@marcusrbrown/infra 0.9.12 → 0.9.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.9.12",
+  "version": "0.9.13",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",

package/src/commands/gateway/backup.test.ts

@@ -265,6 +265,79 @@ describe('backupGatewayCa — atomic write (COR2)', () => {
   })
 })
 
+// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
+
+describe('backupGatewayCa — SSH command includes UserKnownHostsFile', () => {
+  let tmpOutput: string
+
+  beforeEach(() => {
+    tmpOutput = `/tmp/test-backup-known-hosts-${Date.now()}.tar`
+  })
+
+  afterEach(async () => {
+    try {
+      ;(await Bun.file(tmpOutput).exists()) && Bun.spawnSync(['rm', '-f', tmpOutput])
+    } catch {
+      // ignore
+    }
+  })
+
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh', async () => {
+    let capturedCmd: string[] = []
+    const spawnCapture: BackupSpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(new Uint8Array([1, 2, 3]))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(controller) {
+            controller.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await backupGatewayCa({host: 'gateway.example.com', output: tmpOutput, includeCa: true}, spawnCapture)
+
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
+    let capturedCmd: string[] = []
+    const spawnCapture: BackupSpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(new Uint8Array([1, 2, 3]))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(controller) {
+            controller.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await backupGatewayCa({host: 'gateway.example.com', output: tmpOutput, includeCa: true}, spawnCapture)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})
+
 // ─── SEC1: Tmp file born with mode 0600 (no chmod race) ──────────────────────
 
 describe('backupGatewayCa — SEC1: tmp file created with mode 0600 atomically', () => {

package/src/commands/gateway/backup.ts

@@ -5,6 +5,7 @@ import type {ActionCtx} from '../../lib/action-ctx'
 import {closeSync, constants as fsConstants, openSync, renameSync, unlinkSync, writeSync} from 'node:fs'
 
 import {z} from 'zod'
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {validateGatewayHost} from './host'
 
 declare const process: {
@@ -69,6 +70,7 @@ export async function backupGatewayCa(
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     `root@${opts.host}`,
     `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine tar -cf - -C /src ${CA_CERT_FILE} ${CA_KEY_FILE}`,
   ]

package/src/commands/gateway/logs.test.ts

@@ -220,3 +220,44 @@ describe('tail forwarding', () => {
     expect(capturedCmd.join(' ')).toContain('--tail=25')
   })
 })
+
+// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
+
+describe('streamGatewayLogs — SSH command includes UserKnownHostsFile', () => {
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh', async () => {
+    delete process.env.CI
+
+    const {streamGatewayLogs} = await import('./logs')
+
+    let capturedCmd: string[] = []
+    const spawnCapture: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamGatewayLogs({host: 'gateway.example.com', service: 'gateway', tail: 100, allowCi: false}, spawnCapture)
+
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
+    delete process.env.CI
+
+    const {streamGatewayLogs} = await import('./logs')
+
+    let capturedCmd: string[] = []
+    const spawnCapture: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamGatewayLogs({host: 'gateway.example.com', service: 'gateway', tail: 100, allowCi: false}, spawnCapture)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})

package/src/commands/gateway/logs.ts

@@ -2,6 +2,7 @@ import type {goke} from 'goke'
 
 import {z} from 'zod'
 
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {validateGatewayHost} from './host'
 
 declare const process: {
@@ -88,6 +89,7 @@ export async function streamGatewayLogs(
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     `root@${opts.host}`,
     `docker compose --project-directory ${COMPOSE_PROJECT_DIR} logs --no-color --tail=${opts.tail} ${opts.service}`,
   ]

package/src/commands/gateway/restore.test.ts

@@ -403,6 +403,162 @@ describe('restoreGatewayCa — SEC2: unguessable remote tmp path via mktemp', ()
   })
 })
 
