fix(desktop): pin terminal host key #10

Merged

ochenstarik-ui merged 1 commit from hermes/task2-a-security-debts into main

2026-07-31 06:22:00 +00:00

ochenstarik-ui commented

2026-07-31 06:18:40 +00:00

(Migrated from github.com)

Summary

pin interactive SSH terminals to the same endpoint-scoped host-key trust used by monitoring
add fail-closed legacy-profile migration UX and re-confirmation on endpoint edits
remove response-code async dispatch and synchronous execution wrappers from the provisioning helper
refresh SMM_AgentUid atomically during update-agent and fail fast on /etc/passwd mismatch

Security properties

OpenSSH uses -F none, StrictHostKeyChecking=yes, one endpoint pin, and disables alternate host-key trust sources
ProcessStartInfo.ArgumentList preserves paths containing spaces for direct ssh.exe and wt.exe new-tab -- ssh.exe
contaminated pin files containing additional keys or certificate authorities are rejected
malformed execution envelopes are rejected before privileged executor or filesystem/process mutation

Verification

Desktop security tests: 12/12 passed
Control/Agent/provisioning-helper tests: 65/65 passed
bootstrap contract: passed
Windows desktop contract and actual ssh.exe -G: passed
Desktop Release x64 build: 0 warnings, 0 errors
git diff --check: clean
independent security/diff repair review: APPROVE, no BLOCKING/HIGH/MEDIUM findings

The full local verification was also executed through an ad-hoc hermes-verify-*.sh script under %TEMP%; the script was removed after a successful run. Linux-only enrollment argv and systemd/container checks remain required CI gates.

## Summary - pin interactive SSH terminals to the same endpoint-scoped host-key trust used by monitoring - add fail-closed legacy-profile migration UX and re-confirmation on endpoint edits - remove response-code async dispatch and synchronous execution wrappers from the provisioning helper - refresh `SMM_AgentUid` atomically during `update-agent` and fail fast on `/etc/passwd` mismatch ## Security properties - OpenSSH uses `-F none`, `StrictHostKeyChecking=yes`, one endpoint pin, and disables alternate host-key trust sources - `ProcessStartInfo.ArgumentList` preserves paths containing spaces for direct `ssh.exe` and `wt.exe new-tab -- ssh.exe` - contaminated pin files containing additional keys or certificate authorities are rejected - malformed execution envelopes are rejected before privileged executor or filesystem/process mutation ## Verification - Desktop security tests: 12/12 passed - Control/Agent/provisioning-helper tests: 65/65 passed - bootstrap contract: passed - Windows desktop contract and actual `ssh.exe -G`: passed - Desktop Release x64 build: 0 warnings, 0 errors - `git diff --check`: clean - independent security/diff repair review: APPROVE, no BLOCKING/HIGH/MEDIUM findings The full local verification was also executed through an ad-hoc `hermes-verify-*.sh` script under `%TEMP%`; the script was removed after a successful run. Linux-only enrollment argv and systemd/container checks remain required CI gates.