security(aggregator): fleet-feed push exposes the proxy credential in process argv and disables SSH host-key verification #948

Finding

pm-stack/aggregator/scripts/push-fleet-feed.sh (added by PR #892, commit 46584cefaef5) hands the egress-proxy credential to socat by interpolating it into the SSH ProxyCommand string, so the proxy username/password appears in the ssh/scp/socat process command lines — readable by any local user via ps for the duration of every ~5-minute feed push. The same connection disables SSH host-key verification entirely.

Evidence (current main a2eef6f7920a)

• pm-stack/aggregator/scripts/push-fleet-feed.sh:48:
  proxycmd = f"socat - PROXY:{u.hostname}:100.99.113.103:22,proxyport=3130,proxyauth={user}:{pw}"
• :54 passes it as -o ProxyCommand={proxycmd} to scp and ssh (:60-67). Command lines are world-readable on Linux (/proc/<pid>/cmdline), so the shared proxy credential — read at runtime from HTTPS_PROXY / the mcpx daemon env — is exposed to any process on the sandbox for each push window.
• :50-51: StrictHostKeyChecking=no with UserKnownHostsFile=/dev/null — the laptop's host key is never verified, on a connection authenticated with the sandbox's ~/.ssh/id_ed25519. A spoofed endpoint on the proxy route silently receives the feed push and the remote mv.
• git grep proxyauth origin/main hits only this file — the pattern exists nowhere else in the repo.

The credential itself is not in the diff or the repo (it is read from a file/env at runtime) — this is about the hand-off mechanism, not a committed secret.

Why it matters

The proxy credential is a shared fleet secret (the same egress proxy mcpx uses). argv is the weakest place a secret can sit: it needs no file permission, no ptrace, no root — just ps. And with host-key checking off, the SSH transport the push relies on provides authentication of the client but none of the server, so the credential exposure and the MITM surface compound on the same connection.

Acceptance criteria

• The proxy credential no longer appears in any process command line (e.g. env/fd-based hand-off to socat, or a mode-600 config file socat reads), verified by inspecting ps//proc during a push.
• The laptop host key is pinned and verified (checked-in known-hosts entry, or Tailscale SSH), and a push to a mismatched key fails.
• A grep-level guard or test asserts neither proxyauth= interpolation nor StrictHostKeyChecking=no reappears in push-fleet-feed.sh.
• Normal fleet-feed pushes keep working end to end (feed arrives on the laptop, remote mv completes).

Found by the pr-diff-review job reviewing PR #892 against current main. Dedupe: searches for proxyauth / StrictHostKeyChecking push-fleet-feed returned no existing issue.