Port to TypeScript with strict compiler and type-aware ESLint - #14

Merged as 6f182b4.

What landed

The self-contained server.mjs is gone; src/ holds seven typed modules compiled to dist/:

The suite is split along the same boundaries — four files plus test-helpers.ts — and went from 148 to 153 tests, still at 100% of statements, branches, functions and lines as a build gate.

What strictness actually caught

Worth recording honestly, because it is the answer to "was the port worth it":

The linter nearly introduced a bug. prefer-nullish-coalescing wanted process.env.ProgramData || default rewritten to ??. Issue #10 reports that variable as empty, not undefined — ?? would have silently undone the Windows fix merged in #11 two hours earlier. Same trap for args.timeout || DEFAULT, where 0 must fall back. Both are now exempted with the reason written next to the rule, and the calibration is documented in the README so the next person does not "fix" it back.

strict found one piece of dead code. Under noUncheckedIndexedAccess, aliases[0] is string | undefined, which made the guard immediately above it visibly redundant. Cleaned up rather than worked around, as were a few defensive fallbacks (split(...)[0] ?? '') that can never trigger and would only have produced uncoverable branches.

An external review (codex) found a real regression I had missed. The port turned options.timeout || 30000 into ?? 30000 in SSHClient.runRemoteCommand, so a caller passing { timeout: 0 } would get an immediate SIGTERM instead of the default. Not reachable through the MCP tools — the dispatcher always sends an explicit timeout — but SSHClient is exported and a refactor should not change its behaviour. Fixed in 74a0531 with a fake-timer regression test. Notably this is the same trap I had recognised in tools.ts and calibrated the lint rule for, and still missed one call site of. I then audited every remaining ?? against the original: the others are provably equivalent (a Set is never falsy, 0 ?? 0 equals 0 || 0, and _password cannot be empty because the annotation regex requires (.+)).

Delivery chain

This is where a build step is genuinely risky — 1.3.6 and 1.3.8 were both entry-point/packaging regressions — so it was measured rather than assumed. Verified end to end: bin/ directly, npm start, start-silent.sh, an install from the packed tarball, and the DXT build all start the compiled server and answer initialize/tools/list over STDIO. It turned out to have exactly one redirection point, because manifest.json and the start scripts already pointed at bin/mcp-ssh.js.

Both workflows now run typecheck, lint, the suite and a smoke test of the compiled server — the test matrix across Linux and Windows on Node 20/22/24, and the publish workflow before anything reaches npm.

Cleanups that fell out

• Dropped ts-node and @types/ssh2: the repo had no .ts files and never used ssh2
• uploadFile/downloadFile share one _scp() body; they differed only in argument order

Not in scope, flagged for later: the SDK marks the low-level Server class as deprecated in favour of McpServer. Migrating changes the registration API, so it is suppressed with a comment rather than done here.