) => hop.trim())
+        .filter(Boolean)
+        .map((hop) => {
+        let user;
+        let rest = hop;
+        if (hop.includes("@")) {
+            const at = hop.lastIndexOf("@");
+            user = hop.slice(0, at);
+            rest = hop.slice(at + 1);
+        }
+        let port = 22;
+        let host = rest;
+        const colon = rest.match(/^(.*):(\d+)$/);
+        if (colon) {
+            host = colon[1];
+            port = Number(colon[2]);
+        }
+        return {
+            host,
+            port,
+            username: user || defaultUser,
+            keyPath: defaultKeyPath,
+        };
+    });
 }
 /**
  * Concrete machines suitable for auto-connecting: `Host` entries that

package/dist/ssh/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/ssh/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAA;AAC7C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAA;AAoB7C,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,cAAuB;IAC1D,IAAI,cAAc,IAAI,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAA;QAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,IAAI,OAAO,GAA0B,IAAI,CAAA;IAEzC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,SAAQ;QAEpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAE7B,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;YAChD,OAAO,GAAG;gBACR,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1D;aACF,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;YAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,SAAQ;QAEtB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,UAAU;gBACb,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAA;gBACxB,MAAK;YACP,KAAK,MAAM;gBACT,OAAO,CAAC,IAAI,GAAG,KAAK,CAAA;gBACpB,MAAK;YACP,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;gBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,GAAG,GAAG,CAAA;gBAC1C,MAAK;YACP,CAAC;YACD,KAAK,cAAc;gBACjB,OAAO,CAAC,YAAY,GAAG,KAAK,CAAA;gBAC5B,MAAK;QACT,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,GAAG;YAAE,GAAG,IAAI,IAAI,CAAA;aACtB,IAAI,EAAE,KAAK,GAAG;YAAE,GAAG,IAAI,GAAG,CAAA;;YAC1B,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,CAAC,CAAA;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAyB,EAAE,IAAY;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;QACxD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAA;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,cAAuB;IACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAA;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACnD,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,cAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;IACjD,MAAM,KAAK,GAAoG,EAAE,CAAA;IAEjH,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/ssh/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAA;AAC7C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAA;AA0B7C,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,cAAuB;IAC1D,IAAI,cAAc,IAAI,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAA;QAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,IAAI,OAAO,GAA0B,IAAI,CAAA;IAEzC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,SAAQ;QAEpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAE7B,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;YAChD,OAAO,GAAG;gBACR,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1D;aACF,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;YAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrB,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,SAAQ;QAEtB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,UAAU;gBACb,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAA;gBACxB,MAAK;YACP,KAAK,MAAM;gBACT,OAAO,CAAC,IAAI,GAAG,KAAK,CAAA;gBACpB,MAAK;YACP,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;gBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,GAAG,GAAG,CAAA;gBAC1C,MAAK;YACP,CAAC;YACD,KAAK,cAAc;gBACjB,OAAO,CAAC,YAAY,GAAG,KAAK,CAAA;gBAC5B,MAAK;YACP,KAAK,WAAW;gBACd,OAAO,CAAC,SAAS,GAAG,KAAK,CAAA;gBACzB,MAAK;YACP,KAAK,cAAc;gBACjB,OAAO,CAAC,YAAY,GAAG,KAAK,CAAA;gBAC5B,MAAK;QACT,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,GAAG;YAAE,GAAG,IAAI,IAAI,CAAA;aACtB,IAAI,EAAE,KAAK,GAAG;YAAE,GAAG,IAAI,GAAG,CAAA;;YAC1B,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,CAAC,CAAA;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAyB,EAAE,IAAY;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;QACxD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAA;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,cAAuB;IACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAA;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAClE,