Architecture review fixes: PTY starvation, persistence durability, remote/mobile leaks

[matej21]

Architecture review fixes + remote server TLS

Implements the High findings and the highest-value low-risk Medium findings from a 10-area parallel architecture review, and turns the originally-deferred remote TLS item into a full implementation (server + desktop client + mobile Rust). Each fix is an isolated commit; full workspace builds, clippy (-D warnings) is clean, and all touched test suites pass (okena-layout 56, okena-workspace 276, okena-core client 71, plus a new TLS handshake integration test).

High

• PTY UI starvation (src/app/mod.rs) — the central PTY event loop drained the whole bounded channel and ran the full ANSI/VTE parse synchronously on the GPUI thread with no yield, so one high-bandwidth terminal (cat hugefile, yes, a runaway build log) starved input/render/resize and every other terminal. Added a 256 KiB per-turn byte budget + yield_now(); undrained events stay queued (nothing dropped). Also drops the terminals-registry lock before parsing (a keystroke/resize/kill on another terminal no longer blocks behind a large parse).
• Persistence latch → silent data loss (persistence.rs) — deleting the last project set LOADED_FROM_DEFAULT and permanently disabled all saves for the session (silently, save returned Ok), reverting on next launch. Empty-save is now skipped only when we actually loaded from a fallback default this session; a genuine user delete persists.
• Crash-unsafe settings save (settings.rs) — added fsync before the atomic rename (mirrors the workspace save path).
• close_terminal drift (actions/layout/close.rs) — close hand-rolled the remove/collapse/clamp logic that LayoutNode::remove_at_path already implements (and tests_simulate had a third copy), so the well-tested remove_at_path_* unit tests didn't guard the shipped path. Delegated to remove_at_path; kept the last-pane→bookmark branch and the active-tab focus-preservation delta. Follow-up fix: the focus-preservation step double-decremented active_tab when closing a tab before a last active tab (it overlapped remove_at_path's own clamp), landing focus one tab too far left — now sets the index absolutely, with a regression test for the last-active-tab case.
• Unencrypted remote exposure (remote/server.rs, settings UI) — the remote server had no TLS; bound beyond loopback, the token + entire PTY stream (passwords, SSH keys) crossed the network in cleartext. Shipped as a loud warn! + reworded UI hint first, then fully fixed by the TLS work below.
• Mobile connection leak (mobile/native/src/client/manager.rs) — connections were never removed from the manager map, leaking RemoteClients, alacritty grids, and event tasks on every reconnect/re-pair. Added remove_connection and replace-by-host:port in add_connection.

Medium

• Layout active_tab clamp — normalize() now clamps Tabs.active_tab (the single choke point) so a stale/out-of-range index can't reach children[active_tab] and panic.
• Atomic session/export writes (sessions.rs) — save_session/export_workspace used non-atomic fs::write; routed through a shared tmp + fsync + rename helper.
• Rename-based .bak (persistence.rs) — rolling backup was a non-atomic fs::copy a crash could truncate; now an atomic rename, with the corrupt-deserialize path guarded so it can't clobber the sole surviving good copy.
• reqwest client reuse (okena-core remote client) — stop building a fresh reqwest::Client per state_changed event; reuse the session client (shares the connection pool).
• Docs — corrected the crate count and added the missing okena-ext-github to the crate table.

Remote server TLS (https/wss + certificate pinning)

Encrypts the remote control channel end-to-end. Trust model is self-signed cert + Trust-On-First-Use pinning with out-of-band fingerprint verification (SSH-style) — appropriate for a LAN tool with no CA. Rolled out secure-by-default without breaking existing plain-http setups.

• Server (src/remote/tls.rs, serve.rs, server.rs) — generates and persists a self-signed cert in the config dir (remote_cert.pem / remote_key.pem), reused across restarts so the pinned fingerprint stays stable. Serving is dual-stack on a single port: a custom accept loop peeks the first byte (0x16 = TLS ClientHello) and routes each connection to either the rustls acceptor or plain HTTP (via hyper-util's auto builder). So enabling TLS does not break already-paired plain-http clients — they keep working while new/auto clients negotiate TLS. The cert's SHA-256 fingerprint is logged, surfaced in Settings, and written to remote.json.
• Client (okena-core — shared by desktop + mobile) — a rustls PinnedCertVerifier trusts the server cert purely by its pinned SHA-256 (None → TOFU capture, Some → exact match, no downgrade), while still verifying the handshake signature against the presented key (aws_lc_rs). One ClientConfig drives both reqwest and tokio-tungstenite. RemoteConnectionConfig gains tls + pinned_cert_sha256 (serde-default, back-compatible). On connect the client auto-detects scheme (https-first, http fallback) and auto-upgrades a previously-plain connection to TLS, pinning the cert and persisting it.
• Desktop UI — connect dialog auto-detects TLS and, after a TLS pair, shows the captured fingerprint and requires explicit confirmation before trusting the pin (closes the first-connect MITM window). Settings has an "Encrypt with TLS" toggle + the server fingerprint for verification. The sidebar flags plain-http connections with a "⚠ no TLS" badge and a right-click "Upgrade to TLS" action (flips the connection to TLS + re-pairs).
• Secure-by-default + BC — remote_tls_enabled defaults on (including for existing configs missing the key); safe because the server is dual-stack. Explicit opt-out is honored. Verified across a client × server × version × settings compatibility matrix; the key path (new TLS server × old/plain client on one port) is covered by an integration test that drives the real dual-stack server and asserts plain http, pinned https (TOFU capture), and wrong-pin rejection.
• Mobile — the Rust stack is TLS-capable (manager threads tls + pins the cert); exposing the toggle in the Flutter UI needs a flutter_rust_bridge codegen pass and is left as a marked TODO.

Deferred (flagged, larger follow-ups)

PROTO_VERSION negotiation + typed WsOutbound parsing on the client; refresh_windows() invalidation scoping; WorkspaceData.projects Vec→index; extension failure-isolation; enabling clippy::unwrap_used workspace lint; mobile Flutter TLS toggle (Rust side ready, needs codegen + UI).

🤖 Generated with Claude Code