@linxin666/dsh-ssh 0.3.20 → 0.3.22

package/src/client/panel/HostsTab.tsx

@@ -5,7 +5,8 @@
  */
 import { useCallback, useEffect, useRef, useState, type ReactNode } from 'react'
 import type { SshApi } from '../api.ts'
-import type { SshHostSummary, TestResult } from '../../protocol.ts'
+import type { ImportSkipBlock, ImportSkipReason, SshHostSummary, TestResult } from '../../protocol.ts'
+import type { SshKey } from '../locales.ts'
 import { errorMessage, tt } from './helpers.ts'
 import { HostFormDialog } from './HostFormDialog.tsx'
 import css from './panel.module.css'
@@ -20,6 +21,17 @@ export interface HostsTabProps {
 /** The host-form dialog invocation. */
 type DialogState = { mode: 'create' } | { mode: 'edit'; host: SshHostSummary }
 
+/** Skipped-block rows rendered before the "and N more" summary. */
+const IMPORT_SKIP_LIMIT = 8
+
+/** Locale key per import skip reason (no dynamic key concatenation). */
+const IMPORT_REASON_KEY: Record<ImportSkipReason, SshKey> = {
+  wildcard: 'import.reason.wildcard',
+  existing: 'import.reason.existing',
+  match: 'import.reason.match',
+  invalid: 'import.reason.invalid',
+}
+
 /** Host list grouping modes (#379). */
 export type HostGroupBy = 'none' | 'environment' | 'tags'
 
@@ -67,6 +79,8 @@ export function HostsTab({ api, onConnect }: HostsTabProps) {
   const [testResults, setTestResults] = useState<Record<string, TestResult>>({})
   const [importing, setImporting] = useState(false)
   const [notice, setNotice] = useState<string | null>(null)
+  /** Blocks the last import skipped, with the reason each one was left out. */
+  const [importSkips, setImportSkips] = useState<ImportSkipBlock[]>([])
   const [dialog, setDialog] = useState<DialogState | null>(null)
   const [groupBy, setGroupBy] = useState<HostGroupBy>('none')
   const [collapsed, setCollapsed] = useState<Record<string, boolean>>({})
@@ -153,6 +167,7 @@ export function HostsTab({ api, onConnect }: HostsTabProps) {
       const result = await api.importSshConfig()
       if (!mountedRef.current) return
       setNotice(tt('hosts.imported', { parsed: result.parsed, added: result.added, skipped: result.skipped }))
+      setImportSkips(result.skippedBlocks)
       void load()
     } catch (cause) {
       if (!mountedRef.current) return
@@ -167,7 +182,12 @@ export function HostsTab({ api, onConnect }: HostsTabProps) {
     return (
       <tr key={host.alias}>
         <td className={css.mono}>{host.alias}</td>
-        <td className={css.mono}>{host.host}:{host.port}</td>
+        <td className={css.mono}>
+          {host.host}:{host.port}
+          {host.proxyCommand !== undefined && (
+            <span className={css.badge} data-kind="proxy" title={host.proxyCommand}>{tt('hosts.proxyBadge')}</span>
+          )}
+        </td>
         <td>{host.user}</td>
         <td><span className={css.badge} data-kind={host.auth}>{host.auth === 'key' ? tt('form.auth.key') : host.auth === 'password' ? tt('form.auth.password') : tt('form.auth.agent')}</span></td>
         <td className={css.cellMuted}>{host.environment ?? ''}</td>
@@ -234,6 +254,21 @@ export function HostsTab({ api, onConnect }: HostsTabProps) {
         <button type="button" className={css.ghostButton} disabled={importing} onClick={() => { void importConfig() }}>{importing ? tt('common.loading') : tt('hosts.import')}</button>
       </div>
       {notice !== null && <div className={css.banner} data-kind="ok">{notice}</div>}
+      {notice !== null && importSkips.length > 0 && (
+        <ul className={css.importSkips}>
+          {importSkips.slice(0, IMPORT_SKIP_LIMIT).map(block => (
+            <li key={block.name} className={css.importSkipRow}>
+              <span className={css.mono}>{block.name}</span>
+              <span className={css.cellMuted}>{tt(IMPORT_REASON_KEY[block.reason])}</span>
+            </li>
+          ))}
+          {importSkips.length > IMPORT_SKIP_LIMIT && (
+            <li className={css.importSkipRow}>
+              <span className={css.cellMuted}>{tt('import.more', { count: importSkips.length - IMPORT_SKIP_LIMIT })}</span>
+            </li>
+          )}
+        </ul>
+      )}
       {error !== null && <div className={css.banner} data-kind="error">{tt('common.error', { error })}</div>}
       {hosts === null && error === null && <div className={css.loading}>{tt('common.loading')}</div>}
       {hosts !== null && hosts.length === 0 && <div className={css.empty}>{tt('hosts.empty')}</div>}

