@zincapp/znvault-cli 4.4.0 → 4.6.0

package/dist/commands/ssh/connect.js

@@ -4,205 +4,132 @@ import { getCurrentProfile } from '../../lib/config.js';
 import { getDefaultKeyPath, getCertificatePath, isCertificateValid, signCertificate, } from './helpers.js';
 import { resolveBookmark } from './bookmark.js';
 /**
- * Execute SSH connection with certificate authentication
- * Extracted for reuse by both `ssh connect` and `ssh <destination>` shortcuts
+ * Resolve the SSH key, ensure a valid vault-CA certificate (auto-signing if
+ * needed), and return the destination parts + base ssh args. No spawning,
+ * no process.exit, no stdio side effects — safe to call from any command.
+ *
+ * Mirrors the key-resolution + sign logic previously inline in executeConnect,
+ * so `ssh connect` and `ssh forward` share one code path.
  */
-export async function executeConnect(destination, remoteCommand, options) {
+export async function ensureSignedSshBase(destination, options) {
     const fs = await import('fs');
     const path = await import('path');
-    const { spawn } = await import('child_process');
-    // Get profile config for defaults
     const profile = getCurrentProfile();
-    // Resolve destination: could be a bookmark, user@host, or just host
     let user;
     let host;
     let port = options.port ?? '22';
     let identityOverride = options.identity;
     let principalsOverride = options.principals;
-    // Check if destination is a bookmark
     const bookmark = resolveBookmark(destination);
     if (bookmark) {
         host = bookmark.host;
         user = bookmark.user;
-        if (bookmark.port) {
+        if (bookmark.port)
             port = bookmark.port.toString();
-        }
-        if (bookmark.identity) {
+        if (bookmark.identity)
             identityOverride = bookmark.identity;
-        }
         if (bookmark.principals && !options.principals) {
             principalsOverride = bookmark.principals.join(',');
         }
-        if (options.verbose) {
-            output.info(`Using bookmark '${destination}' → ${bookmark.host}`);
-        }
     }
     else if (destination.includes('@')) {
         const parts = destination.split('@');
         user = parts[0];
-        host = parts.slice(1).join('@'); // Handle IPv6 or multiple @
+        host = parts.slice(1).join('@');
     }
     else {
         host = destination;
-        // Use default user from config if available
-        if (profile.sshUser) {
+        if (profile.sshUser)
             user = profile.sshUser;
-        }
     }
-    // Command line options override bookmark settings
-    if (options.port && options.port !== '22') {
+    if (options.port && options.port !== '22')
         port = options.port;
+    // Resolve key
+    let keyPath;
+    if (identityOverride) {
+        keyPath = path.resolve(identityOverride.replace(/^~/, process.env.HOME ?? ''));
+        if (!fs.existsSync(keyPath))
+            throw new Error(`SSH key not found: ${keyPath}`);
+    }
+    else if (profile.sshIdentity && fs.existsSync(profile.sshIdentity)) {
+        keyPath = profile.sshIdentity;
     }
-    const verbose = (msg) => {
-        if (options.verbose) {
-            output.info(msg);
+    else {
+        const defaultKey = await getDefaultKeyPath();
+        if (!defaultKey) {
+            throw new Error('No SSH key found in ~/.ssh/ — generate one with: ssh-keygen -t ed25519');
         }
-    };
+        keyPath = defaultKey;
+    }
+    const pubKeyPath = `${keyPath}.pub`;
+    if (!fs.existsSync(pubKeyPath))
+        throw new Error(`Public key not found: ${pubKeyPath}`);
+    // Ensure cert
+    const certPath = await getCertificatePath(keyPath);
+    const certStatus = await isCertificateValid(certPath);
+    if (options.forceSign || !certStatus.valid) {
+        await signCertificate(pubKeyPath, certPath, principalsOverride, options.ttl, options.tenant);
+    }
+    // Build base ssh args (identity + cert + optional port)
+    const baseSshArgs = ['-i', keyPath];
+    if (port && port !== '22')
+        baseSshArgs.push('-p', port);
+    baseSshArgs.push('-o', `CertificateFile=${certPath}`);
+    return { keyPath, certPath, user, host, port, baseSshArgs };
+}
+/**
+ * Execute SSH connection with certificate authentication
+ * Extracted for reuse by both `ssh connect` and `ssh <destination>` shortcuts
+ */
+export async function executeConnect(destination, remoteCommand, options) {
+    const { spawn } = await import('child_process');
+    const verbose = (msg) => { if (options.verbose)
+        output.info(msg); };
+    let base;
     try {
-        // Step 1: Find SSH key
-        let keyPath;
-        if (identityOverride) {
-            keyPath = path.resolve(identityOverride.replace(/^~/, process.env.HOME ?? ''));
-            if (!fs.existsSync(keyPath)) {
-                output.error(`SSH key not found: ${keyPath}`);
-                process.exit(1);
-            }
-            verbose(`Using specified key: ${keyPath}`);
-        }
-        else if (profile.sshIdentity && fs.existsSync(profile.sshIdentity)) {
