feat: quote SSH config values so special characters save reliably

The SSH config writer now wraps single-token directive values (HostName,
User, IdentityFile, ProxyJump, CertificateFile) in double quotes when they
contain whitespace or a quote, escaping embedded backslash and quote. The
parser unwraps and unescapes symmetrically, so values with spaces, a "#" or
quotes round-trip exactly instead of being split or truncated on the next
read. Multi-argument directives such as LocalForward stay unquoted.

Every cloud provider now exposes an injectable HTTP base so the production
fetch path (URL construction, auth header, error mapping, pagination and
host mapping) runs end to end against a mock, for all 16 providers including
the signed (AWS, Oracle, OVH) and multi-host (Azure) paths. The Azure
nextLink follow is anchored to the API host so the bearer token cannot leak
to a look-alike host.

Bump to 3.18.5 and add the changelog entry.

Author: erickochen

CHANGELOG.md

@@ -1,3 +1,9 @@
+## 3.18.5 - 2026-05-27
+
+- feat: Special characters in your SSH config save reliably.
+- feat: Paths, hostnames and proxy jumps that contain spaces, "#" or quotes are written and read back exactly, whether you edit them yourself or provider sync writes them.
+- change: Provider sync is now verified end to end for every supported cloud, so a broken request, header or page cursor is caught before it ever reaches your host list.
+
 ## 3.18.4 - 2026-05-27
 
 - change: Safer foundations under every sync, sign and connect.

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "purple-ssh"
-version = "3.18.4"
+version = "3.18.5"
 edition = "2024"
 description = "Open-source terminal SSH manager that keeps ~/.ssh/config in sync with your cloud infra. Spin up a VM on AWS, GCP, Azure, Hetzner or 12 other cloud providers and it appears in your host list. Destroy it and the entry dims. Search hundreds of hosts, transfer files, manage Docker and Podman over SSH, sign Vault SSH certs. Rust TUI, MIT licensed."
 license = "MIT"

Cargo.toml

@@ -0,0 +1,17 @@
+Host space-in-path
+  HostName 10.0.0.1
+  IdentityFile "~/my key/id_ed25519"
+  CertificateFile "~/.purple/certs/space host-cert.pub"
+
+Host hash-in-value
+  HostName 10.0.0.2
+  IdentityFile "~/id #note"
+
+Host internal-quotes
+  HostName 10.0.0.3
+  ProxyCommand ssh -W "%h:%p" gateway
+
+Host mixed
+  HostName "a b"
+  User "deploy user"
+  ProxyJump "jump host"

fuzz/Cargo.lock

@@ -312,9 +312,18 @@ fn ec2_get(
     agent: &ureq::Agent,
     creds: &AwsCredentials,
     region: &str,
+    endpoint: &str,
     params: Vec<(String, String)>,
 ) -> Result<String, ProviderError> {
-    let host = format!("ec2.{}.amazonaws.com", region);
+    // Host used for SigV4 signing and the request URL. Derived from the
+    // injected endpoint so tests can point the signed request at a mock; the
+    // authority is everything after the scheme (e.g. "ec2.us-east-1.amazonaws.com"
+    // or "127.0.0.1:1234").
+    let host = endpoint
+        .split_once("://")
+        .map(|(_, authority)| authority)
+        .unwrap_or(endpoint)
+        .to_string();
     let epoch = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
         .unwrap_or_default()
@@ -334,7 +343,7 @@ fn ec2_get(
         .join("&");
 
     let auth = sign_request(creds, region, &host, &query_string, &timestamp, &datestamp);
-    let url = format!("https://{}/?{}", host, query_string);
+    let url = format!("{}/?{}", endpoint, query_string);
 
     let mut resp = agent
         .get(&url)
@@ -353,6 +362,7 @@ fn describe_instances(
     agent: &ureq::Agent,
     creds: &AwsCredentials,
     region: &str,
+    endpoint: &str,
     cancel: &AtomicBool,
 ) -> Result<Vec<Ec2Instance>, ProviderError> {
     let mut all = Vec::new();
@@ -376,7 +386,7 @@ fn describe_instances(
             params.push(param("NextToken", token));
         }
 
-        let body = ec2_get(agent, creds, region, params)?;
+        let body = ec2_get(agent, creds, region, endpoint, params)?;
         let resp: DescribeInstancesResponse = quick_xml::de::from_str(&body)
             .map_err(|e| ProviderError::Parse(format!("{}: {}", region, e)))?;
 
