sneakoscope 7.1.0 → 7.3.0

package/dist/core/release/runtime-script-pack-closure.js

@@ -15,6 +15,12 @@ export function analyzeRuntimeScriptPackClosure(root) {
     const rootReasons = new Map();
     const missingReferences = new Map();
     const dynamicWarnings = new Map();
+    const checkoutOnlyPolicies = [];
+    const checkoutOnlyPolicyIssues = [];
+    const manifestRoots = new Set();
+    const requiredScriptCategories = [];
+    const referenceSourcePolicies = [];
+    let rootMode = 'legacy_discovery';
     const collectRoots = (source, text, context = source, strictExplicit = false) => {
         const scan = scanScriptReferences(text, runtimeContext(context), candidateSet, strictExplicit);
         for (const reference of scan.references)
@@ -32,19 +38,79 @@ export function analyzeRuntimeScriptPackClosure(root) {
     let dynamicReferencePolicies = [];
     if (fs.existsSync(requiredManifestPath)) {
         const manifest = readJson(requiredManifestPath);
+        if (manifest.root_mode === 'manifest_ssot')
+            rootMode = 'manifest_ssot';
+        else if (manifest.root_mode !== undefined)
+            checkoutOnlyPolicyIssues.push(`runtime_script_root_mode_invalid:${String(manifest.root_mode)}`);
         for (const entry of Array.isArray(manifest.scripts) ? manifest.scripts : []) {
             const reference = normalizeScriptPath(String(entry?.path || ''));
-            if (reference && candidateSet.has(reference))
+            const reason = String(entry?.reason || '').trim();
+            const category = String(entry?.category || '').trim();
+            if (reference && candidateSet.has(reference)) {
+                manifestRoots.add(reference);
                 addRoot(roots, rootReasons, reference, 'runtime-required-scripts.json');
+            }
             else if (reference)
                 missingReferences.set(`runtime-required-scripts.json\0${reference}`, {
                     source: 'runtime-required-scripts.json', reference
                 });
+            if (!reference)
+                checkoutOnlyPolicyIssues.push(`runtime_required_script_path_invalid:${String(entry?.path || '')}`);
+            if (!reason)
+                checkoutOnlyPolicyIssues.push(`runtime_required_script_reason_missing:${reference || 'invalid'}`);
+            if (rootMode === 'manifest_ssot' && ![
+                'installed_runtime',
+                'installed_repair',
+                'installed_package_verification'
+            ].includes(category)) {
+                checkoutOnlyPolicyIssues.push(`runtime_required_script_category_invalid:${reference || 'invalid'}:${category || 'missing'}`);
+            }
+            if (reference && reason && (rootMode !== 'manifest_ssot' || category)) {
+                requiredScriptCategories.push({ path: reference, category: category || 'legacy_unspecified', reason });
+            }
+        }
+        for (const entry of Array.isArray(manifest.reference_source_policies) ? manifest.reference_source_policies : []) {
+            const source = String(entry?.source || '').trim().replace(/\\/g, '/');
+            const classification = String(entry?.classification || '').trim();
+            const reason = String(entry?.reason || '').trim();
+            if (!source || source.includes('..'))
+                checkoutOnlyPolicyIssues.push(`runtime_reference_source_policy_invalid:${source || 'missing'}`);
+            if (!['installed_runtime', 'checkout_ci', 'test_fixture'].includes(classification)) {
+                checkoutOnlyPolicyIssues.push(`runtime_reference_source_classification_invalid:${source || 'missing'}:${classification || 'missing'}`);
+            }
+            if (!reason)
+                checkoutOnlyPolicyIssues.push(`runtime_reference_source_reason_missing:${source || 'missing'}`);
+            if (source && !source.includes('..') && ['installed_runtime', 'checkout_ci', 'test_fixture'].includes(classification) && reason) {
+                referenceSourcePolicies.push({ source, classification, reason });
+            }
         }
         dynamicReferencePolicies = (Array.isArray(manifest.dynamic_reference_policies) ? manifest.dynamic_reference_policies : [])
             .map((entry) => ({ source: runtimeContext(String(entry?.source || '')), reason: String(entry?.reason || '').trim() }))
