@yawlabs/ssh-mcp 0.8.0 → 0.9.0

package/dist/index.js

@@ -3,15 +3,14 @@
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
-// src/ssh.ts
-import { readFileSync as readFileSync2 } from "fs";
+// src/env.ts
+import { appendFileSync, existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, statSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
-import { Client } from "ssh2";
 
 // src/diagnose.ts
 import { execFileSync } from "child_process";
-import { existsSync, readFileSync, readdirSync } from "fs";
+import { existsSync, readdirSync, readFileSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
 function isValidHostname(host) {
@@ -19,7 +18,7 @@ function isValidHostname(host) {
   if (host.startsWith("[")) {
     return /^\[[0-9a-fA-F:]+\]$/.test(host);
   }
-  return /^[a-zA-Z0-9._\-]+$/.test(host);
+  return /^[a-zA-Z0-9._-]+$/.test(host);
 }
 function runArgs(cmd, args) {
   try {
@@ -260,165 +259,462 @@ function diagnose(host, port = 22) {
   return { overall, checks, suggestions };
 }
 
-// src/ssh.ts
-function resolveFromSshConfig(host) {
+// src/env.ts
+function probeAgent(socket, agentLabel) {
+  const { stdout, ok } = runArgs("ssh-add", ["-l"]);
+  const noIdentities = stdout.includes("no identities") || stdout.includes("The agent has no identities");
+  if (!ok && !noIdentities) return null;
+  const keys = ok && !noIdentities ? stdout.split("\n").filter(Boolean) : [];
+  return {
+    running: true,
+    reachable: true,
+    socket,
+    keys,
+    started: false,
+    message: keys.length > 0 ? `${agentLabel} running with ${keys.length} key(s) loaded` : `${agentLabel} running but no keys loaded. Use ssh_key_load to add one.`
+  };
+}
+var startedAgentPid = null;
+function killStartedAgent() {
+  if (startedAgentPid === null) return;
   try {
-    const { stdout, ok } = runArgs("ssh", ["-G", host]);
-    if (!ok) return null;
-    const config = {};
-    const identityFiles = [];
-    for (const line of stdout.split("\n")) {
-      const spaceIdx = line.indexOf(" ");
-      if (spaceIdx > 0) {
-        const key = line.substring(0, spaceIdx);
-        const value = line.substring(spaceIdx + 1);
-        if (key === "identityfile") {
-          identityFiles.push(value);
-        } else {
-          config[key] = value;
-        }
-      }
-    }
-    return {
-      hostname: config.hostname || host,
-      user: config.user || "",
-      port: config.port || "22",
-      identityFiles,
-      proxyJump: config.proxyjump && config.proxyjump !== "none" ? config.proxyjump : void 0
-    };
+    process.kill(startedAgentPid);
   } catch {
-    return null;
   }
+  startedAgentPid = null;
 }
-function readKnownHostsKeys(host, port) {
-  if (!isValidHostname(host)) return [];
-  const targets = port && port !== 22 ? [`[${host}]:${port}`, host] : [host];
-  const keys = [];
-  for (const target of targets) {
-    const { stdout, ok } = runArgs("ssh-keygen", ["-F", target]);
-    if (!ok || !stdout.trim()) continue;
-    for (const line of stdout.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const parts = trimmed.split(/\s+/);
-      if (parts.length < 3) continue;
-      try {
-        keys.push(Buffer.from(parts[2], "base64"));
-      } catch {
+function ensureAgent() {
+  const sock = process.env.SSH_AUTH_SOCK;
+  if (sock) {
+    const result = probeAgent(sock, "ssh-agent");
+    if (result) return result;
+  }
+  if (!sock && process.platform === "win32") {
+    const result = probeAgent("\\\\.\\pipe\\openssh-ssh-agent", "Windows OpenSSH agent");
+    if (result) return result;
+  }
+  const { stdout, ok } = runArgs("ssh-agent", ["-s"]);
+  if (ok) {
+    const sockMatch = stdout.match(/SSH_AUTH_SOCK=([^;]+)/);
+    const pidMatch = stdout.match(/SSH_AGENT_PID=([^;]+)/);
+    if (sockMatch) {
+      process.env.SSH_AUTH_SOCK = sockMatch[1];
+      if (pidMatch) {
+        process.env.SSH_AGENT_PID = pidMatch[1];
+        startedAgentPid = Number.parseInt(pidMatch[1], 10);
       }
+      return {
+        running: true,
+        reachable: true,
+        socket: sockMatch[1],
+        keys: [],
+        started: true,
+        env: { SSH_AUTH_SOCK: sockMatch[1], SSH_AGENT_PID: pidMatch?.[1] },
+        message: "Started new ssh-agent scoped to the ssh-mcp server process. Your shell's environment is NOT modified \u2014 this agent is only visible to this MCP server and will terminate when the server exits. No keys loaded yet \u2014 use ssh_key_load to add one."
