[Workbench T12] 交付跨平台远程浏览器切片

[TablewareBox]

Parent

UniLab Authoring Workbench v1 技术 Spec

What to build

Workbench Backend、OS、Agent 与 Workspace 在同一台 macOS、Linux 或 Windows 主机运行，用户通过统一的鉴权浏览器门面远程使用全部 v1 能力。认证、会话租约和代理协议只实现一次；平台差异限制在 launchd、systemd 与 Windows Task Scheduler 启动适配层。

Current contract

T9 HardwareDebugSession/逐次批准已按冻结决策废弃；远程切片沿用 T8：普通 Workbench 可启动当前 Workspace 内任意设备图，Normal/Dry-run 均记录完整审计，不另建真机会话门禁。共享 VS Code Extension 已由 T10 发布。

Acceptance criteria

• Theia 与控制端点只监听 loopback，浏览器只访问 Workbench 鉴权门面
• macOS、Linux、Windows 共用同一 remote-access/v1 认证、HTTP 与 WebSocket 代理实现
• Workspace、OS、Agent 同主机语义在远程浏览器下保持
• per-start token 绑定 PID/port/generation，过期或错配请求被拒绝
• launchd、systemd、Windows Task Scheduler 只做进程托管并共享同一环境配置合同
• 三个平台的原生 watcher、ripgrep、terminal 与 Python 环境 PATH 进入兼容矩阵
• 无桌面启动、刷新重连、断网恢复、更新和安全退出路径通过
• 远程诊断默认脱敏 token、Secrets、对话正文和敏感路径
• 未完成实机验收的平台保持 unverified，不以其他平台测试冒充支持证据

Prerequisites

• [Workbench T8] 任意 Workspace 设备图启动与审计记录
• [Workbench T10] 发布共享 VS Code Extension

[TablewareBox]

开始 T12。实现边界先冻结为：Theia/OS/Agent 控制面仅监听 127.0.0.1；新增单一远程 HTTP/WebSocket 鉴权门面；每次启动生成随机 token 并与 PID、门面端口、generation 绑定；浏览器只持有该门面的会话凭据。先完成可在当前 macOS 上运行的协议/集成测试和 headless harness，再把 Linux 发行/服务管理的环境差异单独验收。

[github-actions]

GitHub → Feishu OKF synchronization

Feishu snapshot: Uni-Lab-Core #208
Knowledge stage: testing
Issue updated: 2026-08-10T10:05:07Z

[TablewareBox]

T12 implementation merged in uni-lab-fe#30 (52d67b0).

Implemented one cross-platform remote-access/v1 facade, shared Electron/remote browser session control, per-start PID/port/generation capabilities, HTTP+WebSocket proxying, diagnostic redaction, shutdown cleanup, native dependency matrix, and launchd/systemd/Windows Task Scheduler adapters.

macOS arm64 real acceptance passed: Electron and remote in-app browser concurrently used the same Workspace/backend/OS PID; login fragment was scrubbed; refresh reconnected; stop preserved local Theia/OS while releasing the remote port/file/lease; restart rotated generation and rejected the old credential. Unit/integration gates: Workbench 29/29, Theia 5/5, Desktop 121/121, WorkbenchSession 29/29, both builds and frontend quality gate passed.

Remaining acceptance evidence is platform-host testing, not hidden implementation debt: the available Linux x64 host is reachable but lacks the pinned Node/pnpm runtime; no Windows host is available. Linux and Windows therefore remain explicitly unverified in compatibility.json as required.