feat: convert ssh tunnels into a plugin

packages/plugin-sdk/src/backend.ts

@@ -661,6 +661,12 @@ export interface PluginSshConnectOptions {
   prompt?: PluginSshPromptChannel;
   /** Config fields to force, e.g. a longer readyTimeout. */
   overrides?: Record<string, unknown>;
+  /**
+   * An already-open stream to the host, such as a forwardOut channel through
+   * another host. The transport step is skipped: no port knocking, proxy,
+   * jump hosts or DNS lookup. Host key checks and auth still run.
+   */
+  sock?: unknown;
 }
 
 export interface PluginSshConnection<Client = unknown> {

packages/plugin-sdk/src/testing.ts

@@ -22,6 +22,7 @@ import type {
   PluginLoginMethod,
   PluginSecondFactor,
   PluginSshAuthProvider,
+  PluginSshConnectOptions,
   PluginSshHost,
   PluginHostSummary,
   PluginHostRecord,
@@ -94,7 +95,11 @@ export interface FakePluginContext {
   /** Core settings readable through ctx.settings.readCore. */
   coreSettings: Map<string, string>;
   /** Every ctx.ssh.connect and withConnection call, in order. */
-  sshConnections: Array<{ host: number | PluginSshHost; pool?: string }>;
+  sshConnections: Array<{
+    host: number | PluginSshHost;
+    pool?: string;
+    options?: PluginSshConnectOptions;
+  }>;
   /** Every ctx.hosts.share call, in order. */
   hostShares: Array<{
     hostId: number;
@@ -467,8 +472,8 @@ export function createFakeContext(
     },
 
     ssh: {
-      connect: async (host) => {
-        sshConnections.push({ host });
+      connect: async (host, connectOptions) => {
+        sshConnections.push({ host, options: connectOptions });
         return {
           client: sshClient as never,
           jumpClient: null,