ai-remote 0.5.1 → 0.6.0

package/README.md

@@ -35,6 +35,46 @@ npx ai-remote exec "systemctl status nginx"
 npx ai-remote close
 ```
 
+### Agent computer use over VNC and RDP
+
+Open a session once, then reuse it from a persistent Node runtime:
+
+```js
+import { RemoteComputer, desktopPoint } from 'ai-remote/computer';
+
+const desktop = new RemoteComputer('my-session');
+const image = await desktop.screenshot({ maxEdge: 1000 });
+// Inspect the PNG in image.base64, then choose a point in screenshot pixels.
+const point = desktopPoint(image, { x: 100, y: 150 });
+const after = await desktop.act([
+  { type: 'click', ...point },
+  { type: 'type', text: 'literal text; including semicolons' },
+]);
+// after.base64 is the new PNG, ready to return to a vision-capable agent.
+```
+
+The same API drives either protocol. `act` batches input and returns one
+in-memory screenshot; `dispatch` skips capture for a known sequence. Keep the
+JavaScript handle and your own variables across calls. No CLI subprocess or
+new remote connection is needed for each action.
+
+For CLI callers, put an action array in a JSON file:
+
+```bash
+ai-remote batch actions.json --session my-session --shot after.png --json
+```
+
+Actions include repeated clicks (`count`, optional `intervalMs`), pointer moves,
+scrolling, literal text, keyboard chords, waits, and drag paths. See
+[the agent skill](SKILL.md#structured-batches-and-a-reusable-javascript-client)
+for schemas, pacing, and coordinate rules. JSON input is validated before
+execution, and desktop IPC batches do not interleave with each other.
+
+This supplies remote pixels and input; it does not add browser DOM access,
+native accessibility trees, or a model. `changed` and `quiet` describe observed
+pixels, not completion of the application's work. Verify results after bursts
+and observe before choosing actions that depend on a new screen.
+
 ### What a command costs, and where the time actually goes
 
 Measured on an M4, `list` with two sessions open:

package/SKILL.md

@@ -53,25 +53,104 @@ prints are npm's own and harmless — ignore them, or add `--silent`.
 
 ## Working loop
 
-Act, then look. The session holds the framebuffer, so a screenshot taken after a
-click shows what the click did.
+### Structured batches and a reusable JavaScript client
+
+Prefer `batch` for generated actions and literal text. Unlike `do`, JSON text
+is never split on semicolons, and the entire batch schema and coordinates are
+validated before input starts. Both VNC and RDP use the same action API.
+
+```json
+[
+  { "type": "click", "x": 168, "y": 185, "count": 50 },
+  { "type": "wait", "ms": 500 }
+]
+```
+
+Save this as `actions.json`, then run:
 
 ```bash
-npx ai-remote key MetaLeft             # open the Start menu
-npx ai-remote shot -o after.png        # see what happened
+ai-remote batch actions.json --session test --shot result.png --region 8,95,320,180 --json
+```
+
+`batch -` reads JSON from stdin. Without `--shot`, dispatch finishes without
+waiting for a screenshot. A click's optional `intervalMs` controls pacing;
+its default is zero. Fifty inputs dispatched is not proof of fifty inputs
+processed: verify the application's resulting count. A burst may still be
+drawing when the first screenshot arrives. Add a workload-specific `wait`
+inside the batch or take another observation when that happens.
+
+Supported actions: `click` (`x`, `y`, optional `button`, `count`, `intervalMs`),
+`move` (`x`, `y`), `scroll` (`x`, `y`, `dx`, `dy`), `type` (`text`, optional
+`chunkSize`, `intervalMs`), `key` (`chord`), `wait` (`ms`), and `drag` (`path`
+of `{x,y}` points, optional `button`, `intervalMs`). Buttons are left=0,
+middle=1, right=2. Drag releases its button even if a step fails. Text defaults
+to eight Unicode code points per chunk with 20 ms between chunks; zero pacing
+can be selected explicitly. This avoids the observed unpaced long-input issue
+in the RDP Chrome omnibox without slowing clicks.
+
+For a persistent Node/JavaScript execution environment:
+
+```js
+import { RemoteComputer, desktopPoint } from 'ai-remote/computer';
+const desktop = new RemoteComputer('test'); // session already opened by CLI
+const image = await desktop.screenshot({ maxEdge: 800 });
+// Inspect image.base64 as PNG before choosing a point in that image.
