root/goodbuddy
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

feat: add managed SSH execution spaces

Browse Source 
Add managed SSH Hosts and projects with signed side-by-side GoodBuddy Agent and OpenCode Runtime installation, Ask and Execute workspace access, a Main-owned model bridge, detached Agent lifecycle, durable ACP output recovery, and project activation UI.

Use protocol v2 with bounded FIFO frames over SSH instead of custom credit, priority, batching, or model-message chunking. Mismatched Host Agents now upgrade automatically, an exactly verified Node runtime is reused on-host, and local Portable builds can embed strictly verified Agent artifacts.

Release note: 新增托管 SSH 远程项目，可自动安装或升级签名 Agent/OpenCode Runtime，并在 SSH 断线后继续 Agent 工作和同步未确认输出。
This commit is contained in:
mesalogo
2026-08-24 23:02:18 +08:00
parent 3829a871f5
commit 607bb33249
258 changed files with 99449 additions and 2427 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/build-release.test.ts
+549 -2
View File
@@ -4,6 +4,7 @@ import {
mkdirSync,
readFileSync,
rmSync,
symlinkSync,
writeFileSync
} from 'node:fs'
import { createHash } from 'node:crypto'
@@ -11,7 +12,7 @@ import { createRequire } from 'node:module'
import { tmpdir } from 'node:os'
import { join } from 'node:path'
import { Writable } from 'node:stream'
import { describe, expect, it } from 'vitest'
import { describe, expect, it, vi } from 'vitest'
interface ReleaseOptions {
platform: 'windows' | 'macos' | 'linux'
@@ -23,6 +24,17 @@ interface ReleaseOptions {
help: boolean
}
type VerifyRemoteRuntimeBundle = (
bundleDirectory: string,
options: {
projectRoot: string
architecture: 'x64' | 'arm64'
registry: Record<string, unknown>
lock: Record<string, unknown>
verificationEnvironment: 'production'
}
) => void
interface ReleaseBuilderModule {
assertReplaceableOutput: (
directory: string,
@@ -150,6 +162,27 @@ interface ReleaseBuilderModule {
options: ReleaseOptions
) => void
verifyPortableZip: (filePath: string) => void
verifyReleaseAgentResources: (
projectRoot?: string,
verifyBundleMatrix?: (
bundleRoot: string,
options: { projectRoot: string }
) => void
) => void
verifyReleaseRemoteRuntimeResources: (
projectRoot?: string,
verifyBundleMatrix?: (
bundleRoot: string,
options: { projectRoot: string }
) => void
) => void
verifyRemoteRuntimeBundleMatrix: (
resourcesRoot: string,
options: {
projectRoot: string
verifyBundleDirectory: VerifyRemoteRuntimeBundle
}
) => void
verifyArchiveIntegrity: (
filePath: string,
expectedIntegrity: string
@@ -173,6 +206,22 @@ const packageVersion = (
const releaseBuilder = require(
'../build/build-release.cjs'
) as ReleaseBuilderModule
const releaseConfig = require(
'../build/electron-builder.release.cjs'
) as {
extraResources: Array<{
from: string
to?: string
filter?: string[]
}>
}
const prepareBundledRuntimes = require(
'../build/runtime-hooks.cjs'
) as (context: {
electronPlatformName: string
arch: number
packager: { projectDir: string }
}) => Promise<void>
const windowsOptions: ReleaseOptions = {
platform: 'windows',
arch: 'x64',
@@ -183,6 +232,60 @@ const windowsOptions: ReleaseOptions = {
help: false
}
function createRemoteRuntimeMatrixFixture(): {
projectRoot: string
resourcesRoot: string
options: {
projectRoot: string
verifyBundleDirectory: VerifyRemoteRuntimeBundle
}
cleanup: () => void
} {
const projectRoot = mkdtempSync(
join(tmpdir(), 'goodbuddy-release-runtime-')
)
const resourcesRoot = join(
projectRoot,
'.remote-runtime-resources'
