feat(ssh): real-SSH access via in-VM sshd + gvproxy port forwarding

.github/workflows/build-runtime.yml

@@ -84,6 +84,16 @@ jobs:
             core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
             core.exportVariable('ACTIONS_CACHE_SERVICE_V2', process.env.ACTIONS_CACHE_SERVICE_V2 || '');
 
+      - name: Build static sshd (Linux only)
+        if: runner.os == 'Linux'
+        run: |
+          bash scripts/build/build-static-sshd.sh dist
+          chmod +x dist/boxlite-sshd dist/boxlite-ssh-keygen
+          # Sanity check: verify static linking
+          file dist/boxlite-sshd | grep -q "statically linked" || \
+            { echo "ERROR: boxlite-sshd is not statically linked" >&2; exit 1; }
+          echo "Built static sshd: $(file dist/boxlite-sshd)"
+
       # Build guest on host BEFORE manylinux container because:
       # - manylinux (AlmaLinux/RHEL) doesn't have musl packages in repos
       # - Building musl-cross-make from source takes ~15 minutes

.gitignore

@@ -223,3 +223,6 @@ regions-*.png
 runners-*.png
 term-*.png
 test-*.png
+
+.nx/cache
+.nx/workspace-data

apps/api-client-go/.openapi-generator/FILES

@@ -69,6 +69,7 @@ model_create_region.go
 model_create_region_response.go
 model_create_runner.go
 model_create_runner_response.go
+model_create_ssh_access_body_dto.go
 model_create_user.go
 model_create_volume.go
 model_health_controller_check_200_response.go

apps/api-client-go/api/openapi.yaml

@@ -2458,6 +2458,12 @@ paths:
         schema:
           type: number
         style: form
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CreateSshAccessBodyDto"
+        required: false
       responses:
         "200":
           content:
@@ -6751,6 +6757,16 @@ components:
       - token
       - url
       type: object
+    CreateSshAccessBodyDto:
+      example:
+        unixUser: boxlite
+      properties:
+        unixUser:
+          description: Unix user for SSH access (camelCase form)
+          example: boxlite
+          pattern: "^([a-z_][a-z0-9_-]{0,31})?$"
+          type: string
+      type: object
     SshAccessDto:
       example:
         id: 123e4567-e89b-12d3-a456-426614174000
@@ -6805,6 +6821,7 @@ components:
       example:
         valid: true
         boxId: 123e4567-e89b-12d3-a456-426614174000
+        unixUser: boxlite
       properties:
         valid:
           description: Whether the SSH access token is valid
@@ -6814,6 +6831,12 @@ components:
           description: ID of the box this SSH access is for
           example: 123e4567-e89b-12d3-a456-426614174000
           type: string
+        unixUser:
+          description: Unix user for real-SSH access; null for legacy exec-bridge
+            tokens
+          example: boxlite
+          nullable: true
+          type: string
       required:
       - boxId
       - valid

apps/api/jest.config.ts

@@ -14,6 +14,12 @@ export default {
   // uuid v14 and nanoid v5 ship ESM-only. The nx preset ignores node_modules
   // from transformation, so let ts-jest down-level them.
   transformIgnorePatterns: ['/node_modules/(?!(?:uuid|nanoid)/)'],
+  moduleNameMapper: {
+    '@boxlite-ai/runner-api-client': '<rootDir>/../libs/runner-api-client/src/index.ts',
+    '@boxlite-ai/api-client': '<rootDir>/../libs/api-client/src/index.ts',
+    '@boxlite-ai/toolbox-api-client': '<rootDir>/../libs/toolbox-api-client/src/index.ts',
+    '@boxlite-ai/analytics-api-client': '<rootDir>/../libs/analytics-api-client/src/index.ts',
+  },
   moduleFileExtensions: ['ts', 'js', 'html'],
   coverageDirectory: '../../coverage/apps/boxlite',
 }

apps/api/src/admin/controllers/box.controller.ts

@@ -47,7 +47,7 @@ export class AdminBoxController {
   @Audit({
     action: AuditAction.RECOVER,
     targetType: AuditTarget.BOX,
-    targetIdFromRequest: (req) => req.params.boxId,
+    targetIdFromRequest: (req) => req.params.boxId as string,
     targetIdFromResult: (result: BoxDto) => result?.id,
   })
   async recoverBox(@Param('boxId') boxId: string): Promise<BoxDto> {

apps/api/src/admin/controllers/runner.controller.ts

@@ -148,7 +148,7 @@ export class AdminRunnerController {
   @Audit({
     action: AuditAction.UPDATE_SCHEDULING,
     targetType: AuditTarget.RUNNER,
-    targetIdFromRequest: (req) => req.params.id,
+    targetIdFromRequest: (req) => req.params.id as string,
     requestMetadata: {
       body: (req: TypedRequest<{ unschedulable: boolean }>) => ({
         unschedulable: req.body?.unschedulable,
@@ -179,7 +179,7 @@ export class AdminRunnerController {
   @Audit({
     action: AuditAction.DELETE,
     targetType: AuditTarget.RUNNER,
-    targetIdFromRequest: (req) => req.params.id,
+    targetIdFromRequest: (req) => req.params.id as string,
   })
   async delete(@Param('id', ParseUUIDPipe) id: string): Promise<void> {
     return this.runnerService.remove(id)