feat(desktop): onboard experimental direct peer hosts

.github/workflows/release-windows-check.yml

@@ -32,7 +32,12 @@ on:
     paths:
       - 'apps/desktop/electron-builder.config.mjs'
       - 'apps/desktop/package.json'
+      - 'native/runtime-host-peer/**'
+      - 'packages/cli/RUNTIME_HOST_PEER_DEPENDENCIES.rust.tsv'
+      - 'packages/cli/RUNTIME_HOST_PEER_THIRD_PARTY_NOTICES.txt'
       - 'scripts/package-windows-x64.mjs'
+      - 'scripts/generate-runtime-host-peer-dependencies.mjs'
+      - 'scripts/generate-runtime-host-peer-notices.mjs'
       - 'scripts/verify-windows-x64.mjs'
       - 'scripts/verify-windows-sandbox-e2e.mjs'
       - 'scripts/verify-windows-installer-lifecycle.mjs'
@@ -119,6 +124,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Update stable Rust for Desktop native artifacts
+        run: rustup update stable --no-self-update
+
       - name: Package the Windows installer and ZIP
         run: npm run package:windows-x64
 

.github/workflows/release.yml

@@ -137,6 +137,9 @@ jobs:
       - name: Audit shipped desktop closure
         run: node scripts/audit-shipped-dependencies.mjs
 
+      - name: Update stable Rust for Desktop native artifacts
+        run: rustup update stable --no-self-update
+
       - name: Write App Store Connect API key
         if: matrix.platform == 'macos'
         env:

apps/desktop/electron-builder.config.mjs

@@ -89,6 +89,14 @@ export default {
       from: 'resources/workers/filesystem-worker.js',
       to: 'workers/filesystem-worker.js',
     },
+    {
+      from: '../../native/runtime-host-peer/target/release/maka_runtime_host_peer.node',
+      to: 'runtime-host-peer/maka_runtime_host_peer.node',
+    },
+    {
+      from: '../../packages/cli/RUNTIME_HOST_PEER_THIRD_PARTY_NOTICES.txt',
+      to: 'licenses/runtime-host-peer/THIRD_PARTY_NOTICES.txt',
+    },
     ...(process.platform === 'win32'
       ? [
           {