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AACrF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,WAAoB,EACpB,cAAuB;IAEvB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,IAAI,IAAwB,CAAA;QAC5B,IAAI,IAAI,GAAG,GAAG,CAAA;QACd,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACvB,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC1B,CAAC;QACD,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,IAAI,IAAI,GAAG,IAAI,CAAA;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACf,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACzB,CAAC;QACD,OAAO;YACL,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,IAAI,IAAI,WAAW;YAC7B,OAAO,EAAE,cAAc;SACxB,CAAA;IACH,CAAC,CAAC,CAAA;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,cAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;IACjD,MAAM,KAAK,GAAoG,EAAE,CAAA;IAEjH,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/ssh/connection.d.ts

@@ -1,3 +1,4 @@
+import { type ProxySpec } from "./proxy.js";
 export interface SshConnectionConfig {
     host: string;
     port: number;
@@ -11,6 +12,16 @@ export interface SshConnectionConfig {
     timeout?: number;
     /** Connection alias for display */
     alias?: string;
+    /** Reject hosts whose key is not (an identical match) in known_hosts. */
+    strictHostKey?: boolean;
+    /** Custom path to a known_hosts file. */
+    knownHostsPath?: string;
+    /** SSH config default path, used to locate known_hosts next to it. */
+    sshConfigPath?: string;
+    /** ProxyJump / ProxyCommand support. */
+    proxy?: ProxySpec;
+    /** Automatically reconnect a dropped session on the next exec/sftp. */
+    autoReconnect?: boolean;
 }
 export interface SshConnectionInfo {
     id: string;
@@ -26,21 +37,28 @@ export declare class SshConnection {
     private _connected;
     private _connectedAt?;
     private _lastActivity?;
-    private _reconnectAttempts;
-    private _maxReconnectAttempts;
+    private _maxAttempts;
+    private _attempts;
+    private _proxyCleanup?;
+    private _hostKeyVerdict?;
     constructor(id: string, config: SshConnectionConfig);
     get id(): string;
     get config(): SshConnectionConfig;
     get connected(): boolean;
     get connectedAt(): Date | undefined;
     get lastActivity(): Date | undefined;
+    /** Result of the last known_hosts check (undefined when disabled). */
+    get hostKeyVerdict(): "ok" | "changed" | "unknown" | undefined;
     /**
-     * Connect to the SSH server.
+     * Connect to the SSH server, with bounded retries.
      */
     connect(): Promise<void>;
+    private connectWithBackoff;
+    private buildConnectConfig;
+    private openConnection;
     /**
-     * Execute a command on the remote server.
-     * Returns a stream for real-time output.
+     * Execute a command on the remote server. Automatically reconnects a
+     * dropped session before running.
      */
     exec(command: string, options?: {
         cwd?: string;
@@ -59,7 +77,8 @@ export declare class SshConnection {
         timeout?: number;
     }): NodeJS.ReadableStream | null;
     /**
-     * Get an SFTP session for file transfers.
+     * Get an SFTP session for file transfers. Automatically reconnects a
+     * dropped session before returning.
      */
     sftp(): Promise<any>;
     /**

package/dist/ssh/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/ssh/connection.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,UAAU,GAAG,KAAK,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,mBAAmB,CAAA;IAC3B,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,GAAG,CAAQ;IACnB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,YAAY,CAAC,CAAM;IAC3B,OAAO,CAAC,aAAa,CAAC,CAAM;IAC5B,OAAO,CAAC,kBAAkB,CAAI;IAC9B,OAAO,CAAC,qBAAqB,CAAI;gBAErB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB;IAMnD,IAAI,EAAE,IAAI,MAAM,CAEf;IAED,IAAI,MAAM,IAAI,mBAAmB,CAEhC;IAED,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,WAAW,IAAI,IAAI,GAAG,SAAS,CAElC;IAED,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAmE9B;;;OAGG;IACG,IAAI,CACR,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IA8D/F;;OAEG;IACH,UAAU,CACR,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,MAAM,CAAC,cAAc,GAAG,IAAI;IAgB/B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAgB1B;;OAEG;IACH,UAAU,IAAI,IAAI;IAOlB;;OAEG;IACH,OAAO,IAAI,iBAAiB;CAgB7B"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/ssh/connection.ts"],"names":[],"mappings":"AAKA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAA;AAEzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,UAAU,GAAG,KAAK,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yEAAyