@linxin666/dsh-ssh 0.3.19 → 0.3.21

package/src/engine/proxy-command.ts

@@ -0,0 +1,248 @@
+/**
+ * OpenSSH-compatible ProxyCommand transport: run the command with the user's
+ * shell and expose its stdio as a Duplex that ssh2 accepts as `sock`.
+ *
+ * The command comes verbatim from the user's own 0600 store file and runs with
+ * the DSH host process's privileges — the same trust the `ssh(1)` client gives
+ * the identical line in `~/.ssh/config`.
+ */
+
+import { spawn, type ChildProcess } from 'node:child_process'
+import { Duplex } from 'node:stream'
+
+/** Token source for one host: the values %h / %p / %r / %n expand to. */
+export interface ProxyTarget {
+  host: string
+  port: number
+  user: string
+  /** The name the user addresses this host by (OpenSSH's %n). */
+  alias: string
+}
+
+/** Captured stderr budget carried into the failure message (characters). */
+const MAX_STDERR = 4096
+
+/** How long a killed proxy command may linger before SIGKILL (ms). */
+const KILL_GRACE_MS = 2_000
+
+/** Expand the OpenSSH ProxyCommand tokens; unknown %X sequences stay verbatim. */
+export function expandProxyTokens(command: string, target: ProxyTarget): string {
+  return command.replace(/%[hprn%]/g, token => {
+    switch (token) {
+      case '%h': return target.host
+      case '%p': return String(target.port)
+      case '%r': return target.user
+      case '%n': return target.alias
+      default: return '%'
+    }
+  })
+}
+
+/** One spawn specification: the user's shell plus the platform quoting. */
+interface SpawnSpec {
+  file: string
+  args: string[]
+  /** cmd.exe needs the command quoted verbatim (Node's own shell recipe). */
+  windowsVerbatimArguments?: boolean
+}
+
+/**
+ * The shell OpenSSH itself would use on this platform: the user's shell with
+ * `-c` on POSIX, cmd.exe on Windows (where the whole command must stay one
+ * verbatim argument, exactly as Node's own `shell: true` does it).
+ */
+function spawnSpec(command: string): SpawnSpec {
+  if (process.platform === 'win32') {
+    return {
+      file: process.env.ComSpec ?? 'cmd.exe',
+      args: ['/d', '/s', '/c', '"' + command + '"'],
+      windowsVerbatimArguments: true,
+    }
+  }
+  return { file: process.env.SHELL ?? '/bin/sh', args: ['-c', command] }
+}
+
+/** One running proxy command: its transport plus the process behind it. */
+export interface ProxyCommandProcess {
+  /** The duplex transport handed to ssh2 as `sock`. */
+  stream: Duplex
+  /** The spawned shell; killing the stream kills it (and its process group). */
+  child: ChildProcess
+}
+
+/**
+ * Start one ProxyCommand and bridge its stdio into a Duplex.
+ *
+ * Failure modes are reported through the stream: a spawn error, or an exit
+ * before the SSH handshake finished, destroys it with the exit status and the
+ * tail of the command's stderr instead of letting ssh2 wait for its own
+ * `readyTimeout`.
+ */
+export function startProxyCommand(rawCommand: string, target: ProxyTarget): ProxyCommandProcess {
+  const command = expandProxyTokens(rawCommand, target)
+  const spec = spawnSpec(command)
+  const child = spawn(spec.file, spec.args, {
+    stdio: ['pipe', 'pipe', 'pipe'],
+    windowsHide: true,
+    ...(spec.windowsVerbatimArguments === true ? { windowsVerbatimArguments: true } : {}),
+    // POSIX only: own process group, so a chained client
+    // (`ssh -W %h:%p bastion`) dies with the transport instead of leaking.
+    ...(process.platform === 'win32' ? {} : { detached: true }),
+  })
+
+  let stderr = ''
+  child.stderr?.on('data', (chunk: Buffer) => {
+    stderr = (stderr + chunk.toString('utf8')).slice(-MAX_STDERR)
+  })
+
+  let killed = false
+  const kill = (): void => {
+    if (killed) return
+    killed = true
+    const pid = child.pid
+    const group = process.platform !== 'win32' && pid !== undefined
+    try {
+      if (group) process.kill(-pid, 'SIGTERM')
+      else child.kill()
+    } catch { /* already gone */ }
+    const escalate = setTimeout(() => {
+      try {
+        if (group) process.kill(-pid, 'SIGKILL')
+        else child.kill('SIGKILL')
+      } catch { /* already gone */ }
+    }, KILL_GRACE_MS)
+    escalate.unref()
+  }
+
+  function formatExitError(code: number | null, signal: NodeJS.Signals | null, stderrDetail: string): Error {
+    const status = signal !== null ? 'signal ' + signal : 'code ' + String(code ?? 'unknown')
+    const detail = stderrDetail.trim()
