@marcusrbrown/infra 0.9.12 → 0.9.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",

package/src/commands/gateway/backup.test.ts

@@ -265,6 +265,79 @@ describe('backupGatewayCa — atomic write (COR2)', () => {
   })
 })
 
+// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
+
+describe('backupGatewayCa — SSH command includes UserKnownHostsFile', () => {
+  let tmpOutput: string
+
+  beforeEach(() => {
+    tmpOutput = `/tmp/test-backup-known-hosts-${Date.now()}.tar`
+  })
+
+  afterEach(async () => {
+    try {
+      ;(await Bun.file(tmpOutput).exists()) && Bun.spawnSync(['rm', '-f', tmpOutput])
+    } catch {
+      // ignore
+    }
+  })
+
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh', async () => {
+    let capturedCmd: string[] = []
+    const spawnCapture: BackupSpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(new Uint8Array([1, 2, 3]))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(controller) {
+            controller.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await backupGatewayCa({host: 'gateway.example.com', output: tmpOutput, includeCa: true}, spawnCapture)
+
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
+    let capturedCmd: string[] = []
+    const spawnCapture: BackupSpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(new Uint8Array([1, 2, 3]))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(controller) {
+            controller.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await backupGatewayCa({host: 'gateway.example.com', output: tmpOutput, includeCa: true}, spawnCapture)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})
+
 // ─── SEC1: Tmp file born with mode 0600 (no chmod race) ──────────────────────
 
 describe('backupGatewayCa — SEC1: tmp file created with mode 0600 atomically', () => {

package/src/commands/gateway/backup.ts

@@ -5,6 +5,7 @@ import type {ActionCtx} from '../../lib/action-ctx'
 import {closeSync, constants as fsConstants, openSync, renameSync, unlinkSync, writeSync} from 'node:fs'
 
 import {z} from 'zod'
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {validateGatewayHost} from './host'
 
 declare const process: {
@@ -69,6 +70,7 @@ export async function backupGatewayCa(
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     `root@${opts.host}`,
     `docker run --rm -v ${MITMPROXY_CERTS_VOLUME}:/src:ro alpine tar -cf - -C /src ${CA_CERT_FILE} ${CA_KEY_FILE}`,
   ]

package/src/commands/gateway/logs.test.ts

@@ -220,3 +220,44 @@ describe('tail forwarding', () => {
     expect(capturedCmd.join(' ')).toContain('--tail=25')
   })
 })
+
+// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
+
+describe('streamGatewayLogs — SSH command includes UserKnownHostsFile', () => {
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh', async () => {
+    delete process.env.CI
+
+    const {streamGatewayLogs} = await import('./logs')
+
+    let capturedCmd: string[] = []
+    const spawnCapture: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamGatewayLogs({host: 'gateway.example.com', service: 'gateway', tail: 100, allowCi: false}, spawnCapture)
+
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
+    delete process.env.CI
+
+    const {streamGatewayLogs} = await import('./logs')
+
+    let capturedCmd: string[] = []
+    const spawnCapture: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamGatewayLogs({host: 'gateway.example.com', service: 'gateway', tail: 100, allowCi: false}, spawnCapture)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})

package/src/commands/gateway/logs.ts

@@ -2,6 +2,7 @@ import type {goke} from 'goke'
 
 import {z} from 'zod'
 
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {validateGatewayHost} from './host'
 
 declare const process: {
@@ -88,6 +89,7 @@ export async function streamGatewayLogs(
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     `root@${opts.host}`,
     `docker compose --project-directory ${COMPOSE_PROJECT_DIR} logs --no-color --tail=${opts.tail} ${opts.service}`,
   ]

package/src/commands/gateway/restore.test.ts

@@ -403,6 +403,162 @@ describe('restoreGatewayCa — SEC2: unguessable remote tmp path via mktemp', ()
   })
 })
 
