Add debug logging for SSH command execution

Introduce a function to check the DEBUG environment variable and adjust logging behavior accordingly. When DEBUG is enabled, full SSH command details are logged; otherwise, only the command itself is logged to prevent exposure of sensitive information.

scripts/ssh.lua

@@ -5,6 +5,12 @@ local utils = require("utils")
 
 local ssh_module = {}
 
+-- Check if DEBUG environment variable is set to "true"
+local function is_debug()
+  local debug_env = os.getenv("DEBUG")
+  return debug_env and (string.lower(debug_env) == "true" or debug_env == "1")
+end
+
 -- Execute a remote command over SSH
 -- Signature: ssh(command, user, host, port, identity_file)
 function ssh_module.execute(command, user, host, port, identity_file)
@@ -54,7 +60,13 @@ function ssh_module.execute(command, user, host, port, identity_file)
   end
 
   local full = join(pieces)
-  utils.log("SSH exec: " .. full)
+
+  -- Log based on DEBUG environment variable
+  if is_debug() then
+    utils.log("SSH exec: " .. full)
+  else
+    utils.log("SSH exec: " .. "'" .. command:gsub("'", "'\\''") .. "'")
+  end
 
   local ok, reason, code = os.execute(full)
   if ok == true or ok == 0 then
@@ -107,7 +119,13 @@ function ssh_module.execute_with_output(command, user, host, port, identity_file
   end
 
   local full = join(pieces)
-  utils.log("SSH exec (with output): " .. full)
+
+  -- Log based on DEBUG environment variable
+  if is_debug() then
+    utils.log("SSH exec (with output): " .. full)
+  else
+    utils.log("SSH exec (with output): " .. "'" .. command:gsub("'", "'\\''") .. "'")
+  end
 
   -- Use io.popen to capture output
   local fh = io.popen(full, "r")