feat(core-ssh): tunnel through SSH in process on Windows

.github/workflows/build-linux.yml

@@ -200,6 +200,10 @@ jobs:
           esac
       - name: Clippy
         run: meson devenv -C _build cargo clippy --locked --workspace --all-targets -- -D warnings
+      - name: Clippy with the in-process SSH transport
+        run: |
+          meson devenv -C _build cargo clippy --locked --workspace --all-targets \
+            --features tablepro-ssh/in-process,tablepro-session/in-process-ssh -- -D warnings
       - name: Clippy without default features
         run: meson devenv -C _build cargo clippy --locked --workspace --all-targets --no-default-features -- -D warnings
       - name: Build
@@ -444,12 +448,14 @@ jobs:
         include:
           - package: tablepro-ssh
             apt: openssh-client
+            features: tablepro-ssh/in-process
           - package: tablepro-test-fixtures
             apt: openssh-client
           - package: tablepro-ssh
             release: openssh-9.9
             openssh: "9.9"
             apt: openssh-client
+            features: tablepro-ssh/in-process
           - package: tablepro-driver-postgres
             release: postgres-14
             postgres: "14"
@@ -525,7 +531,8 @@ jobs:
           TABLEPRO_TEST_REDIS: ${{ matrix.redis }}
           TABLEPRO_TEST_MONGO: ${{ matrix.mongo }}
           TABLEPRO_TEST_OPENSSH: ${{ matrix.openssh }}
-        run: cargo nextest run --locked --profile ci -p "$PACKAGE" --run-ignored only
+          FEATURES: ${{ matrix.features }}
+        run: cargo nextest run --locked --profile ci -p "$PACKAGE" ${FEATURES:+--features "$FEATURES"} --run-ignored only
       - name: Upload JUnit report
         if: always()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

.github/workflows/core.yml

@@ -37,6 +37,8 @@ jobs:
       # aws-lc-sys assembles x64 with NASM, which the Windows runner lacks;
       # its prebuilt objects stand in.
       AWS_LC_SYS_PREBUILT_NASM: "1"
+      # The SSH transport the Windows app runs (core ADR 0009).
+      IN_PROCESS_SSH: tablepro-ssh/in-process,tablepro-session/in-process-ssh
     defaults:
       run:
         shell: bash
@@ -58,7 +60,7 @@ jobs:
       # on Linux alone.
       - name: Check the core crates
         run: |
-          cargo check --locked --target "$TARGET" --features "$FEATURES" \
+          cargo check --locked --target "$TARGET" --features "$FEATURES" --features "$IN_PROCESS_SSH" \
             -p tablepro-core -p tablepro-net -p tablepro-storage -p tablepro-ssh -p tablepro-session \
             -p tablepro-foreign-import -p tablepro-ai -p tablepro-mcp -p tablepro-test-support -p tablepro-test-fixtures \
             -p tablepro-driver-cassandra -p tablepro-driver-clickhouse -p tablepro-driver-duckdb \
@@ -67,6 +69,28 @@ jobs:
       # The SQL Server driver's own: integrated login differs on every platform.
       - name: Core unit tests
         run: cargo test --locked --target "$TARGET" --features "$FEATURES" -p tablepro-core -p tablepro-driver-mssql --lib
+      # The transports and the drivers' relays each have a split per platform.
+      - name: Transport unit tests
+        run: |
+          cargo test --locked --target "$TARGET" -p tablepro-driver-mysql -p tablepro-driver-mongodb \
+            -p tablepro-driver-cassandra --lib
+          # The rest of net's tests read how Linux handles a full listen backlog.
+          cargo test --locked --target "$TARGET" -p tablepro-net --lib -- loopback private_
+          cargo test --locked --target "$TARGET" --features tablepro-ssh/in-process -p tablepro-ssh --lib in_process
+      - name: Start Windows' OpenSSH Server
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: scripts/ci/start-windows-sshd.ps1 -Out (Join-Path $env:RUNNER_TEMP 'tablepro-ssh')
+      - name: SSH tunnels through Windows' OpenSSH Server
+        if: runner.os == 'Windows'
+        # One login at a time: the Arm64 runner is slow to start each session's process.
+        run: cargo test --locked --target "$TARGET" --features tablepro-ssh/in-process -p tablepro-ssh --test in_process_windows -- --ignored --test-threads=1
+      - name: The OpenSSH Server's log
+        if: failure() && runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          Get-Content (Join-Path $env:ProgramData 'ssh\sshd_config') | Where-Object { $_ -notmatch '^\s*(#|$)' }
+          Get-Content (Join-Path $env:ProgramData 'ssh\logs\sshd.log') -Tail 300 -ErrorAction Continue
       # Each importer reads its app's files from this platform's own places.
       - name: Importers from other apps
         run: cargo test --locked --target "$TARGET" -p tablepro-foreign-import

.github/workflows/windows.yml

@@ -65,6 +65,14 @@ jobs:
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
+      - name: Start Windows' OpenSSH Server
+        if: matrix.name == 'x64'
+        shell: pwsh
+        run: scripts/ci/start-windows-sshd.ps1 -Out (Join-Path $env:RUNNER_TEMP 'tablepro-ssh')
+      - name: Prepare PostgreSQL for the SSH connection tests
+        if: matrix.name == 'x64'
+        shell: pwsh
+        run: windows/ci/ssh-postgres.ps1
       - name: Test the interop library
         # The test build runs cargo for the core first (windows/AGENTS.md, Commands).
         working-directory: windows
@@ -100,6 +108,10 @@ jobs:
           name: windows-screenshots-${{ matrix.name }}
           path: screenshots
           if-no-files-found: ignore
+      - name: The OpenSSH Server's log
+        if: failure() && matrix.name == 'x64'
+        shell: pwsh
+        run: Get-Content (Join-Path $env:ProgramData 'ssh\logs\sshd.log') -Tail 300 -ErrorAction Continue
 
       - name: Restore uniffi-bindgen-cs
         if: matrix.bindings