             .filter((entry) => entry.source && entry.reason)
             .sort((a, b) => a.source.localeCompare(b.source));
+        for (const entry of Array.isArray(manifest.checkout_only_scripts) ? manifest.checkout_only_scripts : []) {
+            const scriptPath = normalizeScriptPath(String(entry?.path || ''));
+            const reason = String(entry?.reason || '').trim();
+            const sources = Array.isArray(entry?.sources)
+                ? [...new Set(entry.sources.map((source) => String(source || '').trim().replace(/\\/g, '/')).filter(Boolean))].sort()
+                : [];
+            if (!scriptPath)
+                checkoutOnlyPolicyIssues.push(`checkout_only_script_path_invalid:${String(entry?.path || '')}`);
+            else if (!candidateSet.has(scriptPath))
+                checkoutOnlyPolicyIssues.push(`checkout_only_script_missing:${scriptPath}`);
+            if (!reason)
+                checkoutOnlyPolicyIssues.push(`checkout_only_script_reason_missing:${scriptPath || 'invalid'}`);
+            if (!sources.length)
+                checkoutOnlyPolicyIssues.push(`checkout_only_script_sources_missing:${scriptPath || 'invalid'}`);
+            for (const source of sources) {
+                if (!/^\.github\/workflows\/[A-Za-z0-9._/-]+\.ya?ml$/.test(source)) {
+                    checkoutOnlyPolicyIssues.push(`checkout_only_script_source_invalid:${scriptPath || 'invalid'}:${source}`);
+                }
+            }
+            if (scriptPath && candidateSet.has(scriptPath) && reason && sources.length) {
+                checkoutOnlyPolicies.push({ path: scriptPath, sources, reason });
+            }
+        }
     }
     for (const relative of runtimeReferenceSources(absoluteRoot)) {
         const absolute = path.join(absoluteRoot, relative);
@@ -57,10 +123,68 @@ export function analyzeRuntimeScriptPackClosure(root) {
         recordMissing(missingReferences, candidate, scan.missing);
         recordDynamic(dynamicWarnings, candidate, scan.dynamic);
     }
-    const closure = transitiveClosure(roots, edges);
+    const classifiedReferenceRoots = [];
+    const unclassifiedReferenceRoots = [];
+    const installedPolicyRoots = new Set();
+    if (rootMode === 'manifest_ssot') {
+        for (const [scriptPath, sources] of rootReasons) {
+            if (manifestRoots.has(scriptPath))
+                continue;
+            for (const source of sources) {
+                const policy = referenceSourcePolicies.find((entry) => sourcePolicyMatches(entry.source, source));
+                if (policy) {
+                    if (policy.classification === 'installed_runtime')
+                        installedPolicyRoots.add(scriptPath);
+                    classifiedReferenceRoots.push({
+                        path: scriptPath,
+                        source,
+                        classification: policy.classification,
+                        reason: policy.reason
+                    });
+                }
+                else {
+                    unclassifiedReferenceRoots.push({ path: scriptPath, source });
+                    checkoutOnlyPolicyIssues.push(`runtime_reference_source_unclassified:${scriptPath}:${source}`);
+                }
+            }
+        }
+    }
+    const packageRoots = rootMode === 'manifest_ssot'
+        ? new Set([...manifestRoots, ...installedPolicyRoots])
+        : new Set(roots);
+    const checkoutOnlyRoots = new Set();
+    for (const policy of checkoutOnlyPolicies) {
+        const observed = [...(rootReasons.get(policy.path) || [])].sort();
+        const missingSources = policy.sources.filter((source) => !observed.includes(source));
+        const unexpectedSources = observed.filter((source) => !policy.sources.includes(source));
+        if (!observed.length)
+            checkoutOnlyPolicyIssues.push(`checkout_only_script_policy_stale:${policy.path}`);
+        for (const source of missingSources) {
+            checkoutOnlyPolicyIssues.push(`checkout_only_script_source_not_observed:${policy.path}:${source}`);
+        }
+        for (const source of unexpectedSources) {
+            checkoutOnlyPolicyIssues.push(`checkout_only_script_unapproved_root_source:${policy.path}:${source}`);
+        }
