fix: make Host updates simple and fast

Host repair could fail while adopting the published OpenCode Runtime, then
repeat package and payload verification and carry durable metadata snapshots
for recovery. Host preparation now verifies each acquired compound archive
once, adopts signed Agent and Runtime metadata without rereading payload trees,
and retries failed work by cleaning staging and preparing fresh.

The desktop and Agent versions are advanced to 0.11.9 with the approved
bilingual release notes. Remote Projects remain a disabled-by-default technical
preview, Agent packages remain separate Linux x64/arm64 releases, and this
release has no LoongArch preview.

Release note: 修复 Host 更新采用失败，移除重复远端包体校验，并将中断恢复简化为清理暂存后重新准备。

src/main/remote-agent/remote-environment-preparer.ts

@@ -5,7 +5,6 @@ import type {
   RemoteEnvironmentPreparationMethod,
   RemoteEnvironmentUpdateProgress
 } from '../../shared/ssh-host-contracts'
-import type { StagedSftp } from '../ssh/bounded-sftp'
 import { verifyAgentInstallationId } from '../ssh/ssh-agent-command'
 import type {
   AgentDiagnosticResult,
@@ -33,13 +32,8 @@ import type {
   AgentPackageManager,
   VerifiedRemoteAgentInstallCandidate
 } from './agent-package-manager'
-import {
-  restoreRemoteEnvironmentMetadata,
-  snapshotRemoteEnvironmentMetadata,
-  type RemoteEnvironmentMetadataSnapshot
-} from './remote-environment-metadata'
 import type {
-  PersistedRemoteEnvironmentMetadataSnapshot,
+  PendingRemoteEnvironmentOperation,
   RemoteEnvironmentOperationStore
 } from './remote-environment-operation-store'
 import type {
@@ -52,7 +46,6 @@ import {
 import { boundedDiagnostic } from './bounded-diagnostic'
 
 const MAXIMUM_PACKAGE_BYTES = 512 * 1024 * 1024
-const MAXIMUM_METADATA_BYTES = 1024 * 1024
 const MAXIMUM_DIAGNOSTIC_CHARACTERS = 800
 
 function assertAgentCommandSucceeded(
@@ -95,7 +88,7 @@ export type RemoteEnvironmentPreparerOptions = {
 /**
  * Prepares one signed compound environment. The selected method controls only
  * how the archive reaches the Host; both paths share prepare, commit,
- * activation, rollback, health checks, and cleanup.
+ * activation, health checks, and cleanup.
  */
 export class RemoteEnvironmentPreparer implements Preparer {
   readonly #resolver: AgentInstallationTargetResolver
@@ -134,29 +127,21 @@ export class RemoteEnvironmentPreparer implements Preparer {
     const target = await this.#resolver.resolve(hostId)
     signal.throwIfAborted()
     assertValidSshConnectionTarget(hostId, target)
-    const recovered = await this.#reconcilePendingOperation(
+    await this.#cleanupPendingOperation(
       hostId,
       target,
       emit,
       signal
     )
-    if (recovered) {
-      return
-    }
 
     let probeLease: SshConnectionLease | undefined
     let bootstrapLease:
       | SshRemotePackageBootstrapLease
       | undefined
     let archiveLease: AgentPackageArchiveLease | undefined
-    let metadataSftp: StagedSftp | undefined
-    let metadataSnapshots:
-      | readonly RemoteEnvironmentMetadataSnapshot[]
-      | undefined
     let operationId: string | undefined
     let operationCleaned = false
     let pendingOperationSaved = false
-    let committedIdentity: SshRemotePackageIdentity | undefined
     try {
       probeLease = await this.#sshPool.acquire(target, signal)
       assertLeaseMatchesTarget(probeLease, target)
@@ -256,16 +241,13 @@ export class RemoteEnvironmentPreparer implements Preparer {
       }
       emit(method, 'probing')
 