+const point = desktopPoint(image, { x: 100, y: 100 });
+const after = await desktop.act([{ type: 'click', ...point }]);
+// Return after.base64 directly to the vision-capable caller.
+```
+
+Keep `desktop` and variables in the caller's JavaScript runtime. `act` returns
+PNG base64 and geometry directly, with no screenshot file or CLI subprocess.
+`dispatch` takes the same actions and skips observation. The remote connection
+stays in the existing daemon; individual API calls use local IPC. Desktop IPC
+batches and screenshots are serialized; a live human/viewer can still interact.
+This is a pixel/input API, not a browser DOM or native accessibility tree.
+
+Act, then look, in one command. `--shot` runs the steps and captures the frame
+they produced, so the two halves of one observation cost one round trip:
+
+```bash
+npx ai-remote key MetaLeft --shot after.png    # open the Start menu, and see it
+npx ai-remote click 640,400 --shot after.png
+npx ai-remote do "type hello; key Enter" --shot after.png
+```
+
+The capture waits for the frame the steps caused, not for a fixed delay, and it
+tells you what it found:
+
+```
+Pressed MetaLeft. Wrote after.png (1280x800).
+Pressed MetaLeft. Wrote after.png (1280x800), though nothing on screen changed.
 ```
 
-`shot` waits for the screen to stop changing before it captures, so there is
-normally no need to sleep first. When an action starts something slow (an app
-launching, a page loading), put an explicit wait in a `do` script instead of
-guessing from outside.
+**Read that second line.** "Nothing on screen changed" usually means the click
+landed somewhere that does nothing — the wrong coordinates, a window that was
+not focused — rather than that the screenshot is stale. Look again before
+repeating the click.
+
+It can also mean the action's only mark was too small to tell apart from what
+the desktop does on its own: clicking into a text field paints one caret, and a
+caret is smaller than a clock ticking. The picture is still the current one.
+
+"The screen was still moving" is not a failure: the picture is current, it was
+just taken while something was animating. Take another if it matters.
+
+A bare `npx ai-remote shot -o after.png` still works and is the right thing when
+you have not just done something. When an action starts something slow — an app
+launching, a page loading — put an explicit wait in a `do` script rather than
+guessing from outside:
+
+```bash
+npx ai-remote do "key MetaLeft; wait 800; type notepad; key Enter; wait 1500" --shot s.png
+```
 
 Prefer `do` when the next few steps are already known — one round trip instead
 of four, and the timing between steps stays inside the session rather than
 depending on how fast the shell gets round to the next command:
 
 ```bash
-npx ai-remote do "key MetaLeft; wait 800; type notepad; wait 1200; key Enter; wait 1500; shot s.png"
+npx ai-remote do "key MetaLeft; wait 800; type notepad; wait 1200; key Enter; wait 1500" --shot s.png
 ```
 
 Steps, separated by `;`:
@@ -114,6 +193,34 @@ screenshot full size and click the coordinates you read off it.
 image tokens and a 800px one is a fraction of that, usually with no loss of
 anything you needed to see.
 
+### Focus on one application
+
+For a known window that stays in place, `--region X,Y,W,H` captures only that
+rectangle. It works on `shot` and on commands with `--shot`. Use `--json` to
+retain its coordinate origin:
+
+```bash
+ai-remote click 544,705 --shot result.png --region 520,538,208,351 --json
+```
+
+Coordinates sent to input remain full-desktop pixels. For a returned cropped
+image, map using `desktop_x = viewport.x + image_x * viewport.width / width`
+and the equivalent formula for y. `width` and `height` are the returned image
+size; `desktopWidth` and `desktopHeight` are the whole desktop. The full-screen
+scaling formula above does not apply to cropped images.
+
+Invalid or out-of-bounds regions are refused before an atomic action runs.
+Re-observe the full desktop if the window moves or a dialog can appear outside
+the crop. A crop is explicit geometry, not automatic window tracking.
+
+A region also says which part of the screen you care about, so the wait for the
+screen to settle watches that rectangle and ignores the rest. On a machine with
+a build log scrolling in one corner, that is the difference between a capture
+that returns promptly and one that waits for a screen that is never still. The
+trade is the other way round too: a change *outside* the region no longer holds
+the capture back, so re-observe the whole desktop when something may have
+happened elsewhere.
