feat(desktop): manage WSL Host projects

apps/desktop/renderer-architecture.json

@@ -624,7 +624,7 @@
           "react": 1
         },
         "importSpecifiers": 22,
-        "nonTriviaTokens": 990
+        "nonTriviaTokens": 977
       },
       "src/renderer/app-shell-project-actions.ts": {
         "importDeclarations": 9,
@@ -945,7 +945,7 @@
           "useShellRunUpdates": 1,
           "useShellSearch": 1,
           "useStableActions": 7,
-          "useState": 18,
+          "useState": 17,
           "useSystemUiLocale": 1,
           "useTaskEntryController": 1,
           "useTaskSubmissionReadiness": 1,
@@ -1063,7 +1063,7 @@
           "react": 1
         },
         "importSpecifiers": 187,
-        "nonTriviaTokens": 15912
+        "nonTriviaTokens": 15908
       },
       "src/renderer/use-app-shell-composer-quotes.ts": {
         "importDeclarations": 3,

apps/desktop/src/main/__tests__/runtime-host-managed-services.test.ts

@@ -26,6 +26,7 @@ import { createClientRuntimeHostProfileCatalog } from "@maka/runtime-host/client
 import {
   createDesktopRuntimeHostManagedServiceStore,
   findDesktopRuntimeHostManagedServiceBinding,
+  isDesktopRuntimeHostManagedSshServiceBinding,
 } from "../runtime-host-managed-services.js";
 import {
   createDesktopRuntimeHostProfileService,
@@ -154,6 +155,7 @@ test("keeps Desktop service bindings outside the shared profile catalog", async
     profile,
   );
   assert.ok(binding);
+  assert.ok(isDesktopRuntimeHostManagedSshServiceBinding(binding));
   assert.equal(await managedServices.markUninstallingIfCurrent(binding), true);
   assert.equal(
     findDesktopRuntimeHostManagedServiceBinding(
@@ -186,3 +188,51 @@ test("keeps Desktop service bindings outside the shared profile catalog", async
     true,
   );
 });
+
+test("persists a WSL deployment through its environment control route", async () => {
+  const root = await mkdtemp(join(tmpdir(), "maka-managed-wsl-deployment-"));
+  roots.push(root);
+  const store = createDesktopRuntimeHostManagedServiceStore(root);
+  const environment = {
+    id: "ubuntu",
+    name: "Ubuntu",
+    kind: "environment" as const,
+    provider: { kind: "wsl" as const, distribution: "Ubuntu-24.04" },
+    rootId: "a".repeat(64),
+    operatorPath: "/home/operator/.local/share/maka/operator",
+  };
+  await store.save(environment, {
+    deployment: {
+      id: environment.rootId,
+      rootPath: "/home/operator/.config/Maka/workspaces/default",
+      deploymentId,
+    },
+  });
+
+  assert.deepEqual(
+    findDesktopRuntimeHostManagedServiceBinding(await store.read(), environment),
+    {
+      profile: environment,
+      deployment: {
+        id: environment.rootId,
+        rootPath: "/home/operator/.config/Maka/workspaces/default",
+        deploymentId,
+      },
+      state: "active",
+    },
+  );
+  await assert.rejects(
+    store.save(
+      { ...environment, id: "ubuntu-duplicate" },
+      {
+        deployment: {
+          id: environment.rootId,
+          rootPath: "/home/operator/.config/Maka/workspaces/default",
+          deploymentId,
+        },
+      },
+    ),
+    /already bound/u,
+  );
+  await assert.rejects(store.save(profile, deployedService), /already bound/u);
+});

apps/desktop/src/main/__tests__/runtime-host-management.test.ts

@@ -36,6 +36,7 @@ import type {
   DesktopRuntimeHostSshUpdatePolicyInput,
   DesktopRuntimeHostSshUpdateReconciliationInput,
 } from '../runtime-host-ssh-terminal.js';
+import type { DesktopRuntimeHostWslManagementInput } from '../runtime-host-wsl-controller.js';
 
 const DEPLOYMENT_ID = '11111111-1111-4111-8111-111111111111';
 
@@ -176,6 +177,100 @@ test('requires explicit interruption authority before a provider restarts active
   );
 });
 