@@ -408,6 +418,7 @@ fn fetch_image_names(
     agent: &ureq::Agent,
     creds: &AwsCredentials,
     region: &str,
+    endpoint: &str,
     image_ids: &[String],
 ) -> Result<HashMap<String, String>, ProviderError> {
     if image_ids.is_empty() {
@@ -424,7 +435,7 @@ fn fetch_image_names(
             params.push(param(&format!("ImageId.{}", i + 1), id));
         }
 
-        let body = ec2_get(agent, creds, region, params)?;
+        let body = ec2_get(agent, creds, region, endpoint, params)?;
         let resp: DescribeImagesResponse = quick_xml::de::from_str(&body)
             .map_err(|e| ProviderError::Parse(format!("{}: {}", region, e)))?;
 
@@ -455,26 +466,20 @@ fn extract_tags(tag_set: &[Ec2Tag]) -> (String, Vec<String>) {
 
 // --- Provider trait ---
 
-impl Provider for Aws {
-    fn name(&self) -> &str {
-        "aws"
-    }
-
-    fn short_label(&self) -> &str {
-        "aws"
+impl Aws {
+    /// Real EC2 endpoint for a region. Overridable via `fetch_with_endpoint`
+    /// so tests can point the signed request at a mock server.
+    fn region_endpoint(region: &str) -> String {
+        format!("https://ec2.{}.amazonaws.com", region)
     }
 
-    fn fetch_hosts_cancellable(
-        &self,
-        token: &str,
-        cancel: &AtomicBool,
-        env: &crate::runtime::env::Env,
-    ) -> Result<Vec<ProviderHost>, ProviderError> {
-        self.fetch_hosts_with_progress(token, cancel, env, &|_| {})
-    }
-
-    fn fetch_hosts_with_progress(
+    /// Per-region fetch pipeline against caller-supplied endpoints. Production
+    /// resolves the real EC2 host per region; tests pass a closure returning a
+    /// mock URL so SigV4 signing, DescribeInstances + DescribeImages, XML
+    /// deserialize and `ProviderHost` mapping all run end to end.
+    fn fetch_with_endpoint(
         &self,
+        resolve_endpoint: impl Fn(&str) -> String,
         token: &str,
         cancel: &AtomicBool,
         env: &crate::runtime::env::Env,
@@ -514,7 +519,8 @@ impl Provider for Aws {
                 total_regions
             ));
 
-            let instances = match describe_instances(&agent, &creds, region, cancel) {
+            let endpoint = resolve_endpoint(region);
+            let instances = match describe_instances(&agent, &creds, region, &endpoint, cancel) {
                 Ok(instances) => instances,
                 Err(ProviderError::Cancelled) => return Err(ProviderError::Cancelled),
                 Err(ProviderError::AuthFailed) => return Err(ProviderError::AuthFailed),
@@ -539,7 +545,7 @@ impl Provider for Aws {
             // Fetch AMI names (best effort)
             let ami_names = if !ami_ids.is_empty() {
                 progress(&format!("Resolving AMIs for {}...", region));
-                fetch_image_names(&agent, &creds, region, &ami_ids).unwrap_or_default()
+                fetch_image_names(&agent, &creds, region, &endpoint, &ami_ids).unwrap_or_default()
             } else {
                 HashMap::new()
             };
@@ -610,6 +616,35 @@ impl Provider for Aws {
     }
 }
 
+impl Provider for Aws {
+    fn name(&self) -> &str {
+        "aws"
+    }
+
+    fn short_label(&self) -> &str {
+        "aws"
+    }
+
+    fn fetch_hosts_cancellable(
+        &self,
+        token: &str,
+        cancel: &AtomicBool,
+        env: &crate::runtime::env::Env,
+    ) -> Result<Vec<ProviderHost>, ProviderError> {
+        self.fetch_hosts_with_progress(token, cancel, env, &|_| {})
+    }
+
+    fn fetch_hosts_with_progress(
+        &self,
+        token: &str,
+        cancel: &AtomicBool,
+        env: &crate::runtime::env::Env,
+        progress: &dyn Fn(&str),
+    ) -> Result<Vec<ProviderHost>, ProviderError> {
+        self.fetch_with_endpoint(Self::region_endpoint, token, cancel, env, progress)
+    }
+}
+
 #[cfg(test)]
 #[path = "aws_tests.rs"]
 mod tests;