-      // Persist recovery identity before either preparation path may create
-      // remote staging. A Main crash must never leave an untracked operation.
+      // Keep only the operation ID needed to clean stale staging before the
+      // next fresh attempt. No remote environment state is copied locally.
       await this.#operationStore.save({
         version: 1,
         hostId,
         targetIdentity: remoteHostRecoveryIdentityKey(target),
-        operationId,
-        size: remoteCandidate.size,
-        sha256: remoteCandidate.sha256,
-        urls: [...remoteCandidate.urls]
+        operationId
       })
       pendingOperationSaved = true
 
@@ -289,35 +271,6 @@ export class RemoteEnvironmentPreparer implements Preparer {
       assertPrepared(prepared, operationId)
       assertPackageIdentity(prepared.identity, candidate)
 
-      // Snapshot the complete environment before commit so an Agent success
-      // followed by a Runtime failure cannot expose a partially adopted pair.
-      metadataSftp = await probeLease.openStagedSftp(
-        probe.canonicalHomeDirectory,
-        {
-          maximumFileBytes: MAXIMUM_METADATA_BYTES,
-          maximumTotalBytes: MAXIMUM_METADATA_BYTES * 24,
-          maximumOperations: 128
-        },
-        signal
-      )
-      metadataSnapshots =
-        await snapshotRemoteEnvironmentMetadata(
-          metadataSftp,
-          probe.uid,
-          signal
-        )
-      await this.#operationStore.save({
-        version: 2,
-        hostId,
-        targetIdentity: remoteHostRecoveryIdentityKey(target),
-        operationId,
-        size: remoteCandidate.size,
-        sha256: remoteCandidate.sha256,
-        urls: [...remoteCandidate.urls],
-        metadataSnapshots:
-          persistMetadataSnapshots(metadataSnapshots)
-      })
-
       // Keep the full target re-resolution immediately adjacent to commit.
       await assertTargetCurrent(this.#resolver, target, signal)
       assertLeaseMatchesTarget(bootstrapLease, target)
@@ -355,7 +308,6 @@ export class RemoteEnvironmentPreparer implements Preparer {
         throw new Error('远端安装提交身份与准备身份不匹配')
       }
       assertPackageIdentity(committed.identity, candidate)
-      committedIdentity = committed.identity
       signal.throwIfAborted()
 
       await this.#adoptCommittedEnvironment(
@@ -372,7 +324,10 @@ export class RemoteEnvironmentPreparer implements Preparer {
           operationId,
           { signal }
         )
-        if (cleanup.cleaned) {
+        if (
+          cleanup.cleaned ||
+          cleanup.reason === 'operation-unavailable'
+        ) {
           operationCleaned = true
           try {
             await this.#operationStore.remove(hostId)
@@ -381,29 +336,10 @@ export class RemoteEnvironmentPreparer implements Preparer {
           }
         }
       } catch {
-        // The environment is already healthy. Leave the bounded
-        // operation for a later maintenance retry.
+        // The environment is already healthy. The next update will retry
+        // cleanup before starting a fresh operation.
       }
     } catch (error) {
-      let rollbackError: unknown
-      if (
-        committedIdentity &&
-        metadataSftp &&
-        metadataSnapshots
-      ) {
-        await stopCandidateBestEffort(
-          probeLease,
-          committedIdentity.agent.installationId
-        )
-        try {
-          await restoreRemoteEnvironmentMetadata(
-            metadataSftp,
-            metadataSnapshots
-          )
-        } catch (reason) {
-          rollbackError = reason
-        }
-      }
       if (
         operationId &&
         bootstrapLease &&
@@ -415,19 +351,11 @@ export class RemoteEnvironmentPreparer implements Preparer {
           operationId
         )
         if (operationCleaned && pendingOperationSaved) {
-          await this.#operationStore.remove(hostId)
+          await this.#operationStore.remove(hostId).catch(() => undefined)
         }
       }
-      if (rollbackError) {
-        throw new AggregateError(
-          [error, rollbackError],
-          '远程运行环境准备失败，且原有环境元数据未能完整恢复',
-          { cause: error }
-        )
-      }
       throw error
     } finally {
-      metadataSftp?.close()
       archiveLease?.release()
       bootstrapLease?.release()
       probeLease?.release()
@@ -595,7 +523,7 @@ export class RemoteEnvironmentPreparer implements Preparer {
     )
   }
 