+test('routes WSL status and directory configuration through the persisted operator route', async () => {
+  const handlers = new Map<string, (...args: unknown[]) => unknown>();
+  const calls: DesktopRuntimeHostWslManagementInput[] = [];
+  const profile = {
+    id: 'ubuntu',
+    name: 'Ubuntu',
+    kind: 'environment' as const,
+    provider: { kind: 'wsl' as const, distribution: 'Ubuntu-24.04' },
+    rootId: 'a'.repeat(64),
+    operatorPath: '/home/operator/.local/share/maka/operator',
+  };
+  const binding = {
+    profile,
+    deployment: {
+      id: 'a'.repeat(64),
+      rootPath: '/home/operator/.config/Maka/workspaces/default',
+      deploymentId: DEPLOYMENT_ID,
+    },
+    state: 'active' as const,
+  };
+  let reconnects = 0;
+  createDesktopRuntimeHostManagement({
+    ...unusedUpdateDependencies(),
+    ipcMain: {
+      handle: (channel, handler) => handlers.set(channel, handler as (...args: unknown[]) => unknown),
+      removeHandler: (channel) => handlers.delete(channel),
+    },
+    profiles: {
+      ...unusedDirectPeerProfileDependencies(),
+      resolveManagedService: async () => binding,
+      resolveManagedAccess: async () => undefined,
+      rotateManagedCredential: async () => assert.fail('credential rotation is not expected'),
+      markManagedServiceUninstalling: async () => assert.fail('uninstall is not expected'),
+      markManagedServiceCleanupPending: async () => assert.fail('uninstall is not expected'),
+      clearManagedServiceBinding: async () => assert.fail('uninstall is not expected'),
+    },
+    runServiceManagement: async () => assert.fail('WSL must not use SSH management'),
+    runWslManagement: async (input) => {
+      calls.push(input);
+      return serviceResult(input.action);
+    },
+    runAccessManagement: async () => assert.fail('access management is not expected'),
+    cleanupManagedDeployment: async () => assert.fail('cleanup is not expected'),
+    currentHostEpoch: () => 'before-configure',
+    awaitUpdatedConnection: async () => {
+      reconnects += 1;
+    },
+  });
+
+  const run = handlers.get('runtime-host-management:run');
+  const configure = handlers.get('runtime-host-management:configure-project-directories');
+  assert.ok(run);
+  assert.ok(configure);
+  await run({}, profile.id, 'status');
+  await configure(
+    {},
+    profile.id,
+    [{ label: 'Work', path: '/srv/work' }],
+    `sha256:${'b'.repeat(64)}`,
+    false,
+  );
+
+  assert.deepEqual(calls.map(({ action, distribution, operatorPath, expectedTarget }) => ({
+    action,
+    distribution,
+    operatorPath,
+    expectedTarget,
+  })), [
+    {
+      action: 'status',
+      distribution: 'Ubuntu-24.04',
+      operatorPath: profile.operatorPath,
+      expectedTarget: {
+        serviceId: 'a'.repeat(64),
+        rootPath: '/home/operator/.config/Maka/workspaces/default',
+        rootId: 'a'.repeat(64),
+        deploymentId: DEPLOYMENT_ID,
+      },
+    },
+    {
+      action: 'configure',
+      distribution: 'Ubuntu-24.04',
+      operatorPath: profile.operatorPath,
+      expectedTarget: {
+        serviceId: 'a'.repeat(64),
+        rootPath: '/home/operator/.config/Maka/workspaces/default',
+        rootId: 'a'.repeat(64),
+        deploymentId: DEPLOYMENT_ID,
+      },
+    },
+  ]);
+  assert.equal(reconnects, 0);
+});
+
 test('identifies, rotates, and revokes managed credentials without exposing secrets', async () => {
   const handlers = new Map<string, (...args: unknown[]) => unknown>();
   const profile = {
@@ -538,6 +633,7 @@ test('publishes update progress and waits for the managed profile to reconnect',
       clearManagedServiceBinding: async () => undefined,
     },
     runServiceManagement: async () => assert.fail('ordinary management is not expected'),
+    runWslManagement: async () => assert.fail('WSL management is not expected'),
     runPeerManagement: async () => assert.fail('direct peer management is not expected'),
     directPeerClientAvailable: false,
     runUpdate: async (input, onProgress) => {
@@ -1312,6 +1408,8 @@ function serviceSummary(installedVersion: string) {
 