-            // Use configured identity from profile
-            keyPath = profile.sshIdentity;
-            verbose(`Using configured key: ${keyPath}`);
-        }
-        else {
-            const defaultKey = await getDefaultKeyPath();
-            if (!defaultKey) {
-                output.error('No SSH key found in ~/.ssh/');
-                output.info('Generate one with: ssh-keygen -t ed25519');
-                output.info('Or specify a key with: znvault ssh -i /path/to/key user@host');
-                process.exit(1);
-            }
-            keyPath = defaultKey;
-            verbose(`Using default key: ${keyPath}`);
-        }
-        const pubKeyPath = `${keyPath}.pub`;
-        if (!fs.existsSync(pubKeyPath)) {
-            output.error(`Public key not found: ${pubKeyPath}`);
-            process.exit(1);
-        }
-        // Step 2: Check certificate validity
-        const certPath = await getCertificatePath(keyPath);
-        verbose(`Certificate path: ${certPath}`);
-        const certStatus = await isCertificateValid(certPath);
-        const needsSign = options.forceSign || !certStatus.valid;
-        if (options.verbose && !certStatus.valid) {
-            output.warn(`Certificate needs signing: ${certStatus.reason}`);
-        }
-        else if (options.verbose && certStatus.valid) {
-            output.success('Certificate is valid');
-        }
-        // Step 3: Sign if needed
-        if (needsSign) {
-            const spinner = output.spinner('Signing certificate...').start();
-            try {
-                await signCertificate(pubKeyPath, certPath, principalsOverride, options.ttl, options.tenant);
-                spinner.succeed('Certificate signed');
-                // Show certificate info
-                if (options.verbose) {
-                    const { execSync } = await import('child_process');
-                    try {
-                        const certInfo = execSync(`ssh-keygen -L -f "${certPath}"`, { encoding: 'utf8' });
-                        const principalsMatch = certInfo.match(/Principals:\s*([\s\S]*?)(?=\s+Critical Options:)/);
-                        const validMatch = certInfo.match(/Valid:\s+from\s+(\S+)\s+to\s+(\S+)/);
-                        if (principalsMatch) {
-                            const principals = principalsMatch[1].trim().split('\n').map(p => p.trim()).filter(Boolean);
-                            output.info(`Principals: ${principals.join(', ')}`);
-                        }
-                        if (validMatch) {
-                            output.info(`Valid until: ${validMatch[2]}`);
-                        }
-                    }
-                    catch {
-                        // Ignore cert inspection errors
-                    }
-                }
-            }
-            catch (err) {
-                spinner.fail('Failed to sign certificate');
-                output.error(err instanceof Error ? err.message : String(err));
-                process.exit(1);
-            }
-        }
-        else if (!options.verbose) {
-            // In non-verbose mode, just mention we're using existing cert
-            output.info('Using existing valid certificate');
-        }
-        // Step 4: Build SSH command
-        const sshArgs = [];
-        // Add identity file (this tells SSH to use our key + cert)
-        sshArgs.push('-i', keyPath);
-        // Add port if not default
-        if (port && port !== '22') {
-            sshArgs.push('-p', port);
-        }
-        // Add TTY allocation flags
-        if (options.t) {
-            sshArgs.push('-t');
-        }
-        else if (options.T) {
-            sshArgs.push('-T');
-        }
-        // Explicitly tell SSH to use the certificate
-        sshArgs.push('-o', `CertificateFile=${certPath}`);
-        // Add destination
-        if (user) {
-            sshArgs.push(`${user}@${host}`);
-        }
-        else {
-            sshArgs.push(host);
-        }
-        // Add remote command if specified
-        if (remoteCommand && remoteCommand.length > 0) {
-            sshArgs.push(...remoteCommand);
-        }
-        // Step 5: Execute SSH
-        if (options.dryRun) {
-            output.section('Dry Run');
-            output.keyValue({
-                'Key': keyPath,
-                'Certificate': certPath,
-                'Host': host,
-                'User': user ?? '(default)',
-                'Port': port,
-                'Principals': principalsOverride ?? '(from mapping)',
-                'Command': remoteCommand.length > 0 ? remoteCommand.join(' ') : '(interactive shell)',
-            });
-            console.log();
-            output.info(`Would execute: ssh ${sshArgs.join(' ')}`);
-            return;
-        }
-        verbose(`Executing: ssh ${sshArgs.join(' ')}`);
-        // Only print empty line for interactive sessions
-        if (remoteCommand.length === 0) {
-            console.log();
-        }
-        // Spawn SSH with stdio inherited (interactive session)
