Install Whiteboard on a host from Settings and connect its agents

.github/workflows/review-desktop-preview.yml

@@ -101,14 +101,16 @@ jobs:
             exit 1
           fi
 
-  npm:
-    name: Publish npm package
+  remote:
+    name: Publish remote tarballs and npm package
     needs: version
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 60
     permissions:
       contents: read
       id-token: write
+    outputs:
+      whiteboard_remote: ${{ steps.remote.outputs.whiteboard_remote }}
     env:
       VERSION: ${{ needs.version.outputs.version }}
       COMMIT: ${{ needs.version.outputs.commit }}
@@ -175,11 +177,52 @@ jobs:
           key: ${{ runner.os }}-code-oss-deps-v3-${{ steps.code-oss-inputs.outputs.digest }}
           restore-keys: |
             ${{ runner.os }}-code-oss-deps-v3-
-      - name: Build the VS Code server
+      - name: Check for published remote tarballs
+        if: ${{ !inputs.dry_run }}
+        id: existing
+        run: |
+          mkdir -p remote-artifacts
+          FOUND=0
+          for t in linux-x64 linux-arm64; do
+            NAME="whiteboard-remote-${VERSION}-${t}.tar.xz.sha256"
+            STATUS=$(curl -sS --retry 3 --retry-all-errors -o "remote-artifacts/$NAME" -w '%{http_code}' "https://install.dev.fast/releases/${VERSION}/remote/$NAME")
+            case "$STATUS" in
+              200) FOUND=$((FOUND + 1)) ;;
+              404) rm -f "remote-artifacts/$NAME" ;;
+              *) echo "::error::${NAME} answered ${STATUS}" >&2; exit 1 ;;
+            esac
+          done
+          if [ "$FOUND" = 1 ]; then
+            echo "::error::Only one remote tarball for ${VERSION} is published; fix releases/${VERSION}/remote/ on R2 by hand." >&2
+            exit 1
+          fi
+          echo "published=$([ "$FOUND" = 2 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+      - name: Build the remote tarballs
+        if: ${{ steps.existing.outputs.published != 'true' }}
         run: |
           source apps/review-desktop/scripts/code-oss-dependencies.sh
           ensure_code_oss_dependencies "$PWD/apps/review-desktop" "$PWD/apps/review-desktop/code-oss"
-          BUILD_SOURCEVERSION="$COMMIT" node apps/review-desktop/scripts/build-remote-runtime.mjs
+          for t in linux-x64 linux-arm64; do
+            node apps/review-desktop/scripts/build-remote-tarball.mjs --target "$t" --out remote-artifacts --version "$VERSION" --commit "$COMMIT"
+          done
+      # Payloads before the pin: no Desktop build may pin a tarball R2 lacks.
+      - name: Upload the remote tarballs to R2
+        if: ${{ !inputs.dry_run && steps.existing.outputs.published != 'true' }}
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          AWS_ENDPOINT_URL: ${{ vars.R2_ENDPOINT_URL }}
+          AWS_REGION: auto
+          R2_BUCKET: ${{ vars.R2_RELEASE_BUCKET }}
+        run: |
+          PREFIX="s3://${R2_BUCKET}/releases/${VERSION}/remote/"
+          aws s3 cp remote-artifacts/ "$PREFIX" --recursive --exclude "*" --include "*.tar.xz" --content-type application/x-xz
+          aws s3 cp remote-artifacts/ "$PREFIX" --recursive --exclude "*" --include "*.sha256" --content-type text/plain
+      - name: Pin the remote tarballs
+        id: remote
+        run: |
+          PIN=$(node apps/review-desktop/scripts/stamp-remote-artifacts.mjs remote-artifacts "$VERSION" "https://install.dev.fast/releases/${VERSION}/remote")
+          echo "whiteboard_remote=$PIN" >> "$GITHUB_OUTPUT"
       - name: Build release tarball
         run: |
           jq -n --arg version "$VERSION" --arg commit "$COMMIT" '{$version, $commit}' > release-plan.json
@@ -210,36 +253,39 @@ jobs:
   # build signs with the production repository key rather than a CI key.
   linux:
     if: ${{ inputs.platforms == 'all' || inputs.platforms == 'linux' }}
-    needs: [version, npm]
+    needs: [version, remote]
     uses: ./.github/workflows/review-linux-build.yml
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.remote.outputs.whiteboard_remote }}
       release_signing: ${{ !inputs.dry_run }}
     secrets: inherit
 
