OldKrab · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026
@@ -15,7 +15,7 @@ on:
   push:
     branches: [main, 'android/**']
   pull_request:
-    paths: ['apps/android/**', '.github/workflows/android.yml']
+    paths: ['apps/android/**', 'openaide-rs/android-ssh/**', 'openaide-rs/remote-client/**', '.github/workflows/android.yml']
 
 permissions:
   contents: read
@@ -56,12 +56,34 @@ jobs:
         with:
           name: android-browser-diagnostics
           path: test-results/
+  version:
+    # The version the APK reports, stamped into the Linux App Server test builds carry.
+    if: ${{ !inputs.release }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      version: ${{ steps.read.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - id: read
+        run: echo "version=$(node -p 'require("./package.json").version')" >> "$GITHUB_OUTPUT"
+  linux-app-server:
+    # A release has already built this artifact in the calling workflow.
+    if: ${{ !inputs.release }}
+    needs: version
+    uses: ./.github/workflows/build-app-server-target.yml
+    with:
+      target: linux-x64-musl
+      version: ${{ needs.version.outputs.version }}
   apk:
     # Test builds carry the App Server built from the same commit, so local work
     # can be tried before the version is published. Releases download the published one.
-    needs: runtime
+    needs: [runtime, linux-app-server]
+    # The Linux App Server job is skipped in releases, which would skip this job too.
+    if: ${{ !cancelled() && needs.runtime.result == 'success' && (inputs.release || needs.linux-app-server.result == 'success') }}
     runs-on: ubuntu-24.04
-    timeout-minutes: 20
+    # Includes building the SSH client library and its bindings.
+    timeout-minutes: 35
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
@@ -72,6 +94,26 @@ jobs:
       - name: Carry the runtime in test builds
         if: ${{ !inputs.release }}
         run: echo "BUNDLED_RUNTIME=-PopenaideBundledRuntime=$RUNNER_TEMP/runtime/openaide-app-server-android-arm64.tar.gz" >> "$GITHUB_ENV"
+      # SSH Computers upload the Linux App Server only if its SHA-256 is built in. The release
+      # pins the binary published beside this APK; test builds carry the one from this commit.
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          name: app-server-linux-x64-musl
+          path: ${{ runner.temp }}/linux-app-server
+      - name: Pin the Linux App Server for SSH Computers
+        if: ${{ inputs.release }}
+        run: |
+          sha="$(openssl dgst -sha256 -r "$RUNNER_TEMP/linux-app-server/openaide-app-server" | cut -d ' ' -f 1)"
+          test "${#sha}" -eq 64
+          echo "SSH_APP_SERVER=-PopenaideSshAppServerSha256=$sha" >> "$GITHUB_ENV"
+      # The SSH client is a Rust library the APK carries.
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
+        with:
+          toolchain: 1.97.1
+          targets: aarch64-linux-android
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
+        with:
+          shared-key: android-ssh
       - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
         with:
           distribution: temurin
@@ -82,11 +124,17 @@ jobs:
       - uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd
         with:
           packages: platform-tools
-      - run: sdkmanager 'platforms;android-35' 'build-tools;35.0.0'
+      - run: sdkmanager 'platforms;android-35' 'build-tools;35.0.0' 'ndk;27.2.12479018'
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version-file: .node-version
           cache: npm
+      - name: Carry the Linux App Server in test builds
+        if: ${{ !inputs.release }}
+        run: |
+          version="$(node -p 'require("./package.json").version')"
+          node scripts/package-app-server-archive.mjs "$RUNNER_TEMP/linux-app-server/openaide-app-server" "$version" "$RUNNER_TEMP/ssh-archive"
+          echo "SSH_APP_SERVER=-PopenaideSshAppServerArchive=$RUNNER_TEMP/ssh-archive/openaide-app-server-linux-x64-$version.tar.gz" >> "$GITHUB_ENV"
       - name: Build the Frontend shipped in the APK
         run: |
           npm ci
@@ -122,11 +170,12 @@ jobs:
       # Release workflow adds the version.
       - name: Check and build APKs
         run: |
-          gradle -p apps/android --no-daemon $BUNDLED_RUNTIME testDebugUnitTest lintDebug assembleDebug assembleDebugAndroidTest
+          gradle -p apps/android --no-daemon $BUNDLED_RUNTIME $SSH_APP_SERVER testDebugUnitTest lintDebug assembleDebug assembleDebugAndroidTest
+          cp apps/android/app/build/outputs/apk/debug/app-debug.apk apps/android/build/openaide-android-debug.apk
       - name: Build user APK
         if: steps.key.outputs.staged == 'true'
         run: |
-          gradle -p apps/android --no-daemon $BUNDLED_RUNTIME assembleRelease
+          gradle -p apps/android --no-daemon $BUNDLED_RUNTIME $SSH_APP_SERVER assembleRelease
           cp apps/android/app/build/outputs/apk/release/app-release.apk apps/android/build/openaide-android.apk
       - name: Remove the signing key
         if: always() && steps.key.outputs.staged == 'true'

@@ -184,7 +184,7 @@ jobs:
 
   desktop-darwin-arm64:
     if: needs.prepare.outputs.desktop_darwin_arm64 == 'true'
-    needs: [prepare, server-darwin-arm64]
+    needs: [prepare, server-darwin-arm64, server-linux-x64-musl]
     uses: ./.github/workflows/package-desktop-target.yml
     with:
       target: darwin-arm64

@@ -80,11 +80,17 @@ jobs:
         with:
           name: app-server-${{ inputs.target }}
           path: app-server
+      # Windows bundles it for WSL; every Desktop pins its checksum for SSH Computers.
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
-        if: inputs.target == 'win32-x64'
         with:
           name: app-server-linux-x64-musl
           path: wsl-app-server
+      - name: Pin the Linux App Server for SSH Computers
+        shell: bash
+        run: |
+          sha="$(openssl dgst -sha256 -r wsl-app-server/openaide-app-server | cut -d ' ' -f 1)"
+          test "${#sha}" -eq 64
+          echo "OPENAIDE_SSH_APP_SERVER_SHA256=$sha" >> "$GITHUB_ENV"
       - name: Restore App Server executable permission
         if: runner.os != 'Windows'
         run: chmod +x "app-server/${{ steps.target.outputs.binary }}"

@@ -63,7 +63,8 @@ jobs:
       enable_windows_updates: true
 
   android-artifacts:
-    needs: validate
+    # The APK pins the Linux App Server that SSH Computers run, built by artifacts.
+    needs: [validate, artifacts]
     uses: ./.github/workflows/android.yml
     secrets: inherit
     with:

@@ -295,6 +295,10 @@ _Avoid_: Host as a product term
 A phone or computer other than the one running the App Server whose App Shell connects to that App Server as a regular client. It is trusted because it was paired, has full access, and stays trusted until any client removes it.
 _Avoid_: Account, login, linked phone
 
+**Terminal**:
+The user's own interactive shell on the App Server's computer, opened from a Project or Task and starting in its folder. It belongs to no Task, outlives the clients viewing it, and ends when closed, when its shell exits, or when App Server stops.
+_Avoid_: Console, Agent terminal, treating a Terminal as Task context
+
 **Pairing Code**:
 A short plain-text code, also drawn as a QR code, that adds a Remote Device. Either a trusted client shows a single-use code the new device reads, or the new device shows a code a trusted client reads and confirms.
 _Avoid_: Password, token, invite link