sneakoscope 6.2.0 → 6.4.0

package/dist/core/remote/machine-registry.js

@@ -0,0 +1,162 @@
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { readJson } from '../fsx.js';
+import { REMOTE_MACHINE_REGISTRY_SCHEMA } from './types.js';
+const MACHINE_ID_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+const SSH_ALIAS_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+export function remoteMachineRegistryPath(globalRoot) {
+    return path.join(path.resolve(globalRoot), 'remote', 'machines.json');
+}
+export function validateSshAlias(value) {
+    return typeof value === 'string' && SSH_ALIAS_RE.test(value);
+}
+export function validateRemoteMachineRegistry(value) {
+    const issues = [];
+    const record = asRecord(value);
+    if (!record || record.schema !== REMOTE_MACHINE_REGISTRY_SCHEMA)
+        issues.push('invalid_registry_schema');
+    const rawMachines = Array.isArray(record?.machines) ? record.machines : [];
+    if (!Array.isArray(record?.machines))
+        issues.push('machines_array_required');
+    if (rawMachines.length > 128)
+        issues.push('machine_count_exceeds_128');
+    const ids = new Set();
+    const aliases = new Set();
+    const machines = [];
+    rawMachines.forEach((raw, index) => {
+        const machine = asRecord(raw);
+        const prefix = `machine_${index}`;
+        if (!machine) {
+            issues.push(`${prefix}:object_required`);
+            return;
+        }
+        const id = stringValue(machine.id);
+        const displayName = stringValue(machine.display_name);
+        const sshAlias = stringValue(machine.ssh_alias);
+        const enabled = machine.enabled;
+        if (!MACHINE_ID_RE.test(id))
+            issues.push(`${prefix}:invalid_id`);
+        if (ids.has(id))
+            issues.push(`${prefix}:duplicate_id`);
+        if (id)
+            ids.add(id);
+        if (!displayName || displayName.length > 120)
+            issues.push(`${prefix}:invalid_display_name`);
+        if (machine.transport !== 'ssh-stdio')
+            issues.push(`${prefix}:unsupported_transport`);
+        if (!validateSshAlias(sshAlias))
+            issues.push(`${prefix}:invalid_ssh_alias`);
+        if (aliases.has(sshAlias))
+            issues.push(`${prefix}:duplicate_ssh_alias`);
+        if (sshAlias)
+            aliases.add(sshAlias);
+        if (typeof enabled !== 'boolean')
+            issues.push(`${prefix}:enabled_boolean_required`);
+        const roots = Array.isArray(machine.allowed_roots) ? machine.allowed_roots.map(stringValue) : [];
+        if (!Array.isArray(machine.allowed_roots) || roots.length === 0)
+            issues.push(`${prefix}:allowed_roots_required`);
+        if (roots.length > 32)
+            issues.push(`${prefix}:allowed_roots_exceeds_32`);
+        const uniqueRoots = new Set();
+        roots.forEach((root, rootIndex) => {
+            const issue = validateAllowedRoot(root);
+            if (issue)
+                issues.push(`${prefix}:root_${rootIndex}:${issue}`);
+            const normalized = path.normalize(root);
+            if (uniqueRoots.has(normalized))
+                issues.push(`${prefix}:root_${rootIndex}:duplicate_root`);
+            uniqueRoots.add(normalized);
+        });
+        if (MACHINE_ID_RE.test(id) && displayName && validateSshAlias(sshAlias) && machine.transport === 'ssh-stdio' && typeof enabled === 'boolean') {
+            machines.push({
+                id,
+                display_name: displayName,
+                transport: 'ssh-stdio',
+                ssh_alias: sshAlias,
+                allowed_roots: roots,
+                enabled
+            });
+        }
+    });
+    return {
+        ok: issues.length === 0,
+        issues,
+        registry: issues.length === 0 ? { schema: REMOTE_MACHINE_REGISTRY_SCHEMA, machines } : null
+    };
