fix: quote shell interpolations in deploy and harden SSH

Extract deploy helpers (validateInstanceName, buildSshCommand,
buildRsyncCommand) to prevent shell injection via instance names.
Replace StrictHostKeyChecking=no with accept-new (TOFU) across all
SSH and rsync commands in the deploy path.

Signed-off-by: Brian Taylor <brian@briantaylor.xyz>
Signed-off-by: Brian Taylor <brian.taylor818@gmail.com>

Author: brianwtaylor

bin/lib/deploy.js

@@ -0,0 +1,45 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Deploy helpers — input validation and shell-safe command builders.
+
+const INSTANCE_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+
+function validateInstanceName(name) {
+  if (!name || !INSTANCE_NAME_RE.test(name)) {
+    throw new Error(
+      `Invalid instance name: ${JSON.stringify(name)}. ` +
+      "Must start with alphanumeric and contain only [a-zA-Z0-9._-]."
+    );
+  }
+}
+
+function buildSshCommand(host, remoteCmd) {
+  const args = [
+    "ssh",
+    "-o", "StrictHostKeyChecking=accept-new",
+    "-o", "LogLevel=ERROR",
+  ];
+  args.push(shellQuote(host));
+  if (remoteCmd) args.push(shellQuote(remoteCmd));
+  return args.join(" ");
+}
+
+function buildRsyncCommand(sources, host, dest) {
+  const sshOpt = '"ssh -o StrictHostKeyChecking=accept-new -o LogLevel=ERROR"';
+  const quotedSources = sources.map(shellQuote).join(" ");
+  return `rsync -az --delete --exclude node_modules --exclude .git --exclude src -e ${sshOpt} ${quotedSources} ${shellQuote(host + ":" + dest)}`;
+}
+
+function shellQuote(s) {
+  // Simple single-quote wrapping — escape any embedded single quotes
+  return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+
+module.exports = {
+  INSTANCE_NAME_RE,
+  validateInstanceName,
+  buildSshCommand,
+  buildRsyncCommand,
+  shellQuote,
+};

bin/nemoclaw.js

@@ -17,6 +17,7 @@ const {
 const registry = require("./lib/registry");
 const nim = require("./lib/nim");
 const policies = require("./lib/policies");
+const { validateInstanceName, buildSshCommand, buildRsyncCommand, shellQuote } = require("./lib/deploy");
 
 // ── Global commands ──────────────────────────────────────────────
 
@@ -62,6 +63,7 @@ async function deploy(instanceName) {
     await ensureGithubToken();
   }
   const name = instanceName;
+  validateInstanceName(name);
   const gpu = process.env.NEMOCLAW_GPU || "a2-highgpu-1g:nvidia-tesla-a100:1";
 
   console.log("");
@@ -83,7 +85,7 @@ async function deploy(instanceName) {
 
   if (!exists) {
     console.log(`  Creating Brev instance '${name}' (${gpu})...`);
-    run(`brev create ${name} --gpu "${gpu}"`);
+    run(`brev create ${shellQuote(name)} --gpu "${gpu}"`);
   } else {
     console.log(`  Brev instance '${name}' already exists.`);
   }
@@ -93,7 +95,7 @@ async function deploy(instanceName) {
   console.log("  Waiting for SSH...");
   for (let i = 0; i < 60; i++) {
     try {
-      execSync(`ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no ${name} 'echo ok' 2>/dev/null`, { encoding: "utf-8", stdio: "pipe" });
+      execSync(`ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new ${shellQuote(name)} 'echo ok' 2>/dev/null`, { encoding: "utf-8", stdio: "pipe" });
       break;
     } catch {
       if (i === 59) {
@@ -105,8 +107,12 @@ async function deploy(instanceName) {
   }
 
   console.log("  Syncing NemoClaw to VM...");
-  run(`ssh -o StrictHostKeyChecking=no -o LogLevel=ERROR ${name} 'mkdir -p /home/ubuntu/nemoclaw'`);
-  run(`rsync -az --delete --exclude node_modules --exclude .git --exclude src -e "ssh -o StrictHostKeyChecking=no -o LogLevel=ERROR" "${ROOT}/scripts" "${ROOT}/Dockerfile" "${ROOT}/nemoclaw" "${ROOT}/nemoclaw-blueprint" "${ROOT}/bin" "${ROOT}/package.json" ${name}:/home/ubuntu/nemoclaw/`);
+  run(buildSshCommand(name, "mkdir -p /home/ubuntu/nemoclaw"));
+  run(buildRsyncCommand(
+    [`${ROOT}/scripts`, `${ROOT}/Dockerfile`, `${ROOT}/nemoclaw`, `${ROOT}/nemoclaw-blueprint`, `${ROOT}/bin`, `${ROOT}/package.json`],
+    name,
+    "/home/ubuntu/nemoclaw/"
+  ));
 
