Sign up
View stargazersSign up

fix(ssh): isolate managed tunnel processes#4347

merged1
main
GitHub fork: codex/fix-3533-ssh-tunnel-multiplexing
openedJul 23, 2026byNnateEc
2 files changed
View on GitHubTwo-way sync enabledPR last imported 23d ago

Closes #3533

Summary

  • disable OpenSSH connection multiplexing for T3-managed local-forward processes
  • prevent inherited ControlMaster auto / ControlPersist settings from making the supervised tunnel exit immediately
  • leave ordinary SSH commands and the user's SSH config unchanged

Verification

  • ./node_modules/.bin/vp test run packages/ssh/src/tunnel.test.ts (12 passed)
  • ./node_modules/.bin/vp run --filter @t3tools/ssh typecheck
  • targeted lint and formatting for the changed files

Note

Low Risk Narrow change to tunnel ssh argv plus test assertions; no auth, config file, or non-tunnel SSH behavior changes.

Overview Managed SSH local-forward tunnels now pass explicit -o ControlMaster=no, ControlPath=none, and ControlPersist=no when spawning the supervised ssh -N -L … process in startSshTunnel.

That prevents a user’s global SSH config (e.g. ControlMaster auto / ControlPersist) from attaching the tunnel to an existing multiplexed session, which could make the supervised process exit right away and break T3’s tunnel lifecycle.

Only the tunnel spawn argv changes; other SSH command paths are untouched. A test asserts the first tunnel command includes these three options after ensureEnvironment.

Reviewed by Cursor Bugbot for commit 427ab70f8be8827eeedd1cc0900f644d06ef3e56. Bugbot is set up for automated code reviews on this repo. Configure here.

Note

Disable SSH connection multiplexing for managed tunnel processes

Adds -o ControlMaster=no -o ControlPath=none -o ControlPersist=no to the SSH command in tunnel.ts to prevent managed tunnel processes from sharing or inheriting existing SSH control sockets. This isolates each tunnel process from ambient SSH multiplexing that could interfere with tunnel behavior.

Macroscope summarized 427ab70.

Added 1 commit

  • fix(ssh): isolate managed tunnel processes427ab70
CcoderabbitaiBotJul 23, 2026
Synced from GitHub

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: feee8a58-0ad9-47c5-9d79-f4ec3757efd9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

MmacroscopeappBotJul 23, 2026
Synced from GitHub

Approvability

Verdict: Approved

This PR adds standard SSH options (ControlMaster=no, ControlPath=none, ControlPersist=no) to isolate managed tunnel processes. The change is small, additive, follows existing patterns, and includes test coverage.

You can customize Macroscope's approvability policy. Learn more.