[aledbf]

The workspace image's sshd will accept one key exchange, mlkem768x25519-sha256 (spin-stack/spin-machine#245): post-quantum, and a login costs what curve25519's does (40 vs 39 ms on the bench fleet, where sntrup761x25519 took 104). ssh2 has no ML-KEM, so Spinbox Remote could not connect to such a workspace. This moves the connection to the machine's own OpenSSH. spin's side is https://github.com/spin-stack/spin/pull/1206.

What changes

• The connection is ssh (src/spin/connection.ts): one ControlMaster (ssh -M -N), carried by spin tunnel <session> as its ProxyCommand. spin ssh-session hands out a session that spin tunnel carries once, so a second login would need a second session, certificate and claim check. Everything after the login goes through that one connection: the server's start runs as an exec through it, and each connection VS Code makes to the server is an ssh -W 127.0.0.1:<port> through it, behind the same loopback listener as before. Readiness is ssh -O check. Closing it kills the master, which ends the tunnel and every client.
• Host key verification is as strict as hostVerifier was. The claim's key, parsed and re-encoded by parseHostKey, is the one line of a known_hosts that belongs to this connection alone (mkdtemp, 0600), with HostKeyAlias, StrictHostKeyChecking=yes, GlobalKnownHostsFile=/dev/null and UpdateHostKeys=no. Login uses the certificate alone: -i <identity>, CertificateFile, IdentitiesOnly, PreferredAuthentications=publickey, BatchMode. -F /dev/null keeps the person's Host * (a ProxyJump, a ControlMaster, a forwarded agent) from changing the connection. Every run passes -o KexAlgorithms=mlkem768x25519-sha256.
• Version gate (src/spin/openssh.ts): ssh -V is asked before the CLI is run. An OpenSSH older than 9.9 is refused in VS Code as a modal SpinRefusal (ssh_outdated, not temporary). The message names the version found, the version needed and the reason, in the same words as the spin CLI. An unreadable banner is let through with a line in the log. A missing ssh is refused as ssh_not_found. A successful check is cached per PATH; a refusal is not cached, so updating OpenSSH and opening again works without reloading.
• LogLevel is INFO: ssh reports no matching key exchange method found at INFO, and ERROR would hide exactly that refusal.
• Windows is refused up front (platform_unsupported). There is no spin CLI for Windows (spin builds linux and darwin; vscode-spinbox carries linux and darwin only), CI is Linux-only, and OpenSSH for Windows has no ControlMaster. A per-connection design without a master (ssh -N -L) would need a fresh spin ssh-session for each login, because a session is carried once.
• ssh2, @types/ssh2, @types/ssh2-streams, patches/ssh2@1.17.0.patch, its patchedDependencies and allowBuilds, its dependabot ignore, the esbuild externals and test/ssh2.security.test.ts are gone. keys.ts keeps only parseHostKey.

Tests

OpenSSH runs on both ends, and the runner needs OpenSSH 9.9 or newer; CI's ubuntu-latest is 26.04 with 10.2.

• test/sshd.ts: a real sshd set up as a workspace's (certificates only, KexAlgorithms mlkem768x25519-sha256).
• test/spin/connection.sshd.test.ts: logs in with ed25519 and ecdsa certificates; refuses the bare key, another principal's certificate, a host key that is not the pinned one, and an sshd without ML-KEM (no matching key exchange method found). Also carries a loopback port through -W. I planted StrictHostKeyChecking=no and KexAlgorithms=+…, and the host-key and ML-KEM tests failed.
• test/spin/openssh.test.ts: the version gate (9.6, 9.8, Windows 9.5 and 8.9 refused with the message; 9.9, Windows 9.9, 10.2 and 9.10 pass; Dropbear and an empty banner warn), the PATH lookup and re-check after a refusal, and the options: KexAlgorithms, ProxyCommand, known hosts, strict checking, certificate, -F /dev/null, % escaping.
• test/spin/resolve.test.ts: activation through to the server's answer. The real ssh runs through a wrapper that records each run and logs in as the test's user (a test sshd admits only its own user). Every run must carry the KexAlgorithms and strict host key options. A new case checks that an OpenSSH 9.6 is refused, with the exact message shown, before the CLI is asked anything.

go tool task ci passes locally (gate, install, lint, typecheck, 91 tests, package). The e2e lane (task test:e2e, against spin's KVM stack) was not run. test/e2e/spin.e2e.test.ts was only updated for forwardOut(port).

🤖 Generated with Claude Code