fix: make managed SSH sessions fast and resilient

Managed SSH project selection repeatedly activated the remote Host and could
leave idle ACP bindings rejected as stale-controller after a controller
generation change. Host environment updates also coupled project state to
component installation evidence and presented a crowded control surface.

Project selection is now local-only, one Host connection serves compatible
project and conversation callers, idle bindings are safely replaced only
after proven controller takeover, and active prompts keep exact resume/replay.
Remote environment setup now uses explicit signed compound package
preparation with bounded transfer, rollback, recovery, and clearer settings.

Managed Hosts must be updated to separately distributed Agent 0.11.6 before
the daemon-side controller recovery fix takes effect. Desktop packages do not
embed the Agent or remote Runtime, and existing project data is preserved.

Release note: 托管 SSH 项目切换不再重复连接，同一 Host 可顺畅承载多个项目和对话；同时修复重连后的 stale-controller，并优化远程环境安装、更新与状态布局。

src/main/execution-space/execution-space-resolver.test.ts

@@ -1,10 +1,5 @@
-import { mkdtemp, rm } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { DatabaseSync } from 'node:sqlite'
 import { describe, expect, it, vi } from 'vitest'
 import type { AssistantProject } from '../../shared/assistant-contracts'
-import { AssistantDatabase } from '../assistant/assistant-database'
 import {
   ExecutionSpaceResolver,
   REMOTE_EXECUTION_SPACE_UNAVAILABLE
@@ -42,35 +37,18 @@ describe('ExecutionSpaceResolver', () => {
     expect(first.workspaceAccess).not.toBe(second.workspaceAccess)
   })
 
-  it('keeps every remote workspace operation fail closed', async () => {
-    const resolver = new ExecutionSpaceResolver()
-    const descriptor = resolver.resolveProject(
-      project({
-        rootPath: '/srv/project',
-        executionSpace: {
-          kind: 'ssh',
-          hostId: '00000000-0000-4000-8000-000000000201',
-          remoteRootPath: '/srv/project'
-        }
-      })
+  it('keeps remote workspace operations unavailable without a factory', async () => {
+    const descriptor = new ExecutionSpaceResolver().resolveProject(
+      remoteProject()
     )
 
     expect(descriptor.kind).toBe('ssh')
     await expect(
       descriptor.workspaceAccess.listDirectory({ path: '' })
     ).rejects.toThrow(REMOTE_EXECUTION_SPACE_UNAVAILABLE)
-    await expect(
-      descriptor.workspaceAccess.getChanges({})
-    ).rejects.toThrow(REMOTE_EXECUTION_SPACE_UNAVAILABLE)
-    await expect(
-      descriptor.workspaceAccess.writeTextAtomic({
-        path: 'file.txt',
-        content: 'no'
-      })
-    ).rejects.toThrow(REMOTE_EXECUTION_SPACE_UNAVAILABLE)
   })
 
-  it('uses an injected remote factory only for complete matching validation', async () => {
+  it('binds remote access only to the configured Host and path', () => {
     const workspaceAccess = {
       getIdentity: vi.fn(),
       listDirectory: vi.fn(),
@@ -84,289 +62,54 @@ describe('ExecutionSpaceResolver', () => {
     const factory = {
       create: vi.fn(() => workspaceAccess)
     }
-    const validation = {
-      hostRevision: 1,
-      hostKeyGeneration: 2,
-      remoteUsername: 'builder',
-      workspaceIdentity: 'workspace-1',
-      agentProtocolMajor: 1,
-      agentInstallationIdAtValidation: 'agent-1',
-      agentBinaryDigestAtValidation: `sha256:${'a'.repeat(64)}`,
-      agentVersionAtValidation: '0.11.0',
-      agentArchitectureAtValidation: 'x64' as const,
-      validatedAt: '2026-08-01T00:00:00.000Z'
-    }
-    const runtimeValidation = {
-      runtimeSelectionKey: 'opencode',
-      runtimeBundleDigest: `sha256:${'b'.repeat(64)}`,
-      runtimeAdapterDigest: `sha256:${'c'.repeat(64)}`,
-      agentInstallationIdAtValidation: 'agent-1',
-      validatedAt: '2026-08-01T00:00:00.000Z',
-      workMode: 'ask' as const
-    }
     const resolver = new ExecutionSpaceResolver(factory)
-    const descriptor = resolver.resolveProject(
-      project({
-        rootPath: '/srv/project',
-        executionSpace: {
-          kind: 'ssh',
-          hostId: '00000000-0000-4000-8000-000000000201',
-          remoteRootPath: '/srv/project',
-          validation
-        },
-        runtimeValidation
-      })
-    )
+    const first = resolver.resolveProject(remoteProject())
+    const second = resolver.resolveProject(remoteProject())
 
