feat: add managed SSH execution spaces

Add managed SSH Hosts and projects with signed side-by-side GoodBuddy Agent and OpenCode Runtime installation, Ask and Execute workspace access, a Main-owned model bridge, detached Agent lifecycle, durable ACP output recovery, and project activation UI.

Use protocol v2 with bounded FIFO frames over SSH instead of custom credit, priority, batching, or model-message chunking. Mismatched Host Agents now upgrade automatically, an exactly verified Node runtime is reused on-host, and local Portable builds can embed strictly verified Agent artifacts.

Release note: 新增托管 SSH 远程项目，可自动安装或升级签名 Agent/OpenCode Runtime，并在 SSH 断线后继续 Agent 工作和同步未确认输出。

.github/workflows/packages.yml

@@ -26,7 +26,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version: 24.19.0
           cache: npm
 
       - name: Verify release tag version
@@ -50,7 +50,9 @@ jobs:
         run: npm run build:bundle
 
       - name: Upload production bundle
-        if: github.event_name == 'workflow_dispatch' || github.ref_type == 'tag'
+        if: >-
+          github.ref_type == 'tag' ||
+          (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
         uses: actions/upload-artifact@v7
         with:
           name: goodbuddy-production-bundle
@@ -58,10 +60,240 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+  authorize-agent-signing:
+    name: Authorize production Agent signing
+    if: >-
+      github.ref_type == 'tag' ||
+      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
+    needs: validate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      authorized: ${{ steps.policy.outputs.authorized }}
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Verify immutable release ref policy
+        id: policy
+        shell: bash
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin \
+            "+refs/heads/main:refs/remotes/origin/main"
+          git merge-base --is-ancestor \
+            "$GITHUB_SHA" refs/remotes/origin/main
+
+          case "$GITHUB_EVENT_NAME" in
+            push)
+              test "$GITHUB_REF_TYPE" = "tag"
+              test "$(node -p "String(require(process.env.GITHUB_EVENT_PATH).created)")" = "true"
+              test "$(node -p "String(require(process.env.GITHUB_EVENT_PATH).forced)")" = "false"
+              test "$(node -p "String(require(process.env.GITHUB_EVENT_PATH).deleted)")" = "false"
+              expected="v$(node -p "require('./package.json').version")"
+              test "$GITHUB_REF" = "refs/tags/$expected"
+              test "$GITHUB_REF_NAME" = "$expected"
+              git fetch --no-tags origin \
+                "+refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
+              test "$(git cat-file -t "refs/tags/$GITHUB_REF_NAME")" = "tag"
+              test "$(git rev-parse "refs/tags/$GITHUB_REF_NAME^{commit}")" = "$GITHUB_SHA"
+              ;;
+            workflow_dispatch)
+              test "$GITHUB_REF" = "refs/heads/main"
+              test "$GITHUB_REF_TYPE" = "branch"
+              test "$GITHUB_SHA" = "$(git rev-parse refs/remotes/origin/main)"
+              ;;
+            *)
+              echo "Production Agent signing is limited to immutable version-tag pushes or a manual run of refs/heads/main." >&2
+              exit 1
+              ;;
+          esac
+
+          echo "authorized=true" >> "$GITHUB_OUTPUT"
+
+  agent-runtime:
+    name: Acquire Linux ${{ matrix.arch }} Agent runtime
+    if: >-
+      needs.authorize-agent-signing.result == 'success' &&
+      needs.authorize-agent-signing.outputs.authorized == 'true'
+    needs:
+      - validate
+      - authorize-agent-signing
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x64
+            node-url: https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-x64.tar.gz
+            node-archive: node-v24.19.0-linux-x64.tar.gz
+            node-sha256: f625d97cd707df4ff96254916fbc5ff014f09c09effe5a1e0ca8f6d41a8789d4
+          - arch: arm64
+            node-url: https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-arm64.tar.gz
+            node-archive: node-v24.19.0-linux-arm64.tar.gz
+            node-sha256: d28c8a5bf0a808f0ed434a1dce8c54ae98f0371c0bd86ac58abc613f73e6643f
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Verify locked Node runtime metadata
+        env:
+          AGENT_ARCH: ${{ matrix.arch }}
+          NODE_ARCHIVE: ${{ matrix.node-archive }}
+          NODE_SHA256: ${{ matrix.node-sha256 }}
+          NODE_URL: ${{ matrix.node-url }}
+        run: |
+          node - <<'NODE'
+          const lock = require('./agent-runtime-lock.json')
+          const input = lock.node?.targets?.[`linux-${process.env.AGENT_ARCH}`]
+          const expectedUrl = `${lock.node?.source ?? ''}${input?.archive ?? ''}`
+          if (
+            input?.archive !== process.env.NODE_ARCHIVE ||
+            input?.sha256 !== process.env.NODE_SHA256 ||
+            expectedUrl !== process.env.NODE_URL ||
+            !expectedUrl.startsWith('https://')
+          ) {
+            throw new Error('Agent runtime acquisition metadata does not match agent-runtime-lock.json')
+          }
+          NODE
+
+      - name: Restore verified Node runtime cache
+        id: node-runtime-cache
+        uses: actions/cache/restore@v6
+        with:
+          path: ${{ runner.temp }}/goodbuddy-agent-node
+          key: goodbuddy-agent-node-${{ matrix.arch }}-${{ matrix.node-sha256 }}
+
+      - name: Download locked official Node runtime
+        if: steps.node-runtime-cache.outputs.cache-hit != 'true'
+        shell: bash
+        env:
+          NODE_ARCHIVE: ${{ matrix.node-archive }}
+          NODE_URL: ${{ matrix.node-url }}
+        run: |
+          set -euo pipefail
+          directory="$RUNNER_TEMP/goodbuddy-agent-node"
+          archive="$directory/$NODE_ARCHIVE"
+          mkdir -p "$directory"
+          curl --proto '=https' --tlsv1.2 \
+            --fail --silent --show-error --location \
+            --retry 3 --retry-all-errors \
+            --connect-timeout 15 --max-time 300 \
+            --max-filesize 104857600 \
+            "$NODE_URL" --output "$archive.partial"
+          mv "$archive.partial" "$archive"
+
+      - name: Verify locked Node runtime digest
+        shell: bash
+        env:
+          NODE_ARCHIVE: ${{ matrix.node-archive }}
+          NODE_SHA256: ${{ matrix.node-sha256 }}
+        run: |
+          set -euo pipefail
+          archive="$RUNNER_TEMP/goodbuddy-agent-node/$NODE_ARCHIVE"
+          test -f "$archive"
+          printf '%s  %s\n' "$NODE_SHA256" "$archive" |
+            sha256sum --check --strict -
+
+      - name: Save verified Node runtime cache
+        if: steps.node-runtime-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v6
+        with:
+          path: ${{ runner.temp }}/goodbuddy-agent-node
+          key: goodbuddy-agent-node-${{ matrix.arch }}-${{ matrix.node-sha256 }}
+
+      - name: Upload verified Node runtime input
+        uses: actions/upload-artifact@v7
+        with:
+          name: goodbuddy-agent-node-${{ matrix.arch }}
+          path: ${{ runner.temp }}/goodbuddy-agent-node/${{ matrix.node-archive }}
+          if-no-files-found: error
+          compression-level: 0
+          retention-days: 1
+
+  agent-signing:
+    name: Linux ${{ matrix.arch }} signed Agent bundle
+    if: >-
+      needs.authorize-agent-signing.result == 'success' &&
+      needs.authorize-agent-signing.outputs.authorized == 'true'
+    needs:
+      - validate
+      - authorize-agent-signing
+      - agent-runtime
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x64
+            runner: ubuntu-24.04
+            node-archive: node-v24.19.0-linux-x64.tar.gz
+            node-sha256: f625d97cd707df4ff96254916fbc5ff014f09c09effe5a1e0ca8f6d41a8789d4
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+            node-archive: node-v24.19.0-linux-arm64.tar.gz
+            node-sha256: d28c8a5bf0a808f0ed434a1dce8c54ae98f0371c0bd86ac58abc613f73e6643f
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 20
+    environment:
+      name: agent-signing
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24.19.0
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Preflight production Agent signing registry
+        env:
+          GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
+        run: node build/agent-bundle.cjs preflight
+
+      - name: Download verified official Node runtime input
+        uses: actions/download-artifact@v8
+        with:
+          name: goodbuddy-agent-node-${{ matrix.arch }}
+          path: ${{ runner.temp }}/goodbuddy-agent-node
+
+      - name: Build and sign Agent bundle
+        shell: bash
+        env:
+          GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
+          GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}
+        run: |
+          set -euo pipefail
+          set +x
+          node build/agent-bundle.cjs build \
+            --arch "${{ matrix.arch }}" \
+            --runtime-archive "$RUNNER_TEMP/goodbuddy-agent-node/${{ matrix.node-archive }}" \
+            --archive "dist/agent-bundles/goodbuddy-agent-linux-${{ matrix.arch }}.tar"
+
+      - name: Upload signed Agent bundle
+        uses: actions/upload-artifact@v7
+        with:
+          name: goodbuddy-agent-linux-${{ matrix.arch }}
+          path: dist/agent-bundles/goodbuddy-agent-linux-${{ matrix.arch }}.tar
+          if-no-files-found: error
+          compression-level: 0
+          retention-days: 1
+
   package:
     name: ${{ matrix.platform }} ${{ matrix.arch }}
-    if: github.event_name == 'workflow_dispatch' || github.ref_type == 'tag'
-    needs: validate
+    if: >-
+      needs.authorize-agent-signing.result == 'success' &&
+      needs.authorize-agent-signing.outputs.authorized == 'true'
+    needs:
+      - validate
+      - authorize-agent-signing
+      - agent-signing
     strategy:
       fail-fast: false
       matrix:
@@ -92,7 +324,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version: 24.19.0
           cache: npm
 
