Harden SSH and profile resolution boundaries

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b

src/glas_harness/transport.py

@@ -25,7 +25,9 @@ class TransportError(RuntimeError):
     """The sandbox reachability descriptor cannot safely execute commands."""
 
 
-_SSH_TARGET = re.compile(r"^(?:[A-Za-z0-9._-]+@)?[A-Za-z0-9._-]+$")
+_SSH_TARGET = re.compile(
+    r"^(?:[A-Za-z0-9][A-Za-z0-9._-]*@)?[A-Za-z0-9][A-Za-z0-9._-]*$"
+)
 
 
 @dataclass(frozen=True)
@@ -63,9 +65,11 @@ class ExecutionTransport:
                 *scoped_command,
             ]
         if self.kind == "ssh":
-            if not self.ssh_target:
-                raise TransportError("SSH transport is missing target")
-            return ["ssh", self.ssh_target, shlex.join(scoped_command)]
+            if not self.ssh_target or not _SSH_TARGET.fullmatch(self.ssh_target):
+                raise TransportError(
+                    "SSH target must be a single non-option host or user@host target"
+                )
+            return ["ssh", "--", self.ssh_target, shlex.join(scoped_command)]
         raise TransportError(f"unsupported execution transport: {self.kind}")
 
     def run(
@@ -175,7 +179,9 @@ def transport_from_sandbox(sandbox: SandboxHandle) -> ExecutionTransport:
                 "incomplete remote sandbox reachability: ssh and remote_dir are required"
             )
         if not _SSH_TARGET.fullmatch(str(ssh_target)):
-            raise TransportError("SSH reachability must be a single host or user@host target")
+            raise TransportError(
+                "SSH reachability must be a single non-option host or user@host target"
+            )
         if not PurePosixPath(str(remote_dir)).is_absolute():
             raise TransportError("remote sandbox workspace must be an absolute path")
         return ExecutionTransport(