+}
+export async function loadRemoteMachineRegistry(file) {
+    const validation = validateRemoteMachineRegistry(await readJson(path.resolve(file), null));
+    if (!validation.ok || !validation.registry)
+        throw new Error(`remote_machine_registry_invalid:${validation.issues.join(',')}`);
+    return validation.registry;
+}
+export function findRemoteMachine(registry, machineId) {
+    const machine = registry.machines.find((candidate) => candidate.id === machineId && candidate.enabled);
+    if (!machine)
+        throw new Error(`remote_machine_unknown_or_disabled:${machineId}`);
+    return machine;
+}
+export function selectWorkerMachine(registry, explicitMachineId, hostname = os.hostname()) {
+    if (explicitMachineId)
+        return findRemoteMachine(registry, explicitMachineId);
+    const hostnameMatch = registry.machines.find((machine) => machine.enabled && machine.id === hostname);
+    if (hostnameMatch)
+        return hostnameMatch;
+    const enabled = registry.machines.filter((machine) => machine.enabled);
+    if (enabled.length === 1 && enabled[0])
+        return enabled[0];
+    throw new Error('remote_worker_machine_id_required');
+}
+export async function resolveAllowedProjectRoot(machine, candidateRoot) {
+    if (!path.isAbsolute(candidateRoot))
+        throw new Error('remote_project_root_must_be_absolute');
+    const candidateReal = await fsp.realpath(path.resolve(candidateRoot)).catch(() => null);
+    if (!candidateReal)
+        throw new Error('remote_project_root_unreadable');
+    const candidateStat = await fsp.stat(candidateReal).catch(() => null);
+    if (!candidateStat?.isDirectory())
+        throw new Error('remote_project_root_not_directory');
+    for (const configuredRoot of machine.allowed_roots) {
+        const rootStat = await fsp.lstat(configuredRoot).catch(() => null);
+        if (!rootStat || !rootStat.isDirectory() || rootStat.isSymbolicLink())
+            continue;
+        const allowedReal = await fsp.realpath(configuredRoot).catch(() => null);
+        if (!allowedReal)
+            continue;
+        if (isWithinRoot(allowedReal, candidateReal))
+            return candidateReal;
+    }
+    throw new Error('remote_project_root_not_allowlisted_or_symlink_escape');
+}
+export function isLexicallyWithinAllowedRoot(machine, candidateRoot) {
+    if (!path.isAbsolute(candidateRoot))
+        return false;
+    const candidate = path.resolve(candidateRoot);
+    return machine.allowed_roots.some((root) => isWithinRoot(path.resolve(root), candidate));
+}
+export function validateAllowedRoot(root) {
+    if (!root || !path.isAbsolute(root))
+        return 'absolute_path_required';
+    if (path.normalize(root) !== root || root.includes(`${path.sep}..${path.sep}`) || root.endsWith(`${path.sep}..`))
+        return 'normalized_path_required';
+    const parsedRoot = path.parse(root).root;
+    if (root === parsedRoot)
+        return 'filesystem_root_forbidden';
+    const normalized = root.replace(/\/+$/, '');
+    if (normalized === os.homedir().replace(/\/+$/, ''))
+        return 'home_root_forbidden';
+    if (/^\/Users\/[^/]+$/.test(normalized) || /^\/home\/[^/]+$/.test(normalized) || normalized === '/root')
+        return 'home_root_forbidden';
+    return null;
+}
+function isWithinRoot(root, candidate) {
+    const relative = path.relative(path.resolve(root), path.resolve(candidate));
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+function asRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function stringValue(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}

package/dist/core/remote/owner-proof.js

@@ -0,0 +1,224 @@
+import crypto from 'node:crypto';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { nowIso, readJson, runProcess, sha256, writeTextAtomic } from '../fsx.js';