package/src/client/panel/SshPanel.tsx

@@ -5,7 +5,7 @@
  * activation. The hosts tab's connect action switches here to the terminal
  * tab with the chosen alias preselected.
  */
-import { useState } from 'react'
+import { useCallback, useState, useSyncExternalStore } from 'react'
 import type { SshApi } from '../api.ts'
 import type { PanelController } from './controller.ts'
 import { tt, type TerminalFontSource } from './helpers.ts'
@@ -46,6 +46,10 @@ interface ConnectRequest {
 
 /** The tabbed SSH panel. */
 export function SshPanel({ controller, api, terminalFont }: SshPanelProps) {
+  const panelOpen = useSyncExternalStore(
+    useCallback(listener => controller.subscribe(listener), [controller]),
+    useCallback(() => controller.getSnapshot().panelOpen, [controller]),
+  )
   const [activeTab, setActiveTab] = useState<SshTab>('hosts')
   const [connectRequest, setConnectRequest] = useState<ConnectRequest | null>(null)
 
@@ -81,7 +85,7 @@ export function SshPanel({ controller, api, terminalFont }: SshPanelProps) {
         {activeTab === 'hosts' && <HostsTab api={api} onConnect={handleConnect} />}
         {activeTab === 'terminal' && <TerminalTab api={api} presetAlias={connectRequest?.alias} requestId={connectRequest?.nonce} terminalFont={terminalFont} />}
         {activeTab === 'transfer' && <TransferTab api={api} />}
-        {activeTab === 'tunnels' && <TunnelsTab api={api} />}
+        {activeTab === 'tunnels' && <TunnelsTab api={api} active={panelOpen} />}
         {activeTab === 'cluster' && <ClusterTab api={api} />}
       </div>
     </div>

package/src/client/panel/TunnelsTab.tsx

@@ -1,6 +1,6 @@
 /**
  * Tunnels tab: the live local port-forward list (auto-refresh every 5s while
- * mounted) with per-row stop, a stop-all action scoped to the selected alias,
+ * visible) with per-row stop, a stop-all action scoped to the selected alias,
  * and a new-tunnel form.
  */
 import { useEffect, useRef, useState } from 'react'
@@ -9,7 +9,7 @@ import type { SshHostSummary, TunnelInfo } from '../../protocol.ts'
 import { errorMessage, tt } from './helpers.ts'
 import css from './panel.module.css'
 
-/** Live-tunnel polling interval while the tab is mounted (ms). */
+/** Live-tunnel polling interval while the tab and page are visible (ms). */
 export const TUNNEL_POLL_MS = 5000
 
 /**
@@ -37,10 +37,12 @@ export function diffTunnels(prev: TunnelInfo[] | null, next: TunnelInfo[]): Tunn
 /** Tunnels tab props. */
 export interface TunnelsTabProps {
   api: SshApi
+  /** Pause automatic reads while the owning panel is closed, preserving form state. */
+  active?: boolean
 }
 
 /** The tunnels tab. */
-export function TunnelsTab({ api }: TunnelsTabProps) {
+export function TunnelsTab({ api, active = true }: TunnelsTabProps) {
   const [hosts, setHosts] = useState<SshHostSummary[]>([])
   const [tunnels, setTunnels] = useState<TunnelInfo[] | null>(null)
   const [error, setError] = useState<string | null>(null)
@@ -65,28 +67,66 @@ export function TunnelsTab({ api }: TunnelsTabProps) {
     return () => { disposed = true }
   }, [api])
 