+// ─── SSH and SCP commands include repo-pinned UserKnownHostsFile ─────────────
+
+describe('restoreGatewayCa — SSH and SCP commands include UserKnownHostsFile', () => {
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to every ssh invocation', async () => {
+    const tarDir = `/tmp/test-kh-ssh-tar-dir-${Date.now()}`
+    const realTar = `/tmp/test-kh-ssh-tar-${Date.now()}.tar`
+    const certContent = 'CERT'
+    const keyContent = 'KEY'
+    Bun.spawnSync(['mkdir', '-p', tarDir])
+    await Bun.write(`${tarDir}/mitmproxy-ca-cert.pem`, certContent)
+    await Bun.write(`${tarDir}/mitmproxy-ca.pem`, keyContent)
+    Bun.spawnSync(['tar', '-cf', realTar, '-C', tarDir, 'mitmproxy-ca-cert.pem', 'mitmproxy-ca.pem'])
+
+    const capturedCmds: string[][] = []
+    const spawnCapture: RestoreSpawnFn = (cmd, _opts) => {
+      capturedCmds.push([...cmd])
+      const cmdStr = cmd.join(' ')
+      const isTarTf = cmd[0] === 'tar' && cmd.includes('-tf')
+      const isMktemp = cmdStr.includes('mktemp')
+      const encoder = new TextEncoder()
+      let stdout = ''
+      if (isTarTf) stdout = 'mitmproxy-ca-cert.pem\nmitmproxy-ca.pem\n'
+      else if (isMktemp) stdout = '/tmp/gateway-ca-restore-kh-test.tar\n'
+      else stdout = certContent
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(stdout))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(controller) {
+            controller.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await restoreGatewayCa({host: 'gateway.example.com', input: realTar, includeCa: true}, spawnCapture)
+
+    // Every ssh invocation must include UserKnownHostsFile
+    const sshCmds = capturedCmds.filter(c => c[0] === 'ssh')
+    expect(sshCmds.length).toBeGreaterThan(0)
+    for (const sshCmd of sshCmds) {
+      const knownHostsIdx = sshCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+      expect(knownHostsIdx).toBeGreaterThan(-1)
+      expect(sshCmd[knownHostsIdx - 1]).toBe('-o')
+      expect(sshCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+    }
+
+    Bun.spawnSync(['rm', '-rf', tarDir, realTar])
+  })
+
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to the scp invocation', async () => {
+    const tarDir = `/tmp/test-kh-scp-tar-dir-${Date.now()}`
+    const realTar = `/tmp/test-kh-scp-tar-${Date.now()}.tar`
+    const certContent = 'CERT'
+    const keyContent = 'KEY'
+    Bun.spawnSync(['mkdir', '-p', tarDir])
+    await Bun.write(`${tarDir}/mitmproxy-ca-cert.pem`, certContent)
+    await Bun.write(`${tarDir}/mitmproxy-ca.pem`, keyContent)
+    Bun.spawnSync(['tar', '-cf', realTar, '-C', tarDir, 'mitmproxy-ca-cert.pem', 'mitmproxy-ca.pem'])
+
+    const capturedCmds: string[][] = []
+    const spawnCapture: RestoreSpawnFn = (cmd, _opts) => {
+      capturedCmds.push([...cmd])
+      const cmdStr = cmd.join(' ')
+      const isTarTf = cmd[0] === 'tar' && cmd.includes('-tf')
+      const isMktemp = cmdStr.includes('mktemp')
+      const encoder = new TextEncoder()
+      let stdout = ''
+      if (isTarTf) stdout = 'mitmproxy-ca-cert.pem\nmitmproxy-ca.pem\n'
+      else if (isMktemp) stdout = '/tmp/gateway-ca-restore-kh-scp-test.tar\n'
+      else stdout = certContent
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(stdout))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(controller) {
+            controller.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await restoreGatewayCa({host: 'gateway.example.com', input: realTar, includeCa: true}, spawnCapture)
+
+    const scpCmd = capturedCmds.find(c => c[0] === 'scp')
+    expect(scpCmd).toBeDefined()
+    const knownHostsIdx = scpCmd!.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(scpCmd![knownHostsIdx - 1]).toBe('-o')
+    expect(scpCmd![knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+
+    Bun.spawnSync(['rm', '-rf', tarDir, realTar])
+  })
+
+  it('does not weaken StrictHostKeyChecking in ssh or scp commands', async () => {
+    const tarDir = `/tmp/test-kh-strict-tar-dir-${Date.now()}`
+    const realTar = `/tmp/test-kh-strict-tar-${Date.now()}.tar`
+    const certContent = 'CERT'
+    const keyContent = 'KEY'
+    Bun.spawnSync(['mkdir', '-p', tarDir])
+    await Bun.write(`${tarDir}/mitmproxy-ca-cert.pem`, certContent)
+    await Bun.write(`${tarDir}/mitmproxy-ca.pem`, keyContent)
+    Bun.spawnSync(['tar', '-cf', realTar, '-C', tarDir, 'mitmproxy-ca-cert.pem', 'mitmproxy-ca.pem'])
+
+    const capturedCmds: string[][] = []
+    const spawnCapture: RestoreSpawnFn = (cmd, _opts) => {
+      capturedCmds.push([...cmd])
+      const cmdStr = cmd.join(' ')
+      const isTarTf = cmd[0] === 'tar' && cmd.includes('-tf')
+      const isMktemp = cmdStr.includes('mktemp')
+      const encoder = new TextEncoder()
+      let stdout = ''
+      if (isTarTf) stdout = 'mitmproxy-ca-cert.pem\nmitmproxy-ca.pem\n'
+      else if (isMktemp) stdout = '/tmp/gateway-ca-restore-kh-strict-test.tar\n'
+      else stdout = certContent
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(stdout))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(controller) {
+            controller.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await restoreGatewayCa({host: 'gateway.example.com', input: realTar, includeCa: true}, spawnCapture)
+
+    // All ssh and scp commands must have StrictHostKeyChecking=yes
+    const sshAndScpCmds = capturedCmds.filter(c => c[0] === 'ssh' || c[0] === 'scp')
+    expect(sshAndScpCmds.length).toBeGreaterThan(0)
+    for (const cmd of sshAndScpCmds) {
+      const strictIdx = cmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+      expect(strictIdx).toBeGreaterThan(-1)
+      expect(cmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+    }
+
+    Bun.spawnSync(['rm', '-rf', tarDir, realTar])
+  })
+})
+
 // ─── COR1: validateBackupArchive ─────────────────────────────────────────────
 
 describe('validateBackupArchive — COR1', () => {

package/src/commands/gateway/restore.ts

@@ -2,6 +2,7 @@ import type {goke} from 'goke'
 
 import {z} from 'zod'
 
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {validateGatewayHost} from './host'
 
 declare const process: {
@@ -38,7 +39,16 @@ export type RestoreResult = {ok: true; confirmed: true} | {ok: false; error: str
 
 /** Returns the argv array for an SSH command to the given host. */
 function sshCommand(host: string, remote: string): string[] {
-  return ['ssh', '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes', `root@${host}`, remote]
+  return [
+    'ssh',
+    '-o',
+    'BatchMode=yes',
+    '-o',
+    'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
+    `root@${host}`,
+    remote,
+  ]
 }
 
 async function spawnText(
@@ -143,6 +153,7 @@ export async function restoreGatewayCa(
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     opts.input,
     `root@${opts.host}:${tmpRemote}`,
   ]

package/src/commands/gateway/status.test.ts

@@ -139,6 +139,71 @@ function makeSpawnError(message: string): SpawnFn {
   }
 }
 
+// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
+
+describe('getGatewayComposeStatus — SSH command includes UserKnownHostsFile', () => {
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh when the file exists', async () => {
+    const {getGatewayComposeStatus} = await import('./status')
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(JSON.stringify([{Name: 'gateway', State: 'running', Health: 'healthy'}])))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getGatewayComposeStatus('gateway.fro.bot', capturingSpawn)
+
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
+    const {getGatewayComposeStatus} = await import('./status')
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const encoder = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(controller) {
+            controller.enqueue(encoder.encode(JSON.stringify([{Name: 'gateway', State: 'running', Health: 'healthy'}])))
+            controller.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getGatewayComposeStatus('gateway.fro.bot', capturingSpawn)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})
+
 describe('getGatewayComposeStatus — host validation (SEC1)', () => {
   it('rejects a leading-hyphen host and does not invoke ssh', async () => {
     const {getGatewayComposeStatus} = await import('./status')

package/src/commands/gateway/status.ts

@@ -3,6 +3,7 @@ import type {ActionCtx} from '../../lib/action-ctx'
 import type {StatusSummary} from '../status'
 import {z} from 'zod'
 
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {redactHost} from '../../lib/redact'
 // ─── Minimal ctx interface (subset of GokeExecutionContext used by this action) ─
 import {validateGatewayHost} from './host'
@@ -108,6 +109,7 @@ export async function getGatewayComposeStatus(
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     `root@${host}`,
     `docker compose --project-directory ${COMPOSE_PROJECT_DIR} ps --format json`,
   ]

package/src/commands/keeweb/status.test.ts

@@ -181,23 +181,73 @@ describe('keeweb status helpers', () => {
   })
 
   describe('checkContentHash', () => {
-    it('resolves dist path at correct depth from restructured location', async () => {
-      // Regression test for P1 path depth bug: after restructure from
-      // commands/keeweb-status.ts to commands/keeweb/status.ts, the path
-      // needs 5 levels of ../ to reach apps/keeweb/dist/index.html
-      let capturedPath = ''
-      fileSpy = spyOn(Bun, 'file').mockImplementation((...args: unknown[]) => {
-        capturedPath = String(args[0])
-        return {exists: async () => false} as ReturnType<typeof Bun.file>
-      })
+    it('does not emit a path-noisy warning when running from a packaged install (bunx)', async () => {
+      // Simulate packaged layout: moduleDir is inside node_modules (bunx temp install)
+      const packagedDir = '/private/var/folders/xx/T/bunx-1234/node_modules/@marcusrbrown/infra/src/commands/keeweb'
+      // Bun.file should not be called for the dist path in packaged mode,
+      // but if it is, return false to avoid false positives
+      fileSpy = spyOn(Bun, 'file').mockImplementation(
+        () =>
+          ({
+            exists: async () => false,
+          }) as ReturnType<typeof Bun.file>,
+      )
 
