feat: add independent managed SSH agent packages

Managed SSH previously tied remote Agent and Runtime artifacts to desktop
packaging and Host activation. Settings now manages verified Linux x64 and
arm64 .gbagent packages explicitly, with source-aligned download and update
plus offline import and export. Each package contains the signed Agent, pinned
Node, and compatible OpenCode Runtime, and project activation never downloads
one automatically.

Dedicated native CI and a protected release workflow publish deterministic,
signed cumulative catalogs to GitHub and Beijing OSS without replacing the
desktop Latest release. Desktop packaging is metadata-only, remains independent
of Agent artifacts and signing credentials, and Linux desktop releases add RPM
installers.

The managed SSH path also keeps model credentials in Main, enforces Ask as
read-only, verifies signed Agent and Runtime inputs, preserves ACP recovery, and
reports Host update cancellation and failures accurately.

Release note: 远程项目现可在“设置”中手动下载、更新或离线导入签名 Agent 包，桌面安装包与远程组件发布相互独立；Linux 桌面版同时新增 RPM 安装包。

tests/packages-workflow.test.ts

@@ -7,29 +7,12 @@ const workflow = readFileSync(
   join(process.cwd(), '.github', 'workflows', 'packages.yml'),
   'utf8'
 )
-const runtimeLock = JSON.parse(
-  readFileSync(
-    join(process.cwd(), 'agent-runtime-lock.json'),
-    'utf8'
-  )
-) as {
-  node: {
-    version: string
-    source: string
-    targets: Record<
-      string,
-      {
-        archive: string
-        sha256: string
-      }
-    >
-  }
-}
-const parsedWorkflow = parse(workflow) as {
+const parsed = parse(workflow) as {
   jobs: Record<
     string,
     {
       needs?: string | string[]
+      environment?: { name?: string }
       strategy?: {
         matrix?: {
           include?: Array<Record<string, unknown>>
@@ -46,27 +29,19 @@ const parsedWorkflow = parse(workflow) as {
 }
 
 function serializedJob(name: string): string {
-  return JSON.stringify(parsedWorkflow.jobs[name])
+  return JSON.stringify(parsed.jobs[name])
 }
 
 function jobScripts(name: string): string {
   return (
-    parsedWorkflow.jobs[name]?.steps
+    parsed.jobs[name]?.steps
       ?.map((step) => step.run ?? '')
       .join('\n') ?? ''
   )
 }
 
-function jobSteps(
-  name: string
-): NonNullable<
-  (typeof parsedWorkflow.jobs)[string]['steps']
-> {
-  return parsedWorkflow.jobs[name]?.steps ?? []
-}
-
 function jobNeeds(name: string): string[] {
-  const needs = parsedWorkflow.jobs[name]?.needs
+  const needs = parsed.jobs[name]?.needs
   return needs === undefined
     ? []
     : Array.isArray(needs)
@@ -74,286 +49,172 @@ function jobNeeds(name: string): string[] {
       : [needs]
 }
 
