fix: resolve Debian regression findings

[whyour]

Default-root Debian containers set HOME=/home/qinglong, while OpenSSH reads /root/.ssh/config. Private SSH subscriptions now resolve the user’s home through a getter and create .ssh before writing their Include configuration. Custom UIDs without a passwd entry retain the HOME fallback.

Linux mirror configuration is saved after a successful process exit, allowing ordinary sudo/apt warnings on stderr. Nonzero exits, signals, and spawn failures do not persist the requested value. Debian and Ubuntu index refreshes use apt-get update --error-on=any, because the default command can return zero after download failures. Startup recovery records an end time for interrupted task instances while preserving unknown exit codes and completed history.

Mirror verification tests give ref-content queries enough time and check retry counts separately from deadline failure. Production polling deadlines are unchanged.

Validation:

• Backend TypeScript check/build and CLI build passed.
• Latest full backend/frontend GitHub CI suite (Node 20): 504 tests passed, with zero skips; all four APT download-failure cases executed. Backend build, execution benchmark, CodeQL, and preview checks passed. The earlier full Debian run passed 500 tests.
• Latest focused Debian run: 28 tests passed, including actual APT failures for Debian/Ubuntu with existing or empty source definitions, SSH home/permissions/rename, missing passwd entries, process outcomes, restart recovery, and subscription regressions.
• CLI: 296 passed as root, plus the permission case passed as UID 5432 (297 effective passes).
• Mirror notification tests passed 10 consecutive runs.
• Live Debian root SSH pull/rename and a pull after restart passed; forced restart finalized the interrupted instance. Mirror persistence passed with actual sudo stderr and an empty local apt-source fixture.

Live validation loaded three rebuilt backend modules into debian-dev digest sha256:e6e283114afecb3dd1157e21dc8a83eed79b93494955cdfa83b50082595031a8; the APT cases execute the generated updater from current source in a separate container. These are focused post-fix checks following the earlier two-hour regression, rather than another two-hour soak or a newly published image.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
qinglong	Ready	Preview	Oct 8, 2026 5:07pm UTC
qinglong-back	Ready	Preview	Oct 8, 2026 5:07pm UTC