+// ─── SSH and SCP commands include repo-pinned UserKnownHostsFile ─────────────
+
+describe('restoreGatewayCa — SSH and SCP commands include UserKnownHostsFile', () => {
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to every ssh invocation', async () => {
+    const tarDir = `/tmp/test-kh-ssh-tar-dir-${Date.now()}`
+    const realTar = `/tmp/test-kh-ssh-tar-${Date.now()}.tar`
+    const certContent = 'CERT'
+    const keyContent = 'KEY'
+    Bun.spawnSync(['mkdir', '-p', tarDir])
+    await Bun.write(`${tarDir}/mitmproxy-ca-cert.pem`, certContent)
+    await Bun.write(`${tarDir}/mitmproxy-ca.pem`, keyContent)
+    Bun.spawnSync(['tar', '-cf', realTar, '-C', tarDir, 'mitmproxy-ca-cert.pem', 'mitmproxy-ca.pem'])
+
+    const capturedCmds: string[][] = []
+    const spawnCapture: RestoreSpawnFn = (cmd, _opts) => {
+      capturedCmds.push([...cmd])
+      const cmdStr = cmd.join(' ')
+      const isTarTf = cmd[0] === 'tar' && cmd.includes('-tf')
+      const isMktemp = cmdStr.includes('mktemp')
+      const encoder = new TextEncoder()
+      let stdout = ''
+      if (isTarTf) stdout = 'mitmproxy-ca-cert.pem\nmitmproxy-ca.pem\n'
+      else if (isMktemp) stdout = '/tmp/gateway-ca-restore-kh-test.tar\n'
+      else stdout = certContent
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(stdout))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(controller) {
+            controller.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await restoreGatewayCa({host: 'gateway.example.com', input: realTar, includeCa: true}, spawnCapture)
+
+    // Every ssh invocation must include UserKnownHostsFile
+    const sshCmds = capturedCmds.filter(c => c[0] === 'ssh')
+    expect(sshCmds.length).toBeGreaterThan(0)
+    for (const sshCmd of sshCmds) {
+      const knownHostsIdx = sshCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+      expect(knownHostsIdx).toBeGreaterThan(-1)
+      expect(sshCmd[knownHostsIdx - 1]).toBe('-o')
+      expect(sshCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+    }
+
+    Bun.spawnSync(['rm', '-rf', tarDir, realTar])
+  })
+
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to the scp invocation', async () => {
+    const tarDir = `/tmp/test-kh-scp-tar-dir-${Date.now()}`
+    const realTar = `/tmp/test-kh-scp-tar-${Date.now()}.tar`
+    const certContent = 'CERT'
+    const keyContent = 'KEY'
+    Bun.spawnSync(['mkdir', '-p', tarDir])
+    await Bun.write(`${tarDir}/mitmproxy-ca-cert.pem`, certContent)
+    await Bun.write(`${tarDir}/mitmproxy-ca.pem`, keyContent)
+    Bun.spawnSync(['tar', '-cf', realTar, '-C', tarDir, 'mitmproxy-ca-cert.pem', 'mitmproxy-ca.pem'])
+
+    const capturedCmds: string[][] = []
+    const spawnCapture: RestoreSpawnFn = (cmd, _opts) => {
+      capturedCmds.push([...cmd])
+      const cmdStr = cmd.join(' ')
+      const isTarTf = cmd[0] === 'tar' && cmd.includes('-tf')
+      const isMktemp = cmdStr.includes('mktemp')
+      const encoder = new TextEncoder()
+      let stdout = ''
+      if (isTarTf) stdout = 'mitmproxy-ca-cert.pem\nmitmproxy-ca.pem\n'
+      else if (isMktemp) stdout = '/tmp/gateway-ca-restore-kh-scp-test.tar\n'
+      else stdout = certContent
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(stdout))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(controller) {
+            controller.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await restoreGatewayCa({host: 'gateway.example.com', input: realTar, includeCa: true}, spawnCapture)
+
+    const scpCmd = capturedCmds.find(c => c[0] === 'scp')
+    expect(scpCmd).toBeDefined()
+    const knownHostsIdx = scpCmd!.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(scpCmd![knownHostsIdx - 1]).toBe('-o')
+    expect(scpCmd![knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+
+    Bun.spawnSync(['rm', '-rf', tarDir, realTar])
+  })
+
+  it('does not weaken StrictHostKeyChecking in ssh or scp commands', async () => {
+    const tarDir = `/tmp/test-kh-strict-tar-dir-${Date.now()}`
+    const realTar = `/tmp/test-kh-strict-tar-${Date.now()}.tar`
+    const certContent = 'CERT'
+    const keyContent = 'KEY'
+    Bun.spawnSync(['mkdir', '-p', tarDir])
+    await Bun.write(`${tarDir}/mitmproxy-ca-cert.pem`, certContent)
+    await Bun.write(`${tarDir}/mitmproxy-ca.pem`, keyContent)
+    Bun.spawnSync(['tar', '-cf', realTar, '-C', tarDir, 'mitmproxy-ca-cert.pem', 'mitmproxy-ca.pem'])
+
+    const capturedCmds: string[][] = []
+    const spawnCapture: RestoreSpawnFn = (cmd, _opts) => {
+      capturedCmds.push([...cmd])
+      const cmdStr = cmd.join(' ')
+      const isTarTf = cmd[0] === 'tar' && cmd.includes('-tf')
+      const isMktemp = cmdStr.includes('mktemp')
+      const encoder = new TextEncoder()
+      let stdout = ''
+      if (isTarTf) stdout = 'mitmproxy-ca-cert.pem\nmitmproxy-ca.pem\n'
+      else if (isMktemp) stdout = '/tmp/gateway-ca-restore-kh-strict-test.tar\n'
+      else stdout = certContent
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(stdout))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(controller) {
+            controller.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await restoreGatewayCa({host: 'gateway.example.com', input: realTar, includeCa: true}, spawnCapture)
+
+    // All ssh and scp commands must have StrictHostKeyChecking=yes
+    const sshAndScpCmds = capturedCmds.filter(c => c[0] === 'ssh' || c[0] === 'scp')
+    expect(sshAndScpCmds.length).toBeGreaterThan(0)
+    for (const cmd of sshAndScpCmds) {
+      const strictIdx = cmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+      expect(strictIdx).toBeGreaterThan(-1)
+      expect(cmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+    }
+
+    Bun.spawnSync(['rm', '-rf', tarDir, realTar])
+  })
+})
+
 // ─── COR1: validateBackupArchive ─────────────────────────────────────────────
 
 describe('validateBackupArchive — COR1', () => {

package/src/commands/gateway/restore.ts

@@ -2,6 +2,7 @@ import type {goke} from 'goke'
 
 import {z} from 'zod'
 