-    expect(descriptor.workspaceAccess).toBe(workspaceAccess)
-    expect(descriptor).toMatchObject({
-      kind: 'ssh',
-      validation: {
-        agentInstallationIdAtValidation: 'agent-1',
-        agentBinaryDigestAtValidation: `sha256:${'a'.repeat(64)}`,
-        agentVersionAtValidation: '0.11.0',
-        agentArchitectureAtValidation: 'x64'
-      },
-      runtimeValidation
-    })
+    expect(first.workspaceAccess).toBe(workspaceAccess)
+    expect(first.cacheIdentity).toBe(second.cacheIdentity)
     expect(factory.create).toHaveBeenCalledWith({
       hostId: '00000000-0000-4000-8000-000000000201',
-      remoteRootPath: '/srv/project',
-      hostRevision: 1,
-      hostKeyGeneration: 2,
-      remoteUsername: 'builder',
-      workspaceIdentity: 'workspace-1',
-      agentProtocolMajor: 1,
-      agentInstallationId: 'agent-1',
-      agentBinaryDigest: `sha256:${'a'.repeat(64)}`,
-      agentVersion: '0.11.0',
-      agentArchitecture: 'x64'
+      remoteRootPath: '/srv/project'
     })
+  })
 
-    const stale = resolver.resolveProject(
-      project({
-        rootPath: '/srv/project',
+  it('changes remote identities only with stable project configuration', () => {
+    const resolver = new ExecutionSpaceResolver()
+    const first = resolver.resolveProject(remoteProject())
+    const nextPath = resolver.resolveProject(
+      remoteProject({
+        rootPath: '/srv/other',
         executionSpace: {
           kind: 'ssh',
           hostId: '00000000-0000-4000-8000-000000000201',
-          remoteRootPath: '/srv/project',
-          validation
-        },
-        runtimeValidation: {
-          ...runtimeValidation,
-          agentInstallationIdAtValidation: 'agent-2'
+          remoteRootPath: '/srv/other'
         }
       })
     )
-    await expect(stale.workspaceAccess.getIdentity()).rejects.toThrow(
-      REMOTE_EXECUTION_SPACE_UNAVAILABLE
-    )
-
-    expect(factory.create).toHaveBeenCalledOnce()
-  })
-
-  it('includes remote Host, Agent, Runtime, and work-mode identities in the cache identity', () => {
-    const resolver = new ExecutionSpaceResolver()
-    const baseValidation = {
-      hostRevision: 1,
-      hostKeyGeneration: 2,
-      remoteUsername: 'builder',
-      workspaceIdentity: 'workspace-1',
-      agentProtocolMajor: 1,
-      agentInstallationIdAtValidation: 'agent-1',
-      agentBinaryDigestAtValidation: `sha256:${'a'.repeat(64)}`,
-      agentVersionAtValidation: '0.11.0',
-      agentArchitectureAtValidation: 'x64' as const,
-      validatedAt: '2026-08-01T00:00:00.000Z'
-    }
-    const runtimeValidation = {
-      runtimeSelectionKey: 'opencode',
-      runtimeBundleDigest: `sha256:${'b'.repeat(64)}`,
-      runtimeAdapterDigest: `sha256:${'c'.repeat(64)}`,
-      agentInstallationIdAtValidation: 'agent-1',
-      validatedAt: '2026-08-01T00:00:00.000Z',
-      workMode: 'ask' as const
-    }
-    const first = resolver.resolveProject(
-      project({
-        rootPath: '/srv/project',
-        executionSpace: {
-          kind: 'ssh',
-          hostId: '00000000-0000-4000-8000-000000000201',
-          remoteRootPath: '/srv/project',
-          validation: baseValidation
-        },
-        runtimeValidation
-      })
-    )
-    const second = resolver.resolveProject(
-      project({
-        rootPath: '/srv/project',
-        executionSpace: {
-          kind: 'ssh',
-          hostId: '00000000-0000-4000-8000-000000000201',
-          remoteRootPath: '/srv/project',
-          validation: {
-            ...baseValidation,
-            hostRevision: 2
-          }
-        },
-        runtimeValidation
+    const nextProject = resolver.resolveProject(
+      remoteProject({
+        id: '00000000-0000-4000-8000-000000000102'
       })
     )
 