-        const sshProcess = spawn('ssh', sshArgs, {
-            stdio: 'inherit',
-            env: process.env,
-        });
-        sshProcess.on('close', (code) => {
-            process.exit(code ?? 0);
-        });
-        sshProcess.on('error', (err) => {
-            output.error(`Failed to start SSH: ${err.message}`);
-            process.exit(1);
-        });
+        if (options.verbose)
+            output.info('Resolving SSH certificate...');
+        base = await ensureSignedSshBase(destination, options);
+        if (options.verbose)
+            output.success('Certificate ready');
     }
     catch (err) {
         output.error(err instanceof Error ? err.message : String(err));
         process.exit(1);
+        return;
+    }
+    // Build the interactive ssh args from the shared base
+    const sshArgs = [...base.baseSshArgs];
+    if (options.t)
+        sshArgs.push('-t');
+    else if (options.T)
+        sshArgs.push('-T');
+    sshArgs.push(base.user ? `${base.user}@${base.host}` : base.host);
+    if (remoteCommand && remoteCommand.length > 0)
+        sshArgs.push(...remoteCommand);
+    if (options.dryRun) {
+        output.section('Dry Run');
+        output.keyValue({
+            'Key': base.keyPath,
+            'Certificate': base.certPath,
+            'Host': base.host,
+            'User': base.user ?? '(default)',
+            'Port': base.port,
+            'Command': remoteCommand.length > 0 ? remoteCommand.join(' ') : '(interactive shell)',
+        });
+        console.log();
+        output.info(`Would execute: ssh ${sshArgs.join(' ')}`);
+        return;
     }
+    verbose(`Executing: ssh ${sshArgs.join(' ')}`);
+    if (remoteCommand.length === 0)
+        console.log();
+    const sshProcess = spawn('ssh', sshArgs, { stdio: 'inherit', env: process.env });
+    sshProcess.on('close', (code) => process.exit(code ?? 0));
+    sshProcess.on('error', (err) => {
+        output.error(`Failed to start SSH: ${err.message}`);
+        process.exit(1);
+    });
 }
 export function registerConnectCommand(parent) {
     parent

package/dist/commands/ssh/connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/commands/ssh/connect.ts"],"names":[],"mappings":"AAAA,oCAAoC;AAQpC,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,aAAuB,EACvB,OAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAEhD,kCAAkC;IAClC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,oEAAoE;IACpE,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,GAAW,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IACxC,IAAI,gBAAgB,GAAuB,OAAO,CAAC,QAAQ,CAAC;IAC5D,IAAI,kBAAkB,GAAuB,OAAO,CAAC,UAAU,CAAC;IAEhE,qCAAqC;IACrC,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QACrB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QACrB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACvC,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/C,kBAAkB,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,mBAAmB,WAAW,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,4BAA4B;IAC/D,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,WAAW,CAAC;QACnB,4CAA4C;QAC5C,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1C,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE;QAC9B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,uBAAuB;QACvB,IAAI,OAAe,CAAC;QACpB,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,uCAAuC;YACvC,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;YAC9B,OAAO,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;gBACxD,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;gBAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,UAAU,CAAC;YACrB,OAAO,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,OAAO,MAAM,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,CAAC,yBAAyB,UAAU,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,qCAAqC;QACrC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QAEzC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAEzD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACzC,CAAC;QAED,yBAAyB;QACzB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,KAAK,EAAE,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC7F,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;gBAEtC,wBAAwB;gBACxB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;oBACnD,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,qBAAqB,QAAQ,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;wBAClF,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;wBAC3F,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;wBAExE,IAAI,eAAe,EAAE,CAAC;4BACpB,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;4BAC5F,MAAM,CAAC,IAAI,CAAC,eAAe,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACtD,CAAC;wBACD,IAAI,UAAU,EAAE,CAAC;4BACf,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;wBAC/C,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,gCAAgC;oBAClC,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;QAED,4BAA4B;QAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,2DAA2D;QAC3D,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE5B,0BAA0B;QAC1B,