Runtime page, Linux arm64, and dependency audit (0.5.0)

.github/workflows/desktop.yml

@@ -17,6 +17,10 @@ jobs:
             platform: darwin-arm64
           - runner: ubuntu-24.04
             platform: linux-x64
+            ssh-platform: linux/amd64
+          - runner: ubuntu-24.04-arm
+            platform: linux-arm64
+            ssh-platform: linux/arm64
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4
@@ -38,6 +42,8 @@ jobs:
           if-no-files-found: error
       - name: Real SSH acceptance on an offline host
         if: runner.os == 'Linux'
+        env:
+          OXBIT_SSH_TEST_PLATFORM: ${{ matrix.ssh-platform }}
         run: bun run remote:test
   build:
     needs: remote-runtime
@@ -51,6 +57,8 @@ jobs:
             platform: darwin-arm64
           - runner: ubuntu-24.04
             platform: linux-x64
+          - runner: ubuntu-24.04-arm
+            platform: linux-arm64
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4

.github/workflows/language-servers.yml

@@ -19,7 +19,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runner: [macos-26, ubuntu-24.04]
+        runner: [macos-26, ubuntu-24.04, ubuntu-24.04-arm]
     runs-on: ${{ matrix.runner }}
     env:
       OXBIT_LSP_REPORT: evidence/language-milestone1/real-servers.json

.github/workflows/release.yml

@@ -18,6 +18,8 @@ jobs:
             platform: darwin-arm64
           - runner: ubuntu-24.04
             platform: linux-x64
+          - runner: ubuntu-24.04-arm
+            platform: linux-arm64
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4
@@ -103,6 +105,65 @@ jobs:
           name: remote-manifest
           path: release-files/remote-runtime-manifest.json
           if-no-files-found: error
+  # Linux arm64 is published when it builds; its failure does not block the release.
+  linux:
+    needs: remote-runtime
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            platform: linux-x64
+          - runner: ubuntu-24.04-arm
+            platform: linux-arm64
+    runs-on: ${{ matrix.runner }}
+    continue-on-error: ${{ matrix.platform == 'linux-arm64' }}
+    timeout-minutes: 120
+    env:
+      OXBIT_REMOTE_PAYLOADS: ${{ github.workspace }}/.desktop-cache/remote-payloads
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24.20.0"
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.4.2"
+      - name: Linux native dependencies (Ubuntu 24.04 minimum)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential python3 pkg-config libssl-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev patchelf libxdo-dev libfuse2t64 xdg-utils xvfb dbus-x11
+      - run: rustup toolchain install 1.97.1 --profile minimal
+      - run: bun install --frozen-lockfile
+      - run: bun run build
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: remote-runtime-*
+          path: .desktop-cache/remote-payloads
+      - name: Build and sign the updater AppImage and .deb
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          OXBIT_UPDATER_PUBLIC_KEY: ${{ vars.OXBIT_UPDATER_PUBLIC_KEY }}
+        run: bun run desktop:release
+      - name: Installed package smoke checks
+        run: |
+          bundle=apps/desktop/src-tauri/target/release/bundle
+          sudo apt-get install -y ./"$bundle"/deb/*.deb
+          xvfb-run -a dbus-run-session -- bun run desktop:test:installed -- /usr/bin/oxbit-desktop
+          sudo apt-get remove -y "$(dpkg-deb --field "$bundle"/deb/*.deb Package)"
+          APPIMAGE_EXTRACT_AND_RUN=1 xvfb-run -a dbus-run-session -- node scripts/desktop/installed-smoke.mjs "$(realpath "$bundle"/appimage/*.AppImage)"
+      - name: Collect release files
+        run: |
+          bundle=apps/desktop/src-tauri/target/release/bundle
+          mkdir -p release-files
+          cp "$bundle"/deb/*.deb "$bundle"/appimage/*.AppImage "$bundle"/appimage/*.AppImage.sig release-files/
+          ls -l release-files
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-${{ matrix.platform }}
+          path: release-files/
+          if-no-files-found: error
   # The pinned manifest records the darwin payload after the macos job signs and repacks it.
   ios:
     needs: [remote-runtime, macos]
@@ -181,7 +242,7 @@ jobs:
           path: release-files/
           if-no-files-found: error
   publish:
-    needs: [macos, ios]
+    needs: [macos, ios, linux]
     if: github.ref_type == 'tag' && github.repository == 'yannelli/oxbit'
     runs-on: ubuntu-24.04
     permissions:

README.md

@@ -45,13 +45,17 @@ See [npm packages](docs/npm.md).
 | `oxbit -f` | Keep the runtime attached to the terminal |
 | `oxbit --no-open` | Start without opening a browser |
 | `oxbit --port 9300` | Choose a port for a new runtime; stop an existing one first |
+| `oxbit --lan` | Serve on your network and advertise the runtime to the iOS app |
+| `oxbit --keep-alive 1h` | Stop the runtime after an hour with no connected client |
 | `oxbit --help` | Show all options |
 
-The first runtime uses port 9277. Later runtimes choose a free port and record it
-in `~/.oxbit/workspaces/<id>/daemon.json`. The printed URL includes a pairing code
-in its fragment, which the editor consumes and removes from the address bar.
-Opening `http://127.0.0.1:9277` without that fragment loads the browser sample
-workspace; use **Runtime connection** to pair it with your project.
+Each runtime binds a port the operating system assigns, unless `--port` or `PORT`
+sets one, and records it in `~/.oxbit/workspaces/<id>/daemon.json`. The printed URL
+includes a pairing code in its fragment, which the editor consumes and removes from
+the address bar. Opening the runtime URL without that fragment loads the browser
+sample workspace; the cloud button in the title bar opens the **Runtime** page,
+where you pair the runtime with its printed code. Later, one tap on the cloud button
+reconnects to the last runtime.
 