)
mkdirSync(join(projectRoot, 'resources'), { recursive: true })
writeFileSync(
join(projectRoot, 'resources', 'agent-release-keys.json'),
JSON.stringify({ formatVersion: 1 })
)
writeFileSync(
join(projectRoot, 'remote-runtime-lock.json'),
JSON.stringify({
formatVersion: 1,
runtimes: {
opencode: {
targets: {
x64: {
package: 'opencode-linux-x64-baseline',
integrity: 'sha512-x64'
},
arm64: {
package: 'opencode-linux-arm64',
integrity: 'sha512-arm64'
}
}
}
}
})
)
return {
projectRoot,
resourcesRoot,
options: {
projectRoot,
verifyBundleDirectory: vi.fn<VerifyRemoteRuntimeBundle>()
},
cleanup: () => {
rmSync(projectRoot, { recursive: true, force: true })
}
}
}
function pe(machine: number): Buffer {
const buffer = Buffer.alloc(256)
buffer.write('MZ', 0, 'ascii')
@@ -358,6 +461,10 @@ describe('release build arguments', () => {
expect(arguments_).toEqual(
expect.arrayContaining([
'--config',
expect.stringMatching(
/build[\\/]electron-builder\.release\.cjs$/u
),
'--win',
'nsis',
'dir',
@@ -376,6 +483,278 @@ describe('release build arguments', () => {
).toBe(false)
})
it('verifies both Agent bundles through the release preflight', () => {
const projectRoot = join('workspace', 'goodbuddy')
const verifyBundleMatrix = vi.fn()
releaseBuilder.verifyReleaseAgentResources(
projectRoot,
verifyBundleMatrix
)
expect(verifyBundleMatrix).toHaveBeenCalledOnce()
expect(verifyBundleMatrix).toHaveBeenCalledWith(
join(projectRoot, '.agent-resources'),
{ projectRoot }
)
expect(() =>
releaseBuilder.verifyReleaseAgentResources(
projectRoot,
() => {
throw new Error('invalid Agent bundle')
}
)
).toThrow('invalid Agent bundle')
})
it('verifies both remote Runtime bundles through the release preflight', () => {
const projectRoot = join('workspace', 'goodbuddy')
const verifyBundleMatrix = vi.fn()
releaseBuilder.verifyReleaseRemoteRuntimeResources(
projectRoot,
verifyBundleMatrix
)
expect(verifyBundleMatrix).toHaveBeenCalledOnce()
expect(verifyBundleMatrix).toHaveBeenCalledWith(
join(projectRoot, '.remote-runtime-resources'),
{ projectRoot }
)
expect(() =>
releaseBuilder.verifyReleaseRemoteRuntimeResources(
projectRoot,
() => {
throw new Error('invalid remote Runtime bundle')
}
)
).toThrow('invalid remote Runtime bundle')
})
it('discovers one canonical remote Runtime digest directory per architecture', () => {
const projectRoot = mkdtempSync(
join(tmpdir(), 'goodbuddy-release-runtime-')
)
const resourcesRoot = join(
projectRoot,
'.remote-runtime-resources'
)
const digests = {
x64: '1'.repeat(64),
arm64: '2'.repeat(64)
}
const registry = { formatVersion: 1 }
const lock = {
formatVersion: 1,
runtimes: {
opencode: {
targets: {
x64: {
package: 'opencode-linux-x64-baseline',
integrity: 'sha512-x64'
},
arm64: {
package: 'opencode-linux-arm64',
integrity: 'sha512-arm64'
}
}
}
}
}
const verifyBundleDirectory = vi.fn()
try {
mkdirSync(join(projectRoot, 'resources'), { recursive: true })
writeFileSync(
join(projectRoot, 'resources', 'agent-release-keys.json'),
JSON.stringify(registry)
)
writeFileSync(
join(projectRoot, 'remote-runtime-lock.json'),
JSON.stringify(lock)
)
for (const architecture of ['x64', 'arm64'] as const) {
mkdirSync(
join(
resourcesRoot,
`linux-${architecture}`,
'opencode',
digests[architecture]
),
{ recursive: true }
)
}
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
resourcesRoot,
{ projectRoot, verifyBundleDirectory }
)
expect(verifyBundleDirectory).toHaveBeenCalledTimes(2)
for (const architecture of ['x64', 'arm64'] as const) {