-      await checkContentHash(false)
+      const result = await checkContentHash(false, packagedDir)
+
+      // Must NOT contain the bogus node_modules path in the summary
+      expect(result.summary).not.toContain('node_modules/apps/keeweb')
+      expect(result.summary).not.toContain('/private/var/folders')
+      // Must clearly communicate that local dist is unavailable from packaged CLI
+      expect(result.summary.toLowerCase()).toMatch(/not available|unavailable|packaged|source checkout/)
+      // Level should be info (neutral — not a warning for packaged installs)
+      expect(result.level).toBe('info')
+    })
+
+    it('does not emit path-noisy warning for any node_modules install path', async () => {
+      // Simulate npm/npx global install: node_modules path but not bunx temp
+      const npmInstallDir = '/usr/local/lib/node_modules/@marcusrbrown/infra/src/commands/keeweb'
+      fileSpy = spyOn(Bun, 'file').mockImplementation(
+        () =>
+          ({
+            exists: async () => false,
+          }) as ReturnType<typeof Bun.file>,
+      )
+
+      const result = await checkContentHash(false, npmInstallDir)
+
+      expect(result.summary).not.toContain('node_modules/apps/keeweb')
+      expect(result.summary.toLowerCase()).toMatch(/not available|unavailable|packaged|source checkout/)
+    })
+
+    it('does not emit path-noisy warning when running from an unpacked tarball outside node_modules', async () => {
+      // Simulate unpacked tarball layout: e.g. `npm pack` + extract to /tmp/pkg/package/
+      // The path does NOT contain node_modules, but also has no repo apps/keeweb/src tree.
+      const unpackedTarballDir = '/tmp/pkg/package/src/commands/keeweb'
+      fileSpy = spyOn(Bun, 'file').mockImplementation(
+        () =>
+          ({
+            exists: async () => false,
+          }) as ReturnType<typeof Bun.file>,
+      )
+
+      const result = await checkContentHash(false, unpackedTarballDir)
 
-      expect(capturedPath).toContain('apps/keeweb/dist/index.html')
-      expect(capturedPath).not.toContain('commands/keeweb/apps')
+      // Must NOT contain the raw temp path in the summary
+      expect(result.summary).not.toContain('/tmp/pkg/package')
+      // Must NOT contain the path-noisy "Local dist file not found: ..." message
+      expect(result.summary).not.toMatch(/Local dist file not found/)
+      // Must clearly communicate that local dist is unavailable from packaged CLI
+      expect(result.summary.toLowerCase()).toMatch(/not available|unavailable|packaged|source checkout/)
+      // Level should be info (neutral — not a warning for packaged installs)
+      expect(result.level).toBe('info')
     })
 
-    it('returns warning when the local dist file does not exist', async () => {
+    it('packaged install content hash level is info, not warning', async () => {
+      // Packaged/non-source installs should not degrade status with a warning.
+      // The content hash check is a source-only local comparison; when not in a
+      // source checkout, the result should be neutral (info), not warning.
+      const packagedDir = '/private/var/folders/xx/T/bunx-1234/node_modules/@marcusrbrown/infra/src/commands/keeweb'
       fileSpy = spyOn(Bun, 'file').mockImplementation(
         () =>
           ({
@@ -205,10 +255,111 @@ describe('keeweb status helpers', () => {
           }) as ReturnType<typeof Bun.file>,
       )
 
-      const result = await checkContentHash(false)
+      const result = await checkContentHash(false, packagedDir)
+
+      expect(result.level).toBe('info')
+      expect(result.summary.toLowerCase()).toMatch(/not available|unavailable|packaged|source checkout/)
+    })
+
+    it('source checkout with matching hashes returns ok', async () => {
+      // Simulate source checkout: marker file exists, dist file exists, hashes match.
+      const sourceCheckoutDir = '/home/user/projects/infra/packages/cli/src/commands/keeweb'
+      const htmlContent = '<html>KeeWeb</html>'
+
+      fileSpy = spyOn(Bun, 'file').mockImplementation((pathArg: unknown) => {
+        const p = String(pathArg)
+        if (p.endsWith('apps/keeweb/src/build.ts')) {
+          return {exists: async () => true} as ReturnType<typeof Bun.file>
+        }
+        if (p.endsWith('apps/keeweb/dist/index.html')) {
+          return {
+            exists: async () => true,
+            text: async () => htmlContent,
+          } as ReturnType<typeof Bun.file>
+        }
+        return {exists: async () => false} as ReturnType<typeof Bun.file>
+      })
+
+      fetchMock.mockImplementation(createFetchImplementation(async () => new Response(htmlContent, {status: 200})))
+
+      const result = await checkContentHash(false, sourceCheckoutDir)
+
+      expect(result.level).toBe('ok')
+      expect(result.summary).toContain('matches')
+    })
+
+    it('source checkout with mismatched hashes returns warning', async () => {
+      // Simulate source checkout: marker file exists, dist file exists, hashes differ.
+      const sourceCheckoutDir = '/home/user/projects/infra/packages/cli/src/commands/keeweb'
+      const localHtml = '<html>KeeWeb local</html>'
+      const remoteHtml = '<html>KeeWeb remote</html>'
+
+      fileSpy = spyOn(Bun, 'file').mockImplementation((pathArg: unknown) => {
+        const p = String(pathArg)
+        if (p.endsWith('apps/keeweb/src/build.ts')) {
+          return {exists: async () => true} as ReturnType<typeof Bun.file>
+        }
+        if (p.endsWith('apps/keeweb/dist/index.html')) {
+          return {
+            exists: async () => true,
+            text: async () => localHtml,
+          } as ReturnType<typeof Bun.file>
+        }
+        return {exists: async () => false} as ReturnType<typeof Bun.file>
+      })
+
+      fetchMock.mockImplementation(createFetchImplementation(async () => new Response(remoteHtml, {status: 200})))
+
+      const result = await checkContentHash(false, sourceCheckoutDir)
+
+      expect(result.level).toBe('warning')
+      expect(result.summary).toContain('differs')
+    })
+
+    it('resolves dist path at correct depth from restructured location (path-sensitive mock)', async () => {
+      // Regression test for P1 path depth bug: after restructure from
+      // commands/keeweb-status.ts to commands/keeweb/status.ts, the path
+      // needs 5 levels of ../ to reach apps/keeweb/dist/index.html.
+      //
+      // Uses path-sensitive mock: marker returns true, dist returns false.
+      // This exercises the dist path check and lets us assert the correct path.
+      const capturedPaths: string[] = []
+      fileSpy = spyOn(Bun, 'file').mockImplementation((pathArg: unknown) => {
+        const p = String(pathArg)
+        capturedPaths.push(p)
+        if (p.endsWith('apps/keeweb/src/build.ts')) {
+          return {exists: async () => true} as ReturnType<typeof Bun.file>
+        }
+        return {exists: async () => false} as ReturnType<typeof Bun.file>
+      })
+
+      await checkContentHash(false)
+
+      // The dist path must appear in the captured paths
+      const distPath = capturedPaths.find(p => p.endsWith('apps/keeweb/dist/index.html'))
+      expect(distPath).toBeDefined()
+      expect(distPath).not.toContain('commands/keeweb/apps')
+    })
+
+    it('returns warning when the local dist file does not exist in source checkout (path-sensitive mock)', async () => {
+      // Simulate source checkout: marker exists, dist file missing (needs a build).
+      // Uses path-sensitive mock instead of call-count ordering.
+      const sourceCheckoutDir = '/home/user/projects/infra/packages/cli/src/commands/keeweb'
+      fileSpy = spyOn(Bun, 'file').mockImplementation((pathArg: unknown) => {
+        const p = String(pathArg)
+        if (p.endsWith('apps/keeweb/src/build.ts')) {
+          return {exists: async () => true} as ReturnType<typeof Bun.file>
+        }
+        // dist/index.html → missing
+        return {exists: async () => false} as ReturnType<typeof Bun.file>
+      })
+
+      const result = await checkContentHash(false, sourceCheckoutDir)
 
