fix(B-0789 iter-4.2 fixfwd): 5 Copilot findings on #5083 (3 P0 incl Nix-injection + 2 P1) before maintainer test

[AceHack]

Summary

PR #5083 (iter-4.2 substrate) auto-merged with required checks green; 5 substantive Copilot findings landed post-merge. All real; the Nix-injection P0 is security-relevant; install-script P0s would abort the install on real hardware under set -euo pipefail. Fix-forward before maintainer tests iter-4.2 end-to-end on PC 1.

P0 fixes (would actually break install or open security hole)

Thread	Fix
PRRT_kwDOSF9kNM6Erhtf	find /iso /run /mnt /boot aborts install when start-path missing → filter to existing dirs only via SEARCH_DIRS array + || true defense
PRRT_kwDOSF9kNM6Erhto	while read < $PUBKEY_FILE fails on root-owned mounts → read via sudo cat process substitution
PRRT_kwDOSF9kNM6Erhty	NIX CODE INJECTION in operator-ssh-keys.nix if pubkey comment has " or \ → sed-escape \\ → \\\\ then " → \" (Nix double-quoted string rules; backslash first)

P1 fixes

Thread	Fix
PRRT_kwDOSF9kNM6ErhuB	resolve('~/path') doesn't expand ~/ in Node → expand leading ~/ (and bare ~) to homedir() before resolve()
PRRT_kwDOSF9kNM6ErhuK	Pubkey regex/glob missed ecdsa-sha2-nistp{256,384,521} + FIDO sk-ssh-ed25519@* / sk-ecdsa-sha2-* → broaden to OpenSSH-spec prefixes per sshd(8) AuthorizedKeysFile

Files

• full-ai-cluster/tools/zflash.ts: ~/ expansion + broader pubkey regex
• full-ai-cluster/usb-nixos-installer/zeta-install.sh: filtered find paths, sudo cat read, Nix string escape, broader pubkey glob

Test plan

• shellcheck clean on zeta-install.sh
• zflash.ts --help parses post-fix
• Five threads on feat(B-0789 iter-4.2): zflash auto-inject SSH pubkey to boot USB ESP + zeta-install.sh probe — zero-typing SSH on first boot #5083 to be resolved post-merge via resolveReviewThread
• CI passes (gate workflow + CodeQL)
• Maintainer's next iter-4.2 USB flash uses this fix-forward — first end-to-end test

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Copilot]

Pull request overview

Fix-forward PR addressing five Copilot review findings from #5083 (iter-4.2 SSH pubkey injection for the cluster install USB). Three P0s would break the install under set -euo pipefail or open a Nix code-injection hole; two P1s improve path/key handling on the macOS side.

Changes:

• zeta-install.sh: filter find start-paths to existing dirs (with || true), read pubkey via sudo cat process substitution, sed-escape \ then " before interpolating into the generated Nix file, and broaden the case-glob to match ecdsa-sha2-* and FIDO sk-*@* key prefixes.
• zflash.ts: expand leading ~ / ~/ to homedir() before resolve() for --ssh-key, and broaden the OpenSSH key-type regex to match ecdsa-sha2-*, sk-ssh-ed25519@*, sk-ecdsa-sha2-* (dropping the bogus ssh-ecdsa token).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
full-ai-cluster/usb-nixos-installer/zeta-install.sh	Hardens probe step against missing dirs, root-owned mounts, and Nix-string injection; broadens accepted key types.
full-ai-cluster/tools/zflash.ts	Expands ~/~/ in --ssh-key argument and broadens pubkey-type validation regex.

Verification spot-checks:

• Nix escape order is correct: s/\\/\\\\/g then s/"/\\"/g — second pass does not re-double the backslashes added in the first (sequential -e apply once each), so " → \" and \ → \\ in the emitted Nix double-quoted string.
• ~ expansion: next === "~" slices 1 (empty tail) → homedir(); ~/foo slices 2 → join(homedir(), "foo"). Both correct.
• find … || true plus prior [ -d "$d" ] guard removes the set -e abort path.
• done < <(sudo cat "$PUBKEY_FILE") works even when the file is on a root-owned mount.
• Case glob ecdsa-sha2-*\ * and sk-{ssh-ed25519,ecdsa-sha2-*}@*\ * match the OpenSSH token forms; TS regex mirrors these structurally.

No new issues found in the diff.