fix(projects): harden host and remote identity

packages/server/src/server/project-group-key.test.ts

@@ -57,6 +57,19 @@ describe("deriveProjectGroupKey", () => {
     ).toBe("remote:github.com/getpaseo/paseo");
   });
 
+  test("accepts an SCP-style remote with a bracketed IPv6 host", () => {
+    const rootPath = path.resolve("repo");
+
+    expect(
+      deriveProjectGroupKey({
+        rootPath,
+        remoteUrl: "git@[2001:db8::1]:getpaseo/paseo.git",
+        worktreeRoot: rootPath,
+        mainRepoRoot: null,
+      }),
+    ).toBe("remote:[2001:db8::1]/getpaseo/paseo");
+  });
+
   test("includes the selected path within a repository", () => {
     const worktreeRoot = path.resolve("repo");
     const rootPath = path.join(worktreeRoot, "packages", "app");

packages/server/src/server/project-group-key.ts

@@ -39,7 +39,7 @@ function deriveRemoteProjectGroupKey(remoteUrl: string | null): string | null {
   let remotePath: string | null = null;
   const scpLike =
     !trimmed.includes("://") && !/^[A-Za-z]:[\\/]/.test(trimmed)
-      ? trimmed.match(/^(?:[^@/:]+@)?([^/:]+):(.+)$/)
+      ? trimmed.match(/^(?:[^@/:]+@)?(\[[^\]]+\]|[^/:]+):(.+)$/)
       : null;
   if (scpLike) {
     host = scpLike[1] ?? null;

packages/server/src/utils/path.test.ts

@@ -48,6 +48,10 @@ describe("path equivalence", () => {
     );
   });
 
+  test("accepts contained path segments beginning with two dots", () => {
+    expect(getRealpathAwareRelativePath("/repo", "/repo/..tools")).toBe("..tools");
+  });
+
   test.skipIf(process.platform === "win32")(
     "derives the contained suffix from a realpath-equivalent root",
     () => {

packages/server/src/utils/path.ts

@@ -96,7 +96,9 @@ function getRelativePathInsideRoot(root: string, candidate: string): string | nu
 
   if (
     comparisonRelative !== "" &&
-    (comparisonRelative.startsWith("..") || platformPath.isAbsolute(comparisonRelative))
+    (comparisonRelative === ".." ||
+      comparisonRelative.startsWith(`..${platformPath.sep}`) ||
+      platformPath.isAbsolute(comparisonRelative))
   ) {
     return null;
   }