feat(sidecar): inject and start okdev-sshd in dev container for embedded mode

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: acmore

infra/sidecar/entrypoint.sh

@@ -140,6 +140,43 @@ if ! grep -q "ForceCommand" /etc/ssh/sshd_config; then
   echo "ForceCommand /usr/local/bin/nsenter-dev.sh" >> /etc/ssh/sshd_config
 fi
 
+# When embedded SSH mode is enabled, copy okdev-sshd into the dev container
+# and start it there. The SSH server runs natively in the dev container's cgroup.
+OKDEV_SSH_MODE="${OKDEV_SSH_MODE:-sidecar}"
+if [ "$OKDEV_SSH_MODE" = "embedded" ]; then
+  DEV_PID=""
+  tries=0
+  while [ -z "$DEV_PID" ] && [ "$tries" -lt 60 ]; do
+    for pid in $(ls /proc 2>/dev/null | grep -E '^[0-9]+$' | sort -n); do
+      [ "$pid" = "1" ] && continue
+      [ "$pid" = "$$" ] && continue
+      [ -r "/proc/$pid/root" ] 2>/dev/null || continue
+      if ! [ "/proc/$pid/root" -ef "/proc/self/root" ] 2>/dev/null; then
+        if [ -d "/proc/$pid" ]; then
+          DEV_PID="$pid"
+          break
+        fi
+      fi
+    done
+    if [ -z "$DEV_PID" ]; then
+      sleep 0.5
+      tries=$((tries + 1))
+    fi
+  done
+
+  if [ -n "$DEV_PID" ]; then
+    nsenter --target "$DEV_PID" --mount -- mkdir -p /var/okdev
+    cat /usr/local/bin/okdev-sshd | nsenter --target "$DEV_PID" --mount -- sh -c "cat > /var/okdev/okdev-sshd && chmod +x /var/okdev/okdev-sshd"
+    cat /root/.ssh/authorized_keys | nsenter --target "$DEV_PID" --mount -- sh -c "cat > /var/okdev/authorized_keys && chmod 600 /var/okdev/authorized_keys"
+
+    nsenter --target "$DEV_PID" --mount --uts --ipc --pid --cgroup -- \
+      /var/okdev/okdev-sshd --port 2222 --authorized-keys /var/okdev/authorized_keys &
+    echo "okdev-sshd started in dev container (PID $DEV_PID) on port 2222"
+  else
+    echo "WARNING: could not find dev container PID, embedded SSH not started" >&2
+  fi
+fi
+
 # Start syncthing in background (run as root for workspace access)
 syncthing serve --home /var/syncthing --no-browser \
   --gui-address=http://0.0.0.0:8384 --no-restart --skip-port-probing &