feat: support golang

[kerthcet]

What this PR does / why we need it

Which issue(s) this PR fixes

Fixes #

Special notes for your reviewer

Does this PR introduce a user-facing change?

[Copilot]

Pull request overview

This PR adds a first-class “controller” surface intended to be embedded/consumed from Go (via a Rust C ABI + Go wrapper), while also introducing daemon authentication on /ws (JWT/Ed25519 verification) and expanding controller observability (/stats includes per-daemon detail). It reorganizes the sandbox-server crate so the same Rust implementation can be built as: a native controller binary, a Python extension (feature-gated), and an FFI/staticlib for Go.

Changes:

• Add daemon token authentication on WebSocket upgrade (/ws) with an auth-enabled constructor and shared app state.
• Add a Rust C ABI (server/src/ffi.rs) + Go wrapper module (go/controller) for embedding the controller in Go.
• Expand registry stats to include per-daemon details and expose them via /stats (and FFI JSON), plus build/docs updates for controller artifacts.

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
server/src/server.rs	Adds optional auth gating for /ws, shared AppState, and richer /stats response wiring.
server/src/registry.rs	Extends RegistryStats with per-daemon detail (DaemonInfo).
server/src/python.rs	Moves Python bindings behind a python feature into a dedicated module.
server/src/main.rs	Introduces the sandd-controller binary with clap/env-based configuration and auth wiring.
server/src/lib.rs	Reorganizes crate modules for multi-consumer layout (bin, python feature, ffi feature).
server/src/ffi.rs	Adds C ABI to drive controller/registry/exec/session from non-Python hosts (e.g., Go).
server/src/auth.rs	Adds Ed25519 JWT verification (TokenVerifier), bearer parsing, and tests.
server/Cargo.toml	Adds sandd-controller bin, ffi/python feature gating, and staticlib output.
sandd/src/main.rs	Adds optional daemon bearer token header on upgrade; env var naming updates.
pyproject.toml	Ensures maturin builds the Python layer via the new python feature.
Makefile	Adds controller build targets and multi-arch Docker targets/documentation for images.
hack/docker/README.md	Updates tunnel image build guidance to use multi-arch Makefile targets.
hack/docker/Dockerfile.controller	Adds a distroless-based controller image build for the native binary.
go/go.mod	Introduces a Go module for controller bindings.
go/controller/controller.go	Implements a safe-ish Go wrapper over the Rust C ABI.
go/controller/controller_test.go	Adds Go-level tests for lifecycle, misconfig, and concurrency behavior.
examples/tunnel-simple/README.md	Updates local build instructions to use the new Make targets.
docs/proposals/TUNNEL.md	Updates tunnel image build instructions for multi-arch Make targets.
Cargo.lock	Updates lockfile for new dependencies (e.g., clap, jsonwebtoken).
.github/workflows/release.yaml	Refactors release workflow steps and checksum generation; clarifies daemon-only release artifacts.
.dockerignore	Stops excluding examples/ to keep workspace manifests parseable in Docker builds.

Suppressed comments (1)

go/controller/controller.go:533

• Session.Close can free the underlying SanddSession* while another goroutine is inside Read/Write/Resize. In particular, Read copies s.ptr under s.mu and then calls into C without holding s.mu, so a concurrent Close can sandd_session_free the same pointer, leading to use-after-free / undefined behavior.

func (s *Session) Close() error {
	s.mu.Lock()
	if s.ptr == nil {
		s.mu.Unlock()
		return nil
	}
	ptr := s.ptr
	s.ptr = nil
	s.mu.Unlock()

	if s.srv != nil {
		s.srv.forget(s)
	}
	C.sandd_session_free(ptr)
	return nil

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kerthcet]

/lgtm
/kind feature

[InftyAI-Agent]

Approved: PR has both lgtm and approved labels

[InftyAI-Agent]

Approved: PR has both lgtm and approved labels