ssh-mcp 2.3.2 → 2.3.4

package/build/index.js

@@ -1,222 +1,14 @@
 #!/usr/bin/env node
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { loadConfig, getConfigPath } from './config/loader.js';
-import { OperatorError, ConfigNotFoundError, reportFatal } from './errors.js';
+import { reportFatal } from './errors.js';
 import { ConnectionRegistry } from './ssh/connection-registry.js';
-import { PolicyEngine, HOST_GROUPS, resolvePolicyRules } from './policy/engine.js';
+import { PolicyEngine, resolvePolicyRules } from './policy/engine.js';
 import { AuditStore } from './audit/store.js';
 import { registerTools, registerResources, getToolHashes } from './tools/registry.js';
 import { initKeychain } from './config/credential-resolver.js';
 import { SERVER_VERSION } from './version.js';
-function parseArgv() {
-    const args = process.argv.slice(2);
-    const config = {};
-    for (const arg of args) {
-        if (arg.startsWith('--')) {
-            const eq = arg.indexOf('=');
-            if (eq === -1) {
-                config[arg.slice(2)] = null;
-            }
-            else {
-                config[arg.slice(2, eq)] = arg.slice(eq + 1);
-            }
-        }
-    }
-    return config;
-}
-/**
- * Whether a boolean flag was passed at all.
- *
- * `parseArgv` stores `null` for a flag written without `=`, which is how every
- * documented boolean flag is written. Testing that value for truthiness makes
- * the flag a no-op: `--disableApproval`, `--auditEntropyScan` and
- * `--auditTamperEvident` all did nothing unless spelled `--flag=1`, which
- * nothing documents (#91). The two call sites that got it right already used
- * `!== undefined`; this gives the check a name so the next one cannot miss it.
- *
- * `--flag=false` and `--flag=0` turn it off, because a flag that cannot be
- * turned off once written into a wrapper script is its own annoyance.
- */
-function flagEnabled(argv, name) {
-    if (!(name in argv))
-        return false;
-    const value = argv[name];
-    if (value === null || value === '')
-        return true;
-    return !['false', '0', 'no', 'off'].includes(value.toLowerCase());
-}
-/**
- * v1 flags that v2 removed. Silently ignoring them means the user only finds
- * out at the first command, as an auth failure with no hint about the cause.
- */
-const REMOVED_V1_FLAGS = {
-    password: 'Use the SSH_MCP_PASSWORD env var (or a per-profile SSH_MCP_<PROFILE>_PASSWORD).',
-    suPassword: 'Use the SSH_MCP_SUDO_PASSWORD env var.',
-    sudoPassword: 'Use the SSH_MCP_SUDO_PASSWORD env var.',
-    disableSudo: 'Sudo is now a separate tool; restrict it with a role/policy that disallows the "privileged" class.',
-};
-function checkRemovedFlags(argv) {
-    const found = Object.keys(REMOVED_V1_FLAGS).filter((f) => f in argv);
-    if (found.length === 0)
-        return;
-    throw new OperatorError('These flags were removed in v2:\n' +
-        found.map((f) => `  --${f}: ${REMOVED_V1_FLAGS[f]}`).join('\n') +
-        '\nSee the "Migrating from v1" section of the README.');
-}
-/**
- * v1 documented `--maxChars=none` (and 0/negative) as "no limit". Parsing it
- * with `parseInt(...) || 5000` silently turned that into a 5000-char cap.
- */
-function parseMaxChars(raw) {
-    if (typeof raw !== 'string' || raw === '')
-        return 5_000;
-    if (raw.toLowerCase() === 'none')
-        return Number.MAX_SAFE_INTEGER;
-    const parsed = parseInt(raw);
-    if (isNaN(parsed))
-        return 5_000;
-    return parsed <= 0 ? Number.MAX_SAFE_INTEGER : parsed;
-}
-/**
- * `strict` was previously unreachable: nothing but test code could select it,
- * yet host-key.ts pointed users at a `--acceptNewHostKey` flag that never
- * existed. `--insecureHostKey` is kept as an alias for the documented flag.