+      };
     }
   }
-  return keys;
-}
-function buildHostVerifier(hosts, port) {
-  const strict = process.env.SSH_MCP_STRICT_HOST_KEY === "1";
-  return (key) => {
-    const known = hosts.flatMap((h) => readKnownHostsKeys(h, port));
-    if (known.length === 0) {
-      return !strict;
-    }
-    return known.some((k) => k.equals(key));
+  return {
+    running: false,
+    reachable: false,
+    keys: [],
+    started: false,
+    message: process.platform === "win32" ? "Windows OpenSSH agent not running. Start it: Get-Service ssh-agent | Set-Service -StartupType Automatic; Start-Service ssh-agent" : 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
   };
 }
-function resolveConfig(config) {
-  const sshConfig = resolveFromSshConfig(config.host);
-  const port = config.port || (sshConfig ? Number.parseInt(sshConfig.port, 10) : 22);
-  const verifierHosts = [config.host];
-  if (sshConfig?.hostname && sshConfig.hostname !== config.host) {
-    verifierHosts.push(sshConfig.hostname);
-  }
-  const connectConfig = {
-    host: sshConfig?.hostname || config.host,
-    port,
-    username: config.username || sshConfig?.user || process.env.USER || process.env.USERNAME || "root",
-    keepaliveInterval: 15e3,
-    keepaliveCountMax: 3,
-    hostVerifier: buildHostVerifier(verifierHosts, port)
-  };
-  if (config.privateKeyPath) {
-    connectConfig.privateKey = readFileSync2(config.privateKeyPath);
-  } else if (config.password) {
-    connectConfig.password = config.password;
-  } else {
-    const agentSock = config.agent || process.env.SSH_AUTH_SOCK || (process.platform === "win32" ? "\\\\.\\pipe\\openssh-ssh-agent" : void 0);
-    if (agentSock) {
-      connectConfig.agent = agentSock;
-    } else {
-      const home = homedir2();
-      const keyPaths = sshConfig && sshConfig.identityFiles.length > 0 ? sshConfig.identityFiles.map((p) => p.startsWith("~") ? join2(home, p.slice(1)) : p) : [join2(home, ".ssh", "id_ed25519"), join2(home, ".ssh", "id_rsa"), join2(home, ".ssh", "id_ecdsa")];
-      for (const keyPath of keyPaths) {
-        try {
-          connectConfig.privateKey = readFileSync2(keyPath);
-          break;
-        } catch {
-        }
-      }
+function detectKeyType(filePath, fileName) {
+  const pubPath = `${filePath}.pub`;
+  if (existsSync2(pubPath)) {
+    try {
+      const pub = readFileSync2(pubPath, "utf8");
+      if (pub.includes("ssh-ed25519")) return "ed25519";
+      if (pub.includes("ssh-rsa")) return "rsa";
+      if (pub.includes("ecdsa")) return "ecdsa";
+      if (pub.includes("ssh-dss")) return "dsa";
+    } catch {
     }
   }
-  return { connectConfig, proxyJump: sshConfig?.proxyJump };
-}
-var DIAG_CACHE_TTL_MS = 2e3;
-var diagAgentCache = null;
-var diagKeysCache = null;
-function cachedAgentCheck() {
-  const now = Date.now();
-  if (diagAgentCache && now - diagAgentCache.at < DIAG_CACHE_TTL_MS) {
-    return diagAgentCache.result;
+  if (fileName.includes("ed25519")) return "ed25519";
+  if (fileName.includes("rsa")) return "rsa";
+  if (fileName.includes("ecdsa")) return "ecdsa";
+  if (fileName.includes("dsa")) return "dsa";
+  try {
+    const content = readFileSync2(filePath, "utf8");
+    if (content.includes("RSA PRIVATE KEY")) return "rsa";
+    if (content.includes("EC PRIVATE KEY")) return "ecdsa";
+    if (content.includes("DSA PRIVATE KEY")) return "dsa";
+  } catch {
   }
-  const result = checkSshAgent();
-  diagAgentCache = { at: now, result };
-  return result;
+  return "unknown";
 }
-function cachedKeysCheck() {
-  const now = Date.now();
-  if (diagKeysCache && now - diagKeysCache.at < DIAG_CACHE_TTL_MS) {
-    return diagKeysCache.result;
+function listSshKeys() {
+  const sshDir = join2(homedir2(), ".ssh");
+  if (!existsSync2(sshDir)) return [];
+  const loadedFingerprints = /* @__PURE__ */ new Set();
+  const { stdout: agentOut, ok: agentOk } = runArgs("ssh-add", ["-l"]);
+  if (agentOk && !agentOut.includes("no identities")) {
+    for (const line of agentOut.split("\n").filter(Boolean)) {
+      const match = line.match(/(\S+:\S+)/);
+      if (match) loadedFingerprints.add(match[1]);
+    }
   }
-  const result = checkSshKeys();
-  diagKeysCache = { at: now, result };
-  return result;
-}
-function formatDiagnostics(host) {
+  const skipFiles = /* @__PURE__ */ new Set(["known_hosts", "known_hosts.old", "config", "authorized_keys", "environment"]);
+  const keys = [];
+  let files;
   try {
-    const checks = [
-      { name: "SSH Agent", ...cachedAgentCheck() },
-      { name: "SSH Keys", ...cachedKeysCheck() },
-      { name: "SSH Config", ...checkSshConfig(host) },
-      { name: "Known Hosts", ...checkKnownHosts(host) }
-    ];
-    const parts = [];
-    const suggestions = [];
-    for (const check of checks) {
-      if (check.status !== "ok") {
-        parts.push(`[${check.status.toUpperCase()}] ${check.name}: ${check.message}`);
+    files = readdirSync2(sshDir);
+  } catch {
+    return [];
+  }
+  for (const file of files) {
+    if (file.endsWith(".pub") || file.startsWith(".") || skipFiles.has(file)) continue;
+    const filePath = join2(sshDir, file);
+    try {
+      const stat = statSync(filePath);
+      if (!stat.isFile()) continue;
+      const content = readFileSync2(filePath, "utf8");
+      if (!content.includes("PRIVATE KEY")) continue;
+      const type = detectKeyType(filePath, file);
+      let fingerprint;
+      const { stdout: fpOut, ok: fpOk } = runArgs("ssh-keygen", ["-lf", filePath]);
+      if (fpOk) {