+        if (observed.length && missingSources.length === 0 && unexpectedSources.length === 0) {
+            packageRoots.delete(policy.path);
+            checkoutOnlyRoots.add(policy.path);
+        }
+    }
+    const closure = transitiveClosure(packageRoots, edges);
+    const checkoutOnlyClosure = transitiveClosure(checkoutOnlyRoots, edges);
     const declaredResult = declaredRuntimeScriptAllowlist(pkg.files);
     const declaredSet = new Set(declaredResult.declared);
     const closureSet = new Set(closure);
+    const checkoutOnlyClosureSet = new Set(checkoutOnlyClosure);
+    for (const [source, dependencies] of edges) {
+        if (!closureSet.has(source) || checkoutOnlyClosureSet.has(source))
+            continue;
+        for (const dependency of dependencies) {
+            if (checkoutOnlyClosureSet.has(dependency)) {
+                checkoutOnlyPolicyIssues.push(`checkout_only_script_product_dependency:${dependency}:${source}`);
+            }
+        }
+    }
     const missingFromAllowlist = closure.filter((file) => !declaredSet.has(file));
     const staleAllowlistEntries = declaredResult.declared.filter((file) => !closureSet.has(file));
     const excluded = candidates.filter((file) => !closureSet.has(file));
@@ -69,11 +193,25 @@ export function analyzeRuntimeScriptPackClosure(root) {
     const observedDynamicSources = new Set(dynamicReferenceWarnings.map((entry) => entry.source));
     return {
         schema: 'sks.runtime-script-pack-closure.v1',
+        root_mode: rootMode,
         candidates,
-        roots: [...roots].sort(),
+        roots: [...packageRoots].sort(),
         root_reasons: [...rootReasons.entries()]
+            .filter(([scriptPath]) => packageRoots.has(scriptPath))
             .map(([scriptPath, sources]) => ({ path: scriptPath, sources: [...sources].sort() }))
             .sort((a, b) => a.path.localeCompare(b.path)),
+        required_script_categories: requiredScriptCategories.sort((a, b) => a.path.localeCompare(b.path)),
+        reference_source_policies: referenceSourcePolicies.sort((a, b) => a.source.localeCompare(b.source)),
+        classified_reference_roots: classifiedReferenceRoots.sort(comparePolicyFinding),
+        unclassified_reference_roots: unclassifiedReferenceRoots.sort(comparePolicyFinding),
+        checkout_only_roots: [...checkoutOnlyRoots].sort(),
+        checkout_only_root_reasons: [...rootReasons.entries()]
+            .filter(([scriptPath]) => checkoutOnlyRoots.has(scriptPath))
+            .map(([scriptPath, sources]) => ({ path: scriptPath, sources: [...sources].sort() }))
+            .sort((a, b) => a.path.localeCompare(b.path)),
+        checkout_only_closure: checkoutOnlyClosure,
+        checkout_only_excluded: checkoutOnlyClosure.filter((file) => !closureSet.has(file)),
+        checkout_only_policies: checkoutOnlyPolicies.sort((a, b) => a.path.localeCompare(b.path)),
         closure,
         excluded,
         declared: declaredResult.declared,
@@ -84,7 +222,7 @@ export function analyzeRuntimeScriptPackClosure(root) {
         dynamic_reference_policies: dynamicReferencePolicies,
         uncovered_dynamic_references: dynamicReferenceWarnings.filter((entry) => !dynamicPolicySources.has(entry.source)),
         stale_dynamic_reference_policies: dynamicReferencePolicies.filter((entry) => !observedDynamicSources.has(entry.source)),
-        declaration_issues: declaredResult.issues,
+        declaration_issues: [...new Set([...declaredResult.issues, ...checkoutOnlyPolicyIssues])].sort(),
         closure_sha256: digestLines(closure)
     };
 }
@@ -336,6 +474,17 @@ function addRoot(target, reasons, scriptPath, source) {
     current.add(source);
     reasons.set(scriptPath, current);
 }
+function sourcePolicyMatches(pattern, source) {
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
+    const expression = escaped
+        .replace(/\*\*/g, '\0')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\0/g, '.*');
+    return new RegExp(`^${expression}$`).test(source);
+}
+function comparePolicyFinding(a, b) {
+    return `${a.path}\0${a.source}`.localeCompare(`${b.path}\0${b.source}`);
+}
 function compareFinding(a, b) {
     return `${a.source}\0${a.reference || a.excerpt || ''}`.localeCompare(`${b.source}\0${b.reference || b.excerpt || ''}`);
 }