apps/desktop/src/main/__tests__/runtime-host-management.test.ts

@@ -20,6 +20,7 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import {
+  RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
   runtimeHostAccessCredentialFingerprint,
   type RuntimeHostServiceManagementFrame,
 } from '@maka/runtime-host/operator';
@@ -73,6 +74,7 @@ test('identifies, rotates, and revokes managed credentials without exposing secr
       removeHandler: (channel) => handlers.delete(channel),
     },
     profiles: {
+      ...unusedDirectPeerProfileDependencies(),
       resolveManagedService: async () => ({ profile, service, state: 'active' as const }),
       resolveManagedAccess: async () => ({
         profile,
@@ -215,6 +217,7 @@ test('manages only the service identity bound by Desktop onboarding', async () =
       removeHandler: (channel) => handlers.delete(channel),
     },
     profiles: {
+      ...unusedDirectPeerProfileDependencies(),
       resolveManagedService: async (profileId) =>
         profileId === managedProfile.id
           ? { profile: managedProfile, service: managedService, state: 'active' as const }
@@ -361,6 +364,7 @@ test('publishes update progress and waits for the managed profile to reconnect',
       removeHandler: (channel) => handlers.delete(channel),
     },
     profiles: {
+      ...unusedDirectPeerProfileDependencies(),
       resolveManagedService: async () =>
         bindingPresent ? { profile, service, state: 'active' as const } : undefined,
       resolveManagedAccess: async () => undefined,
@@ -370,6 +374,8 @@ test('publishes update progress and waits for the managed profile to reconnect',
       clearManagedServiceBinding: async () => undefined,
     },
     runServiceManagement: async () => assert.fail('ordinary management is not expected'),
+    runPeerManagement: async () => assert.fail('direct peer management is not expected'),
+    directPeerClientAvailable: false,
     runUpdate: async (input, onProgress) => {
       updates.push(input);
       onProgress('staging');
@@ -481,6 +487,7 @@ test('configures Project roots with CAS and reconnects only after a committed cu
       removeHandler: (channel) => handlers.delete(channel),
     },
     profiles: {
+      ...unusedDirectPeerProfileDependencies(),
       resolveManagedService: async () => ({ profile, service, state: 'active' as const }),
       resolveManagedAccess: async () => undefined,
       rotateManagedCredential: async () => assert.fail('credential rotation is not expected'),
@@ -588,6 +595,7 @@ test('manages one Host update policy and reconciles it through the bound operato
       removeHandler: (channel) => handlers.delete(channel),
     },
     profiles: {
+      ...unusedDirectPeerProfileDependencies(),
       resolveManagedService: async () => ({ profile, service, state: 'active' as const }),
       resolveManagedAccess: async () => undefined,
       rotateManagedCredential: async () => assert.fail('credential rotation is not expected'),
@@ -733,6 +741,7 @@ test('resumes deployment cleanup without invoking the removed operator', async (
       removeHandler: (channel) => handlers.delete(channel),
     },
     profiles: {
+      ...unusedDirectPeerProfileDependencies(),
       resolveManagedService: async () => ({ profile, service, state }),
       resolveManagedAccess: async () => undefined,
       markManagedServiceUninstalling: async (binding) => {
@@ -785,6 +794,7 @@ test('rechecks uninstall intent before retrying the remote service', async () =>
       removeHandler: (channel) => handlers.delete(channel),
     },
     profiles: {
+      ...unusedDirectPeerProfileDependencies(),
       resolveManagedService: async () => ({
         profile: {
           id: 'office',
@@ -834,6 +844,235 @@ test('rechecks uninstall intent before retrying the remote service', async () =>
   assert.equal(marked, true);
 });
 