- */
-function resolveHostKeyMode(argv) {
-    if (flagEnabled(argv, 'insecureHostKey'))
-        return 'insecure';
-    const mode = argv.hostKeyMode;
-    if (mode === null || mode === undefined)
-        return 'tofu';
-    if (mode === 'tofu' || mode === 'strict' || mode === 'insecure')
-        return mode;
-    throw new OperatorError(`Invalid --hostKeyMode=${mode}. Expected one of: tofu, strict, insecure.`);
-}
-/**
- * Which policy tier a CLI-configured host belongs to.
- *
- * Without this there was no way to say it from the command line at all. The
- * inline profile carries no group, so it fell to the strictest tier, where the
- * `admin` role has no `privileged` — meaning `sudo` could never run for anyone
- * who had not written a config file (#91).
- *
- * The default stays `prod`. Guessing an unknown host is production is the safe
- * direction; what was missing was a way to correct the guess.
- */
-export function resolveHostGroup(argv) {
-    const group = argv.group;
-    if (group === null || group === undefined)
-        return 'prod';
-    if (HOST_GROUPS.includes(group))
-        return group;
-    // Falling through would silently apply the prod bindings to a typo, and the
-    // operator would read the refusal as policy rather than as their own slip.
-    throw new OperatorError(`Invalid --group=${group}. Expected one of: ${HOST_GROUPS.join(', ')}.`);
-}
-/**
- * Every ACL finding, in the order it happened — both "readable beyond its owner" and
- * "could not be checked".
- *
- * Collected rather than only printed so `main()` can act on them once there is somewhere
- * durable to put them; see the note at the sink below.
- */
-const aclFindings = [];
-async function buildAppConfig(argv) {
-    // The way past an ACL that could not be read, rather than an operator with no
-    // exit. See assertPrivateOnWindows.
-    // The sink is supplied here rather than left to the module's default, which is the
-    // point of having one: "this security check did not run" is a decision about what the
-    // operator must be told, and the loader is not the layer that owns that. Routing it to
-    // the audit store as well needs an AuditRecord variant for a startup event — that type
-    // is hash-chained and tamper-evident, so it is its own change, and it is queued.
-    const aclOpts = {
-        enforce: flagEnabled(argv, 'strictConfigAcl'),
-        allowUnchecked: flagEnabled(argv, 'allowUncheckedConfigAcl'),
-        onFinding: (f) => {
-            aclFindings.push(f);
-            console.error(`Warning: ${f.message}`);
-        },
-    };
-    if (argv.config !== undefined) {
-        // `parseArgv` stores null for a flag written without `=`, so a bare `--config` used to
-        // be falsy here and fall into the default-path branch — which now refuses rather than
-        // silently ignoring an unusable file, so the operator got a refusal naming a path they
-        // never asked for.
-        if (argv.config === null || argv.config === '') {
-            throw new OperatorError('--config needs a path: --config=<path>');
-        }
-        return loadConfig(argv.config, aclOpts);
-    }
-    try {
-        const fromFile = await loadConfig(undefined, aclOpts);
-        // Before #138 every Windows config was rejected by the mode-bit check and
-        // the rejection was swallowed, so an operator who also passed --host/--user
-        // was silently running off the flags. Now that the file loads, it takes
-        // precedence — a flip worth one line rather than a surprise about which host
-        // a command reached.
-        if (argv.host || argv.user) {
-            console.error(`Note: ${getConfigPath()} was loaded, so --host/--user are ignored. ` +
-                'Pass --config <path> to choose a different file.');
-        }
-        return fromFile;
-    }
-    catch (err) {
-        // Only "there is no file" means fall through. A file that exists and is
-        // unusable — malformed TOML, a schema violation, a permission failure —
-        // used to be swallowed here too and reported as a missing config, which is
-        // how #138 stayed unfindable: the operator's file was in the right place,
-        // and the real error was discarded before anyone could read it.
-        //
-        // Falling through would also be wrong on its own terms whenever
-        // --host/--user happen to be present: the server would start, silently
-        // ignoring every profile, policy and role binding the operator wrote.
-        if (!(err instanceof ConfigNotFoundError))
-            throw err;
-    }
-    if (!argv.host || !argv.user) {
-        throw new OperatorError('No config file found and missing required --host/--user.\n' +
-            // Was hardcoded to ~/.config/ssh-mcp/config.toml on every platform, so on
-            // Windows and macOS it named a path this code never reads.
