desktop: fix two managed-SSH-spawn bugs that break every fresh remote backend spawn

[SmelterLabs]

What

Two bugs in the managed SSH spawn engine (apps/desktop/electron/remote-lifecycle.ts) that together break every fresh remote backend spawn on a stock Ubuntu host. Found while running the current tip against a real remote (Ubuntu Server 24.04, dash as /bin/sh); the lockfile-reuse path masks both bugs for already-running backends, which is likely why they went unnoticed.

Bug 1 — double shell-quoting in the spawn payload (and the stale reaper)

expandRemotePath() already returns a shell-quoted fragment like "$HOME"'/.hermes/...'. buildSpawnCommand() wrapped that output in shq() again, so the payload's reservation / lock / owner_file variables store the quote characters literally. Every mkdir "$reservation" then fails forever, and the reservation loop spins ~5 minutes per attempt while holding the box-global update mutex — with parallel spawn attempts queueing behind it on the flock. Observed live: 20+ payloads stacked on the mutex, every desktop connect timing out at 20s while the abandoned remote payloads kept spinning.

The same double-quoting sits in buildOwnedStaleTerminationCommand()'s identity guards, so every stale-backend reap REFUSEs on path mismatch.

Fix: embed expandRemotePath() output raw (it is already quoted), with comments marking the contract.

Bug 2 — bashism in lockfile publication

The payload runs under plain sh (dash on Ubuntu), but published the lockfile via ${var//__PID__/$child} — bash-only substitution. dash aborts the whole script on it after the serve child was spawned; the client sees an unknown failure, runs its error cleanup which deletes the session token file, and the just-booting serve dies on the missing token — orphaning one serve process per attempt.

Fix: POSIX sed substitution.

Tests

Two regression tests added to remote-lifecycle.test.ts:

• payload variables must keep $HOME expandable (no re-quoting after expandRemotePath())
• lockfile publication must be POSIX sh (no ${var//}; pid substituted via sed)

Both fail against the previous code; all 89 remote-lifecycle tests pass with the fix. Live-verified end to end against an Ubuntu 24.04 remote: fresh backend spawn in ~3s with correct backend.lock.json publication, and kill-recovery (dispatch probe -> retire -> respawn) in 12s.

🤖 Generated with Claude Code

[teknium1]

Merged via #96084 (rebase merge, commit pending confirmation below) — your commit cherry-picked onto current main with your authorship preserved. Both diagnoses were exactly right, and the turnaround was outstanding: the fresh-spawn path shipped in #95942 a few hours earlier with precisely the gap you hit (the engine suites drive scripted transports; the reuse path masks both bugs; only a live fresh spawn against a real remote exposes them — the test you ran). We added a dash-level E2E on top: the real buildSpawnCommand payload now executes under dash through the full reservation/mutex/publication sequence, and the pre-fix payload provably aborts. Third landed contribution of yours in this campaign — thank you.

[teknium1]

Final merge SHA: beb212d (#96084, admin-merged on the pre-authorized re-green — the rebase was conflict-only after a GitHub rate-limit window stalled the PR head sync; content identical to the CI-green 542736a, which passed 29 checks plus our dash E2E and your Ubuntu round-trip).