+        const match = fpOut.match(/(\S+:\S+)/);
+        fingerprint = match?.[1];
       }
+      const loadedInAgent = fingerprint ? loadedFingerprints.has(fingerprint) : false;
+      keys.push({ name: file, path: filePath, type, fingerprint, loadedInAgent });
+    } catch {
     }
-    const agent = checks[0];
-    if (agent.status === "error") suggestions.push('Start ssh-agent: eval "$(ssh-agent -s)"');
-    if (agent.status === "warning") suggestions.push("Load a key: ssh-add ~/.ssh/id_ed25519");
-    const keys = checks[1];
-    if (keys.status === "error") suggestions.push('Generate a key: ssh-keygen -t ed25519 -C "your@email.com"');
-    const known = checks[3];
-    if (known.status === "warning") suggestions.push(`Add host key: ssh-keyscan -H "${host}" >> ~/.ssh/known_hosts`);
-    if (suggestions.length > 0) {
-      parts.push(`Suggested fixes: ${suggestions.join(" | ")}`);
-    }
-    return parts.length > 0 ? parts.join("\n") : "";
-  } catch {
-    return "";
   }
+  return keys;
 }
-function connectRaw(connectConfig) {
-  return new Promise((resolve, reject) => {
-    const client = new Client();
-    client.on("ready", () => resolve(client)).on("error", (err) => reject(err)).connect(connectConfig);
-  });
+function loadKey(keyPath) {
+  const agent = ensureAgent();
+  if (!agent.reachable) {
+    return { status: "error", message: agent.message };
+  }
+  const resolved = keyPath.startsWith("~") ? join2(homedir2(), keyPath.slice(1)) : keyPath;
+  if (!existsSync2(resolved)) {
+    return { status: "error", message: `Key not found: ${resolved}` };
+  }
+  const { stdout, ok } = runArgs("ssh-add", [resolved]);
+  if (ok) {
+    return { status: "ok", message: `Key loaded: ${resolved}` };
+  }
+  if (stdout.includes("passphrase") || stdout.includes("incorrect") || stdout.includes("bad permissions")) {
+    if (stdout.includes("UNPROTECTED PRIVATE KEY")) {
+      return { status: "error", message: `Key ${resolved} has too-open permissions. Fix: chmod 600 ${resolved}` };
+    }
+    return { status: "error", message: `Key ${resolved} requires a passphrase. Add it manually: ssh-add ${resolved}` };
+  }
+  return { status: "error", message: `Failed to load key: ${stdout}` };
 }
-async function connectWithProxy(resolved) {
-  if (!resolved.proxyJump) {
-    return connectRaw(resolved.connectConfig);
+function configLookup(host) {
+  if (!isValidHostname(host)) {
+    return { error: `Invalid hostname: "${host}"` };
   }
-  const jumpResolved = resolveConfig({ host: resolved.proxyJump });
+  const { stdout, ok } = runArgs("ssh", ["-G", host]);
+  if (!ok) {
+    return { error: `Failed to resolve SSH config for ${host}: ${stdout}` };
+  }
+  const all = {};
+  const identityFiles = [];
+  for (const line of stdout.split("\n")) {
+    const spaceIdx = line.indexOf(" ");
+    if (spaceIdx > 0) {
+      const key = line.substring(0, spaceIdx);
+      const value = line.substring(spaceIdx + 1);
+      if (key === "identityfile") {
+        identityFiles.push(value);
+      } else {
+        all[key] = value;
+      }
+    }
+  }
+  return {
+    hostname: all.hostname || host,
+    user: all.user || "",
+    port: all.port || "22",
+    identityFile: identityFiles,
+    proxyJump: all.proxyjump && all.proxyjump !== "none" ? all.proxyjump : void 0,
+    proxyCommand: all.proxycommand && all.proxycommand !== "none" ? all.proxycommand : void 0,
+    all,
+    raw: stdout
+  };
+}
+function fixKnownHosts(host, port = 22) {
+  if (!isValidHostname(host)) {
+    return { status: "error", message: `Invalid hostname: "${host}"`, actions: [] };
+  }
+  const actions = [];
+  const { ok: removeOk } = runArgs("ssh-keygen", ["-R", host]);
+  if (removeOk) {
+    actions.push(`Removed old host key for ${host}`);
+  }
+  if (port !== 22) {
+    const { ok } = runArgs("ssh-keygen", ["-R", `[${host}]:${port}`]);
+    if (ok) actions.push(`Removed old host key for [${host}]:${port}`);
+  }
+  const scanArgs = port !== 22 ? ["-H", "-p", String(port), host] : ["-H", host];
+  const { stdout: scanOut, ok: scanOk } = runArgs("ssh-keyscan", scanArgs);
+  if (scanOk && scanOut.trim()) {
+    try {
+      const knownHostsPath = join2(homedir2(), ".ssh", "known_hosts");
+      appendFileSync(knownHostsPath, `
+${scanOut.trim()}
+`);
+      actions.push(`Added new host key for ${host}`);
+      return { status: "ok", message: `Host key refreshed for ${host}`, actions };
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      return { status: "error", message: `Scanned key but failed to write known_hosts: ${msg}`, actions };
+    }
+  }
+  return { status: "error", message: `Could not scan host key for ${host}. Host may be unreachable.`, actions };
+}
+function checkGitSsh(host = "github.com", user = "git") {
+  if (!isValidHostname(host)) {
+    return { status: "error", message: `Invalid hostname: "${host}"` };
+  }
+  const { stdout } = runArgs("ssh", ["-T", "-o", "ConnectTimeout=5", "-o", "BatchMode=yes", `${user}@${host}`]);
+  const text = stdout;
+  if (text.includes("successfully authenticated") || text.includes("Welcome to GitLab") || text.includes("logged in as")) {
+    const userMatch = text.match(/Hi (\S+)!/) || text.match(/@(\S+)!/) || text.match(/logged in as (\S+)/);
+    return {
+      status: "ok",
+      message: `Git SSH authentication to ${host} succeeded${userMatch ? ` as ${userMatch[1]}` : ""}`,
+      authenticatedAs: userMatch?.[1]
+    };
+  }
+  if (text.includes("Permission denied")) {
+    return {
+      status: "error",