-describe('packages workflow', () => {
-  it('uses valid YAML and Node.js 24 GitHub Actions', () => {
+describe('desktop packages workflow', () => {
+  it('uses valid YAML, pinned action majors, and only desktop release jobs', () => {
     expect(() => parse(workflow)).not.toThrow()
-
-    const references = [
+    expect(Object.keys(parsed.jobs)).toEqual([
+      'validate',
+      'authorize-release',
+      'package',
+      'release'
+    ])
+    const actionReferences = [
       ...workflow.matchAll(
-        /uses:\s+(actions\/(?:checkout|setup-node|cache|upload-artifact|download-artifact)@v\d+)/gu
+        /uses:\s+((?:actions\/(?:checkout|setup-node|cache|upload-artifact|download-artifact)|aliyun\/configure-aliyun-credentials-action)@v\d+)/gu
       )
     ].map((match) => match[1])
-
-    expect(new Set(references)).toEqual(
+    expect(new Set(actionReferences)).toEqual(
       new Set([
         'actions/checkout@v7',
         'actions/setup-node@v7',
         'actions/cache@v6',
         'actions/upload-artifact@v7',
-        'actions/download-artifact@v8'
+        'actions/download-artifact@v8',
+        'aliyun/configure-aliyun-credentials-action@v1'
       ])
     )
-    const setupNodeVersions = Object.values(parsedWorkflow.jobs)
-      .flatMap((job) => job.steps ?? [])
-      .filter((step) => step.uses === 'actions/setup-node@v7')
-      .map((step) => step.with?.['node-version'])
-
-    expect(setupNodeVersions.length).toBeGreaterThanOrEqual(4)
-    expect(new Set(setupNodeVersions)).toEqual(
-      new Set([runtimeLock.node.version])
-    )
-  })
-
-  it('builds signed Agent bundles natively before the release package matrix', () => {
-    const runtimeJob = serializedJob('agent-runtime')
-    const signingJob = serializedJob('agent-signing')
-    const signingMatrix =
-      parsedWorkflow.jobs['agent-signing']?.strategy?.matrix
-        ?.include ?? []
-    const packageDownload = jobSteps('package').find(
-      (step) =>
-        step.uses === 'actions/download-artifact@v8' &&
-        step.with?.pattern !== undefined
-    )
-
-    expect(signingMatrix).toContainEqual(
-      expect.objectContaining({
-        arch: 'arm64',
-        runner: 'ubuntu-24.04-arm'
-      })
-    )
-    expect(signingJob).toContain(
+    expect(workflow).not.toContain('agent-signing:')
+    expect(workflow).not.toContain('remote-runtime-signing:')
+    expect(workflow).not.toContain(
       'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
     )
-    expect(signingJob).toContain(
-      'Preflight production Agent signing registry'
-    )
-    expect(signingJob).toContain(
-      'node build/agent-bundle.cjs preflight'
-    )
-    for (const target of Object.values(runtimeLock.node.targets)) {
-      expect(runtimeJob).toContain(target.archive)
-    }
-    expect(packageDownload?.with?.pattern).toBe(
-      'goodbuddy-agent-linux-*'
-    )
-    const packageScripts = jobScripts('package')
-    for (const targetName of Object.keys(runtimeLock.node.targets)) {
-      expect(packageScripts).toContain(
-        `--archive dist/agent-downloads/goodbuddy-agent-${targetName}.tar`
-      )
-    }
-    expect(jobNeeds('package')).toEqual(
-      expect.arrayContaining(['validate', 'agent-signing'])
+    expect(workflow).not.toContain(
+      'GOODBUDDY_REMOTE_RUNTIME_SIGNING_PRIVATE_KEY'
     )
   })
 
-  it('imports Agent artifacts before invoking the explicit release packager', () => {
+  it('packages all six desktop targets without remote component dependencies', () => {
+    expect(
+      parsed.jobs.package?.strategy?.matrix?.include
+    ).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          platform: 'windows',
+          arch: 'x64',
+          runner: 'windows-2025'
+        }),
+        expect.objectContaining({
+          platform: 'windows',
+          arch: 'arm64',
+          runner: 'windows-2025'
+        }),
+        expect.objectContaining({
+          platform: 'macos',
+          arch: 'x64',
+          runner: 'macos-15-intel'
+        }),
+        expect.objectContaining({
+          platform: 'macos',
+          arch: 'arm64',
+          runner: 'macos-15'
+        }),
+        expect.objectContaining({
+          platform: 'linux',
+          arch: 'x64',
+          runner: 'ubuntu-24.04'
+        }),
+        expect.objectContaining({
+          platform: 'linux',
+          arch: 'arm64',
+          runner: 'ubuntu-24.04-arm'
+        })
+      ])
+    )
+    expect(jobNeeds('package')).toEqual([
+      'validate',
+      'authorize-release'
+    ])
     const scripts = jobScripts('package')
-    const importIndex = scripts.indexOf(
-      'node build/agent-bundle.cjs import'
+    expect(scripts).toContain('npm run release:package')
+    expect(scripts).not.toContain('agent-bundle.cjs import')
+    expect(scripts).not.toContain(
+      'remote-runtime-bundle.cjs import'
     )
-    const releaseIndex = scripts.indexOf(
-      'npm run release:package'
+    expect(serializedJob('package')).not.toContain(
+      'goodbuddy-agent-linux-'
+    )
+    expect(serializedJob('package')).not.toContain(
+      'goodbuddy-opencode-linux-'
     )
-
-    expect(importIndex).toBeGreaterThanOrEqual(0)
-    expect(releaseIndex).toBeGreaterThan(importIndex)
-    expect(scripts).not.toContain('npm run dist')
-    expect(scripts).not.toContain('npm run portable')
   })
 
