fix: confine keys to rootdir; verify host keys by default

[thorwhalen]

Closes #7

What changes

Keys confined to rootdir. A key that is absolute, or whose .. segments leave rootdir after normalisation, raises KeyError in __getitem__, __setitem__, __delitem__ and mkdir, and in returns False. Keys that stay inside (a/../b, ./a) behave as before. Keyword-only allow_escape=True restores the old behaviour. Symbolic links on the server are not resolved by this check (documented).

Host keys verified by default. The client used AutoAddPolicy, accepting any host key. It now reads known_hosts the way OpenSSH picks the files (GlobalKnownHostsFile / UserKnownHostsFile from ~/.ssh/config replace the defaults; /dev/null means none), parsing leniently (marker, unsupported or malformed lines are skipped, so @revoked is not honoured), matching HostKeyAlias and lower-cased names. For a host not found there it:

• follows the host's ssh config: StrictHostKeyChecking no / off / accept-new accept the key for the session;
• otherwise refuses, with a message explaining how to proceed (connect once with ssh, set the ssh config option, or pass the policy);
• keyword-only missing_host_key_policy= (a paramiko policy class or instance) overrides both.
  A changed key for a known host is always refused (paramiko behaviour). Subdirectory instances (which open new connections) are pinned to the key their parent connected with. Keys containing NUL are refused.

Release note (behaviour change)

• Connecting to a host that is not in known_hosts and has no StrictHostKeyChecking setting now fails instead of silently trusting the key. Fix: ssh <host> once, or pass missing_host_key_policy=paramiko.AutoAddPolicy.
• Keys pointing outside rootdir now raise KeyError; pass allow_escape=True if you relied on that.

No fleet dependents.

Review

Independent refute-review by a sub-agent: first round found one blocker (a known_hosts file with @cert-authority/malformed lines could crash the constructor) and should-fixes (UserKnownHostsFile should replace defaults, silent test skips, subdirectory re-trust, HostKeyAlias/case); all fixed. Re-review: no blockers; its performance note (quadratic key loading) and the remaining silent-skip path were fixed too.

Tests

sshdol/tests/test_confinement.py (no server needed) plus doctests. The existing integration tests run in hosted CI against a localhost sshd whose ssh config sets StrictHostKeyChecking no, which exercises the config-following path. wads ci-local passes (integration tests skipped locally: no test server). When SSH_TEST_HOST is set explicitly (as in CI), a failing connection now fails the tests instead of skipping them.

🤖 Generated with Claude Code