   const envLines = [`NVIDIA_API_KEY=${process.env.NVIDIA_API_KEY}`];
   const ghToken = process.env.GITHUB_TOKEN;
@@ -115,21 +121,21 @@ async function deploy(instanceName) {
   if (tgToken) envLines.push(`TELEGRAM_BOT_TOKEN=${tgToken}`);
   const envTmp = path.join(os.tmpdir(), `nemoclaw-env-${Date.now()}`);
   fs.writeFileSync(envTmp, envLines.join("\n") + "\n", { mode: 0o600 });
-  run(`scp -q -o StrictHostKeyChecking=no -o LogLevel=ERROR "${envTmp}" ${name}:/home/ubuntu/nemoclaw/.env`);
+  run(`scp -q -o StrictHostKeyChecking=accept-new -o LogLevel=ERROR "${envTmp}" ${shellQuote(name)}:/home/ubuntu/nemoclaw/.env`);
   fs.unlinkSync(envTmp);
 
   console.log("  Running setup...");
-  run(`ssh -t -o StrictHostKeyChecking=no -o LogLevel=ERROR ${name} 'cd /home/ubuntu/nemoclaw && set -a && . .env && set +a && bash scripts/brev-setup.sh'`);
+  run(`ssh -t -o StrictHostKeyChecking=accept-new -o LogLevel=ERROR ${shellQuote(name)} 'cd /home/ubuntu/nemoclaw && set -a && . .env && set +a && bash scripts/brev-setup.sh'`);
 
   if (tgToken) {
     console.log("  Starting services...");
-    run(`ssh -o StrictHostKeyChecking=no -o LogLevel=ERROR ${name} 'cd /home/ubuntu/nemoclaw && set -a && . .env && set +a && bash scripts/start-services.sh'`);
+    run(buildSshCommand(name, "cd /home/ubuntu/nemoclaw && set -a && . .env && set +a && bash scripts/start-services.sh"));
   }
 
   console.log("");
   console.log("  Connecting to sandbox...");
   console.log("");
-  run(`ssh -t -o StrictHostKeyChecking=no -o LogLevel=ERROR ${name} 'cd /home/ubuntu/nemoclaw && set -a && . .env && set +a && openshell sandbox connect nemoclaw'`);
+  run(`ssh -t -o StrictHostKeyChecking=accept-new -o LogLevel=ERROR ${shellQuote(name)} 'cd /home/ubuntu/nemoclaw && set -a && . .env && set +a && openshell sandbox connect nemoclaw'`);
 }
 
 async function start() {

test/deploy.test.js

@@ -0,0 +1,86 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+const { describe, it } = require("node:test");
+const assert = require("node:assert/strict");
+
+const {
+  validateInstanceName,
+  buildSshCommand,
+  buildRsyncCommand,
+  shellQuote,
+} = require("../bin/lib/deploy");
+
+describe("deploy helpers", () => {
+  describe("validateInstanceName", () => {
+    it("accepts valid names", () => {
+      for (const name of ["my-box", "prod.server", "test_01", "a", "A1-b.c_d"]) {
+        assert.doesNotThrow(() => validateInstanceName(name));
+      }
+    });
+
+    it("rejects names starting with hyphen", () => {
+      assert.throws(() => validateInstanceName("-bad"), /Invalid instance name/);
+    });
+
+    it("rejects shell injection", () => {
+      assert.throws(() => validateInstanceName("foo;rm -rf /"), /Invalid instance name/);
+    });
+
+    it("rejects command substitution", () => {
+      assert.throws(() => validateInstanceName("$(whoami)"), /Invalid instance name/);
+    });
+
+    it("rejects empty string", () => {
+      assert.throws(() => validateInstanceName(""), /Invalid instance name/);
+    });
+
+    it("rejects names with spaces", () => {
+      assert.throws(() => validateInstanceName("foo bar"), /Invalid instance name/);
+    });
+  });
+
+  describe("buildSshCommand", () => {
+    it("uses StrictHostKeyChecking=accept-new", () => {
+      const cmd = buildSshCommand("myhost", "ls");
+      assert.ok(cmd.includes("StrictHostKeyChecking=accept-new"));
+      assert.ok(!cmd.includes("StrictHostKeyChecking=no"));
+    });
+
+    it("quotes host and remote command", () => {
+      const cmd = buildSshCommand("myhost", "echo hello");
+      assert.ok(cmd.includes("'myhost'"));
+      assert.ok(cmd.includes("'echo hello'"));
+    });
+
+    it("works without remote command", () => {
+      const cmd = buildSshCommand("myhost");
+      assert.ok(cmd.includes("'myhost'"));
+      assert.ok(cmd.startsWith("ssh "));
+    });
+  });
+
+  describe("buildRsyncCommand", () => {
+    it("quotes source paths and destination", () => {
+      const cmd = buildRsyncCommand(["/tmp/a", "/tmp/b"], "host", "/dest/");
+      assert.ok(cmd.includes("'/tmp/a'"));
+      assert.ok(cmd.includes("'/tmp/b'"));
+      assert.ok(cmd.includes("'host:/dest/'"));
+    });
+
+    it("uses accept-new in ssh option", () => {
+      const cmd = buildRsyncCommand(["/tmp/a"], "host", "/dest/");
+      assert.ok(cmd.includes("accept-new"));
+    });
+  });
+
+  describe("shellQuote", () => {
+    it("wraps in single quotes", () => {
+      assert.equal(shellQuote("hello"), "'hello'");
+    });
+
+    it("escapes embedded single quotes", () => {
+      assert.equal(shellQuote("it's"), "'it'\\''s'");
+    });
+  });
+});