fix: multi-connection proxy pam

[sheensantoscapadngan]

Description 📣

This PR ensures that local proxy process is still UP even when a client connection cancels

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

# Here's some code block to paste some code snippets

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-362-fix-multi-connection-proxy-pam

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[greptile-apps]

Greptile Summary

This PR changes PAM proxy disconnect handling so an individual client or gateway stream closing no longer shuts down the local proxy. It separates shutdown signaling from graceful cleanup and adds a three-failure establishment threshold for database, Kubernetes, RDP, Redis, and SSH proxies.

Confidence Score: 4/5

The PR should not merge until independent client connection failures can no longer terminate the entire PAM session and disconnect healthy clients.

The new proxy-wide counter conflates failures from concurrent connection attempts, and reaching three invokes session-wide graceful shutdown even when an existing proxied connection remains healthy.

Files Needing Attention: packages/pam/local/base-proxy.go and the database, Kubernetes, RDP, Redis, and SSH local proxy handlers

Important Files Changed

Filename	Overview
packages/pam/local/base-proxy.go	Separates shutdown signaling from cleanup and introduces a proxy-wide establishment-failure counter whose threshold can terminate a still-usable multi-connection session.
packages/pam/local/database-proxy.go	Keeps the listener alive after individual stream closure but contributes each independently failed connection to the shared session-loss threshold.
packages/pam/local/kubernetes-proxy.go	Adopts common per-connection close handling and shared establishment-failure tracking for kubectl connections.
packages/pam/local/rdp-proxy.go	Preserves reconnect behavior after stream closure while adding relay and gateway failures to the shared shutdown threshold.
packages/pam/local/redis-proxy.go	Stops treating a stream close as session loss but can still terminate the session after three independent establishment failures.
packages/pam/local/ssh-proxy.go	Moves SSH stream closure to per-connection handling and participates in the proxy-wide failure threshold.
packages/pam/local/azure-proxy.go	Uses idempotent shutdown signaling and invokes cleanup when that signal is observed; no changed-code defect was identified.
packages/pam/local/gcp-proxy.go	Routes the shutdown signal through graceful cleanup; its existing cloud-proxy connection behavior is otherwise unchanged.

_{Reviews (1): Last reviewed commit: "fix: multi-connection proxy pam" | Re-trigger Greptile}

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10