+    return new Error('ProxyCommand exited (' + status + ')' + (detail === '' ? '' : ': ' + detail))
+  }
+
+  const stream = new Duplex({
+    read() {
+      child.stdout?.resume()
+    },
+    write(chunk, _encoding, callback) {
+      const stdin = child.stdin
+      if (stream.destroyed || stdin === null || stdin.destroyed) {
+        callback(new Error('ProxyCommand stdin is already closed'))
+        return
+      }
+      stdin.write(chunk, (err) => {
+        if (!err) {
+          callback()
+          return
+        }
+        if ((child.exitCode !== null && child.exitCode !== 0) || child.signalCode !== null) {
+          const exitErr = formatExitError(child.exitCode, child.signalCode, stderr)
+          fail(exitErr)
+          callback(exitErr)
+          return
+        }
+        let resolved = false
+        const onExit = (code: number | null, signal: NodeJS.Signals | null) => {
+          if (resolved) return
+          resolved = true
+          clearTimeout(timer)
+          const exitErr = (code !== null && code !== 0) || signal !== null
+            ? formatExitError(code, signal, stderr)
+            : new Error('ProxyCommand transport write failed: ' + err.message)
+          fail(exitErr)
+          callback(exitErr)
+        }
+        const timer = setTimeout(() => {
+          if (resolved) return
+          resolved = true
+          child.removeListener('exit', onExit)
+          const transportErr = new Error('ProxyCommand transport write failed: ' + err.message)
+          fail(transportErr)
+          callback(transportErr)
+        }, 200)
+        timer.unref()
+        child.once('exit', onExit)
+      })
+    },
+    final(callback) {
+      const stdin = child.stdin
+      if (stdin === null || stdin.destroyed) {
+        callback()
+        return
+      }
+      stdin.end((err?: Error | null) => {
+        if (err) callback(new Error('ProxyCommand transport close failed: ' + err.message))
+        else callback()
+      })
+    },
+    destroy(error, callback) {
+      kill()
+      callback(error)
+    },
+  })
+
+  // ssh2 attaches its own error handling once it owns the socket; this listener
+  // only guarantees an 'error' emitted before that never reaches the host
+  // process as an unhandled event.
+  stream.on('error', () => { /* surfaced through the ssh2 client */ })
+
+  let failed = false
+  const fail = (error: Error): void => {
+    if (failed || stream.destroyed) return
+    failed = true
+    stream.destroy(error)
+  }
+
+  // The transport only reports a clean EOF once BOTH the stdout pipe ended and
+  // the process exited successfully: a command that dies (bastion client down,
+  // typo, refused connection) must surface its own exit status and stderr
+  // instead of the generic "connection lost before handshake" ssh2 produces
+  // for a socket that simply closed.
+  let stdoutEnded = false
+  let exited = false
+  const finishIfClean = (): void => {
+    if (exited && stdoutEnded && !failed && !stream.destroyed) stream.push(null)
+  }
+
+  child.stdout?.on('data', (chunk: Buffer) => {
+    if (stream.push(chunk) === false) child.stdout?.pause()
+  })
+  child.stdout?.on('end', () => {
+    stdoutEnded = true
+    finishIfClean()
+  })
+  child.stdout?.on('error', (error: Error) => {
+    fail(new Error('ProxyCommand stdout error: ' + error.message))
+  })
+  child.stdin?.on('error', (error: Error) => {
+    // A broken pipe (EPIPE) on stdin occurs naturally when the proxy command
+    // exits early or closes its standard input. Prevent unhandled EventEmitter errors.
+    if ((child.exitCode !== null && child.exitCode !== 0) || child.signalCode !== null) {
+      fail(formatExitError(child.exitCode, child.signalCode, stderr))
+      return
+    }
+    const timer = setTimeout(() => {
+      fail(new Error('ProxyCommand transport error: ' + error.message))
+    }, 200)
+    timer.unref()
+    child.once('exit', (code, signal) => {
+      clearTimeout(timer)
+      if ((code !== null && code !== 0) || signal !== null) {
+        fail(formatExitError(code, signal, stderr))
+      }
+    })
+  })
+  child.on('error', (error: Error) => {
+    fail(new Error('ProxyCommand could not start: ' + error.message))
+  })
+  child.on('exit', (code, signal) => {
+    exited = true
+    if ((code !== null && code !== 0) || signal !== null) {
+      fail(formatExitError(code, signal, stderr))
+      return
+    }
+    finishIfClean()
+  })
+
+  return { stream, child }
+}