+import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-guard.js';
+import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
+import { REMOTE_OWNER_PROOF_SCHEMA, REMOTE_R2_APPROVAL_SCHEMA } from './types.js';
+export class RemoteOwnerProofError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'RemoteOwnerProofError';
+    }
+}
+export class RemoteOwnerProofStore {
+    directory;
+    constructor(directory) {
+        this.directory = directory;
+    }
+    async register(proof) {
+        validateOwnerProof(proof);
+        const file = this.pathFor(proof.session_id);
+        await writeTextAtomic(file, `${JSON.stringify(proof, null, 2)}\n`, { mode: 0o600 });
+    }
+    async read(sessionId) {
+        const file = this.pathFor(sessionId);
+        const stat = await fsp.lstat(file).catch(() => null);
+        if (!stat)
+            return null;
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw new RemoteOwnerProofError('owner_proof_file_invalid');
+        if ((stat.mode & 0o077) !== 0)
+            throw new RemoteOwnerProofError('owner_proof_permissions_must_be_0600');
+        const proof = await readJson(file);
+        validateOwnerProof(proof);
+        if (proof.session_id !== sessionId)
+            throw new RemoteOwnerProofError('owner_proof_session_mismatch');
+        return proof;
+    }
+    pathFor(sessionId) {
+        const key = sha256(assertBoundedString(sessionId, 'session_id', 160)).slice(0, 24);
+        return path.join(path.resolve(this.directory), `${key}.json`);
+    }
+}
+export async function inspectRemoteProcess(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return null;
+    const ps = await runProcess('ps', ['-p', String(pid), '-o', 'lstart=', '-o', 'command='], {
+        timeoutMs: 3_000,
+        maxOutputBytes: 64 * 1024
+    }).catch(() => null);
+    if (!ps || ps.code !== 0 || !ps.stdout.trim())
+        return null;
+    const lines = ps.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    const combined = lines.join(' ');
+    const startMatch = combined.match(/^(\S+\s+\S+\s+\d+\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+)$/);
+    if (!startMatch?.[1] || !startMatch[2])
+        return null;
+    const cwd = await runProcess('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], {
+        timeoutMs: 3_000,
+        maxOutputBytes: 64 * 1024
+    }).catch(() => null);
+    if (!cwd || cwd.code !== 0)
+        return null;
+    const cwdLine = cwd.stdout.split(/\r?\n/).find((line) => line.startsWith('n'));
+    if (!cwdLine?.slice(1))
+        return null;
+    const projectRoot = await fsp.realpath(cwdLine.slice(1)).catch(() => null);
+    if (!projectRoot)
+        return null;
+    return {
+        pid,
+        process_start_time: normalizeSpace(startMatch[1]),
+        command: normalizeCommand(startMatch[2]),
+        project_root: projectRoot
+    };
+}
+export async function cancelOwnedSession(input) {
+    const sessionId = input.envelope.session_id;
+    if (!sessionId)
+        throw new RemoteOwnerProofError('cancel_session_id_required');
+    validateR2Approval(input.envelope, input.payload, input.now?.() ?? Date.now());
+    const owner = await input.store.read(sessionId);
+    if (!owner)
+        throw new RemoteOwnerProofError('owner_proof_missing');
+    const expectedRoot = await fsp.realpath(path.resolve(input.payload.expected_project_root)).catch(() => null);
+    if (!expectedRoot)
+        throw new RemoteOwnerProofError('expected_project_root_unreadable');
+    const ownerRoot = await fsp.realpath(path.resolve(owner.project_root)).catch(() => null);
+    if (!ownerRoot)
+        throw new RemoteOwnerProofError('owner_project_root_unreadable');
+    assertEqual(owner.session_id, sessionId, 'owner_session_mismatch');
+    assertEqual(owner.project_id, input.envelope.project_id, 'owner_project_mismatch');