-  // Live list with a TUNNEL_POLL_MS heartbeat while mounted. Every load
+  // Live list with a TUNNEL_POLL_MS heartbeat while visible. Every load
   // carries a sequence number so stale responses never overwrite newer
   // state, and the list is diff-set so an unchanged poll tick keeps the
   // previous state reference (no wasted re-render).
   const seqRef = useRef(0)
+  const automaticRead = useRef<{ running: boolean; resume?: () => void }>({ running: false })
   useEffect(() => {
+    if (!active) return
+    let disposed = false
+    const read = automaticRead.current
+    let timer: ReturnType<typeof setInterval> | undefined
     const load = async (): Promise<void> => {
+      if (disposed || read.running || document.visibilityState === 'hidden') return
+      read.running = true
       const seq = ++seqRef.current
       try {
         const list = await api.listTunnels()
-        if (seq !== seqRef.current) return
+        if (disposed || seq !== seqRef.current) return
         setTunnels(prev => diffTunnels(prev, list) ?? prev)
         setError(null)
       } catch (cause) {
-        if (seq !== seqRef.current) return
+        if (disposed || seq !== seqRef.current) return
         setError(errorMessage(cause))
+      } finally {
+        read.running = false
+        const resume = read.resume
+        read.resume = undefined
+        resume?.()
       }
     }
-    void load()
-    const timer = setInterval(() => { void load() }, TUNNEL_POLL_MS)
-    return () => { clearInterval(timer) }
-  }, [api])
+    const resume = (): void => {
+      if (disposed || document.visibilityState === 'hidden') return
+      // Rapid close/reopen must not start more reads while the old effect's
+      // request is pending. Keep only the latest visible refresh.
+      if (read.running) read.resume = resume
+      else void load()
+    }
+    const stop = (): void => {
+      if (timer !== undefined) clearInterval(timer)
+      timer = undefined
+    }
+    const onVisibility = (): void => {
+      if (document.visibilityState === 'hidden') {
+        stop()
+        if (read.resume === resume) read.resume = undefined
+      } else if (timer === undefined) {
+        resume()
+        timer = setInterval(() => { void load() }, TUNNEL_POLL_MS)
+      }
+    }
+    document.addEventListener('visibilitychange', onVisibility)
+    onVisibility()
+    return () => {
+      disposed = true
+      seqRef.current += 1
+      if (read.resume === resume) read.resume = undefined
+      stop()
+      document.removeEventListener('visibilitychange', onVisibility)
+    }
+  }, [api, active])
 
   const refresh = async (): Promise<void> => {
     const seq = ++seqRef.current

package/src/client/panel/panel.module.css

@@ -433,6 +433,12 @@ html[data-dsh-ssh-active]:not([data-dsh-taskboard-active]) [class*='centerCol']
   border-color: var(--dsw-alias-state-success-primary);
 }
 
+.badge[data-kind='proxy'] {
+  margin-left: 6px;
+  color: var(--dsw-alias-state-business-primary);
+  border-color: var(--dsw-alias-state-business-primary);
+}
+
 .badge[data-status='ok'] {
   color: var(--dsw-alias-state-success-primary);
   border-color: var(--dsw-alias-state-success-primary);
@@ -562,6 +568,27 @@ html[data-dsh-ssh-active]:not([data-dsh-taskboard-active]) [class*='centerCol']
   overflow-wrap: anywhere;
 }
 
+/* Import skip detail: what an import left out and why (#1448). */
+.importSkips {
+  list-style: none;
+  margin: 6px 0 0;
+  padding: 8px 12px;
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  border: 1px solid var(--dsw-alias-border-l1);
+  border-radius: 8px;
+  background: var(--dsw-alias-bg-layer-2);
+}
+
+.importSkipRow {
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  gap: 12px;
+  font-size: 12px;
+}
+
 .banner[data-kind='ok'] {
   color: var(--dsw-alias-state-success-primary);
   border-color: var(--dsw-alias-state-success-primary);

package/src/client/panel-mount-core.ts

@@ -20,10 +20,11 @@
  * (shared/client/sidebar-entry-core.ts, synced copy).
  */
 import { createRoot, type Root } from 'react-dom/client'
+import { subscribeBodyInvalidations } from './body-mutations.ts'
 