package/src/index.ts

@@ -64,7 +64,7 @@ const DEFAULT_ANNOUNCE = false
 const SECTION_ORDER = 150
 
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
-export const SSH_GUIDANCE = '本机已安装 dsh-ssh 插件（DSH 远程 SSH 运维）：侧边栏「SSH」入口；在 dsh-web 插件全家桶仓库（packages/dsh-ssh）统一维护。能力：主机配置存 $DSH_HOME/dsh-ssh.json（默认 ~/.dsh）（可从 ~/.ssh/config 导入）；持久连接池复用长连接（空闲 30 分钟自动断开）；ssh_list 列出主机、ssh_exec 执行远程命令、ssh_upload/ssh_download 传输文件、ssh_tunnel 本地端口转发（访问远程数据库/内网服务）、ssh_cluster 按 aliases/environment/tags 至少一种非空 selector 筛选后集群并发执行；支持密钥/密码/ssh-agent 认证、passphrase 密钥与 ProxyJump 跳板机；Web 终端走 WebSocket。限制：主机操作由用户在 GUI 中配置后 agent 方可使用；密码以明文存在用户主目录私有文件（权限 0600）；命令输出原样返回、可能含敏感信息；断线重连可能重放非幂等命令；传输/执行消耗真实远程资源，先确认再操作。路径区分：本机（dsh host）上的文件与命令一律用本地工具（read / write / edit / bash），ssh_* 工具只针对远程主机上的路径。用户提到「SSH / 远程服务器 / 服务器操作 / 跳板机 / 隧道 / 部署 / 上传下载」时即指本插件，请据此协作。'
+export const SSH_GUIDANCE = '本机已安装 dsh-ssh 插件（DSH 远程 SSH 运维）：侧边栏「SSH」入口；在 dsh-web 插件全家桶仓库（packages/dsh-ssh）统一维护。能力：主机配置存 $DSH_HOME/dsh-ssh.json（默认 ~/.dsh）（可从 ~/.ssh/config 导入）；持久连接池复用长连接（空闲 30 分钟自动断开）；ssh_list 列出主机、ssh_exec 执行远程命令、ssh_upload/ssh_download 传输文件、ssh_tunnel 本地端口转发（访问远程数据库/内网服务）、ssh_cluster 按 aliases/environment/tags 至少一种非空 selector 筛选后集群并发执行；支持密钥/密码/ssh-agent 认证、passphrase 密钥、ProxyJump 跳板机（别名或 [user@]host[:port] 地址）与 OpenSSH 语义的 ProxyCommand（跳过堡垒机客户端场景，只能由用户在 GUI 配置，agent 不可写）；Web 终端走 WebSocket。限制：主机操作由用户在 GUI 中配置后 agent 方可使用；密码以明文存在用户主目录私有文件（权限 0600）；命令输出原样返回、可能含敏感信息；断线重连可能重放非幂等命令；传输/执行消耗真实远程资源，先确认再操作。路径区分：本机（dsh host）上的文件与命令一律用本地工具（read / write / edit / bash），ssh_* 工具只针对远程主机上的路径。用户提到「SSH / 远程服务器 / 服务器操作 / 跳板机 / 隧道 / 部署 / 上传下载」时即指本插件，请据此协作。'
 