+    assertEqual(owner.pid, input.payload.expected_pid, 'owner_pid_mismatch');
+    assertEqual(normalizeSpace(owner.process_start_time), normalizeSpace(input.payload.expected_process_start_time), 'owner_start_time_mismatch');
+    assertEqual(normalizeCommand(owner.expected_command), normalizeCommand(input.payload.expected_command), 'owner_command_mismatch');
+    assertEqual(ownerRoot, expectedRoot, 'owner_project_root_mismatch');
+    assertEqual(owner.active_generation, input.payload.expected_generation, 'owner_generation_mismatch');
+    assertEqual(owner.active_generation, input.currentGeneration, 'active_generation_mismatch');
+    if (!timingSafeEqual(owner.owner_nonce, input.payload.owner_nonce))
+        throw new RemoteOwnerProofError('owner_nonce_mismatch');
+    const live = await (input.inspectProcess ?? inspectRemoteProcess)(owner.pid);
+    if (!live)
+        throw new RemoteOwnerProofError('owned_process_not_running_or_uninspectable');
+    assertEqual(live.pid, owner.pid, 'live_pid_mismatch');
+    assertEqual(normalizeSpace(live.process_start_time), normalizeSpace(owner.process_start_time), 'process_start_time_mismatch');
+    assertEqual(normalizeCommand(live.command), normalizeCommand(owner.expected_command), 'foreign_process_command_refused');
+    const liveRoot = await fsp.realpath(path.resolve(live.project_root)).catch(() => null);
+    if (!liveRoot || liveRoot !== expectedRoot)
+        throw new RemoteOwnerProofError('foreign_process_project_root_refused');
+    await (input.killProcess ?? defaultKill(input.root, expectedRoot))(owner.pid);
+    return { pid: owner.pid, signal: 'SIGTERM', owner_proof: 'verified' };
+}
+export function parseRemoteCancelPayload(value) {
+    const record = asRecord(value);
+    if (!record)
+        throw new RemoteOwnerProofError('cancel_payload_object_required');
+    const approval = asRecord(record.approval);
+    const parsed = {
+        owner_nonce: assertBoundedString(record.owner_nonce, 'owner_nonce', 256),
+        expected_pid: assertPositiveInteger(record.expected_pid, 'expected_pid'),
+        expected_process_start_time: assertBoundedString(record.expected_process_start_time, 'expected_process_start_time', 160),
+        expected_command: assertBoundedString(record.expected_command, 'expected_command', 4096),
+        expected_project_root: assertBoundedString(record.expected_project_root, 'expected_project_root', 4096),
+        expected_generation: assertPositiveInteger(record.expected_generation, 'expected_generation'),
+        approval: {
+            schema: approval?.schema === REMOTE_R2_APPROVAL_SCHEMA ? REMOTE_R2_APPROVAL_SCHEMA : invalid('approval_schema_invalid'),
+            approval_id: assertBoundedString(approval?.approval_id, 'approval_id', 160),
+            approved_by: approval?.approved_by === 'telegram-owner' ? 'telegram-owner' : invalid('approval_actor_invalid'),
+            approved_at: assertBoundedString(approval?.approved_at, 'approved_at', 64),
+            expires_at: assertBoundedString(approval?.expires_at, 'approval_expires_at', 64),
+            machine_id: assertBoundedString(approval?.machine_id, 'approval_machine_id', 160),
+            project_id: assertBoundedString(approval?.project_id, 'approval_project_id', 160),
+            session_id: assertBoundedString(approval?.session_id, 'approval_session_id', 160),
+            kind: approval?.kind === 'cancel' ? 'cancel' : invalid('approval_kind_invalid'),
+            command_id: assertBoundedString(approval?.command_id, 'approval_command_id', 160)
+        }
+    };
+    return parsed;
+}
+function validateR2Approval(envelope, payload, now) {
+    const approval = payload.approval;
+    assertEqual(approval.schema, REMOTE_R2_APPROVAL_SCHEMA, 'approval_schema_invalid');
+    assertEqual(approval.approved_by, 'telegram-owner', 'approval_actor_invalid');
