feat(desktop): manage remote runtime host services - #3282
Open
M4n5ter wants to merge 6 commits into
Open
Conversation
Astro-Han
added a commit
that referenced
this pull request
Aug 20, 2026
Branch protection landed in .asf.yaml (#3262) and now requires an approving review and a passing `test` check on every pull request to main, with stale approvals dismissed on each new commit. Every open pull request based on main reports reviewDecision REVIEW_REQUIRED; #3282, based on a feature branch, reports nothing. That leaves the fast path with nothing to exempt. CONTRIBUTING defined it as merging without independent human review, which a committer can no longer do. Redefining it as "the baseline alone" does not rescue it: the extra scrutiny in this section applies only to protected areas, and not touching a protected area was already a fast-path precondition, so the two scopes never overlap. A named fast path would exempt nothing while adding a comment obligation, and the maintainer sign-off it claimed to skip was never written down anywhere. State the rule directly instead. The section gives the baseline every pull request clears, says what material changes need beyond it, and closes with "for everything else the baseline is enough" — which answers which changes take the light route without keeping a concept that no longer carries content. The merge-time comment goes with it: it existed to leave a trace for merges that had no approval, and every merge now has one. Two corrections in the same section. The baseline says branch protection enforces the mechanics and that independent human judgment is policy GitHub cannot verify, because an approval from someone other than the author is not by itself proof of an independent human. The Chinese text is realigned so 重大 distributes across the whole protected list, matching the English, instead of modifying only the first item. The public-decision rule moves from future to present tense. dev@maka.apache.org exists and carries active threads, so project-level decisions belong there now rather than "once an ASF development list is available". .coderabbit.yaml and .github/skills/code-review/SKILL.md told automated reviewers not to make a fast-path determination. With the concept gone, both now say only that automated review is not authorization to merge. Their neighbouring lines about independent human review remain accurate and are left alone. Generated-by: Claude Code
6 tasks
Astro-Han
added a commit
that referenced
this pull request
Aug 20, 2026
Branch protection landed in .asf.yaml (#3262) and now requires an approving review and a passing `test` check on every pull request to main, with stale approvals dismissed on each new commit. Every open pull request based on main reports reviewDecision REVIEW_REQUIRED; #3282, based on a feature branch, reports nothing. That leaves the fast path with nothing to exempt. CONTRIBUTING defined it as merging without independent human review, which a committer can no longer do. Redefining it as "the baseline alone" does not rescue it: the extra scrutiny in this section applies only to protected areas, and not touching a protected area was already a fast-path precondition, so the two scopes never overlap. A named fast path would exempt nothing while adding a comment obligation, and the maintainer sign-off it claimed to skip was never written down anywhere. State the rule directly instead. The section gives the baseline every pull request clears, names a maintainer as the one who decides whether a change is material and whether the review it received is enough, and closes with "for everything else the baseline is enough" — which answers which changes take the light route without keeping a concept that no longer carries content. Naming the classifier keeps what the old "a maintainer makes the final determination" actually did: settle whether a change needs more than the mechanics. The merge-time comment does not survive; it existed to leave a trace for merges that had no approval, and every merge now has one. Two corrections in the same section. The baseline says branch protection enforces the mechanics and that independent human judgment is policy GitHub cannot verify, because an approval from someone other than the author is not by itself proof of an independent human. The Chinese text is realigned so 重大 distributes across the whole protected list, matching the English, instead of modifying only the first item. The public-decision rule moves from future to present tense. dev@maka.apache.org exists and carries active threads, so project-level decisions belong there now rather than "once an ASF development list is available". .coderabbit.yaml and .github/skills/code-review/SKILL.md told automated reviewers not to make a fast-path determination. With the concept gone, both now say only that automated review is not authorization to merge. Their neighbouring lines about independent human review remain accurate and are left alone. Generated-by: Claude Code
M4n5ter
pushed a commit
that referenced
this pull request
Aug 20, 2026