 /**
  * Mount the SSH engine, routes, tools, and announcement.

package/src/protocol.ts

@@ -35,6 +35,13 @@ export interface SshHostEntry {
   }
   /** Jump chain: local aliases connected through in order (ProxyJump). */
   proxyJump: string[]
+  /**
+   * OpenSSH-compatible ProxyCommand: a shell command whose stdio becomes the
+   * connection transport. Tokens %h (host) / %p (port) / %r (user) / %n (alias)
+   * expand before exec and %% is a literal percent; an empty value or 'none'
+   * means "no proxy command". Mutually exclusive with a non-empty proxyJump.
+   */
+  proxyCommand?: string
   /** Free-form note. */
   description?: string
   /** Deployment environment label (development / production / ...). */
@@ -57,6 +64,8 @@ export interface SshHostSummary {
   /** Whether the key path exists on the host machine (key auth only). */
   keyReady: boolean
   proxyJump: string[]
+  /** Configured ProxyCommand, echoed to the browser so the form can edit it. */
+  proxyCommand?: string
   description?: string
   environment?: string
   tags: string[]
@@ -142,19 +151,34 @@ export interface HostPayload {
    */
   auth?: SshHostEntry['auth']
   proxyJump?: string[]
+  /**
+   * ProxyCommand to store. An empty string or 'none' clears a stored value;
+   * omitting the key leaves it untouched (PATCH semantics).
+   */
+  proxyCommand?: string
   description?: string
   environment?: string
   tags?: string[]
   location?: string
 }
 
+/** Why one ssh_config Host block was not imported. */
+export type ImportSkipReason = 'wildcard' | 'existing' | 'match' | 'invalid'
+
+/** One skipped ssh_config block and the reason it could not be imported. */
+export interface ImportSkipBlock {
+  /** Host pattern (or '`Match …`' label) that was skipped. */
+  name: string
+  reason: ImportSkipReason
+}
+
 /** Import outcome from ~/.ssh/config. */
 export interface ImportResult {
   parsed: number
   added: number
   skipped: number
-  /** Aliases that failed to map (wildcard patterns, missing HostName, ...). */
-  skippedNames: string[]
+  /** Every skipped block with its reason, in scan order and deduplicated by name. */
+  skippedBlocks: ImportSkipBlock[]
 }
 
 /** JSON error body used by every route. */

package/src/routes.ts

@@ -136,7 +136,7 @@ const maxUploadBytes = deps.maxUploadBytes ?? MAX_UPLOAD_BYTES
             // without this the pool would keep running commands on the old
             // host/credentials until the idle sweep (up to 30 min later).
             const patch = body as Record<string, unknown>
-            if (['host', 'port', 'user', 'auth', 'proxyJump'].some(key => patch[key] !== undefined)) {
+            if (['host', 'port', 'user', 'auth', 'proxyJump', 'proxyCommand'].some(key => patch[key] !== undefined)) {
               engine.dropAlias(alias)
             }
             writeJson(res, 200, { host: store.summarize(entry) })