+test('keeps the SSH profile while adding and removing its managed Direct peer', async () => {
+  const handlers = new Map<string, (...args: unknown[]) => unknown>();
+  const profile = {
+    id: 'office',
+    name: 'Office',
+    kind: 'remote' as const,
+    rootId: 'a'.repeat(64),
+    transport: {
+      kind: 'ssh' as const,
+      destination: 'operator@example.com',
+      remotePort: 7443,
+      websocketPath: '/runtime-host',
+    },
+  };
+  const service = {
+    id: 'b'.repeat(64),
+    rootPath: '/srv/maka',
+    operatorPath: '/home/operator/.local/share/maka/operator',
+  };
+  let peerProfileExists = false;
+  const actions: string[] = [];
+
+  createDesktopRuntimeHostManagement({
+    ...unusedUpdateDependencies(),
+    ipcMain: {
+      handle: (channel, handler) => handlers.set(channel, handler as (...args: unknown[]) => unknown),
+      removeHandler: (channel) => handlers.delete(channel),
+    },
+    profiles: {
+      ...unusedDirectPeerProfileDependencies(),
+      resolveManagedService: async () => ({ profile, service, state: 'active' as const }),
+      resolveManagedAccess: async () => undefined,
+      rotateManagedCredential: async () => assert.fail('credential rotation is not expected'),
+      markManagedServiceUninstalling: async (binding) => binding,
+      markManagedServiceCleanupPending: async (binding) => binding,
+      clearManagedServiceBinding: async () => undefined,
+      resolveManagedDirectPeerProfile: async () => ({
+        exists: peerProfileExists,
+        enabled: false,
+      }),
+      upsertManagedDirectPeerProfile: async (_profileId, descriptor) => {
+        assert.deepEqual(descriptor.routeHints, ['/ip4/192.0.2.8/udp/44001/quic-v1']);
+        peerProfileExists = true;
+      },
+      removeManagedDirectPeerProfile: async () => {
+        peerProfileExists = false;
+      },
+    },
+    directPeerClientAvailable: true,
+    runServiceManagement: async (input) => {
+      assert.equal(input.action, 'status');
+      assert.equal(
+        input.capabilityRequest,
+        RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
+      );
+      return {
+        ...serviceResult('status'),
+        operatorCapabilities: [RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY],
+      };
+    },
+    runAccessManagement: async () => assert.fail('access management is not expected'),
+    runPeerManagement: async (input) => {
+      actions.push(input.action);
+      return {
+        kind: 'result',
+        action: input.action,
+        status: input.action === 'disable'
+          ? {
+              state: 'not_configured',
+              serviceState: 'running',
+              routeHints: [],
+              coordinationRelays: [],
+            }
+          : {
+              state: 'enabled',
+              serviceState: 'running',
+              peerId: '12D3KooWpeer',
+              rootId: profile.rootId,
+              routeHints: ['/ip4/192.0.2.8/udp/44001/quic-v1'],
+              coordinationRelays: [],
+            },
+      };
+    },
+    cleanupManagedDeployment: async () => assert.fail('cleanup is not expected'),
+  });
+
+  const configure = handlers.get('runtime-host-management:configure-direct-peer');
+  assert.ok(configure);
+  const enabled = await configure({}, profile.id, true, []);
+  assert.equal((enabled as { profilePresent: boolean }).profilePresent, true);
+  const disabled = await configure({}, profile.id, false, []);
+  assert.equal((disabled as { profilePresent: boolean }).profilePresent, false);
+  assert.deepEqual(actions, ['enable', 'disable']);
+});
+
+test('disables a newly enabled listener when its Desktop profile cannot be committed', async () => {
+  for (const failure of ['descriptor', 'persistence'] as const) {
+    const handlers = new Map<string, (...args: unknown[]) => unknown>();
+    const actions: string[] = [];
+    createDesktopRuntimeHostManagement({
+      ...unusedUpdateDependencies(),
+      ipcMain: {
+        handle: (channel, handler) => handlers.set(channel, handler as (...args: unknown[]) => unknown),
+        removeHandler: (channel) => handlers.delete(channel),
+      },
+      profiles: {
+        ...unusedDirectPeerProfileDependencies(),
+        resolveManagedService: async () => managedSshBinding(),
+        resolveManagedAccess: async () => undefined,
+        rotateManagedCredential: async () => assert.fail('credential rotation is not expected'),
+        markManagedServiceUninstalling: async (binding) => binding,
+        markManagedServiceCleanupPending: async (binding) => binding,
+        clearManagedServiceBinding: async () => undefined,
+        resolveManagedDirectPeerProfile: async () => ({ exists: false, enabled: false }),
+        upsertManagedDirectPeerProfile: async () => {
+          if (failure === 'persistence') throw new Error('profile store failed');
+        },
+        removeManagedDirectPeerProfile: async () => undefined,
+      },
+      directPeerClientAvailable: true,
+      runServiceManagement: async () => ({
+        ...serviceResult('status'),
+        operatorCapabilities: [RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY],
+      }),
