Method establishChain

src/utils/ssh-tunnel.ts:90–166

* Establish a chain of SSH connections through jump hosts. * @returns The final SSH client connected to the target host

(
    jumpHosts: JumpHost[],
    targetConfig: SSHTunnelConfig,
    privateKey: Buffer | undefined
  )

   * @returns The final SSH client connected to the target host
   */
  private async establishChain(
    jumpHosts: JumpHost[],
    targetConfig: SSHTunnelConfig,
    privateKey: Buffer | undefined
  ): Promise<Client> {
    let previousStream: Duplex | undefined;

    // Connect through each jump host
    for (let i = 0; i < jumpHosts.length; i++) {
      const jumpHost = jumpHosts[i];
      const nextHost = i + 1 < jumpHosts.length
        ? jumpHosts[i + 1]
        : { host: targetConfig.host, port: targetConfig.port || 22 };

      // Per-hop credentials: use a hop's own resolved key when it has one, falling
      // back to the target's key otherwise. The target password is always offered as
      // a fallback (as before) — a hop may carry only a default-discovered key, so
      // suppressing the password on "has a key" would break password auth.
      const hopPrivateKey = jumpHost.privateKey ? this.loadPrivateKey(jumpHost.privateKey) : privateKey;
      const hopPassword = targetConfig.password;
      const hopPassphrase = jumpHost.passphrase ?? targetConfig.passphrase;

      let client: Client | null = null;
      let forwardStream: Duplex;
      try {
        client = await this.connectToHost(
          {
            host: jumpHost.host,
            port: jumpHost.port,
            username: jumpHost.username || targetConfig.username,
          },
          hopPassword,
          hopPrivateKey,
          hopPassphrase,
          previousStream,
          `jump host ${i + 1}`,
          targetConfig.keepaliveInterval,
          targetConfig.keepaliveCountMax
        );

        // Forward to the next host
        console.error(`  → Forwarding through ${jumpHost.host}:${jumpHost.port} to ${nextHost.host}:${nextHost.port}`);
        forwardStream = await this.forwardTo(client, nextHost.host, nextHost.port);
      } catch (error) {
        if (client) {
          try {
            client.end();
          } catch {
            // Ignore errors during cleanup of partially established client
          }
        }
        throw error;
      }

      this.sshClients.push(client);
      previousStream = forwardStream;
    }