+      message: `Permission denied for ${host}. Either no key is loaded in the agent or your key isn't registered with ${host}. Run ssh_key_list to check, then ssh_key_load if needed.`
+    };
+  }
+  if (text.includes("Connection refused")) {
+    return { status: "error", message: `Connection refused by ${host}. SSH may not be available on this host.` };
+  }
+  if (text.includes("timed out") || text.includes("Connection timed out")) {
+    return { status: "error", message: `Connection to ${host} timed out. Check your network or firewall.` };
+  }
+  if (text.includes("Could not resolve")) {
+    return { status: "error", message: `Could not resolve hostname "${host}". Check DNS or spelling.` };
+  }
+  return { status: "error", message: `Git SSH check for ${host}: ${text || "no response (agent may not be running)"}` };
+}
+function testConnection(host, port = 22) {
+  if (!isValidHostname(host)) {
+    return { status: "error", message: `Invalid hostname: "${host}"` };
+  }
+  const start = Date.now();
+  const { ok, stdout } = runArgs("ssh", [
+    "-o",
+    "ConnectTimeout=5",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "StrictHostKeyChecking=no",
+    "-p",
+    String(port),
+    host,
+    "echo",
+    "SSH_OK"
+  ]);
+  const elapsed = Date.now() - start;
+  if (ok && stdout.includes("SSH_OK")) {
+    return { status: "ok", message: `Connected to ${host}:${port} in ${elapsed}ms` };
+  }
+  if (stdout.includes("Permission denied")) {
+    return {
+      status: "error",
+      message: `Authentication failed to ${host}:${port} (${elapsed}ms). Key not authorized. Check: ssh-add -l, verify correct username, verify key is in remote authorized_keys.`
+    };
+  }
+  if (stdout.includes("Connection refused")) {
+    return {
+      status: "error",
+      message: `Connection refused at ${host}:${port}. SSH server not running or port blocked.`
+    };
+  }
+  if (stdout.includes("timed out")) {
+    return { status: "error", message: `Connection timed out to ${host}:${port}. Host down or firewall blocking.` };
+  }
+  if (stdout.includes("Host key verification failed")) {
+    return {
+      status: "error",
+      message: `Host key mismatch for ${host}. Instance was likely recreated. Fix with ssh_known_hosts_fix.`
+    };
+  }
+  if (stdout.includes("Could not resolve")) {
+    return { status: "error", message: `Could not resolve "${host}". Check DNS, /etc/hosts, or SSH config.` };
+  }
+  return { status: "error", message: `Connection failed to ${host}:${port}: ${stdout}` };
+}
+
+// src/ssh.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+import { Client } from "ssh2";
+function resolveFromSshConfig(host) {
+  try {
+    const { stdout, ok } = runArgs("ssh", ["-G", host]);
+    if (!ok) return null;
+    const config = {};
+    const identityFiles = [];
+    for (const line of stdout.split("\n")) {
+      const spaceIdx = line.indexOf(" ");
+      if (spaceIdx > 0) {
+        const key = line.substring(0, spaceIdx);
+        const value = line.substring(spaceIdx + 1);
+        if (key === "identityfile") {
+          identityFiles.push(value);
+        } else {
+          config[key] = value;
+        }
+      }
+    }
+    return {
+      hostname: config.hostname || host,
+      user: config.user || "",
+      port: config.port || "22",
+      identityFiles,
+      proxyJump: config.proxyjump && config.proxyjump !== "none" ? config.proxyjump : void 0
+    };
+  } catch {
+    return null;
+  }
+}
+function readKnownHostsKeys(host, port) {
+  if (!isValidHostname(host)) return [];
+  const targets = port && port !== 22 ? [`[${host}]:${port}`, host] : [host];
+  const keys = [];
+  for (const target of targets) {
+    const { stdout, ok } = runArgs("ssh-keygen", ["-F", target]);
+    if (!ok || !stdout.trim()) continue;
+    for (const line of stdout.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const parts = trimmed.split(/\s+/);
+      if (parts.length < 3) continue;
+      try {
+        keys.push(Buffer.from(parts[2], "base64"));
+      } catch {
+      }
+    }
+  }
+  return keys;
+}
+function buildHostVerifier(hosts, port) {
+  const strict = process.env.SSH_MCP_STRICT_HOST_KEY === "1";
+  return (key) => {
+    const known = hosts.flatMap((h) => readKnownHostsKeys(h, port));
+    if (known.length === 0) {
+      return !strict;
+    }
+    return known.some((k) => k.equals(key));
+  };
+}
+function resolveConfig(config) {
+  const sshConfig = resolveFromSshConfig(config.host);
+  const port = config.port || (sshConfig ? Number.parseInt(sshConfig.port, 10) : 22);
+  const verifierHosts = [config.host];
+  if (sshConfig?.hostname && sshConfig.hostname !== config.host) {
+    verifierHosts.push(sshConfig.hostname);
+  }
+  const connectConfig = {
+    host: sshConfig?.hostname || config.host,
+    port,
+    username: config.username || sshConfig?.user || process.env.USER || process.env.USERNAME || "root",
+    keepaliveInterval: 15e3,
+    keepaliveCountMax: 3,
+    hostVerifier: buildHostVerifier(verifierHosts, port)
+  };
+  if (config.privateKeyPath) {
+    connectConfig.privateKey = readFileSync3(config.privateKeyPath);
+  } else if (config.password) {
+    connectConfig.password = config.password;
+  } else {
+    const agentSock = config.agent || process.env.SSH_AUTH_SOCK || (process.platform === "win32" ? "\\\\.\\pipe\\openssh-ssh-agent" : void 0);
+    if (agentSock) {
+      connectConfig.agent = agentSock;
+    } else {
+      const home = homedir3();