package/src/ssh-config.ts

@@ -0,0 +1,153 @@
+/**
+ * Minimal `~/.ssh/config` reader for the one-shot host import: Host blocks with
+ * `Include` expansion and explicit skip reasons. Values stay raw strings; the
+ * store maps them onto a HostPayload.
+ *
+ * Deliberate simplifications (documented in the package README):
+ *   - `Match` blocks are skipped — their options are conditional and must never
+ *     merge into the Host block above them.
+ *   - A multi-pattern `Host a b` line only exposes its first pattern.
+ *   - Include pathnames accept `~`, globs, and several whitespace-separated
+ *     pathnames, but not environment variables, `%` tokens, or quoting.
+ *   - Relative Include pathnames resolve against the directory of the config
+ *     file the import started from (OpenSSH: `~/.ssh` for a user config).
+ *   - A file that already contributed lines is never read twice, which doubles
+ *     as the Include cycle guard.
+ */
+
+import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { dirname, isAbsolute, join } from 'node:path'
+import type { ImportSkipBlock } from './protocol.ts'
+
+/** One parsed Host block. */
+export interface SshBlock {
+  /** Raw Host line value (may hold several whitespace-separated patterns). */
+  pattern: string
+  /** Lowercased option key/value pairs; the last occurrence of a key wins. */
+  props: Record<string, string>
+}
+
+/** One config file read, with every Include expanded in place. */
+export interface SshConfigRead {
+  blocks: SshBlock[]
+  skipped: ImportSkipBlock[]
+}
+
+/** Include recursion guard: a cycle or a runaway chain stops here. */
+const MAX_INCLUDE_DEPTH = 16
+
+/** The only line shape ssh_config knows: `Keyword value...` (case-insensitive). */
+const LINE_RE = /^([A-Za-z0-9_-]+)\s+(.+)$/
+
+/** Expand a leading `~` the way OpenSSH does for user configuration files. */
+function expandTilde(path: string): string {
+  if (path === '~') return homedir()
+  if (path.startsWith('~/')) return join(homedir(), path.slice(2))
+  return path
+}
+
+/** Turn one glob segment into a matcher (`*` and `?` only). */
+function segmentMatcher(segment: string): RegExp {
+  const escaped = segment.replace(/[.+^${}()|[\]\\]/g, '\\$&')
+  return new RegExp('^' + escaped.replace(/\*/g, '.*').replace(/\?/g, '.') + '$')
+}
+
+/**
+ * Expand a segment list against the filesystem. Wildcards match whole segments
+ * only; matches are sorted so a glob import stays deterministic.
+ */
+function globSegments(prefix: string, segments: string[]): string[] {
+  const [head, ...rest] = segments
+  if (head === undefined) return [prefix]
+  if (!/[*?]/.test(head)) return globSegments(join(prefix, head), rest)
+  let names: string[]
+  try {
+    names = readdirSync(prefix)
+  } catch {
+    return []
+  }
+  const matcher = segmentMatcher(head)
