feat(ssh): establish desktop controller foundation

.github/workflows/ssh-desktop.yml

@@ -0,0 +1,122 @@
+name: SSH desktop foundation
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/ssh-desktop.yml'
+      - 'cmd/atenea-ssh-controller/**'
+      - 'internal/sshcontrol/**'
+      - 'desktop/ssh/**'
+      - 'go.mod'
+      - 'go.sum'
+
+jobs:
+  native-build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15, windows-2025, ubuntu-24.04]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.26.7'
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.4.2'
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install Linux WebView build dependencies
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev xvfb xauth xdotool imagemagick dbus-x11 weston
+      - name: Frontend check and build
+        working-directory: desktop/ssh/frontend
+        shell: bash
+        run: |
+          bun install --frozen-lockfile
+          bun run check
+          bun run build
+      - name: Native controller tests
+        shell: bash
+        run: go test -race -count=1 ./internal/sshcontrol/...
+      - name: Build Wails shell
+        working-directory: desktop/ssh
+        shell: bash
+        run: |
+          python scripts/restricted_wails.py test
+          python scripts/restricted_wails.py build
+      - name: Check Linux launcher diagnostics
+        if: runner.os == 'Linux'
+        working-directory: desktop/ssh
+        shell: bash
+        run: bash scripts/linux_launcher_test.sh
+      - name: Bundle controller beside window
+        shell: bash
+        run: |
+          case "${{ runner.os }}" in
+            macOS) target=desktop/ssh/build/bin/atenea-ssh.app/Contents/MacOS/atenea-ssh-controller ;;
+            Windows) target=desktop/ssh/build/bin/atenea-ssh-controller.exe ;;
+            Linux) target=desktop/ssh/build/bin/atenea-ssh-controller ;;
+          esac
+          go build -o "$target" ./cmd/atenea-ssh-controller
+      - name: Render Linux window in a virtual X11 session
+        if: runner.os == 'Linux'
+        working-directory: desktop/ssh
+        shell: bash
+        run: dbus-run-session -- xvfb-run -a -s '-screen 0 1280x800x24' bash scripts/linux_render_smoke.sh
+      - name: Render copied Linux package through a Terminal link
+        if: runner.os == 'Linux'
+        working-directory: desktop/ssh
+        shell: bash
+        run: |
+          install_root=$(mktemp -d)
+          trap 'rm -rf "$install_root"' EXIT
+          mkdir -p "$install_root/bin" "$install_root/command" "$install_root/config"
+          install -m 755 build/bin/atenea-ssh build/bin/atenea-ssh-bin build/bin/atenea-ssh-controller "$install_root/bin/"
+          ln -s ../bin/atenea-ssh "$install_root/command/atenea-ssh"
+          ATENEA_SSH_SHELL="$install_root/command/atenea-ssh" \
+          ATENEA_SSH_CONTROLLER="$install_root/bin/atenea-ssh-controller" \
+          ATENEA_SSH_CAPTURE=build/ci-artifacts/linux-installed-link.png \
+          XDG_CONFIG_HOME="$install_root/config" \
+          dbus-run-session -- xvfb-run -a -s '-screen 0 1280x800x24' bash scripts/linux_render_smoke.sh
+      - name: Exercise Linux lifecycle in a virtual Wayland session
+        if: runner.os == 'Linux'
+        working-directory: desktop/ssh
+        shell: bash
+        run: dbus-run-session -- bash scripts/linux_wayland_lifecycle.sh
+      - name: Probe Linux WebView bridge in virtual X11
+        if: runner.os == 'Linux'
+        working-directory: desktop/ssh
+        shell: bash
+        run: |
+          python scripts/restricted_wails.py probe-build
+          (cd ../.. && go build -o desktop/ssh/build/bin/atenea-ssh-controller ./cmd/atenea-ssh-controller)
+          ATENEA_SSH_CAPTURE=build/ci-artifacts/linux-bridge-probe.png dbus-run-session -- xvfb-run -a -s '-screen 0 1280x800x24' bash scripts/linux_render_smoke.sh
+      - name: Capture Linux WebView navigation probe in virtual X11
+        if: runner.os == 'Linux'
+        working-directory: desktop/ssh
+        shell: bash
+        run: |
+          python scripts/restricted_wails.py navigation-probe-build
+          (cd ../.. && go build -o desktop/ssh/build/bin/atenea-ssh-controller ./cmd/atenea-ssh-controller)
+          ATENEA_SSH_CAPTURE=build/ci-artifacts/linux-navigation-probe.png dbus-run-session -- xvfb-run -a -s '-screen 0 1280x800x24' bash scripts/linux_render_smoke.sh
+      - name: Capture Linux WebView navigation probe in virtual Wayland
+        if: runner.os == 'Linux'
+        working-directory: desktop/ssh
+        shell: bash
+        run: ATENEA_SSH_CAPTURE=build/ci-artifacts/linux-wayland-navigation-probe.png ATENEA_SSH_CAPTURE_DELAY=7 dbus-run-session -- bash scripts/linux_wayland_lifecycle.sh
+      - name: Save Linux window capture
+        if: runner.os == 'Linux' && always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: atenea-ssh-linux-window
+          path: |
+            desktop/ssh/build/ci-artifacts/linux-render-smoke.png
+            desktop/ssh/build/ci-artifacts/linux-installed-link.png
+            desktop/ssh/build/ci-artifacts/linux-bridge-probe.png
+            desktop/ssh/build/ci-artifacts/linux-navigation-probe.png
+            desktop/ssh/build/ci-artifacts/linux-wayland.png
+            desktop/ssh/build/ci-artifacts/linux-wayland-navigation-probe.png
+          if-no-files-found: ignore

cmd/atenea-ssh-controller/main.go

@@ -0,0 +1,53 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"os/signal"
+	"time"
+
+	"github.com/Tutitoos/atenea/internal/sshcontrol/controller"
+)
+
+// The controller deliberately exposes no SSH commands in this foundation.
+func main() {
+	rootFlag := flag.String("root", "", "absolute per-user state directory")
+	stopFlag := flag.Bool("stop", false, "stop the current user's controller")
+	flag.Parse()
+	if flag.NArg() != 0 {
+		fmt.Fprintln(os.Stderr, "unexpected arguments")
+		os.Exit(2)
+	}
+	root := *rootFlag
+	if root == "" {
+		var err error
+		root, err = controller.Root()
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+	}
+	id, err := controller.InstallationID(root)
+	if err == nil && *stopFlag {
+		ctx, cancel := context.WithTimeout(context.Background(), 8*time.Second)
+		defer cancel()
+		_, err = controller.Call(ctx, root, id, "stop")
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		return
+	}
+	if err == nil {
+		ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
+		defer cancel()
+		err = controller.Serve(ctx, root, id)
+	}
+	if err != nil && !errors.Is(err, context.Canceled) {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}

desktop/ssh/.gitignore

@@ -0,0 +1,8 @@
+/build/bin/
+/build/ci-artifacts/
+/frontend/node_modules/
+/frontend/dist/*
+!/frontend/dist/gitkeep
+/frontend/wailsjs/
+/frontend/package.json.md5
+/ssh