+
 ## Modifier keys between a Mac and a PC
 
 When one end is a Mac and the other is not, **Control and Command swap** so the
@@ -433,10 +540,13 @@ npx ai-remote open HOST --ssh -u USER [-i ~/.ssh/id_ed25519]      # a terminal,
 npx ai-remote open HOST --vnc -u USER                             # a screen over VNC
 npx ai-remote vnc [--vnc-port N]                                  # ...or add one to this session
 npx ai-remote shot [-o FILE] [--max-edge N] [--json]
-npx ai-remote click X,Y [--button right|middle] [--double]
-npx ai-remote type "text"
-npx ai-remote key ControlLeft+KeyA
-npx ai-remote do "key MetaLeft; wait 800; type notepad; shot s.png"
+npx ai-remote click X,Y [--button right|middle] [--double] [--shot FILE]
+npx ai-remote type "text" [--shot FILE]
+npx ai-remote key ControlLeft+KeyA [--shot FILE]
+npx ai-remote do "key MetaLeft; wait 800; type notepad" [--shot FILE]
+                              # --shot: act and look in one round trip
+                              # bare --shot writes screen.png; a name that is
+                              # not a .png goes as --shot=NAME
 npx ai-remote exec "command" [--reconnect]
 npx ai-remote reconnect                                           # a new login: fresh PATH
 npx ai-remote clipboard [on|off]                                  # share text both ways

package/dist/{cli-chunk-M5GGPPAC.mjs → cli-chunk-L6E2YYPQ.mjs}

@@ -1,7 +1,11 @@
 import {
   SshSession,
   TcpTransport
-} from "./cli-chunk-X2JMVOWL.mjs";
+} from "./cli-chunk-UD2YES3P.mjs";
+import {
+  checkHostKey,
+  hostAddress
+} from "./cli-chunk-WWORJ2NE.mjs";
 
 // src/cli/shell.ts
 function bareUsername(username) {
@@ -27,10 +31,20 @@ var Shell = class {
       identities: options.identities ?? [],
       columns: options.columns ?? 120,
       rows: options.rows ?? 30,
-      // Every host this reaches was named by the person running the command,
-      // on their own network. There is no stored known_hosts to compare with
-      // yet, so nothing useful can be decided here.
-      verifyHost: async () => true,
+      // Compared against `~/.config/ai-remote/known_hosts.json`, on the same
+      // accept-new terms OpenSSH uses. A key that changed stops the connection.
+      verifyHost: (info) => {
+        const verdict = checkHostKey(
+          hostAddress(options.host, options.port),
+          info,
+          { insecure: options.insecureHostKey }
+        );
+        if (verdict.message) {
+          (options.onNotice ?? ((line) => console.error(line)))(verdict.message);
+        }
+        if (!verdict.accepted) this.lastError = verdict.message;
+        return verdict.accepted;
+      },
       openTransport: () => new TcpTransport(options.host, options.port)
     });
     this.session.addEventListener("data", (event) => {

package/dist/{cli-chunk-DGYNADUR.mjs → cli-chunk-P4645KKB.mjs}

@@ -3,7 +3,7 @@ import {
   VERSION,
   isTitlebarDragPoint,
   logicalDisplaySize
-} from "./cli-chunk-WBOYG4KJ.mjs";
+} from "./cli-chunk-TKKENOSJ.mjs";
 
 // src/cli/window.ts
 import { spawn } from "node:child_process";
@@ -38,7 +38,7 @@ function chunk(type, body) {
   view.setUint32(8 + body.length, crc32(out.subarray(4, 8 + body.length)));
   return out;
 }
-function encodePng(rgba, width, height) {
+function encodePng(rgba, width, height, level = 6) {
   const stride = width * 4;
   const raw = new Uint8Array((stride + 1) * height);
   for (let y = 0; y < height; y++) {
@@ -57,7 +57,7 @@ function encodePng(rgba, width, height) {
   const parts = [
     new Uint8Array([137, 80, 78, 71, 13, 10, 26, 10]),
     chunk("IHDR", ihdr),
-    chunk("IDAT", new Uint8Array(deflateSync(raw, { level: 6 }))),
+    chunk("IDAT", new Uint8Array(deflateSync(raw, { level }))),
     chunk("IEND", new Uint8Array(0))
   ];
   const total = parts.reduce((sum, part) => sum + part.length, 0);

package/dist/{cli-chunk-WBOYG4KJ.mjs → cli-chunk-TKKENOSJ.mjs}

@@ -1,5 +1,5 @@
 // src/cli/generated/version.ts