+  return names.filter(name => matcher.test(name)).sort().flatMap(name => globSegments(join(prefix, name), rest))
+}
+
+/** Resolve one Include pathname into the existing regular files it names. */
+function resolveInclude(spec: string, baseDir: string): string[] {
+  const expanded = expandTilde(spec)
+  const full = isAbsolute(expanded) ? expanded : join(baseDir, expanded)
+  if (!/[*?]/.test(full)) return existsSync(full) ? [full] : []
+  const root = /^([A-Za-z]:[\\/]|[\\/])/.exec(full)?.[1] ?? ''
+  const segments = full.slice(root.length).split(/[\\/]+/).filter(part => part !== '')
+  const files = globSegments(root === '' ? '.' : root, segments)
+  return files.filter(path => {
+    try {
+      return statSync(path).isFile()
+    } catch {
+      return false
+    }
+  })
+}
+
+/** Read one file into lines, splicing every `Include` in place. */
+function readLines(file: string, baseDir: string, visited: Set<string>, depth: number): string[] {
+  if (depth > MAX_INCLUDE_DEPTH) return []
+  let key: string
+  try {
+    key = realpathSync(file)
+  } catch {
+    return []
+  }
+  if (visited.has(key)) return []
+  visited.add(key)
+  let text: string
+  try {
+    text = readFileSync(key, 'utf8')
+  } catch {
+    return []
+  }
+  const out: string[] = []
+  for (const raw of text.split(/\r?\n/)) {
+    const match = LINE_RE.exec(raw.trim())
+    if (match === null || match[1].toLowerCase() !== 'include') {
+      out.push(raw)
+      continue
+    }
+    for (const spec of match[2].trim().split(/\s+/).filter(part => part !== '')) {
+      for (const included of resolveInclude(spec, baseDir)) {
+        out.push(...readLines(included, baseDir, visited, depth + 1))
+      }
+    }
+  }
+  return out
+}
+
+/**
+ * Parse one ssh_config file (Include expanded) into Host blocks plus the
+ * `Match` blocks that were deliberately skipped.
+ */
+export function readSshConfigBlocks(configPath: string): SshConfigRead {
+  const blocks: SshBlock[] = []
+  const skipped: ImportSkipBlock[] = []
+  const lines = readLines(configPath, dirname(configPath), new Set<string>(), 0)
+  let current: SshBlock | undefined
+  for (const raw of lines) {
+    const match = LINE_RE.exec(raw.trim())
+    if (match === null) continue
+    const key = match[1].toLowerCase()
+    const value = match[2].trim()
+    if (key === 'host') {
+      current = { pattern: value, props: {} }
+      blocks.push(current)
+      continue
+    }
+    if (key === 'match') {
+      // Everything below a Match line is conditional; attributing it to the
+      // Host block above would import a wrong HostName / ProxyCommand.
+      skipped.push({ name: 'Match ' + value, reason: 'match' })
+      current = undefined
+      continue
+    }
+    if (current !== undefined) current.props[key] = value
+  }
+  return { blocks, skipped }
+}

