From f67ed12e49e8e8e642212e1f9f3586927ba88fb3 Mon Sep 17 00:00:00 2001
From: Dict Xiong <me@dxng.cn>
Date: Thu, 13 Aug 2026 15:55:11 +0800
Subject: [PATCH] fix(riot): simplify and secure

---
 scripts/riot           | 9 ++++-----
 tools/test-riot-gpg.sh | 2 ++
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/scripts/riot b/scripts/riot
index 6b8b56e..c572adf 100755
--- a/scripts/riot
+++ b/scripts/riot
@@ -178,14 +178,13 @@ probe_remote_gpg_socket() {
 
     # The probe must be an independent connection: reusing or creating a
     # multiplex master here races with the immediately following login.
-    local query_cmd=(ssh "-S" "none" "-o" "ClearAllForwardings=yes" "-o" "RequestTTY=no")
+    local query_cmd=(ssh "-S" "none" "-o" "ClearAllForwardings=yes")
     if [[ -n "$PORT" ]]; then
         query_cmd+=("-p" "$PORT")
     fi
     query_cmd+=(
         "${SSH_OPTIONS[@]}"
         "${EXTRA_SSH_OPTIONS[@]}"
-        "-o" "RequestTTY=no"
         "-T"
         "$USERNAME${USERNAME:+@}$SERVER"
         'socket=$(gpgconf --list-dirs agent-socket 2>/dev/null) || exit 10
@@ -290,9 +289,9 @@ eval_or_echo() {
             tmux_win=$((tmux_win+1))
             $DO tmux new-window -t $TMUX_SESS:$tmux_win -d bash -l
         fi
-        for arg in "${CMD[@]}"; do
-            $DO tmux send-keys -t "$TMUX_SESS:$tmux_win" "$arg" Space
-        done
+        local command
+        printf -v command '%q ' "${CMD[@]}"
+        $DO tmux send-keys -l -t "$TMUX_SESS:$tmux_win" "${command% }"
         $DO tmux send-keys -t "$TMUX_SESS:$tmux_win" Enter
     else
         $DO "${CMD[@]}"
diff --git a/tools/test-riot-gpg.sh b/tools/test-riot-gpg.sh
index 60a7620..154df6b 100755
--- a/tools/test-riot-gpg.sh
+++ b/tools/test-riot-gpg.sh
@@ -123,6 +123,8 @@ MOCK_REMOTE_RESTRICTED=0 MOCK_SYSTEMD_ACTIVE=1 run_riot -g example.test > "$TEST
 grep -Fq 'remote gpg-agent.socket is active' "$TEST_DIR/err"
 grep -Fq 'ARG=none' "$MOCK_SSH_LOG"
 grep -Fq 'ARG=ClearAllForwardings=yes' "$MOCK_SSH_LOG"
+grep -Fq 'ARG=-T' "$MOCK_SSH_LOG"
+! grep -Fq 'ARG=RequestTTY=' "$MOCK_SSH_LOG"
 grep -Fq 'ARG=StreamLocalBindUnlink=no' "$MOCK_SSH_LOG"
 grep -Fq "ARG=$MOCK_REMOTE_SOCKET:$MOCK_LOCAL_SOCKET" "$MOCK_SSH_LOG"
 [[ ! -e "$MOCK_REMOTE_SOCKET" ]]