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,2BAA2B;QAC3B,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAED,6CAA6C;QAC7C,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,QAAQ,EAAE,CAAC,CAAC;QAElD,kBAAkB;QAClB,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAED,kCAAkC;QAClC,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;QACjC,CAAC;QAED,sBAAsB;QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1B,MAAM,CAAC,QAAQ,CAAC;gBACd,KAAK,EAAE,OAAO;gBACd,aAAa,EAAE,QAAQ;gBACvB,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,IAAI,IAAI,WAAW;gBAC3B,MAAM,EAAE,IAAI;gBACZ,YAAY,EAAE,kBAAkB,IAAI,gBAAgB;gBACpD,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB;aACtF,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE/C,iDAAiD;QACjD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,uDAAuD;QACvD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE;YACvC,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7B,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,MAAM;SACH,OAAO,CAAC,oCAAoC,CAAC;SAC7C,WAAW,CAAC,uEAAuE,CAAC;SACpF,MAAM,CAAC,uBAAuB,EAAE,sDAAsD,CAAC;SACvF,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;SAC7C,MAAM,CAAC,2BAA2B,EAAE,0DAA0D,CAAC;SAC/F,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC;SACvD,MAAM,CAAC,eAAe,EAAE,6BAA6B,CAAC;SACtD,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;SACpE,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC;SAC9C,MAAM,CAAC,IAAI,EAAE,6DAA6D,CAAC;SAC3E,MAAM,CAAC,IAAI,EAAE,oCAAoC,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,aAAuB,EAAE,OAAuB,EAAE,EAAE;QACtF,MAAM,cAAc,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/commands/ssh/connect.ts"],"names":[],"mappings":"AAAA,oCAAoC;AAQpC,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAgBhD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,OAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,GAAW,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IACxC,IAAI,gBAAgB,GAAuB,OAAO,CAAC,QAAQ,CAAC;IAC5D,IAAI,kBAAkB,GAAuB,OAAO,CAAC,UAAU,CAAC;IAEhE,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QACrB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QACrB,IAAI,QAAQ,CAAC,IAAI;YAAE,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,QAAQ;YAAE,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC5D,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/C,kBAAkB,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,WAAW,CAAC;QACnB,IAAI,OAAO,CAAC,OAAO;YAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;QAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE/D,cAAc;IACd,IAAI,OAAe,CAAC;IACpB,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACrE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,GAAG,UAAU,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,OAAO,MAAM,CAAC;IACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,EAAE,CAAC,CAAC;IAEvF,cAAc;IACd,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3C,MAAM,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/F,CAAC;IAED,wDAAwD;IACxD,MAAM,WAAW,GAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAEtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,aAAuB,EACvB,OAAuB;IAEvB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,GAAG,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACjE,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,sDAAsD;IACtD,MAAM,OAAO,GAAa,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC7B,IAAI,OAAO,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;IAE9E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC;YACd,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,aAAa,EAAE,IAAI,CAAC,QAAQ;YAC5B,MAAM,EAAE,IAAI,CAAC,IAAI;YACjB,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW;YAChC,MAAM,EAAE,IAAI,CAAC,IAAI;YACjB,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB;SACtF,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAE9C,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjF,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC7B,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,MAAM;SACH,OAAO,CAAC,oCAAoC,CAAC;SAC7C,WAAW,CAAC,uEAAuE,CAAC;SACpF,MAAM,CAAC,uBAAuB,EAAE,sDAAsD,CAAC;SACvF,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;SAC7C,MAAM,CAAC,2BAA2B,EAAE,0DAA0D,CAAC;SAC/F,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC;SACvD,MAAM,CAAC,eAAe,EAAE,6BAA6B,CAAC;SACtD,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;SACpE,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC;SAC9C,MAAM,CAAC,IAAI,EAAE,6DAA6D,CAAC;SAC3E,MAAM,CAAC,IAAI,EAAE,oCAAoC,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,aAAuB,EAAE,OAAuB,EAAE,EAAE;QACtF,MAAM,cAAc,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/ssh/forward.d.ts

@@ -0,0 +1,49 @@
+/**
+ * SSH local port-forward with vault-CA certificate authentication.
+ *
+ * `znvault ssh forward -L 127.0.0.1:<lport>:<rhost>:<rport> <destination>`
+ * opens `ssh -N -L ...` using an auto-signed vault SSH certificate. The
+ * `--print-port` machine mode binds an OS-chosen local port and prints a
+ * single JSON line so callers (e.g. the payara deploy plugin) can consume it.