package/src/store.ts

@@ -11,7 +11,8 @@ import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSyn
 import { homedir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { dshHome } from './dsh-home.ts'
-import type { HostPayload, ImportResult, SshHostEntry, SshHostSummary } from './protocol.ts'
+import type { HostPayload, ImportResult, ImportSkipBlock, ImportSkipReason, SshHostEntry, SshHostSummary } from './protocol.ts'
+import { readSshConfigBlocks } from './ssh-config.ts'
 
 /** File format version. */
 const FORMAT_VERSION = 1
@@ -57,6 +58,17 @@ export function validateHostPayload(payload: unknown): string | undefined {
   if (p.proxyJump !== undefined && (!Array.isArray(p.proxyJump) || p.proxyJump.some(x => typeof x !== 'string' || x === ''))) {
     return 'proxyJump must be an array of alias strings'
   }
+  if (p.proxyCommand !== undefined && typeof p.proxyCommand !== 'string') {
+    return 'proxyCommand must be a string when provided'
+  }
+  // OpenSSH resolves ProxyCommand and ProxyJump by "whichever appears first in
+  // the config"; a stored entry has no order, so the combination is rejected
+  // instead of silently picking one transport.
+  const proxyCommand = typeof p.proxyCommand === 'string' ? normalizeProxyCommand(p.proxyCommand) : undefined
+  const proxyJump = Array.isArray(p.proxyJump) ? p.proxyJump as string[] : []
+  if (proxyCommand !== undefined && proxyJump.length > 0) {
+    return 'proxyCommand and proxyJump cannot be combined — pick one transport per host'
+  }
   if (p.tags !== undefined && (!Array.isArray(p.tags) || p.tags.some(x => typeof x !== 'string'))) {
     return 'tags must be an array of strings'
   }
@@ -117,6 +129,7 @@ export class HostStore {
       auth: entry.auth.kind,
       keyReady,
       proxyJump: [...entry.proxyJump],
+      ...(entry.proxyCommand !== undefined ? { proxyCommand: entry.proxyCommand } : {}),
       // Optional fields are spread conditionally: the tool bridge rejects
       // undefined-valued properties as non-lossless JSON.
       ...(entry.description !== undefined ? { description: entry.description } : {}),
@@ -153,6 +166,7 @@ export class HostStore {
         agentPath: payload.auth.kind === 'agent' ? normalizeAgentPath(payload.auth.agentPath) : undefined,
       },
       proxyJump: [...(payload.proxyJump ?? [])],
+      proxyCommand: normalizeProxyCommand(payload.proxyCommand),
       description: payload.description?.trim() || undefined,
       environment: payload.environment?.trim() || undefined,
       tags: [...(payload.tags ?? [])].map(tag => tag.trim()).filter(tag => tag !== ''),
@@ -184,6 +198,17 @@ export class HostStore {
     if (patch.proxyJump !== undefined && (!Array.isArray(patch.proxyJump) || patch.proxyJump.some(x => typeof x !== 'string' || x === ''))) {
       throw new Error('proxyJump must be an array of alias strings')
     }
+    if (patch.proxyCommand !== undefined && typeof patch.proxyCommand !== 'string') {
+      throw new Error('proxyCommand must be a string when provided')
+    }
+    // The mutual exclusion is checked on the MERGED view: a patch that only
+    // adds one transport must not slip past a stored value of the other.
+    const mergedProxyCommand = patch.proxyCommand !== undefined
+      ? normalizeProxyCommand(patch.proxyCommand)
+      : entry.proxyCommand
+    if (mergedProxyCommand !== undefined && (patch.proxyJump ?? entry.proxyJump).length > 0) {
+      throw new Error('proxyCommand and proxyJump cannot be combined — pick one transport per host')
+    }
     if (patch.tags !== undefined && (!Array.isArray(patch.tags) || patch.tags.some(x => typeof x !== 'string'))) {
       throw new Error('tags must be an array of strings')
     }
@@ -220,6 +245,7 @@ export class HostStore {
       }
     }
     if (patch.proxyJump !== undefined) entry.proxyJump = [...patch.proxyJump]
+    if (patch.proxyCommand !== undefined) entry.proxyCommand = mergedProxyCommand
     if (patch.description !== undefined) entry.description = patch.description.trim() || undefined
     if (patch.environment !== undefined) entry.environment = patch.environment.trim() || undefined
     if (patch.tags !== undefined) entry.tags = [...patch.tags].map(tag => tag.trim()).filter(tag => tag !== '')
@@ -240,55 +266,41 @@ export class HostStore {
 