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {validateGatewayHost} from './host'
 
 declare const process: {
@@ -38,7 +39,16 @@ export type RestoreResult = {ok: true; confirmed: true} | {ok: false; error: str
 
 /** Returns the argv array for an SSH command to the given host. */
 function sshCommand(host: string, remote: string): string[] {
-  return ['ssh', '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes', `root@${host}`, remote]
+  return [
+    'ssh',
+    '-o',
+    'BatchMode=yes',
+    '-o',
+    'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
+    `root@${host}`,
+    remote,
+  ]
 }
 
 async function spawnText(
@@ -143,6 +153,7 @@ export async function restoreGatewayCa(
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     opts.input,
     `root@${opts.host}:${tmpRemote}`,
   ]

package/src/commands/gateway/status.test.ts

@@ -139,6 +139,71 @@ function makeSpawnError(message: string): SpawnFn {
   }
 }
 
+// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
+
+describe('getGatewayComposeStatus — SSH command includes UserKnownHostsFile', () => {
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh when the file exists', async () => {
+    const {getGatewayComposeStatus} = await import('./status')
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(JSON.stringify([{Name: 'gateway', State: 'running', Health: 'healthy'}])))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getGatewayComposeStatus('gateway.fro.bot', capturingSpawn)
+
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
+    const {getGatewayComposeStatus} = await import('./status')
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(JSON.stringify([{Name: 'gateway', State: 'running', Health: 'healthy'}])))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getGatewayComposeStatus('gateway.fro.bot', capturingSpawn)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})
+
 describe('getGatewayComposeStatus — host validation (SEC1)', () => {
   it('rejects a leading-hyphen host and does not invoke ssh', async () => {
     const {getGatewayComposeStatus} = await import('./status')

package/src/commands/gateway/status.ts

@@ -3,6 +3,7 @@ import type {ActionCtx} from '../../lib/action-ctx'
 import type {StatusSummary} from '../status'
 import {z} from 'zod'
 
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {redactHost} from '../../lib/redact'
 // ─── Minimal ctx interface (subset of GokeExecutionContext used by this action) ─
 import {validateGatewayHost} from './host'
@@ -108,6 +109,7 @@ export async function getGatewayComposeStatus(
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     `root@${host}`,
     `docker compose --project-directory ${COMPOSE_PROJECT_DIR} ps --format json`,
   ]

package/src/commands/umami/logs.test.ts

@@ -152,3 +152,40 @@ describe('logs command', () => {
     expect(spawnCalled).toBe(false)
   })
 })
+
+// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
+
+describe('streamUmamiLogs — SSH command includes UserKnownHostsFile', () => {
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh', async () => {
+    delete process.env.CI
+
+    let capturedCmd: string[] = []
+    const spawnCapture: LogsSpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamUmamiLogs({host: 'metrics.fro.bot', service: 'umami', tail: 100, allowCi: false}, spawnCapture)
+
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
+    delete process.env.CI
+
+    let capturedCmd: string[] = []
+    const spawnCapture: LogsSpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamUmamiLogs({host: 'metrics.fro.bot', service: 'umami', tail: 100, allowCi: false}, spawnCapture)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})

package/src/commands/umami/logs.ts

@@ -2,6 +2,7 @@ import type {goke} from 'goke'
 
 import {z} from 'zod'
 
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {validateUmamiHost} from './host'
 
 declare const process: {
@@ -91,6 +92,7 @@ export async function streamUmamiLogs(
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     `root@${opts.host}`,
     `docker compose --project-directory ${COMPOSE_PROJECT_DIR} logs --no-color --tail=${opts.tail} ${opts.service}`,
   ]

package/src/commands/umami/status.test.ts

@@ -133,6 +133,70 @@ function makeSpawn(stdout: string, stderr = '', exitCode = 0): SpawnFn {
   }
 }
 
+// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
+
+describe('getUmamiComposeStatus — SSH command includes UserKnownHostsFile', () => {
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh when the file exists', async () => {
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const enc = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.enqueue(enc.encode(JSON.stringify([{Name: 'umami', State: 'running', Health: 'healthy'}])))
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getUmamiComposeStatus('metrics.fro.bot', capturingSpawn)
+
+    // Find the UserKnownHostsFile option in the ssh command
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const enc = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.enqueue(enc.encode(JSON.stringify([{Name: 'umami', State: 'running', Health: 'healthy'}])))
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getUmamiComposeStatus('metrics.fro.bot', capturingSpawn)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})
+
 describe('getUmamiComposeStatus', () => {
   it('returns service rows from NDJSON output', async () => {
     const ndjson = [

package/src/commands/umami/status.ts

@@ -3,6 +3,7 @@ import type {ActionCtx} from '../../lib/action-ctx'
 import type {StatusSummary} from '../status'
 import {z} from 'zod'
 
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {redactHost} from '../../lib/redact'
 import {validateUmamiHost} from './host'
 
@@ -102,6 +103,7 @@ export async function getUmamiComposeStatus(host: string, spawn: SpawnFn = defau
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     `root@${host}`,
     `docker compose --project-directory ${COMPOSE_PROJECT_DIR} ps --format json`,
   ]

package/src/conventions.test.ts

@@ -276,6 +276,30 @@ describe('repo conventions', () => {
     expect(offenders).toEqual([])
   })
 