+ */
+import type { Command } from 'commander';
+import type { ConnectOptions } from './types.js';
+import type { SignedSshBase } from './connect.js';
+/**
+ * Ask the OS for a free TCP port by binding :0 then releasing it.
+ * Small TOCTOU window between release and ssh re-binding it — acceptable
+ * for a deploy tool (the race would only surface as an ssh bind error, which
+ * is reported and the host marked unreachable).
+ */
+export declare function pickFreePort(): Promise<number>;
+/** A local-forward specification: bind 127.0.0.1:lport → rhost:rport over the ssh channel. */
+export interface ForwardSpec {
+    bindHost: string;
+    localPort: number;
+    remoteHost: string;
+    remotePort: number;
+}
+/**
+ * Build the `ssh -N -L ...` argv from a signed base and a forward spec.
+ * Uses BatchMode + ConnectTimeout to match the codebase idiom (haproxy.ts).
+ */
+export declare function buildForwardArgs(base: SignedSshBase, spec: ForwardSpec, connectTimeoutSeconds: number): string[];
+/** Options accepted by `znvault ssh forward`. Extends ConnectOptions with forward-specific fields. */
+export interface ForwardOptions extends ConnectOptions {
+    /** -L spec: "[bindHost:]lport:rhost:rport". lport 0 = OS-assigned. */
+    L?: string;
+    /** Print one JSON line with the chosen local port and keep running. */
+    printPort?: boolean;
+}
+/**
+ * Parse a `-L` forward spec. Accepts 4-part (bindHost:lport:rhost:rport) or
+ * 3-part (lport:rhost:rport, bindHost defaults to 127.0.0.1).
+ */
+export declare function parseForwardOption(spec: string): ForwardSpec;
+/**
+ * Run the forward: sign the cert, pick a port if lport==0, spawn `ssh -N -L`,
+ * and (in --print-port mode) emit one JSON line to stdout then hold the tunnel.
+ */
+export declare function runForward(destination: string, options: ForwardOptions): Promise<void>;
+export declare function registerForwardCommand(parent: Command): void;
+//# sourceMappingURL=forward.d.ts.map

package/dist/commands/ssh/forward.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.d.ts","sourceRoot":"","sources":["../../../src/commands/ssh/forward.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAc9C;AAED,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,WAAW,EACjB,qBAAqB,EAAE,MAAM,GAC5B,MAAM,EAAE,CAQV;AAED,sGAAsG;AACtG,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,sEAAsE;IACtE,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAmB5D;AAKD;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CAwEf;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAiB5D"}

package/dist/commands/ssh/forward.js

@@ -0,0 +1,151 @@
+// Path: src/commands/ssh/forward.ts
+import * as net from 'node:net';
+import * as output from '../../lib/output.js';
+import { ensureSignedSshBase } from './connect.js';
+/**
+ * Ask the OS for a free TCP port by binding :0 then releasing it.
+ * Small TOCTOU window between release and ssh re-binding it — acceptable
+ * for a deploy tool (the race would only surface as an ssh bind error, which
+ * is reported and the host marked unreachable).
+ */
+export function pickFreePort() {
+    return new Promise((resolve, reject) => {
+        const srv = net.createServer();
+        srv.once('error', reject);
+        srv.listen(0, '127.0.0.1', () => {
+            const addr = srv.address();
+            if (addr && typeof addr === 'object') {
+                const port = addr.port;
+                srv.close(() => { resolve(port); });
+            }
+            else {
+                srv.close(() => { reject(new Error('Failed to obtain a free port')); });
+            }
+        });
+    });
+}
+/**
+ * Build the `ssh -N -L ...` argv from a signed base and a forward spec.
+ * Uses BatchMode + ConnectTimeout to match the codebase idiom (haproxy.ts).
+ */
+export function buildForwardArgs(base, spec, connectTimeoutSeconds) {
+    const args = [...base.baseSshArgs];
+    args.push('-o', 'BatchMode=yes');
+    args.push('-o', `ConnectTimeout=${connectTimeoutSeconds}`);
+    args.push('-N');
+    args.push('-L', `${spec.bindHost}:${spec.localPort}:${spec.remoteHost}:${spec.remotePort}`);
+    args.push(base.user ? `${base.user}@${base.host}` : base.host);
+    return args;
+}
+/**
+ * Parse a `-L` forward spec. Accepts 4-part (bindHost:lport:rhost:rport) or
+ * 3-part (lport:rhost:rport, bindHost defaults to 127.0.0.1).