package/dist/core/release/stage-publish.js

@@ -0,0 +1,194 @@
+import path from 'node:path';
+import fs from 'node:fs';
+import { RELEASE_ORIGIN_IDENTITY, releaseOriginIdentity } from './release-origin.js';
+export const STAGE_PUBLISH_SCHEMA = 'sks.release-stage-publish.v1';
+export const STAGE_WORKFLOW_FILE = 'publish-npm.yml';
+export const RELEASE_BRANCH = 'main';
+const STAGE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function stagePublish(opts) {
+    const readJsonFile = opts.readJsonFile || defaultReadJson;
+    const steps = [];
+    const version = String(opts.version || readPackageVersion(opts.root, readJsonFile) || '').trim();
+    const confirmed = opts.confirm === true;
+    let commit = null;
+    let runId = null;
+    let stageId = null;
+    const preflight = runPreflight(opts, version);
+    steps.push(...preflight.steps);
+    commit = preflight.commit;
+    if (!preflight.ok)
+        return finish();
+    if (!confirmed) {
+        steps.push(skipped('push', 'confirm_required'), skipped('dispatch', 'confirm_required'));
+        steps.push(skipped('watch', 'confirm_required'), skipped('download', 'confirm_required'), skipped('verify', 'confirm_required'));
+        return finish();
+    }
+    const push = opts.run('git', ['push', 'origin', RELEASE_BRANCH]);
+    steps.push(step('push', push.status === 0, `git push origin ${RELEASE_BRANCH}`, push.status === 0 ? null : 'stage_push_failed'));
+    if (push.status !== 0)
+        return finish();
+    const dispatch = opts.run('gh', [
+        'workflow', 'run', STAGE_WORKFLOW_FILE,
+        '--ref', RELEASE_BRANCH,
+        '-f', `version=${version}`,
+        '-f', 'confirm_stage=true'
+    ]);
+    steps.push(step('dispatch', dispatch.status === 0, `gh workflow run ${STAGE_WORKFLOW_FILE} version=${version} confirm_stage=true`, dispatch.status === 0 ? null : 'stage_dispatch_failed'));
+    if (dispatch.status !== 0)
+        return finish();
+    runId = resolveRunId(opts, commit);
+    steps.push(step('resolve_run', Boolean(runId), runId ? `run ${runId}` : null, runId ? null : 'stage_run_not_found'));
+    if (!runId)
+        return finish();
+    const watch = opts.run('gh', ['run', 'watch', runId, '--exit-status'], { timeoutMs: opts.watchTimeoutMs ?? 3 * 60 * 60 * 1000 });
+    steps.push(step('watch', watch.status === 0, `gh run watch ${runId}`, watch.status === 0 ? null : 'stage_workflow_failed'));
+    if (watch.status !== 0)
+        return finish();
+    const artifactDir = opts.artifactDir || path.join(opts.root, '.sneakoscope', 'reports', 'release', version, 'stage');
+    const download = downloadArtifacts(opts, runId, commit, artifactDir);
+    steps.push(download.step);
+    if (!download.step.ok)
+        return finish();
+    const receipt = readStageReceipt(artifactDir, readJsonFile);
+    stageId = receipt.stageId;
+    steps.push(step('stage_receipt', Boolean(stageId), receipt.path, stageId ? null : receipt.blocker));
+    if (!stageId)
+        return finish();
+    const verify = runLocalVerify(opts, { artifactDir, version, stageId });
+    steps.push(verify);
+    return finish();
+    function finish() {
+        const blockers = steps.filter((entry) => entry.blocker).map((entry) => String(entry.blocker));
+        const reachedApproval = Boolean(stageId) && steps.every((entry) => entry.ok || entry.blocker === null);
+        return {
+            schema: STAGE_PUBLISH_SCHEMA,
+            ok: blockers.length === 0 && (confirmed ? reachedApproval : true),
+            confirmed,
+            version,
+            commit,
+            run_id: runId,
+            stage_id: stageId,
+            steps,
+            blockers,
+            approval_command: stageId ? `npm stage approve ${stageId}` : null,
+            approval_is_human_2fa_step: true,
+            next_actions: nextActions({ confirmed, stageId, blockers })
+        };
+    }
+}
+function nextActions(state) {
+    if (!state.confirmed)
+        return ['Re-run with --confirm to push, dispatch the stage workflow, and verify the staged tarball.'];
+    if (state.blockers.length)
+        return ['Resolve the blockers above, then re-run with --confirm.'];
+    if (!state.stageId)
+        return ['No stage id was produced; inspect the workflow run before retrying.'];
+    return [
+        `Review the comparison receipt, then approve with 2FA yourself: npm stage approve ${state.stageId}`,
+        'Staging is not publication. Nothing is public until that approval completes.'
+    ];
+}
+function runPreflight(opts, version) {
+    const steps = [];