expect(verifyBundleDirectory).toHaveBeenCalledWith(
join(
resourcesRoot,
`linux-${architecture}`,
'opencode',
digests[architecture]
),
{
projectRoot,
architecture,
registry,
lock,
verificationEnvironment: 'production'
}
)
}
} finally {
rmSync(projectRoot, { recursive: true, force: true })
}
})
it('rejects a missing remote Runtime digest directory', () => {
const fixture = createRemoteRuntimeMatrixFixture()
try {
mkdirSync(
join(
fixture.resourcesRoot,
'linux-x64',
'opencode'
),
{ recursive: true }
)
expect(() =>
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
fixture.resourcesRoot,
fixture.options
)
).toThrow(
/must contain exactly one digest directory for x64; found 0/u
)
} finally {
fixture.cleanup()
}
})
it('rejects multiple remote Runtime digest directories', () => {
const fixture = createRemoteRuntimeMatrixFixture()
const runtimeRoot = join(
fixture.resourcesRoot,
'linux-x64',
'opencode'
)
try {
mkdirSync(join(runtimeRoot, '1'.repeat(64)), {
recursive: true
})
mkdirSync(join(runtimeRoot, '2'.repeat(64)))
expect(() =>
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
fixture.resourcesRoot,
fixture.options
)
).toThrow(
/must contain exactly one digest directory for x64; found 2/u
)
} finally {
fixture.cleanup()
}
})
it('rejects malformed entries in a remote Runtime digest root', () => {
const fixture = createRemoteRuntimeMatrixFixture()
const runtimeRoot = join(
fixture.resourcesRoot,
'linux-x64',
'opencode'
)
try {
mkdirSync(join(runtimeRoot, 'NOT-A-CANONICAL-DIGEST'), {
recursive: true
})
expect(() =>
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
fixture.resourcesRoot,
fixture.options
)
).toThrow(
/contains an unexpected entry for x64: NOT-A-CANONICAL-DIGEST/u
)
} finally {
fixture.cleanup()
}
})
it('rejects non-directory remote Runtime digest entries', () => {
const fixture = createRemoteRuntimeMatrixFixture()
const runtimeRoot = join(
fixture.resourcesRoot,
'linux-x64',
'opencode'
)
const digest = '1'.repeat(64)
try {
mkdirSync(runtimeRoot, { recursive: true })
writeFileSync(join(runtimeRoot, digest), 'not a bundle')
expect(() =>
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
fixture.resourcesRoot,
fixture.options
)
).toThrow(
new RegExp(
`entry must be a real directory for x64: ${digest}`,
'u'
)
)
} finally {
fixture.cleanup()
}
})
it('rejects symlinked remote Runtime digest directories', () => {
const fixture = createRemoteRuntimeMatrixFixture()
const runtimeRoot = join(
fixture.resourcesRoot,
'linux-x64',
'opencode'
)
const digest = '1'.repeat(64)
const target = join(fixture.projectRoot, 'runtime-target')
try {
mkdirSync(runtimeRoot, { recursive: true })
mkdirSync(target)
symlinkSync(
target,
join(runtimeRoot, digest),
process.platform === 'win32' ? 'junction' : 'dir'
)
expect(() =>
releaseBuilder.verifyRemoteRuntimeBundleMatrix(
fixture.resourcesRoot,
fixture.options
)
).toThrow(
new RegExp(
`entry must be a real directory for x64: ${digest}`,
'u'
)
)
} finally {
fixture.cleanup()
}
})
it('explicitly disables notarization for unsigned macOS packages', () => {
const arguments_ =
releaseBuilder.buildElectronBuilderArguments(
@@ -731,7 +1110,7 @@ describe('release build arguments', () => {
}
})
it('keeps Web3D test fixtures out of release resources', () => {
it('keeps installable Agent resources out of ordinary desktop packages', () => {
const packageJson = require('../package.json') as {
build: {
files: string[]
@@ -757,6 +1136,21 @@ describe('release build arguments', () => {
