Function resolveJumpHosts

src/utils/ssh-config-parser.ts:365–415

(
  proxyJump: string,
  configPath: string,
  visited: Set<string> = new Set()
)

 * @param visited Aliases already on the current resolution path (cycle guard)
 */
export function resolveJumpHosts(
  proxyJump: string,
  configPath: string,
  visited: Set<string> = new Set()
): JumpHost[] {
  if (!proxyJump || proxyJump.trim() === '' || proxyJump.toLowerCase() === 'none') {
    return [];
  }

  const resolved: JumpHost[] = [];

  // Iterate the raw tokens (not parseJumpHosts output) so we can tell an explicit
  // `:port` from the normalized default of 22 — needed to let a token port override
  // a config alias's Port.
  for (const token of proxyJump.split(',').map((s) => s.trim()).filter((s) => s.length > 0)) {
    const hop = parseJumpHost(token);

    if (!looksLikeSSHAlias(hop.host)) {
      resolved.push(hop); // literal host — nothing to resolve
      continue;
    }

    if (visited.has(hop.host)) {
      throw new Error(`Cycle detected in SSH ProxyJump chain at alias "${hop.host}"`);
    }

    // Jump-host aliases may omit `User` (inherited from the target), so don't require it.
    const aliasConfig = parseSSHConfig(hop.host, configPath, { requireUser: false });
    if (!aliasConfig) {
      resolved.push(hop); // alias not in config — treat the token literally
      continue;
    }

    // Expand this alias's own jump chain first so it connects before the alias.
    if (aliasConfig.proxyJump) {
      resolved.push(...resolveJumpHosts(aliasConfig.proxyJump, configPath, new Set(visited).add(hop.host)));
    }

    resolved.push({
      host: aliasConfig.host,
      // An explicit `:port` on the token wins; otherwise use the alias's Port (default 22).
      port: tokenHasExplicitPort(token) ? hop.port : aliasConfig.port ?? 22,
      // An explicit `user@` on the token wins; otherwise the alias's User.
      username: hop.username ?? aliasConfig.username,
      privateKey: aliasConfig.privateKey,
      passphrase: aliasConfig.passphrase,
    });
  }

  return resolved;
}

/**
 * Whether a ProxyJump token carries an explicit `:port` (vs. relying on the