+    const branch = text(opts.run('git', ['rev-parse', '--abbrev-ref', 'HEAD']));
+    steps.push(step('branch', branch === RELEASE_BRANCH, branch, branch === RELEASE_BRANCH ? null : 'stage_requires_main_branch'));
+    const status = opts.run('git', ['status', '--porcelain']);
+    const clean = status.status === 0 && text(status) === '';
+    steps.push(step('clean_tree', clean, clean ? 'clean' : 'dirty', clean ? null : 'stage_requires_clean_tree'));
+    const versionOk = /^\d+\.\d+\.\d+$/.test(version);
+    steps.push(step('version', versionOk, version || null, versionOk ? null : 'stage_version_invalid'));
+    const origin = releaseOriginIdentity(opts.root);
+    const originOk = origin.identity === RELEASE_ORIGIN_IDENTITY;
+    steps.push(step('origin', originOk, origin.identity || null, originOk ? null : 'stage_origin_identity_mismatch'));
+    const gh = opts.run('gh', ['auth', 'status']);
+    steps.push(step('gh_auth', gh.status === 0, gh.status === 0 ? 'authenticated' : null, gh.status === 0 ? null : 'stage_gh_not_authenticated'));
+    const commit = text(opts.run('git', ['rev-parse', 'HEAD'])) || null;
+    return { ok: steps.every((entry) => entry.ok), commit, steps };
+}
+function resolveRunId(opts, commit) {
+    if (!commit)
+        return null;
+    for (let attempt = 0; attempt < 30; attempt += 1) {
+        const listed = opts.run('gh', [
+            'run', 'list',
+            '--workflow', STAGE_WORKFLOW_FILE,
+            '--branch', RELEASE_BRANCH,
+            '--limit', '20',
+            '--json', 'databaseId,headSha,status'
+        ]);
+        if (listed.status === 0) {
+            const rows = safeJsonArray(listed.stdout);
+            const match = rows.find((row) => String(row?.headSha || '') === commit);
+            if (match?.databaseId != null)
+                return String(match.databaseId);
+        }
+        opts.run('sleep', ['2']);
+    }
+    return null;
+}
+function downloadArtifacts(opts, runId, commit, dir) {
+    const names = commit ? [`stage-input-${commit}`, `npm-stage-receipt-${commit}`] : [];
+    if (!names.length)
+        return { step: step('download', false, null, 'stage_commit_unknown') };
+    const args = ['run', 'download', runId, '--dir', dir];
+    for (const name of names)
+        args.push('--name', name);
+    const result = opts.run('gh', args);
+    return { step: step('download', result.status === 0, dir, result.status === 0 ? null : 'stage_artifact_download_failed') };
+}
+function readStageReceipt(dir, readJsonFile) {
+    for (const candidate of ['stage-receipt.json', 'stage-output.json', 'npm-stage-receipt.json']) {
+        const file = path.join(dir, candidate);
+        const payload = readJsonFile(file);
+        const stageId = String(payload?.stage_id || '').trim();
+        if (!stageId)
+            continue;
+        if (!STAGE_ID_RE.test(stageId))
+            return { stageId: null, path: file, blocker: 'stage_id_uuid_invalid' };
+        return { stageId, path: file, blocker: null };
+    }
+    return { stageId: null, path: null, blocker: 'stage_receipt_missing' };
+}
+function runLocalVerify(opts, input) {
+    const verifier = path.join(opts.root, 'dist', 'scripts', 'npm-stage-tarball-verifier.js');
+    if (!fs.existsSync(verifier))
+        return step('verify', false, verifier, 'stage_verifier_unavailable_outside_checkout');
+    const result = opts.run(process.execPath, [
+        verifier,
+        '--stage-id', input.stageId,
+        '--local-receipt', path.join(input.artifactDir, 'pack-receipt.json'),
+        '--local-tarball', path.join(input.artifactDir, `sneakoscope-${input.version}.tgz`),
+        '--stage-receipt', path.join(input.artifactDir, 'stage-receipt.json')
+    ]);
+    return step('verify', result.status === 0, 'npm-stage-tarball-verifier', result.status === 0 ? null : 'stage_tarball_comparison_failed');
+}
+function readPackageVersion(root, readJsonFile) {
+    const pkg = readJsonFile(path.join(root, 'package.json'));
+    return String(pkg?.version || '');
+}
+function defaultReadJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function safeJsonArray(value) {
+    try {
+        const parsed = JSON.parse(value);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+function text(result) {
+    return String(result.stdout || '').trim();
+}
+function step(id, ok, detail = null, blocker = null) {
+    return { id, ok, attempted: true, detail, blocker };
+}
+function skipped(id, blocker) {
+    return { id, ok: true, attempted: false, detail: null, blocker: null, ...(blocker ? { detail: blocker } : {}) };
+}

