feat: support macOS arm64 remote Agent hosts

Extend GoodBuddy Agent packaging, installation, SSH attachment, Runtime lifecycle, and Desktop package management to macOS arm64. Linux x64, Linux arm64, and Darwin arm64 share the existing signed catalog. Preserve Ask read-only behavior and Execute account permissions, and stop detached tool descendants during Mac cancellation.

Upgrade Desktop before publishing the first mixed-platform catalog because older Linux-only readers reject Darwin entries. Intel Macs are not supported; no launchd service or administrator access is required. This commit does not publish a release.

Validation: 3520 tests passed, 57 skipped; typecheck, lint, and development build passed. Real Mac installation, Ask/Execute, cancellation and reconnect passed; final Linux installation, Ask and reconnect passed. Nine real model requests were recorded.

Release note: 支持将 Apple Silicon Mac 用作远程项目 Host，可安装 macOS arm64 Agent 并使用 Ask、Execute 和断线重连；与 Linux 共用一个包目录，发布混合目录前需升级 Desktop。

src/main/ssh/ssh-agent-command.test.ts

@@ -214,7 +214,8 @@ describe('fixed Agent SSH commands', () => {
     const cases: Array<
       [Partial<Record<string, string>>, string]
     > = [
-      [{ os: 'Darwin' }, 'non-linux'],
+      [{ os: 'Darwin' }, 'unsupported-architecture'],
+      [{ os: 'FreeBSD' }, 'unsupported-platform'],
       [{ arch: 'riscv64' }, 'unsupported-architecture'],
       [{ home: 'unknown' }, 'home-directory-unavailable'],
       [{ uid: 'unknown' }, 'uid-unavailable'],

src/main/ssh/ssh-agent-command.ts

@@ -129,17 +129,17 @@ export function parseAgentBootstrapProbeOutput(
   }
 
   const os = values.get('os')
-  if (os !== 'Linux') {
-    return incompatible('non-linux')
+  if (os !== 'Linux' && os !== 'Darwin') {
+    return incompatible('unsupported-platform')
   }
   const rawArchitecture = values.get('arch')
   const architecture =
     rawArchitecture === 'x86_64'
       ? 'x64'
-      : rawArchitecture === 'aarch64'
+      : rawArchitecture === 'aarch64' || rawArchitecture === 'arm64'
         ? 'arm64'
         : undefined
-  if (!architecture) {
+  if (!architecture || (os === 'Darwin' && architecture !== 'arm64')) {
     return incompatible('unsupported-architecture')
   }
 
@@ -169,17 +169,17 @@ export function parseAgentBootstrapProbeOutput(
   if (procfs !== 'ready' && procfs !== 'unavailable') {
     throw new Error('Agent 启动探针返回了无效结果')
   }
-  if (procfs === 'unavailable') {
+  if (procfs === 'unavailable' && os === 'Linux') {
     return incompatible('procfs-unavailable')
   }
   return agentBootstrapProbeResultSchema.parse({
     ready: true,
-    platform: 'linux',
+    platform: os === 'Darwin' ? 'darwin' : 'linux',
     architecture,
     canonicalHomeDirectory: home,
     uid,
     shell,
-    procfs: 'ready'
+    procfs: os === 'Darwin' ? 'not-applicable' : 'ready'
   })
 }
 

src/main/ssh/ssh-host-remote-environment.ts

@@ -83,7 +83,7 @@ export type SshHostRemoteEnvironmentInspectorOptions = {
   remoteRuntimeLockPath: string
   loadRemoteEnvironmentCatalog?: (
     architecture: 'x64' | 'arm64',
-    options: { signal?: AbortSignal }
+    options: { signal?: AbortSignal; platform?: 'linux' | 'darwin' }
   ) => Promise<RemoteEnvironmentCatalog>
   now?: () => Date
 }
@@ -155,7 +155,7 @@ export class SshHostRemoteEnvironmentInspector {
         await Promise.all([
           this.#loadRemoteEnvironmentCatalog(
             probe.architecture,
-            { signal }
+            { signal, platform: probe.platform }
           ),
           readOptionalRegistry(
             sftp,

src/main/ssh/ssh-remote-package-bootstrap.test.ts

@@ -503,7 +503,7 @@ describe("fixed SSH remote package bootstrap", () => {
       '--archive-sha256-verified true',
     );
     expect(SSH_REMOTE_PACKAGE_BOOTSTRAP_SCRIPT).toContain(
-      'actual_sha256=$(sha256sum "$archive"',
+      'actual_sha256=$(hash_sha256 "$archive"',
     );
   });
 

