fix: sql guard, fk/index queries, pool hardening

test/unit/net/tunnel.test.ts

@@ -162,4 +162,42 @@ describe('openTunnel', () => {
             'auth failed'
         )
     })
+
+    it('close() resolves even with an open forwarded socket', async () => {
+        const tunnel = await openTunnel(sshConfig({ password: 'pw' }), 'db-host', 5432)
+        const socket = await new Promise<net.Socket>((resolve, reject) => {
+            const s = net.connect(tunnel.localPort, tunnel.localHost, () => {
+                s.write('hold')
+                resolve(s)
+            })
+            s.once('error', reject)
+        })
+        const clientClosed = new Promise<void>((resolve) => {
+            if (socket.closed) {
+                resolve()
+                return
+            }
+            socket.once('close', () => resolve())
+        })
+        // Deliberately do NOT end the socket; close() must still resolve.
+        await tunnel.close()
+        // The forwarded socket on the server side is destroyed, which tears
+        // down our client end too.
+        await clientClosed
+        expect(socket.destroyed).toBe(true)
+    })
+
+    it('reports isClosed false for a fresh tunnel', async () => {
+        const tunnel = await openTunnel(sshConfig({ password: 'pw' }), 'db-host', 5432)
+        expect(tunnel.isClosed()).toBe(false)
+        await tunnel.close()
+    })
+
+    it('flips isClosed to true when the ssh client closes', async () => {
+        const tunnel = await openTunnel(sshConfig({ password: 'pw' }), 'db-host', 5432)
+        const client = ssh2State.state.instances[0]
+        client.emit('close')
+        expect(tunnel.isClosed()).toBe(true)
+        await tunnel.close()
+    })
 })