feat(desktop): manage remote runtime host services - #3282
Draft
M4n5ter wants to merge 14 commits into
Draft
Conversation
Let Desktop install, pair, verify, and connect a Linux Runtime Host from one SSH destination while retaining manual profiles for advanced endpoints. Keep delivered credentials in the main process and continue successful setup directly to remote Project selection. Unpackaged builds may exercise the same service contract with a content-addressed local CLI archive instead of introducing a separate development Host mode. Generated-by: Codex
Keep the current credential valid until the newly persisted Desktop profile has established its own connection, then let that authenticated connection finalize the handoff. Re-pairing the same Host now atomically rebinds its transport and rolls back on connection failure. Pin packaged onboarding to an exact CLI package and give content-addressed development archives a safe dev-to-dev replacement path. Generated-by: Codex
Escalate cancelled or timed-out setup processes from graceful to forced termination and stop waiting after a bounded deadline. Reuse the same lifecycle for setup, development package upload, and terminal shutdown. Generated-by: Codex
Keep one expiring pending credential per principal while preserving immediate replacement for standalone CLI setup. Commit only the pending candidate, make retries harmless, and align SSH cancellation with the completion boundary. Generated-by: Codex
Reuse one per-principal staging path for development package uploads so a failed SSH handoff cannot accumulate orphaned archives. Successful setup still removes the staged package normally. Generated-by: Codex
Replay idempotent credential finalization after uncertain commits or connection replacement, while restoring the prior profile after conclusive failures. Share one exact setup package validator so valid build metadata is accepted consistently. Generated-by: Codex
Derive the Desktop setup package from the CLI release version so onboarding cannot target a stale command surface. Bound credential-authority shutdown and service replacement behavior, while keeping development archive setup portable and self-cleaning. Generated-by: Codex
Run the prepare-stage CLI fixture against the version declared by the repository manifest so release validation remains stable across intentional CLI version bumps. Generated-by: Codex
Terminate interactive SSH independently from onboarding settlement so shutdown cannot wait behind the process it must stop. Contain post-onboarding catalog refresh failures after the hook records the UI error state. Generated-by: Codex
Align managed development releases with the generated package version grammar. Preserve published credential authority after uncertain commits, persist pending Desktop pairing transactions across process loss, and dismiss interactive SSH presentation when cancellation begins. Generated-by: Codex
Serialize credential finalization with target shutdown so an in-flight commit can reconcile before its connection is retired. Make secret-file publication durable before dependent profile state is written, and remove the unused pairing intent UUID. Generated-by: Codex
Advance the compatibility epoch for staged credential operations and let Desktop shutdown interrupt only pairing reconnect waits. Interrupted finalization retains its durable journal so the next startup can reconcile an unknown outcome without rolling back a potentially committed credential. Generated-by: Codex
Add an SSH-backed management surface for installed remote Runtime Host services so Desktop can inspect status and logs, recover or restart the service, and uninstall it without conflating service lifecycle with Profile or State Root ownership. Keep direct connection Profiles usable without claiming a management channel, and use a bounded framed CLI result so machine output cannot expose launch configuration. Generated-by: Codex
Persist the exact managed service and State Root identity established by onboarding, and fail closed when repair or management targets drift.\n\nClose SSH admission during shutdown and remove duplicate management state, IPC, and version derivation.
Astro-Han
added a commit
that referenced
this pull request
Aug 20, 2026
Branch protection landed in .asf.yaml (#3262) and now requires an approving review and a passing `test` check on every pull request to main, with stale approvals dismissed on each new commit. Every open pull request based on main reports reviewDecision REVIEW_REQUIRED; #3282, based on a feature branch, reports nothing. That leaves the fast path with nothing to exempt. CONTRIBUTING defined it as merging without independent human review, which a committer can no longer do. Redefining it as "the baseline alone" does not rescue it: the extra scrutiny in this section applies only to protected areas, and not touching a protected area was already a fast-path precondition, so the two scopes never overlap. A named fast path would exempt nothing while adding a comment obligation, and the maintainer sign-off it claimed to skip was never written down anywhere. State the rule directly instead. The section gives the baseline every pull request clears, says what material changes need beyond it, and closes with "for everything else the baseline is enough" — which answers which changes take the light route without keeping a concept that no longer carries content. The merge-time comment goes with it: it existed to leave a trace for merges that had no approval, and every merge now has one. Two corrections in the same section. The baseline says branch protection enforces the mechanics and that independent human judgment is policy GitHub cannot verify, because an approval from someone other than the author is not by itself proof of an independent human. The Chinese text is realigned so 重大 distributes across the whole protected list, matching the English, instead of modifying only the first item. The public-decision rule moves from future to present tense. dev@maka.apache.org exists and carries active threads, so project-level decisions belong there now rather than "once an ASF development list is available". .coderabbit.yaml and .github/skills/code-review/SKILL.md told automated reviewers not to make a fast-path determination. With the concept gone, both now say only that automated review is not authorization to merge. Their neighbouring lines about independent human review remain accurate and are left alone. Generated-by: Claude Code
6 tasks
Astro-Han
added a commit
that referenced
this pull request
Aug 20, 2026
