feat(cli): add --ssh-mode embedded flag to okdev up

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: acmore

internal/cli/up.go

@@ -19,11 +19,15 @@ func newUpCmd(opts *Options) *cobra.Command {
 	var waitTimeout time.Duration
 	var dryRun bool
 	var tmux bool
+	var sshMode string
 
 	cmd := &cobra.Command{
 		Use:   "up",
 		Short: "Create or resume a dev session",
 		RunE: func(cmd *cobra.Command, args []string) error {
+			if sshMode != "sidecar" && sshMode != "embedded" {
+				return fmt.Errorf("invalid --ssh-mode %q: must be \"sidecar\" or \"embedded\"", sshMode)
+			}
 			ui := newUpUI(cmd.OutOrStdout(), cmd.ErrOrStderr())
 			// Keep legacy config-path announce quiet for this command; we render it in staged output.
 			prevQuiet, hadQuiet := os.LookupEnv("OKDEV_QUIET_CONFIG_ANNOUNCE")
@@ -88,6 +92,7 @@ func newUpCmd(opts *Options) *cobra.Command {
 				cfg.WorkspaceMountPath(),
 				cfg.Spec.Sidecar.Image,
 				enableTmux,
+				sshMode == "embedded",
 				preStopCmd,
 			)
 			if err != nil {
@@ -200,6 +205,7 @@ func newUpCmd(opts *Options) *cobra.Command {
 	cmd.Flags().DurationVar(&waitTimeout, "wait-timeout", 3*time.Minute, "Wait timeout for pod readiness")
 	cmd.Flags().BoolVar(&dryRun, "dry-run", false, "Preview actions without applying resources")
 	cmd.Flags().BoolVar(&tmux, "tmux", false, "Enable tmux persistent shell sessions in the sidecar")
+	cmd.Flags().StringVar(&sshMode, "ssh-mode", "sidecar", "SSH server mode: sidecar (default) or embedded")
 	return cmd
 }
 

internal/kube/podspec.go

@@ -10,7 +10,7 @@ import (
 
 var semverTagPattern = regexp.MustCompile(`^v?\d+\.\d+\.\d+([.-][0-9A-Za-z.-]+)?$`)
 
-func PreparePodSpec(podSpec corev1.PodSpec, volumes []corev1.Volume, workspaceMountPath, sidecarImage string, tmux bool, preStop string) (corev1.PodSpec, error) {
+func PreparePodSpec(podSpec corev1.PodSpec, volumes []corev1.Volume, workspaceMountPath, sidecarImage string, tmux bool, embeddedSSH bool, preStop string) (corev1.PodSpec, error) {
 	if strings.TrimSpace(sidecarImage) == "" {
 		return corev1.PodSpec{}, fmt.Errorf("sidecar image cannot be empty")
 	}
@@ -96,6 +96,16 @@ func PreparePodSpec(podSpec corev1.PodSpec, volumes []corev1.Volume, workspaceMo
 				Value: "1",
 			})
 		}
+		if embeddedSSH {
+			sidecarContainer.Env = append(sidecarContainer.Env, corev1.EnvVar{
+				Name:  "OKDEV_SSH_MODE",
+				Value: "embedded",
+			})
+			sidecarContainer.Ports = append(sidecarContainer.Ports, corev1.ContainerPort{
+				ContainerPort: 2222,
+				Name:          "embedded-ssh",
+			})
+		}
 		spec.Containers = append(spec.Containers, sidecarContainer)
 	}
 

internal/kube/podspec_test.go

@@ -7,7 +7,7 @@ import (
 )
 
 func TestPreparePodSpecShareProcessNamespace(t *testing.T) {
-	spec, err := PreparePodSpec(corev1.PodSpec{}, nil, "/workspace", "ghcr.io/acmore/okdev-sidecar:edge", false, "")
+	spec, err := PreparePodSpec(corev1.PodSpec{}, nil, "/workspace", "ghcr.io/acmore/okdev-sidecar:edge", false, false, "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -17,7 +17,7 @@ func TestPreparePodSpecShareProcessNamespace(t *testing.T) {
 }
 