-            `Either create a config file at ${getConfigPath()} or pass --config <path>.\n` +
-            'For quick start: --host=<host> --user=<user> (credentials via env vars).');
-    }
-    const defaults = {
-        sessionMaxPerConnection: parseInt(argv.sessionMax) || 5,
-        sessionIdleTimeoutMs: parseInt(argv.sessionTtl) || 600_000,
-        sessionBackgroundMaxMs: 3_600_000,
-        commandTimeoutMs: parseInt(argv.timeout) || 60_000,
-        commandMaxChars: parseMaxChars(argv.maxChars),
-        commandMaxOutputBytes: 1_048_576,
-        connectionIdleReapMs: 900_000,
-        commandQuotaPerDay: parseInt(argv.commandQuota) || 0,
-        approvalGrantTtlMs: parseInt(argv.approvalGrantTtl) || 0,
-        approvalMode: 'ask-destructive',
-    };
-    const profile = {
-        name: 'default',
-        host: argv.host,
-        port: parseInt(argv.port) || 22,
-        user: argv.user,
-        auth: argv.key ? 'key' : 'password',
-        keyRef: argv.key || undefined,
-        workdir: argv.workdir || undefined,
-        tty: false,
-        timeout: defaults.commandTimeoutMs,
-        maxChars: defaults.commandMaxChars,
-        maxOutputBytes: defaults.commandMaxOutputBytes,
-        role: 'admin',
-        group: resolveHostGroup(argv),
-        readOnly: false,
-        approvalPolicy: flagEnabled(argv, 'disableApproval') ? 'auto' : defaults.approvalMode,
-        cert: false,
-        sessionMaxPerConnection: defaults.sessionMaxPerConnection,
-        sessionIdleTimeoutMs: defaults.sessionIdleTimeoutMs,
-        sessionBackgroundMaxMs: defaults.sessionBackgroundMaxMs,
-        commandQuotaPerDay: defaults.commandQuotaPerDay,
-    };
-    return { defaults, profiles: [profile] };
-}
+import { parseArgv, buildAppConfig, checkRemovedFlags, flagEnabled, resolveHostKeyMode, } from './cli.js';
 async function main() {
     const argv = parseArgv();
     checkRemovedFlags(argv);
@@ -268,14 +60,29 @@ async function main() {
         console.error('SSH MCP Server v2 running on stdio');
     }
     const reaperInterval = setInterval(() => {
-        for (const info of registry.listConnections()) {
-            const conn = registry.get(info.profile);
-            if (conn) {
-                conn.reapExpiredSessions();
-            }
-        }
-        registry.reapIdleConnections();
+        // Session reaping is awaited before connection reaping, and that order is load-bearing:
+        // closing a background session now signals its command, and `reapIdleConnections` gates
+        // on `sessionCount`, which drops to zero as soon as a session is closed. Fired without
+        // awaiting, the connection was torn down microseconds after the first signal and the
+        // TERM and KILL rungs were discarded — so a command that ignores INT survived its own
+        // reaping.
+        void (async () => {
+            const conns = registry.listConnections()
+                .map((info) => registry.get(info.profile))
+                .filter((c) => Boolean(c));
+            await Promise.all(conns.map((conn) => conn.reapExpiredSessions().catch(() => { })));
+            registry.reapIdleConnections();
+        })();
     }, 60_000);
+    /**
+     * How long teardown gets before the process exits regardless.
+     *
+     * One kill ladder (3s) plus slack. Sessions and connections close concurrently, so this
+     * is the whole budget rather than a per-session one. Docker's default stop grace is 10s
+     * and Kubernetes' is 30s, so this stays comfortably inside both — the point is that we
+     * choose the moment we give up rather than being SIGKILLed in the middle of it.
