Module tunnel 

SSH tunnelling with a mandatory deadline (bounded one-shot).

Four modes share this entry point, split across submodules because they share a lifecycle but not a data path:

Mode	Who listens	Submodule
local forward	this process	local
SOCKS5 proxy	this process	local + socks
remote Unix socket	this process	local + streamlocal
reverse forward	the SSH server	reverse

What lives here is everything the modes genuinely share: the deadline wrapper, the counters it reads after cancellation, the exposure guards, and the two helpers (pump, drain_forwards) that every mode ends up calling.

Structs

ServeContext

Everything an already-connected client needs to serve one tunnel, minus the mode-specific destination.

TunnelAuth

SSH credential overrides for one tunnel invocation.

TunnelRequest

Everything one tunnel invocation needs.

TunnelStats

Counters shared between the accept loop and the deadline wrapper.

Enums

ForwardKind

What an accepted local connection is forwarded to.

TunnelMode

Which tunnel the caller asked for.

Functions

guard_network_exposure

Rejects a non-loopback bind unless the caller explicitly accepted the risk.

guard_remote_exposure

Rejects a reverse forward that would publish a remote listener.

resolve_tunnel_connection

Builds the connection config for a tunnel from an already-loaded registry record.

run_tunnel

Runs the tunnel subcommand with a mandatory timeout.

run_tunnel_with_client

Testable local-forward loop (see run_tunnel_with_client_stats for counters).

run_tunnel_with_client_stats

Testable local-forward loop that publishes lifetime counters into ServeContext::stats.

validate_remote_socket

Rejects a remote socket path that cannot be valid on any POSIX host.