-    expect(second.cacheIdentity).not.toBe(first.cacheIdentity)
-
-    for (const validation of [
-      {
-        ...baseValidation,
-        agentBinaryDigestAtValidation: `sha256:${'b'.repeat(64)}`
-      },
-      {
-        ...baseValidation,
-        agentVersionAtValidation: '0.11.1'
-      },
-      {
-        ...baseValidation,
-        agentArchitectureAtValidation: 'arm64' as const
-      }
-    ]) {
-      const changed = resolver.resolveProject(
-        project({
-          rootPath: '/srv/project',
-          executionSpace: {
-            kind: 'ssh',
-            hostId: '00000000-0000-4000-8000-000000000201',
-            remoteRootPath: '/srv/project',
-            validation
-          },
-          runtimeValidation
-        })
-      )
-      expect(changed.cacheIdentity).not.toBe(first.cacheIdentity)
-    }
-
-    for (const changedRuntimeValidation of [
-      {
-        ...runtimeValidation,
-        workMode: 'execute' as const
-      }
-    ]) {
-      const changed = resolver.resolveProject(
-        project({
-          rootPath: '/srv/project',
-          executionSpace: {
-            kind: 'ssh',
-            hostId: '00000000-0000-4000-8000-000000000201',
-            remoteRootPath: '/srv/project',
-            validation: baseValidation
-          },
-          runtimeValidation: changedRuntimeValidation
-        })
-      )
-      expect(changed.cacheIdentity).not.toBe(first.cacheIdentity)
-    }
-  })
-
-  it('changes DB-backed cache identity for host and Runtime generations', async () => {
-    const directory = await mkdtemp(
-      join(tmpdir(), 'goodbuddy-execution-resolver-')
-    )
-    const databasePath = join(directory, 'assistant.sqlite')
-    const database = new AssistantDatabase(databasePath)
-    const raw = new DatabaseSync(databasePath)
-    try {
-      database.initialize('C:\\Workspace')
-      const projectId = database.listProjects()[0]!.id
-      raw
-        .prepare(
-          `UPDATE project_execution_spaces
-           SET kind = 'ssh', root_path = ?, ssh_host_id = ?,
-               host_revision = ?, host_key_generation = ?,
-               remote_username = ?, workspace_identity = ?,
-               agent_installation_id_at_validation = ?,
-               agent_binary_digest_at_validation = ?,
-               agent_version_at_validation = ?,
-               agent_architecture_at_validation = ?,
-               agent_protocol_major = ?,
-               trust_attestation_revision = ?, validated_at = ?
-           WHERE project_id = ?`
-        )
-        .run(
-          '/srv/project',
-          '00000000-0000-4000-8000-000000000201',
-          1,
-          1,
-          'builder',
-          'workspace-1',
-          'agent-1',
-          `sha256:${'a'.repeat(64)}`,
-          '0.11.0',
-          'x64',
-          1,
-          0,
-          '2026-08-01T00:00:00.000Z',
-          projectId
-        )
-      raw
-        .prepare(
-          `INSERT INTO project_runtime_validations
-            (project_id, runtime_selection_key,
-             runtime_bundle_digest, runtime_adapter_digest,
-             confinement_policy_digest, approval_bridge_version,
-             agent_installation_id_at_validation, validated_at,
-             work_mode, trust_tier, trust_attestation_revision)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-        )
-        .run(
-          projectId,
-          'opencode',
-          `sha256:${'b'.repeat(64)}`,
-          `sha256:${'c'.repeat(64)}`,
-          `sha256:${'c'.repeat(64)}`,
-          'unused',
-          'agent-1',
-          '2026-08-01T00:00:00.000Z',
-          'ask',
-          null,
-          null
-        )
-
-      const resolver = new ExecutionSpaceResolver()
-      const baseline = resolver.resolveProject(
-        database.getProject(projectId)
-      )
-      raw
-        .prepare(
-          `UPDATE project_execution_spaces
-           SET host_key_generation = 2
-           WHERE project_id = ?`
-        )
-        .run(projectId)
-      const nextHostGeneration = resolver.resolveProject(
-        database.getProject(projectId)
-      )
-      raw
-        .prepare(
-          `UPDATE project_runtime_validations
-           SET runtime_bundle_digest = ?
-           WHERE project_id = ?`
-        )
-        .run(`sha256:${'e'.repeat(64)}`, projectId)
-      const nextRuntimeGeneration = resolver.resolveProject(
-        database.getProject(projectId)
-      )
-
-      expect(nextHostGeneration.cacheIdentity).not.toBe(
-        baseline.cacheIdentity
-      )
-      expect(nextRuntimeGeneration.cacheIdentity).not.toBe(
-        nextHostGeneration.cacheIdentity
-      )
-    } finally {
-      raw.close()
-      database.close()
-      await rm(directory, { recursive: true, force: true })
-    }
+    expect(nextPath.cacheIdentity).not.toBe(first.cacheIdentity)
+    expect(nextProject.cacheIdentity).toBe(first.cacheIdentity)
+    expect(nextProject.routeIdentity).not.toBe(first.routeIdentity)
   })
 })
+
+function remoteProject(
+  overrides: Partial<AssistantProject> = {}
+): AssistantProject {
+  return project({
+    rootPath: '/srv/project',
+    executionSpace: {
+      kind: 'ssh',
+      hostId: '00000000-0000-4000-8000-000000000201',
+      remoteRootPath: '/srv/project'
+    },
+    runtimeSelection: { provider: 'opencode' },
+    ...overrides
+  })
+}