Fix vagrant SSH strict host key checking failure by Copilot · Pull Request #6275 · wp-cli/wp-cli

Copilot · 2026-03-15T22:07:24Z

When ssh: vagrant is configured, WP-CLI parses vagrant ssh-config and builds a direct SSH command to the resolved host (typically 127.0.0.1:2222). This breaks when the VM has been recreated or a different VM previously occupied the same loopback address, triggering SSH's "REMOTE HOST IDENTIFICATION HAS CHANGED!" error.

Vagrant itself sets StrictHostKeyChecking no and UserKnownHostsFile /dev/null in its ssh-config output, but WP-CLI only consumed a subset of those values (HostName, Port, User, IdentityFile).

Changes

php/WP_CLI/Runner.php: Introduces an $is_vagrant_ssh flag, set when SSH connection details are derived from vagrant ssh-config. Adds -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null to the SSH command args in that case, mirroring what vagrant itself specifies. Regular (non-vagrant) SSH connections are unaffected.
features/aliases.feature: Adds a scenario asserting the strict host checking options appear in the generated command when ssh: vagrant is used.

Generated command example (with ssh: vagrant in wp-cli.yml):

ssh -p 2222 -i '/path/to/key' -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T -q 'vagrant@127.0.0.1' 'wp ...'

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

example.com
- Triggering command: /usr/bin/php php vendor/bin/phpunit --color=always --bootstrap ./vendor/wp-cli/wp-cli-tests/tests/bootstrap.php (dns block)
nosuchhost_asdf_asdf_asdf.com
- Triggering command: /usr/bin/php php vendor/bin/phpunit --color=always --bootstrap ./vendor/wp-cli/wp-cli-tests/tests/bootstrap.php (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

This section details on the original issue you should resolve

<issue_title>SSH vagrant fails due to strict host checking</issue_title>
<issue_description>## Bug Report

Yes, I reviewed the contribution guidelines.

Yes, more specifically, I reviewed the guidelines on how to write clear bug reports.

Describe the current, buggy behavior

When setting this wp-cli.yml:
path: "public_html"
@test:
  ssh: vagrant
  path: /srv/www/wordpress-two/public_html
WP CLI will see vagrant and attempt to run vagrant ssh-config to retrieve the connection details. However, this connection fails. To see why, I ran the ssh command WP CLI uses without the -q parameter:
~/dev/vvv/www/wordpress-two ᚴ:master 
❯ ssh -p 2222  -i /Users/tarendai/.vagrant.d/insecure_private_key -t 'vagrant@127.0.0.1'
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:odkaAaxa8UwMr5eB6espa1lXGWOtmJ8w/9M5M/sEU6w.
Please contact your system administrator.
Add correct host key in /Users/tarendai/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /Users/tarendai/.ssh/known_hosts:7
ECDSA host key for [127.0.0.1]:2222 has changed and you have requested strict checking.
Host key verification failed.
If:

the user has used a local loopback SSH

the user has destroyed and recreated the VM

had a different VM open

Then aliases that use ssh will fail due to fingerprinting

Describe how other contributors can replicate this bug

Add vagrant to an alias as the ssh parameter

ensure that 127.0.0.1 is present in SSH known hosts for reasons unrelated to vagrant

attempt to use WP CLI on the host to SSH into the guest

Describe what you expect as the correct outcome

Working alias' when ssh: vagrant is specified

Provide a possible solution

Remove strict host checking when the host is 127.0.0.1, e.g. ssh -o StrictHostKeychecking=no, or, allow wp-cli.yml to force the use of the vagrant ssh fallback
</issue_description>

Comments on the Issue (you are @copilot in this section)
@danielbachhuber Thanks for the report, @tomjn

allow wp-cli.yml to force the use of the vagrant ssh fallback

I think I'm open to this approach, if someone would like to submit a PR.</comment_new>

Fixes SSH vagrant fails due to strict host checking #5488

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.

When ssh: vagrant is configured and vagrant ssh-config is parsed, add -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null to the SSH command to match what vagrant itself sets. This prevents failures when the vagrant VM has been recreated and has a different host key than what is stored in ~/.ssh/known_hosts. Adds a Behat test scenario to verify the fix. Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

codecov · 2026-03-16T07:14:51Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Copilot

Pull request overview

This PR fixes WP-CLI’s ssh: vagrant alias behavior by mirroring Vagrant’s SSH config that disables strict host key checking, preventing failures when the VM is recreated and the host key changes.

Changes:

Track when SSH connection details were derived from vagrant ssh-config and, in that case, add -o StrictHostKeyChecking=no and -o UserKnownHostsFile=/dev/null to the generated SSH command.
Add a Behat scenario asserting the strict host checking options appear in the generated command for ssh: vagrant.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
`php/WP_CLI/Runner.php`	Adds a vagrant-derived flag and injects vagrant-like SSH options into the generated SSH command.
`features/aliases.feature`	Adds a scenario covering the vagrant strict host key checking behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

features/aliases.feature

php/WP_CLI/Runner.php

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

features/aliases.feature

@swissspidy

* Initial plan * Fix vagrant SSH strict host key checking failure When ssh: vagrant is configured and vagrant ssh-config is parsed, add -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null to the SSH command to match what vagrant itself sets. This prevents failures when the vagrant VM has been recreated and has a different host key than what is stored in ~/.ssh/known_hosts. Adds a Behat test scenario to verify the fix. Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Apply suggestion from @swissspidy --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> Co-authored-by: Pascal Birchler <pascalb@google.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

