Yes it is protected we overlooked that. 

I like your idea to return RemoteSession, but one more problem is the call to initSession in JscConnection.exec. Thus I suggest:
- to rename initSession into getSession
- make it public
- make it return RemoteSession 
- pass to getConnection the SshTransport

This way a remote connection can call getSession and getSession can (as initSession does now) correctly call the SessionFactory. 

Instead of passing SshTransport we could also just pass an Interface SessionStorage which has just the getSession method and is implemented by SshTransport.

Should we upload a new patch with this suggested getSession method (and your other comments addressed)?