feat(gateway): live Desktop observer for cloud workers (Labs) (#120727)

* feat(gateway): live desktop observer for cloud workers

Adds live observation for cloud worker desktops through the gateway and Crabbox plugin, including desktop provisioning, persisted desktop metadata, tunneled WebSocket proxying, and the worker.desktop.observe protocol method.

The gateway, Crabbox plugin, and gateway protocol surfaces remain off by default behind the cloudWorkers.desktop Labs flag.

* feat(ui): Desktop panel for cloud worker observation

* docs(gateway): document cloud worker desktop lab

* fix(ci): regenerate contract baselines after rebase

* fix(protocol): regenerate Android gateway methods

* fix(ci): align rebased SDK and lint baselines

* fix(gateway): enforce view-only RFB boundary and fence desktop teardown

* fix(gateway): tighten RFB filter surface

* fix(state): keep pre-desktop databases readable and harden view-only RFB

* fix(gateway): fence desktop observer upgrades behind work admission

* fix(gateway): bind desktop observer tokens to their owner epoch

* fix(ci): regenerate config and SDK baselines after rebase

* fix(ci): regenerate native protocol and SDK baselines

* fix(ci): regenerate contracts after main rebase

* fix(state): register desktop metadata as lazy additive

* fix(ci): regenerate SDK baseline after final direct-merge rebase
This commit is contained in:
Peter Steinberger
2026-08-09 09:37:01 -07:00
committed by GitHub
parent 2f8c950701
commit 8fdf7570a1
75 changed files with 3573 additions and 189 deletions
+11
View File
@@ -78,12 +78,23 @@ export type WorkerSshIdentityRequest = {
keyRef: SecretRef;
};
/** Optional interactive desktop endpoint provisioned with the lease (warm-time capability). */
export type WorkerDesktopEndpoint = {
/** Desktop service protocol on the worker loopback; "rfb" is the only phase-1 value. */
protocol: "rfb";
/** Loopback port on the worker (e.g. 5900). */
port: number;
/** Absolute on-box path to the per-lease password file; read over SSH, never persisted as plaintext. */
passwordFilePath?: string;
};
/** Durable lease identity and endpoint returned by a successful provision operation. */
export type WorkerLease = {
leaseId: string;
ssh: WorkerSshEndpoint;
/** The SSH account also owns processes unrelated to this worker lease. */
sharedHost?: boolean;
desktop?: WorkerDesktopEndpoint;
};
/** Authoritative inspection result for an already-known worker lease. */