chore: merge train 260821 — land #2294 (release SSH credential boundary)

[lidge-jun]

Summary

Second leg of the merge train: lands #2294 — fix(release): reject credential-bearing SSH remotes plus an adversarial-review hardening commit.

Review chain:

• grok-4.6 adversarial security review (Euler) on live head 71598fa: GO-WITH-FIXES (blockers=1) — scp-like host class allowed a second @ (git@SECRET@host:path accepted, printed to both log sinks)
• Hardening commit 2cdfba2: host class excludes @, raw ssh:// userinfo with : rejected before URL parse (WHATWG empty-password collapse), regression rows for both shapes
• Same reviewer re-verdict on 2cdfba2: PASS; residuals (scp-like IPv6 depth, U+2028 log-split) accepted and recorded in devlog/_plan/260821_bug_merge_train/030_merge_2294.md
• Non-author security approval recorded by merging maintainer per repo policy (author Ingwannu, merger lidge-jun)

Also includes the already-reviewed #2295 leg context via train history (landed by #2315).

Verification

• bun test tests/release-helper.test.ts — 24/24 pass at hardened head
• bun run typecheck / privacy:scan — pass
• Full suite on lidge at 2cdfba2: 14211 pass / 16 skip / 0 fail across 893 files, exit 0

Checklist

• Local CI green (full suite executed remotely on lidge at exact head)
• Branch includes the latest dev commit (train tracks origin/dev; chore: merge train 260821 — land #2295 (zero-byte coordinator recovery) #2315 landed here)
• No open Codex/CodeRabbit findings against this head
• Ready for review

Summary by CodeRabbit

• Bug Fixes

  • Strengthened validation for protected-branch SSH release targets.
  • Rejects malformed, credential-bearing, or ambiguous SSH targets before release operations begin.
  • Prevents sensitive information from appearing in logged commands or error output.
  • Clarified validation messages to explain the accepted credential-free SSH formats.

• Security

  • Added coverage for shell-sensitive deploy-key paths and SSH target parsing to improve release safety.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f0ac7c53-a9d3-434a-84c2-c68542a2b360

📥 Commits

Reviewing files that changed from the base of the PR and between ffa6d46 and f52de33.

📒 Files selected for processing (4)

• devlog/_plan/260821_bug_merge_train/000_triage_matrix.md
• devlog/_plan/260821_bug_merge_train/030_merge_2294.md
• scripts/release.ts
• tests/release-helper.test.ts

---

📝 Walkthrough

Walkthrough

Changes

The release push now accepts only credential-free SSH targets. URL parsing rejects credential-shaped userinfo, invalid characters, queries, hashes, and malformed hosts. Tests model SSH argument handling, preserve deploy-key paths literally, and cover rejected credential cases. Merge-train records document validation and resolution status.

SSH release target hardening

Layer / File(s)	Summary
Strict SSH remote validation scripts/release.ts:172-215, scripts/release.ts:229	isSshRemote now validates ssh:// and git@host:owner/repo targets with strict credential, hostname, path, query, hash, and character rules. The invalid-target message now states the credential-free contract.
SSH invocation and regression coverage tests/release-helper.test.ts:40-43, tests/release-helper.test.ts:271-315, tests/release-helper.test.ts:443-461, tests/release-helper.test.ts:507-546	Tests record parsed SSH arguments, verify hostile deploy-key paths remain single literal -i arguments, reject credential-bearing targets without secret exposure or pushes, and accept credential-free targets.
Merge-train validation records devlog/_plan/260821_bug_merge_train/000_triage_matrix.md:11, devlog/_plan/260821_bug_merge_train/030_merge_2294.md:5-43	The planning records document security review targets, validation gates, the resolved blocker, the passing re-verdict, and the merged-to-train status.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: ingwannu

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/merge-train-260821

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}