to: 'runtimes',
filter: ['npm{,/**/*}']
})
expect(resourceSources).toContain(
'resources/agent-release-keys.json'
)
expect(resourceSources).toContain('agent-runtime-lock.json')
expect(resourceSources).toContain('remote-runtime-lock.json')
expect(
resourceSources.some((source) =>
source.startsWith('.agent-resources/')
)
).toBe(false)
expect(
resourceSources.some((source) =>
source.startsWith('.remote-runtime-resources/')
)
).toBe(false)
expect(
resourceSources.some((source) => source.startsWith('tests/'))
).toBe(false)
@@ -777,6 +1171,159 @@ describe('release build arguments', () => {
)
).toBe(true)
})
it('adds the complete Agent matrix only to release packages', () => {
const resourceEntries = releaseConfig.extraResources
expect(resourceEntries).toEqual(
expect.arrayContaining([
{
from: 'resources/agent-release-keys.json',
to: 'agent-release-keys.json'
},
{
from: 'agent-runtime-lock.json',
to: 'agent-runtime-lock.json'
},
{
from: '.agent-resources/linux-x64',
to: 'agents/linux-x64',
filter: ['**/*']
},
{
from: '.agent-resources/linux-arm64',
to: 'agents/linux-arm64',
filter: ['**/*']
},
{
from: 'remote-runtime-lock.json',
to: 'remote-runtime-lock.json'
},
{
from: '.remote-runtime-resources/linux-x64',
to: 'remote-runtimes/linux-x64',
filter: ['**/*']
},
{
from: '.remote-runtime-resources/linux-arm64',
to: 'remote-runtimes/linux-arm64',
filter: ['**/*']
}
])
)
expect(
resourceEntries.filter((entry) =>
entry.from.startsWith('.agent-resources/')
)
).toHaveLength(2)
expect(
resourceEntries.filter((entry) =>
entry.from.startsWith('.remote-runtime-resources/')
)
).toHaveLength(2)
expect(
resourceEntries.filter(
(entry) => entry.from === 'agent-runtime-lock.json'
)
).toHaveLength(1)
expect(
resourceEntries.filter(
(entry) => entry.from === 'remote-runtime-lock.json'
)
).toHaveLength(1)
expect(
resourceEntries.filter(
(entry) =>
entry.from === 'resources/agent-release-keys.json'
)
).toHaveLength(1)
})
it('prepares desktop Runtimes without Agent artifacts', async () => {
const projectRoot = mkdtempSync(
join(tmpdir(), 'goodbuddy-runtime-hook-')
)
const packageName = 'opencode-windows-x64-baseline'
const integrity = 'sha512-test-integrity'
const executable = Buffer.from('desktop runtime')
try {
mkdirSync(join(projectRoot, 'out', 'main'), {
recursive: true
})
mkdirSync(
join(projectRoot, '.runtime-resources', 'x64'),
{ recursive: true }
)
writeFileSync(
join(projectRoot, 'package.json'),
JSON.stringify({
dependencies: {
'@deepseek-ai/dsh-llm': '0.1.0-rc.6'
}
})
)
writeFileSync(
join(projectRoot, 'package-lock.json'),
JSON.stringify({
packages: {
[`node_modules/${packageName}`]: {
version: '1.18.9',
integrity
}
}
})
)
writeFileSync(
join(
projectRoot,
'.runtime-resources',
'x64',
'opencode.exe'
),
executable
)
writeFileSync(
join(
projectRoot,
'.runtime-resources',
'x64',
'.ready.json'
),
JSON.stringify({
packageName,
version: '1.18.9',
integrity,
executableSha256: createHash('sha256')
.update(executable)
.digest('hex')
})
)
await expect(
prepareBundledRuntimes({
electronPlatformName: 'win32',
arch: 1,
packager: { projectDir: projectRoot }
})
).resolves.toBeUndefined()
expect(
existsSync(join(projectRoot, '.agent-resources'))
).toBe(false)
expect(
JSON.parse(
readFileSync(
join(projectRoot, 'out', 'main', 'package.json'),
'utf8'
)
)
).toMatchObject({
name: '@deepseek-ai/dsh-llm',
version: '0.1.0-rc.6'
})
} finally {
rmSync(projectRoot, { recursive: true, force: true })
}
})
})
describe('release binary architecture detection', () => {