fix(ssh): trust ~/.ssh/known_hosts too (v0.16.3)

apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/cli",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "type": "module",
   "bin": {
     "diskpush": "./dist/bin.js"

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/desktop",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "private": true,
   "type": "module",
   "main": "dist-electron/main/index.js",

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/web",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "private": true,
   "type": "module",
   "scripts": {

packages/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/database",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/fleet-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/fleet-core",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/plugin-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/plugin-api",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/plugin-dbbackup/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/plugin-dbbackup",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "description": "DiskPush plugin: dump Postgres, Supabase, MySQL/MariaDB and SQLite databases to tagged, verified, gzipped files, prune them, push them anywhere rsync reaches, and restore them.",
   "license": "MIT",
   "type": "module",

packages/plugin-mediaanalyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/plugin-mediaanalyzer",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/rsync-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/rsync-core",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/s3-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/s3-core",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/schemas/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/schemas",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/ssh-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diskpush/ssh-core",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/ssh-core/src/session.ts

@@ -1,4 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
 import { Client, type AnyAuthMethod, type ConnectConfig, type SFTPWrapper } from 'ssh2'
 import type { Connection } from '@diskpush/schemas'
 import { keyTypeOf, sha256Fingerprint } from './fingerprint.js'
@@ -23,7 +25,14 @@ export type HostKeyPrompt = (details: {
 }) => Promise<boolean>
 
 export type SessionOptions = {
+  /** DiskPush's own known_hosts: read, and where newly trusted keys are written. */
   knownHostsPath: string
+  /**
+   * Further known_hosts files trusted read-only, so a host OpenSSH already
+   * knows is not "new" to DiskPush. Defaults to ~/.ssh/known_hosts (hashed
+   * entries included); pass [] to trust only `knownHostsPath`.
+   */
+  trustedKnownHostsPaths?: readonly string[]
   /**
    * Asked only when a host is genuinely new. A *changed* key is never
    * prompted away here; it fails, and the user has to deal with it
@@ -76,7 +85,8 @@ export class SshSession {
 
   static async connect(connection: Connection, options: SessionOptions): Promise<SshSession> {
     const client = new Client()
-    const knownHosts = readKnownHosts(options.knownHostsPath)
+    const trusted = options.trustedKnownHostsPaths ?? [join(homedir(), '.ssh', 'known_hosts')]
+    const knownHosts = [options.knownHostsPath, ...trusted.filter((p) => p !== options.knownHostsPath)].flatMap(readKnownHosts)
 
     const config: ConnectConfig = {
       host: connection.host,