[devin-ai-integration]

Summary

syspi add git+ssh://git@github.com/owner/repo@1.0.0 was refused ("a user name or password in the host is not supported"), so every SSH remote that expects a fixed login needed a User entry in ssh_config first.

A user name is now accepted in the authority of a <vcs>+ssh:// location (git+ssh, hg+ssh, svn+ssh). Still refused: a password on any transport (user:pw@, user:@), and a user name on any other transport, where it would be a credential. pkg:git/user@host/path means git+https and is refused by the same rule, so the alias and the bare notation agree.

Identity

• The user name is part of the identity (RFC 3986 §3.2: userinfo is a component of the authority; nothing in §6 or Annex B.3.5 drops it). It is written to .project.json and the lock's resource inside the percent-encoded vcs_url (…git%2Bssh:%2F%2Fgit%40github.com%2F…); the lock's source, the address the VCS executable receives, is ssh://git@github.com/….
• git+ssh://git@host/p and git+ssh://host/p are two identities, as git+https and git+ssh already are: each is resolved through its own address and locked under its own resource; a lock entry of one never satisfies a usage of the other.
• lib/<publisher>-<name>_<version> does not carry it. Two usages differing only in the user name are locked as two entries with the same revision and sha256 and installed once; different contents for one directory fail the run, as before.
• A user name starting with - is refused (it would reach ssh as an option).
• Error and log redaction keeps a password-free SSH login readable and still masks any user:password@ and any userinfo on other schemes.

Annex B.3.5

The Annex (informative) says "Using user names and password in the host_name is not supported and should be reported by tools as an error", and in the same clause that its syntax is pip's, whose examples include git+ssh://git@git.example.com/MyProject. This change departs from that recommendation for the SSH login only; docs/packages.md says so explicitly rather than presenting it as something the Annex permits.

Tests

• internal/origin: acceptance, canonical form and round trip for git/hg/svn, port, case, escaped and empty user name; refusals; identity and key distinctness.
• internal/vcs: the exact argv each executable receives (stand-in executables on PATH), redaction.
• internal/install: locationKey keeps the user name and its case.
• tests/e2e: real git over the ssh transport with a stand-in for the ssh program (records the destination, runs the remote command locally): both spellings, lock contents, shared lib/ directory, offline reuse, switching spelling, refusals never reaching ssh. Skipped on Windows (POSIX shell stand-in).

Overlap

internal/install/install.go, internal/install/install_test.go and docs/packages.md are also touched by #9, README.md by #8; here install.go changes only locationKey.

---

🟢 Devin Review found nothing to fix · View findings

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.