-  it('authorizes signing only for protected-main commits and matching immutable version tags', () => {
-    const authorization = serializedJob(
-      'authorize-agent-signing'
-    )
-    const policy = jobScripts('authorize-agent-signing')
-
+  it('keeps desktop authorization tied to protected main and v tags', () => {
+    const authorization = serializedJob('authorize-release')
+    const policy = jobScripts('authorize-release')
     expect(authorization).toContain(
       "github.ref == 'refs/heads/main'"
     )
-    expect(policy).toContain(
-      'git merge-base --is-ancestor'
-    )
+    expect(policy).toContain('git merge-base --is-ancestor')
     expect(policy).toContain(
       "require('./package.json').version"
     )
-    expect(policy).toContain(
-      'GITHUB_EVENT_PATH).created'
-    )
-    expect(policy).toContain(
-      'GITHUB_EVENT_PATH).forced'
-    )
-    expect(policy).toContain(
-      'GITHUB_EVENT_PATH).deleted'
-    )
     expect(policy).toContain(
       'test "$GITHUB_REF" = "refs/tags/$expected"'
     )
-    expect(policy).toContain(
-      'git cat-file -t "refs/tags/$GITHUB_REF_NAME"'
-    )
     expect(policy).toContain(
       'refs/tags/$GITHUB_REF_NAME^{commit}'
     )
-    expect(policy).toContain(
-      'test "$GITHUB_REF" = "refs/heads/main"'
-    )
-    expect(policy).toContain(
-      'test "$GITHUB_SHA" = "$(git rev-parse refs/remotes/origin/main)"'
-    )
     expect(policy).toContain(
       'echo "authorized=true" >> "$GITHUB_OUTPUT"'
     )
-  })
-
-  it('gates the only Agent private-key step behind the protected signing environment', () => {
-    const signing = serializedJob('agent-signing')
-
-    expect(signing).toContain('"name":"agent-signing"')
-    expect(signing).toContain(
-      '"authorize-agent-signing"'
-    )
-    expect(signing).toContain(
-      "needs.authorize-agent-signing.outputs.authorized == 'true'"
-    )
-    expect(signing).toContain(
-      '${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}'
-    )
-    expect(signing.indexOf('Preflight production Agent signing registry'))
-      .toBeLessThan(
-        signing.indexOf(
-          '${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}'
-        )
-      )
-    expect(signing).not.toContain('"cache"')
-    expect(signing).not.toContain('actions/cache')
-    expect(
-      workflow.match(
-        /\$\{\{\s*secrets\.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY\s*\}\}/gu
-      )
-    ).toHaveLength(1)
-  })
-
-  it('keeps production signing inputs out of arbitrary-ref jobs', () => {
-    for (const name of [
-      'validate',
-      'authorize-agent-signing',
-      'agent-runtime'
-    ]) {
-      expect(serializedJob(name)).not.toContain('secrets.')
-      expect(serializedJob(name)).not.toContain(
-        'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
-      )
-    }
-
-    expect(serializedJob('validate')).not.toContain(
-      'GOODBUDDY_AGENT_SIGNING_KEY_ID'
-    )
-    expect(serializedJob('authorize-agent-signing')).not.toContain(
-      'GOODBUDDY_AGENT_SIGNING_KEY_ID'
-    )
-  })
-
-  it('preserves unsigned validation while rejecting arbitrary refs from release jobs', () => {
-    const validation = serializedJob('validate')
-    const authorization = serializedJob(
-      'authorize-agent-signing'
-    )
-
-    expect(validation).toContain('npm test')
-    expect(validation).toContain('npm run typecheck')
-    expect(validation).toContain('npm run lint')
-    expect(validation).toContain('npm run build:bundle')
-    expect(authorization).toContain(
-      "github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'"
-    )
-    expect(authorization).not.toContain(
-      "github.event_name == 'workflow_dispatch' || github.ref_type == 'tag'"
-    )
     expect(serializedJob('package')).toContain(
-      "needs.authorize-agent-signing.outputs.authorized == 'true'"
+      "needs.authorize-release.outputs.authorized == 'true'"
     )
   })
 
