feat: remote deploy via SSH (hatch.sh --host)

[Copilot]

hatch.sh was local-only; remote deployments required manual SSH + file copying. This adds a --host ssh://[user@]host flag with optional --path to scaffold and launch an instance on a remote host in one command.

Changes

scripts/hatch.sh

• New flags: --host ssh://[user@]host, --path /remote/path (defaults to /opt/hatchery/instances/<name>)
• Path validated early (before any scaffolding) against [a-zA-Z0-9/_.-] to prevent command injection
• Remote SSH commands use printf '%q' quoting on the path
• When --host is set: mkdir -p → rsync -az → docker compose up -d --build on the remote
• ssh_host/ssh_user stored in fleet.json (already consumed by fleet.sh health for SSH tunnel support)
• Tailored "Next steps" output for remote vs local deploys

scripts/test-hatch.sh

• Test 13: invalid --host format is rejected
• Test 14: --host ssh://user@host correctly stores ssh_host/ssh_user in fleet.json (uses PATH-injected stub ssh/rsync to avoid real connections)

README.md

• Minimal usage docs for remote deploy

Example

./scripts/hatch.sh chc-todd --port 18791 --host ssh://zeph@revere --path /share/Container/chc-todd

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• host
  • Triggering command: /usr/bin/ssh ssh user@host mkdir -p /tmp/test-path (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Remote deploy via SSH (hatch.sh --host)</issue_title>
<issue_description>hatch.sh only works locally. Todd deployment required manual SSH + file copy.

Add --host ssh://user@host flag that:

1. SSHs to target
2. Creates container directory
3. Copies template files (scp/rsync)
4. Runs docker compose up -d --build

Example: ./scripts/hatch.sh chc-todd --port 18791 --host ssh://zeph@revere --path /share/Container/chc-todd

Implementation notes: no separate validation report docs in PR, keep docs minimal.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Remote deploy via SSH (hatch.sh --host) #13

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.