fix: make Host environment updates fast and recoverable

Published Host updates could fail while the desktop reverified Runtime against
its bundled lock and repeatedly traversed remote payloads. Host preparation now
verifies and extracts once, adopts Agent and Runtime on one pinned connection,
and uses registered metadata for normal health, capability, and prompt paths.
Interrupted commits and adoption retain bounded recovery and rollback state.

Desktop and Agent versions are 0.11.8. Remote Projects remain a technical
preview; the Agent targets Linux x64 and arm64, with no LoongArch preview.

Release note: 修复正式环境 Host 更新失败并移除重复远端包体扫描；中断恢复与清理失败不再破坏已健康环境。

src/main/remote-agent/remote-environment-operation-store.ts

@@ -6,13 +6,12 @@ import {
   writeJsonFileAtomically
 } from '../settings-file-utils'
 
-const MAXIMUM_RECORD_BYTES = 64 * 1024
+const MAXIMUM_RECORD_BYTES = 8 * 1024 * 1024
 const OPERATION_ID_PATTERN =
   /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u
 const SHA256_PATTERN = /^[a-f0-9]{64}$/u
 
-export type PendingRemoteEnvironmentOperation = {
-  version: 1
+type PendingRemoteEnvironmentOperationBase = {
   hostId: string
   targetIdentity: string
   operationId: string
@@ -21,6 +20,28 @@ export type PendingRemoteEnvironmentOperation = {
   urls: readonly string[]
 }
 
+export type PersistedRemoteEnvironmentMetadataSnapshot = {
+  path:
+    | '.goodbuddy/agent/release-keys.json'
+    | '.goodbuddy/agent/registry.json'
+    | '.goodbuddy/runtimes/release-keys.json'
+    | '.goodbuddy/runtimes/remote-runtime-lock.json'
+    | '.goodbuddy/runtimes/registry.json'
+  contentsBase64?: string
+  uid: number
+}
+
+export type PendingRemoteEnvironmentOperation =
+  PendingRemoteEnvironmentOperationBase &
+    (
+      | { version: 1 }
+      | {
+          version: 2
+          metadataSnapshots:
+            readonly PersistedRemoteEnvironmentMetadataSnapshot[]
+        }
+    )
+
 export class RemoteEnvironmentOperationStore {
   readonly #directory: string
 
@@ -91,11 +112,23 @@ function parsePendingOperation(
   value: unknown,
   expectedHostId: string
 ): PendingRemoteEnvironmentOperation {
-  if (
-    typeof value !== 'object' ||
-    value === null ||
-    Object.keys(value).sort().join('\0') !==
-      [
+  if (typeof value !== 'object' || value === null) {
+    throw new Error('远程环境恢复记录无效')
+  }
+  const record = value as Record<string, unknown>
+  const version = record.version
+  const expectedKeys = version === 2
+    ? [
+        'hostId',
+        'metadataSnapshots',
+        'operationId',
+        'sha256',
+        'size',
+        'targetIdentity',
+        'urls',
+        'version'
+      ]
+    : [
         'hostId',
         'operationId',
         'sha256',
@@ -103,13 +136,15 @@ function parsePendingOperation(
         'targetIdentity',
         'urls',
         'version'
-      ].sort().join('\0')
+      ]
+  if (
+    Object.keys(value).sort().join('\0') !==
+      expectedKeys.sort().join('\0')
   ) {
     throw new Error('远程环境恢复记录无效')
   }
-  const record = value as Record<string, unknown>
   if (
-    record.version !== 1 ||
+    (version !== 1 && version !== 2) ||
     record.hostId !== expectedHostId ||
     typeof record.targetIdentity !== 'string' ||
     !SHA256_PATTERN.test(record.targetIdentity) ||
@@ -129,8 +164,7 @@ function parsePendingOperation(
   ) {
     throw new Error('远程环境恢复记录无效')
   }
-  return {
-    version: 1,
+  const base: PendingRemoteEnvironmentOperationBase = {
     hostId: expectedHostId,
     targetIdentity: record.targetIdentity,
     operationId: record.operationId,
@@ -138,4 +172,100 @@ function parsePendingOperation(
     sha256: record.sha256,
     urls: [...record.urls] as string[]
   }
+  if (version === 1) {
+    return { version: 1, ...base }
+  }
+  return {
+    version: 2,
+    ...base,
+    metadataSnapshots: parseMetadataSnapshots(
+      record.metadataSnapshots
+    )
+  }
+}
+
+const metadataPaths =
+  new Set<PersistedRemoteEnvironmentMetadataSnapshot['path']>([
+    '.goodbuddy/agent/release-keys.json',
+    '.goodbuddy/agent/registry.json',
+    '.goodbuddy/runtimes/release-keys.json',
+    '.goodbuddy/runtimes/remote-runtime-lock.json',
+    '.goodbuddy/runtimes/registry.json'
+  ])
+
+function parseMetadataSnapshots(
+  value: unknown
+): readonly PersistedRemoteEnvironmentMetadataSnapshot[] {
+  if (!Array.isArray(value) || value.length !== metadataPaths.size) {
+    throw new Error('远程环境恢复记录无效')
+  }
+  const paths = new Set<string>()
+  let totalBytes = 0
+  const snapshots = value.map((item) => {
+    if (
+      typeof item !== 'object' ||
+      item === null ||
+      !(
+        Object.keys(item).sort().join('\0') ===
+          ['path', 'uid'].sort().join('\0') ||
+        Object.keys(item).sort().join('\0') ===
+          ['contentsBase64', 'path', 'uid'].sort().join('\0')
+      )
+    ) {
+      throw new Error('远程环境恢复记录无效')
+    }
+    const snapshot = item as Record<string, unknown>
+    if (
+      typeof snapshot.path !== 'string' ||
+      !metadataPaths.has(
+        snapshot.path as PersistedRemoteEnvironmentMetadataSnapshot['path']
+      ) ||
+      paths.has(snapshot.path) ||
+      !Number.isSafeInteger(snapshot.uid) ||
+      Number(snapshot.uid) < 0
+    ) {
+      throw new Error('远程环境恢复记录无效')
+    }
+    paths.add(snapshot.path)
+    if (snapshot.contentsBase64 === undefined) {
+      return {
+        path:
+          snapshot.path as PersistedRemoteEnvironmentMetadataSnapshot['path'],
+        uid: Number(snapshot.uid)
+      }
+    }
+    if (
+      typeof snapshot.contentsBase64 !== 'string' ||
+      !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u
+        .test(snapshot.contentsBase64)
+    ) {
+      throw new Error('远程环境恢复记录无效')
+    }
+    const contents = Buffer.from(
+      snapshot.contentsBase64,
+      'base64'
+    )
+    if (
+      contents.toString('base64') !==
+        snapshot.contentsBase64 ||
+      contents.byteLength > 1024 * 1024
+    ) {
+      throw new Error('远程环境恢复记录无效')
+    }
+    totalBytes += contents.byteLength
+    return {
+      path:
+        snapshot.path as PersistedRemoteEnvironmentMetadataSnapshot['path'],
+      contentsBase64: snapshot.contentsBase64,
+      uid: Number(snapshot.uid)
+    }
+  })
+  if (
+    paths.size !== metadataPaths.size ||
+    [...metadataPaths].some((path) => !paths.has(path)) ||
+    totalBytes > 5 * 1024 * 1024
+  ) {
+    throw new Error('远程环境恢复记录无效')
+  }
+  return snapshots
 }