[bobleer]

Summary

Remote HTML previews currently wait for each 256 KiB chunk before requesting the next, and reload every resource body. Pipeline bounded reads and retain short-lived, owner-revalidated resource bytes so SSH workspaces and Desktop/CLI Peer Device previews load sooner while preserving workspace confinement and explicit offline errors.

Type and Areas

Type: performance improvement / bug fix

Areas: shared remote resource transfer service, Desktop HTML gateway, SSH/SFTP and encrypted Relay integration fixtures, CI

Motivation / Impact

• Share one controller-side transfer service across SSH and encrypted peer readers. Read up to four ordered chunks ahead, with eight active resources and eight remote reads per preview. Dropping a response or closing the preview cancels pending work.
• Coalesce duplicate resource requests and retain query parameters in cache keys so versioned URLs invalidate independently. Queries never enter filesystem paths. Cache only complete, validated resources: at most 16 MiB / 64 entries per preview, with a 4 MiB per-resource limit. Every hit revalidates the owner, resolved path, revision, size and MIME type; forbidden, changed or offline owners cannot fall back to cached/controller-local bytes.
• Expire entries five seconds after insertion without extending the deadline on hits. This bounds reuse with coarse SFTP timestamps; explicit browser reload directives force content reads. HTTP responses remain no-store.
• Reuse the final no-follow metadata lookup instead of repeating the same SFTP stat. Path checks, chunk version checks, the 64 MiB file limit and authorization cookies remain enforced.
• Add the focused transfer/cache suite to the existing three-platform workspace-provider CI step.

Measurements

Three runs per case, approximately 2.72 MiB total: HTML, 96 KiB CSS, 2 MiB JavaScript, 512 KiB image and 128 KiB font. HTML completes before up to six concurrent asset requests. Every returned byte is checked. The baseline was also measured with the original provider/gateway source from b4533049a; the committed experiment retains the prior serial chunk algorithm for reproducible comparisons.

Transport	Original median	Prefetched cold median	Revalidated warm median
Real loopback SSH + OpenSSH SFTP, 40 ms added to each reply	11,066 ms	4,745 ms	835 ms
Encrypted loopback Relay peer, 40 ms added per resource RPC	1,548 ms	1,252 ms	91 ms

SSH samples: original [11057, 11066, 11185], cold [4787, 4745, 4707], warm [835, 841, 824] ms. Peer HTTP samples: original [1548, 1627, 1521], cold [1227, 1285, 1252], warm [91, 91, 91] ms.

These measure resource completion with controlled latency, excluding browser rendering and preview bootstrap. They are not measurements of a physical two-machine deployment. The fixtures preserve pipelined SFTP responses and concurrent peer dispatch; timing ratios are deliberately not CI assertions.

Verification

Passed locally:

• cargo test --locked -p openbitfun-services-integrations --no-default-features --features remote-connect --lib remote_connect::html_preview — 18 tests covering ordering, read/memory bounds, coalescing, revisions, expiration, explicit refresh, cancellation, account changes and owner path policy.
• cargo test --locked -p openbitfun-services-integrations --no-default-features --features remote-ssh-concrete --lib remote_ssh::manager::tests::workspace_sftp:: — 10 passed, 4 opt-in/diagnostic tests ignored.
• OPENBITFUN_TEST_SFTP_SERVER=/usr/libexec/sftp-server cargo test --locked -p openbitfun-services-integrations --no-default-features --features remote-connect,remote-ssh-concrete --lib openssh_html_preview_reads_nested_site_resources -- --ignored — real SSH/SFTP resource test passed.
• cargo test --locked -p openbitfun-desktop --lib html_preview — 10 passed, 1 opt-in benchmark ignored, including authenticated HTTP and encrypted peer resource transfer.
• Both opt-in loading benchmarks above passed; reproduction commands are in the owning guides.
• pnpm run fmt:rs, pnpm run check:github-config, pnpm run check:core-boundaries, pnpm run check:repo-hygiene, git diff --check, and the Git object-size check passed. GitHub config tests: 54 passed, 1 PowerShell-dependent test skipped locally.

Also passed pnpm run build:web, cargo build --locked -p openbitfun-desktop, and node tests/e2e/scripts/run-html-preview.mjs on macOS. The isolated native browser verified CSS, module scripts, dynamic imports, images, encoded paths and reloading one preview after opening another.

All 14 checks passed on final head bc00e53cf7ee0ac9ecbbeadc688ebda5559c7b7c, including three-platform CLI and Rust checks, frontend, Linux x64/ARM64 builds and installer validation, and aggregate validation: CI run 40645890814.

Reviewer Notes

AI-assisted change; focused automated and loopback protocol tests passed. SSH remote workspaces and Peer Device transport are exercised separately. Mobile/IM Remote Control and Detached Dispatch are not changed or exercised. No persisted format, command registration or wire DTO changed: existing workspace_html_preview_v1 peers continue to work. Cache scope is one controller preview; there is no disk cache or cross-account/device cache.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.