Hand the Completed CONNECT Socket to ssh2-sftp-client

Preserve the SSH greeting already buffered after proxy headers, then use sock with the destination's normal SSH options.

import SftpClient from 'ssh2-sftp-client';

const client = new SftpClient();
await client.connect({
  ...sshOptions,
  sock: tunnelSocket,
});

Supply the existing destination host, port, account and host-key policy in sshOptions. The socket must already lead through an accepted CONNECT tunnel to that destination, not merely to the proxy listener.

Check the helper before handing over the stream: reject 407 or other failed responses, retain setup deadlines and close rejected sockets. Node's HTTP connect event includes head bytes already read after the headers; preserve a nonempty buffer with the appropriate stream handoff, for example socket.unshift(head). It can contain the SSH greeting.

Pass the socket promptly, then close the completed SFTP workload with await client.end(). An HTTP Agent elsewhere does not create this SSH transport, and the CONNECT account is separate from the SSH account.

Mikanda mikatakata