package/dist/core/remote/index.js

@@ -6,5 +6,7 @@ export * from './audit-idempotency.js';
 export * from './owner-proof.js';
 export * from './protocol.js';
 export * from './session-snapshot.js';
+export * from './session-binding.js';
 export * from './worker.js';
 export * from './ssh-worker-client.js';
+export * from './local-worker-client.js';

package/dist/core/remote/local-worker-client.js

@@ -0,0 +1,35 @@
+import path from 'node:path';
+import { resolveAllowedProjectRoot } from './machine-registry.js';
+import { RemoteWorker } from './worker.js';
+export class RemoteLocalWorkerClient {
+    options;
+    root;
+    worker;
+    ready = null;
+    closed = false;
+    constructor(options) {
+        this.options = options;
+        if (options.machine.transport !== 'local')
+            throw new Error('local_worker_transport_required');
+        this.root = path.resolve(options.projectRoot);
+        this.worker = options.workerFactory?.({
+            root: this.root,
+            machine: options.machine,
+            projectId: options.projectId
+        }) ?? new RemoteWorker({
+            root: this.root,
+            machine: options.machine,
+            projectId: options.projectId
+        });
+    }
+    async request(request) {
+        if (this.closed)
+            throw new Error('local_worker_client_closed');
+        this.ready ??= resolveAllowedProjectRoot(this.options.machine, this.root).then(() => undefined);
+        await this.ready;
+        return this.worker.handle(request);
+    }
+    async close() {
+        this.closed = true;
+    }
+}