       - name: Cache packaging toolsets
@@ -115,6 +347,24 @@ jobs:
           name: goodbuddy-production-bundle
           path: out
 
+      - name: Download signed Agent bundles
+        uses: actions/download-artifact@v8
+        with:
+          pattern: goodbuddy-agent-linux-*
+          path: dist/agent-downloads
+          merge-multiple: true
+
+      - name: Import and verify both Agent bundles
+        shell: bash
+        run: |
+          set -euo pipefail
+          node build/agent-bundle.cjs import \
+            --arch x64 \
+            --archive dist/agent-downloads/goodbuddy-agent-linux-x64.tar
+          node build/agent-bundle.cjs import \
+            --arch arm64 \
+            --archive dist/agent-downloads/goodbuddy-agent-linux-arm64.tar
+
       - name: Resolve macOS signing mode
         id: macos-signing
         if: matrix.platform == 'macos'
@@ -229,8 +479,13 @@ jobs:
 
   release:
     name: Publish GitHub and OSS release
-    if: github.event_name == 'push' && github.ref_type == 'tag'
-    needs: package
+    if: >-
+      github.event_name == 'push' &&
+      github.ref_type == 'tag' &&
+      needs.authorize-agent-signing.outputs.authorized == 'true'
+    needs:
+      - authorize-agent-signing
+      - package
     runs-on: ubuntu-24.04
     timeout-minutes: 35
     environment:
@@ -247,7 +502,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version: 24.19.0
 
       - name: Verify release tag
         shell: bash