 /** Options for mountCenterPanel; dsh-ssh mount.tsx and dsh-task-board board-mount.tsx are the canonical consumers. */
 export interface CenterPanelMountOptions {
-  /** Render the panel React tree into a root (initial mount, remount, locale refresh). */
+  /** Render the panel tree (first open, remount while open, locale refresh). */
   render: (root: Root) => void
   /** dataset key of the injected container's view attribute, e.g. `dshSshView` for `data-dsh-ssh-view`. */
   viewDatasetKey: string
@@ -79,31 +80,38 @@ export function mountCenterPanel(options: CenterPanelMountOptions): () => void {
   } catch { /* locale service absent: the panel follows its next natural re-render */ }
 
   const ensure = (): void => {
-    if (container !== undefined) {
-      if (container.isConnected) return
+    if (container !== undefined && !container.isConnected) {
       // The conversation pane was replaced; drop the stale tree and remount.
       root?.unmount()
       root = undefined
       container.remove()
       container = undefined
     }
-    const column = conversationColumn()
-    if (column === undefined) return
-    container = document.createElement('div')
-    container.dataset[options.viewDatasetKey] = ''
-    container.dataset.dshPlugin = options.pluginName
-    container.className = options.viewClassName
-    column.appendChild(container)
+    if (container === undefined) {
+      const column = conversationColumn()
+      if (column === undefined) return
+      container = document.createElement('div')
+      container.dataset[options.viewDatasetKey] = ''
+      container.dataset.dshPlugin = options.pluginName
+      container.className = options.viewClassName
+      column.appendChild(container)
+    }
+    // Keep a visited tree mounted so drafts and terminal sessions survive
+    // close/reopen; an unused panel needs neither a React root nor effects.
+    if (root !== undefined || !options.isOpen()) return
     root = createRoot(container)
     options.render(root)
   }
 
   // The frame mounts after boot settlement; watch for the column's arrival.
-  const waitObserver = new MutationObserver(() => { ensure() })
-  waitObserver.observe(document.body, { childList: true, subtree: true })
+  // The observation is the page-wide hub (shared/client/body-mutations.ts):
+  // every family panel used to hold its own document.body subtree observer, so
+  // the per-mutation cost grew with the number of installed plugins.
+  const unsubscribeBody = subscribeBodyInvalidations(() => { ensure() })
 
   const applyActive = (): void => {
     if (options.isOpen()) {
+      ensure()
       // Single-occupant center column: opening this panel must evict the
       // sibling panel, both its html attribute and its controller state,
       // otherwise the two panels' visibility rules fight and the second
@@ -135,7 +143,7 @@ export function mountCenterPanel(options: CenterPanelMountOptions): () => void {
   return () => {
     document.removeEventListener('click', onClickSidebarRow, true)
     document.removeEventListener(ACTIVATE_EVENT, onOtherActivate)
-    waitObserver.disconnect()
+    unsubscribeBody()
     unsubscribe()
     unsubscribeLocale?.()
     document.documentElement.removeAttribute(options.activeAttribute)

package/src/client/sidebar-entry-core.ts

@@ -14,6 +14,7 @@
  * Packages receive this file as a generated copy via scripts/sync-shared.mjs;
  * edit the shared source and re-run the sync instead of editing a copy.
  */
+import { subscribeBodyInvalidations } from './body-mutations.ts'
 
 /** Per-package configuration for one sidebar entry row. */
 export interface SidebarEntryOptions {
@@ -188,13 +189,15 @@ export function mountSidebarEntry(options: SidebarEntryOptions): () => void {
 
   // Body-level watcher retained as the "whole rebuild" fallback: when the shell
   // tears down the whole sidebar pane, the root observer is gone with it and
-  // only this body observation can notice the new pane mounting. It is no
-  // longer disconnected after placement; the placed-and-still-mounted case
+  // only this body observation can notice the new pane mounting. It stays
+  // subscribed after placement; the placed-and-still-mounted case
   // short-circuits through the cheap document.body.contains(entry) check, so
-  // unrelated app mutations (e.g. chat streaming) cost one contains check
-  // instead of churning the full re-query.
-  const waitObserver = new MutationObserver(() => { tryPlace() })
-  waitObserver.observe(document.body, { childList: true, subtree: true })
+  // unrelated app mutations (e.g. chat streaming) cost one contains check per
+  // frame instead of churning the full re-query. The body observation itself is
+  // the page-wide hub (shared/client/body-mutations.ts): every family plugin
+  // used to hold its own body subtree observer, so the per-mutation cost grew
+  // with the number of installed plugins; the hub keeps exactly one.
+  const unsubscribeBody = subscribeBodyInvalidations(() => { tryPlace() })
 