+ */
+export function parseForwardOption(spec) {
+    const parts = spec.split(':');
+    if (parts.length === 4) {
+        return {
+            bindHost: parts[0],
+            localPort: Number(parts[1]),
+            remoteHost: parts[2],
+            remotePort: Number(parts[3]),
+        };
+    }
+    if (parts.length === 3) {
+        return {
+            bindHost: '127.0.0.1',
+            localPort: Number(parts[0]),
+            remoteHost: parts[1],
+            remotePort: Number(parts[2]),
+        };
+    }
+    throw new Error(`Invalid forward spec "${spec}". Use "[bindHost:]localPort:remoteHost:remotePort".`);
+}
+const DEFAULT_FORWARD_REMOTE_PORT = 9100;
+const FORWARD_CONNECT_TIMEOUT_SECONDS = 10;
+/**
+ * Run the forward: sign the cert, pick a port if lport==0, spawn `ssh -N -L`,
+ * and (in --print-port mode) emit one JSON line to stdout then hold the tunnel.
+ */
+export async function runForward(destination, options) {
+    const { spawn } = await import('child_process');
+    const spec = options.L
+        ? parseForwardOption(options.L)
+        : { bindHost: '127.0.0.1', localPort: 0, remoteHost: '127.0.0.1', remotePort: DEFAULT_FORWARD_REMOTE_PORT };
+    // Resolve a concrete local port (O1): pick a free one when 0 was requested.
+    if (spec.localPort === 0) {
+        spec.localPort = await pickFreePort();
+    }
+    let base;
+    try {
+        base = await ensureSignedSshBase(destination, options);
+    }
+    catch (err) {
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+        return;
+    }
+    const sshArgs = buildForwardArgs(base, spec, FORWARD_CONNECT_TIMEOUT_SECONDS);
+    if (options.dryRun) {
+        output.section('Dry Run');
+        output.keyValue({
+            'Key': base.keyPath,
+            'Certificate': base.certPath,
+            'Forward': `${spec.bindHost}:${spec.localPort} → ${base.host}:${spec.remotePort}`,
+            'User': base.user ?? '(default)',
+        });
+        console.log();
+        output.info(`Would execute: ssh ${sshArgs.join(' ')}`);
+        return;
+    }
+    // All human/log output goes to STDERR so stdout stays a clean machine channel.
+    const sshProcess = spawn('ssh', sshArgs, {
+        stdio: ['ignore', 'ignore', 'inherit'],
+        env: process.env,
+    });
+    let exited = false;
+    sshProcess.on('error', (err) => {
+        exited = true;
+        process.stderr.write(`Failed to start SSH: ${err.message}\n`);
+        process.exit(1);
+    });
+    sshProcess.on('close', (code) => {
+        exited = true;
+        process.exit(code ?? 0);
+    });
+    // Teardown on our own termination so we never orphan the ssh -N child.
+    const cleanup = () => { if (!exited && sshProcess.pid)
+        sshProcess.kill('SIGTERM'); };
+    process.on('SIGINT', () => { cleanup(); process.exit(0); });
+    process.on('SIGTERM', () => { cleanup(); process.exit(0); });
+    if (options.printPort) {
+        // ssh -N has no "ready" signal on stdout; give it a moment to establish,
+        // then emit the contract line. forwardUp = ssh started + port bound by us.