+     */
+    const SHUTDOWN_BUDGET_MS = 5000;
     let isShuttingDown = false;
     const cleanup = async () => {
         if (isShuttingDown)
@@ -283,14 +90,26 @@ async function main() {
         isShuttingDown = true;
         console.error('Shutting down SSH MCP Server...');
         clearInterval(reaperInterval);
+        // Audit first. An earlier version of this comment claimed session teardown wrote audit
+        // records that the old order dropped — it does not: nothing under src/ssh/ touches the
+        // audit store, only the `close-session` tool does, and that record is written and
+        // awaited during the tool call. So the reorder rescued nothing and put the final flush
+        // behind a teardown that now waits for kill ladders. Flushing first cannot lose a record
+        // that teardown does not write, and it survives a SIGKILL at the end of the grace period.
         try {
             await audit.close();
         }
         catch (e) {
             console.error('audit.close failed:', e);
         }
+        // Bounded, so `process.exit(0)` is reached deliberately rather than by the container
+        // runtime's SIGKILL. Teardown is concurrent now, so the honest ceiling is one kill
+        // ladder plus slack rather than one per session.
         try {
-            await registry.closeAll();
+            await Promise.race([
+                registry.closeAll(),
+                new Promise((resolve) => setTimeout(resolve, SHUTDOWN_BUDGET_MS).unref()),
+            ]);
         }
         catch (e) {
             console.error('closeAll failed:', e);
@@ -315,4 +134,3 @@ if (isCliEnabled || isTestMode) {
         process.exit(reportFatal(error));
     });
 }
-export { parseArgv, buildAppConfig, checkRemovedFlags, parseMaxChars, flagEnabled, resolveHostKeyMode };

package/build/ssh/channel-signal.js

@@ -0,0 +1,193 @@
+/** Outgoing states in which the far end still has a channel to receive a request. */
+const OPEN_STATES = new Set(['open', 'eof']);
+/**
+ * Whether ssh2's own `Channel.signal()` would put this request on the wire.
+ *
+ * A deliberate copy of lib/Channel.js:241-243 in ssh2 1.17, and the single place to
+ * update when that changes. Copying it is what lets us tell "ssh2 will handle this"
+ * from "ssh2 will silently discard it" — the distinction the whole module exists for.
+ */
+function ssh2WillSend(ch) {
+    return ch.type === 'session' && ch.writable === true && ch.outgoing?.state === 'open';
+}
+/**
+ * Whether the transport can still carry a packet.
+ *
+ * ssh2 hands every packet to `onWrite`, which is `if (isWritable(sock)) sock.write(data)`
+ * (lib/client.js:303) — an unwritable socket means the packet is dropped with no error
+ * and no return value. Measured against 1.17.0: immediately after `client.end()`,
+ * `sock.writable` is false while `outgoing.state` is still `'eof'`, so the state guard
+ * below passes and the signal call returns without throwing. Reporting that as delivery
+ * is #146 one layer down, and it is reachable whenever a connection is closed under a
+ * running command — `SSHConnection.close()`, or the idle reaper, which does not consult
+ * `activeChannels`.
+ *
+ * All three of `isWritable`'s conjuncts, not just the first. The first version of this
+ * checked `sock.writable` alone, and ssh2 added the other two for a reason
+ * (nodejs/node#36029: `writable` stays true after the stream has ended). Measured:
+ *
+ *   allowHalfOpen=false, peer FIN -> writable=false, isWritable()=false   (agree)
+ *   allowHalfOpen=true,  peer FIN -> writable=true,  isWritable()=false   (disagree)
+ *
+ * and a ProxyJump connection's transport is exactly the second case — `connectConfig.sock`
+ * is a `forwardOut` channel, and ssh2's channels default to `allowHalfOpen: true`
+ * (lib/Channel.js:90). So the one-conjunct version was blind on the path that has its own
+ * integration test. Mirroring the whole predicate is also what `ssh2WillSend` does, and
+ * the asymmetry between the two was the actual defect.
+ */
+function onTheWire(ch) {
+    const sock = ch._client?._sock;
+    // Fail closed on a shape we cannot read: every other unknown in this module is reported
+    // as "not dispatched", and a guard whose job is to refuse when unsure must not be the
+    // one place that assumes the best.
+    if (sock === undefined || typeof sock.writable !== 'boolean')
+        return false;
+    return sock.writable && sock._readableState?.ended === false;
+}
+/**
+ * Send `name` to the process behind `channel`.
+ *
+ * Returns whether the request was **dispatched to the wire** — not whether the command
+ * stopped. Nothing in SSH acknowledges a signal request, the delivery semantics are the
+ * server's choice rather than the protocol's, and a target may refuse it outright, so
+ * "the process is gone" is not a fact this function can produce. What it can produce
+ * honestly is "I could not even ask", which is what the caller warns about, because a
+ * signal that goes nowhere while reporting success is the defect this module exists to
+ * remove.
