Function sandbox_forward

crates/openshell-cli/src/ssh.rs:328–404

Forward a local port to a sandbox via SSH. Background mode keeps the spawned `ssh -N` child alive and records that PID for later management via [`stop_forward`] or [`list_forwards`].

(
    server: &str,
    name: &str,
    spec: &ForwardSpec,
    background: bool,
    tls: &TlsOptions,
)

/// Background mode keeps the spawned `ssh -N` child alive and records that PID
/// for later management via [`stop_forward`] or [`list_forwards`].
pub async fn sandbox_forward(
    server: &str,
    name: &str,
    spec: &ForwardSpec,
    background: bool,
    tls: &TlsOptions,
) -> Result<()> {
    openshell_core::forward::check_port_available(spec)?;

    let session = ssh_session_config(server, name, tls).await?;

    let mut command = TokioCommand::from(ssh_base_command(&session.proxy_command));
    command
        .arg("-N")
        .arg("-o")
        .arg("ExitOnForwardFailure=yes")
        .arg("-L")
        .arg(spec.ssh_forward_arg());

    command.arg("sandbox");

    if background {
        command
            .kill_on_drop(false)
            .stdin(Stdio::null())
            .stdout(Stdio::inherit())
            .stderr(Stdio::inherit());
    } else {
        command
            .stdin(Stdio::inherit())
            .stdout(Stdio::inherit())
            .stderr(Stdio::inherit());
    }

    let port = spec.port;

    if background {
        let mut child = command.spawn().into_diagnostic()?;
        let pid = child.id().ok_or_else(|| {
            miette::miette!("ssh process did not expose a PID for background tracking")
        })?;

        if let Err(err) = wait_for_forward_start(&mut child, spec)
            .await
            .wrap_err("ssh process started but local forward listener was not reachable")
        {
            terminate_owned_forward_child(&mut child);
            return Err(err);
        }

        track_background_forward_or_cleanup(
            name,
            port,
            pid,
            &session.sandbox_id,
            &spec.bind_addr,
            || terminate_owned_forward_child(&mut child),
        )?;