Branch protection landed in .asf.yaml (#3262) and now requires an approving review and a passing `test` check on every pull request to main, with stale approvals dismissed on each new commit. Every open pull request based on main reports reviewDecision REVIEW_REQUIRED; #3282, based on a feature branch, reports nothing. That leaves the fast path with nothing to exempt. CONTRIBUTING defined it as merging without independent human review, which a committer can no longer do. Redefining it as "the baseline alone" does not rescue it: the extra scrutiny in this section applies only to protected areas, and not touching a protected area was already a fast-path precondition, so the two scopes never overlap. A named fast path would exempt nothing while adding a comment obligation, and the maintainer sign-off it claimed to skip was never written down anywhere. State the rule directly instead. The section gives the baseline every pull request clears, names a maintainer as the one who decides whether a change is material and whether the review it received is enough, and closes with "for everything else the baseline is enough" — which answers which changes take the light route without keeping a concept that no longer carries content. Naming the classifier keeps what the old "a maintainer makes the final determination" actually did: settle whether a change needs more than the mechanics. The merge-time comment does not survive; it existed to leave a trace for merges that had no approval, and every merge now has one. Two corrections in the same section. The baseline says branch protection enforces the mechanics and that independent human judgment is policy GitHub cannot verify, because an approval from someone other than the author is not by itself proof of an independent human. The Chinese text is realigned so 重大 distributes across the whole protected list, matching the English, instead of modifying only the first item. The public-decision rule moves from future to present tense. dev@maka.apache.org exists and carries active threads, so project-level decisions belong there now rather than "once an ASF development list is available". .coderabbit.yaml and .github/skills/code-review/SKILL.md told automated reviewers not to make a fast-path determination. With the concept gone, both now say only that automated review is not authorization to merge. Their neighbouring lines about independent human review remain accurate and are left alone. Generated-by: Claude Code
M4n5ter
pushed a commit
that referenced
this pull request
Aug 20, 2026
Branch protection landed in .asf.yaml (#3262) and now requires an approving review and a passing `test` check on every pull request to main, with stale approvals dismissed on each new commit. Every open pull request based on main reports reviewDecision REVIEW_REQUIRED; #3282, based on a feature branch, reports nothing. That leaves the fast path with nothing to exempt. CONTRIBUTING defined it as merging without independent human review, which a committer can no longer do. Redefining it as "the baseline alone" does not rescue it: the extra scrutiny in this section applies only to protected areas, and not touching a protected area was already a fast-path precondition, so the two scopes never overlap. A named fast path would exempt nothing while adding a comment obligation, and the maintainer sign-off it claimed to skip was never written down anywhere. State the rule directly instead. The section gives the baseline every pull request clears, names a maintainer as the one who decides whether a change is material and whether the review it received is enough, and closes with "for everything else the baseline is enough" — which answers which changes take the light route without keeping a concept that no longer carries content. Naming the classifier keeps what the old "a maintainer makes the final determination" actually did: settle whether a change needs more than the mechanics. The merge-time comment does not survive; it existed to leave a trace for merges that had no approval, and every merge now has one. Two corrections in the same section. The baseline says branch protection enforces the mechanics and that independent human judgment is policy GitHub cannot verify, because an approval from someone other than the author is not by itself proof of an independent human. The Chinese text is realigned so 重大 distributes across the whole protected list, matching the English, instead of modifying only the first item. The public-decision rule moves from future to present tense. dev@maka.apache.org exists and carries active threads, so project-level decisions belong there now rather than "once an ASF development list is available". .coderabbit.yaml and .github/skills/code-review/SKILL.md told automated reviewers not to make a fast-path determination. With the concept gone, both now say only that automated review is not authorization to merge. Their neighbouring lines about independent human review remain accurate and are left alone. Generated-by: Claude Code
M4n5ter
force-pushed
the
feat/desktop-managed-remote-onboarding
branch
from
August 20, 2026 09:42
32fa336 to
3f403af
Compare
This was referenced Aug 20, 2026
M4n5ter
force-pushed
the
feat/desktop-managed-remote-onboarding
branch
2 times, most recently
from
August 20, 2026 14:29
33bfae8 to
6cc6cd1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
English
Summary
Add a per-computer management surface for SSH-managed Runtime Hosts. Desktop can inspect service status and bounded recent logs, start or restart the service, repair its managed installation, and uninstall the Maka-managed service while preserving both the State Root and Desktop Profile.
Onboarding now binds each managed Profile to the exact managed service and State Root. Every repair or management action revalidates that binding before mutation, so manual connection Profiles cannot manage an unrelated service and SSH destination drift fails closed. The SSH management channel also closes admission before Desktop shutdown.
Direct connection Profiles remain usable without claiming a service-management channel. Runtime Host protocol clients still cannot upgrade or terminate the service; these explicit management actions run through the separately authenticated SSH operator channel.
Depends on #3236
Fixes #3281
Verification
npm run lintnpm run format:checknpm run typechecknpx knip --workspace apps/desktopAI use
Select exactly one:
Tool(s) and scope: OpenAI Codex implemented the change and assisted with tests, validation, and PR wording under maintainer direction and review.
Checklist
Does this PR entail a change in behavior?
中文
概要
为通过 SSH 管理的 Runtime Host 增加 per-computer 管理界面。Desktop 可以查看服务状态和有界的近期日志，启动或重启服务，修复其托管安装，以及在保留 State Root 和 Desktop Profile 的前提下卸载 Maka 管理的服务。
Onboarding 现在会把每个 managed Profile 绑定到精确的 managed service 与 State Root。每次修复或管理操作都会在执行变更前重新验证该绑定，因此手工 connection Profile 无法管理无关服务，SSH 目标漂移也会 fail closed。Desktop shutdown 前还会先关闭 SSH 管理操作的 admission。
Direct connection Profile 仍可正常使用，但不会被描述为具备服务管理通道。Runtime Host protocol Client 仍不能升级或终止服务；这些显式管理操作经由单独认证的 SSH operator channel 执行。
依赖 #3236
修复 #3281
验证
npm run lintnpm run format:checknpm run typechecknpx knip --workspace apps/desktopAI 使用
仅选择一项：
工具与范围：OpenAI Codex 在维护者指导与审核下实施变更，并协助测试、验证和 PR 措辞。
检查清单
这个 PR 是否包含行为变更？