Phase 17: SCP over SFTP subsystem + EOF/CLOSE fixes

markbase-core/src/ssh_server/server.rs

@@ -655,6 +655,22 @@ fn handle_ssh_service_loop(
                 // Phase 17: EOF means client won't send more data → close child stdin
                 // (Essential for SCP upload where scp -t waits for EOF on stdin)
                 channel_manager.close_child_stdin();
+                // ⭐⭐⭐⭐⭐ Phase 17: Send SSH_MSG_CHANNEL_CLOSE in response to EOF
+                // ONLY for subsystem channels (no exec_process) — RFC 4254 §5.3
+                // For exec channels, wait for child exit → exit-status + EOF + CLOSE
+                let has_exec = packet.payload.len() >= 5 && {
+                    let channel_id =
+                        u32::from_be_bytes([packet.payload[1], packet.payload[2], packet.payload[3], packet.payload[4]]);
+                    channel_manager.channel_has_exec_process(channel_id)
+                };
+                if !has_exec && packet.payload.len() >= 5 {
+                    let channel_id =
+                        u32::from_be_bytes([packet.payload[1], packet.payload[2], packet.payload[3], packet.payload[4]]);
+                    let close_packet = channel_manager.build_channel_close(channel_id)?;
+                    let encrypted_response =
+                        EncryptedPacket::new(&close_packet.payload, encryption_ctx, true)?;
+                    encrypted_response.write(stream)?;
+                }
             }
             Some(&pt) if pt == PacketType::SSH_MSG_DISCONNECT as u8 => {
                 info!("Received SSH_MSG_DISCONNECT");