bug(sdk/ts): forward().close() never revokes SSH session tokens of open connections
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 62/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- typescript
- Domain
- api
Research direction
Start in sdk/typescript/src/client.ts with forward, teardown, and forwardConnection, and follow how the per-connection AbortController signal reaches the finally block that calls revokeSshSession. Check the Go file client's revoke call for the intended independent context. Reproduce by opening a connection, closing the handle, and confirming no RevokeSshSession request is sent. Done when each minted token gets a revoke request with its own timeout, even after the connection signal is aborted.
Written by the indexing model from the issue text.
Description
User Story
I use OpenShell and build automation against its SDKs. I found this while reviewing sdk/ on main; it is identified from the code paths cited below and has not yet been reproduced against a live gateway.
Problem Statement
On close() (or caller abort), teardown aborts each connection's AbortController. forwardConnection's finally then calls revokeSshSession({ token, allowMissing: true }, { signal }) with that same, already-aborted signal, so the revoke RPC is never sent. The Go file client revokes with a fresh background context.
Impact / Why This Matters
Every SSH session token minted for connections still open at close() stays valid until it expires instead of being revoked, contrary to the method's documented revoke-on-close behavior.
Acceptance Criteria
- Closing a forward handle with open connections issues
RevokeSshSessionfor each minted token (bounded by its own timeout, independent of the aborted connection signal).
Reproduction Steps
const h = await client.sandbox.forward(name, { targetPort }).- Open a local connection so a session token is minted.
await h.close().- Observe no
RevokeSshSessionRPC reaches the gateway for that token (the call rejects immediately on the aborted signal).
Suggested UX (if applicable)
No response
Environment
- OpenShell:
main@ 82977e2 (2026-10-13) - SDK: TypeScript (
sdk/typescript/src/client.ts,forward/forwardConnection) - Toolchain: Go 1.25.4 linux/amd64, Node 22
Logs
- Dominant language
- Rust
- Stars
- 15.4k
- Forks
- 1.7k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 374
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from NVIDIA/OpenShell
-
state:triage-needed
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
bug(sdk/go): edge (Cloudflare Access) token is cached for the client lifetime and never reloadedOpenstate:triage-needed
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
state:triage-needed
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
state:triage-needed
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
state:triage-needed
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
All issues in NVIDIA/OpenShell
Similar issues
-
docs(skills): issue-first should reference an existing Linear ticket instead of filing a duplicateOpendocumentation
Difficulty 1/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
area: tui good first issue help wanted type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
srothgan/claude-code-rust#473 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
storytold/photocraft#5260 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100