package/dist/core/remote/machine-registry.js

@@ -3,6 +3,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { readJson } from '../fsx.js';
 import { REMOTE_MACHINE_REGISTRY_SCHEMA } from './types.js';
+import { asRecordOrNull as asRecord } from '../json/records.js';
 const MACHINE_ID_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 const SSH_ALIAS_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 export function remoteMachineRegistryPath(globalRoot) {
@@ -34,6 +35,7 @@ export function validateRemoteMachineRegistry(value) {
         const id = stringValue(machine.id);
         const displayName = stringValue(machine.display_name);
         const sshAlias = stringValue(machine.ssh_alias);
+        const transport = machine.transport;
         const enabled = machine.enabled;
         if (!MACHINE_ID_RE.test(id))
             issues.push(`${prefix}:invalid_id`);
@@ -43,14 +45,19 @@ export function validateRemoteMachineRegistry(value) {
             ids.add(id);
         if (!displayName || displayName.length > 120)
             issues.push(`${prefix}:invalid_display_name`);
-        if (machine.transport !== 'ssh-stdio')
+        if (transport !== 'local' && transport !== 'ssh-stdio')
             issues.push(`${prefix}:unsupported_transport`);
-        if (!validateSshAlias(sshAlias))
-            issues.push(`${prefix}:invalid_ssh_alias`);
-        if (aliases.has(sshAlias))
-            issues.push(`${prefix}:duplicate_ssh_alias`);
-        if (sshAlias)
-            aliases.add(sshAlias);
+        if (transport === 'ssh-stdio') {
+            if (!validateSshAlias(sshAlias))
+                issues.push(`${prefix}:invalid_ssh_alias`);
+            if (aliases.has(sshAlias))
+                issues.push(`${prefix}:duplicate_ssh_alias`);
+            if (sshAlias)
+                aliases.add(sshAlias);
+        }
+        else if (sshAlias) {
+            issues.push(`${prefix}:local_ssh_alias_forbidden`);
+        }
         if (typeof enabled !== 'boolean')
             issues.push(`${prefix}:enabled_boolean_required`);
         const roots = Array.isArray(machine.allowed_roots) ? machine.allowed_roots.map(stringValue) : [];
@@ -68,12 +75,13 @@ export function validateRemoteMachineRegistry(value) {
                 issues.push(`${prefix}:root_${rootIndex}:duplicate_root`);
             uniqueRoots.add(normalized);
         });
-        if (MACHINE_ID_RE.test(id) && displayName && validateSshAlias(sshAlias) && machine.transport === 'ssh-stdio' && typeof enabled === 'boolean') {
+        const transportValid = transport === 'local' || (transport === 'ssh-stdio' && validateSshAlias(sshAlias));
+        if (MACHINE_ID_RE.test(id) && displayName && transportValid && typeof enabled === 'boolean') {
             machines.push({
                 id,
                 display_name: displayName,
-                transport: 'ssh-stdio',
-                ssh_alias: sshAlias,
+                transport,
+                ...(transport === 'ssh-stdio' ? { ssh_alias: sshAlias } : {}),
                 allowed_roots: roots,
                 enabled
             });
@@ -154,9 +162,6 @@ function isWithinRoot(root, candidate) {
     const relative = path.relative(path.resolve(root), path.resolve(candidate));
     return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
 }
-function asRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
-}
 function stringValue(value) {
     return typeof value === 'string' ? value.trim() : '';
 }

package/dist/core/remote/owner-proof.js

@@ -5,6 +5,7 @@ import { nowIso, readJson, runProcess, sha256, writeTextAtomic } from '../fsx.js
 import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-guard.js';
 import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
 import { REMOTE_OWNER_PROOF_SCHEMA, REMOTE_R2_APPROVAL_SCHEMA } from './types.js';
+import { asRecordOrNull as asRecord } from '../json/records.js';
 export class RemoteOwnerProofError extends Error {
     code;
     constructor(code) {
@@ -210,9 +211,6 @@ function normalizeSpace(value) {
 function normalizeCommand(value) {
     return value.trim();
 }
-function asRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
-}
 function invalid(code) {
     throw new RemoteOwnerProofError(code);
 }

package/dist/core/remote/protocol.js

@@ -1,5 +1,6 @@
 import { once } from 'node:events';
 import { REMOTE_COMMAND_SCHEMA, REMOTE_WORKER_REQUEST_SCHEMA, REMOTE_WORKER_RESPONSE_SCHEMA } from './types.js';
+import { asRecordOrNull as asRecord } from '../json/records.js';
 export const DEFAULT_REMOTE_MAX_LINE_BYTES = 64 * 1024;
 export const DEFAULT_REMOTE_MAX_RESPONSE_BYTES = 512 * 1024;
 const IDENTIFIER_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/;
@@ -258,6 +259,3 @@ function timestamp(value, field) {
         throw new RemoteProtocolError(`${field}_invalid`);
     return parsed;
 }
-function asRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
-}

package/dist/core/remote/readiness.js

@@ -5,6 +5,7 @@ import path from 'node:path';
 import { PACKAGE_VERSION, exists, runProcess, which } from '../fsx.js';
 import { resolveAllowedProjectRoot } from './machine-registry.js';
 import { REMOTE_READINESS_SCHEMA } from './types.js';
+import { asRecordOrNull as asRecord } from '../json/records.js';
 export async function remoteReadiness(options) {
     const root = path.resolve(options.root);
     const deps = dependencies(options.dependencies);
@@ -153,6 +154,3 @@ function codexAppCandidates(platform, homeDir) {
         path.join(homeDir, 'Applications', 'ChatGPT.app')
     ];
 }
-function asRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
-}