-  async #reconcilePendingOperation(
+  async #cleanupPendingOperation(
     hostId: string,
     target: SshConnectionTarget,
     emit: (
@@ -603,207 +531,46 @@ export class RemoteEnvironmentPreparer implements Preparer {
       phase: RemoteEnvironmentUpdateProgress['phase']
     ) => void,
     signal: AbortSignal
-  ): Promise<boolean> {
-    const pending = await this.#operationStore.load(hostId)
+  ): Promise<void> {
+    let pending: PendingRemoteEnvironmentOperation | undefined
+    try {
+      pending = await this.#operationStore.load(hostId)
+    } catch {
+      await this.#operationStore.remove(hostId)
+      return
+    }
     if (!pending) {
-      return false
+      return
     }
     if (
       pending.targetIdentity !==
       remoteHostRecoveryIdentityKey(target)
     ) {
-      throw new SshRemotePackageCommitIndeterminateError(
-        'SSH Host 连接目标已变化，无法确认上一次远程环境提交；请恢复原 Host 连接后重试，或删除此 Host 以明确放弃恢复'
-      )
+      await this.#operationStore.remove(hostId)
+      return
     }
     emit('auto', 'applying')
-    const candidate: SshRemotePackageCandidate = {
-      operationId: pending.operationId,
-      size: pending.size,
-      sha256: pending.sha256,
-      urls: pending.urls
-    }
     const bootstrapLease =
       await this.#sshPool.acquireRemotePackageBootstrap(
         target,
         signal
-      )
-    let commandLease: SshConnectionLease | undefined
-    let recoveryMetadataSftp: StagedSftp | undefined
+      ).catch(() => undefined)
     try {
+      if (!bootstrapLease) {
+        return
+      }
       assertLeaseMatchesTarget(bootstrapLease, target)
-      if (pending.version === 1) {
-        const cleanup = await bootstrapLease.cleanup(
-          pending.operationId,
-          { signal }
-        )
-        if (
-          !cleanup.cleaned &&
-          cleanup.reason !== 'operation-unavailable'
-        ) {
-          throw new Error(
-            `旧版远程环境暂存清理失败：${cleanup.reason}`
-          )
-        }
-        await this.#operationStore.remove(hostId)
-        return false
-      }
-      const status = await bootstrapLease.commitStatus(
-        candidate,
-        { signal }
-      )
-      if (
-        !status.committed &&
-        status.reason === 'operation-unavailable'
-      ) {
-        await this.#operationStore.remove(hostId)
-        return false
-      }
-      if (
-        !status.committed &&
-        status.reason === 'installer-rollback-incomplete'
-      ) {
-        throw new SshRemotePackageCommitIndeterminateError(
-          '上一次远程环境发布失败且回滚结果不完整，请检查 Host 状态'
-        )
-      }
-      commandLease = await this.#sshPool.acquire(
-        target,
-        signal
-      )
-      assertLeaseMatchesTarget(commandLease, target)
-      const probe =
-        await commandLease.runAgentBootstrapProbe(signal)
-      if (!probe.ready) {
-        throw new Error(
-          `远端系统不能恢复 GoodBuddy 环境：${probe.reason}`
-        )
-      }
-      recoveryMetadataSftp =
-        await commandLease.openStagedSftp(
-          probe.canonicalHomeDirectory,
-          {
-            maximumFileBytes: MAXIMUM_METADATA_BYTES,
-            maximumTotalBytes:
-              MAXIMUM_METADATA_BYTES * 24,
-            maximumOperations: 128
-          },
-          signal
-        )
-      const recoverySnapshots =
-        restorePersistedMetadataSnapshots(
-          pending.metadataSnapshots,
-          probe.uid
-        )
-      if (status.committed) {
-        try {
-          await this.#adoptCommittedEnvironment(
-            commandLease,
-            status.identity,
-            'auto',
-            emit,
-            signal
-          )
-        } catch (error) {
-          await stopCandidateBestEffort(
-            commandLease,
-            status.identity.agent.installationId
-          )
-          try {
-            await restoreRemoteEnvironmentMetadata(
-              recoveryMetadataSftp,
-              recoverySnapshots
-            )
-          } catch (rollbackError) {
-            throw new AggregateError(
-              [error, rollbackError],
-              '上一次远程环境恢复失败，且原有环境元数据未能完整恢复',
-              { cause: rollbackError }
-            )
-          }
-          throw error
-        }
-      } else {
-        await restoreRemoteEnvironmentMetadata(
-          recoveryMetadataSftp,
-          recoverySnapshots
-        )
-      }
-      const cleanup = await bootstrapLease.cleanup(
+      await bootstrapLease.cleanup(
         pending.operationId,
         { signal }
-      )
-      if (
-        cleanup.cleaned ||
-        cleanup.reason === 'operation-unavailable'
-      ) {
-        await this.#operationStore.remove(hostId)
-      } else if (!status.committed) {
-        throw new Error(
-          `上一次未提交的远程环境暂存清理失败：${cleanup.reason}`
-        )
-      }
-      return status.committed
-    } catch (error) {
-      if (
-        error instanceof
-        SshRemotePackageCommitIndeterminateError
-      ) {
-        throw error
-      }
-      const detail = error instanceof Error
-        ? error.message
-        : String(error)
-      throw new SshRemotePackageCommitIndeterminateError(
-        `上一次远程环境恢复失败：${detail}`
-      )
+      ).catch(() => undefined)
     } finally {
-      recoveryMetadataSftp?.close()
-      commandLease?.release()
-      bootstrapLease.release()
+      bootstrapLease?.release()
+      await this.#operationStore.remove(hostId)
     }
   }
 }
 