fuzz/seed_corpus/fuzz_ssh_config/11_quoted_values.conf

@@ -858,3 +858,111 @@ fn test_http_describe_images_auth_failure() {
     }
     mock.assert();
 }
+
+#[test]
+fn fetch_from_drives_full_pipeline_against_mock() {
+    // Exercises the production per-region pipeline end to end through the
+    // endpoint seam: SigV4 signing, DescribeInstances + DescribeImages,
+    // XML deserialize and ProviderHost mapping. Before the seam these were
+    // only covered by re-issuing equivalent requests inline.
+    let mut server = mockito::Server::new();
+    let instances = server
+        .mock("GET", "/")
+        .match_query(mockito::Matcher::UrlEncoded(
+            "Action".into(),
+            "DescribeInstances".into(),
+        ))
+        .match_header("Authorization", mockito::Matcher::Any)
+        .with_status(200)
+        .with_header("content-type", "text/xml")
+        .with_body(
+            r#"<DescribeInstancesResponse xmlns="http://ec2.amazonaws.com/doc/2016-11-15/">
+  <reservationSet><item><instancesSet><item>
+    <instanceId>i-1234567890</instanceId>
+    <instanceState><name>running</name></instanceState>
+    <privateIpAddress>10.0.0.1</privateIpAddress>
+    <ipAddress>54.1.2.3</ipAddress>
+    <imageId>ami-12345678</imageId>
+    <instanceType>t3.micro</instanceType>
+    <tagSet><item><key>Name</key><value>web-1</value></item></tagSet>
+  </item></instancesSet></item></reservationSet>
+</DescribeInstancesResponse>"#,
+        )
+        .create();
+    let images = server
+        .mock("GET", "/")
+        .match_query(mockito::Matcher::UrlEncoded(
+            "Action".into(),
+            "DescribeImages".into(),
+        ))
+        .with_status(200)
+        .with_header("content-type", "text/xml")
+        .with_body(
+            r#"<DescribeImagesResponse xmlns="http://ec2.amazonaws.com/doc/2016-11-15/">
+  <imagesSet><item><imageId>ami-12345678</imageId><name>amzn2-ami-hvm-2.0</name></item></imagesSet>
+</DescribeImagesResponse>"#,
+        )
+        .create();
+
+    let aws = Aws {
+        regions: vec!["us-east-1".to_string()],
+        profile: String::new(),
+    };
+    let url = server.url();
+    let hosts = aws
+        .fetch_with_endpoint(
+            |_region| url.clone(),
+            "AKID:SECRET",
+            &AtomicBool::new(false),
+            &crate::runtime::env::Env::empty(),
+            &|_| {},
+        )
+        .expect("fetch_with_endpoint must succeed against the mock");
+    instances.assert();
+    images.assert();
+
+    assert_eq!(hosts.len(), 1);
+    assert_eq!(hosts[0].server_id, "i-1234567890");
+    assert_eq!(hosts[0].name, "web-1");
+    assert_eq!(hosts[0].ip, "54.1.2.3");
+    assert!(
+        hosts[0]
+            .metadata
+            .contains(&("region".to_string(), "us-east-1".to_string()))
+    );
+    assert!(
+        hosts[0]
+            .metadata
+            .contains(&("os".to_string(), "amzn2-ami-hvm-2.0".to_string()))
+    );
+}
+
+#[test]
+fn fetch_from_maps_auth_failure_to_provider_error() {
+    let mut server = mockito::Server::new();
+    let mock = server
+        .mock("GET", "/")
+        .match_query(mockito::Matcher::Any)
+        .with_status(401)
+        .with_header("content-type", "text/xml")
+        .with_body("<Error><Code>AuthFailure</Code></Error>")
+        .create();
+
+    let aws = Aws {
+        regions: vec!["us-east-1".to_string()],
+        profile: String::new(),
+    };
+    let url = server.url();
+    let result = aws.fetch_with_endpoint(
+        |_region| url.clone(),
+        "AKID:SECRET",
+        &AtomicBool::new(false),
+        &crate::runtime::env::Env::empty(),
+        &|_| {},
+    );
+    mock.assert();
+    assert!(
+        matches!(result, Err(ProviderError::AuthFailed)),
+        "a 401 from the region must surface as AuthFailed, got {result:?}"
+    );
+}