+ */
+export function signalChannel(channel, name) {
+    const ch = channel;
+    const state = ch.outgoing?.state;
+    // Only session channels carry a process. ssh2 gates on this too, and a
+    // forwarded-tcpip channel has nothing to signal.
+    if (ch.type !== undefined && ch.type !== 'session')
+        return false;
+    // Already closing or closed: the request would have no channel to arrive on, and
+    // ssh2 may have handed the id to a new channel.
+    if (state !== undefined && !OPEN_STATES.has(state))
+        return false;
+    // Nothing can be dispatched through a socket ssh2 will not write to, and it will not
+    // tell us — so this has to be asked before either path claims success.
+    if (!onTheWire(ch))
+        return false;
+    // The supported path, taken whenever ssh2 will actually write the request.
+    if (ssh2WillSend(ch)) {
+        try {
+            channel.signal(name);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    const id = ch.outgoing?.id;
+    const protocol = ch._client?._protocol;
+    if (typeof id === 'number' && typeof protocol?.signal === 'function') {
+        try {
+            protocol.signal(id, name);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    // A shape we do not recognise. Ask ssh2 and report failure anyway: we cannot tell
+    // whether it sent anything, and claiming delivery we cannot verify is what made
+    // this bug invisible for so long. An unnecessary "may still be running" warning is
+    // the better way to be wrong.
+    try {
+        channel.signal(name);
+    }
+    catch { /* nothing left to try */ }
+    return false;
+}
+/**
+ * Appended when a stop request could not even be dispatched, so nothing was asked of the
+ * host at all.
+ *
+ * Deliberately narrower than "the command is still running", which is not knowable from
+ * here: nothing acknowledges a signal request. Its *absence* therefore means "we asked",
+ * not "it died".
+ *
+ * It lives beside the function that decides it because two callers now need the same
+ * sentence — a timed-out or cancelled `exec`, and `close-session` on a background
+ * session. One contract, one place.
+ */
+export const COULD_NOT_SIGNAL = ' The remote command could not be signalled, so it may still be running on the host.';
+/** How long each signal is given to work before the next one is tried. */
+const ESCALATION_MS = 1000;
+/**
+ * Escalate until the command is gone: INT, then TERM, then KILL, then drop the
+ * channel.
+ *
+ * KILL is last because it denies the command any chance to clean up; it exists
+ * because the rung below it used to be `close()`, and closing a channel was measured
+ * not to stop anything. A command that ignores INT and TERM used to run forever.
+ *
+ * Returns whether the *first* signal was dispatched — known synchronously, so the
+ * caller can say "I could not even ask" in the same breath as the timeout it is already
+ * reporting. It is not a claim that the command stopped, and callers must not read it
+ * as one: the later rungs have not run yet, and no rung is acknowledged by anything.
+ */
+export function terminateChannel(channel) {
+    const dispatched = signalChannel(channel, 'INT');
+    const pending = [];
+    const later = (fn, ms) => {
+        // Unreferenced: this ladder outlives the promise it settled by up to three
+        // seconds, and a referenced timer would add that to the exit of any process
+        // whose last act was a timed-out command.
+        pending.push(setTimeout(fn, ms).unref());
+    };
+    const stop = () => { for (const t of pending)
+        clearTimeout(t); pending.length = 0; };
+    // Nothing more to send once the channel is gone, and the id may be reused.
+    channel.once('close', stop);
+    later(() => { signalChannel(channel, 'TERM'); }, ESCALATION_MS);
+    later(() => { signalChannel(channel, 'KILL'); }, ESCALATION_MS * 2);
+    later(() => { try {
+        channel.close();
+    }
+    catch { /* already gone */ } }, ESCALATION_MS * 3);
+    return dispatched;
+}
+/**
+ * Wait for a channel to actually close, bounded.
+ *
+ * The ladder's rungs are timers, so `terminateChannel` returns long before the escalation
+ * has finished. Anything that tears the transport down afterwards — `SSHConnection.close()`
+ * calling `client.end()`, or the process exiting — cancels the rest of it, and a command
+ * that ignored INT then survives with no further escalation possible. Callers that are
+ * about to do that must wait here first.
