I suggest we enable bracketed paste mode by default in the /etc/inputrc on production hosts where shells are regularly used, particularly deployment.eqiad.wmnet and the mwmaint hosts. This should protect better against deployers running unwanted commands because they paste input that unexpectedly contains a line break.
For example, compare the two log messages at T291118#7435634. For the first one, I wrote the beginning of the scap sync-file command, pasted the summary (generated by P8845), then went back into it and pasted the task ID into the () generated by that script (because the Gerrit change had no task ID attached). After this, I intended to go back to the end of the summary and add “(1/2)”, to indicate that this was the first of a two-part sync; however, the task ID I’d copied from Gerrit actually contained a trailing newline, and so the command was started immediately. In this case, I quickly decided that adding the “(1/2)” was not worth the risk of Ctrl+C’ing scap, and so I let the command finish and log the deploy with the incomplete message; however, in general, I’d like to avoid this in the future.
I already added bracketed paste mode to my personal ~/.inputrc on deploy1002:
$include /etc/inputrc set enable-bracketed-paste on
And it seems to work fine, even through the layers of Gnome Shell, tmux, and ssh.