refactor(ssh): group system-ssh transport, ssh config and remote exec into their own folders

config/process-host-direct-import-baseline.txt

@@ -102,11 +102,11 @@ src/main/runtime/windows-mobile-firewall.ts
 src/main/skills/skill-update-run.ts
 src/main/ssh/ssh-connection.ts
 src/main/ssh/ssh-proxy-command.ts
-src/main/ssh/system-ssh-command.ts
-src/main/ssh/system-ssh-dynamic-forward-process.ts
-src/main/ssh/system-ssh-file-transfer.ts
-src/main/ssh/system-ssh-forward-process.ts
-src/main/ssh/system-ssh-operation-lifecycle.ts
+src/main/ssh/system-transport/system-ssh-command.ts
+src/main/ssh/system-transport/system-ssh-dynamic-forward-process.ts
+src/main/ssh/system-transport/system-ssh-file-transfer.ts
+src/main/ssh/system-transport/system-ssh-forward-process.ts
+src/main/ssh/system-transport/system-ssh-operation-lifecycle.ts
 src/main/startup/ensure-virtual-display.ts
 src/main/windows-process-tree-kill.ts
 src/main/zsh-startup-hook-pty-harness.ts

config/reliability-gates.jsonc

@@ -6349,7 +6349,7 @@
         "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-network-route-registry.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts src/main/browser/browser-host-lease-reconnect-delay.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/browser-host-command-ledger.test.ts src/main/runtime/browser-host/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/browser-host-lease-placement-retirement.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-network-route-registry.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host-registry.test.ts src/main/browser/paired-runtime-browser-client-host-runtime.test.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-session-startup.test.ts src/main/ipc/runtime-environments-subscription-teardown.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/browser-host-command-ledger.test.ts src/main/runtime/browser-host/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
-        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/browser/browser-network-deferred-socket.test.ts src/main/browser/browser-network-execution-route.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/ssh-browser-network-execution-route.test.ts src/main/browser/system-ssh-socks-client-socket.test.ts src/main/ssh/system-ssh-dynamic-forward-process.test.ts src/shared/browser-client-host-protocol.test.ts src/main/ssh/system-ssh-forward-process.test.ts src/main/ssh/system-ssh-operations.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts",
+        "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/browser-host-lease-registry.test.ts src/main/browser/browser-network-deferred-socket.test.ts src/main/browser/browser-network-execution-route.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/ssh-browser-network-execution-route.test.ts src/main/browser/system-ssh-socks-client-socket.test.ts src/main/ssh/system-transport/system-ssh-dynamic-forward-process.test.ts src/shared/browser-client-host-protocol.test.ts src/main/ssh/system-transport/system-ssh-forward-process.test.ts src/main/ssh/system-transport/system-ssh-operations.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts",
         "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
         "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 node_modules/.bin/vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
       ],
@@ -6405,7 +6405,7 @@
         "src/main/browser/paired-runtime-browser-network-route.test.ts",
         "src/main/browser/ssh-browser-network-execution-route.test.ts",
         "src/main/browser/system-ssh-socks-client-socket.test.ts",
-        "src/main/ssh/system-ssh-dynamic-forward-process.test.ts",
+        "src/main/ssh/system-transport/system-ssh-dynamic-forward-process.test.ts",
         "src/main/ssh/port-forwarding/ssh-port-forward.test.ts",
         "src/main/browser/remote-browser-socks-server.test.ts",
         "src/main/runtime/runtime-binary-message-router.test.ts",
@@ -6889,7 +6889,7 @@
           ]
         },
         {
-          "file": "src/main/ssh/system-ssh-dynamic-forward-process.test.ts",