+      const keyPaths = sshConfig && sshConfig.identityFiles.length > 0 ? sshConfig.identityFiles.map((p) => p.startsWith("~") ? join3(home, p.slice(1)) : p) : [join3(home, ".ssh", "id_ed25519"), join3(home, ".ssh", "id_rsa"), join3(home, ".ssh", "id_ecdsa")];
+      for (const keyPath of keyPaths) {
+        try {
+          connectConfig.privateKey = readFileSync3(keyPath);
+          break;
+        } catch {
+        }
+      }
+    }
+  }
+  return { connectConfig, proxyJump: sshConfig?.proxyJump };
+}
+var DIAG_CACHE_TTL_MS = 2e3;
+var diagAgentCache = null;
+var diagKeysCache = null;
+function cachedAgentCheck() {
+  const now = Date.now();
+  if (diagAgentCache && now - diagAgentCache.at < DIAG_CACHE_TTL_MS) {
+    return diagAgentCache.result;
+  }
+  const result = checkSshAgent();
+  diagAgentCache = { at: now, result };
+  return result;
+}
+function cachedKeysCheck() {
+  const now = Date.now();
+  if (diagKeysCache && now - diagKeysCache.at < DIAG_CACHE_TTL_MS) {
+    return diagKeysCache.result;
+  }
+  const result = checkSshKeys();
+  diagKeysCache = { at: now, result };
+  return result;
+}
+function formatDiagnostics(host) {
+  try {
+    const checks = [
+      { name: "SSH Agent", ...cachedAgentCheck() },
+      { name: "SSH Keys", ...cachedKeysCheck() },
+      { name: "SSH Config", ...checkSshConfig(host) },
+      { name: "Known Hosts", ...checkKnownHosts(host) }
+    ];
+    const parts = [];
+    const suggestions = [];
+    for (const check of checks) {
+      if (check.status !== "ok") {
+        parts.push(`[${check.status.toUpperCase()}] ${check.name}: ${check.message}`);
+      }
+    }
+    const agent = checks[0];
+    if (agent.status === "error") suggestions.push('Start ssh-agent: eval "$(ssh-agent -s)"');
+    if (agent.status === "warning") suggestions.push("Load a key: ssh-add ~/.ssh/id_ed25519");
+    const keys = checks[1];
+    if (keys.status === "error") suggestions.push('Generate a key: ssh-keygen -t ed25519 -C "your@email.com"');
+    const known = checks[3];
+    if (known.status === "warning") suggestions.push(`Add host key: ssh-keyscan -H "${host}" >> ~/.ssh/known_hosts`);
+    if (suggestions.length > 0) {
+      parts.push(`Suggested fixes: ${suggestions.join(" | ")}`);
+    }
+    return parts.length > 0 ? parts.join("\n") : "";
+  } catch {
+    return "";
+  }
+}
+function connectRaw(connectConfig) {
+  return new Promise((resolve, reject) => {
+    const client = new Client();
+    client.on("ready", () => resolve(client)).on("error", (err) => reject(err)).connect(connectConfig);
+  });
+}
+async function connectWithProxy(resolved) {
+  if (!resolved.proxyJump) {
+    return connectRaw(resolved.connectConfig);
+  }
+  const jumpResolved = resolveConfig({ host: resolved.proxyJump });
   const jumpClient = await connectWithProxy(jumpResolved);
   const targetHost = resolved.connectConfig.host;
   const targetPort = resolved.connectConfig.port;
@@ -445,6 +741,7 @@ var DEFAULT_MAX_EXEC_BYTES = 10 * 1024 * 1024;
 function exec(client, command, timeoutMs = 3e4, maxBytes = DEFAULT_MAX_EXEC_BYTES) {
   return new Promise((resolve, reject) => {
     let settled = false;
+    let activeStream = null;
     const settle = (fn) => {
       if (settled) return;
       settled = true;
@@ -452,6 +749,16 @@ function exec(client, command, timeoutMs = 3e4, maxBytes = DEFAULT_MAX_EXEC_BYTE
       fn();
     };
     const timer = setTimeout(() => {
+      if (activeStream) {
+        try {
+          activeStream.signal("TERM");
+        } catch {
+        }
+        try {
+          activeStream.close();
+        } catch {
+        }
+      }
       settle(() => reject(new Error(`Command timed out after ${timeoutMs}ms`)));
     }, timeoutMs);
     client.exec(command, (err, stream) => {
@@ -459,6 +766,7 @@ function exec(client, command, timeoutMs = 3e4, maxBytes = DEFAULT_MAX_EXEC_BYTE
         settle(() => reject(err));
         return;
       }
+      activeStream = stream;
       const stdoutChunks = [];
       const stderrChunks = [];
       let stdoutBytes = 0;
@@ -698,365 +1006,84 @@ ${diag}`);
         continue;
       }
       entry.refCount++;
-      if (entry.idleTimer) {
-        clearTimeout(entry.idleTimer);
-        entry.idleTimer = null;
-      }
-      return client;
-    }
-    throw new Error(
-      `Failed to acquire SSH connection for ${key} after ${MAX_ACQUIRE_ATTEMPTS} attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
-    );
-  }
-  release(client) {
-    for (const entry of this.entries.values()) {
-      if (entry.client === client) {
-        entry.refCount = Math.max(0, entry.refCount - 1);
-        if (entry.refCount === 0 && !entry.dead) {
-          entry.idleTimer = setTimeout(() => {
-            try {
-              entry.client.end();
-            } catch {
-            }
-            this.entries.delete(entry.key);
-          }, this.idleTtlMs);
-          entry.idleTimer.unref();
-        }
-        return;
-      }
-    }
-    try {
-      client.end();
-    } catch {
-    }
-  }
-  async withConnection(config, fn) {
-    const client = await this.acquire(config);
-    try {
-      return await fn(client);
-    } finally {
-      this.release(client);
-    }
-  }
-  drain() {
-    for (const entry of this.entries.values()) {
-      if (entry.idleTimer) {
-        clearTimeout(entry.idleTimer);
-      }
-      try {
-        entry.client.end();
-      } catch {
-      }
-    }
-    this.entries.clear();
-  }
-  get size() {
-    return this.entries.size;