+      runAccessManagement: async () => assert.fail('access management is not expected'),
+      runPeerManagement: async (input) => {
+        actions.push(input.action);
+        return {
+          kind: 'result',
+          action: input.action,
+          status: input.action === 'disable'
+            ? {
+                state: 'disabled',
+                serviceState: 'running',
+                peerId: '12D3KooWpeer',
+                rootId: 'a'.repeat(64),
+                routeHints: [],
+                coordinationRelays: [],
+              }
+            : {
+                state: 'enabled',
+                serviceState: 'running',
+                peerId: '12D3KooWpeer',
+                rootId: 'a'.repeat(64),
+                routeHints: failure === 'descriptor' ? [] : ['/ip4/192.0.2.8/udp/44001/quic-v1'],
+                coordinationRelays: [],
+              },
+        };
+      },
+      cleanupManagedDeployment: async () => assert.fail('cleanup is not expected'),
+    });
+
+    const configure = handlers.get('runtime-host-management:configure-direct-peer');
+    assert.ok(configure);
+    await assert.rejects(
+      configure({}, 'office', true, []) as Promise<unknown>,
+      failure === 'descriptor' ? /usable direct-peer descriptor/u : /profile store failed/u,
+    );
+    assert.deepEqual(actions, ['enable', 'disable']);
+  }
+});
+
+test('does not invoke peer management when the remote operator lacks its capability', async () => {
+  const handlers = new Map<string, (...args: unknown[]) => unknown>();
+  createDesktopRuntimeHostManagement({
+    ...unusedUpdateDependencies(),
+    ipcMain: {
+      handle: (channel, handler) => handlers.set(channel, handler as (...args: unknown[]) => unknown),
+      removeHandler: (channel) => handlers.delete(channel),
+    },
+    profiles: {
+      ...unusedDirectPeerProfileDependencies(),
+      resolveManagedService: async () => managedSshBinding(),
+      resolveManagedAccess: async () => undefined,
+      rotateManagedCredential: async () => assert.fail('credential rotation is not expected'),
+      markManagedServiceUninstalling: async (binding) => binding,
+      markManagedServiceCleanupPending: async (binding) => binding,
+      clearManagedServiceBinding: async () => undefined,
+      resolveManagedDirectPeerProfile: async () => ({ exists: false, enabled: false }),
+    },
+    directPeerClientAvailable: true,
+    runServiceManagement: async () => serviceResult('status'),
+    runAccessManagement: async () => assert.fail('access management is not expected'),
+    runPeerManagement: async () => assert.fail('peer management is not expected'),
+    cleanupManagedDeployment: async () => assert.fail('cleanup is not expected'),
+  });
+
+  const get = handlers.get('runtime-host-management:get-direct-peer');
+  const configure = handlers.get('runtime-host-management:configure-direct-peer');
+  assert.ok(get);
+  assert.ok(configure);
+  assert.deepEqual(await get({}, 'office'), {
+    state: 'unsupported',
+    routeHints: [],
+    coordinationRelays: [],
+    profilePresent: false,
+    profileEnabled: false,
+    clientAvailable: true,
+    managementAvailable: false,
+  });
+  await assert.rejects(
+    configure({}, 'office', true, []) as Promise<unknown>,
+    /Update this Runtime Host/u,
+  );
+});
+
+function managedSshBinding() {
+  return {
+    profile: {
+      id: 'office',
+      name: 'Office',
+      kind: 'remote' as const,
+      rootId: 'a'.repeat(64),
+      transport: {
+        kind: 'ssh' as const,
+        destination: 'operator@example.com',
+        remotePort: 7443,
+        websocketPath: '/runtime-host',
+      },
+    },
+    service: {
+      id: 'b'.repeat(64),
+      rootPath: '/srv/maka',
+      operatorPath: '/home/operator/.local/share/maka/operator',
+    },
+    state: 'active' as const,
+  };
+}
+
 function serviceResult(
   action: DesktopRuntimeHostSshManagementInput['action'],
   operatorAccess = false,
@@ -884,13 +1123,27 @@ function unusedUpdateDependencies() {
     runUpdatePolicy: async (): Promise<never> => assert.fail('update policy is not expected'),
     runUpdateReconciliation: async (): Promise<never> =>
       assert.fail('update reconciliation is not expected'),
+    runPeerManagement: async (): Promise<never> =>
+      assert.fail('direct peer management is not expected'),
+    directPeerClientAvailable: false,
     resolveUpdatePackage: () => ({ kind: 'npm', specifier: 'maka-agent@1.2.3' } as const),
     currentHostEpoch: () => undefined,
     awaitUpdatedConnection: async () => undefined,
     sendProgress: () => undefined,
   };
 }
 
+function unusedDirectPeerProfileDependencies() {
+  return {
+    resolveManagedDirectPeerProfile: async (): Promise<never> =>
+      assert.fail('direct peer profile inspection is not expected'),
+    upsertManagedDirectPeerProfile: async (): Promise<never> =>
+      assert.fail('direct peer profile creation is not expected'),
+    removeManagedDirectPeerProfile: async (): Promise<never> =>
+      assert.fail('direct peer profile removal is not expected'),
+  };
+}
+
 function accessCredential(
   credentialId: string,
   principalId: string,