   windows:
     if: ${{ inputs.platforms == 'all' || inputs.platforms == 'windows' }}
-    needs: [version, npm]
+    needs: [version, remote]
     permissions:
       contents: read
       id-token: write
     uses: ./.github/workflows/review-windows-build.yml
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.remote.outputs.whiteboard_remote }}
       sign: true
 
   macos:
     if: ${{ inputs.platforms == 'all' || inputs.platforms == 'macos' }}
-    needs: [version, npm]
+    needs: [version, remote]
     permissions:
       contents: read
       actions: read
     uses: ./.github/workflows/review-macos-build.yml
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.remote.outputs.whiteboard_remote }}
       channel: preview
     secrets: inherit
 

.github/workflows/review-desktop-release.yml

@@ -274,14 +274,16 @@ jobs:
             --draft \
             --generate-notes
 
-  npm:
-    name: Publish npm package
+  remote:
+    name: Publish remote tarballs and npm package
     needs: version
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 60
     permissions:
-      contents: read
+      contents: write
       id-token: write
+    outputs:
+      whiteboard_remote: ${{ steps.remote.outputs.whiteboard_remote }}
     env:
       VERSION: ${{ needs.version.outputs.version }}
       COMMIT: ${{ needs.version.outputs.commit }}
@@ -348,11 +350,59 @@ jobs:
           key: ${{ runner.os }}-code-oss-deps-v3-${{ steps.code-oss-inputs.outputs.digest }}
           restore-keys: |
             ${{ runner.os }}-code-oss-deps-v3-
-      - name: Build the VS Code server
+      - name: Check for published remote tarballs
+        if: ${{ !inputs.dry_run }}
+        id: existing
+        run: |
+          mkdir -p remote-artifacts
+          FOUND=0
+          for t in linux-x64 linux-arm64; do
+            NAME="whiteboard-remote-${VERSION}-${t}.tar.xz.sha256"
+            STATUS=$(curl -sS --retry 3 --retry-all-errors -o "remote-artifacts/$NAME" -w '%{http_code}' "https://install.dev.fast/releases/${VERSION}/remote/$NAME")
+            case "$STATUS" in
+              200) FOUND=$((FOUND + 1)) ;;
+              404) rm -f "remote-artifacts/$NAME" ;;
+              *) echo "::error::${NAME} answered ${STATUS}" >&2; exit 1 ;;
+            esac
+          done
+          if [ "$FOUND" = 1 ]; then
+            echo "::error::Only one remote tarball for ${VERSION} is published; fix releases/${VERSION}/remote/ on R2 by hand." >&2
+            exit 1
+          fi
+          echo "published=$([ "$FOUND" = 2 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+      - name: Build the remote tarballs
+        if: ${{ steps.existing.outputs.published != 'true' }}
         run: |
           source apps/review-desktop/scripts/code-oss-dependencies.sh
           ensure_code_oss_dependencies "$PWD/apps/review-desktop" "$PWD/apps/review-desktop/code-oss"
-          BUILD_SOURCEVERSION="$COMMIT" node apps/review-desktop/scripts/build-remote-runtime.mjs
+          for t in linux-x64 linux-arm64; do
+            node apps/review-desktop/scripts/build-remote-tarball.mjs --target "$t" --out remote-artifacts --version "$VERSION" --commit "$COMMIT"
+          done
+      # Release assets, then R2, then the pin: a rerun that finds the tarballs on
+      # R2 skips both uploads, and no Desktop build may pin a tarball R2 lacks.
+      - name: Attach the remote tarballs to the GitHub Release
+        if: ${{ !inputs.dry_run && steps.existing.outputs.published != 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ needs.version.outputs.tag }}
+        run: gh release upload "$TAG" --repo "$GITHUB_REPOSITORY" --clobber remote-artifacts/*.tar.xz remote-artifacts/*.sha256
+      - name: Upload the remote tarballs to R2
+        if: ${{ !inputs.dry_run && steps.existing.outputs.published != 'true' }}
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          AWS_ENDPOINT_URL: ${{ vars.R2_ENDPOINT_URL }}
+          AWS_REGION: auto
+          R2_BUCKET: ${{ vars.R2_RELEASE_BUCKET }}
+        run: |
+          PREFIX="s3://${R2_BUCKET}/releases/${VERSION}/remote/"
+          aws s3 cp remote-artifacts/ "$PREFIX" --recursive --exclude "*" --include "*.tar.xz" --content-type application/x-xz
+          aws s3 cp remote-artifacts/ "$PREFIX" --recursive --exclude "*" --include "*.sha256" --content-type text/plain
+      - name: Pin the remote tarballs
+        id: remote
+        run: |
+          PIN=$(node apps/review-desktop/scripts/stamp-remote-artifacts.mjs remote-artifacts "$VERSION" "https://install.dev.fast/releases/${VERSION}/remote")
+          echo "whiteboard_remote=$PIN" >> "$GITHUB_OUTPUT"
       - name: Build release tarball
         run: |
           jq -n --arg version "$VERSION" --arg commit "$COMMIT" '{$version, $commit}' > release-plan.json
@@ -381,37 +431,40 @@ jobs:
 