 function unusedUpdateDependencies() {
   return {
+    runWslManagement: async (): Promise<never> =>
+      assert.fail('WSL management is not expected'),
     runUpdate: async (): Promise<never> => assert.fail('update is not expected'),
     runUpdatePolicy: async (): Promise<never> => assert.fail('update policy is not expected'),
     runUpdateReconciliation: async (): Promise<never> =>

apps/desktop/src/main/__tests__/runtime-host-onboarding.test.ts

@@ -19,15 +19,19 @@
 
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
+import type { EnvironmentRuntimeHostProfile } from '@maka/runtime-host/client';
 import type { DesktopRuntimeHostProfileAddInput } from '../../preload/bridge-contract.js';
-import type { DesktopRuntimeHostManagedServiceTarget } from '../runtime-host-managed-services.js';
+import type {
+  DesktopRuntimeHostManagedSshServiceTarget,
+  DesktopRuntimeHostManagedWslServiceTarget,
+} from '../runtime-host-managed-services.js';
 import { createDesktopRuntimeHostOnboarding } from '../runtime-host-onboarding.js';
 
 test('persists a verified on-demand SSH profile without endpoint or credential projection', async () => {
   let setupInput: unknown;
   let saved:
     | (DesktopRuntimeHostProfileAddInput & {
-        readonly managedService?: DesktopRuntimeHostManagedServiceTarget;
+        readonly managedService?: DesktopRuntimeHostManagedSshServiceTarget;
       })
     | undefined;
   const harness = createHarness({
@@ -93,18 +97,28 @@ test('persists a verified on-demand SSH profile without endpoint or credential p
 });
 
 test('onboards WSL as a credential-free environment profile', async () => {
-  let saved: DesktopRuntimeHostProfileAddInput | undefined;
+  let saved:
+    | {
+        readonly profile: EnvironmentRuntimeHostProfile;
+        readonly managedService: DesktopRuntimeHostManagedWslServiceTarget;
+      }
+    | undefined;
   const peerTargets: string[] = [];
   const harness = createHarness({
     profiles: {
-      addAndEnable: async (input) => {
+      addManagedEnvironmentAndEnable: async (input) => {
         saved = input;
-        return { kind: 'connected', snapshot: { entries: [], defaultProfileId: 'local' } };
+        return {
+          profileId: input.profile.id,
+        };
       },
     },
     runWslSetup: async (_input, _onProgress, onComplete) => {
       onComplete();
       return {
+        serviceId: 'a'.repeat(64),
+        deploymentId: '00000000-0000-4000-8000-000000000001',
+        rootPath: '/home/operator/.config/Maka/workspaces/default',
         rootId: 'a'.repeat(64),
         operatorPath: '/home/operator/.local/share/maka/operator',
       };
@@ -121,7 +135,6 @@ test('onboards WSL as a credential-free environment profile', async () => {
   });
 
   assert.equal((result as { kind?: string }).kind, 'complete');
-  assert.equal(saved?.credential, undefined);
   assert.deepEqual(saved?.profile, {
     id: saved?.profile.id,
     name: 'Ubuntu-24.04',
@@ -130,6 +143,13 @@ test('onboards WSL as a credential-free environment profile', async () => {
     rootId: 'a'.repeat(64),
     operatorPath: '/home/operator/.local/share/maka/operator',
   });
+  assert.deepEqual(saved?.managedService, {
+    deployment: {
+      id: 'a'.repeat(64),
+      rootPath: '/home/operator/.config/Maka/workspaces/default',
+      deploymentId: '00000000-0000-4000-8000-000000000001',
+    },
+  });
   assert.deepEqual(peerTargets, ['none']);
   await harness.onboarding.close();
 });
@@ -296,7 +316,7 @@ function createHarness(overrides: HarnessOverrides = {}) {
   const onboarding = createDesktopRuntimeHostOnboarding({
     clientInstanceId: 'stable-client',
     profiles: {
-      addAndEnable: async () => assert.fail('profile must not be saved'),
+      addManagedEnvironmentAndEnable: async () => assert.fail('profile must not be saved'),
       addAndEnableVerified: async () => assert.fail('profile must not be saved'),
       ...profiles,
     },

