sync: update from private repo (7d64ee2)

src/engine/tools/ssh-console.ts

@@ -246,6 +246,7 @@ async function ensureSessionInternal(
 
   // Open the channel. On failure clear the PEM and bail.
   let channel: import('ssh2').ClientChannel;
+  let client: import('ssh2').Client;
   let hostFingerprint: string;
   try {
     const shellResult = await sub.openShellChannel({
@@ -266,6 +267,7 @@ async function ensureSessionInternal(
       timeoutMs: sub.config.callTimeoutSeconds * 1000,
     });
     channel = shellResult.channel;
+    client = shellResult.client;
     hostFingerprint = shellResult.hostFingerprint;
   } catch (e) {
     clearBuffer(pemBuf);
@@ -292,8 +294,10 @@ async function ensureSessionInternal(
     return err(`SshConsoleEnsure: failed to open shell channel: ${(e as Error).message}`);
   }
 
-  // Build the session and register it. From here on the channel + PEM
-  // belong to the session; we don't clear them on the happy path.
+  // Build the session and register it. From here on the channel + client
+  // + PEM belong to the session; we don't clear them on the happy path.
+  // The session ends the client (and thus releases the PEM-bound
+  // connection) when it closes.
   const session = new ConsoleSession({
     localTaskId,
     connectionId,
@@ -303,6 +307,7 @@ async function ensureSessionInternal(
     rows,
     scrollbackCap: sub.config.console.scrollbackBytes,
     channel,
+    client,
     auditRepo: sub.auditRepo,
   });
   sub.sessionRegistry.register(session);