 func TestPreparePodSpecWorkspaceDefaultsToEmptyDir(t *testing.T) {
-	spec, err := PreparePodSpec(corev1.PodSpec{}, nil, "/workspace", "ghcr.io/acmore/okdev-sidecar:edge", false, "")
+	spec, err := PreparePodSpec(corev1.PodSpec{}, nil, "/workspace", "ghcr.io/acmore/okdev-sidecar:edge", false, false, "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -43,7 +43,7 @@ func TestPreparePodSpecUsesConfiguredWorkspaceVolume(t *testing.T) {
 			},
 		},
 	}
-	spec, err := PreparePodSpec(corev1.PodSpec{}, volumes, "/workspace", "ghcr.io/acmore/okdev-sidecar:edge", false, "")
+	spec, err := PreparePodSpec(corev1.PodSpec{}, volumes, "/workspace", "ghcr.io/acmore/okdev-sidecar:edge", false, false, "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -59,7 +59,7 @@ func TestPreparePodSpecUsesConfiguredWorkspaceVolume(t *testing.T) {
 }
 
 func TestPreparePodSpecAddsWorkspaceMountOnDevAndSidecar(t *testing.T) {
-	spec, err := PreparePodSpec(corev1.PodSpec{}, nil, "/workspace", "ghcr.io/acmore/okdev-sidecar:edge", false, "")
+	spec, err := PreparePodSpec(corev1.PodSpec{}, nil, "/workspace", "ghcr.io/acmore/okdev-sidecar:edge", false, false, "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -89,7 +89,7 @@ func TestPreparePodSpecAddsWorkspaceMountOnDevAndSidecar(t *testing.T) {
 }
 
 func TestPreparePodSpecErrorsOnEmptyImage(t *testing.T) {
-	if _, err := PreparePodSpec(corev1.PodSpec{}, nil, "/workspace", "", false, ""); err == nil {
+	if _, err := PreparePodSpec(corev1.PodSpec{}, nil, "/workspace", "", false, false, ""); err == nil {
 		t.Fatal("expected error for empty sidecar image")
 	}
 }
@@ -112,3 +112,59 @@ func TestSyncthingImagePullPolicy(t *testing.T) {
 		}
 	}
 }
+
+func findContainer(containers []corev1.Container, name string) *corev1.Container {
+	for i := range containers {
+		if containers[i].Name == name {
+			return &containers[i]
+		}
+	}
+	return nil
+}
+
+func TestPreparePodSpecEmbeddedSSHMode(t *testing.T) {
+	t.Run("embeddedSSH=false", func(t *testing.T) {
+		spec, err := PreparePodSpec(corev1.PodSpec{}, nil, "/workspace", "ghcr.io/acmore/okdev-sidecar:edge", false, false, "")
+		if err != nil {
+			t.Fatal(err)
+		}
+		sc := findContainer(spec.Containers, "okdev-sidecar")
+		if sc == nil {
+			t.Fatal("sidecar container not found")
+		}
+		for _, env := range sc.Env {
+			if env.Name == "OKDEV_SSH_MODE" {
+				t.Fatal("expected no OKDEV_SSH_MODE env var when embeddedSSH=false")
+			}
+		}
+	})
+
+	t.Run("embeddedSSH=true", func(t *testing.T) {
+		spec, err := PreparePodSpec(corev1.PodSpec{}, nil, "/workspace", "ghcr.io/acmore/okdev-sidecar:edge", false, true, "")
+		if err != nil {
+			t.Fatal(err)
+		}
+		sc := findContainer(spec.Containers, "okdev-sidecar")
+		if sc == nil {
+			t.Fatal("sidecar container not found")
+		}
+		foundEnv := false
+		for _, env := range sc.Env {
+			if env.Name == "OKDEV_SSH_MODE" && env.Value == "embedded" {
+				foundEnv = true
+			}
+		}
+		if !foundEnv {
+			t.Fatal("expected OKDEV_SSH_MODE=embedded env var when embeddedSSH=true")
+		}
+		foundPort := false
+		for _, p := range sc.Ports {
+			if p.ContainerPort == 2222 && p.Name == "embedded-ssh" {
+				foundPort = true
+			}
+		}
+		if !foundPort {
+			t.Fatal("expected port 2222 named embedded-ssh when embeddedSSH=true")
+		}
+	})
+}