+          "file": "src/main/ssh/system-transport/system-ssh-dynamic-forward-process.test.ts",
           "assertions": [
             "system SSH uses BatchMode=yes, disables ControlMaster, and positions one dynamic forward before the destination",
             "authority invalidation cancels an in-progress SSH launch and destroys its active readiness probe immediately"
@@ -18736,13 +18736,13 @@
       "invariant": "For one connected SSH authority, a renderer snapshot may update Forwarded or Detected state only if no newer push for that target and stream arrived after the snapshot began. Active tunnels and persisted intent remain authoritative through scan refresh and reconnect until explicit removal or a real connection-lifecycle transition.",
       "oracle": "Hold empty initial Forwarded and Detected snapshot promises, publish live events, release the snapshots, and require each target and stream to preserve only its own newer push while applying unaffected snapshots. Reject one target's Detected snapshot and require its Forwarded snapshot plus later targets to hydrate independently. Begin another target with partial connected authority and require its snapshots to hydrate after same-watermark authority reconciliation. In headed Electron, hold an authoritative empty Forwarded snapshot across renderer reload, add a forward through the Ports panel, release and confirm the wrapped main handler resumed, then complete a later renderer-to-main listPortForwards round trip as the ordered hydration-continuation barrier. Before checking the Forwarded row, require main inventory, persisted intent, HTTP, remote process identity, and close warnings to prove the tunnel remained authoritative. Then forward two real Docker listeners, refresh detection, force an in-place relay-channel reconnect, perform a full transport reconnect, reject a bound local-port collision, remove one row, and require all signals to agree.",
       "commands": [
-        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts src/main/ssh/system-ssh-forward-process.test.ts src/main/ipc/ssh.test.ts --reporter=dot",
+        "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts src/main/ssh/system-transport/system-ssh-forward-process.test.ts src/main/ipc/ssh.test.ts --reporter=dot",
         "pnpm exec electron-vite build --mode e2e"
       ],
       "testFiles": [
         "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts",
         "src/main/ssh/port-forwarding/ssh-port-forward.test.ts",
-        "src/main/ssh/system-ssh-forward-process.test.ts",
+        "src/main/ssh/system-transport/system-ssh-forward-process.test.ts",
         "src/main/ipc/ssh.test.ts"
       ],
       "assertionRefs": [
@@ -18755,7 +18755,7 @@
           "assertions": ["lists forwards filtered by connectionId", "removes a forward by id"]
         },
         {
-          "file": "src/main/ssh/system-ssh-forward-process.test.ts",
+          "file": "src/main/ssh/system-transport/system-ssh-forward-process.test.ts",
           "assertions": [
             "does not spawn ssh when the requested local forward port is already in use",
             "sends SIGTERM then SIGKILL when the process does not exit",
@@ -18775,7 +18775,7 @@
           "date": "2026-07-30",
           "runner": "local",
           "platform": "macos",
-          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts src/main/ssh/system-ssh-forward-process.test.ts src/main/ipc/ssh.test.ts --reporter=dot",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts src/main/ssh/system-transport/system-ssh-forward-process.test.ts src/main/ipc/ssh.test.ts --reporter=dot",
           "result": "passed",
           "durationSeconds": 6.77,
           "summary": "Six renderer, main-process, and barrier lifecycle files passed with 215 tests, including deterministic stale-snapshot, rejected-stream, partial-authority, and single-capture isolation plus existing collision, delayed-exit, reconnect, persistence, re-registration, and unrelated-forward contracts."