Branch protection landed in .asf.yaml (#3262) and now requires an approving review and a passing `test` check on every pull request to main, with stale approvals dismissed on each new commit. Every open pull request based on main reports reviewDecision REVIEW_REQUIRED; #3282, based on a feature branch, reports nothing. That leaves the fast path with nothing to exempt. CONTRIBUTING defined it as merging without independent human review, which a committer can no longer do. Redefining it as "the baseline alone" does not rescue it: the extra scrutiny in this section applies only to protected areas, and not touching a protected area was already a fast-path precondition, so the two scopes never overlap. A named fast path would exempt nothing while adding a comment obligation, and the maintainer sign-off it claimed to skip was never written down anywhere. State the rule directly instead. The section gives the baseline every pull request clears, names a maintainer as the one who decides whether a change is material and whether the review it received is enough, and closes with "for everything else the baseline is enough" — which answers which changes take the light route without keeping a concept that no longer carries content. Naming the classifier keeps what the old "a maintainer makes the final determination" actually did: settle whether a change needs more than the mechanics. The merge-time comment does not survive; it existed to leave a trace for merges that had no approval, and every merge now has one. Two corrections in the same section. The baseline says branch protection enforces the mechanics and that independent human judgment is policy GitHub cannot verify, because an approval from someone other than the author is not by itself proof of an independent human. The Chinese text is realigned so 重大 distributes across the whole protected list, matching the English, instead of modifying only the first item. The public-decision rule moves from future to present tense. dev@maka.apache.org exists and carries active threads, so project-level decisions belong there now rather than "once an ASF development list is available". .coderabbit.yaml and .github/skills/code-review/SKILL.md told automated reviewers not to make a fast-path determination. With the concept gone, both now say only that automated review is not authorization to merge. Their neighbouring lines about independent human review remain accurate and are left alone. Generated-by: Claude Code
M4n5ter
force-pushed
the
feat/desktop-managed-remote-onboarding
branch
from
August 20, 2026 09:42
32fa336 to
3f403af
Compare
This was referenced Aug 20, 2026
M4n5ter
force-pushed
the
feat/desktop-managed-remote-onboarding
branch
3 times, most recently
from
August 21, 2026 02:23
6cc6cd1 to
25bea91
Compare
Base automatically changed from
feat/desktop-managed-remote-onboarding
to
main
August 21, 2026 06:09
M4n5ter
force-pushed
the
feat/desktop-runtime-host-management
branch
from
August 21, 2026 08:06
8c188ca to
50a4915
Compare
M4n5ter
marked this pull request as ready for review
August 21, 2026 08:07
16 tasks
Member
Author
Add an SSH-backed management surface for installed remote Runtime Host services so Desktop can inspect status and logs, recover or restart the service, and uninstall it without conflating service lifecycle with Profile or State Root ownership. Keep direct connection Profiles usable without claiming a management channel, and use a bounded framed CLI result so machine output cannot expose launch configuration. Generated-by: Codex
Bind repair and management to the exact service and State Root identity established during onboarding, and reject requests when that identity drifts. Close SSH admission during shutdown and remove duplicate management state, IPC, and version derivation. Generated-by: Codex
Route ongoing management through the installed Host operator, keep management metadata outside the shared connection profile schema, and make repair and uninstall recoverable across version and process boundaries. Generated-by: Codex
Bind the installed operator to its original Client Data Root and give it a self-contained cleanup phase so interrupted uninstalls remain recoverable. Correlate management responses with requested actions and remove duplicate recovery and action representations. Generated-by: Codex
Record the POSIX-only managed operator integration test added by the service hardening change so the checked Windows test inventory matches the suite.\n\nGenerated-by: Codex
Position the Runtime Host log view at its newest entry after every successful refresh so operators see the current service state immediately.\n\nGenerated-by: Codex
M4n5ter
force-pushed
the
feat/desktop-runtime-host-management
branch
from
August 21, 2026 10:20
5b8652b to
1626713
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
English
Summary
Add a per-computer management surface for SSH-managed Runtime Hosts. Desktop can inspect service status and bounded recent logs, start or restart the service, repair its managed installation, and uninstall the Maka-managed service while preserving both the State Root and Desktop Profile.
Onboarding now binds each managed Profile to the exact managed service and State Root. Every repair or management action revalidates that binding before mutation, so manual connection Profiles cannot manage an unrelated service and SSH destination drift fails closed. The SSH management channel also closes admission before Desktop shutdown.
Direct connection Profiles remain usable without claiming a service-management channel. Runtime Host protocol clients still cannot upgrade or terminate the service; these explicit management actions run through the separately authenticated SSH operator channel.
Depends on #3236
Fixes #3281
Verification
npm run lintnpm run format:checknpm run typechecknpx knip --workspace apps/desktopAI use
Select exactly one:
Tool(s) and scope: OpenAI Codex implemented the change and assisted with tests, validation, and PR wording under maintainer direction and review.
Checklist
Does this PR entail a change in behavior?
中文
概要
为通过 SSH 管理的 Runtime Host 增加 per-computer 管理界面。Desktop 可以查看服务状态和有界的近期日志，启动或重启服务，修复其托管安装，以及在保留 State Root 和 Desktop Profile 的前提下卸载 Maka 管理的服务。
Onboarding 现在会把每个 managed Profile 绑定到精确的 managed service 与 State Root。每次修复或管理操作都会在执行变更前重新验证该绑定，因此手工 connection Profile 无法管理无关服务，SSH 目标漂移也会 fail closed。Desktop shutdown 前还会先关闭 SSH 管理操作的 admission。
Direct connection Profile 仍可正常使用，但不会被描述为具备服务管理通道。Runtime Host protocol Client 仍不能升级或终止服务；这些显式管理操作经由单独认证的 SSH operator channel 执行。
依赖 #3236
修复 #3281
验证
npm run lintnpm run format:checknpm run typechecknpx knip --workspace apps/desktopAI 使用
仅选择一项：
工具与范围：OpenAI Codex 在维护者指导与审核下实施变更，并协助测试、验证和 PR 措辞。
检查清单
这个 PR 是否包含行为变更？
Product walkthrough / 功能演示
▶ Watch the complete management flow / 查看完整管理流程（MP4，45 秒）