From 427ab70f8be8827eeedd1cc0900f644d06ef3e56 Mon Sep 17 00:00:00 2001 From: Nathan Shan Date: Thu, 23 Jul 2026 16:48:16 +0800 Subject: [PATCH] fix(ssh): isolate managed tunnel processes - Disable OpenSSH connection multiplexing for T3-managed port forwards. - Prevent inherited ControlMaster settings from making supervised tunnels exit early. - Cover the tunnel command options in the lifecycle test. --- packages/ssh/src/tunnel.test.ts | 5 +++++ packages/ssh/src/tunnel.ts | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/packages/ssh/src/tunnel.test.ts b/packages/ssh/src/tunnel.test.ts index 7e7a5a54276..4c2ecb33183 100644 --- a/packages/ssh/src/tunnel.test.ts +++ b/packages/ssh/src/tunnel.test.ts @@ -381,6 +381,11 @@ describe("ssh tunnel scripts", () => { const first = yield* manager.ensureEnvironment(target); assert.equal(first.httpBaseUrl, "http://127.0.0.1:41773/"); + const firstTunnelArgs = spawnedCommands.find((args) => args.includes("-N")); + assert.isDefined(firstTunnelArgs); + assert.include(firstTunnelArgs, "ControlMaster=no"); + assert.include(firstTunnelArgs, "ControlPath=none"); + assert.include(firstTunnelArgs, "ControlPersist=no"); yield* manager.disconnectEnvironment(target); assert.equal(tunnelKillCount, 1); diff --git a/packages/ssh/src/tunnel.ts b/packages/ssh/src/tunnel.ts index 016d5e9a854..179d1fcb547 100644 --- a/packages/ssh/src/tunnel.ts +++ b/packages/ssh/src/tunnel.ts @@ -963,6 +963,12 @@ const startSshTunnel = Effect.fn("ssh/tunnel.startSshTunnel")(function* (input: "-o", "ExitOnForwardFailure=yes", "-o", + "ControlMaster=no", + "-o", + "ControlPath=none", + "-o", + "ControlPersist=no", + "-o", "ServerAliveInterval=15", "-o", "ServerAliveCountMax=3",