+ *
+ * Resolves true if the channel closed, false on timeout. The default budget is the ladder
+ * plus a little, so a command that only dies to KILL still gets there.
+ */
+export function waitForChannelClose(channel, ms = ESCALATION_MS * 3 + 500) {
+    // ssh2 emits `'close'` exactly once, and `onCHANNEL_CLOSE` early-returns for a channel
+    // whose incoming state is already `'closed'` — so a listener attached after the fact
+    // never fires and the caller would burn the whole budget waiting for an event that has
+    // already happened. Not reachable through SessionManager today, because the session is
+    // removed from the map by that same emit; it is a trap for the next caller.
+    const incoming = channel.incoming;
+    if (incoming?.state === 'closed' || channel.destroyed)
+        return Promise.resolve(true);
+    return new Promise((resolve) => {
+        let settled = false;
+        const onClose = () => done(true);
+        const done = (closed) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            // Detached on the timeout path too: a timed-out wait would otherwise leave its
+            // closure attached to a channel that may outlive it.
+            channel.removeListener('close', onClose);
+            resolve(closed);
+        };
+        const timer = setTimeout(() => done(false), ms);
+        // Unreferenced so a hung channel cannot hold the process open; the caller is awaiting
+        // this, so the loop stays alive for as long as the caller itself does.
+        timer.unref();
+        channel.once('close', onClose);
+    });
+}

package/build/ssh/connection-registry.js

@@ -94,9 +94,10 @@ export class ConnectionRegistry {
         }
     }
     async closeAll() {
-        for (const conn of this.connections.values()) {
-            await conn.close().catch(() => { });
-        }
+        // Concurrently, for the reason SessionManager.closeAll gives: each connection now waits
+        // for its sessions' kill ladders, and serialising multiplied that wait by the number of
+        // profiles.
+        await Promise.all([...this.connections.values()].map((conn) => conn.close().catch(() => { })));
         this.connections.clear();
     }
 }

package/build/ssh/connection.js

@@ -6,6 +6,40 @@ import { tracer } from '../observability/tracer.js';
 import { redactText } from '../guard/redactor.js';
 import { shellSingleQuote } from '../guard/sanitizer.js';
 import { openWithRetry } from './channel-retry.js';
+import { terminateChannel, COULD_NOT_SIGNAL } from './channel-signal.js';
+/**
+ * Stop the command behind `channel`, record why on the span, and return the sentence the
+ * rejection should carry.
+ *
+ * Module scope rather than a closure inside `exec`: it captures nothing but the span, and
+ * at module scope it is directly testable with a stub span and a fake channel. It exists
+ * at all because the three settle paths used to inline this, and two of them computed the
+ * "unstopped" value for the message and then dropped it before the span — so
+ * `ssh.unstopped` was structurally incapable of being true for a cancelled command, which
+ * is the most common way an MCP client stops one.
+ */
+export function stopAndDescribe(span, reason, channel) {
+    span.setAttribute(reason, true);
+    // A null channel means the exec callback has not arrived yet. It does NOT mean nothing is
+    // running — ssh2 invokes that callback on CHANNEL_SUCCESS, which OpenSSH sends after
+    // forking the command — but there is nothing to warn about either: `onExecChannel` stops
+    // such a late channel the moment it arrives. Warning here would put "may still be
+    // running" on every timeout that races a slow channel open, and a warning that fires when
+    // nothing is wrong stops being read.
+    //
+    // Recorded as its own attribute rather than as `ssh.unstopped: false`, which would assert
+    // a clean stop this path cannot yet know about. The late-arrival handler emits the real
+    // answer on its own span.
+    if (channel === null) {
+        span.setAttribute('ssh.stopDeferred', true);
+        return '';
+    }
+    const dispatched = terminateChannel(channel);
+    // Set on every settle path, always, so "stopped cleanly" and "ran an older build" are not
+    // the same absent-attribute query.