+    assertEqual(approval.machine_id, envelope.machine_id, 'approval_machine_mismatch');
+    assertEqual(approval.project_id, envelope.project_id, 'approval_project_mismatch');
+    assertEqual(approval.session_id, envelope.session_id, 'approval_session_mismatch');
+    assertEqual(approval.kind, envelope.kind, 'approval_kind_mismatch');
+    assertEqual(approval.command_id, envelope.command_id, 'approval_command_mismatch');
+    const approvedAt = Date.parse(approval.approved_at);
+    const expiresAt = Date.parse(approval.expires_at);
+    if (!Number.isFinite(approvedAt) || !Number.isFinite(expiresAt))
+        throw new RemoteOwnerProofError('approval_timestamp_invalid');
+    if (approvedAt > now + 30_000)
+        throw new RemoteOwnerProofError('approval_from_future');
+    if (expiresAt <= now)
+        throw new RemoteOwnerProofError('approval_expired');
+    if (expiresAt - approvedAt > 10 * 60_000)
+        throw new RemoteOwnerProofError('approval_ttl_exceeds_10m');
+}
+function validateOwnerProof(value) {
+    if (!value || value.schema !== REMOTE_OWNER_PROOF_SCHEMA)
+        throw new RemoteOwnerProofError('owner_proof_schema_invalid');
+    assertBoundedString(value.session_id, 'session_id', 160);
+    assertBoundedString(value.project_id, 'project_id', 160);
+    if (!path.isAbsolute(value.project_root))
+        throw new RemoteOwnerProofError('owner_project_root_absolute_required');
+    assertPositiveInteger(value.pid, 'pid');
+    assertBoundedString(value.process_start_time, 'process_start_time', 160);
+    assertBoundedString(value.expected_command, 'expected_command', 4096);
+    assertBoundedString(value.owner_nonce, 'owner_nonce', 256);
+    assertPositiveInteger(value.active_generation, 'active_generation');
+    if (!Number.isFinite(Date.parse(value.registered_at)))
+        throw new RemoteOwnerProofError('registered_at_invalid');
+}
+function defaultKill(root, projectRoot) {
+    const contract = createRequestedScopeContract({
+        route: 'remote:cancel',
+        userRequest: 'Cancel only the exact owner-proof SKS remote session process.',
+        projectRoot,
+        overrides: { codex_app_process: true }
+    });
+    return async (pid) => guardedProcessKill(guardContextForRoute(root, contract, 'R2 owner-proof remote cancel'), pid, { confirmed: true, signal: 'SIGTERM' });
+}
+function timingSafeEqual(left, right) {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+function assertEqual(left, right, code) {
+    if (left !== right)
+        throw new RemoteOwnerProofError(code);
+}
+function assertBoundedString(value, field, max) {
+    const text = typeof value === 'string' ? value.trim() : '';
+    if (!text || Buffer.byteLength(text) > max)
+        throw new RemoteOwnerProofError(`${field}_invalid`);
+    return text;
+}
+function assertPositiveInteger(value, field) {
+    const number = Number(value);
+    if (!Number.isSafeInteger(number) || number <= 0)
+        throw new RemoteOwnerProofError(`${field}_invalid`);
+    return number;
+}
+function normalizeSpace(value) {
+    return value.trim().replace(/\s+/g, ' ');
+}
+function normalizeCommand(value) {
+    return value.trim();
+}
+function asRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function invalid(code) {
+    throw new RemoteOwnerProofError(code);
+}
+export function newOwnerNonce() {
+    return crypto.randomBytes(32).toString('base64url');
+}
+export function ownerProofRegisteredAt() {
+    return nowIso();
+}

package/dist/core/remote/protocol.js

@@ -0,0 +1,263 @@
+import { once } from 'node:events';
+import { REMOTE_COMMAND_SCHEMA, REMOTE_WORKER_REQUEST_SCHEMA, REMOTE_WORKER_RESPONSE_SCHEMA } from './types.js';
+export const DEFAULT_REMOTE_MAX_LINE_BYTES = 64 * 1024;
+export const DEFAULT_REMOTE_MAX_RESPONSE_BYTES = 512 * 1024;