-  }
-  get stats() {
-    let active = 0;
-    let idle = 0;
-    for (const entry of this.entries.values()) {
-      if (entry.refCount > 0) active++;
-      else idle++;
-    }
-    return { active, idle };
-  }
-  /** Total number of successful SSH connects made by this pool since construction. */
-  get connectCount() {
-    return this._connectCount;
-  }
-};
-
-// src/server.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-
-// src/tools.ts
-import { z } from "zod";
-
-// src/env.ts
-import { appendFileSync, existsSync as existsSync2, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
-function probeAgent(socket, agentLabel) {
-  const { stdout, ok } = runArgs("ssh-add", ["-l"]);
-  const noIdentities = stdout.includes("no identities") || stdout.includes("The agent has no identities");
-  if (!ok && !noIdentities) return null;
-  const keys = ok && !noIdentities ? stdout.split("\n").filter(Boolean) : [];
-  return {
-    running: true,
-    reachable: true,
-    socket,
-    keys,
-    started: false,
-    message: keys.length > 0 ? `${agentLabel} running with ${keys.length} key(s) loaded` : `${agentLabel} running but no keys loaded. Use ssh_key_load to add one.`
-  };
-}
-function ensureAgent() {
-  const sock = process.env.SSH_AUTH_SOCK;
-  if (sock) {
-    const result = probeAgent(sock, "ssh-agent");
-    if (result) return result;
-  }
-  if (!sock && process.platform === "win32") {
-    const result = probeAgent("\\\\.\\pipe\\openssh-ssh-agent", "Windows OpenSSH agent");
-    if (result) return result;
-  }
-  const { stdout, ok } = runArgs("ssh-agent", ["-s"]);
-  if (ok) {
-    const sockMatch = stdout.match(/SSH_AUTH_SOCK=([^;]+)/);
-    const pidMatch = stdout.match(/SSH_AGENT_PID=([^;]+)/);
-    if (sockMatch) {
-      process.env.SSH_AUTH_SOCK = sockMatch[1];
-      if (pidMatch) process.env.SSH_AGENT_PID = pidMatch[1];
-      return {
-        running: true,
-        reachable: true,
-        socket: sockMatch[1],
-        keys: [],
-        started: true,
-        env: { SSH_AUTH_SOCK: sockMatch[1], SSH_AGENT_PID: pidMatch?.[1] },
-        message: "Started new ssh-agent scoped to the ssh-mcp server process. Your shell's environment is NOT modified \u2014 this agent is only visible to this MCP server and will terminate when the server exits. No keys loaded yet \u2014 use ssh_key_load to add one."
-      };
-    }
-  }
-  return {
-    running: false,
-    reachable: false,
-    keys: [],
-    started: false,
-    message: process.platform === "win32" ? "Windows OpenSSH agent not running. Start it: Get-Service ssh-agent | Set-Service -StartupType Automatic; Start-Service ssh-agent" : 'Could not start ssh-agent. Run manually: eval "$(ssh-agent -s)"'
-  };
-}
-function detectKeyType(filePath, fileName) {
-  const pubPath = `${filePath}.pub`;
-  if (existsSync2(pubPath)) {
-    try {
-      const pub = readFileSync3(pubPath, "utf8");
-      if (pub.includes("ssh-ed25519")) return "ed25519";
-      if (pub.includes("ssh-rsa")) return "rsa";
-      if (pub.includes("ecdsa")) return "ecdsa";
-      if (pub.includes("ssh-dss")) return "dsa";
-    } catch {
+      if (entry.idleTimer) {
+        clearTimeout(entry.idleTimer);
+        entry.idleTimer = null;
+      }
+      return client;
     }
+    throw new Error(
+      `Failed to acquire SSH connection for ${key} after ${MAX_ACQUIRE_ATTEMPTS} attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
+    );
   }
-  if (fileName.includes("ed25519")) return "ed25519";
-  if (fileName.includes("rsa")) return "rsa";
-  if (fileName.includes("ecdsa")) return "ecdsa";
-  if (fileName.includes("dsa")) return "dsa";
-  try {
-    const content = readFileSync3(filePath, "utf8");
-    if (content.includes("RSA PRIVATE KEY")) return "rsa";
-    if (content.includes("EC PRIVATE KEY")) return "ecdsa";
-    if (content.includes("DSA PRIVATE KEY")) return "dsa";
-  } catch {
-  }
-  return "unknown";
-}
-function listSshKeys() {
-  const sshDir = join3(homedir3(), ".ssh");
-  if (!existsSync2(sshDir)) return [];
-  const loadedFingerprints = /* @__PURE__ */ new Set();
-  const { stdout: agentOut, ok: agentOk } = runArgs("ssh-add", ["-l"]);
-  if (agentOk && !agentOut.includes("no identities")) {
-    for (const line of agentOut.split("\n").filter(Boolean)) {
-      const match = line.match(/(\S+:\S+)/);
-      if (match) loadedFingerprints.add(match[1]);
+  release(client) {
+    for (const entry of this.entries.values()) {
+      if (entry.client === client) {
+        entry.refCount = Math.max(0, entry.refCount - 1);
+        if (entry.refCount === 0 && !entry.dead) {
+          entry.idleTimer = setTimeout(() => {
+            try {
+              entry.client.end();
+            } catch {
+            }
+            this.entries.delete(entry.key);
+          }, this.idleTtlMs);
+          entry.idleTimer.unref();
+        }
+        return;
+      }
     }
-  }
-  const skipFiles = /* @__PURE__ */ new Set(["known_hosts", "known_hosts.old", "config", "authorized_keys", "environment"]);
-  const keys = [];
-  let files;
-  try {
-    files = readdirSync2(sshDir);
-  } catch {
-    return [];
-  }
-  for (const file of files) {
-    if (file.endsWith(".pub") || file.startsWith(".") || skipFiles.has(file)) continue;
-    const filePath = join3(sshDir, file);
     try {
-      const stat = statSync(filePath);
-      if (!stat.isFile()) continue;
-      const content = readFileSync3(filePath, "utf8");
-      if (!content.includes("PRIVATE KEY")) continue;
