Show the VM's SSH host key fingerprint

src/api.ts

@@ -356,6 +356,26 @@ export interface VmInstance {
    * known — use it to filter OS images for a reinstall. Omitted if unknown.
    */
   cpu_arch?: CpuArch;
+  /**
+   * The VM's own SSH host keys, scanned from the guest after boot — for
+   * verifying the host on first connect instead of trusting whatever key it
+   * presents. Always an array, empty until the scan succeeds, and
+   * re-captured after a reinstall. Not the same as `ssh_key`, the customer's
+   * authorized key.
+   */
+  host_ssh_keys: Array<VmSshHostKey>;
+}
+
+export interface VmSshHostKey {
+  /** Key algorithm, e.g. "ssh-ed25519". */
+  key_type: string;
+  /** Base64 key blob, without the algorithm prefix or a comment. */
+  public_key: string;
+  /**
+   * `SHA256:…` fingerprint over the decoded key blob — the form
+   * `ssh-keygen -lf` prints and the one a client shows on an unknown host.
+   */
+  fingerprint_sha256: string;
 }
 
 export interface VmIpAssignment {

src/locales/ar.json

@@ -1511,6 +1511,9 @@
   "acrOoz": {
     "defaultMessage": "استمر."
   },
+  "af6sO8": {
+    "defaultMessage": "تحقق من مفتاح المضيف عند الاتصال لأول مرة."
+  },
   "agOXPD": {
     "defaultMessage": "Size"
   },

src/locales/de.json

@@ -1511,6 +1511,9 @@
   "acrOoz": {
     "defaultMessage": "Weiter."
   },
+  "af6sO8": {
+    "defaultMessage": "Überprüfen Sie beim ersten Verbindungsaufbau den Host-Schlüssel."
+  },
   "agOXPD": {
     "defaultMessage": "Size"
   },

src/locales/en.json

@@ -1511,6 +1511,9 @@
   "acrOoz": {
     "defaultMessage": "Continue"
   },
+  "af6sO8": {
+    "defaultMessage": "Verify the host key on first connect"
+  },
   "agOXPD": {
     "defaultMessage": "Size"
   },

src/locales/es.json

@@ -1511,6 +1511,9 @@
   "acrOoz": {
     "defaultMessage": "Continúe."
   },
+  "af6sO8": {
+    "defaultMessage": "Verifique la clave del servidor al realizar la primera conexión."
+  },
   "agOXPD": {
     "defaultMessage": "Size"
   },

src/locales/fr.json

@@ -1511,6 +1511,9 @@
   "acrOoz": {
     "defaultMessage": "Continuez."
   },
+  "af6sO8": {
+    "defaultMessage": "Vérifiez la clé de l’hôte lors de la première connexion."
+  },
   "agOXPD": {
     "defaultMessage": "Size"
   },

src/locales/ja.json

@@ -1511,6 +1511,9 @@
   "acrOoz": {
     "defaultMessage": "続行してください。"
   },
+  "af6sO8": {
+    "defaultMessage": "初回接続時にホストキーを確認してください。"
+  },
   "agOXPD": {
     "defaultMessage": "Size"
   },

src/locales/ko.json

@@ -1511,6 +1511,9 @@
   "acrOoz": {
     "defaultMessage": "계속 진행하세요."
   },
+  "af6sO8": {
+    "defaultMessage": "처음 연결할 때 호스트 키를 확인하세요."
+  },
   "agOXPD": {
     "defaultMessage": "Size"
   },

src/locales/pt.json

@@ -1511,6 +1511,9 @@
   "acrOoz": {
     "defaultMessage": "Continue."
   },
+  "af6sO8": {
+    "defaultMessage": "Verifique a chave do servidor na primeira conexão."
+  },
   "agOXPD": {
     "defaultMessage": "Size"
   },

src/locales/ru.json

@@ -1511,6 +1511,9 @@
   "acrOoz": {
     "defaultMessage": "Продолжайте."
   },
+  "af6sO8": {
+    "defaultMessage": "При первом подключении убедитесь в подлинности ключа хоста."
+  },
   "agOXPD": {
     "defaultMessage": "Size"
   },

src/locales/tr.json

@@ -1511,6 +1511,9 @@
   "acrOoz": {
     "defaultMessage": "Devam et."
   },
+  "af6sO8": {
+    "defaultMessage": "İlk bağlantıda ana bilgisayar anahtarını doğrulayın."
+  },
   "agOXPD": {
     "defaultMessage": "Size"
   },

src/locales/zh.json

@@ -1511,6 +1511,9 @@
   "acrOoz": {
     "defaultMessage": "继续。"
   },
+  "af6sO8": {
+    "defaultMessage": "首次连接时，请验证主机密钥。"
+  },
   "agOXPD": {
     "defaultMessage": "Size"
   },

src/pages/vm.tsx

@@ -363,6 +363,21 @@ export default function VmPage() {
               <pre className="select-all bg-cyber-panel px-4 py-3 rounded-sm font-mono text-sm text-cyber-text-bright w-fit max-w-full overflow-x-auto">
                 ssh {state.image.default_username}@{bestHost()}
               </pre>
+              {(state.host_ssh_keys?.length ?? 0) > 0 && (
+                <div className="mt-3 flex flex-col gap-2">
+                  <span className="text-[0.65rem] uppercase tracking-[0.2em] text-cyber-text">
+                    <FormattedMessage defaultMessage="Verify the host key on first connect" />
+                  </span>
+                  {state.host_ssh_keys.map((k) => (
+                    <pre
+                      key={k.fingerprint_sha256}
+                      className="select-all bg-cyber-panel px-4 py-2 rounded-sm font-mono text-xs text-cyber-muted w-fit max-w-full overflow-x-auto"
+                    >
+                      {k.key_type} {k.fingerprint_sha256}
+                    </pre>
+                  ))}
+                </div>
+              )}
             </SectionCard>
           )}