   /**
    * Import hosts from `~/.ssh/config`: Host blocks with a single non-wildcard
-   * pattern and a HostName become entries (key auth via IdentityFile, jump
-   * hosts via ProxyJump). Existing aliases are skipped.
+   * pattern become entries (a missing HostName falls back to the pattern
+   * itself; key auth via IdentityFile; jump hosts via ProxyJump; ProxyCommand
+   * kept verbatim). `Include` files are expanded, and `Match` blocks,
+   * wildcard patterns, and aliases that already exist are skipped with a
+   * reason instead of silently disappearing.
    * @returns import statistics.
    */
   importFromSshConfig(): ImportResult {
     // Per-run statistics: a later import must not report earlier runs' skips.
-    this.skippedNames = new Set<string>()
+    this.skippedBlocks = []
     const configPath = this.sshConfigOverride ?? sshConfigPath()
-    if (!existsSync(configPath)) return { parsed: 0, added: 0, skipped: 0, skippedNames: [] }
-    const lines = readFileSync(configPath, 'utf8').split(/\r?\n/)
-    const blocks: { pattern: string; props: Record<string, string> }[] = []
-    let current: { pattern: string; props: Record<string, string> } | undefined
-    const skip = (name: string, seen: Set<string>): void => {
-      if (name !== '' && !seen.has(name)) {
-        seen.add(name)
-        this.skippedNames.add(name)
-      }
-    }
-    for (const raw of lines) {
-      const line = raw.trim()
-      if (line === '' || line.startsWith('#')) continue
-      const match = /^([A-Za-z0-9_\-]+)\s+(.+)$/.exec(line)
-      if (match === null) continue
-      const key = match[1].toLowerCase()
-      const value = match[2].trim()
-      if (key === 'host') {
-        current = { pattern: value, props: {} }
-        blocks.push(current)
-      } else if (current !== undefined) {
-        current.props[key] = value
-      }
+    if (!existsSync(configPath)) return { parsed: 0, added: 0, skipped: 0, skippedBlocks: [] }
+    const { blocks, skipped } = readSshConfigBlocks(configPath)
+    this.skippedBlocks = [...skipped]
+    const skip = (name: string, reason: ImportSkipReason): void => {
+      if (name === '') return
+      if (this.skippedBlocks.some(block => block.name === name)) return
+      this.skippedBlocks.push({ name, reason })
     }
     let added = 0
     for (const block of blocks) {
       const pattern = block.pattern.split(/\s+/)[0]
       if (pattern.includes('*') || pattern.includes('?')) {
-        skip(pattern, this.skippedNames)
+        skip(pattern, 'wildcard')
         continue
       }
-      const hostName = block.props.hostname
-      if (hostName === undefined || hostName === '') {
-        skip(pattern, this.skippedNames)
-        continue
-      }
-      const existing = this.list().some(entry => entry.alias === pattern)
-      if (existing) {
-        skip(pattern, this.skippedNames)
+      if (this.list().some(entry => entry.alias === pattern)) {
+        skip(pattern, 'existing')
         continue
       }
+      // A block without HostName is a usable OpenSSH entry: the Host pattern
+      // itself is the hostname.
+      const hostName = block.props.hostname !== undefined && block.props.hostname !== ''
+        ? block.props.hostname
+        : pattern
       const payload: HostPayload = {
         alias: pattern,
         host: hostName,
@@ -309,6 +321,7 @@ export class HostStore {
         proxyJump: block.props.proxyjump !== undefined
           ? block.props.proxyjump.split(',').map(hop => hop.trim()).filter(hop => hop !== '')
           : [],
+        proxyCommand: block.props.proxycommand,
         description: block.props.description,
         environment: block.props.environment,
         tags: (block.props.tags ?? '').split(',').map(tag => tag.trim()).filter(tag => tag !== ''),
@@ -318,14 +331,14 @@ export class HostStore {
         this.create(payload)
         added += 1
       } catch {
-        // Unusable entry (bad alias grammar etc.) — count as skipped.
-        skip(pattern, this.skippedNames)
+        // Unusable entry (bad alias grammar, conflicting transports, ...).
+        skip(pattern, 'invalid')
       }
     }
-    return { parsed: blocks.length, added, skipped: this.skippedNames.size, skippedNames: [...this.skippedNames] }
+    return { parsed: blocks.length, added, skipped: this.skippedBlocks.length, skippedBlocks: [...this.skippedBlocks] }
   }
 
-  private skippedNames = new Set<string>()
+  private skippedBlocks: ImportSkipBlock[] = []
 
   /**
    * Last parsed store keyed by file identity. list/find ride every acquire
@@ -387,6 +400,17 @@ export function normalizeAgentPath(agentPath: string | undefined): string | unde
   return expandHome(trimmed)
 }
 
+/**
+ * Normalize a ProxyCommand for storage: trim, and treat an empty value or
+ * OpenSSH's `none` keyword as "no proxy command" (an explicit clear).
+ */
+export function normalizeProxyCommand(raw: string | undefined): string | undefined {
+  const trimmed = raw?.trim()
+  if (trimmed === undefined || trimmed === '') return undefined
+  if (trimmed.toLowerCase() === 'none') return undefined
+  return trimmed
+}
+
 /** Expand a leading `~` in a filesystem path. */
 export function expandHome(path: string): string {
   if (path === '~') return homedir()