       expect(result.level).toBe('warning')
       expect(result.summary).toContain('not found')
+      expect(result.details).toEqual(expect.arrayContaining(['Run: bun run --cwd apps/keeweb build']))
+      expect(result.summary).not.toContain('node_modules')
     })
   })
 })

package/src/commands/keeweb/status.ts

@@ -10,7 +10,7 @@ const SITE_URL = 'https://kw.igg.ms/'
 const GH_REPO = 'marcusrbrown/infra'
 const HTTP_TIMEOUT_MS = 10_000
 
-type CheckLevel = 'ok' | 'warning' | 'error'
+type CheckLevel = 'ok' | 'info' | 'warning' | 'error'
 
 interface CheckResult {
   title: string
@@ -31,6 +31,10 @@ function levelLabel(level: CheckLevel): string {
     return 'OK'
   }
 
+  if (level === 'info') {
+    return 'INFO'
+  }
+
   if (level === 'warning') {
     return 'WARN'
   }
@@ -192,8 +196,44 @@ export async function checkLastDeploy(verbose: boolean): Promise<CheckResult> {
   }
 }
 
-export async function checkContentHash(verbose: boolean): Promise<CheckResult> {
-  const distIndexPath = path.resolve(import.meta.dir, '../../../../../apps/keeweb/dist/index.html')
+/**
+ * Detect whether moduleDir belongs to a source checkout of this monorepo.
+ *
+ * A source checkout has the repo root at 5 levels above the keeweb command
+ * directory (packages/cli/src/commands/keeweb → repo root). We confirm the
+ * layout by checking for a source-only marker file that is never shipped in
+ * the CLI package. This is more robust than checking for `node_modules` in
+ * the path, which misses unpacked tarballs and global-style installs.
+ */
+async function isSourceCheckout(resolvedModuleDir: string): Promise<boolean> {
+  // Candidate repo root is 5 levels up from packages/cli/src/commands/keeweb
+  const candidateRoot = path.resolve(resolvedModuleDir, '../../../../../')
+  // apps/keeweb/src/build.ts is a source-only file never included in the CLI package
+  const sourceMarker = path.join(candidateRoot, 'apps', 'keeweb', 'src', 'build.ts')
+  return Bun.file(sourceMarker).exists()
+}
+
+export async function checkContentHash(verbose: boolean, moduleDir?: string): Promise<CheckResult> {
+  const resolvedModuleDir = moduleDir ?? import.meta.dir
+  const distIndexPath = path.resolve(resolvedModuleDir, '../../../../../apps/keeweb/dist/index.html')
+
+  // When running from a packaged install (bunx, npm global, unpacked tarball, etc.),
+  // the resolved path has no repo apps/keeweb source tree — the KeeWeb dist is not
+  // shipped with the CLI package. Emit a clean, non-path-noisy message instead of
+  // a scary temp path. We detect source checkout by looking for a source-only marker
+  // file rather than relying on `node_modules` in the path (which misses tarballs).
+  const sourceCheckout = await isSourceCheckout(resolvedModuleDir)
+  if (!sourceCheckout) {
+    return {
+      title: 'Content hash',
+      level: 'info',
+      summary: 'Content hash not available: local KeeWeb dist is only present in a source checkout',
+      details: verbose
+        ? ['Clone the repo and run: bun run --cwd apps/keeweb build', 'Then re-run status from the source checkout']
+        : undefined,
+    }
+  }
+
   const localFile = Bun.file(distIndexPath)
   const localExists = await localFile.exists()
 

package/src/commands/umami/logs.test.ts

@@ -152,3 +152,40 @@ describe('logs command', () => {
     expect(spawnCalled).toBe(false)
   })
 })
+
+// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
+
+describe('streamUmamiLogs — SSH command includes UserKnownHostsFile', () => {
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh', async () => {
+    delete process.env.CI
+
+    let capturedCmd: string[] = []
+    const spawnCapture: LogsSpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamUmamiLogs({host: 'metrics.fro.bot', service: 'umami', tail: 100, allowCi: false}, spawnCapture)
+
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
+    delete process.env.CI
+
+    let capturedCmd: string[] = []
+    const spawnCapture: LogsSpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamUmamiLogs({host: 'metrics.fro.bot', service: 'umami', tail: 100, allowCi: false}, spawnCapture)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})

package/src/commands/umami/logs.ts

@@ -2,6 +2,7 @@ import type {goke} from 'goke'
 
 import {z} from 'zod'
 
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {validateUmamiHost} from './host'
 
 declare const process: {
@@ -91,6 +92,7 @@ export async function streamUmamiLogs(
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     `root@${opts.host}`,
     `docker compose --project-directory ${COMPOSE_PROJECT_DIR} logs --no-color --tail=${opts.tail} ${opts.service}`,
   ]

package/src/commands/umami/status.test.ts

@@ -133,6 +133,70 @@ function makeSpawn(stdout: string, stderr = '', exitCode = 0): SpawnFn {
   }
 }
 
+// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
+
+describe('getUmamiComposeStatus — SSH command includes UserKnownHostsFile', () => {
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh when the file exists', async () => {
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const enc = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.enqueue(enc.encode(JSON.stringify([{Name: 'umami', State: 'running', Health: 'healthy'}])))
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getUmamiComposeStatus('metrics.fro.bot', capturingSpawn)
+
+    // Find the UserKnownHostsFile option in the ssh command
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
+    let capturedCmd: string[] = []
+
+    const capturingSpawn: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      const enc = new TextEncoder()
+      return {
+        stdout: new ReadableStream({
+          start(c) {
+            c.enqueue(enc.encode(JSON.stringify([{Name: 'umami', State: 'running', Health: 'healthy'}])))
+            c.close()
+          },
+        }),
+        stderr: new ReadableStream({
+          start(c) {
+            c.close()
+          },
+        }),
+        exited: Promise.resolve(0),
+      }
+    }
+
+    await getUmamiComposeStatus('metrics.fro.bot', capturingSpawn)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})
+
 describe('getUmamiComposeStatus', () => {
   it('returns service rows from NDJSON output', async () => {
     const ndjson = [

package/src/commands/umami/status.ts

@@ -3,6 +3,7 @@ import type {ActionCtx} from '../../lib/action-ctx'
 import type {StatusSummary} from '../status'
 import {z} from 'zod'
 
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
 import {redactHost} from '../../lib/redact'
 import {validateUmamiHost} from './host'
 
@@ -102,6 +103,7 @@ export async function getUmamiComposeStatus(host: string, spawn: SpawnFn = defau
     'BatchMode=yes',
     '-o',
     'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
     `root@${host}`,
     `docker compose --project-directory ${COMPOSE_PROJECT_DIR} ps --format json`,
   ]

package/src/conventions.test.ts

@@ -276,6 +276,30 @@ describe('repo conventions', () => {
     expect(offenders).toEqual([])
   })
 
+  it('opencode.jsonc mcp.infra.command uses local repo source (not bunx published package)', async () => {
+    const jsoncText = await Bun.file(resolve(REPO_ROOT, 'opencode.jsonc')).text()
+    const stripped = jsoncText
+      .split('\n')
+      .map(line => (/^\s*\/\//.test(line) ? '' : line))
+      .join('\n')
+      .replaceAll(/,(\s*[}\]])/g, '$1')
+    const opencode = JSON.parse(stripped) as {mcp?: {infra?: {command?: unknown}}}
+
+    const infraCommand = opencode.mcp?.infra?.command
+    expect(Array.isArray(infraCommand), 'mcp.infra.command must be an array').toBe(true)
+
+    const cmd = infraCommand as string[]
+    expect(
+      cmd,
+      'mcp.infra.command must be ["bun", "run", "packages/cli/src/cli.ts", "mcp"] — use local source, not bunx',
+    ).toEqual(['bun', 'run', 'packages/cli/src/cli.ts', 'mcp'])
+
+    // Explicit regression guard: bunx @marcusrbrown/infra resolves stale published
+    // package cache and exits before the MCP handshake, causing connection closed.
+    expect(cmd.join(' ')).not.toContain('bunx')
+    expect(cmd.join(' ')).not.toContain('@marcusrbrown/infra')
+  })
+
   it('gates every sensitive infra MCP tool in opencode.jsonc', async () => {
     // Parse opencode.jsonc tolerantly: it uses JSONC syntax (// line comments,
     // trailing commas). Strategy:

package/src/lib/known-hosts.test.ts

@@ -0,0 +1,192 @@
+import {existsSync, mkdirSync, rmSync, writeFileSync} from 'node:fs'
+import {tmpdir} from 'node:os'
+import {join, resolve} from 'node:path'
+
+import {describe, expect, it} from 'bun:test'
+
+import {buildKnownHostsArgs, resolveKnownHostsPath, resolveRepoKnownHostsPath} from './known-hosts'
+
+// ─── resolveRepoKnownHostsPath ────────────────────────────────────────────────
+
+describe('resolveRepoKnownHostsPath', () => {
+  it('returns the path to .github/known_hosts when it exists at the repo root', () => {
+    // The actual repo has .github/known_hosts — this test runs from the repo root
+    const result = resolveRepoKnownHostsPath()
+
+    expect(result).not.toBeNull()
+    expect(result).toMatch(/\.github[/\\]known_hosts$/)
+    if (result) expect(existsSync(result)).toBe(true)
+  })
+
+  it('returns null when a custom base path has no .github/known_hosts', () => {
+    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
+    mkdirSync(tmpDir, {recursive: true})
+
+    try {
+      const result = resolveRepoKnownHostsPath(tmpDir)
+      expect(result).toBeNull()
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('returns the path when a custom base path has .github/known_hosts', () => {
+    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
+    const githubDir = join(tmpDir, '.github')
+    mkdirSync(githubDir, {recursive: true})
+    writeFileSync(join(githubDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
+
+    try {
+      const result = resolveRepoKnownHostsPath(tmpDir)
+      expect(result).not.toBeNull()
+      expect(result).toBe(join(tmpDir, '.github', 'known_hosts'))
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+})
+
+// ─── resolveKnownHostsPath (new: multi-layout resolution) ────────────────────
+
+describe('resolveKnownHostsPath', () => {
+  it('returns the packaged resource path when only src/resources/known_hosts exists (installed package layout)', () => {
+    // Simulate: node_modules/@marcusrbrown/infra/src/lib/known-hosts.ts
+    // Only src/resources/known_hosts exists; no .github/known_hosts at any ancestor.
+    const tmpDir = join(tmpdir(), `known-hosts-installed-${Date.now()}`)
+    const libDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'lib')
+    const resourcesDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'resources')
+    mkdirSync(libDir, {recursive: true})
+    mkdirSync(resourcesDir, {recursive: true})
+    writeFileSync(join(resourcesDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
+
+    try {
+      // Pass the simulated import.meta.dir (the lib dir inside the package)
+      const result = resolveKnownHostsPath(libDir)
+      expect(result).not.toBeNull()
+      expect(result).toBe(join(resourcesDir, 'known_hosts'))
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('prefers .github/known_hosts over packaged resource when both exist (repo checkout layout)', () => {
+    // Mirror the real layout: packages/cli/src/lib is 4 levels deep from repo root.
+    // tmpDir is the "repo root"; libDir is tmpDir/packages/cli/src/lib.
+    const tmpDir = join(tmpdir(), `known-hosts-both-${Date.now()}`)
+    const libDir = join(tmpDir, 'packages', 'cli', 'src', 'lib')
+    const githubDir = join(tmpDir, '.github')
+    const resourcesDir = join(tmpDir, 'packages', 'cli', 'src', 'resources')
+    mkdirSync(libDir, {recursive: true})
+    mkdirSync(githubDir, {recursive: true})
+    mkdirSync(resourcesDir, {recursive: true})
+    writeFileSync(join(githubDir, 'known_hosts'), 'repo.example.com ssh-ed25519 AAAA...\n')
+    writeFileSync(join(resourcesDir, 'known_hosts'), 'packaged.example.com ssh-ed25519 AAAA...\n')
+
+    try {
+      // lib is at tmpDir/packages/cli/src/lib — 4 levels up is tmpDir (the "repo root")
+      const result = resolveKnownHostsPath(libDir)
+      expect(result).not.toBeNull()
+      // Should prefer .github/known_hosts (repo checkout)
+      expect(result).toBe(join(githubDir, 'known_hosts'))
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('throws a clear error when neither .github/known_hosts nor packaged resource exists', () => {
+    const tmpDir = join(tmpdir(), `known-hosts-none-${Date.now()}`)
+    const libDir = join(tmpDir, 'src', 'lib')
+    mkdirSync(libDir, {recursive: true})
+
+    try {
+      expect(() => resolveKnownHostsPath(libDir)).toThrow(
+        'Pinned SSH known_hosts file not found; reinstall @marcusrbrown/infra or run from the repo checkout',
+      )
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+})
+
+// ─── buildKnownHostsArgs ──────────────────────────────────────────────────────
+
+describe('buildKnownHostsArgs', () => {
+  it('returns UserKnownHostsFile args when .github/known_hosts exists at repo root', () => {
+    const args = buildKnownHostsArgs()
+
+    // The actual repo has .github/known_hosts
+    expect(args).toHaveLength(2)
+    expect(args[0]).toBe('-o')
+    expect(args[1]).toMatch(/^UserKnownHostsFile=/)
+    expect(args[1]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('throws when no known_hosts file exists (fail-closed behavior)', () => {
+    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
+    const libDir = join(tmpDir, 'src', 'lib')
+    mkdirSync(libDir, {recursive: true})
+
+    try {
+      expect(() => buildKnownHostsArgs(libDir)).toThrow(
+        'Pinned SSH known_hosts file not found; reinstall @marcusrbrown/infra or run from the repo checkout',
+      )
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('returns UserKnownHostsFile args pointing to the packaged resource in installed layout', () => {
+    const tmpDir = join(tmpdir(), `known-hosts-installed-${Date.now()}`)
+    const libDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'lib')
+    const resourcesDir = join(tmpDir, 'node_modules', '@marcusrbrown', 'infra', 'src', 'resources')
+    mkdirSync(libDir, {recursive: true})
+    mkdirSync(resourcesDir, {recursive: true})
+    writeFileSync(join(resourcesDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
+
+    try {
+      const args = buildKnownHostsArgs(libDir)
+      expect(args).toHaveLength(2)
+      expect(args[0]).toBe('-o')
+      expect(args[1]).toBe(`UserKnownHostsFile=${join(resourcesDir, 'known_hosts')}`)
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+
+  it('returns UserKnownHostsFile args pointing to the custom base path (repo checkout)', () => {
+    // Mirror the real layout: packages/cli/src/lib is 4 levels deep from repo root.
+    const tmpDir = join(tmpdir(), `known-hosts-test-${Date.now()}`)
+    const libDir = join(tmpDir, 'packages', 'cli', 'src', 'lib')
+    const githubDir = join(tmpDir, '.github')
+    mkdirSync(libDir, {recursive: true})
+    mkdirSync(githubDir, {recursive: true})
+    writeFileSync(join(githubDir, 'known_hosts'), 'example.com ssh-ed25519 AAAA...\n')
+
+    try {
+      const args = buildKnownHostsArgs(libDir)
+      expect(args).toHaveLength(2)
+      expect(args[0]).toBe('-o')
+      expect(args[1]).toBe(`UserKnownHostsFile=${join(githubDir, 'known_hosts')}`)
+    } finally {
+      rmSync(tmpDir, {recursive: true, force: true})
+    }
+  })
+})
+
+// ─── Drift guard: packaged resource matches .github/known_hosts ───────────────
+
+describe('packaged known_hosts resource drift guard', () => {
+  const REPO_ROOT = resolve(import.meta.dir, '..', '..', '..', '..')
+  const REPO_KNOWN_HOSTS = join(REPO_ROOT, '.github', 'known_hosts')
+  const PACKAGED_RESOURCE = resolve(import.meta.dir, '..', 'resources', 'known_hosts')
+
+  it('src/resources/known_hosts exists in the package source tree', () => {
+    expect(existsSync(PACKAGED_RESOURCE)).toBe(true)
+  })
+
+  it('src/resources/known_hosts matches .github/known_hosts (no drift)', async () => {
+    const repoContent = await Bun.file(REPO_KNOWN_HOSTS).text()
+    const packagedContent = await Bun.file(PACKAGED_RESOURCE).text()
+    expect(packagedContent).toBe(repoContent)
+  })
+})

package/src/lib/known-hosts.ts

@@ -0,0 +1,76 @@
+import {existsSync} from 'node:fs'
+import {join, resolve} from 'node:path'
+
+const FAIL_CLOSED_ERROR =
+  'Pinned SSH known_hosts file not found; reinstall @marcusrbrown/infra or run from the repo checkout'
+
+/**
+ * Resolve the path to the repo-pinned `.github/known_hosts` file.
+ *
+ * SSH commands in this CLI use `StrictHostKeyChecking=yes` but the invoking
+ * user's `~/.ssh/known_hosts` may not contain the pinned host keys for
+ * `metrics.fro.bot`, `gateway.fro.bot`, etc. The repo ships authoritative
+ * host keys in `.github/known_hosts`. When that file exists, SSH commands
+ * should use it via `UserKnownHostsFile=<path>` so host verification succeeds
+ * without weakening `StrictHostKeyChecking`.
+ *
+ * @param repoRoot - Optional override for the repo root directory. Defaults to
+ *   the actual repo root resolved relative to this file's location. Pass a
+ *   custom path in tests to avoid touching the real filesystem.
+ * @returns Absolute path to `.github/known_hosts` if it exists, otherwise null.
+ */
+export function resolveRepoKnownHostsPath(repoRoot?: string): string | null {
+  // This file lives at packages/cli/src/lib/known-hosts.ts
+  // Repo root is 4 levels up: lib → src → cli → packages → repo root
+  const base = repoRoot ?? resolve(import.meta.dir, '..', '..', '..', '..')
+  const candidate = join(base, '.github', 'known_hosts')
+  return existsSync(candidate) ? candidate : null
+}
+
+/**
+ * Resolve the pinned known_hosts file from either layout:
+ *
+ * 1. Repo checkout: `.github/known_hosts` at the monorepo root (4 levels up
+ *    from `src/lib/`).
+ * 2. Installed package: `src/resources/known_hosts` bundled alongside the
+ *    source (1 level up from `src/lib/`, then into `resources/`).
+ *
+ * Prefers the repo checkout layout when both exist. Throws a clear error if
+ * neither is found — fail-closed, never silently falls back to user
+ * `~/.ssh/known_hosts`.
+ *
+ * @param libDir - Override for the directory containing this file (for tests).
+ *   Defaults to `import.meta.dir`.
+ * @returns Absolute path to the pinned known_hosts file.
+ * @throws Error if no pinned known_hosts file is found.
+ */
+export function resolveKnownHostsPath(libDir?: string): string {
+  const dir = libDir ?? import.meta.dir
+
+  // Layout 1: repo checkout — walk up 4 levels from src/lib to repo root
+  const repoRoot = resolve(dir, '..', '..', '..', '..')
+  const repoCandidate = join(repoRoot, '.github', 'known_hosts')
+  if (existsSync(repoCandidate)) return repoCandidate
+
+  // Layout 2: installed package — src/resources/known_hosts is 1 level up from src/lib
+  const packagedCandidate = resolve(dir, '..', 'resources', 'known_hosts')
+  if (existsSync(packagedCandidate)) return packagedCandidate
+
+  throw new Error(FAIL_CLOSED_ERROR)
+}
+
+/**
+ * Build the SSH `-o UserKnownHostsFile=<path>` argument pair for the
+ * repo-pinned known_hosts file.
+ *
+ * Returns `['-o', 'UserKnownHostsFile=<path>']` when the file is found.
+ * Throws a clear error if no pinned known_hosts file is available — fail-closed,
+ * never silently omits `UserKnownHostsFile` for SSH commands that rely on
+ * pinned verification.
+ *
+ * @param libDir - Override for the directory containing this file (for tests).
+ */
+export function buildKnownHostsArgs(libDir?: string): string[] {
+  const path = resolveKnownHostsPath(libDir)
+  return ['-o', `UserKnownHostsFile=${path}`]
+}