+  it('opencode.jsonc mcp.infra.command uses local repo source (not bunx published package)', async () => {
+    const jsoncText = await Bun.file(resolve(REPO_ROOT, 'opencode.jsonc')).text()
+    const stripped = jsoncText
+      .split('\n')
+      .map(line => (/^\s*\/\//.test(line) ? '' : line))
+      .join('\n')
+      .replaceAll(/,(\s*[}\]])/g, '$1')
+    const opencode = JSON.parse(stripped) as {mcp?: {infra?: {command?: unknown}}}
+
+    const infraCommand = opencode.mcp?.infra?.command
+    expect(Array.isArray(infraCommand), 'mcp.infra.command must be an array').toBe(true)
+
+    const cmd = infraCommand as string[]
+    expect(
+      cmd,
+      'mcp.infra.command must be ["bun", "run", "packages/cli/src/cli.ts", "mcp"] — use local source, not bunx',
+    ).toEqual(['bun', 'run', 'packages/cli/src/cli.ts', 'mcp'])
+
+    // Explicit regression guard: bunx @marcusrbrown/infra resolves stale published
+    // package cache and exits before the MCP handshake, causing connection closed.
+    expect(cmd.join(' ')).not.toContain('bunx')
+    expect(cmd.join(' ')).not.toContain('@marcusrbrown/infra')
+  })
+
   it('gates every sensitive infra MCP tool in opencode.jsonc', async () => {
     // Parse opencode.jsonc tolerantly: it uses JSONC syntax (// line comments,
     // trailing commas). Strategy:

package/src/lib/known-hosts.test.ts

@@ -0,0 +1,192 @@
+import {existsSync, mkdirSync, rmSync, writeFileSync} from 'node:fs'
+import {tmpdir} from 'node:os'
+import {join, resolve} from 'node:path'
+
+import {describe, expect, it} from 'bun:test'
+
+import {buildKnownHostsArgs, resolveKnownHostsPath, resolveRepoKnownHostsPath} from './known-hosts'
+
+// ─── resolveRepoKnownHostsPath ────────────────────────────────────────────────
+
+describe('resolveRepoKnownHostsPath', () => {
+  it('returns the path to .github/known_hosts when it exists at the repo root', () => {
+    // The actual repo has .github/known_hosts — this test runs from the repo root
+    const result = resolveRepoKnownHostsPath()
+
+    expect(result).not.toBeNull()
+    expect(result).toMatch(/\.github[/\\]known_hosts$/)
+    if (result) expect(existsSync(result)).toBe(true)
+  })
+
+  it('returns null when a custom base path has no .github/known_hosts', () => {
+    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
+    mkdirSync(tmpDir, {recursive: true})
+
+    try {
+      const result = resolveRepoKnownHostsPath(tmpDir)
+      expect(result).toBeNull()
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('returns the path when a custom base path has .github/known_hosts', () => {
+    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
+    const githubDir = join(tmpDir, '.github')
+    mkdirSync(githubDir, {recursive: true})
+    writeFileSync(join(githubDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
+
+    try {
+      const result = resolveRepoKnownHostsPath(tmpDir)
+      expect(result).not.toBeNull()
+      expect(result).toBe(join(tmpDir, '.github', 'known_hosts'))
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+})
+
+// ─── resolveKnownHostsPath (new: multi-layout resolution) ────────────────────
+
+describe('resolveKnownHostsPath', () => {
+  it('returns the packaged resource path when only src/resources/known_hosts exists (installed package layout)', () => {
+    // Simulate: node_modules/@marcusrbrown/infra/src/lib/known-hosts.ts
+    // Only src/resources/known_hosts exists; no .github/known_hosts at any ancestor.
+    const tmpDir = join(tmpdir(), `known-hosts-installed-${Date.now()}`)
+    const libDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'lib')
+    const resourcesDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'resources')
+    mkdirSync(libDir, {recursive: true})
+    mkdirSync(resourcesDir, {recursive: true})
+    writeFileSync(join(resourcesDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
+
+    try {
+      // Pass the simulated import.meta.dir (the lib dir inside the package)
+      const result = resolveKnownHostsPath(libDir)
+      expect(result).not.toBeNull()
+      expect(result).toBe(join(resourcesDir, 'known_hosts'))
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('prefers .github/known_hosts over packaged resource when both exist (repo checkout layout)', () => {
+    // Mirror the real layout: packages/cli/src/lib is 4 levels deep from repo root.
+    // tmpDir is the "repo root"; libDir is tmpDir/packages/cli/src/lib.
+    const tmpDir = join(tmpdir(), `known-hosts-both-${Date.now()}`)
+    const libDir = join(tmpDir, 'packages', 'cli', 'src', 'lib')
+    const githubDir = join(tmpDir, '.github')
+    const resourcesDir = join(tmpDir, 'packages', 'cli', 'src', 'resources')
+    mkdirSync(libDir, {recursive: true})
+    mkdirSync(githubDir, {recursive: true})
+    mkdirSync(resourcesDir, {recursive: true})
+    writeFileSync(join(githubDir, 'known_hosts'), 'repo.example.com ssh-ed25519 AAAA...\n')
+    writeFileSync(join(resourcesDir, 'known_hosts'), 'packaged.example.com ssh-ed25519 AAAA...\n')
+
+    try {
+      // lib is at tmpDir/packages/cli/src/lib — 4 levels up is tmpDir (the "repo root")
+      const result = resolveKnownHostsPath(libDir)
+      expect(result).not.toBeNull()
+      // Should prefer .github/known_hosts (repo checkout)
+      expect(result).toBe(join(githubDir, 'known_hosts'))
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('throws a clear error when neither .github/known_hosts nor packaged resource exists', () => {
+    const tmpDir = join(tmpdir(), `known-hosts-none-${Date.now()}`)
+    const libDir = join(tmpDir, 'src', 'lib')
+    mkdirSync(libDir, {recursive: true})
+
+    try {
+      expect(() => resolveKnownHostsPath(libDir)).toThrow(
+        'Pinned SSH known_hosts file not found; reinstall @marcusrbrown/infra or run from the repo checkout',
+      )
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+})
+
+// ─── buildKnownHostsArgs ──────────────────────────────────────────────────────
+
+describe('buildKnownHostsArgs', () => {
+  it('returns UserKnownHostsFile args when .github/known_hosts exists at repo root', () => {
+    const args = buildKnownHostsArgs()
+
+    // The actual repo has .github/known_hosts
+    expect(args).toHaveLength(2)
+    expect(args[0]).toBe('-o')
+    expect(args[1]).toMatch(/^UserKnownHostsFile=/)
+    expect(args[1]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('throws when no known_hosts file exists (fail-closed behavior)', () => {
+    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
+    const libDir = join(tmpDir, 'src', 'lib')
+    mkdirSync(libDir, {recursive: true})
+
+    try {
+      expect(() => buildKnownHostsArgs(libDir)).toThrow(
+        'Pinned SSH known_hosts file not found; reinstall @marcusrbrown/infra or run from the repo checkout',
+      )
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('returns UserKnownHostsFile args pointing to the packaged resource in installed layout', () => {
+    const tmpDir = join(tmpdir(), `known-hosts-installed-${Date.now()}`)
+    const libDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'lib')
+    const resourcesDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'resources')
+    mkdirSync(libDir, {recursive: true})
+    mkdirSync(resourcesDir, {recursive: true})
+    writeFileSync(join(resourcesDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
+
+    try {
+      const args = buildKnownHostsArgs(libDir)
+      expect(args).toHaveLength(2)
+      expect(args[0]).toBe('-o')
+      expect(args[1]).toBe(`UserKnownHostsFile=${join(resourcesDir, 'known_hosts')}`)
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('returns UserKnownHostsFile args pointing to the custom base path (repo checkout)', () => {
+    // Mirror the real layout: packages/cli/src/lib is 4 levels deep from repo root.
+    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
+    const libDir = join(tmpDir, 'packages', 'cli', 'src', 'lib')
+    const githubDir = join(tmpDir, '.github')
+    mkdirSync(libDir, {recursive: true})
+    mkdirSync(githubDir, {recursive: true})
+    writeFileSync(join(githubDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
+
+    try {
+      const args = buildKnownHostsArgs(libDir)
+      expect(args).toHaveLength(2)
+      expect(args[0]).toBe('-o')
+      expect(args[1]).toBe(`UserKnownHostsFile=${join(githubDir, 'known_hosts')}`)
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+})
+
+// ─── Drift guard: packaged resource matches .github/known_hosts ───────────────
+
+describe('packaged known_hosts resource drift guard', () => {
+  const REPO_ROOT = resolve(import.meta.dir, '..', '..', '..', '..')
+  const REPO_KNOWN_HOSTS = join(REPO_ROOT, '.github', 'known_hosts')
+  const PACKAGED_RESOURCE = resolve(import.meta.dir, '..', 'resources', 'known_hosts')
+
+  it('src/resources/known_hosts exists in the package source tree', () => {
+    expect(existsSync(PACKAGED_RESOURCE)).toBe(true)
+  })
+
+  it('src/resources/known_hosts matches .github/known_hosts (no drift)', async () => {
+    const repoContent = await Bun.file(REPO_KNOWN_HOSTS).text()
+    const packagedContent = await Bun.file(PACKAGED_RESOURCE).text()
+    expect(packagedContent).toBe(repoContent)
+  })
+})