+        await new Promise((r) => setTimeout(r, 300));
+        if (!exited) {
+            process.stdout.write(JSON.stringify({ localPort: spec.localPort, pid: sshProcess.pid, forwardUp: true }) + '\n');
+        }
+    }
+    else {
+        process.stderr.write(`Forwarding 127.0.0.1:${spec.localPort} → ${base.host}:${spec.remotePort} (Ctrl-C to stop)\n`);
+    }
+}
+export function registerForwardCommand(parent) {
+    parent
+        .command('forward <destination>')
+        .description('Open an SSH local port-forward authenticated by the vault SSH CA')
+        .option('-L <spec>', 'Forward spec: [bindHost:]localPort:remoteHost:remotePort (localPort 0 = auto)')
+        .option('--print-port', 'Print {"localPort","pid","forwardUp"} JSON then hold the tunnel (machine mode)')
+        .option('-i, --identity <file>', 'Path to SSH private key')
+        .option('-p, --port <port>', 'SSH port', '22')
+        .option('--principals <principals>', 'Principals for signing (comma-separated)')
+        .option('--ttl <ttl>', 'Certificate TTL (e.g., 8h, 1d)')
+        .option('--tenant <id>', 'Tenant ID (superadmin only)')
+        .option('--force-sign', 'Force re-signing even if certificate is valid')
+        .option('--dry-run', 'Show what would be done without executing SSH')
+        .option('-v, --verbose', 'Show verbose output')
+        .action(async (destination, options) => {
+        await runForward(destination, options);
+    });
+}
+//# sourceMappingURL=forward.js.map

package/dist/commands/ssh/forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../../../src/commands/ssh/forward.ts"],"names":[],"mappings":"AAAA,oCAAoC;AAYpC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGnD;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;YAC3B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAmB,EACnB,IAAiB,EACjB,qBAA6B;IAE7B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,qBAAqB,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;YACpB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC7B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;YACpB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC7B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,sDAAsD,CAAC,CAAC;AACvG,CAAC;AAED,MAAM,2BAA2B,GAAG,IAAI,CAAC;AACzC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,OAAuB;IAEvB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC;QACpB,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,2BAA2B,EAAE,CAAC;IAE9G,4EAA4E;IAC5E,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAE9E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC;YACd,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,aAAa,EAAE,IAAI,CAAC,QAAQ;YAC5B,SAAS,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE;YACjF,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE;QACvC,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;QACtC,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC7B,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QAC9B,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,OAAO,GAAG,GAAS,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG;QAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,qBAAqB,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,MAAM;SACH,OAAO,CAAC,uBAAuB,CAAC;SAChC,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CAAC,WAAW,EAAE,+EAA+E,CAAC;SACpG,MAAM,CAAC,cAAc,EAAE,gFAAgF,CAAC;SACxG,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;SAC7C,MAAM,CAAC,2BAA2B,EAAE,0CAA0C,CAAC;SAC/E,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC;SACvD,MAAM,CAAC,eAAe,EAAE,6BAA6B,CAAC;SACtD,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;SACpE,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC;SAC9C,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,OAAuB,EAAE,EAAE;QAC7D,MAAM,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/ssh/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/ssh/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAkDtC,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,IAAI,CAuDjF;AAGD,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/ssh/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAazC,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAkDtC,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,IAAI,CA8DjF;AAGD,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/commands/ssh/index.js

@@ -5,6 +5,7 @@ import { registerMappingCommands } from './mapping.js';
 import { registerServerGroupCommands } from './server-group.js';
 import { registerConfigCommands } from './config.js';
 import { registerConnectCommand, executeConnect } from './connect.js';
+import { registerForwardCommand } from './forward.js';
 import { registerBookmarkCommands, resolveBookmark } from './bookmark.js';
 import { registerSCPCommand } from './scp.js';
 import { registerHostsCommand } from './hosts.js';
@@ -13,7 +14,7 @@ import { resolveContext, withRegisterContext, } from '../../lib/command-context.
 // Known subcommands that should NOT be treated as destinations
 const SSH_SUBCOMMANDS = new Set([
     'ca', 'cert', 'mapping', 'server-group', 'config',
-    'bookmark', 'bm', 'hosts', 'scp', 'connect', 'exec',
+    'bookmark', 'bm', 'hosts', 'scp', 'connect', 'exec', 'forward',
     'help', '--help', '-h',
 ]);
 /**
@@ -55,6 +56,12 @@ export function registerSSHCommands(parent, opts) {
     const ssh = parent
         .command('ssh')
         .description('SSH CA management and quick connect (znvault ssh user@host)')
+        // Parse options relative to position: options that appear AFTER a subcommand
+        // name (e.g. `ssh connect --dry-run ...`) are handed to the subcommand rather
+        // than being swallowed by this parent (which also declares --dry-run/--ttl/-i
+        // for the `ssh user@host` shortcut). Without this, Commander attributes those
+        // options to the parent and the subcommand's action sees them as undefined.