   // Self-heal: if a React re-render displaces the row, re-insert it in the
   // same frame (microtask before paint -> no visible flicker).
@@ -225,7 +228,7 @@ export function mountSidebarEntry(options: SidebarEntryOptions): () => void {
   tryPlace()
 
   return () => {
-    waitObserver.disconnect()
+    unsubscribeBody()
     rootObserver.disconnect()
     unsubscribeRefresh?.()
     unsubscribeActive?.()

package/src/engine/connection-pool.ts

@@ -4,9 +4,11 @@
  */
 
 import { existsSync, readFileSync } from 'node:fs'
+import type { Duplex } from 'node:stream'
 import { Client, type ConnectConfig } from 'ssh2'
 import type { ExecResult, SshHostEntry } from '../protocol.ts'
 import { expandHome, normalizeAgentPath, type HostStore } from '../store.ts'
+import { startProxyCommand, type ProxyTarget } from './proxy-command.ts'
 
 /** Default engine knobs. */
 export interface EngineOptions {
@@ -121,6 +123,13 @@ export function connectClient(config: ConnectConfig, onKeyboardInteractive?: Key
     const fail = (error: unknown): void => {
       if (settled) return
       settled = true
+      // A caller-supplied transport (a jump forwardOut stream or a
+      // ProxyCommand) must not outlive the client that failed to use it, or
+      // its child process leaks.
+      const sock = config.sock
+      if (sock !== undefined && typeof (sock as { destroy?: unknown }).destroy === 'function') {
+        try { (sock as { destroy: () => void }).destroy() } catch { /* already closed */ }
+      }
       try { client.destroy() } catch { /* already closed */ }
       reject(error instanceof Error ? error : new Error(String(error)))
     }
@@ -169,10 +178,86 @@ export function appendOutput(target: { text: string; truncated: boolean }, chunk
   target.text += chunk.toString('utf8')
 }
 