package/src/resources/known_hosts

@@ -0,0 +1,28 @@
+box.heatvision.co ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJNjkvxUDLB432BdSnrfYGgYyfUQxrdwV6sNqETNkyqs
+box.heatvision.co ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPnP2/6iqHUeOJX4+aVcFpaal0lLdT6sZrRSF95+MgyCY+p3K21Kgr2xp9eyGJ8splnaJv7Kwv1V7+HC3CMXoqM=
+box.heatvision.co ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCpOziObL6mGk7hT113yo8kElbut5DU6xXoUYw8QWc4ix8iHxJV6T1hLl4wemFkSdA1jUhqhfR94Wdk7DtSGUiq9LidwfmL9ZsrAlnThLJeugZE1f+EtIye9hIqpzmmqMZvHeYFu3zbiB2/Xpc/krTmfKjIOsI0MeOKPAKEiFLG1DU9i5bWKs2ktC8TZCqp+Pfc4xt54Ug4lfLspbGbRZ96SQuxns+SSfyQW5peH13ZMl92/GGA2Tdh3bHausOYI6AvUimd/0mVc6b0bSWVS/k1bdb27rE/6TrZZ4ICXElGkgNndOsX5lFNcJdU+T6pJicA5fO8mpZ/ysakvyesmPigXxYsW3Q/tQkBoQXcKcxi+ItqU/ahJ1I4DObKnvJlu5htr3Gzo4dO5sxpDdufECqgicauFZzvXzD49XZvctRG01ZSy6ZmIekBsiTFHaTMO8zV88/AwVOT8CrgbrmIiwUG6ZfXCPFMztu4Z5IwxMWRnKG2GHWGNBb2/F5PDAz/Xrc=
+
+# cliproxy droplet (147.182.133.210 / cliproxy.fro.bot)
+cliproxy.fro.bot ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEq1Jbp0zCI12p7JIEtDTajBcCQyz0gmHls/BNXYTwIJ
+cliproxy.fro.bot ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNIaI6OauhhSiho+UtAl9ZfP2NkbOo/Pw6i/beGyxl/Z/dqnigruDXWuhlitnAtpOvpeQXOcx3xKSOjX8iQkKXc=
+cliproxy.fro.bot ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDcC+mMGekM5zzg3JcpVQD8Q+eRrhTPZptaG7sz1r5R5WVxdOboZ6xtjCQjCuqafig/PIYsZCnJrgmonW0gdKhpNbwobb9FBF8kFbeOa4rRKUoU7k8nmubWCn87L1GCGAtiX50YcxkxTTzZqHPZKiKRV38ExdfwR8uzeP2k8I/ay1uEjP5P1r/LCqHvKU8Dm3qF+NHZPGb0Ri/Iz9aLj3Mo73/BM8D7fhaG/3WXA+vRLwO+vqaIcGraYd5csNFJEXbpU7FBlnJmeKg4VPN7HJHsI69SGmmqGVHQ75A5e5AlNme/nCZmE5SptUy2mt/Y4/BIShDTfuyLG9Q36P1mC3PT0zZwdl4iAO3fciRo2R4/tSPh4nkFT0gEH79SQkZrV42uR5h6BNtf1/Bob8IAwdZL//1J97oc9EAfSntJQvSrYcMCL5ui+uK3S/V24jqYSsywQwfwGNMgDwDHQ66vP/CMbB86PnNmRajHDyF/vQK1ueSVX5sCEYEmQsx2Q6OPLxM=
+|1|h7erWkle+dN76VrVVAiQPmOSee4=|LkpzPt8SQjsCbnPm+txg5Me1SYM= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDcC+mMGekM5zzg3JcpVQD8Q+eRrhTPZptaG7sz1r5R5WVxdOboZ6xtjCQjCuqafig/PIYsZCnJrgmonW0gdKhpNbwobb9FBF8kFbeOa4rRKUoU7k8nmubWCn87L1GCGAtiX50YcxkxTTzZqHPZKiKRV38ExdfwR8uzeP2k8I/ay1uEjP5P1r/LCqHvKU8Dm3qF+NHZPGb0Ri/Iz9aLj3Mo73/BM8D7fhaG/3WXA+vRLwO+vqaIcGraYd5csNFJEXbpU7FBlnJmeKg4VPN7HJHsI69SGmmqGVHQ75A5e5AlNme/nCZmE5SptUy2mt/Y4/BIShDTfuyLG9Q36P1mC3PT0zZwdl4iAO3fciRo2R4/tSPh4nkFT0gEH79SQkZrV42uR5h6BNtf1/Bob8IAwdZL//1J97oc9EAfSntJQvSrYcMCL5ui+uK3S/V24jqYSsywQwfwGNMgDwDHQ66vP/CMbB86PnNmRajHDyF/vQK1ueSVX5sCEYEmQsx2Q6OPLxM=
+|1|hNHRbNSfyK/BBEM32tiaVoRnRRA=|6KslRRxr9KNaKlbnzkdg1/tQokA= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNIaI6OauhhSiho+UtAl9ZfP2NkbOo/Pw6i/beGyxl/Z/dqnigruDXWuhlitnAtpOvpeQXOcx3xKSOjX8iQkKXc=
+|1|NMQwWGuubNdklyTxDZ5rRgmaq0k=|J3xvvUOXXMYgC0vvsn1zvRDlSVQ= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEq1Jbp0zCI12p7JIEtDTajBcCQyz0gmHls/BNXYTwIJ
+
+# gateway droplet (162.243.163.59 / gateway.fro.bot)
+gateway.fro.bot ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3g6QXCHGjaahf8hMBcRYtDWGAQTBpiUn7yrjVsbIb9U9K7d9yypLaTYzYKU0WFVtVFEi25CcRU5/xB6KOTWOSU/izPlgJ8ht7bNDWmSy6X1JaqxOOh2qQWWRklF+g8I1JwXO0X1Bmu7rFGFqaDEyWKChM19DvRi66x+kPYOeCeACwkYOA1L/SeUpF4H82lWGSiql4rzT7M/n/6RXa5gd4oPG1C8rkM8EqPnpFIZSUNv5/TAhGVsZu1RFJ4OvlZrNQba0LON6DUHTKuUE9o2r+VoaehhOuMDq5gOUAcDEDpPdyfCgnWvRkiLZ5osqw5ECcAGhIxXVYdpGhmX157UmLDKosowRbqPibetCJQ4sisa2WPm5jIrQnf/65mFOlkfIIYuzi0OBFG7VOaU0H8+AAOUQ9fnjseIQJV7GaD9F7viE+zgMoCB1fUlG04iIdJ2SgXRLt2+4uUfwuYSJHTvQUxs+6uMtzFQwHUZpBVE71I0g40beyulok7qiCxIBmLZ8=