config/scripts/ci-shard-timings.json

@@ -5685,7 +5685,7 @@
       "src/main/ssh/pinned-runtime-host-target.test.ts": 51,
       "src/main/ssh/relay-bundle-paths.test.ts": 32,
       "src/main/ssh/relay-install-artifacts.test.ts": 37,
-      "src/main/ssh/remote-frame-protocol.test.ts": 113,
+      "src/main/ssh/remote-exec/remote-frame-protocol.test.ts": 113,
       "src/main/managed-server/install/remote-install-gc-termination.test.ts": 187,
       "src/main/managed-server/install/remote-install-model.test.ts": 184,
       "src/main/managed-server/install/remote-node-runtime-store-gc.test.ts": 1625,
@@ -5704,13 +5704,13 @@
       "src/main/ssh/ssh-channel-multiplexer-saturation-wedge.test.ts": 61,
       "src/main/ssh/ssh-channel-multiplexer-settlement.test.ts": 37,
       "src/main/ssh/ssh-channel-multiplexer.test.ts": 120,
-      "src/main/ssh/ssh-config-alias-claim.test.ts": 58,
-      "src/main/ssh/ssh-config-host-picker.test.ts": 223,
-      "src/main/ssh/ssh-config-loader-regression.test.ts": 132,
-      "src/main/ssh/ssh-config-loader.test.ts": 114,
-      "src/main/ssh/ssh-config-parser-host-patterns.test.ts": 49,
-      "src/main/ssh/ssh-config-parser.test.ts": 331,
-      "src/main/ssh/ssh-config-resolver.test.ts": 40,
+      "src/main/ssh/config/ssh-config-alias-claim.test.ts": 58,
+      "src/main/ssh/config/ssh-config-host-picker.test.ts": 223,
+      "src/main/ssh/config/ssh-config-loader-regression.test.ts": 132,
+      "src/main/ssh/config/ssh-config-loader.test.ts": 114,
+      "src/main/ssh/config/ssh-config-parser-host-patterns.test.ts": 49,
+      "src/main/ssh/config/ssh-config-parser.test.ts": 331,
+      "src/main/ssh/config/ssh-config-resolver.test.ts": 40,
       "src/main/ssh/ssh-connect-attempt-cancellation.test.ts": 85,
       "src/main/ssh/ssh-connection-attribution.test.ts": 34,
       "src/main/ssh/ssh-connection-auth-fallback.test.ts": 269,
@@ -5741,7 +5741,7 @@
       "src/main/ssh/ssh-exec-rc-stdout-noise.test.ts": 260,
       "src/main/ssh/ssh-exec-stdin-file-transfer.test.ts": 334,
       "src/main/ssh/ssh-file-transfer-abort.test.ts": 77,
-      "src/main/ssh/ssh-g-config-resolution.test.ts": 128,
+      "src/main/ssh/config/ssh-g-config-resolution.test.ts": 128,
       "src/main/ssh/ssh-host-key-decision.test.ts": 67,
       "src/main/ssh/ssh-host-key-store.test.ts": 207,
       "src/main/ssh/ssh-host-key-verifier.test.ts": 77,
@@ -5760,8 +5760,8 @@
       "src/main/ssh/hostile-host-test-support/ssh-hostile-hosts.docker.test.ts": 574,
       "src/main/ssh/ssh-keyboard-interactive-wire.test.ts": 261,
       "src/main/ssh/ssh-keyboard-interactive.test.ts": 41,
-      "src/main/ssh/ssh-known-hosts-source.test.ts": 106,
-      "src/main/ssh/ssh-known-hosts.test.ts": 89,
+      "src/main/ssh/config/ssh-known-hosts-source.test.ts": 106,
+      "src/main/ssh/config/ssh-known-hosts.test.ts": 89,
       "src/main/ssh/ssh-multi-factor-authentication.test.ts": 109,
       "src/main/ssh/ssh-multi-key-authentication.test.ts": 87,
       "src/main/ssh/ssh-multiplexer-transport-writer.test.ts": 75,
@@ -5773,16 +5773,16 @@
       "src/main/ssh/ssh-quit-abort-upload.test.ts": 252,
       "src/main/ssh/ssh-reconnect-error-classification.test.ts": 98,
       "src/main/ssh/ssh-reconnect-ladder.test.ts": 75,
-      "src/main/ssh/remote-host-answered-failure-producers.test.ts": 321,
+      "src/main/ssh/remote-exec/remote-host-answered-failure-producers.test.ts": 321,