+    span.setAttribute('ssh.unstopped', !dispatched);
+    return dispatched ? '' : COULD_NOT_SIGNAL;
+}
 export class SSHConnection {
     profile;
     client = null;
@@ -193,25 +227,9 @@ export class SSHConnection {
             const timeoutId = setTimeout(() => {
                 if (!resolved) {
                     resolved = true;
-                    if (activeStream) {
-                        try {
-                            activeStream.signal('INT');
-                        }
-                        catch { /* */ }
-                        setTimeout(() => {
-                            try {
-                                activeStream?.signal('TERM');
-                            }
-                            catch { /* */ }
-                            setTimeout(() => { try {
-                                activeStream?.close();
-                            }
-                            catch { /* */ } }, 1000);
-                        }, 1000);
-                    }
-                    span.setAttribute('ssh.timedOut', true);
+                    const note = stopAndDescribe(span, 'ssh.timedOut', activeStream);
                     span.end();
-                    reject(new Error(`Command timed out after ${timeoutMs}ms`));
+                    reject(new Error(`Command timed out after ${timeoutMs}ms${note}`));
                 }
             }, timeoutMs);
             const execOpts = {};
@@ -240,6 +258,23 @@ export class SSHConnection {
                     }
                     return;
                 }
+                // The promise may already have settled — the timeout can fire while
+                // `openWithRetry` is still in flight, and ssh2 only invokes this callback once
+                // the server has replied CHANNEL_SUCCESS, which OpenSSH sends *after* forking
+                // the command. Without this the command ran to completion on the host after the
+                // caller had been told it timed out, holding a channel and discarding its
+                // output: #146 exactly, in the one path the first fix did not cover.
+                if (resolved) {
+                    // On its own span: the exec span was ended when the promise settled, and an
+                    // attribute set on an ended span is silently dropped. Without this the one
+                    // outcome `stopAndDescribe` deferred would be unobservable — the shape this
+                    // whole change exists to remove.
+                    const late = tracer.startSpan('ssh.exec.lateStop');
+                    late.setAttribute('ssh.host', this.profile.host);
+                    late.setAttribute('ssh.unstopped', !terminateChannel(stream));
+                    late.end();
+                    return;
+                }
                 activeStream = stream;
                 this.activeChannels++;
                 let stdout = '';
@@ -261,42 +296,26 @@ export class SSHConnection {
                     if (opts.abortSignal.aborted) {
                         resolved = true;
                         clearTimeout(timeoutId);
+                        // Decremented here rather than on 'close', because the close listener
+                        // below is never attached on this path. The channel now outlives the
+                        // count by as long as the kill ladder takes.
                         this.activeChannels--;
                         // client.exec() has already dispatched the command, so rejecting
                         // without signalling left it running to completion on the host and
-                        // held a channel until it finished.
-                        try {
-                            stream.signal('INT');
-                        }
-                        catch { /* */ }
-                        try {
-                            stream.close();
-                        }
-                        catch { /* */ }
+                        // held a channel until it finished. Closing the channel does not stop
+                        // it either — only a delivered signal does (#146).
+                        const note = stopAndDescribe(span, 'ssh.aborted', stream);
                         span.end();
-                        reject(new Error('Command aborted before execution'));
+                        reject(new Error(`Command aborted before execution${note}`));
                         return;
                     }
                     const onAbort = () => {
                         if (!resolved) {
                             resolved = true;
                             clearTimeout(timeoutId);
-                            try {
-                                stream.signal('INT');
-                            }
-                            catch { /* */ }
-                            setTimeout(() => {
-                                try {
-                                    stream.signal('TERM');
-                                }
-                                catch { /* */ }
-                                setTimeout(() => { try {
-                                    stream.close();
-                                }
-                                catch { /* */ } }, 1000);
-                            }, 1000);
+                            const note = stopAndDescribe(span, 'ssh.aborted', stream);
                             span.end();
-                            reject(new Error('Command aborted'));
+                            reject(new Error(`Command aborted${note}`));
                         }
                     };
                     opts.abortSignal.addEventListener('abort', onAbort, { once: true });
@@ -359,8 +378,8 @@ export class SSHConnection {
     async closeSession(name) {
         return this.sessions.close(name);
     }
-    reapExpiredSessions() {
-        this.sessions.reapExpired();
+    async reapExpiredSessions() {
+        return this.sessions.reapExpired();
     }
     async close() {
         await this.sessions.closeAll();