vibecarbon 0.9.0 → 0.10.0

package/src/lib/deploy/image.js

@@ -13,6 +13,8 @@
  */
 
 import { execFileSync } from 'node:child_process';
+import { knownHostsPathForKey } from '../host-keys.js';
+import { shEscape } from '../shell.js';
 
 const LOCAL_REGISTRY_PREFIX = 'vibecarbon-local';
 
@@ -146,36 +148,30 @@ function defaultTimestamp() {
  * `gzip -1` is universally present and dominant cost is network, not CPU.
  *
  * `pipefail` so a docker-save / gzip failure isn't masked by ssh's exit code.
- * `StrictHostKeyChecking=accept-new` matches the convention used elsewhere
- * in vibecarbon's ssh paths: trust-on-first-use, error on host-key change.
  *
  * @param {{tag: string, sshTarget: string, sshKey?: string}} args
  */
 export function sideloadCompose({ tag, sshTarget, sshKey }) {
-  // SSH options mirror remote-build.js's wrapper script — same tradeoffs:
-  //   * StrictHostKeyChecking=no + UserKnownHostsFile=/dev/null: ephemeral
-  //     VPS IPs get recycled across e2e runs (and across customer
-  //     redeploys after destroy). accept-new + the operator's real
-  //     ~/.ssh/known_hosts would fail with "host key verification failed"
-  //     whenever a recycled IP shows up with a new host key, even with
-  //     BatchMode=yes (in fact especially then, since ssh can't prompt to
-  //     update the entry). iter-perfwave4 hit exactly this on first run.
+  // SSH options mirror remote-build.js's wrapper + the compose deploy path:
+  //   * Host-key pinned per-env (knownHostsPathForKey), NOT /dev/null + no.
+  //     accept-new TOFU's an ephemeral/recycled Hetzner IP but rejects a
+  //     changed key for an already-pinned host (MITM on an established env
+  //     fails). GlobalKnownHostsFile=/dev/null ignores the system file; the
+  //     operator's ~/.ssh/known_hosts is never touched (a stale entry there
+  //     would otherwise reject a recycled IP — iter-perfwave4 hit this).
   //   * BatchMode=yes per feedback_ssh_batchmode_required.md (PR 1T):
-  //     fast-fail rather than hang on interactive password prompt if the
-  //     key fails.
+  //     fast-fail rather than hang on interactive password prompt.
   //   * ConnectTimeout=30: bound the network half of dial; sideload's own
   //     stream is unbounded (limited by docker save throughput).
-  const sshFlags = [
-    '-o',
-    'StrictHostKeyChecking=no',
-    '-o',
-    'UserKnownHostsFile=/dev/null',
-    '-o',
-    'BatchMode=yes',
-    '-o',
-    'ConnectTimeout=30',
-  ];
-  if (sshKey) sshFlags.unshift('-i', sshKey);
+  const sshFlags = ['-o', 'StrictHostKeyChecking=accept-new'];
+  if (sshKey) {
+    // shEscape the known_hosts assignment so a project dir with spaces can't
+    // split the argument in the bash -c string below.
+    sshFlags.push('-o', shEscape(`UserKnownHostsFile=${knownHostsPathForKey(sshKey)}`));
+    sshFlags.push('-o', 'GlobalKnownHostsFile=/dev/null');
+  }
+  sshFlags.push('-o', 'BatchMode=yes', '-o', 'ConnectTimeout=30');
+  if (sshKey) sshFlags.unshift('-i', shEscape(sshKey));
   const cmd = `set -o pipefail && docker save ${tag} | gzip -1 | ssh ${sshFlags.join(' ')} ${sshTarget} 'gunzip | docker load'`;
   // Capture stdio rather than inheriting it: ssh's "Permanently added" host-
   // key warning + `docker load`'s "Loaded image:" success line both bypass