fix(sandbox): verify a sandbox's identity before sending a token

packages/cli/src/commands/sandbox/ssh-exec.ts

@@ -1,6 +1,7 @@
-import { chmod, mkdtemp, rm } from "node:fs/promises";
+import { chmod, mkdir, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { sandboxKnownHostsPath } from "@bunny.net/sandbox/known-hosts";
 import type { SandboxRecord } from "../../config/schema.ts";
 
 export const WORKPLACE = "/workplace";
@@ -36,10 +37,14 @@ export function sshArgs(
     ...(options.tty ? ["-t"] : []),
     "-p",
     portStr,
+    // Trust the host key on first contact, in the dedicated file the SDK also uses.
     "-o",
-    "StrictHostKeyChecking=no",
+    "StrictHostKeyChecking=accept-new",
     "-o",
-    "UserKnownHostsFile=/dev/null",
+    `UserKnownHostsFile=${sandboxKnownHostsPath()}`,
+    // Plaintext entries so the SDK's parser can read the shared file.
+    "-o",
+    "HashKnownHosts=no",
     "-o",
     "LogLevel=ERROR",
     `root@${host}`,
@@ -59,6 +64,8 @@ export async function withSshEnv<T>(
   record: SandboxRecord,
   fn: (env: Record<string, string>) => Promise<T>,
 ): Promise<T> {
+  // ssh writes the known-hosts file but won't create its parent directory.
+  await mkdir(dirname(sandboxKnownHostsPath()), { recursive: true });
   const dir = await mkdtemp(join(tmpdir(), "bunny-ssh-"));
   const scriptPath = join(dir, "askpass");
   await Bun.write(scriptPath, `#!/bin/sh\nprintf '%s' "$BUNNY_SSH_TOKEN"\n`);

packages/sandbox/package.json

@@ -12,6 +12,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./known-hosts": {
+      "types": "./dist/known-hosts.d.ts",
+      "import": "./dist/known-hosts.js"
     }
   },
   "files": [

packages/sandbox/src/known-hosts.ts

@@ -0,0 +1,68 @@
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+/**
+ * The known-hosts file shared by the CLI and libssh2.
+ */
+export function sandboxKnownHostsPath(): string {
+  const base = process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config");
+  return join(base, "bunny", "sandbox_known_hosts");
+}
+
+/** OpenSSH known_hosts label; non-default ports are bracketed. */
+function hostLabel(host: string, port: number): string {
+  return port === 22 ? host : `[${host}]:${port}`;
+}
+
+/** Algorithm name from the front of an SSH public-key blob, or null if malformed. */
+function keyType(key: Buffer): string | null {
+  if (key.length < 4) return null;
+  const len = key.readUInt32BE(0);
+  if (4 + len > key.length) return null;
+  return key.toString("ascii", 4, 4 + len);
+}
+
+/**
+ * Trust-on-first-use check for a server host key (`key` is the raw public-key
+ * blob).
+ * The first key seen for a host and type is recorded and trusted; a later
+ * connection presenting a different key for that host is rejected, catching an
+ * impostor before the token is sent as the password.
+ */
+export function verifyKnownHost(
+  host: string,
+  port: number,
+  key: Buffer,
+  path: string = sandboxKnownHostsPath(),
+): boolean {
+  const type = keyType(key);
+  if (!type) return false;
+  const label = hostLabel(host, port);
+  const encoded = key.toString("base64");
+
+  let text = "";
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    // No file yet — first contact.
+  }
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const [hosts, lineType, lineKey] = trimmed.split(/\s+/);
+    if (!hosts || !lineType || !lineKey) continue;
+    // known_hosts allows several comma-separated hosts per line.
+    if (lineType !== type || !hosts.split(",").includes(label)) continue;
+    return lineKey === encoded;
+  }
+
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    // Append so concurrent connects don't clobber each other.
+    appendFileSync(path, `${label} ${type} ${encoded}\n`, { mode: 0o600 });
+  } catch {
+    // Can't persist (e.g. read-only home): trust it anyway, like OpenSSH accept-new — no cross-run pin.
+  }
+  return true;
+}

packages/sandbox/src/transport.ts

@@ -5,6 +5,7 @@ import {
   type SFTPWrapper,
 } from "ssh2";
 import { SandboxError } from "./errors.ts";
+import { verifyKnownHost } from "./known-hosts.ts";
 
 export interface TransportConfig {
   host: string;
@@ -147,6 +148,8 @@ export class SshTransport {
       port: this.config.port,
       username: this.config.username ?? "root",
       password: this.config.password,
+      hostVerifier: (key: Buffer) =>
+        verifyKnownHost(this.config.host, this.config.port, key),
       readyTimeout: 15_000,
     };
 

tsconfig.json

@@ -20,7 +20,10 @@
       "@bunny.net/openapi-client/generated/*": [
         "./packages/openapi-client/src/generated/*"
       ],
-      "@bunny.net/sandbox": ["./packages/sandbox/src/index.ts"]
+      "@bunny.net/sandbox": ["./packages/sandbox/src/index.ts"],
+      "@bunny.net/sandbox/known-hosts": [
+        "./packages/sandbox/src/known-hosts.ts"
+      ]
     },
 
     // Best practices