+const IDENTIFIER_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/;
+const REMOTE_READ_VIEWS = new Set(['status', 'tail', 'diff', 'gates', 'trust', 'proof', 'artifacts', 'refresh', 'open']);
+export class RemoteProtocolError extends Error {
+    code;
+    details;
+    constructor(code, details = {}) {
+        super(code);
+        this.code = code;
+        this.details = details;
+        this.name = 'RemoteProtocolError';
+    }
+}
+export function parseWorkerRequestLine(line, now = Date.now()) {
+    if (Buffer.byteLength(line) > DEFAULT_REMOTE_MAX_LINE_BYTES)
+        throw new RemoteProtocolError('request_line_too_large');
+    let value;
+    try {
+        value = JSON.parse(line);
+    }
+    catch {
+        throw new RemoteProtocolError('request_json_invalid');
+    }
+    return validateWorkerRequest(value, now);
+}
+export function validateWorkerRequest(value, now = Date.now()) {
+    const record = asRecord(value);
+    if (!record || record.schema !== REMOTE_WORKER_REQUEST_SCHEMA)
+        throw new RemoteProtocolError('request_schema_invalid');
+    const id = identifier(record.id, 'request_id');
+    const type = record.type;
+    if (type === 'hello') {
+        exactKeys(record, ['schema', 'id', 'type']);
+        return { schema: REMOTE_WORKER_REQUEST_SCHEMA, id, type };
+    }
+    if (type === 'list_sessions') {
+        exactKeys(record, ['schema', 'id', 'type']);
+        return { schema: REMOTE_WORKER_REQUEST_SCHEMA, id, type };
+    }
+    if (type === 'read_snapshot') {
+        exactKeys(record, ['schema', 'id', 'type', 'session_id']);
+        return { schema: REMOTE_WORKER_REQUEST_SCHEMA, id, type, session_id: identifier(record.session_id, 'session_id') };
+    }
+    if (type === 'watch') {
+        exactKeys(record, ['schema', 'id', 'type', 'after_seq', 'session_id']);
+        const afterSeq = nonNegativeInteger(record.after_seq, 'after_seq');
+        const sessionId = record.session_id === undefined ? undefined : identifier(record.session_id, 'session_id');
+        return sessionId === undefined
+            ? { schema: REMOTE_WORKER_REQUEST_SCHEMA, id, type, after_seq: afterSeq }
+            : { schema: REMOTE_WORKER_REQUEST_SCHEMA, id, type, after_seq: afterSeq, session_id: sessionId };
+    }
+    if (type === 'prepare_cancel') {
+        exactKeys(record, ['schema', 'id', 'type', 'session_id', 'command_id']);
+        return {
+            schema: REMOTE_WORKER_REQUEST_SCHEMA,
+            id,
+            type,
+            session_id: identifier(record.session_id, 'session_id'),
+            command_id: identifier(record.command_id, 'command_id')
+        };
+    }
+    if (type === 'command') {
+        exactKeys(record, ['schema', 'id', 'type', 'envelope']);
+        return { schema: REMOTE_WORKER_REQUEST_SCHEMA, id, type, envelope: validateRemoteCommandEnvelope(record.envelope, now) };
+    }
+    throw new RemoteProtocolError('request_type_unsupported', { type: String(type ?? '') });
+}
+export function validateRemoteCommandEnvelope(value, now = Date.now()) {
+    const record = asRecord(value);
+    if (!record || record.schema !== REMOTE_COMMAND_SCHEMA)
+        throw new RemoteProtocolError('command_schema_invalid');
+    exactKeys(record, [
+        'schema', 'command_id', 'issued_at', 'expires_at', 'actor', 'machine_id', 'project_id',
+        'session_id', 'kind', 'risk', 'payload', 'idempotency_key'
+    ]);
+    const commandId = identifier(record.command_id, 'command_id');
+    const issuedAt = timestamp(record.issued_at, 'issued_at');
+    const expiresAt = timestamp(record.expires_at, 'expires_at');
+    if (issuedAt > now + 30_000)
+        throw new RemoteProtocolError('command_issued_from_future');
+    if (expiresAt <= now)
+        throw new RemoteProtocolError('command_expired');
+    if (expiresAt <= issuedAt)