package/src/lib/known-hosts.ts

@@ -0,0 +1,76 @@
+import {existsSync} from 'node:fs'
+import {join, resolve} from 'node:path'
+
+const FAIL_CLOSED_ERROR =
+  'Pinned SSH known_hosts file not found; reinstall @marcusrbrown/infra or run from the repo checkout'
+
+/**
+ * Resolve the path to the repo-pinned `.github/known_hosts` file.
+ *
+ * SSH commands in this CLI use `StrictHostKeyChecking=yes` but the invoking
+ * user's `~/.ssh/known_hosts` may not contain the pinned host keys for
+ * `metrics.fro.bot`, `gateway.fro.bot`, etc. The repo ships authoritative
+ * host keys in `.github/known_hosts`. When that file exists, SSH commands
+ * should use it via `UserKnownHostsFile=<path>` so host verification succeeds
+ * without weakening `StrictHostKeyChecking`.
+ *
+ * @param repoRoot - Optional override for the repo root directory. Defaults to
+ *   the actual repo root resolved relative to this file's location. Pass a
+ *   custom path in tests to avoid touching the real filesystem.
+ * @returns Absolute path to `.github/known_hosts` if it exists, otherwise null.
+ */
+export function resolveRepoKnownHostsPath(repoRoot?: string): string | null {
+  // This file lives at packages/cli/src/lib/known-hosts.ts
+  // Repo root is 4 levels up: lib → src → cli → packages → repo root
+  const base = repoRoot ?? resolve(import.meta.dir, '..', '..', '..', '..')
+  const candidate = join(base, '.github', 'known_hosts')
+  return existsSync(candidate) ? candidate : null
+}
+
+/**
+ * Resolve the pinned known_hosts file from either layout:
+ *
+ * 1. Repo checkout: `.github/known_hosts` at the monorepo root (4 levels up
+ *    from `src/lib/`).
+ * 2. Installed package: `src/resources/known_hosts` bundled alongside the
+ *    source (1 level up from `src/lib/`, then into `resources/`).
+ *
+ * Prefers the repo checkout layout when both exist. Throws a clear error if
+ * neither is found — fail-closed, never silently falls back to user
+ * `~/.ssh/known_hosts`.
+ *
+ * @param libDir - Override for the directory containing this file (for tests).
+ *   Defaults to `import.meta.dir`.
+ * @returns Absolute path to the pinned known_hosts file.
+ * @throws Error if no pinned known_hosts file is found.
+ */
+export function resolveKnownHostsPath(libDir?: string): string {
+  const dir = libDir ?? import.meta.dir
+
+  // Layout 1: repo checkout — walk up 4 levels from src/lib to repo root
+  const repoRoot = resolve(dir, '..', '..', '..', '..')
+  const repoCandidate = join(repoRoot, '.github', 'known_hosts')
+  if (existsSync(repoCandidate)) return repoCandidate
+
+  // Layout 2: installed package — src/resources/known_hosts is 1 level up from src/lib
+  const packagedCandidate = resolve(dir, '..', 'resources', 'known_hosts')
+  if (existsSync(packagedCandidate)) return packagedCandidate
+
+  throw new Error(FAIL_CLOSED_ERROR)
+}
+
+/**
+ * Build the SSH `-o UserKnownHostsFile=<path>` argument pair for the
+ * repo-pinned known_hosts file.
+ *
+ * Returns `['-o', 'UserKnownHostsFile=<path>']` when the file is found.
+ * Throws a clear error if no pinned known_hosts file is available — fail-closed,
+ * never silently omits `UserKnownHostsFile` for SSH commands that rely on
+ * pinned verification.
+ *
+ * @param libDir - Override for the directory containing this file (for tests).
+ */
+export function buildKnownHostsArgs(libDir?: string): string[] {
+  const path = resolveKnownHostsPath(libDir)
+  return ['-o', `UserKnownHostsFile=${path}`]
+}

