Add CLI companion and read-only SSH repository inspection

.github/workflows/ci.yml

@@ -55,14 +55,17 @@ jobs:
       - name: Test strand-core
         run: cargo test -p strand-core
 
+      - name: Test Strand companion
+        run: cargo test -p strand-ops -p strand-headless
+
       - name: Test strand-tauri
         run: cargo test -p strand-tauri
 
       - name: Test Azure DevOps Server helper
         run: cargo test -p strand-azdo-protocol -p strand-azdo
 
       - name: Clippy (deny warnings)
-        run: cargo clippy -p strand-core -p strand-tauri -p strand-azdo-protocol -p strand-azdo -- -D warnings
+        run: cargo clippy -p strand-core -p strand-tauri -p strand-ops -p strand-headless -p strand-azdo-protocol -p strand-azdo -- -D warnings
 
   windows-helper:
     name: Azure DevOps Server helper (Windows)

.gitignore

@@ -5,6 +5,8 @@
 # Tauri build artifacts
 /crates/strand-tauri/gen/
 /crates/strand-tauri/target/
+/crates/strand-tauri/binaries/*
+!/crates/strand-tauri/binaries/.gitkeep
 
 # Node / Vite
 node_modules/

Cargo.toml

@@ -4,6 +4,8 @@ members = [
     "crates/strand-azdo",
     "crates/strand-azdo-protocol",
     "crates/strand-core",
+    "crates/strand-headless",
+    "crates/strand-ops",
     "crates/strand-tauri",
 ]
 

README.md

@@ -71,6 +71,13 @@ the resolved app appearance automatically.
 
 ## Features
 
+- **Read-only command line companion** — `strand status/log/diff/review`
+  works without the desktop; `--json` emits a versioned typed payload and
+  `strand schema` describes it. Full-file review context uses the same engine
+  as the app. Settings → Integrations installs `strand` in
+  your user command directory. `strand PATH` opens and focuses a repository
+  in the existing desktop instance, including paths with spaces.
+
 - **More hosting providers** — GitLab merge requests and Bitbucket Cloud pull
   requests use the review workspace, with paged lists, comments, inline threads
   and supported review decisions. GitHub Enterprise/custom hosts use their own
@@ -341,6 +348,11 @@ the resolved app appearance automatically.
   Review findings are structured, path/line-validated, stale-diff guarded, and
   require explicit acceptance before they become notes; repository files are
   never changed by an AI review.
+- **Read-only SSH repositories** — inspect remote status, history, full-context
+  reviews and bounded file snapshots through system OpenSSH, with watching,
+  connection health, cancellation and reconnect. Requires a manually installed
+  compatible companion on the POSIX host; see the
+  [setup guide](./website/docs/remote-repositories.md).
 - **Fast by design** — reads go through [gix](https://github.com/GitoxideLabs/gitoxide),
   writes through git2 and your system `git`. Performance targets live in
   [`PRD.md`](./PRD.md) §8 and are measured in
@@ -403,6 +415,8 @@ calls, so `pnpm dev` is useful for UI work without a Rust build.
 strand/
 ├── crates/
 │   ├── strand-core/           # Git engine (gix for reads, git2 for writes)
+│   ├── strand-headless/       # CLI launcher, read-only companion and stdio engine
+│   ├── strand-ops/            # Shared read operations and versioned wire types
 │   ├── strand-azdo-protocol/  # Shared optional-helper JSON contract
 │   ├── strand-azdo/           # Azure DevOps Server REST helper CLI
 │   └── strand-tauri/          # Tauri 2 app shell + IPC commands

ROADMAP.md

@@ -2148,7 +2148,10 @@ and Store certification remain external gates.
   destination. With no saved layout it is the existing full-size Work surface;
   customization composes registered Strand surfaces into nested panes with
   per-workspace persistence, templates, and one stable live Work runtime.
-- **Remote repos over SSH** — open a repo on a remote machine (agent
+- ◐ **Remote repos over SSH** — read-only inspector, shared stdio companion,
+  bounded watches/files and system-SSH lifecycle shipped locally 2026-09-06.
+  Automatic installation/distribution and ordinary remote tabs remain open.
+  Target: open a repo on a remote machine (agent
   devbox, VPS) and use Strand locally against it. Headless `strandd`
   daemon over JSON-RPC/stdio, system `ssh` for auth/transport (Strand
   never touches credentials). Designed 2026-06-12: `docs/remote-ssh.md`
@@ -2178,7 +2181,7 @@ and Store certification remain external gates.
   preservation fixtures and native lifecycle/keyboard checks pass.
 - ☑ Repository/ref/file custom actions with safe argv templates
   (`UserActionsEditor`, context menus / Quick Launch, `UserActionDialog`)
-- **CLI companion binary (`strand`)** — `strand <path>` opens the repo
+- ◐ **CLI companion binary (`strand`)** — `strand <path>` opens the repo
   in the app; `strand diff/log/status/review --json` gives AI agents
   typed, full-context data the `git` porcelain can't (same serde types
   as the IPC layer). Read-only by design — no push/pull, no writes.
@@ -2855,6 +2858,31 @@ as did the frontend typecheck and five focused frontend tests.
 
 ---
 
+**F16 launcher shipped locally (2026-09-06):** The bundled `strand-cli`
+companion installs as the user's `strand` command from Settings → Integrations
+and the palette. A single-instance argv inbox opens requested repositories
+after session restore and focuses the existing window. Read commands and SSH
+transport follow in separately verified changes.
+
+**F16 read companion shipped locally (2026-09-06):** `strand-ops` and the clap
+front-end provide headless status/snapshot, log/file history, diff variants,
+full-context review, and derived JSON schemas. Machine results share the
+desktop serde types in schema-v1 envelopes; errors and output limits are
+explicit, with no Git mutation or implicit lazy fetch. Terminal syntax colors,
+blame/conflicts and standalone distribution remain in the expanded CLI backlog.
+
+**F17 SSH read foundation shipped locally (2026-09-06):** The same companion
+now serves protocol-v1 JSON-RPC on stdio. `RemoteRepos` uses system OpenSSH with
+strict host checking, multiplexed bounded reads, keepalives, retry deadlines and
+process-tree cancellation. The read-only inspector shows status, history,
+full-context diffs/reviews and versioned file chunks, with coalesced watching,
+visible execution context, recents and manual reconnect. Local commands remain
+in process. Windows WebView2 and real system-SSH loopback verification covered
+watch changes, stale chunks, reconnection, malformed peers, cancellation and
+host-key rejection; see `docs/cli-ssh-verification-2026-09-06.md`. Native host
+release validation, signed static artifacts/SFTP bootstrap and ordinary remote
+tabs remain explicitly open.
+
 **Hosted adapters shipped (2026-09-06):** GitLab merge requests and Bitbucket
 Cloud pull requests share the existing review workspace, with paged collections,
 provider-specific inline coordinates, permission-gated controls and explicit