COD-107 fix: shellescape -J jumpHost + structural validator (close command-injection)

buildSshConnectionArgs interpolated jumpHost raw while its siblings
(identityFile/socksProxy/extraSshOptions) were shellescaped. The token array is
joined and run via execAsync (/bin/sh -c), so a jumpHost like "x; touch /tmp/pwned"
executed. The Zod denylist only blocked backtick/newline/$( and let ;|& and spaces
through.

- shellescape jumpHost in buildSshConnectionArgs (primary fix)
- replace jumpHost denylist with a structural allowlist: [user@]host[:port],
  comma-separated multi-hop, bracketed IPv6; no shell metachar can appear
- update/extend tests: escaped -J assertion + injection-safety case

Verified: remote-ssh-options (11) + case-routes (33) pass, tsc --noEmit clean,
regex accepts valid forms / rejects 8 injection payloads.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/web/schemas.ts

@@ -315,13 +315,19 @@ export const RemoteHostSchema = z.object({
     .string()
     .regex(/^[\w.-]+:\d{1,5}$/, 'SOCKS proxy must be host:port')
     .optional(),
-  // SSH jump host ([user@]host[:port]); reject shell metacharacters.
+  // SSH jump host: a comma-separated chain of [user@]host[:port] hops. Structural
+  // ALLOWLIST (not an open denylist) — only chars valid in user/host/port/IPv6,
+  // so no shell metacharacter (;, |, &, space, $, quotes, …) can appear. The value
+  // is also shellescaped at command-build time (buildSshConnectionArgs); this is the
+  // belt to that suspenders.
   jumpHost: z
     .string()
     .min(1)
     .max(255)
-    .regex(NO_SHELL_INJECTION, 'Invalid jump host')
-    .refine(noCommandSubstitution, 'Invalid jump host')
+    .regex(
+      /^(?:[A-Za-z0-9._-]+@)?[A-Za-z0-9.:\[\]-]+(?::\d{1,5})?(?:,(?:[A-Za-z0-9._-]+@)?[A-Za-z0-9.:\[\]-]+(?::\d{1,5})?)*$/,
+      'Jump host must be [user@]host[:port] (comma-separated for multiple hops)'
+    )
     .optional(),
   // Arbitrary extra -o KEY=VALUE options (escape hatch); each must be KEY=VALUE.
   extraSshOptions: z