-      const type = detectKeyType(filePath, file);
-      let fingerprint;
-      const { stdout: fpOut, ok: fpOk } = runArgs("ssh-keygen", ["-lf", filePath]);
-      if (fpOk) {
-        const match = fpOut.match(/(\S+:\S+)/);
-        fingerprint = match?.[1];
-      }
-      const loadedInAgent = fingerprint ? loadedFingerprints.has(fingerprint) : false;
-      keys.push({ name: file, path: filePath, type, fingerprint, loadedInAgent });
+      client.end();
     } catch {
     }
   }
-  return keys;
-}
-function loadKey(keyPath) {
-  const agent = ensureAgent();
-  if (!agent.reachable) {
-    return { status: "error", message: agent.message };
-  }
-  const resolved = keyPath.startsWith("~") ? join3(homedir3(), keyPath.slice(1)) : keyPath;
-  if (!existsSync2(resolved)) {
-    return { status: "error", message: `Key not found: ${resolved}` };
-  }
-  const { stdout, ok } = runArgs("ssh-add", [resolved]);
-  if (ok) {
-    return { status: "ok", message: `Key loaded: ${resolved}` };
-  }
-  if (stdout.includes("passphrase") || stdout.includes("incorrect") || stdout.includes("bad permissions")) {
-    if (stdout.includes("UNPROTECTED PRIVATE KEY")) {
-      return { status: "error", message: `Key ${resolved} has too-open permissions. Fix: chmod 600 ${resolved}` };
+  async withConnection(config, fn) {
+    const client = await this.acquire(config);
+    try {
+      return await fn(client);
+    } finally {
+      this.release(client);
     }
-    return { status: "error", message: `Key ${resolved} requires a passphrase. Add it manually: ssh-add ${resolved}` };
-  }
-  return { status: "error", message: `Failed to load key: ${stdout}` };
-}
-function configLookup(host) {
-  if (!isValidHostname(host)) {
-    return { error: `Invalid hostname: "${host}"` };
-  }
-  const { stdout, ok } = runArgs("ssh", ["-G", host]);
-  if (!ok) {
-    return { error: `Failed to resolve SSH config for ${host}: ${stdout}` };
   }
-  const all = {};
-  const identityFiles = [];
-  for (const line of stdout.split("\n")) {
-    const spaceIdx = line.indexOf(" ");
-    if (spaceIdx > 0) {
-      const key = line.substring(0, spaceIdx);
-      const value = line.substring(spaceIdx + 1);
-      if (key === "identityfile") {
-        identityFiles.push(value);
-      } else {
-        all[key] = value;
+  drain() {
+    for (const entry of this.entries.values()) {
+      if (entry.idleTimer) {
+        clearTimeout(entry.idleTimer);
+      }
+      try {
+        entry.client.end();
+      } catch {
       }
     }
+    this.entries.clear();
   }
-  return {
-    hostname: all.hostname || host,
-    user: all.user || "",
-    port: all.port || "22",
-    identityFile: identityFiles,
-    proxyJump: all.proxyjump && all.proxyjump !== "none" ? all.proxyjump : void 0,
-    proxyCommand: all.proxycommand && all.proxycommand !== "none" ? all.proxycommand : void 0,
-    all,
-    raw: stdout
-  };
-}
-function fixKnownHosts(host, port = 22) {
-  if (!isValidHostname(host)) {
-    return { status: "error", message: `Invalid hostname: "${host}"`, actions: [] };
-  }
-  const actions = [];
-  const { ok: removeOk } = runArgs("ssh-keygen", ["-R", host]);
-  if (removeOk) {
-    actions.push(`Removed old host key for ${host}`);
-  }
-  if (port !== 22) {
-    const { ok } = runArgs("ssh-keygen", ["-R", `[${host}]:${port}`]);
-    if (ok) actions.push(`Removed old host key for [${host}]:${port}`);
+  get size() {
+    return this.entries.size;
   }
-  const scanArgs = port !== 22 ? ["-H", "-p", String(port), host] : ["-H", host];
-  const { stdout: scanOut, ok: scanOk } = runArgs("ssh-keyscan", scanArgs);
-  if (scanOk && scanOut.trim()) {
-    try {
-      const knownHostsPath = join3(homedir3(), ".ssh", "known_hosts");
-      appendFileSync(knownHostsPath, `
-${scanOut.trim()}
-`);
-      actions.push(`Added new host key for ${host}`);
-      return { status: "ok", message: `Host key refreshed for ${host}`, actions };
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      return { status: "error", message: `Scanned key but failed to write known_hosts: ${msg}`, actions };
+  get stats() {
+    let active = 0;
+    let idle = 0;
+    for (const entry of this.entries.values()) {
+      if (entry.refCount > 0) active++;
+      else idle++;
     }
+    return { active, idle };
   }
-  return { status: "error", message: `Could not scan host key for ${host}. Host may be unreachable.`, actions };
-}
-function checkGitSsh(host = "github.com", user = "git") {
-  if (!isValidHostname(host)) {
-    return { status: "error", message: `Invalid hostname: "${host}"` };
-  }
-  const { stdout } = runArgs("ssh", ["-T", "-o", "ConnectTimeout=5", "-o", "BatchMode=yes", `${user}@${host}`]);
-  const text = stdout;
-  if (text.includes("successfully authenticated") || text.includes("Welcome to GitLab") || text.includes("logged in as")) {
-    const userMatch = text.match(/Hi (\S+)!/) || text.match(/@(\S+)!/) || text.match(/logged in as (\S+)/);
-    return {
-      status: "ok",
-      message: `Git SSH authentication to ${host} succeeded${userMatch ? ` as ${userMatch[1]}` : ""}`,
-      authenticatedAs: userMatch?.[1]
-    };
-  }
-  if (text.includes("Permission denied")) {
-    return {
-      status: "error",
-      message: `Permission denied for ${host}. Either no key is loaded in the agent or your key isn't registered with ${host}. Run ssh_key_list to check, then ssh_key_load if needed.`
-    };
-  }
-  if (text.includes("Connection refused")) {
