fix: prevent SSH destinations from being parsed as options

packages/ssh/src/command.test.ts

@@ -8,7 +8,7 @@ import * as Result from "effect/Result";
 import * as Sink from "effect/Sink";
 import * as Stream from "effect/Stream";
 import * as TestClock from "effect/testing/TestClock";
-import { ChildProcessSpawner } from "effect/unstable/process";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 
 import {
   baseSshArgs,
@@ -99,6 +99,42 @@ describe("ssh command", () => {
     }),
   );
 
+  it.effect("terminates SSH options before a user-controlled destination", () => {
+    let spawnedCommand: ChildProcess.Command | null = null;
+    const spawner = ChildProcessSpawner.make((command) => {
+      spawnedCommand = command;
+      return Effect.succeed(makeFailedProcess({ stdout: "", stderr: "Host lookup failed.\n" }));
+    });
+    const processLayer = Layer.mergeAll(
+      NodeServices.layer,
+      Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, spawner),
+    );
+
+    return Effect.gen(function* () {
+      yield* runSshCommand(
+        {
+          alias: "-oProxyCommand=malicious-command",
+          hostname: "-oProxyCommand=malicious-command",
+          username: null,
+          port: null,
+        },
+        { remoteCommandArgs: ["sh", "-s"] },
+      ).pipe(Effect.flip);
+
+      assert.isNotNull(spawnedCommand);
+      if (spawnedCommand !== null && ChildProcess.isStandardCommand(spawnedCommand)) {
+        const separatorIndex = spawnedCommand.args.indexOf("--");
+        assert.isAtLeast(separatorIndex, 0);
+        assert.deepEqual(spawnedCommand.args.slice(separatorIndex), [
+          "--",
+          "-oProxyCommand=malicious-command",
+          "sh",
+          "-s",
+        ]);
+      }
+    }).pipe(Effect.provide(processLayer));
+  });
+
   it.effect("resolves the remote t3 package spec from the desktop release channel", () =>
     Effect.sync(() => {
       assert.equal(

packages/ssh/src/command.ts

@@ -200,6 +200,7 @@ const runSshCommandInScope = Effect.fn("ssh/command.runSshCommand.inScope")(func
       batchMode: input.batchMode ?? (input.interactiveAuth ? "no" : "yes"),
     }),
     ...(input.preHostArgs ?? []),
+    "--",
     hostSpec,
     ...(input.remoteCommandArgs ?? []),
   ];

packages/ssh/src/tunnel.test.ts

@@ -351,7 +351,11 @@ describe("ssh tunnel scripts", () => {
             tunnelKillCount += 1;
           });
         }
-        if (args.includes("sh") && args.includes("--")) {
+        if (
+          args.some(
+            (arg, index) => arg === "sh" && args[index + 1] === "-s" && args[index + 2] === "--",
+          )
+        ) {
           return makeSuccessfulProcess('{"remotePort":3773}\n');
         }
         if (args.includes("sh")) {
@@ -388,7 +392,11 @@ describe("ssh tunnel scripts", () => {
 
       yield* manager.ensureEnvironment(target);
 
-      assert.equal(spawnedCommands.filter((args) => args.includes("-N")).length, 2);
+      const tunnelCommands = spawnedCommands.filter((args) => args.includes("-N"));
+      assert.equal(tunnelCommands.length, 2);
+      for (const args of tunnelCommands) {
+        assert.deepEqual(args.slice(-2), ["--", "julius@devbox"]);
+      }
       assert.equal(tunnelKillCount, 1);
     }).pipe(Effect.provide(layer), Effect.scoped);
   });

packages/ssh/src/tunnel.ts

@@ -970,6 +970,7 @@ const startSshTunnel = Effect.fn("ssh/tunnel.startSshTunnel")(function* (input:
     "-N",
     "-L",
     `${input.localPort}:127.0.0.1:${input.remotePort}`,
+    "--",
     hostSpec,
   ];
   const sshCommand = yield* resolveSshCommand;