package/src/resources/known_hosts

@@ -0,0 +1,28 @@
+box.heatvision.co ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJNjkvxUDLB432BdSnrfYGgYyfUQxrdwV6sNqETNkyqs
+box.heatvision.co ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPnP2/6iqHUeOJX4+aVcFpaal0lLdT6sZrRSF95+MgyCY+p3K21Kgr2xp9eyGJ8splnaJv7Kwv1V7+HC3CMXoqM=
+box.heatvision.co ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCpOziObL6mGk7hT113yo8kElbut5DU6xXoUYw8QWc4ix8iHxJV6T1hLl4wemFkSdA1jUhqhfR94Wdk7DtSGUiq9LidwfmL9ZsrAlnThLJeugZE1f+EtIye9hIqpzmmqMZvHeYFu3zbiB2/Xpc/krTmfKjIOsI0MeOKPAKEiFLG1DU9i5bWKs2ktC8TZCqp+Pfc4xt54Ug4lfLspbGbRZ96SQuxns+SSfyQW5peH13ZMl92/GGA2Tdh3bHausOYI6AvUimd/0mVc6b0bSWVS/k1bdb27rE/6TrZZ4ICXElGkgNndOsX5lFNcJdU+T6pJicA5fO8mpZ/ysakvyesmPigXxYsW3Q/tQkBoQXcKcxi+ItqU/ahJ1I4DObKnvJlu5htr3Gzo4dO5sxpDdufECqgicauFZzvXzD49XZvctRG01ZSy6ZmIekBsiTFHaTMO8zV88/AwVOT8CrgbrmIiwUG6ZfXCPFMztu4Z5IwxMWRnKG2GHWGNBb2/F5PDAz/Xrc=
+
+# cliproxy droplet (147.182.133.210 / cliproxy.fro.bot)
+cliproxy.fro.bot ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEq1Jbp0zCI12p7JIEtDTajBcCQyz0gmHls/BNXYTwIJ
+cliproxy.fro.bot ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNIaI6OauhhSiho+UtAl9ZfP2NkbOo/Pw6i/beGyxl/Z/dqnigruDXWuhlitnAtpOvpeQXOcx3xKSOjX8iQkKXc=
+cliproxy.fro.bot ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDcC+mMGekM5zzg3JcpVQD8Q+eRrhTPZptaG7sz1r5R5WVxdOboZ6xtjCQjCuqafig/PIYsZCnJrgmonW0gdKhpNbwobb9FBF8kFbeOa4rRKUoU7k8nmubWCn87L1GCGAtiX50YcxkxTTzZqHPZKiKRV38ExdfwR8uzeP2k8I/ay1uEjP5P1r/LCqHvKU8Dm3qF+NHZPGb0Ri/Iz9aLj3Mo73/BM8D7fhaG/3WXA+vRLwO+vqaIcGraYd5csNFJEXbpU7FBlnJmeKg4VPN7HJHsI69SGmmqGVHQ75A5e5AlNme/nCZmE5SptUy2mt/Y4/BIShDTfuyLG9Q36P1mC3PT0zZwdl4iAO3fciRo2R4/tSPh4nkFT0gEH79SQkZrV42uR5h6BNtf1/Bob8IAwdZL//1J97oc9EAfSntJQvSrYcMCL5ui+uK3S/V24jqYSsywQwfwGNMgDwDHQ66vP/CMbB86PnNmRajHDyF/vQK1ueSVX5sCEYEmQsx2Q6OPLxM=
+|1|h7erWkle+dN76VrVVAiQPmOSee4=|LkpzPt8SQjsCbnPm+txg5Me1SYM= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDcC+mMGekM5zzg3JcpVQD8Q+eRrhTPZptaG7sz1r5R5WVxdOboZ6xtjCQjCuqafig/PIYsZCnJrgmonW0gdKhpNbwobb9FBF8kFbeOa4rRKUoU7k8nmubWCn87L1GCGAtiX50YcxkxTTzZqHPZKiKRV38ExdfwR8uzeP2k8I/ay1uEjP5P1r/LCqHvKU8Dm3qF+NHZPGb0Ri/Iz9aLj3Mo73/BM8D7fhaG/3WXA+vRLwO+vqaIcGraYd5csNFJEXbpU7FBlnJmeKg4VPN7HJHsI69SGmmqGVHQ75A5e5AlNme/nCZmE5SptUy2mt/Y4/BIShDTfuyLG9Q36P1mC3PT0zZwdl4iAO3fciRo2R4/tSPh4nkFT0gEH79SQkZrV42uR5h6BNtf1/Bob8IAwdZL//1J97oc9EAfSntJQvSrYcMCL5ui+uK3S/V24jqYSsywQwfwGNMgDwDHQ66vP/CMbB86PnNmRajHDyF/vQK1ueSVX5sCEYEmQsx2Q6OPLxM=
+|1|hNHRbNSfyK/BBEM32tiaVoRnRRA=|6KslRRxr9KNaKlbnzkdg1/tQokA= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNIaI6OauhhSiho+UtAl9ZfP2NkbOo/Pw6i/beGyxl/Z/dqnigruDXWuhlitnAtpOvpeQXOcx3xKSOjX8iQkKXc=
+|1|NMQwWGuubNdklyTxDZ5rRgmaq0k=|J3xvvUOXXMYgC0vvsn1zvRDlSVQ= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEq1Jbp0zCI12p7JIEtDTajBcCQyz0gmHls/BNXYTwIJ
+
+# gateway droplet (162.243.163.59 / gateway.fro.bot)
+gateway.fro.bot ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3g6QXCHGjaahf8hMBcRYtDWGAQTBpiUn7yrjVsbIb9U9K7d9yypLaTYzYKU0WFVtVFEi25CcRU5/xB6KOTWOSU/izPlgJ8ht7bNDWmSy6X1JaqxOOh2qQWWRklF+g8I1JwXO0X1Bmu7rFGFqaDEyWKChM19DvRi66x+kPYOeCeACwkYOA1L/SeUpF4H82lWGSiql4rzT7M/n/6RXa5gd4oPG1C8rkM8EqPnpFIZSUNv5/TAhGVsZu1RFJ4OvlZrNQba0LON6DUHTKuUE9o2r+VoaehhOuMDq5gOUAcDEDpPdyfCgnWvRkiLZ5osqw5ECcAGhIxXVYdpGhmX157UmLDKosowRbqPibetCJQ4sisa2WPm5jIrQnf/65mFOlkfIIYuzi0OBFG7VOaU0H8+AAOUQ9fnjseIQJV7GaD9F7viE+zgMoCB1fUlG04iIdJ2SgXRLt2+4uUfwuYSJHTvQUxs+6uMtzFQwHUZpBVE71I0g40beyulok7qiCxIBmLZ8=