+/** The ProxyCommand token source for one entry. */
+function proxyTargetOf(entry: SshHostEntry): ProxyTarget {
+  return { host: entry.host, port: entry.port, user: entry.user, alias: entry.alias }
+}
+
+/**
+ * Parse an OpenSSH jump hop written as an address: `[user@]host[:port]`
+ * (an IPv6 literal must be bracketed). Returns undefined when the value is not
+ * an address at all.
+ */
+export function parseJumpSpec(spec: string): { host: string; port?: number; user?: string } | undefined {
+  const trimmed = spec.trim()
+  if (trimmed === '') return undefined
+  const at = trimmed.lastIndexOf('@')
+  const user = at >= 0 ? trimmed.slice(0, at) : undefined
+  const rest = at >= 0 ? trimmed.slice(at + 1) : trimmed
+  if (rest === '') return undefined
+  let host = rest
+  let portText: string | undefined
+  if (rest.startsWith('[')) {
+    const end = rest.indexOf(']')
+    if (end < 0) return undefined
+    host = rest.slice(1, end)
+    const tail = rest.slice(end + 1)
+    if (tail.startsWith(':')) portText = tail.slice(1)
+    else if (tail !== '') return undefined
+  } else {
+    const colon = rest.indexOf(':')
+    if (colon >= 0) {
+      host = rest.slice(0, colon)
+      portText = rest.slice(colon + 1)
+    }
+  }
+  if (host === '') return undefined
+  let port: number | undefined
+  if (portText !== undefined) {
+    port = Number(portText)
+    if (!Number.isInteger(port) || port < 1 || port > 65535) return undefined
+  }
+  return {
+    host,
+    ...(port !== undefined ? { port } : {}),
+    ...(user !== undefined && user !== '' ? { user } : {}),
+  }
+}
+
+/**
+ * Resolve one ProxyJump spec: an alias configured in this plugin wins, and any
+ * other value is read as an OpenSSH address whose credentials come from the
+ * target entry (an ad-hoc hop has no stored auth of its own).
+ */
+export function resolveHop(engine: PoolEngine, entry: SshHostEntry, spec: string): SshHostEntry {
+  const configured = engine.store.find(spec)
+  if (configured !== undefined) return configured
+  const parsed = parseJumpSpec(spec)
+  if (parsed === undefined) {
+    throw new Error('proxyJump \'' + spec + '\' is neither a configured alias nor a [user@]host[:port] address')
+  }
+  const now = Date.now()
+  return {
+    alias: spec,
+    host: parsed.host,
+    port: parsed.port ?? 22,
+    user: parsed.user ?? process.env.USER ?? entry.user,
+    auth: entry.auth,
+    proxyJump: [],
+    tags: [],
+    createdAt: now,
+    updatedAt: now,
+  }
+}
+
 /**
  * Build one full jump chain for an entry: hop clients connected through in
  * order, each forwarding a stream to the next destination, ending with the
  * target client. Shared by the pool and standalone shell sessions.
+ *
+ * A ProxyCommand is the transport that reaches its own host, so the entry's
+ * own command seeds the chain when there is no jump chain, and the first hop's
+ * command is used when the hop carries one.
  */
 export async function connectChain(
   engine: PoolEngine,
@@ -180,24 +265,45 @@ export async function connectChain(
   onKeyboardInteractive?: KeyboardInteractiveHandler,
 ): Promise<{ client: Client; hops: Client[] }> {
   const hops: Client[] = []
-  let sock: ConnectConfig['sock']
   const chain = entry.proxyJump
+  // The store rejects both transports on one entry; a hand-edited store file
+  // can still carry both, and silently picking one would hide the mistake.
+  if (chain.length > 0 && entry.proxyCommand !== undefined) {
+    throw new Error('entry \'' + entry.alias + '\' declares both proxyCommand and proxyJump — pick one transport per host')
+  }
+  /** Transports this call started; destroyed on every failure path. */
+  const transports: Duplex[] = []
+  const startTransport = (owner: SshHostEntry): ConnectConfig['sock'] => {
+    const { stream } = startProxyCommand(owner.proxyCommand as string, proxyTargetOf(owner))
+    transports.push(stream)
+    return stream
+  }
+  let sock: ConnectConfig['sock'] = entry.proxyCommand !== undefined ? startTransport(entry) : undefined
   try {
     for (let index = 0; index < chain.length; index += 1) {
-      const hopAlias = chain[index]
-      const hop = engine.store.find(hopAlias)
-      if (hop === undefined) {
-        throw new Error('proxyJump alias \'' + hopAlias + '\' not found — create it first')
+      const spec = chain[index]
+      const hop = resolveHop(engine, entry, spec)
+      if (index > 0 && hop.proxyCommand !== undefined) {
+        throw new Error('proxyJump hop \'' + spec + '\' declares a proxyCommand, which is only supported on the first hop')
+      }
+      const hopSock = index === 0 && hop.proxyCommand !== undefined ? startTransport(hop) : sock
+      let hopClient: Client
+      try {
+        hopClient = await connectClient(buildConnectConfig(hop, hopSock, engine.opts), onKeyboardInteractive)
+      } catch (error) {
+        // Name the hop: an address hop (or a typo'd alias) must stay
+        // diagnosable from the error alone.
+        throw new Error('proxyJump hop \'' + spec + '\' (' + hop.user + '@' + hop.host + ':' + hop.port + '): '
+          + (error instanceof Error ? error.message : String(error)))
       }
-      const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts), onKeyboardInteractive)
       hops.push(hopClient)
-      const next = index + 1 < chain.length ? engine.store.find(chain[index + 1]) : undefined
+      const next = index + 1 < chain.length ? resolveHop(engine, entry, chain[index + 1]) : undefined
       const nextHost = next !== undefined ? next.host : entry.host
       const nextPort = next !== undefined ? next.port : entry.port
       sock = await new Promise<ConnectConfig['sock']>((resolve, reject) => {
         hopClient.forwardOut('127.0.0.1', 0, nextHost, nextPort, (error, stream) => {
           if (error !== undefined) {
-            reject(error)
+            reject(new Error('proxyJump hop \'' + spec + '\' could not forward to ' + nextHost + ':' + nextPort + ': ' + error.message))
           } else {
             resolve(stream)
           }
@@ -206,9 +312,12 @@ export async function connectChain(
     }
   } catch (error) {
     // A missing alias, a failed hop connect, or a failed forwardOut must all
-    // close the hops already connected, so a failed ProxyJump never leaks a
-    // middle-hop connection.
+    // close the hops already connected — and the proxy commands behind them —
+    // so a failed ProxyJump never leaks either.
     for (const client of hops) client.end()
+    for (const stream of transports) {
+      try { stream.destroy() } catch { /* already closed */ }
+    }
     throw error
   }
   let target: Client | undefined
@@ -217,6 +326,9 @@ export async function connectChain(
     return { client: target, hops }
   } catch (error) {
     for (const client of hops) client.end()
+    for (const stream of transports) {
+      try { stream.destroy() } catch { /* already closed */ }
+    }
     // connectClient already destroys the failed target on its own failure
     // path; destroy defensively only when a reference leaked through, and
     // guard it so a second destroy is never an issue.