   linux:
     if: ${{ inputs.platforms == 'all' || inputs.platforms == 'linux' }}
-    needs: [version, npm]
+    needs: [version, remote]
     uses: ./.github/workflows/review-linux-build.yml
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.remote.outputs.whiteboard_remote }}
       release_signing: ${{ !inputs.dry_run }}
     secrets: inherit
 
   # Signs even on a dry run, so the run validates exactly what would ship.
   windows:
     if: ${{ inputs.platforms == 'all' || inputs.platforms == 'windows' }}
-    needs: [version, npm]
+    needs: [version, remote]
     permissions:
       contents: read
       id-token: write
     uses: ./.github/workflows/review-windows-build.yml
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.remote.outputs.whiteboard_remote }}
       sign: true
 
   macos:
     if: ${{ inputs.platforms == 'all' || inputs.platforms == 'macos' }}
-    needs: [version, npm]
+    needs: [version, remote]
     permissions:
       contents: read
       actions: read
     uses: ./.github/workflows/review-macos-build.yml
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.remote.outputs.whiteboard_remote }}
       channel: stable
     secrets: inherit
 

.github/workflows/review-linux-build.yml

@@ -9,6 +9,10 @@ on:
       version:
         type: string
         default: ""
+      whiteboard_remote:
+        description: The remote job's pin (stamp-remote-artifacts.mjs); required with a version.
+        type: string
+        default: ""
       package_revision:
         type: string
         default: "1"
@@ -48,6 +52,11 @@ jobs:
           QUALITY=stable
           if [[ "$VERSION" == *-preview.* ]]; then QUALITY=preview; fi
           node apps/review-desktop/scripts/stamp-release-channel.mjs --version "$VERSION" --quality "$QUALITY"
+      - name: Pin the remote tarballs
+        if: inputs.version != ''
+        env:
+          WHITEBOARD_REMOTE: ${{ inputs.whiteboard_remote }}
+        run: node apps/review-desktop/scripts/stamp-remote-artifacts.mjs --pinned "$WHITEBOARD_REMOTE"
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:

.github/workflows/review-macos-build.yml

@@ -12,6 +12,10 @@ on:
       channel:
         required: true
         type: string
+      whiteboard_remote:
+        description: The remote job's pin (stamp-remote-artifacts.mjs).
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -155,6 +159,11 @@ jobs:
             --version "$RELEASE_VERSION" \
             --quality "${{ inputs.channel }}"
 
+      - name: Pin the remote tarballs
+        env:
+          WHITEBOARD_REMOTE: ${{ inputs.whiteboard_remote }}
+        run: node apps/review-desktop/scripts/stamp-remote-artifacts.mjs --pinned "$WHITEBOARD_REMOTE"
+
       - name: Setup pnpm
         uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 

.github/workflows/review-windows-build.yml

@@ -9,6 +9,10 @@ on:
       version:
         type: string
         required: true
+      whiteboard_remote:
+        description: The remote job's pin (stamp-remote-artifacts.mjs); required with a version.
+        type: string
+        default: ""
       artifact_name:
         type: string
         default: windows-packages
@@ -65,6 +69,10 @@ jobs:
           QUALITY=stable
           if [[ "$VERSION" == *-preview.* ]]; then QUALITY=preview; fi
           node apps/review-desktop/scripts/stamp-release-channel.mjs --version "$VERSION" --quality "$QUALITY"
+      - name: Pin the remote tarballs
+        env:
+          WHITEBOARD_REMOTE: ${{ inputs.whiteboard_remote }}
+        run: node apps/review-desktop/scripts/stamp-remote-artifacts.mjs --pinned "$WHITEBOARD_REMOTE"
       - name: Restore native dependencies
         id: native-cache
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6

