fix(security): pass registry passwords to docker login via stdin

[Gabrielgvl]

What is this PR about?

Follow up on #4579 and #4875 by keeping registry passwords out of the commands used for direct Docker login calls. Shell escaping prevents injection, but printf %s '<password>' | docker login ... still puts the password in the shell process arguments and in execution errors.

• Add a shared dockerLogin helper for registry create, update, both test routes, and rollbacks.
• Use the existing execFileAsync runner with an argument array locally. Send the password only on stdin.
• Add optional stdin input to execAsyncRemote. The remote command contains only escaped registry and username arguments. The password goes to the SSH channel, followed by EOF.
• Sanitize login error messages and discard the original execution error so echoed passwords cannot remain in nested error fields.

Tests

• Local argv and stdin, remote command escaping and channel stdin, empty-password EOF, failed-login password redaction, and unchanged remote execution without stdin.
• Red before green: the five login regressions failed against the existing shell behavior before the fix. All six tests now pass locally.
• pnpm exec biome check on the five changed files.
• pnpm typecheck.
• pnpm test run --exclude __test__/deploy/application.real.test.ts --maxWorkers=4: 1,299 tests pass across 133 files.
• The full suite also ran. Four real-deployment failures reproduce on clean canary because those tests need the Docker Swarm setup used in CI. An unrelated remote-stream timeout cleared on rerun.

Remaining work

utils/providers/docker.ts and utils/cluster/upload.ts generate shell scripts for later execution. Those flows still use safeDockerLoginCommand and are unchanged here. Removing embedded credentials from those scripts needs a separate change. See #4693 and the existing build-log redaction work in #5068. This PR does not close #4693.

Checklist

• Dedicated branch based on canary.
• Read CONTRIBUTING.md.
• Ran the regression tests locally with synthetic credentials only.

Related work

Refs #4579, #4875, #3382, #4693, #5068.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues were found.

Summary

Direct Docker logins now share dockerLogin, which sends passwords through stdin instead of shell command arguments.

• Direct registry logins keep passwords out of commands and errors.

_{Reviews (1) · Last reviewed commit: "fix(security): pass registry login passw..." · Reviewed by Greptile}