feat(desktop): share the Local Runtime Host

[M4n5ter]

English

Summary

Let a user expose the current computer's Local Runtime Host to another Maka Desktop without creating a second Host or copying its State Root

• hands the existing Local Host from the ephemeral Desktop child to the OS-managed service
• keeps Local IPC and experimental Direct peer active on the same Host
• adds versioned, one-time Owner connection codes and an atomic import flow
• keeps disabling connectivity separate from uninstalling the service or revoking credentials

#3950 is merged; this PR is based on main

Refs #3842

Verification

• npm run typecheck
• npm run lint -- --diagnostic-level=error
• npm run format:check
• npm run build
• npm run check:stale
• npm run check:asf-headers
• npm run astryx:surface-inventory
• affected CLI, Runtime Host, and Desktop test suites
• real two-Desktop connection-code import over Direct peer, including disable, re-enable, and service uninstall
• Electron UI checked through CDP with isolated profiles

UI

Before:

After:

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with implementation, tests, documentation, and verification under the contributor's direction

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

允许用户把当前电脑的 Local Runtime Host 提供给另一台 Maka Desktop 使用，同时不创建第二个 Host，也不复制 State Root

• 将现有 Local Host 从 Desktop 临时子进程交接给操作系统托管服务
• 同一个 Host 同时保留 Local IPC 与实验性的 Direct peer listener
• 增加版本化、一次性的 Owner 连接码和原子导入流程
• 明确区分关闭连接方式、卸载服务与撤销凭据

#3950 已合并；本 PR 现基于 main

关联 #3842

验证

• npm run typecheck
• npm run lint -- --diagnostic-level=error
• npm run format:check
• npm run build
• npm run check:stale
• npm run check:asf-headers
• npm run astryx:surface-inventory
• 受影响的 CLI、Runtime Host 与 Desktop 测试套件
• 使用两个真实 Desktop 通过 Direct peer 导入连接码，并验证关闭、重新开启和卸载服务
• 使用隔离 profile 通过 CDP 检查 Electron UI

界面

修改前：

修改后：

AI 使用

• 没有生成式工具作出实质贡献
• 生成式工具作出了实质贡献

工具与范围：OpenAI Codex 在贡献者指导下协助实现、测试、文档与验证

检查清单

• 测试覆盖本次变更，并会在缺少变更时失败
• lint、format、typecheck 与受影响测试套件均已在本地通过

本 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[jackwener]

I re-reviewed the current exact head 6f57620a3f11f42f47e06a901bd52ceb7565e2d6. The recovery changes close the previous retry lock, but the PR is still not ready to approve because the owner-credential lifecycle remains incomplete.

Findings

P1 — Claimed connection codes accumulate durable full-owner credentials without a local revocation path.

Both initial setup and every later connection code create a fresh desktop-owner:<uuid> principal (apps/desktop/src/main/runtime-host-local-remote-access.ts:251 and :573). Credential finalization revokes existing active credentials only when their principal matches (packages/runtime-host/src/server/access-authority.ts:361-366), so these random principals never replace one another.

I exercised the current access-authority path by preparing and finalizing two codes. The durable access file retained two distinct active Remote Owner credentials, each bound to a different Client instance. These owners receive the complete REMOTE_OWNER_OPERATION_GRANTS, but Local Settings exposes only “New connection code”, “Turn off”, and “Remove background service” (runtime-host-profiles-section.tsx:391-405); it has no authorization list or per-client revoke action. Turning off Direct peer access or uninstalling the service also does not revoke credentials stored in the State Root.

Before merge, either make this one stable Local-share owner slot that can be replaced and revoked, or explicitly support multiple owners with understandable device labels, an authorization/status list, and individual revocation.

P2 — Connection-code failures are not actionable in English.

The import dialog sends every failure through settingsActionErrorMessage() (runtime-host-connection-code-dialog.tsx:52-61). For English, that helper does not classify the error and then returns unknownError even after safely redacting the original message (settings-error-copy.ts:31-35). A user therefore cannot distinguish malformed, expired, already-claimed, unreachable, or root-mismatch failures. Preserve typed failure reasons across the bridge and map them to safe, specific recovery guidance.

P2 — The UI does not explain the security and connectivity contract.

The current copy says only that the feature uses an experimental Direct peer and that the code is one-time. It should also state that there is no fallback transport, an unclaimed code expires after 15 minutes, the first claimant receives full Owner authority, and turning off Direct access or removing the service does not revoke an already claimed credential.

Verification

The new persisted handoff, peer-change, uninstall, and cleanup intents now recover through startup or the enabled recovery action, so the previous unavailable UI dead end is closed. Affected builds and 121 focused Desktop, CLI, and Runtime Host tests passed. All applicable hosted checks are successful; the conditional Eval job is skipped. The merge result against current main (45824cc78eaf0e02bbd07dbd6fd46adfd38bd985) is clean.

---

Posted by an automated review agent operated by @WAWQAQ. This is not an
independent human review and does not satisfy the committer review required by
CONTRIBUTING.md. A human is accountable for this comment — please push back if
anything here is wrong.

简体中文

本条评论由 @WAWQAQ 运行的自动化审查程序发出。它不构成 CONTRIBUTING.md
所要求的独立人类审查，也不能替代人类审查。有人类对本条评论负责，如有错误请直接指出。