+        throw new RemoteProtocolError('command_expiry_precedes_issue');
+    if (expiresAt - issuedAt > 15 * 60_000)
+        throw new RemoteProtocolError('command_ttl_exceeds_15m');
+    if (record.actor !== 'telegram-owner')
+        throw new RemoteProtocolError('command_actor_invalid');
+    const machineId = identifier(record.machine_id, 'machine_id');
+    const projectId = identifier(record.project_id, 'project_id');
+    const sessionId = record.session_id === null ? null : identifier(record.session_id, 'session_id');
+    const kind = record.kind;
+    const risk = record.risk;
+    if (kind !== 'input' && kind !== 'verify' && kind !== 'cancel' && kind !== 'read')
+        throw new RemoteProtocolError('command_kind_invalid');
+    if (risk !== 'R0' && risk !== 'R1' && risk !== 'R2')
+        throw new RemoteProtocolError('command_risk_invalid_or_r3_denied');
+    const expectedRisk = kind === 'read' ? 'R0' : kind === 'cancel' ? 'R2' : 'R1';
+    if (risk !== expectedRisk)
+        throw new RemoteProtocolError('command_risk_kind_mismatch', { expected_risk: expectedRisk });
+    if (kind !== 'read' && !sessionId)
+        throw new RemoteProtocolError('command_session_id_required');
+    const payload = asRecord(record.payload);
+    if (!payload)
+        throw new RemoteProtocolError('command_payload_object_required');
+    if (Buffer.byteLength(JSON.stringify(payload)) > 32 * 1024)
+        throw new RemoteProtocolError('command_payload_too_large');
+    if (kind === 'input')
+        boundedString(payload.text, 'input_text', 16 * 1024);
+    if (kind === 'read' && payload.view !== undefined) {
+        const view = boundedString(payload.view, 'read_view', 32);
+        if (!REMOTE_READ_VIEWS.has(view))
+            throw new RemoteProtocolError('command_read_view_unsupported');
+    }
+    const idempotencyKey = identifier(record.idempotency_key, 'idempotency_key');
+    return {
+        schema: REMOTE_COMMAND_SCHEMA,
+        command_id: commandId,
+        issued_at: String(record.issued_at),
+        expires_at: String(record.expires_at),
+        actor: 'telegram-owner',
+        machine_id: machineId,
+        project_id: projectId,
+        session_id: sessionId,
+        kind,
+        risk,
+        payload,
+        idempotency_key: idempotencyKey
+    };
+}
+export function workerSuccessResponse(request, data, extras = {}) {
+    const base = {
+        schema: REMOTE_WORKER_RESPONSE_SCHEMA,
+        id: request.id,
+        type: request.type,
+        ok: true,
+        data
+    };
+    return extras.receipt ? { ...base, receipt: extras.receipt } : base;
+}
+export function workerErrorResponse(id, type, code, options = {}) {
+    const error = {
+        code,
+        message: options.message ?? code,
+        retryable: options.retryable === true,
+        delivery: options.delivery ?? 'acknowledged',
+        ...(options.details ? { details: options.details } : {})
+    };
+    return { schema: REMOTE_WORKER_RESPONSE_SCHEMA, id, type, ok: false, error };
+}
+export async function runRemoteWorkerJsonl(options) {
+    const maxLineBytes = Math.max(1024, options.maxLineBytes ?? DEFAULT_REMOTE_MAX_LINE_BYTES);
+    const maxResponseBytes = Math.max(4096, options.maxResponseBytes ?? DEFAULT_REMOTE_MAX_RESPONSE_BYTES);
+    let buffer = Buffer.alloc(0);
+    let queue = Promise.resolve();
+    let ended = false;
+    const processLine = (lineBuffer) => {
+        queue = queue.then(async () => {
+            if (lineBuffer.length === 0)
+                return;
+            if (lineBuffer.length > maxLineBytes) {
+                await writeResponse(options.output, workerErrorResponse('unknown', 'hello', 'request_line_too_large'), maxResponseBytes);
+                return;
+            }
+            let request;
+            try {
