deploy: host validator under-counts adjacent colons — unbracketed IPv6-ish hosts like '::1:22' pass validation

[bpamiri]

Summary

Validator.$validateHost counts colons with arrayLen(listToArray(arguments.host, ":", false, true)) - 1 (cli/lucli/services/deploy/config/Validator.cfc:72). includeEmptyFields=false collapses adjacent/leading delimiters, so ::1:22 tokenizes to ['1','22'] → colonCount 1 → accepted, even though the source comment and config-reference.mdx both promise "multiple colons without brackets are rejected" (and document ::1:22 as the canonical reject case).

Repro (wheels 4.0.3 and develop)

servers: ["h:1:2"]    → DeployConfigError: invalid host: 'h:1:2'   ✓
servers: ["::1:22"]   → accepted, wheels deploy config succeeds    ✗ (3 colons, unbracketed)

Impact

The ambiguous host string flows into SshPool host parsing and remote command dispatch with whatever interpretation the splitter picks — exactly the ambiguity the check exists to reject. Validation-bypass shape adjacent to the #2956 name-validation work but a distinct root cause.

Proposed direction

Count colons directly (e.g. len(host) - len(replace(host, ":", "", "all"))) or pass includeEmptyFields=true. Extend ValidatorSpec with ::1:22, :a:b, a::b cases.

Acceptance

• Unbracketed multi-colon hosts are rejected with the documented invalid-host error; bracketed [::1]:22 still accepted; spec cases above pass.

Reported by the guide-behavioral-audit P1 batch 2 (work item p1-16-deploy, claim cfg-03; wheels CLI 4.0.3 + develop source).

[wheels-bot]

Wheels Bot — Triage

Classified as bug.

The report describes observable wrong behavior with a clear "what happened / what I expected": servers: ["::1:22"] is accepted even though the source comment and config-reference.mdx both promise "multiple colons without brackets are rejected" (with ::1:22 named as the canonical reject case). Reproduction is concrete and the root cause is pinpointed.

Suspected layer

cli — see .ai/wheels/cli/ for canonical patterns. Concretely the defect is in cli/lucli/services/deploy/config/Validator.cfc:72 ($validateHost).

Fix sketch

$validateHost counts colons via arrayLen(listToArray(arguments.host, ":", false, true)) - 1. With includeEmptyFields=false, adjacent/leading delimiters collapse, so ::1:22 tokenizes to two tokens, giving colonCount 1, which passes the colonCount > 1 gate. Count colons directly instead — e.g. len(host) - len(replace(host, ":", "", "all")) — or pass includeEmptyFields=true to listToArray. Single-line change in one file. Propose-fix should also extend ValidatorSpec with ::1:22, :a:b, a::b reject cases and confirm bracketed [::1]:22 still passes.

Confidence: medium

The fix shape is mechanical and unambiguous, but auto-downgraded from high: the change is in the deploy subsystem and is a validation-bypass shape feeding remote host/command dispatch, so it warrants the propose-fix sensitive-area safety net.

<!-- wheels-bot:triage:3086 -->
<!-- wheels-bot:triage-class:bug -->
<!-- wheels-bot:triage-confidence:medium -->

[wheels-bot]

Wheels Bot — Fix on hold for human review

The proposed fix touches a sensitive area (cli/lucli/services/deploy/**) and the bot's safety net requires a human in the loop before any code is written.