-var VERSION = "0.5.1";
+var VERSION = "0.6.0";
 
 // src/cli/viewer-layout.ts
 var TERMINAL_COLUMNS = 80;

package/dist/{cli-chunk-X2JMVOWL.mjs → cli-chunk-UD2YES3P.mjs}

@@ -245,14 +245,14 @@ function signatureBytes(algorithmName, signatureBlob) {
   const s = parts.mpint();
   return concatBytes(padStart(r, 32), padStart(s, 32));
 }
-async function verifyHostKeySignature({ algorithm, keyBlob, signatureBlob, exchangeHash: exchangeHash2 }) {
+async function verifyHostKeySignature({ algorithm, keyBlob, signatureBlob, exchangeHash: signedHash }) {
   const named = HOST_KEY_ALGORITHMS[algorithm];
   if (!named) throw new Error(`SSH: unsupported host key algorithm ${algorithm}`);
   const { kind, hash } = named;
   const key = await importHostKey(algorithm, keyBlob);
   const signature = signatureBytes(algorithm, signatureBlob);
   const parameters = kind === "ecdsa" ? { name: "ECDSA", hash } : kind === "rsa" ? { name: "RSASSA-PKCS1-v1_5" } : { name: "Ed25519" };
-  return subtle.verify(parameters, key, signature, exchangeHash2);
+  return subtle.verify(parameters, key, signature, signedHash);
 }
 async function exchangeHash({
   hash,
@@ -347,9 +347,11 @@ var SshTransport = class extends EventTarget {
   greeting;
   sendSequence;
   receiveSequence;
+  /** The AES-GCM state for each direction, once NEWKEYS has been exchanged. */
   outgoing;
   incoming;
   sessionId;
+  /** The key exchange in flight, or null between exchanges. */
   kex;
   kexQueue;
   keepaliveTimer;
@@ -386,7 +388,7 @@ var SshTransport = class extends EventTarget {
     this.sessionId = null;
     this.kex = null;
     this.kexQueue = [];
-    this.keepaliveTimer = null;
+    this.keepaliveTimer = void 0;
     this.bytesSent = 0;
     this.bytesReceived = 0;
   }
@@ -411,10 +413,12 @@ var SshTransport = class extends EventTarget {
       }, KEEPALIVE_INTERVAL_MS);
     });
     socket.addEventListener("message", (event) => {
-      if (typeof event.data === "string") return;
-      this.#receive(new Uint8Array(event.data));
+      const { data } = event;
+      if (typeof data === "string") return;
+      this.#receive(new Uint8Array(data));
     });
-    socket.addEventListener("close", (event) => {
+    socket.addEventListener("close", (rawEvent) => {
+      const event = rawEvent;
       this.#finish({
         clean: event.code === 1e3,
         code: event.code,
@@ -445,7 +449,7 @@ var SshTransport = class extends EventTarget {
     if (this.closed) return;
     this.closed = true;
     clearInterval(this.keepaliveTimer);
-    this.keepaliveTimer = null;
+    this.keepaliveTimer = void 0;
     this.dispatchEvent(new CustomEvent("close", { detail }));
   }
   fail(error) {
@@ -556,16 +560,18 @@ var SshTransport = class extends EventTarget {
     return frame;
   }
   async #decrypt(frame) {
+    const incoming = this.incoming;
+    if (!incoming) throw new Error("SSH: a packet arrived before the cipher was installed.");
     let plain;
     try {
       plain = new Uint8Array(await subtle2.decrypt(
         {
           name: "AES-GCM",
-          iv: this.incoming.nextIv(),
+          iv: incoming.nextIv(),
           additionalData: frame.subarray(0, 4),
           tagLength: GCM_TAG_BYTES * 8
         },
-        this.incoming.key,
+        incoming.key,
         frame.subarray(4)
       ));
     } catch {
@@ -717,6 +723,8 @@ var SshTransport = class extends EventTarget {
     this.kex.inbox.push(payload);
   }
   #nextKexPacket(expectedType) {
+    const kex = this.kex;
+    if (!kex) throw new Error("SSH: a key-exchange packet was awaited outside a key exchange.");
     return new Promise((resolve, reject) => {
       const check = (payload) => {
         if (expectedType !== void 0 && payload[0] !== expectedType) {
@@ -725,13 +733,13 @@ var SshTransport = class extends EventTarget {
         }
         resolve(payload);
       };
-      const queued = this.kex.inbox.shift();
+      const queued = kex.inbox.shift();
       if (queued) {
