Managed Tunnel: self-healing component + extension launcher + connect flow

[aarontrowbridge]

Important

Scope. Slice 3 of Managed Fleet (#283 — read it first). The Managed Tunnel: one self-healing component (ssh forward child, ordered address candidates probed LAN-before-overlay, reconnect with bounded backoff, state events for consumers) plus its extension launcher and the "Connect to a Fleet Server" flow — ssh bootstrap (fetch token + identity + pin the instance id, write machine-scoped settings) with a manual entry fallback. The headless launcher's interface is defined in code but not built (parent Notes).

Acceptance Criteria

1. With the tunnel established, the slice-2 attach proceeds through it; killing the ssh child yields a visible reconnecting state and recovery with bounded backoff — no window reload.
2. Address candidates probe in configured order; when the LAN candidate fails, the overlay candidate connects (the 2026-08-07 flap regression test).
3. The ssh bootstrap verifies the ssh target, fetches the fleet token + identity over ssh, pins the canonical instance id, writes only machine-scoped settings, and verifies the handshake before declaring the fleet connected; the manual path (address + pasted token) lands in the same verified end state.
4. A failed bootstrap (ssh refused, handshake mismatch) leaves the machine in its previous mode with no partial configuration.

Testing Decisions

Component unit tests with a fake ssh child harness (scriptable exit/crash) and fake timers for backoff; candidate-probing tests with stubbed probers; connect-flow tests with a stubbed ssh exec (token fetch, settings write set asserted machine-scoped, handshake verify ordering); failure-atomicity test for AC 4. New test surface for the tunnel component is expected; reuse the extension's existing child-process test idioms.

Key Decisions & Constraints

• The component owns no policy: candidates, backoff bounds, and the attach URL come from configuration; launchers own lifecycle.
• Reconnect is unbounded in attempts but bounded in backoff ceiling; state transitions are events, never polled.
• Bootstrap uses the user's existing ssh setup (config aliases included); it never writes the user's ssh config.
• Parent constraints apply; slice-local: the tunnel never logs the token.

Source

Part of #283 · Design: docs/adr/0005-managed-fleet.md (PR #282) · Blocked by #285 (the attach path the tunnel serves).