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wCAAwC;IACxC,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,mBAAmB,CAAA;IAC3B,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAID,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,GAAG,CAAQ;IACnB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,YAAY,CAAC,CAAM;IAC3B,OAAO,CAAC,aAAa,CAAC,CAAM;IAC5B,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,SAAS,CAAI;IACrB,OAAO,CAAC,aAAa,CAAC,CAAY;IAClC,OAAO,CAAC,eAAe,CAAC,CAA8B;gBAE1C,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB;IAOnD,IAAI,EAAE,IAAI,MAAM,CAEf;IAED,IAAI,MAAM,IAAI,mBAAmB,CAEhC;IAED,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,WAAW,IAAI,IAAI,GAAG,SAAS,CAElC;IAED,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED,sEAAsE;IACtE,IAAI,cAAc,IAAI,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAE7D;IAED;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAahB,kBAAkB;YAclB,kBAAkB;YA0DlB,cAAc;IA2B5B;;;OAGG;IACG,IAAI,CACR,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAgE/F;;OAEG;IACH,UAAU,CACR,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,MAAM,CAAC,cAAc,GAAG,IAAI;IAgB/B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAqB1B;;OAEG;IACH,UAAU,IAAI,IAAI;IASlB;;OAEG;IACH,OAAO,IAAI,iBAAiB;CAgB7B"}

package/dist/ssh/connection.js

@@ -2,6 +2,9 @@ import { Client } from "ssh2";
 import { readFileSync, existsSync } from "fs";
 import { resolve as pathResolve } from "path";
 import { escapeShellArg } from "./sanitizer.js";
+import { verifyHostKey } from "./known_hosts.js";
+import { prepareProxy } from "./proxy.js";
+const DEFAULT_KNOWN_HOSTS = () => pathResolve(process.env.HOME || "", ".ssh", "known_hosts");
 export class SshConnection {
     client;
     _config;
@@ -9,12 +12,15 @@ export class SshConnection {
     _connected = false;
     _connectedAt;
     _lastActivity;
-    _reconnectAttempts = 0;
-    _maxReconnectAttempts = 3;
+    _maxAttempts = 3;
+    _attempts = 0;
+    _proxyCleanup;
+    _hostKeyVerdict;
     constructor(id, config) {
         this._id = id;
         this._config = config;
-        this.client = new Client();
+        this._config.strictHostKey = this._config.strictHostKey ?? false;
+        this._config.autoReconnect = this._config.autoReconnect ?? true;
     }
     get id() {
         return this._id;
@@ -31,74 +37,124 @@ export class SshConnection {
     get lastActivity() {
         return this._lastActivity;
     }
+    /** Result of the last known_hosts check (undefined when disabled). */
+    get hostKeyVerdict() {
+        return this._hostKeyVerdict;
+    }
     /**
-     * Connect to the SSH server.
+     * Connect to the SSH server, with bounded retries.
      */
     async connect() {
         if (!this._config.username) {
             throw new Error("A username is required to connect (provide one or set User in the ssh config).");
         }
-        return new Promise((resolve, reject) => {
-            const connectConfig = {
+        this._attempts = 0;
+        await this.connectWithBackoff();
+        // Credentials are only needed for the handshake; drop them from memory
+        // once the connection is established so they are not retained.
+        this._config.password = undefined;
+    }
+    async connectWithBackoff() {
+        try {
+            const cfg = await this.buildConnectConfig();
+            await this.openConnection(cfg);
+        }
+        catch (err) {
+            this._attempts++;
+            if (this._attempts < this._maxAttempts) {
+                await new Promise((r) => setTimeout(r, 1000 * this._attempts));
+                return this.connectWithBackoff();
+            }
+            throw err;
+        }
+    }
+    async buildConnectConfig() {
+        const connectConfig = {
+            host: this._config.host,
+            port: this._config.port,
+            username: this._config.username,
+            readyTimeout: this._config.timeout || 10000,
+            keepaliveInterval: 10000,
+            keepaliveCountMax: 3,
+        };
+        // ── Host key verification (MITM protection) ──
+        if (this._config.strictHostKey) {
+            const knownHostsPath = this._config.knownHostsPath || DEFAULT_KNOWN_HOSTS();
+            connectConfig.hostVerifier = (key) => {
+                const verdict = verifyHostKey(this._config.host, key, knownHostsPath, this._config.port);
+                this._hostKeyVerdict = verdict;
+                // A changed key is always rejected. An unknown key is only accepted
+                // in non-strict mode; here strict mode requires it to be present.
