fix(connection): strip invisible characters from saved credentials

apps/desktop/src/components/connection/ConnectionDialog.vue

@@ -42,6 +42,7 @@ import type { NacosAdminConfig, NacosApiPlane, NacosAuthConfig, NacosImplementat
 import { CONNECTION_ATTEMPT_CANCELLED_MESSAGE, useConnectionStore } from "@/stores/connectionStore";
 import { useTunnelProfileStore } from "@/stores/tunnelProfileStore";
 import { detachTunnelProfileLayer, tunnelProfileReferenceLayer, tunnelProfileSummary } from "@/lib/connection/tunnelProfiles";
+import { sanitizeConnectionCredentials } from "@/lib/connection/credentialSanitizer";
 import { applySshAuthMethod, inferSshAuthMethod } from "@/lib/connection/sshAuthMethod";
 import { applySshConfigHostAliasPrefill as prefillSshConfigHostAlias } from "@/lib/connection/sshConfigHosts";
 import { canPersistConnectionTestResult, connectionEditDraftSyncAction } from "./connectionEditDraftSync";
@@ -4573,6 +4574,8 @@ function connectionConfigForSubmit(id: string, generatedName = "", validatePlugi
   if (!config.show_system_schemas) config.show_system_schemas = undefined;
   if (config.visible_schemas && Object.keys(config.visible_schemas).length === 0) config.visible_schemas = undefined;
   if (config.agent_java_options && config.agent_java_options.length === 0) config.agent_java_options = undefined;
+  // Pasted credentials may carry invisible characters that trim() keeps (#9043).
+  sanitizeConnectionCredentials(config);
   return config as ConnectionConfig;
 }
 

apps/desktop/src/components/connection/TunnelProfileManager.vue

@@ -14,6 +14,7 @@ import { useTunnelProfileStore } from "@/stores/tunnelProfileStore";
 import { createTunnelProfile, createTunnelProfileTestGuard, tunnelProfileSummary, type TunnelProfileType } from "@/lib/connection/tunnelProfiles";
 import { applySshConfigHostAliasPrefill as prefillSshConfigHostAlias } from "@/lib/connection/sshConfigHosts";
 import { applySshAuthMethod } from "@/lib/connection/sshAuthMethod";
+import { stripInvisibleCharactersFromLayer } from "@/lib/connection/credentialSanitizer";
 import * as api from "@/lib/backend/api";
 import type { SshConfigHostEntry, TunnelProfile } from "@/types/database";
 import { translateBackendError } from "@/i18n/backend-errors";
@@ -151,7 +152,10 @@ async function save() {
   invalidateProfileTest();
   isSaving.value = true;
   try {
-    await store.saveProfiles(cloneProfiles(draft.value));
+    // Pasted credentials may carry invisible characters that trim() keeps (#9043).
+    const sanitized = cloneProfiles(draft.value);
+    sanitized.forEach(stripInvisibleCharactersFromLayer);
+    await store.saveProfiles(sanitized);
     toast(t("settings.tunnelsSaved"));
   } catch (error) {
     toast(t("settings.tunnelsSaveFailed", { message: translateBackendError(t, error) }), 5000);

apps/desktop/src/lib/connection/credentialSanitizer.ts

@@ -0,0 +1,45 @@
+import type { TransportLayerConfig } from "@/types/database";
+
+// Zero-width and other invisible characters (U+200B ZERO WIDTH SPACE,
+// U+200C/ZWNJ, U+200D/ZWJ, U+2060 WORD JOINER, U+FEFF BOM) can ride along when
+// a credential is pasted from web pages or rich-text sources. They survive
+// String.trim() — not ASCII whitespace — and turn a visually identical
+// password into a different secret, so the connection fails with "incorrect
+// username/password" (#9043). Strip them from credential fields before save.
+// The set also covers direction marks (U+200E/U+200F, U+202A–U+202E,
+// U+2066–U+2069), the soft hyphen U+00AD, and the invisible operators
+// U+2061–U+2064. NBSP (U+00A0) and ASCII whitespace are deliberately kept:
+// they are legitimate password characters.
+const INVISIBLE_CHARACTERS = /[\u00AD\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF]/g;
+
+export function stripInvisibleCharacters(value: string | undefined): string | undefined {
+  if (value === undefined) return undefined;
+  return value.replace(INVISIBLE_CHARACTERS, "");
+}
+
+/** Strips invisible characters from the credential fields of one transport layer, in place. */
+export function stripInvisibleCharactersFromLayer(layer: TransportLayerConfig): void {
+  if (layer.type === "ssh") {
+    layer.user = stripInvisibleCharacters(layer.user) ?? layer.user;
+    layer.password = stripInvisibleCharacters(layer.password);
+    layer.key_passphrase = stripInvisibleCharacters(layer.key_passphrase);
+  } else if (layer.type === "proxy") {
+    layer.username = stripInvisibleCharacters(layer.username) ?? layer.username;
+    layer.password = stripInvisibleCharacters(layer.password);
+  } else {
+    layer.token = stripInvisibleCharacters(layer.token);
+  }
+}
+
+export interface CredentialBearingConfig {
+  username?: string;
+  password?: string;
+  transport_layers?: TransportLayerConfig[];
+}
+
+/** Strips invisible characters from the credential fields of a connection config, in place. */
+export function sanitizeConnectionCredentials(config: CredentialBearingConfig): void {
+  config.username = stripInvisibleCharacters(config.username) ?? config.username;
+  config.password = stripInvisibleCharacters(config.password) ?? config.password;
+  config.transport_layers?.forEach(stripInvisibleCharactersFromLayer);
+}