+gateway.fro.bot ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGCGPvUmuVd8X6/CxbvhTjjO0Ee6rS1D6XujRgmVl0zcHYIFUYLAFZVosN0RKvcmdmppm64PxH/cLAx7gvKF3t0=
+gateway.fro.bot ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUfj6wqjyh+BLIqHlRxfFlRpBuesAAnUYllFbWN9qzw
+
+|1|8fBUi0jyLBNX5eBIp6NllCFFwVw=|gC1yH9h2zglwFYgKVhvslvDqgqE= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3g6QXCHGjaahf8hMBcRYtDWGAQTBpiUn7yrjVsbIb9U9K7d9yypLaTYzYKU0WFVtVFEi25CcRU5/xB6KOTWOSU/izPlgJ8ht7bNDWmSy6X1JaqxOOh2qQWWRklF+g8I1JwXO0X1Bmu7rFGFqaDEyWKChM19DvRi66x+kPYOeCeACwkYOA1L/SeUpF4H82lWGSiql4rzT7M/n/6RXa5gd4oPG1C8rkM8EqPnpFIZSUNv5/TAhGVsZu1RFJ4OvlZrNQba0LON6DUHTKuUE9o2r+VoaehhOuMDq5gOUAcDEDpPdyfCgnWvRkiLZ5osqw5ECcAGhIxXVYdpGhmX157UmLDKosowRbqPibetCJQ4sisa2WPm5jIrQnf/65mFOlkfIIYuzi0OBFG7VOaU0H8+AAOUQ9fnjseIQJV7GaD9F7viE+zgMoCB1fUlG04iIdJ2SgXRLt2+4uUfwuYSJHTvQUxs+6uMtzFQwHUZpBVE71I0g40beyulok7qiCxIBmLZ8=
+|1|XsFKIlbq2aifqw1if+WGnRz0MBs=|LrHknyfL8diBLT1G7+ss8+9Kbaw= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGCGPvUmuVd8X6/CxbvhTjjO0Ee6rS1D6XujRgmVl0zcHYIFUYLAFZVosN0RKvcmdmppm64PxH/cLAx7gvKF3t0=
+|1|Ytflq7+lWpR/TNEQ8C/wvirEIsc=|hcnjv25+apKJxy6UlAHhtR0baRI= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUfj6wqjyh+BLIqHlRxfFlRpBuesAAnUYllFbWN9qzw
+
+# umami droplet (167.99.236.120 / metrics.fro.bot)
+metrics.fro.bot ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICRCMPA99bZJ1w+QdZPrTzLK06LF7t91tb0GbKfBkA72
+metrics.fro.bot ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCma/Y9qRPlZ8v1wnQQBfwghQ0XbtSMn7QHVgIFGBjbO+Xqim7Lv9EArn58HIVACsZKMD0e9T90r70TDXYTWuZ6+RQ2x2soE6DcG/T/2wyan40hVtXLSCg8hx9DNjLR3RBwkiJcbdrYCqpDmi4kOuJAJ+b5JxUhJAkdF5M9xhUko59HtUm5I/j1T2Df60+7CdKMGZKMrCRios/q4lvgImuWS3aZuNQNuJiv6rfhX7L9LqezlJUgw1AbOzaqPXbZ9xpzt8yklGZQNa5I/CS6pEgn4/SKiRsetpgd4SCB9UuCR7ia/M0VU8itNPMZY11Pi+YwJKfJVZDtS+OSFkFxea8B1MyxDZkvOwnzYVx9xG6W48Oi06x4pQgJcqq5V52xM4upSlVtws5gTLNm/3KaJZ3kb7IK4HnTEUQrz/UShtyP1crsqwj5eoDnvcUfaMHx/YC/7LlQFp8AO8W/KEYWzlycJpZLqPrO/gqoiR0AG9NMP0SSRaD7M2pcQ4tKM1xyopE=
+metrics.fro.bot ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOm6bQkB9dGaPJAVbk9IrVxZSM0KrkUikv8JgVrW0iJMKorJ233GaK03n2/5cuAJ/D3z6nN/pF6QGApWfm6s/JA=
+|1|8o6qExp0klmE80pMU2CYvmbGqSQ=|064FdS/NWWEIU7EjmGBCwCek+DE= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICRCMPA99bZJ1w+QdZPrTzLK06LF7t91tb0GbKfBkA72
+|1|1nwXP2iRwBq0GXyE94EXYJuaUCQ=|Wxoe6EvzjZbk02Hr4mx1YZOciUM= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCma/Y9qRPlZ8v1wnQQBfwghQ0XbtSMn7QHVgIFGBjbO+Xqim7Lv9EArn58HIVACsZKMD0e9T90r70TDXYTWuZ6+RQ2x2soE6DcG/T/2wyan40hVtXLSCg8hx9DNjLR3RBwkiJcbdrYCqpDmi4kOuJAJ+b5JxUhJAkdF5M9xhUko59HtUm5I/j1T2Df60+7CdKMGZKMrCRios/q4lvgImuWS3aZuNQNuJiv6rfhX7L9LqezlJUgw1AbOzaqPXbZ9xpzt8yklGZQNa5I/CS6pEgn4/SKiRsetpgd4SCB9UuCR7ia/M0VU8itNPMZY11Pi+YwJKfJVZDtS+OSFkFxea8B1MyxDZkvOwnzYVx9xG6W48Oi06x4pQgJcqq5V52xM4upSlVtws5gTLNm/3KaJZ3kb7IK4HnTEUQrz/UShtyP1crsqwj5eoDnvcUfaMHx/YC/7LlQFp8AO8W/KEYWzlycJpZLqPrO/gqoiR0AG9NMP0SSRaD7M2pcQ4tKM1xyopE=
+|1|lwRlQiSSd0h7iti76fvRXTtbkSw=|D//yCCMd1iZftlbjJ0NhKCCf5/8= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOm6bQkB9dGaPJAVbk9IrVxZSM0KrkUikv8JgVrW0iJMKorJ233GaK03n2/5cuAJ/D3z6nN/pF6QGApWfm6s/JA=