@swissspidy

…6270) * fix(context): resolve admin user dynamically Replace hardcoded user ID 1 fallback in Admin context with smart user resolution. On multisite, queries get_super_admins() to find a valid super admin. On single site, queries for the first user with the administrator role. Emits a clear error if no suitable user is found. Fixes #6269 * fix(context): optimize query and add test cases Use get_users() with login__in for single DB query instead of looping get_user_by(). Add single-site error case test. Replace wp super-admin commands with direct option manipulation in tests. * fix(context): fix linting issues Use single quotes for strings per PHPCS rules. Fix gherkin use-and lint violations by replacing consecutive When steps with And. * fix(context): address review feedback Revert multisite super admin lookup from get_users() back to foreach + get_user_by('login') loop because get_users() only fetches users on the current site but a super admin might not be a member of any site. Add debug logging after resolving admin user ID. * fix(context): use instanceof for type safety * Fix autoloader priority: locally installed packages now fully override phar-bundled versions (#6218) Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Pascal Birchler <pascalb@google.com> * Add environment variable configuration support to wp-cli.yml (#6169) Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Pascal Birchler <pascalb@google.com> * Autocomplete `--url` (#5704) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Pascal Birchler <pascalb@google.com> Co-authored-by: Pascal Birchler <pascal.birchler@gmail.com> * Add WP-CLI handbook link to `wp help` output (#6273) * Initial plan * Add WP-CLI handbook URL reference to wp help output Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> * Update file(s) from wp-cli/.github * Update file(s) from wp-cli/.github * Fix SSH alias path not forwarded to remote when defined as a separate config key (#6274) * Initial plan * Fix SSH alias path not forwarded to remote when path is a separate config key Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> * Fix: forward active alias to runcommand subprocess (#6272) Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * Fix vagrant SSH strict host key checking failure (#6275) * Initial plan * Fix vagrant SSH strict host key checking failure When ssh: vagrant is configured and vagrant ssh-config is parsed, add -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null to the SSH command to match what vagrant itself sets. This prevents failures when the vagrant VM has been recreated and has a different host key than what is stored in ~/.ssh/known_hosts. Adds a Behat test scenario to verify the fix. Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Apply suggestion from @swissspidy --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> Co-authored-by: Pascal Birchler <pascalb@google.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Add optional `$newline` parameter to `WP_CLI::log()` and `WP_CLI::line()` (#6276) * Initial plan * Add optional $newline parameter to WP_CLI::log(), WP_CLI::line(), and logger info() methods Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> * Undo Base class change --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> Co-authored-by: Pascal Birchler <pascalb@google.com> * Refactor: remove unused imports (#6277) * Harden some tests on macOS * Update tests --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Pascal Birchler <pascalb@google.com> Co-authored-by: Ian Dunn <ian@iandunn.name> Co-authored-by: Pascal Birchler <pascal.birchler@gmail.com> Co-authored-by: swissspidy <swissspidy@users.noreply.github.com> Co-authored-by: Sören Wünsch <soerenwrede@gmail.com>

Initial plan

c5c1f4e

Copilot AI assigned Copilot and swissspidy Mar 15, 2026

Copilot started work on behalf of swissspidy March 15, 2026 22:07 View session

github-actions bot added bug command:cli Related to 'cli' command command:cli-utils labels Mar 15, 2026

Copilot AI changed the title ~~[WIP] [BUG-123] Fix SSH vagrant fails due to strict host checking~~ Fix vagrant SSH strict host key checking failure Mar 15, 2026

Copilot AI requested a review from swissspidy March 15, 2026 22:14

Copilot finished work on behalf of swissspidy March 15, 2026 22:14

swissspidy marked this pull request as ready for review March 16, 2026 07:21

swissspidy requested a review from a team as a code owner March 16, 2026 07:21

Copilot AI review requested due to automatic review settings March 16, 2026 07:21

Copilot started reviewing on behalf of swissspidy March 16, 2026 07:22 View session

Copilot AI reviewed Mar 16, 2026

View reviewed changes

features/aliases.feature Outdated Show resolved Hide resolved

php/WP_CLI/Runner.php Show resolved Hide resolved

php/WP_CLI/Runner.php Show resolved Hide resolved

Potential fix for pull request finding

05afbff

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

swissspidy reviewed Mar 16, 2026

View reviewed changes

features/aliases.feature Outdated Show resolved Hide resolved

Apply suggestion from @swissspidy

c01f24f

swissspidy approved these changes Mar 16, 2026

View reviewed changes

swissspidy added this to the 3.0.0 milestone Mar 16, 2026

swissspidy merged commit 69df18c into main Mar 16, 2026
69 checks passed

swissspidy deleted the copilot/fix-ssh-vagrant-connection branch March 16, 2026 13:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix vagrant SSH strict host key checking failure#6275

Fix vagrant SSH strict host key checking failure#6275
swissspidy merged 4 commits intomainfrom
copilot/fix-ssh-vagrant-connection

Copilot AI commented Mar 15, 2026 •

edited

Loading

Uh oh!

codecov bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

I tried to connect to the following addresses, but was blocked by firewall rules:

Comments on the Issue (you are @copilot in this section)

Uh oh!

codecov bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 15, 2026 •

edited

Loading

codecov bot commented Mar 16, 2026 •

edited

Loading