+                return verdict === "ok";
+            };
+        }
+        // ── Proxy tunnel (ProxyJump / ProxyCommand) ──
+        if (this._config.proxy) {
+            const prepared = await prepareProxy(this._config.proxy, {
                 host: this._config.host,
                 port: this._config.port,
                 username: this._config.username,
-                readyTimeout: this._config.timeout || 10000,
-                keepaliveInterval: 10000,
-                keepaliveCountMax: 3,
-            };
-            // Configure authentication
-            if (this._config.authMethod === "password") {
+                keyPath: this._config.keyPath,
+                passphrase: this._config.passphrase,
+            });
+            this._proxyCleanup = prepared.cleanup;
+            connectConfig.sock = prepared.sock;
+        }
+        // ── Authentication ──
+        if (this._config.authMethod === "password") {
+            if (this._config.password) {
                 connectConfig.password = this._config.password;
             }
-            else {
-                // Key-based authentication
-                const keyPath = this._config.keyPath
-                    ? pathResolve(this._config.keyPath.replace("~", process.env.HOME || ""))
-                    : pathResolve(process.env.HOME || "", ".ssh", "id_rsa");
-                if (!existsSync(keyPath)) {
-                    reject(new Error(`SSH key not found: ${keyPath}`));
-                    return;
-                }
-                connectConfig.privateKey = readFileSync(keyPath, "utf-8");
-                if (this._config.passphrase) {
-                    connectConfig.passphrase = this._config.passphrase;
-                }
+        }
+        else {
+            const keyPath = this._config.keyPath
+                ? pathResolve(this._config.keyPath.replace("~", process.env.HOME || ""))
+                : pathResolve(process.env.HOME || "", ".ssh", "id_rsa");
+            if (!existsSync(keyPath)) {
+                throw new Error(`SSH key not found: ${keyPath}`);
+            }
+            connectConfig.privateKey = readFileSync(keyPath, "utf-8");
+            if (this._config.passphrase) {
+                connectConfig.passphrase = this._config.passphrase;
             }
-            this.client.on("ready", () => {
+        }
+        return connectConfig;
+    }
+    async openConnection(cfg) {
+        // A fresh Client per attempt so a failed handshake never leaves the
+        // previous transport in an unusable state.
+        const client = new Client();
+        this.client = client;
+        return new Promise((resolve, reject) => {
+            client.on("ready", () => {
                 this._connected = true;
                 this._connectedAt = new Date();
                 this._lastActivity = new Date();
-                this._reconnectAttempts = 0;
                 resolve();
             });
-            this.client.on("error", (err) => {
+            client.on("error", (err) => {
                 this._connected = false;
-                if (this._reconnectAttempts < this._maxReconnectAttempts) {
-                    this._reconnectAttempts++;
-                    // Attempt reconnect after delay
-                    setTimeout(() => {
-                        this.connect().catch(() => { });
-                    }, 1000 * this._reconnectAttempts);
-                }
                 reject(err);
             });
-            this.client.on("close", () => {
+            client.on("close", () => {
                 this._connected = false;
             });
-            this.client.on("end", () => {
+            client.on("end", () => {
                 this._connected = false;
             });
-            this.client.connect(connectConfig);
+            client.connect(cfg);
         });
     }
     /**
-     * Execute a command on the remote server.
-     * Returns a stream for real-time output.
+     * Execute a command on the remote server. Automatically reconnects a
+     * dropped session before running.
      */
     async exec(command, options) {
         if (!this._connected) {
-            throw new Error("SSH connection is not active");
+            if (this._config.autoReconnect === false) {
+                throw new Error("SSH connection is not active");
+            }
+            await this.connect();
         }
         this._lastActivity = new Date();
         const wrappedCommand = options?.cwd
@@ -115,7 +171,6 @@ export class SshConnection {
                 let stdout = "";
                 let stderr = "";
                 let killed = false;
-                // Set timeout
                 if (timeoutMs > 0) {
                     timeoutId = setTimeout(() => {
                         killed = true;
@@ -165,12 +220,17 @@ export class SshConnection {
         return null; // Placeholder - actual streaming handled in executor.ts
     }
     /**
-     * Get an SFTP session for file transfers.
+     * Get an SFTP session for file transfers. Automatically reconnects a
+     * dropped session before returning.
      */
     async sftp() {
         if (!this._connected) {
-            throw new Error("SSH connection is not active");
+            if (this._config.autoReconnect === false) {
+                throw new Error("SSH connection is not active");
+            }
+            await this.connect();
         }
+        this._lastActivity = new Date();
         return new Promise((resolve, reject) => {
             this.client.sftp((err, sftp) => {
                 if (err) {
@@ -185,10 +245,12 @@ export class SshConnection {
      * Disconnect from the SSH server.
      */
     disconnect() {
-        if (this._connected) {
+        if (this.client) {
             this.client.end();
-            this._connected = false;
         }
+        this._connected = false;
+        this._proxyCleanup?.();
+        this._proxyCleanup = undefined;
     }
     /**
      * Get connection info for display.