fix(server): SSH device-host tunnels no longer inherit ControlMaster

apps/server/src/device/SshDeviceHost.test.ts

@@ -20,13 +20,16 @@ it.effect("preserves installed status after probes and cleans failed agent activ
     const home = yield* fs.makeTempDirectoryScoped();
     const modes: string[] = [];
     const owners: string[] = [];
+    const tunnelArgs: string[][] = [];
+    const commandArgs: string[][] = [];
     let forwards = 0;
     let failForward = true;
     let rejectConfig = true;
     const spawner = ChildProcessSpawner.make((command) =>
       Effect.gen(function* () {
         if (command._tag !== "StandardCommand") return yield* Effect.die("Unexpected command");
         const forwarding = command.args.includes("-N");
+        (forwarding ? tunnelArgs : commandArgs).push([...command.args]);
         let output = "";
         if (forwarding) {
           if (failForward) {
@@ -132,6 +135,19 @@ it.effect("preserves installed status after probes and cleans failed agent activ
     expect((yield* host.summary).agentDeviceInstalled).toBe(true);
     yield* host.stopAgent;
     expect(forwards).toBe(1);
+    const multiplexingOff = ["ControlMaster=no", "ControlPath=none", "ControlPersist=no"];
+    expect(tunnelArgs.length).toBeGreaterThan(0);
+    for (const args of tunnelArgs) {
+      for (const option of multiplexingOff) {
+        const index = args.indexOf(option);
+        expect(index).toBeGreaterThan(0);
+        expect(args[index - 1]).toBe("-o");
+      }
+    }
+    expect(commandArgs.length).toBeGreaterThan(0);
+    for (const args of commandArgs) {
+      for (const option of multiplexingOff) expect(args).not.toContain(option);
+    }
     yield* host.stop;
     expect(forwards).toBe(0);
   }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),

apps/server/src/device/SshDeviceHost.ts

@@ -242,6 +242,14 @@ export const make = Effect.fn("SshDeviceHost.make")(function* (
             ...identityArgs(config),
             "-o",
             "ExitOnForwardFailure=yes",
+            // A multiplexed client hands its -L forwards to the control master and exits,
+            // so the tunnel must own its own connection.
+            "-o",
+            "ControlMaster=no",
+            "-o",
+            "ControlPath=none",
+            "-o",
+            "ControlPersist=no",
             "-o",
             "ServerAliveInterval=10",
             "-o",