       "src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent-shell.integration.test.ts": 1326,
       "src/main/ssh/legacy-relay/ssh-relay-endpoint-incumbent.test.ts": 100,
       "src/main/ssh/legacy-relay/ssh-relay-endpoint-pty-count.test.ts": 90,
       "src/main/ssh/legacy-relay/ssh-relay-endpoint-runtime.test.ts": 69,
-      "src/main/ssh/remote-exec-closed-stdin.test.ts": 89,
-      "src/main/ssh/remote-exec-command.test.ts": 130,
-      "src/main/ssh/remote-exec-input.test.ts": 92,
+      "src/main/ssh/remote-exec/remote-exec-closed-stdin.test.ts": 89,
+      "src/main/ssh/remote-exec/remote-exec-command.test.ts": 130,
+      "src/main/ssh/remote-exec/remote-exec-input.test.ts": 92,
       "src/main/managed-server/install/remote-install-gc-claim-termination.test.ts": 249,
-      "src/main/ssh/remote-host-answered-failure.test.ts": 101,
+      "src/main/ssh/remote-exec/remote-host-answered-failure.test.ts": 101,
       "src/main/ssh/legacy-relay/ssh-relay-incumbent-process.test.ts": 5329,
       "src/main/managed-server/install/remote-install-lock-exited-owner.test.ts": 380,
       "src/main/managed-server/install/remote-install-lock-termination.test.ts": 276,
@@ -5802,7 +5802,7 @@
       "src/main/ssh/ssh-request-outcome-verdict.test.ts": 37,
       "src/main/ssh/ssh-security-key-identity.test.ts": 147,
       "src/main/ssh/ssh-session-limit-error.test.ts": 27,
-      "src/main/ssh/system-ssh-operations.test.ts": 275,
+      "src/main/ssh/system-transport/system-ssh-operations.test.ts": 275,
       "src/main/ssh/ssh-system-transport.integration.test.ts": 277,
       "src/main/ssh/ssh-target-id-migration.test.ts": 46,
       "src/main/ssh/ssh-target-orcad-claims.test.ts": 306,
@@ -5812,16 +5812,16 @@
       "src/main/ssh/ssh-tcp-forwarding-probe.test.ts": 810,
       "src/main/ssh/ssh-windows-host-cells.test.ts": 39,
       "src/main/ssh/port-forwarding/ssh2-port-forward-listen.test.ts": 30,
-      "src/main/ssh/system-ssh-binary.test.ts": 35,
-      "src/main/ssh/system-ssh-dynamic-forward-process.test.ts": 240,
-      "src/main/ssh/system-ssh-forward-process.test.ts": 251,
-      "src/main/ssh/system-ssh-orphaned-forward.test.ts": 86,
-      "src/main/ssh/system-ssh-sftp-args.test.ts": 44,
-      "src/main/ssh/system-ssh-sftp-path.test.ts": 38,
-      "src/main/ssh/system-ssh-upload-plan-budget.test.ts": 336,
-      "src/main/ssh/system-ssh-windows-upload.test.ts": 343,
-      "src/main/ssh/system-ssh-windows-write-capabilities.test.ts": 35,
-      "src/main/ssh/vscode-ssh-authority.test.ts": 48,
+      "src/main/ssh/system-transport/system-ssh-binary.test.ts": 35,
+      "src/main/ssh/system-transport/system-ssh-dynamic-forward-process.test.ts": 240,
+      "src/main/ssh/system-transport/system-ssh-forward-process.test.ts": 251,
+      "src/main/ssh/system-transport/system-ssh-orphaned-forward.test.ts": 86,
+      "src/main/ssh/system-transport/system-ssh-sftp-args.test.ts": 44,
+      "src/main/ssh/system-transport/system-ssh-sftp-path.test.ts": 38,
+      "src/main/ssh/system-transport/system-ssh-upload-plan-budget.test.ts": 336,
+      "src/main/ssh/system-transport/system-ssh-windows-upload.test.ts": 343,
+      "src/main/ssh/system-transport/system-ssh-windows-write-capabilities.test.ts": 35,
+      "src/main/ssh/config/vscode-ssh-authority.test.ts": 48,
       "src/main/star-nag/service-direct-star.test.ts": 323,
       "src/main/star-nag/service-force-show-races.test.ts": 322,
       "src/main/star-nag/service-outcome-telemetry.test.ts": 354,