-    return { status: "error", message: `Connection refused by ${host}. SSH may not be available on this host.` };
-  }
-  if (text.includes("timed out") || text.includes("Connection timed out")) {
-    return { status: "error", message: `Connection to ${host} timed out. Check your network or firewall.` };
-  }
-  if (text.includes("Could not resolve")) {
-    return { status: "error", message: `Could not resolve hostname "${host}". Check DNS or spelling.` };
-  }
-  return { status: "error", message: `Git SSH check for ${host}: ${text || "no response (agent may not be running)"}` };
-}
-function testConnection(host, port = 22) {
-  if (!isValidHostname(host)) {
-    return { status: "error", message: `Invalid hostname: "${host}"` };
-  }
-  const start = Date.now();
-  const { ok, stdout } = runArgs("ssh", [
-    "-o",
-    "ConnectTimeout=5",
-    "-o",
-    "BatchMode=yes",
-    "-o",
-    "StrictHostKeyChecking=no",
-    "-p",
-    String(port),
-    host,
-    "echo",
-    "SSH_OK"
-  ]);
-  const elapsed = Date.now() - start;
-  if (ok && stdout.includes("SSH_OK")) {
-    return { status: "ok", message: `Connected to ${host}:${port} in ${elapsed}ms` };
-  }
-  if (stdout.includes("Permission denied")) {
-    return {
-      status: "error",
-      message: `Authentication failed to ${host}:${port} (${elapsed}ms). Key not authorized. Check: ssh-add -l, verify correct username, verify key is in remote authorized_keys.`
-    };
-  }
-  if (stdout.includes("Connection refused")) {
-    return {
-      status: "error",
-      message: `Connection refused at ${host}:${port}. SSH server not running or port blocked.`
-    };
-  }
-  if (stdout.includes("timed out")) {
-    return { status: "error", message: `Connection timed out to ${host}:${port}. Host down or firewall blocking.` };
-  }
-  if (stdout.includes("Host key verification failed")) {
-    return {
-      status: "error",
-      message: `Host key mismatch for ${host}. Instance was likely recreated. Fix with ssh_known_hosts_fix.`
-    };
-  }
-  if (stdout.includes("Could not resolve")) {
-    return { status: "error", message: `Could not resolve "${host}". Check DNS, /etc/hosts, or SSH config.` };
+  /** Total number of successful SSH connects made by this pool since construction. */
+  get connectCount() {
+    return this._connectCount;
   }
-  return { status: "error", message: `Connection failed to ${host}:${port}: ${stdout}` };
-}
+};
+
+// src/server.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { dirname, join as join4 } from "path";
+import { fileURLToPath } from "url";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/tools.ts
+import { z } from "zod";
 
 // src/ops.ts
 function shellQuote(s) {
@@ -1096,7 +1123,7 @@ async function find(client, options, timeoutMs = 3e4) {
       `Invalid maxsize format: "${options.maxsize}". Expected: digits followed by optional k/M/G/T/P (e.g. "10M", "500k")`
     );
   }
-  const args = [shellQuote(options.path)];
+  const args = ["--", shellQuote(options.path)];
   if (options.maxdepth !== void 0) args.push("-maxdepth", String(options.maxdepth));
   if (options.type) args.push("-type", options.type);
   if (options.name) args.push("-name", shellQuote(options.name));
@@ -1111,9 +1138,9 @@ async function find(client, options, timeoutMs = 3e4) {
   return result.stdout.split("\n").filter(Boolean);
 }
 async function tail(client, path, lines = 100, grep, timeoutMs = 3e4) {
-  let command = `tail -n ${lines} ${shellQuote(path)}`;
+  let command = `tail -n ${lines} -- ${shellQuote(path)}`;
   if (grep) {
-    command += ` | grep -i ${shellQuote(grep)}`;
+    command += ` | grep -i -e ${shellQuote(grep)}`;
   }
   const result = await exec(client, command, timeoutMs);
   if (result.stderr.trim()) {
@@ -1122,16 +1149,17 @@ async function tail(client, path, lines = 100, grep, timeoutMs = 3e4) {
   return result.stdout;
 }
 async function serviceStatus(client, serviceName, timeoutMs = 3e4) {
-  const result = await exec(client, `systemctl status ${shellQuote(serviceName)} 2>&1`, timeoutMs);
+  const result = await exec(client, `systemctl status -- ${shellQuote(serviceName)} 2>&1`, timeoutMs);
   const raw = result.stdout;
   const activeMatch = raw.match(/Active:\s+(\S+)\s+\(([^)]+)\)/);
   const descMatch = raw.match(/^\s+.*?-\s+(.+)$/m);
   const pidMatch = raw.match(/Main PID:\s+(\d+)/);
   const sinceMatch = raw.match(/since\s+(.+?);/);
+  const fallbackStatus = result.code === 0 ? "active" : "inactive";
   return {
     name: serviceName,
     active: activeMatch?.[1] === "active",
-    status: activeMatch ? `${activeMatch[1]} (${activeMatch[2]})` : result.code === 0 ? "active" : "unknown",
+    status: activeMatch ? `${activeMatch[1]} (${activeMatch[2]})` : fallbackStatus,
     description: descMatch?.[1]?.trim(),
     since: sinceMatch?.[1]?.trim(),
     pid: pidMatch ? Number.parseInt(pidMatch[1], 10) : void 0,
@@ -1514,10 +1542,12 @@ ${files.join("\n")}` }] };
 }
 
 // src/server.ts
+var pkgPath = join4(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
+var { version } = JSON.parse(readFileSync4(pkgPath, "utf8"));
 function createServer(pool) {
   const server = new McpServer({
     name: "ssh-mcp",
-    version: "0.7.0"
+    version
   });
   registerTools(server, pool);
   return server;
@@ -1530,6 +1560,7 @@ async function main() {
   const transport = new StdioServerTransport();
   const shutdown = () => {
     pool.drain();
+    killStartedAgent();
     process.exit(0);
   };
   process.on("SIGINT", shutdown);