Connect to remote hosts over SSH

[thesiti92]

Stacked PR 3 of 9 for remote reviews (base: remote/2-headless-server-gateway; #934, the rename, is merged). Review in order; each PR builds and passes its suites on its own.

Manual test plan

Purpose. Desktop connects to hosts named by SSH alias: one ssh master per alias, remote attach over it, an ssh -L forward, prompts shown in the window through askpass, and a host manager feeding the gateway. Settings gets a Remote hosts section, and Home labels remote reviews <alias>: <repo>.

Setup. Worktree at origin/remote/3-ssh-hosts. R up a; R install a; R up p --auth password; R install p; R up n; R up nf --no-forwarding; R install nf. Create the remote review on a. Launch with DEV_FAST_REVIEW_SSH_CONFIG.

Steps.

1. Settings → Remote hosts: the SSH alias field suggests wb-test-a, wb-test-p, wb-test-n, wb-test-nf (read from the run's ssh_config).
2. Add wb-test-a → connecting, then online; review.remote.hosts in $H/.../User/settings.json becomes ["wb-test-a"].
3. Home lists Remote-order labelled wb-test-a: wbrepo.
4. Open it: the prose, the code peek, the Diff view and the structural diff load. Share, Trace, Open file and Source tree are absent.
5. edit wb-test-a $ID "Edited on the remote." → appears without a reload.
6. S wb-test-a 'bash -s -- Pushed' < /tmp/wb-push.sh → a "Pushed" tab opens, labelled as the host's.
7. pkill -f -- ' -M -N .*-- wb-test-a$' (Desktop's master) → the open review shows Connection lost…, then recovers in the same page; the row returns to online.
8. R pause a → offline within about 15 s; the review rows read unavailable and opening one says why; a laptop review still opens at once. R resume a → online.
9. Add wb-test-p → a quick input titled SSH: wb-test-p shows ssh's password prompt; enter cat /tmp/wbt.$WB_TEST_RUN/password → online.
10. Remove wb-test-a → its reviews leave Home; R ssh a -- ls ~/.dev/review-api.db → still there.

Negative checks.

• Alias -oProxyCommand=touch /tmp/x → refused (… starts with -.); the setting is unchanged and /tmp/x does not exist.
• wb-test-p, press Esc at the prompt → auth-failed; no retry by itself; Retry prompts again.
• wb-test-n (no package) → not-installed, showing npm install -g @dev.fast/whiteboard@0.2.0.
• wb-test-nf → unreachable, detail quoting OpenSSH's administratively prohibited.
• R install a --version 0.0.2-e2e; R ssh a -- whiteboard server stop → incompatible with the install command; rows read incompatible. R install a; R ssh a -- whiteboard server stop → online within about 10 s.
• DevTools (Help → Toggle Developer Tools → Network): every request goes to $URL; none carries the remote's token (R ssh a -- whiteboard remote attach --json).
• SSH command and askpass edge cases: covered by code-oss/src/vs/review/electron-main/remote/reviewSsh*.test.ts, reviewRemoteHost*.test.ts; journey remote-host.

Cleanup. Common cleanup.

Common setup for all plans

Common setup (read once)

• Test each PR in a worktree at its head branch: git -C <core> worktree add --detach ../review-prN origin/<head>, then pnpm install there. Run everything below from that worktree root.
• Helpers (bash or zsh):

R() { node apps/review-desktop/scripts/e2e/remote/remote.mjs "$@"; }
export WB_TEST_RUN=manual-$$                  # before the first `R up`
S() { ssh -F /tmp/wbt.$WB_TEST_RUN/ssh_config "$@"; }   # host aliases are wb-test-<name>
H=/tmp/wb-home-$WB_TEST_RUN                   # isolated Desktop home
mkdir -p $H/review-desktop/state/user-data/User
echo '{"review.experimental.remoteHosts.enabled": true}' > $H/review-desktop/state/user-data/User/settings.json
awk '/createRemoteReview = String.raw`/{f=1;next} /^`;/{f=0} f' apps/review-desktop/scripts/e2e/journeys/remote-host.mjs > /tmp/wb-review.sh
sed -e 's/open\\":false/open\\":true/' -e 's/wbrepo/wbrepo2/g' /tmp/wb-review.sh > /tmp/wb-push.sh
edit() { printf '{"sessionId":"%s","edit":{"type":"insert","content":{"type":"markdown","markdown":"%s"}}}' "$2" "$3" | S "$1" 'whiteboard api session_edit -'; }

• Launch (dev build only; a packaged build ignores both env vars): DEV_REVIEW_HOME=$H DEV_FAST_REVIEW_SSH_CONFIG=/tmp/wbt.$WB_TEST_RUN/ssh_config pnpm dev (prefix DEV_FAST_REVIEW_DESKTOP_BACKGROUND=1 to keep it from taking focus).
• Desktop API: D=$(ls $H/review-desktop/instances/dev-*.json); URL=$(node -p "require('$D').url"); TOK=$(node -p "require('$D').token"); api() { curl -s -H "x-review-token: $TOK" "$URL$1"; }
• A remote review: ID=$(S wb-test-a 'bash -s -- Remote-order' < /tmp/wb-review.sh | head -1) (repo ~/wbrepo, review "Remote-order" with a prose line and a code peek of f.ts). /tmp/wb-push.sh is the same with open: true in ~/wbrepo2.
• Settings: ⌘, → region Remote hosts → type the alias in SSH alias → Add.
• Fork unit tests: (cd apps/review-desktop && TSX_TSCONFIG_PATH=tsconfig.test.json node --import tsx --test --test-force-exit <files>). Package tests: pnpm --filter @dev.fast/whiteboard test <files>.
• Journeys: stage a runtime per apps/review-desktop/scripts/e2e/TESTING.md ("Staging the runtime"), then node apps/review-desktop/scripts/e2e/run.mjs --runtime "$REVIEW_E2E_RUNTIME" --journey <name>.
• The harness has pause/resume (there is no unpause).
• Cleanup, every plan: quit Desktop first (its ssh masters count as leftovers), then R down --all; R verify-clean; rm -rf $H /tmp/wb-*.sh. Without an aws sso login session verify-clean also prints AWS could not be checked and exits 1; no other line may appear.