apps/review-desktop/UPSTREAM

@@ -494,7 +494,8 @@ one of these entries:
   `workbench-dev.html`: allow the local Review session connection and the
   native canvas Trusted Types policy in built and development launches.
 - `src/vs/base/common/product.ts`: declares the `reviewVersion` field described
-  above, so the About panel can read it typed.
+  above, so the About panel can read it typed, and `whiteboardRemote`, the
+  per-arch remote tarballs that release builds pin for remote installs.
 - `src/vs/code/electron-main/app.ts`: own the embedded Review server lifecycle
   and register the Review connection channel that hands the renderer the server
   endpoint the main process validated. Also swaps two update- and menu-related

apps/review-desktop/code-oss/src/vs/base/common/product.ts

@@ -64,6 +64,17 @@ export type ExtensionVirtualWorkspaceSupport = {
 	readonly override?: boolean;
 };
 
+export interface IWhiteboardRemoteArtifact {
+	readonly url: string;
+	readonly sha256: string;
+}
+
+export interface IWhiteboardRemoteProduct {
+	readonly version: string;
+	readonly 'linux-x64': IWhiteboardRemoteArtifact;
+	readonly 'linux-arm64': IWhiteboardRemoteArtifact;
+}
+
 export interface IProductConfiguration {
 	readonly version: string;
 	readonly date?: string;
@@ -78,6 +89,8 @@ export interface IProductConfiguration {
 	 */
 	readonly reviewVersion?: string;
 
+	readonly whiteboardRemote?: IWhiteboardRemoteProduct;
+
 	readonly nameShort: string;
 	readonly nameLong: string;
 

apps/review-desktop/code-oss/src/vs/review/browser/reviewRemoteHostsSettings.test.ts

@@ -13,6 +13,7 @@ function fixture(values: Record<string, unknown>) {
 	const settings = new Map(Object.entries(values));
 	const writes: unknown[] = [];
 	const retried: string[] = [];
+	const uninstalled: string[] = [];
 	const hosts = reviewRemoteHostsSettings({
 		get: (key) => settings.get(key),
 		update: async (key, value) => {
@@ -23,9 +24,13 @@ function fixture(values: Record<string, unknown>) {
 			listSshAliases: async () => ["devbox"],
 			readRemoteHosts: async () => [{ alias: "devbox", state: "online" }],
 			retryRemoteHost: async (alias) => { retried.push(alias); },
+			installRemoteHost: async (alias) => { retried.push(`install ${alias}`); },
+			detectRemoteAgents: async () => null,
+			connectRemoteAgents: async () => [],
+			uninstallRemoteHost: async (alias) => { uninstalled.push(alias); },
 		},
 	});
-	return { hosts, writes, retried };
+	return { hosts, writes, retried, uninstalled };
 }
 
 test("reads the two settings as main does", () => {

apps/review-desktop/code-oss/src/vs/review/browser/reviewRemoteHostsSettings.ts

@@ -11,7 +11,7 @@ import type { IReviewDesktopConnectionService } from "../services/reviewDesktopC
 export function reviewRemoteHostsSettings(input: {
 	get(key: string): unknown;
 	update(key: string, value: string[]): Promise<void>;
-	connection: Pick<IReviewDesktopConnectionService, "readRemoteHosts" | "listSshAliases" | "retryRemoteHost">;
+	connection: Pick<IReviewDesktopConnectionService, "readRemoteHosts" | "listSshAliases" | "retryRemoteHost" | "installRemoteHost" | "detectRemoteAgents" | "connectRemoteAgents" | "uninstallRemoteHost">;
 }): ReviewRemoteHostsSettings {
 	const configured = () => remoteHostAliases(input.get(REVIEW_REMOTE_HOSTS_SETTING));
 	return {
@@ -20,6 +20,10 @@ export function reviewRemoteHostsSettings(input: {
 		suggestions: () => input.connection.listSshAliases(),
 		states: () => input.connection.readRemoteHosts(),
 		retry: (alias) => input.connection.retryRemoteHost(alias),
+		install: (alias) => input.connection.installRemoteHost(alias),
+		agents: (alias) => input.connection.detectRemoteAgents(alias),
+		connectAgents: (alias, agents) => input.connection.connectRemoteAgents(alias, agents),
+		uninstall: (alias) => input.connection.uninstallRemoteHost(alias),
 		set: async (aliases) => {
 			for (const alias of aliases) {
 				const valid = validateSshAlias(alias);