+                request = validateWorkerRequest(JSON.parse(lineBuffer.toString('utf8')), options.now?.() ?? Date.now());
+            }
+            catch (err) {
+                const code = err instanceof RemoteProtocolError ? err.code : 'request_json_invalid';
+                const details = err instanceof RemoteProtocolError ? err.details : undefined;
+                await writeResponse(options.output, workerErrorResponse('unknown', 'hello', code, details ? { details } : {}), maxResponseBytes);
+                return;
+            }
+            let response;
+            try {
+                response = await options.handle(request);
+            }
+            catch (err) {
+                const code = err instanceof RemoteProtocolError ? err.code : 'worker_handler_failed';
+                response = workerErrorResponse(request.id, request.type, code, {
+                    message: code,
+                    ...(err instanceof RemoteProtocolError && Object.keys(err.details).length ? { details: err.details } : {})
+                });
+            }
+            await writeResponse(options.output, response, maxResponseBytes);
+        });
+    };
+    options.input.on('data', (chunk) => {
+        const incoming = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        buffer = Buffer.concat([buffer, incoming]);
+        let newline = buffer.indexOf(0x0a);
+        while (newline >= 0) {
+            let line = buffer.subarray(0, newline);
+            buffer = buffer.subarray(newline + 1);
+            if (line.at(-1) === 0x0d)
+                line = line.subarray(0, -1);
+            processLine(line);
+            newline = buffer.indexOf(0x0a);
+        }
+        if (buffer.length > maxLineBytes) {
+            const oversized = buffer;
+            buffer = Buffer.alloc(0);
+            processLine(oversized);
+        }
+    });
+    options.input.once('end', () => {
+        ended = true;
+        if (buffer.length > 0)
+            processLine(buffer);
+        buffer = Buffer.alloc(0);
+    });
+    options.input.once('error', () => {
+        ended = true;
+    });
+    if (!ended)
+        await Promise.race([once(options.input, 'end'), once(options.input, 'error')]);
+    await queue;
+}
+async function writeResponse(output, response, maxBytes) {
+    let line = `${JSON.stringify(response)}\n`;
+    if (Buffer.byteLength(line) > maxBytes) {
+        line = `${JSON.stringify(workerErrorResponse(response.id, response.type, 'response_output_limit_exceeded'))}\n`;
+    }
+    if (!output.write(line))
+        await once(output, 'drain');
+}
+function exactKeys(record, allowed) {
+    const allowedSet = new Set(allowed);
+    const unexpected = Object.keys(record).filter((key) => !allowedSet.has(key));
+    if (unexpected.length)
+        throw new RemoteProtocolError('unexpected_request_fields', { fields: unexpected });
+}
+function identifier(value, field) {
+    const text = typeof value === 'string' ? value : '';
+    if (!IDENTIFIER_RE.test(text))
+        throw new RemoteProtocolError(`${field}_invalid`);
+    return text;
+}
+function boundedString(value, field, maxBytes) {
+    const text = typeof value === 'string' ? value.trim() : '';
+    if (!text || Buffer.byteLength(text) > maxBytes)
+        throw new RemoteProtocolError(`${field}_invalid`);
+    return text;
+}
+function nonNegativeInteger(value, field) {
+    const number = Number(value);
+    if (!Number.isSafeInteger(number) || number < 0)
+        throw new RemoteProtocolError(`${field}_invalid`);
+    return number;
+}
+function timestamp(value, field) {
+    const parsed = Date.parse(typeof value === 'string' ? value : '');
+    if (!Number.isFinite(parsed))
+        throw new RemoteProtocolError(`${field}_invalid`);
+    return parsed;
+}
+function asRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}