-  it('acquires every locked Agent runtime securely on cold runners', () => {
-    const runtimeJob = serializedJob('agent-runtime')
-    const runtimeScripts = jobScripts('agent-runtime')
-    const signingJob = serializedJob('agent-signing')
-    const runtimeUses = jobSteps('agent-runtime')
-      .map((step) => step.uses)
-      .filter((value) => value !== undefined)
-    const runtimeUpload = jobSteps('agent-runtime').find(
-      (step) =>
-        step.uses === 'actions/upload-artifact@v7'
+  it('installs RPM tooling and invokes the explicit native packager', () => {
+    const packageJob = serializedJob('package')
+    const scripts = jobScripts('package')
+    expect(packageJob).toContain('Install RPM packaging tools')
+    expect(packageJob).toContain(
+      "matrix.platform == 'linux'"
     )
-
-    for (const target of Object.values(runtimeLock.node.targets)) {
-      expect(runtimeJob).toContain(
-        new URL(target.archive, runtimeLock.node.source).toString()
-      )
-      expect(runtimeJob).toContain(target.sha256)
-    }
-    expect(runtimeScripts).toContain(
-      "curl --proto '=https' --tlsv1.2"
+    expect(scripts).toContain(
+      'sudo apt-get install --no-install-recommends --yes rpm'
     )
-    expect(runtimeScripts).toContain('--max-filesize 104857600')
-    expect(runtimeScripts).toContain('sha256sum --check --strict -')
-    expect(runtimeUses).toEqual(
-      expect.arrayContaining([
-        'actions/cache/restore@v6',
-        'actions/cache/save@v6'
-      ])
+    expect(scripts).toContain('rpmbuild --version')
+    expect(scripts).toContain(
+      '--platform ${{ matrix.platform }} --arch ${{ matrix.arch }}'
     )
-    expect(runtimeUpload?.with?.name).toBe(
-      'goodbuddy-agent-node-${{ matrix.arch }}'
-    )
-    expect(runtimeJob).toContain(
-      'steps.node-runtime-cache.outputs.cache-hit != \'true\''
-    )
-    expect(runtimeJob).not.toContain('fail-on-cache-miss: true')
-    expect(jobNeeds('agent-signing')).toEqual(
-      expect.arrayContaining(['validate', 'agent-runtime'])
-    )
-    expect(signingJob).toContain('agent-runtime')
   })
 
-  it('passes the endpoint-derived region to every OSS upload', () => {
-    expect(workflow).toContain(
-      'https://oss-cn-beijing.aliyuncs.com'
+  it('publishes only aggregated desktop assets through the existing OSS contract', () => {
+    expect(jobNeeds('release')).toEqual([
+      'authorize-release',
+      'package'
+    ])
+    expect(parsed.jobs.release?.environment?.name).toBe(
+      'aliyun-oss-release'
     )
-    expect(workflow).toContain('goodbuddy) ;;')
-    expect(workflow).toContain(
-      'oss_region="${endpoint_host#oss-}"'
+    const release = serializedJob('release')
+    const scripts = jobScripts('release')
+    expect(release).toContain(
+      'aliyun/configure-aliyun-credentials-action@v1'
     )
-    expect(workflow).toContain(
-      'echo "region=$oss_region" >> "$GITHUB_OUTPUT"'
+    expect(scripts).toContain(
+      'node build/aggregate-release.cjs'
+    )
+    expect(scripts).toContain(
+      'node build/create-site-release.cjs'
+    )
+    expect(scripts).toContain(
+      'node build/verify-site-release.cjs'
+    )
+    expect(scripts).toContain(
+      'oss://${OSS_BUCKET}/releases/${GITHUB_REF_NAME}'
+    )
+    expect(scripts).toContain(
+      'oss://${OSS_BUCKET}/releases/latest.json'
     )
-    expect(
-      [...workflow.matchAll(/--region "\$OSS_REGION"/gu)]
-    ).toHaveLength(2)
   })
 
-  it('allows fully unsigned macOS builds but rejects partial credentials', () => {
-    expect(workflow).toContain('id: macos-signing')
-    expect(workflow).toContain(
-      'if [[ "$configured" -eq 0 ]]; then'
-    )
-    expect(workflow).toContain(
-      'if [[ "$configured" -ne "${#names[@]}" ]]; then'
-    )
-    expect(workflow).toContain(
-      'Build unsigned macOS release packages'
-    )
-    expect(workflow).toContain('--skip-build --unsigned')
-    expect(workflow).toContain(
-      "steps.macos-signing.outputs.enabled == 'true'"
-    )
-    expect(workflow).toContain(
-      "steps.macos-signing.outputs.enabled == 'false'"
-    )
-    expect(workflow).toContain(
-      'Apple signing credentials are not configured'
+  it('retains macOS signed and explicit unsigned release modes', () => {
+    const scripts = jobScripts('package')
+    expect(scripts).toContain('--skip-build --unsigned')
+    expect(serializedJob('package')).toContain(
+      '"CSC_LINK":"${{ runner.temp }}/goodbuddy-developer-id.p12"'
     )
+    expect(scripts).toContain('xcrun stapler validate')
+    expect(scripts).toContain('spctl --assess')
   })
 })