apps/desktop/src/main/__tests__/runtime-host-profile-service.test.ts

@@ -41,7 +41,11 @@ import {
   RuntimeHostPairingFinalizationInterruptedError,
   type RuntimeHostDesktopTargetState,
 } from "../runtime-host-desktop-manager.js";
-import { createDesktopRuntimeHostManagedServiceStore } from "../runtime-host-managed-services.js";
+import {
+  createDesktopRuntimeHostManagedServiceStore,
+  findDesktopRuntimeHostManagedServiceBinding,
+  isDesktopRuntimeHostManagedSshServiceBinding,
+} from "../runtime-host-managed-services.js";
 import {
   createDesktopRuntimeHostPairingIntent,
   writeDesktopRuntimeHostPairingIntents,
@@ -272,6 +276,58 @@ test("keeps Local enabled while a new remote Host connects", async () => {
   );
 });
 
+test("reuses the existing WSL profile when the same managed Host is added again", async () => {
+  const root = await clientRoot();
+  const catalog = createClientRuntimeHostProfileCatalog(root);
+  const managedServices = createDesktopRuntimeHostManagedServiceStore(root);
+  const existing = {
+    id: "ubuntu",
+    name: "Ubuntu",
+    kind: "environment" as const,
+    provider: { kind: "wsl" as const, distribution: "Ubuntu-24.04" },
+    rootId: ROOT_ID,
+    operatorPath: "/home/operator/.local/share/Maka/runtime-host-services/operator",
+  };
+  await catalog.create(existing);
+  const enabled: string[] = [];
+  const service = createDesktopRuntimeHostProfileService({
+    clientDataRoot: root,
+    startup: await resolveDesktopRuntimeHostStartup(root, { catalog }),
+    catalog,
+    managedServices,
+    states: () => [connectingLocal()],
+    enable: async (target) => {
+      enabled.push(target.profile.id);
+    },
+    disable: async () => undefined,
+    setDefault: () => undefined,
+    finalizePairing: async () => undefined,
+  });
+  const managedService = {
+    deployment: {
+      id: ROOT_ID,
+      rootPath: "/home/operator/.config/Maka/workspaces/default",
+      deploymentId: "11111111-1111-4111-8111-111111111111",
+    },
+  };
+
+  const result = await service.addManagedEnvironmentAndEnable({
+    profile: { ...existing, id: "replacement", name: "Replacement" },
+    managedService,
+  });
+
+  assert.equal(result.profileId, existing.id);
+  assert.deepEqual((await catalog.read()).profiles, [existing]);
+  assert.deepEqual(enabled, [existing.id]);
+  assert.deepEqual(
+    findDesktopRuntimeHostManagedServiceBinding(
+      await managedServices.read(),
+      existing,
+    ),
+    { profile: existing, ...managedService, state: "active" },
+  );
+});
+
 test("reconnects an enabled remote Host with interactive SSH", async () => {
   const root = await clientRoot();
   const catalog = createClientRuntimeHostProfileCatalog(root);
@@ -711,6 +767,7 @@ test("keeps a managed Direct route on the SSH profile credential authority", asy
   };
   const managedBinding = await service.resolveManagedService(MANAGED_PROFILE.id);
   assert.ok(managedBinding);
+  assert.ok(isDesktopRuntimeHostManagedSshServiceBinding(managedBinding));
   await assert.rejects(
     service.remove(MANAGED_PROFILE.id),
     /remove the Direct peer profile/u,
@@ -786,6 +843,7 @@ test("recovers interrupted managed credential rotation after restart", async ()
   assert.equal((await catalog.resolve(MANAGED_PROFILE.id)).credential, "new-token");
   const managed = await service.resolveManagedService(MANAGED_PROFILE.id);
   assert.ok(managed);
+  assert.ok(isDesktopRuntimeHostManagedSshServiceBinding(managed));
   await assert.rejects(
     service.markManagedServiceUninstalling(managed),
     /unfinished pairing/u,