huskies: merge 1108 story Chat bootstrap Phase 3: SSH-remote editor access into the project container (any editor)

docker/Dockerfile.base

@@ -25,6 +25,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates \
         libssl3 \
         procps \
+        openssh-server \
+        sudo \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy the huskies binary and entrypoint from the main image.
@@ -32,18 +34,34 @@ COPY --from=huskies-src /usr/local/bin/huskies /usr/local/bin/huskies
 COPY --from=huskies-src /usr/local/bin/entrypoint.sh /usr/local/bin/entrypoint.sh
 
 # Non-root user — Claude Code refuses --dangerously-skip-permissions as root.
+# -s /bin/bash required for SSH sessions to start a real shell.
 RUN groupadd -r huskies \
-    && useradd -r -g huskies -m -d /home/huskies huskies \
+    && useradd -r -g huskies -m -d /home/huskies -s /bin/bash huskies \
     && mkdir -p /home/huskies/.claude \
+    && mkdir -p /home/huskies/.ssh \
+    && chmod 700 /home/huskies/.ssh \
     && chown -R huskies:huskies /home/huskies \
     && mkdir -p /workspace \
     && chown huskies:huskies /workspace \
-    && git config --global init.defaultBranch master
+    && git config --global init.defaultBranch master \
+    && echo "huskies ALL=(root) NOPASSWD: /usr/sbin/sshd" > /etc/sudoers.d/huskies-sshd \
+    && chmod 0440 /etc/sudoers.d/huskies-sshd \
+    && mkdir -p /run/sshd \
+    && sed -i \
+        -e 's/#PasswordAuthentication yes/PasswordAuthentication no/' \
+        -e 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/' \
+        -e 's/UsePAM yes/UsePAM no/' \
+        /etc/ssh/sshd_config
+
+# Shell profile for SSH sessions: land in /workspace and load toolchain paths.
+RUN printf 'cd /workspace\n[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"\n' \
+        > /home/huskies/.profile \
+    && chown huskies:huskies /home/huskies/.profile
 
 USER huskies
 WORKDIR /workspace
 
-EXPOSE 3001
+EXPOSE 3001 22
 
 ENTRYPOINT ["entrypoint.sh"]
 CMD ["huskies", "/workspace"]

docker/entrypoint.sh

@@ -1,6 +1,22 @@
 #!/bin/sh
 set -e
 
+# ── SSH authorized key ────────────────────────────────────────────────
+# HUSKIES_SSH_PUBKEY is set by `new project` when it generates a keypair.
+# Write it to authorized_keys so the user can connect with the matching
+# private key stored at ~/.huskies/<project>/id_ed25519 on the host.
+if [ -n "$HUSKIES_SSH_PUBKEY" ]; then
+    mkdir -p /home/huskies/.ssh
+    chmod 700 /home/huskies/.ssh
+    printf '%s\n' "$HUSKIES_SSH_PUBKEY" > /home/huskies/.ssh/authorized_keys
+    chmod 600 /home/huskies/.ssh/authorized_keys
+fi
+
+# ── SSH daemon ────────────────────────────────────────────────────────
+# Start sshd in the background so the container accepts SSH connections.
+# Uses sudo (huskies has NOPASSWD for /usr/sbin/sshd in sudoers.d).
+sudo /usr/sbin/sshd -D -e &
+
 # ── Git identity ─────────────────────────────────────────────────────
 # Agents commit code inside the container. Without a git identity,
 # commits fail or use garbage defaults. Fail loudly at startup so the