fix: close unused SSH agent connections

[Luqueee]

Summary

• close SSH agent connections when Signers fails or returns no signers
• retain the connection only for agent-backed authentication methods
• add regression coverage for failure, empty, and successful signer paths

Fixes #16

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• CodeRabbit: 0 findings

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: c21206bb-c00b-49e9-8d21-ff81bfca7b35

📥 Commits

Reviewing files that changed from the base of the PR and between 1afe1ff and 3c8aa41.

📒 Files selected for processing (2)

• internal/tunnel/auth_test.go
• internal/tunnel/tunnel.go

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes

  • Improved SSH agent connection handling when signer retrieval fails or no signers are available.
  • Preserved SSH agent connections while valid signers are in use.
  • Ensured retained SSH agent connections are closed during client and ProxyJump cleanup, including setup failures.

• Tests

  • Added coverage for SSH agent cleanup and retention across failure, empty-signer, successful-signer, and manager shutdown scenarios.

Walkthrough

The tunnel authentication code now tracks SSH agent connection ownership. It closes unused and failed connections, retains connections needed for authentication, and cleans them up during manager and ProxyJump shutdown. Tests cover signer failures, empty signer results, successful retention, and manager cleanup.

Changes

SSH agent connection ownership

Layer / File(s)	Summary
Agent authentication ownership internal/tunnel/tunnel.go	buildSSHConfig and authMethods close agent connections after signer errors or empty results. Successful signer discovery returns the connection for retention.
Manager connection lifecycle internal/tunnel/tunnel.go	Manager retains the agent connection, closes it when initial SSH setup fails, and closes it with the SSH client in Manager.Close.
ProxyJump agent cleanup internal/tunnel/tunnel.go	ProxyJump setup tracks agent connections for each hop and closes them on setup failures and transport shutdown.
Agent lifecycle test coverage internal/tunnel/auth_test.go	Tests verify closure after signer failure and empty results, retention for a valid signer, and cleanup through Manager.Close.

Merge Risk: ⚪ Minimal · up to 3c8aa

SSH agent connections are retained only while needed for authentication and are closed on failure and shutdown paths. No merge-blocking risk is currently identified.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the required Conventional Commit format with the fix: prefix and accurately describes closing unused SSH agent connections.
Description check	✅ Passed	The description directly covers SSH agent connection cleanup, retention behavior, regression tests, and validation commands.
Linked Issues check	✅ Passed	The changes satisfy issue #16 by closing agent connections after Signers failures or empty results, retaining connections for valid agent-backed authentication, adding the required regression tests, a…
Out of Scope Changes check	✅ Passed	The changes to Manager and ProxyJump cleanup support the linked issue by managing retained SSH agent connections and closing them during failures and shutdown. No unrelated changes are identified.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-ssh-agent-leaks

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: c87705ba-1e51-4165-a589-6135f35b323c

📥 Commits

Reviewing files that changed from the base of the PR and between b671d27 and 1afe1ff.

📒 Files selected for processing (2)

• internal/tunnel/auth_test.go
• internal/tunnel/tunnel.go

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.