         check(queued);
         return;
       }
-      this.kex.pending = (payload) => {
-        this.kex.pending = null;
+      kex.pending = (payload) => {
+        kex.pending = null;
         check(payload);
       };
     });
@@ -811,7 +819,7 @@ var SshTransport = class extends EventTarget {
     ]);
     this.outgoing = await GcmCipher.create(keyToServer, ivToServer);
     this.incoming = await GcmCipher.create(keyToClient, ivToClient);
-    this.kex.running = false;
+    if (this.kex) this.kex.running = false;
     this.releaseNewKeys?.();
     this.releaseNewKeys = null;
     const queued = this.kexQueue;
@@ -990,16 +998,19 @@ var SshSession = class extends EventTarget {
   remoteMaxPacket;
   localWindow;
   pendingWrites;
+  /** True while the interactive shell channel is usable. */
   shellOpen;
   commandInFlight;
   /** Set while a tool command runs, to keep its framing off the screen. */
   displayFilter;
   /** True only after the requested interactive shell is ready for commands. */
-  readySignaled;
+  /** True once the interactive shell is actually usable, not merely authenticated. */
+  readySignaled = false;
   powerShellAttempted;
   powerShellTimer;
   /** '', 'posix', 'cmd' or 'powershell'; learned from the prompt. */
-  shellFamily;
+  /** 'powershell' when the host answered with one; '' until the shell is known. */
+  shellFamily = "";
   promptTail;
   exitStatus;
   exitSignal;
@@ -1143,7 +1154,7 @@ var SshSession = class extends EventTarget {
     idleMs = COMMAND_IDLE_MS,
     maxMs = COMMAND_MAX_MS
   } = {}) {
-    const text = String(command || "").trim();
+    const text = (command || "").trim();
     if (!text) return Promise.reject(new Error("No command was given."));
     if (!this.shellOpen || this.closed) {
       return Promise.reject(new Error("The SSH shell is not open."));
@@ -1430,21 +1441,21 @@ var SshSession = class extends EventTarget {
       this.#status("authenticating", `Authenticating as ${this.username}\u2026`);
       this.transport.send(new SshWriter(32).u8(MSG.SERVICE_REQUEST).string("ssh-userauth").take());
       await this.#expect(MSG.SERVICE_ACCEPT);
-      if (await this.#tryNone()) return void await this.#openShell();
+      if (await this.#tryNone()) return await this.#openShell();
       if (this.authMethods.includes("publickey")) {
         for (const identity of await this.#identities()) {
-          if (await this.#tryPublicKey(identity)) return void await this.#openShell();
+          if (await this.#tryPublicKey(identity)) return await this.#openShell();
         }
       }
       if (this.authMethods.includes("password") && this.password) {
-        if (await this.#tryPassword(this.password)) return void await this.#openShell();
+        if (await this.#tryPassword(this.password)) return await this.#openShell();
         this.passwordRejected = true;
       }
       if (this.authMethods.includes("keyboard-interactive")) {
-        if (await this.#tryKeyboardInteractive()) return void await this.#openShell();
+        if (await this.#tryKeyboardInteractive()) return await this.#openShell();
         if (this.canAsk && this.authMethods.includes("keyboard-interactive")) {
           if (await this.#tryKeyboardInteractive({ usePassword: false })) {
-            return void await this.#openShell();
+            return await this.#openShell();
           }
         }
       }
@@ -1453,7 +1464,7 @@ var SshSession = class extends EventTarget {
           prompt: `${this.username}@${this.options.hostLabel || "host"}'s password: `,
           echo: false
         });
-        if (typed && await this.#tryPassword(typed)) return void await this.#openShell();
+        if (typed && await this.#tryPassword(typed)) return await this.#openShell();
       }
       throw new Error(this.authMethods.length ? `SSH: authentication failed${this.triedKeys.length ? ` (the host refused ${this.triedKeys.join(", ")})` : ""}. The host accepts ${this.authMethods.join(", ")}.` : "SSH: the host rejected the connection before any authentication method was offered.");
