Module signals 

Operating system signal handling for one-shot graceful shutdown.

Shutdown model (Rules Rust — graceful shutdown, CLI one-shot)

ssh-cli is not a long-lived daemon. Shutdown is minimal but cooperative:

1. Detect — SIGINT (Ctrl+C / ctrlc) and SIGTERM (signal-hook on Unix).
2. Signal — set shared AtomicBool flags (Release stores).
3. Await — long loops (exec / SCP / tunnel / VPS) poll should_stop and return; main flushes stdio, shuts down the Tokio runtime, then exits 130 (SIGINT) or 143 (SIGTERM). Broken pipe → 141 (see errors).

What we deliberately do not do

• No CancellationToken / TaskTracker tree (overkill for single-session CLI).
• No SIGHUP hot-reload, SIGUSR ops, readiness probes, or sd_notify.
• No std::process::exit inside signal handlers (async-signal-unsafe).
• SIGPIPE: Rust std ignores the signal so writers get BrokenPipe / exit 141.

Double signal

A second SIGINT/SIGTERM sets is_force_exit. Tunnel aborts outstanding forwards immediately; other paths already return on the first signal.

Interior mutability (Rules Rust)

Primitive	Role	Ordering
static AtomicBool (×3)	cancel / term / force flags	store Release, load Acquire
static AtomicU8	cooperative hit counter	Relaxed (count only; flags publish)
std::sync::Once	register handlers once	n/a

No RefCell, Mutex, OnceLock<Arc<_>>, or Arc wrapper around the flags: process-global atomics are the smallest correct primitive (handlers capture 'static references; readers poll without cloning).

Functions

cancellation_flag

Shared cancellation flag (SIGINT) for tests and advanced integration.

force_exit_flag

Shared force-exit flag (second cooperative signal).

is_cancelled

Returns true if the user pressed Ctrl+C (SIGINT).

is_force_exit

Returns true after a second SIGINT/SIGTERM while shutdown is already in progress.

is_terminated

Returns true if the process received SIGTERM.

register_handler

Registers SIGINT (and Unix SIGTERM) handlers that set cancellation flags.

should_stop

Returns true when any cooperative stop signal was observed (SIGINT or SIGTERM).

signal_exit_code

Preferred process exit code after cooperative signal handling.

sigterm_flag

Shared SIGTERM flag for tests and advanced integration.