+        .enablePositionalOptions()
         .argument('[destination]', 'Host to connect to (user@host or bookmark name)')
         .argument('[command...]', 'Remote command to execute')
         .option('-i, --identity <file>', 'Path to SSH private key')
@@ -102,6 +109,7 @@ export function registerSSHCommands(parent, opts) {
         registerHostsCommand(ssh);
         registerSCPCommand(ssh);
         registerConnectCommand(ssh);
+        registerForwardCommand(ssh);
         registerExecCommand(ssh);
     });
 }

package/dist/commands/ssh/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/ssh/index.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAsBlC,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,+DAA+D;AAC/D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ;IACjD,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM;IACnD,MAAM,EAAE,QAAQ,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,kDAAkD;IAClD,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qCAAqC;IACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gBAAgB;IAChB,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oCAAoC;IACpC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,2DAA2D;IAC3D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,sDAAsD;QACtD,0EAA0E;QAC1E,0DAA0D;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,IAAsB;IACzE,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM;SACf,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,6DAA6D,CAAC;SAC1E,QAAQ,CAAC,eAAe,EAAE,iDAAiD,CAAC;SAC5E,QAAQ,CAAC,cAAc,EAAE,2BAA2B,CAAC;SACrD,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;SAC7C,MAAM,CAAC,2BAA2B,EAAE,0CAA0C,CAAC;SAC/E,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC;SACvD,MAAM,CAAC,eAAe,EAAE,6BAA6B,CAAC;SACtD,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;SACpE,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC;SAC9C,MAAM,CAAC,IAAI,EAAE,kCAAkC,CAAC;SAChD,MAAM,CAAC,IAAI,EAAE,oCAAoC,CAAC;SAClD,kBAAkB,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,KAAK,EAAE,WAA+B,EAAE,aAAuB,EAAE,OAAuB,EAAE,EAAE;QAClG,wCAAwC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,IAAI,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,MAAM,cAAc,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,wBAAwB;YACxB,OAAO,CAAC,KAAK,CAAC,sCAAsC,WAAW,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACrE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAC7E,iFAAiF;IACjF,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE;QAC5B,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC7B,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACjC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9B,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,cAAc,YAAY,CAAC;AAE3B,wCAAwC;AACxC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,8BAA8B;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/ssh/index.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAsBlC,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,+DAA+D;AAC/D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ;IACjD,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS;IAC9D,MAAM,EAAE,QAAQ,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,kDAAkD;IAClD,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qCAAqC;IACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gBAAgB;IAChB,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oCAAoC;IACpC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,2DAA2D;IAC3D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,sDAAsD;QACtD,0EAA0E;QAC1E,0DAA0D;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,IAAsB;IACzE,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM;SACf,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,6DAA6D,CAAC;QAC3E,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;SAC3E,uBAAuB,EAAE;SACzB,QAAQ,CAAC,eAAe,EAAE,iDAAiD,CAAC;SAC5E,QAAQ,CAAC,cAAc,EAAE,2BAA2B,CAAC;SACrD,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,IAAI,CAAC;SAC7C,MAAM,CAAC,2BAA2B,EAAE,0CAA0C,CAAC;SAC/E,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC;SACvD,MAAM,CAAC,eAAe,EAAE,6BAA6B,CAAC;SACtD,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;SACpE,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC;SAC9C,MAAM,CAAC,IAAI,EAAE,kCAAkC,CAAC;SAChD,MAAM,CAAC,IAAI,EAAE,oCAAoC,CAAC;SAClD,kBAAkB,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,KAAK,EAAE,WAA+B,EAAE,aAAuB,EAAE,OAAuB,EAAE,EAAE;QAClG,wCAAwC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,IAAI,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,MAAM,cAAc,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,wBAAwB;YACxB,OAAO,CAAC,KAAK,CAAC,sCAAsC,WAAW,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACrE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAC7E,iFAAiF;IACjF,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE;QAC5B,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC7B,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACjC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9B,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,cAAc,YAAY,CAAC;AAE3B,wCAAwC;AACxC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,8BAA8B;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -49,6 +49,12 @@ const program = new Command();
 program
     .name('znvault')
     .description('ZnVault Administration CLI')
+    // Enable positional options on the root program so that options appearing after
+    // a subcommand name are parsed relative to position. Commander requires this on
+    // ancestor commands for nested positional parsing to reach grandchild commands
+    // (e.g. `znvault ssh connect --dry-run`), where the `ssh` parent also declares
+    // its own options for the `ssh user@host` shortcut. See src/commands/ssh/index.ts.
+    .enablePositionalOptions()
     .version(getVersion())
     .option('--url <url>', 'Vault server URL')
     .option('--insecure', 'Skip TLS certificate verification')
@@ -80,6 +86,13 @@ program
     if (parentName === 'completion' || cmdPath === 'completion') {
         return;
     }
+    // Skip profile indicator for `ssh forward --print-port` — its stdout is a
+    // machine channel (JSON contract line) consumed by the deploy tunnel manager.
+    if (cmdPath === 'forward' &&
+        parentName === 'ssh' &&
+        actionCommand.opts().printPort === true) {
+        return;
+    }
     // Show current profile indicator
     const config = getConfig();
     profileIndicator(getActiveProfileName(), config.url);