panic commit

bin/codex-devops-auth.sh

@@ -6,6 +6,8 @@ PKCS11_LIB="${PKCS11_LIB:-/usr/local/lib/opensc-pkcs11.so}"
 YUBIKEY_PIN_FILE="${YUBIKEY_PIN_FILE:-/tmp/pass}"
 TOKEN_HOST="${TOKEN_HOST:-operator-access-token.svc.ad1.r2}"
 SSH_CONFIG_FILE="${SSH_CONFIG_FILE:-$HOME/.ssh/config.oci}"
+TOKEN_STRICT_HOST_KEY_CHECKING="${TOKEN_STRICT_HOST_KEY_CHECKING:-no}"
+TOKEN_USER_KNOWN_HOSTS_FILE="${TOKEN_USER_KNOWN_HOSTS_FILE:-/dev/null}"
 OCI_BIN="${OCI_BIN:-/opt/homebrew/bin/oci}"
 OCI_SESSION_REGION="${OCI_SESSION_REGION:-us-chicago-1}"
 OCI_PROFILE_NAME="${OCI_PROFILE_NAME:-MCP_GW_DEFAULT}"
@@ -376,7 +378,7 @@ quiet_proxy_command() {
 
 proxy_ssh_prefix() {
   local ssh_bin="$1"
-  local prefix="${ssh_bin} -F ${(q)SSH_CONFIG_FILE} -o LogLevel=ERROR"
+  local prefix="${ssh_bin} -F ${(q)SSH_CONFIG_FILE} -o LogLevel=ERROR -o StrictHostKeyChecking=${(q)TOKEN_STRICT_HOST_KEY_CHECKING} -o UserKnownHostsFile=${(q)TOKEN_USER_KNOWN_HOSTS_FILE}"
 
   if [[ -n "${TOKEN_SSH_USER:-}" ]]; then
     prefix+=" -l ${(q)TOKEN_SSH_USER}"
@@ -429,7 +431,12 @@ proxy_jump_as_proxy_command() {
 }
 
 build_token_ssh_args() {
-  TOKEN_SSH_ARGS=(-F "${SSH_CONFIG_FILE}" -o LogLevel=ERROR)
+  TOKEN_SSH_ARGS=(
+    -F "${SSH_CONFIG_FILE}"
+    -o LogLevel=ERROR
+    -o "StrictHostKeyChecking=${TOKEN_STRICT_HOST_KEY_CHECKING}"
+    -o "UserKnownHostsFile=${TOKEN_USER_KNOWN_HOSTS_FILE}"
+  )
   TOKEN_SSH_USER="$(resolve_token_ssh_user || true)"
 
   local proxy_command proxy_jump configured_proxy_command