     } catch (error) {

package/dist/cli-chunk-WWORJ2NE.mjs

@@ -0,0 +1,72 @@
+// src/cli/known-hosts.ts
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function configDir() {
+  const base = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(base, "ai-remote");
+}
+var storePath = () => join(configDir(), "known_hosts.json");
+function read() {
+  try {
+    const parsed = JSON.parse(readFileSync(storePath(), "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function write(store) {
+  mkdirSync(configDir(), { recursive: true, mode: 448 });
+  writeFileSync(storePath(), `${JSON.stringify(store, null, 2)}
+`, { mode: 384 });
+  chmodSync(storePath(), 384);
+}
+var hostAddress = (host, port) => `${host}:${port}`;
+function checkHostKey(address, info, { insecure = false } = {}) {
+  const store = read();
+  const known = store[address];
+  if (known && known.fingerprint === info.fingerprint) {
+    return { accepted: true, status: "known", message: "" };
+  }
+  if (known && !insecure) {
+    return {
+      accepted: false,
+      status: "changed",
+      message: [
+        `The host key for ${address} has changed.`,
+        `  expected: ${known.fingerprint}`,
+        `  received: ${info.fingerprint} (${info.keyType})`,
+        "Someone may be intercepting this connection. If the machine was genuinely",
+        `rebuilt, run \`ai-remote forget-host ${address}\` and connect again.`
+      ].join("\n")
+    };
+  }
+  store[address] = {
+    fingerprint: info.fingerprint,
+    keyType: info.keyType,
+    firstSeen: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  write(store);
+  return {
+    accepted: true,
+    status: known ? "known" : "new",
+    message: known ? `Host key for ${address} replaced at your request: ${info.fingerprint}` : `Recorded host key for ${address}: ${info.fingerprint} (${info.keyType})`
+  };
+}
+function forgetHostKey(address) {
+  const store = read();
+  if (!(address in store)) return false;
+  delete store[address];
+  write(store);
+  return true;
+}
+function knownHosts() {
+  return Object.entries(read()).map(([address, entry]) => ({ address, ...entry })).toSorted((a, b) => a.address < b.address ? -1 : a.address > b.address ? 1 : 0);
+}
+
+export {
+  hostAddress,
+  checkHostKey,
+  forgetHostKey,
+  knownHosts
+};

package/dist/{cli-copy-ZBTICP7N.mjs → cli-copy-2HQU2E7D.mjs}

@@ -1,11 +1,15 @@
 import {
   SshSession,
   TcpTransport
-} from "./cli-chunk-X2JMVOWL.mjs";
+} from "./cli-chunk-UD2YES3P.mjs";
 import {
   SshReader,
   SshWriter
 } from "./cli-chunk-XT2FISR5.mjs";
+import {
+  checkHostKey,
+  hostAddress
+} from "./cli-chunk-WWORJ2NE.mjs";
 
 // src/cli/copy.ts
 import { open as openFile, mkdir, readdir, stat as statFile } from "node:fs/promises";
@@ -438,10 +442,19 @@ var SftpConnection = class {
       // and still redirectable on its own.
       log: (step, detail) => process.stderr.write(`[SSH] ${step} ${JSON.stringify(detail)}
 `),
-      // The same reasoning as the terminal's: the person running the command
-      // named the host, on their own network, and there is no known_hosts here
-      // to compare against yet.
-      verifyHost: async () => true,
+      // The same known_hosts file the terminal uses, on the same accept-new
+      // terms: a key that changed stops the copy rather than completing it.
+      verifyHost: (info) => {
+        const verdict = checkHostKey(
+          hostAddress(options.host, options.port),
+          info,
+          { insecure: options.insecureHostKey }
+        );
+        if (verdict.message) process.stderr.write(`${verdict.message}
+`);
+        if (!verdict.accepted) this.#error = verdict.message;
+        return verdict.accepted;
+      },
       openTransport: () => new TcpTransport(options.host, options.port)
     });
     this.sftp = new Sftp({ write: (bytes) => this.#session.write(bytes) });