* feat(ssh): deploy and pair an empty managed orcad server over SSH (#16741 T6-5)
Adds deploy + pair + status for a managed orcad environment on an empty SSH
host, the loopback tunnel it is reached through (rebuilt on reconnect and
after host resume), SSH provisioning of a new host, and SSH access for an
already paired server. The deployment link lives in the environment sidecar
so a downgraded build cannot strip it. Inert until the T6-6 settings UI.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(ssh): refuse a managed claim while saved state still references the host
Until the T6-8 census exists, a target is claimable only when no workspace
session, automation, worktree metadata or saved PTY lease (any status) points
at it. An unreadable store refuses as unverifiable. Refusals name what
blocked them.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(ssh): keep electron out of the resume path; report a decommission journal in status
The caller now passes the profile path for managed-tunnel recovery after host
resume, so ssh-host-sleep-reconnect no longer reads electron's app. Status maps
T6-4's decommission transaction.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: m4air <m4air@m4airs-Air.localdomain>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(runtime): SSH access links for paired servers in a downgrade-safe sidecar (#16741 T5-1+T5-2)
Paired runtime environments gain a durable two-phase SSH access link
(prepare link, verified link, prepare unlink, complete unlink, cancel),
plus the reconciliation record type and the runtime identity verification
helper that T6 needs. Nothing calls the link store yet; T6's managed tunnel
and runtime SSH access are its first writers.
Why a sidecar: v1.4.217 and v1.4.218 parse orca-environments.json with plain
z.object schemas, which strip unknown keys, and rewrite the whole file on
routine use (markEnvironmentUsed). Storing the link there, as #16741 did, would
let a downgraded build keep the tunnel endpoint but drop sshAccess, stranding
the server unlinkable and losing its pinned host-key fingerprint. #16741's own
answer (bumping the store version) makes those builds reject the whole file.
So orca-environments.json keeps exactly its shipped shape (version 1, persisted
fields only), and all T5 state lives in orca-environment-sidecar.json beside
it: the link and its tunnel endpoint, the pending operation, the reconciliation
record, the verified runtime id and a monotonic pairing-revision floor. Reads
overlay the sidecar; each entry is bound to the environment's createdAt,
pairing revision and preferred endpoint, so a re-pair, removal or edit by an
older build makes it stale (ignored, pruned on the next sidecar write). An
unreadable sidecar fails closed, like the main file.
Porting note (source: #16741a68b6f3531):
- Taken: the link-store behavior and messages, the access-link schemas and
refinements, the reconciliation record, identity verification, and the
store/schema tests.
- Adapted: link state moved from orca-environments.json to the sidecar;
existing mutators write persisted fields only; removal, re-pairing and
runtime identity changes refuse while SSH access is linked or pending.
- Left for later slices: orcadDeployment and restoreManagedOrcadEnvironmentLink
(T6), reconciliation store, integrity, catalog and UI (T5-3 to T5-5), the 24
renderer terminal-input files (T7), runtime-identity and the managed-tunnel
resolver (T6).
* test(runtime): read SSH access from the known view of a persisted environment
---------
Co-authored-by: m4air <m4air@m4airs-Air.localdomain>
* chore(dead-code): drop 2k lines of unreachable exports and orphan modules
Ran knip across every build entry (main, preload, renderer, popout, web,
cli, relay, workers, forked sidecars, config scripts) and removed what no
entry graph can reach.
- 11 orphan modules nothing imported, plus one test that only covered them
- 159 unused exports/types, with their now-dead helpers, imports and tests
Each candidate was verified against dynamic references before deletion.
42 knip hits were false positives and are kept: shared modules consumed by
the mobile/ workspace, the src/shared/plugins/** public API, vendored
shadcn primitives, and relay wire-protocol constants held for compatibility.
Adds knip.json + `pnpm audit:dead-code` so this stays measurable.
Verified: pnpm typecheck, pnpm lint, and 2081 tests across the 73 affected
test files all pass.
* chore(dead-code): move knip config under config/
Root-level additions are blocked by the root directory guard.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
OrcaWinandm4air
Jinwoo HongandJinwoo-H
NeilandOrca
Jinjing