 Without a global install, run `OXBIT_WORKSPACE=/absolute/path bun run start` after
 building. See [runtime configuration](docs/runtime.md) for network hosting,
@@ -62,11 +66,11 @@ allowed origins, and storage.
 ### Desktop
 
 The Tauri desktop app bundles Node, ripgrep, the terminal addon, and managed
-language services. It targets Apple Silicon with macOS 26+ and Ubuntu 24.04+ x64.
+language services. It targets Apple Silicon with macOS 26+ and Ubuntu 24.04+ x64 and arm64.
 Run `bun run desktop:dev` for development or `bun run desktop:build` for local installers.
 Use `oxbit --desktop [path]` to open an installed app.
 
-**Connect over SSH…** opens a remote folder on Linux x64 or macOS Apple Silicon.
+**Connect over SSH…** opens a remote folder on Linux x64, Linux arm64, or macOS Apple Silicon.
 Oxbit installs its headless runtime through SSH; the remote host does not need
 Node or npm for the bundled runtime.
 
@@ -82,7 +86,7 @@ GitHub tokens and runtime pairing credentials are stored in Keychain.
 
 Run `bun run ios:dev "Oxbit iPhone"` or `bun run ios:simulator` on macOS with Xcode.
 See [iOS setup and runtime connections](docs/ios.md).
-The [documentation index](docs/INDEX.md) links native source control, SSH and SFTP, and language-server guides with official API references.
+The [documentation index](docs/INDEX.md) links native source control, SSH and SFTP, language-server, runtime discovery and keep-alive guides with official API references.
 The [iOS release artwork guide](docs/ios-release-assets.md) covers icon exports,
 App Store screenshots, and promo exports with Apple's design and size references.
 
@@ -155,7 +159,8 @@ watchers.
 | `examples/` | Extension and icon-pack examples |
 
 See [architecture](docs/architecture.md), [feature status](docs/feature-status.md),
-[dependencies](docs/dependencies.md), and [design assets](design/README.md).
+[dependencies](docs/dependencies.md), [dependency audits](docs/security.md#dependency-audit),
+and [design assets](design/README.md).
 
 ### Checks
 

apps/desktop/package.json

@@ -19,7 +19,8 @@
     "react": "19.1.0",
     "react-dom": "19.1.0",
     "@tauri-apps/api": "2.11.1",
-    "@oxbit/themes": "workspace:*"
+    "@oxbit/themes": "workspace:*",
+    "@oxbit/protocol": "workspace:*"
   },
   "devDependencies": {
     "@tauri-apps/cli": "2.11.4",

apps/desktop/src-tauri/src/commands.rs

@@ -290,6 +290,7 @@ pub async fn desktop_connection(
     window: WebviewWindow,
     key: String,
     restart: Option<bool>,
+    keep_alive: Option<u64>,
 ) -> Result<Value, String> {
     let project = authorized(&app, &window, &key)?;
     tauri::async_runtime::spawn_blocking(move || {
@@ -313,8 +314,8 @@ pub async fn desktop_connection(
         let progress_app = app.clone(); let progress_key = key.clone();
         let process = OwnedRuntime::launch(&resource.join("bin/node"), &resource.join("desktop.js"), Launch {
             version: 1, r#type: "launch", root: &project.path, data_dir: &data.to_string_lossy(), workspace_key: &key, token: &token,
-            rg_path: &resource.join("bin/rg").to_string_lossy(), git_path: git.as_deref(), development: cfg!(debug_assertions) && !cfg!(feature = "custom-protocol"),
-        }, &desktop.environment, move || { let _ = event_app.emit("desktop-runtime-failed", json!({"key":event_key})); }, move |message| { let _ = progress_app.emit("desktop-remote-progress", json!({"key":progress_key,"message":message})); })?;
+            rg_path: &resource.join("bin/rg").to_string_lossy(), git_path: git.as_deref(), development: cfg!(debug_assertions) && !cfg!(feature = "custom-protocol"), keep_alive,
+        }, &desktop.environment, move |detail| { let _ = event_app.emit("desktop-runtime-failed", json!({"key":event_key,"detail":detail})); }, move |message| { let _ = progress_app.emit("desktop-remote-progress", json!({"key":progress_key,"message":message})); })?;
         // Ownership can change while the runtime starts. Never return credentials to a former owner.
         desktop.model.lock().unwrap().authorize(window.label(), &key)?;
         let result = json!({"url":format!("http://127.0.0.1:{}", process.port), "token":token, "key":key, "openFile":process.open_file});