src/main/ssh/ssh-remote-package-bootstrap.ts

@@ -127,7 +127,7 @@ export type SshRemotePackageAgentIdentity = {
   agentVersion: string;
   manifestSha256: string;
   binaryDigest: string;
-  platform: "linux";
+  platform: "linux" | "darwin";
   architecture: "x64" | "arm64";
   protocol: SshRemotePackageProtocol;
   supervisor: "detached-on-demand";
@@ -140,7 +140,7 @@ export type SshRemotePackageRuntimeIdentity = {
   manifestDigest: string;
   runtimeAdapterDigest: string;
   acpCapabilitiesDigest: string;
-  platform: "linux";
+  platform: "linux" | "darwin";
   architecture: "x64" | "arm64";
   protocol: SshRemotePackageProtocol;
 };
@@ -614,9 +614,17 @@ if [ "$action" = prepare-uploaded ]; then
   run_prepare
 fi
 command -v curl >/dev/null 2>&1 || stop unavailable missing-curl
-command -v sha256sum >/dev/null 2>&1 || stop unavailable missing-sha256sum
+hash_sha256() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$@"
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$@"
+  else
+    return 1
+  fi
+}
 command -v unzip >/dev/null 2>&1 || stop unavailable missing-unzip
-printf test | sha256sum >/dev/null 2>&1 || stop unavailable missing-sha256sum
+printf test | hash_sha256 >/dev/null 2>&1 || stop unavailable missing-sha256sum
 unzip -v >/dev/null 2>&1 || stop unavailable missing-unzip
 if ! mkdir -p -- "$staging_root"; then stop unavailable managed-path-unavailable; fi
 if [ -L "$goodbuddy_root" ] || [ -L "$managed_root" ] ||
@@ -708,7 +716,7 @@ set -- $actual_size
 actual_size=${SHELL_FIRST_POSITIONAL_OR_EMPTY}
 [ "$actual_size" = "$expected_size" ] || stop failed size-mismatch
 emit_progress verifying
-actual_sha256=$(sha256sum "$archive" 2>/dev/null) || stop failed sha256-mismatch
+actual_sha256=$(hash_sha256 "$archive" 2>/dev/null) || stop failed sha256-mismatch
 set -- $actual_sha256
 actual_sha256=${SHELL_FIRST_POSITIONAL_OR_EMPTY}
 [ "$actual_sha256" = "$expected_sha256" ] || stop failed sha256-mismatch
@@ -973,7 +981,7 @@ function parsePackageIdentity(
     agent.installationId !== `agent-${agent.manifestSha256}` ||
     agent.binaryDigest !== `sha256:${agent.manifestSha256}` ||
     !isVersion(agent.agentVersion) ||
-    agent.platform !== "linux" ||
+    (agent.platform !== "linux" && !(agent.platform === "darwin" && architecture === "arm64")) ||
     (architecture !== "x64" && architecture !== "arm64") ||
     !agentProtocol ||
     agent.supervisor !== "detached-on-demand" ||
@@ -987,7 +995,7 @@ function parsePackageIdentity(
     !DIGEST_PATTERN.test(runtime.runtimeAdapterDigest) ||
     typeof runtime.acpCapabilitiesDigest !== "string" ||
     !DIGEST_PATTERN.test(runtime.acpCapabilitiesDigest) ||
-    runtime.platform !== "linux" ||
+    runtime.platform !== agent.platform ||
     runtime.architecture !== architecture ||
     !runtimeProtocol
   ) {
@@ -1003,7 +1011,7 @@ function parsePackageIdentity(
       agentVersion: agent.agentVersion,
       manifestSha256: agent.manifestSha256,
       binaryDigest: agent.binaryDigest,
-      platform: "linux",
+      platform: agent.platform as "linux" | "darwin",
       architecture,
       protocol: agentProtocol,
       supervisor: "detached-on-demand",
@@ -1015,7 +1023,7 @@ function parsePackageIdentity(
       manifestDigest: runtime.manifestDigest,
       runtimeAdapterDigest: runtime.runtimeAdapterDigest,
       acpCapabilitiesDigest: runtime.acpCapabilitiesDigest,
-      platform: "linux",
+      platform: agent.platform as "linux" | "darwin",
       architecture,
       protocol: runtimeProtocol,
     },