+gateway.fro.bot ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGCGPvUmuVd8X6/CxbvhTjjO0Ee6rS1D6XujRgmVl0zcHYIFUYLAFZVosN0RKvcmdmppm64PxH/cLAx7gvKF3t0=
+gateway.fro.bot ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUfj6wqjyh+BLIqHlRxfFlRpBuesAAnUYllFbWN9qzw
+
+|1|8fBUi0jyLBNX5eBIp6NllCFFwVw=|gC1yH9h2zglwFYgKVhvslvDqgqE= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3g6QXCHGjaahf8hMBcRYtDWGAQTBpiUn7yrjVsbIb9U9K7d9yypLaTYzYKU0WFVtVFEi25CcRU5/xB6KOTWOSU/izPlgJ8ht7bNDWmSy6X1JaqxOOh2qQWWRklF+g8I1JwXO0X1Bmu7rFGFqaDEyWKChM19DvRi66x+kPYOeCeACwkYOA1L/SeUpF4H82lWGSiql4rzT7M/n/6RXa5gd4oPG1C8rkM8EqPnpFIZSUNv5/TAhGVsZu1RFJ4OvlZrNQba0LON6DUHTKuUE9o2r+VoaehhOuMDq5gOUAcDEDpPdyfCgnWvRkiLZ5osqw5ECcAGhIxXVYdpGhmX157UmLDKosowRbqPibetCJQ4sisa2WPm5jIrQnf/65mFOlkfIIYuzi0OBFG7VOaU0H8+AAOUQ9fnjseIQJV7GaD9F7viE+zgMoCB1fUlG04iIdJ2SgXRLt2+4uUfwuYSJHTvQUxs+6uMtzFQwHUZpBVE71I0g40beyulok7qiCxIBmLZ8=
+|1|XsFKIlbq2aifqw1if+WGnRz0MBs=|LrHknyfL8diBLT1G7+ss8+9Kbaw= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGCGPvUmuVd8X6/CxbvhTjjO0Ee6rS1D6XujRgmVl0zcHYIFUYLAFZVosN0RKvcmdmppm64PxH/cLAx7gvKF3t0=
+|1|Ytflq7+lWpR/TNEQ8C/wvirEIsc=|hcnjv25+apKJxy6UlAHhtR0baRI= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUfj6wqjyh+BLIqHlRxfFlRpBuesAAnUYllFbWN9qzw
+
+# umami droplet (167.99.236.120 / metrics.fro.bot)
+metrics.fro.bot ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICRCMPA99bZJ1w+QdZPrTzLK06LF7t91tb0GbKfBkA72
+metrics.fro.bot ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCma/Y9qRPlZ8v1wnQQBfwghQ0XbtSMn7QHVgIFGBjbO+Xqim7Lv9EArn58HIVACsZKMD0e9T90r70TDXYTWuZ6+RQ2x2soE6DcG/T/2wyan40hVtXLSCg8hx9DNjLR3RBwkiJcbdrYCqpDmi4kOuJAJ+b5JxUhJAkdF5M9xhUko59HtUm5I/j1T2Df60+7CdKMGZKMrCRios/q4lvgImuWS3aZuNQNuJiv6rfhX7L9LqezlJUgw1AbOzaqPXbZ9xpzt8yklGZQNa5I/CS6pEgn4/SKiRsetpgd4SCB9UuCR7ia/M0VU8itNPMZY11Pi+YwJKfJVZDtS+OSFkFxea8B1MyxDZkvOwnzYVx9xG6W48Oi06x4pQgJcqq5V52xM4upSlVtws5gTLNm/3KaJZ3kb7IK4HnTEUQrz/UShtyP1crsqwj5eoDnvcUfaMHx/YC/7LlQFp8AO8W/KEYWzlycJpZLqPrO/gqoiR0AG9NMP0SSRaD7M2pcQ4tKM1xyopE=
+metrics.fro.bot ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOm6bQkB9dGaPJAVbk9IrVxZSM0KrkUikv8JgVrW0iJMKorJ233GaK03n2/5cuAJ/D3z6nN/pF6QGApWfm6s/JA=
+|1|8o6qExp0klmE80pMU2CYvmbGqSQ=|064FdS/NWWEIU7EjmGBCwCek+DE= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICRCMPA99bZJ1w+QdZPrTzLK06LF7t91tb0GbKfBkA72
+|1|1nwXP2iRwBq0GXyE94EXYJuaUCQ=|Wxoe6EvzjZbk02Hr4mx1YZOciUM= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCma/Y9qRPlZ8v1wnQQBfwghQ0XbtSMn7QHVgIFGBjbO+Xqim7Lv9EArn58HIVACsZKMD0e9T90r70TDXYTWuZ6+RQ2x2soE6DcG/T/2wyan40hVtXLSCg8hx9DNjLR3RBwkiJcbdrYCqpDmi4kOuJAJ+b5JxUhJAkdF5M9xhUko59HtUm5I/j1T2Df60+7CdKMGZKMrCRios/q4lvgImuWS3aZuNQNuJiv6rfhX7L9LqezlJUgw1AbOzaqPXbZ9xpzt8yklGZQNa5I/CS6pEgn4/SKiRsetpgd4SCB9UuCR7ia/M0VU8itNPMZY11Pi+YwJKfJVZDtS+OSFkFxea8B1MyxDZkvOwnzYVx9xG6W48Oi06x4pQgJcqq5V52xM4upSlVtws5gTLNm/3KaJZ3kb7IK4HnTEUQrz/UShtyP1crsqwj5eoDnvcUfaMHx/YC/7LlQFp8AO8W/KEYWzlycJpZLqPrO/gqoiR0AG9NMP0SSRaD7M2pcQ4tKM1xyopE=
+|1|lwRlQiSSd0h7iti76fvRXTtbkSw=|D//yCCMd1iZftlbjJ0NhKCCf5/8= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOm6bQkB9dGaPJAVbk9IrVxZSM0KrkUikv8JgVrW0iJMKorJ233GaK03n2/5cuAJ/D3z6nN/pF6QGApWfm6s/JA=