-function persistMetadataSnapshots(
-  snapshots: readonly RemoteEnvironmentMetadataSnapshot[]
-): readonly PersistedRemoteEnvironmentMetadataSnapshot[] {
-  return snapshots.map((snapshot) => ({
-    path: snapshot.path,
-    uid: snapshot.uid,
-    ...(snapshot.contents === undefined
-      ? {}
-      : {
-          contentsBase64:
-            snapshot.contents.toString('base64')
-        })
-  }))
-}
-
-function restorePersistedMetadataSnapshots(
-  snapshots:
-    readonly PersistedRemoteEnvironmentMetadataSnapshot[],
-  uid: number
-): readonly RemoteEnvironmentMetadataSnapshot[] {
-  if (snapshots.some((snapshot) => snapshot.uid !== uid)) {
-    throw new Error(
-      '远程环境恢复元数据与当前 SSH 用户不匹配'
-    )
-  }
-  return snapshots.map((snapshot) => ({
-    path: snapshot.path,
-    uid: snapshot.uid,
-    ...(snapshot.contentsBase64 === undefined
-      ? {}
-      : {
-          contents: Buffer.from(
-            snapshot.contentsBase64,
-            'base64'
-          )
-        })
-  }))
-}
-
 async function resolvePreparationMethod(
   requested: RemoteEnvironmentPreparationMethod,
   lease: SshRemotePackageBootstrapLease,
@@ -854,23 +621,6 @@ async function cleanupBestEffort(
   }
 }
 
-async function stopCandidateBestEffort(
-  lease: SshConnectionLease | undefined,
-  installationId: string
-): Promise<void> {
-  if (!lease?.isUsable()) {
-    return
-  }
-  try {
-    await lease.runAgentLifecycleAction(
-      verifyAgentInstallationId(installationId),
-      'stop'
-    )
-  } catch {
-    // Metadata rollback remains the authoritative recovery action.
-  }
-}
-
 async function assertTargetCurrent(
   resolver: AgentInstallationTargetResolver,
   expected: SshConnectionTarget,