config/scripts/pr-e2e-route-contracts.test.mjs

@@ -288,7 +288,7 @@ describe('ssh-browser-e2e-routing', () => {
       'src/main/browser/browser-network-deferred-socket.ts',
       'src/main/browser/browser-network-execution-route.ts',
       'src/main/browser/system-ssh-socks-client-socket.ts',
-      'src/main/ssh/system-ssh-dynamic-forward-process.ts',
+      'src/main/ssh/system-transport/system-ssh-dynamic-forward-process.ts',
       'tests/e2e/helpers/docker-ssh-host-target.ts',
       'tests/e2e/helpers/docker-ssh-host-image.ts'
     ]) {

config/scripts/pr-e2e-source-routing.mjs

@@ -276,7 +276,7 @@ export const PR_E2E_SOURCE_ROUTES = [
       file === 'tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts' ||
       /^tests\/e2e\/helpers\/docker-ssh-host-(?:image|target)\.ts$/.test(file) ||
       (isProductSource(file) &&
-        /^src\/main\/(?:browser\/(?:ssh-browser-network-execution-route|browser-network-deferred-socket|browser-network-execution-route|system-ssh-socks-client-socket)|ssh\/system-ssh-dynamic-forward-process)\.ts$/.test(
+        /^src\/main\/(?:browser\/(?:ssh-browser-network-execution-route|browser-network-deferred-socket|browser-network-execution-route|system-ssh-socks-client-socket)|ssh\/system-transport\/system-ssh-dynamic-forward-process)\.ts$/.test(
           file
         ))
   },

src/main/active-view-persistence-boundary.test.ts

@@ -22,7 +22,7 @@ vi.mock('electron', () => ({
 
 vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('./telemetry/cohort-classifier', () => ({ getCohortAtEmit: vi.fn() }))
-vi.mock('./ssh/ssh-config-parser', () => ({
+vi.mock('./ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))

src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts

@@ -5,7 +5,7 @@ import { EventEmitter } from 'node:events'
 import type { ChildProcessWithoutNullStreams } from 'node:child_process'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
-import { RELAY_SENTINEL, RELAY_SENTINEL_TIMEOUT_MS } from '../ssh/remote-frame-protocol'
+import { RELAY_SENTINEL, RELAY_SENTINEL_TIMEOUT_MS } from '../ssh/remote-exec/remote-frame-protocol'
 import {
   MAX_STARTUP_BUFFER_BYTES,
   waitForWslRelaySentinel,

src/main/agent-hooks/wsl-hook-relay-sentinel.ts

@@ -4,7 +4,7 @@
 // ChildProcess instead of a ClientChannel.
 import type { ChildProcessWithoutNullStreams } from 'node:child_process'
 
-import { RELAY_SENTINEL, RELAY_SENTINEL_TIMEOUT_MS } from '../ssh/remote-frame-protocol'
+import { RELAY_SENTINEL, RELAY_SENTINEL_TIMEOUT_MS } from '../ssh/remote-exec/remote-frame-protocol'
 import type { MultiplexerTransport } from '../ssh/ssh-channel-multiplexer'
 
 export const MAX_STARTUP_BUFFER_BYTES = 64 * 1024

src/main/automations/automation-worker-durability.test.ts

@@ -10,7 +10,7 @@ vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('../telemetry/cohort-classifier', () => ({
   getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
-vi.mock('../ssh/ssh-config-parser', () => ({
+vi.mock('../ssh/config/ssh-config-parser', () => ({
   loadUserSshConfig: () => ({ hosts: [] }),
   sshConfigHostsToTargets: () => []
 }))

src/main/browser/ssh-browser-network-execution-route.ts

@@ -5,7 +5,7 @@ import type { Client as SshClient } from 'ssh2'
 import {
   startSystemSshDynamicForwardProcess,
   type SystemSshDynamicForwardProcess
-} from '../ssh/system-ssh-dynamic-forward-process'
+} from '../ssh/system-transport/system-ssh-dynamic-forward-process'
 import { BrowserNetworkDeferredSocket } from './browser-network-deferred-socket'
 import {
   browserNetworkExecutionHostKey,

src/main/github/github-enterprise-repository.test.ts

@@ -16,7 +16,7 @@ vi.mock('../git/runner', () => ({
   gitExecFileAsync: gitExecFileAsyncMock
 }))
 
-vi.mock('../ssh/ssh-g-config-resolution', () => ({
+vi.mock('../ssh/config/ssh-g-config-resolution', () => ({
   resolveWithSshG: resolveWithSshGMock
 }))