feat(ssh): Add SSH agent forwarding

[fabiovincenzi]

Summary

Adds complete SSH protocol support to Git Proxy with SSH agent forwarding.

Key Features

• SSH Proxy Server (src/proxy/ssh/server.ts) - Full SSH protocol handling
• SSH Agent Forwarding (src/proxy/ssh/AgentForwarding.ts, AgentProxy.ts) - Securely forwards client SSH credentials to upstream Git servers
• SSH Key Management - API endpoints, UI components, and CLI tools for user SSH key registration
• Git Protocol Handling (src/proxy/ssh/GitProtocol.ts) - Parses and processes git-upload-pack/git-receive-pack over SSH

Documentation

• docs/SSH_SETUP.md - User guide for configuring SSH access (key generation, agent forwarding, Git remote setup)
• docs/SSH_ARCHITECTURE.md - Technical architecture details, component overview, and security

Tests

Comprehensive test coverage in test/ssh/:

[jescalada]

I found a few bugs worth noting while testing today, most notably:

Concurrent SSH requests failing due to nonexistent channels:

This error happens when running concurrent git commands through SSH (client-side output):

channel_by_id: 2: bad id: channel free
Disconnecting 10.32.1.86 port 2222: data packet referred to nonexistent channel 2
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

I just pushed a fix for this one which was simply due to the incoming and outgoing channel IDs being flipped. It worked with single requests because both use the same channel ID (1) for packet transport.

An error when calling git push when there aren't any commits to push:

juan@pop-os:~/git-proxy-experiments$ git push
Access denied: Unable to parse push. Please contact an administrator for support: Your push has been blocked. Please make sure you are pushing to a single branch.
error: failed to push some refs to 'ssh://10.32.1.86:2222/github.com/jescalada/git-proxy-experiments.git'

When pushing without SSH, this just gives us the expected "Everything up-to-date". I'll look into this further and find a fix 👍🏼

An error after fixing merge conflicts and pushing a merge commit. The first "approval" push was apparently skipped, so there wasn't any push for an admin to approve and break the loop:

juan@pop-os:~/git-proxy-experiments$ git push
Enumerating objects: 10, done.
Counting objects: 100% (10/10), done.
Delta compression using up to 14 threads
Compressing objects: 100% (6/6), done.
Writing objects: 100% (6/6), 690 bytes | 690.00 KiB/s, done.
Total 6 (delta 2), reused 0 (delta 0), pack-reused 0
Access denied: Unreferenced commits in pack (2): e9260e6c519ac964e895ec69d926f844638c9c60, 9ed3a288070f3a7f58494d1a50c99435cff1757c.
This usually happens when a branch was made from a commit that hasn't been approved and pushed to the remote.
Please get approval on the commits, push them and try again.
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly

I'll try reproducing this one again, as it may be due to a buggy push action from before our rcs. Note that the buggy state can be resolved by simply rebasing instead of dealing with merge commits...

[jescalada]

Just pushed a fix for the error when calling git push on a branch that's up-to-date. Basically, HTTPS handles no-op pushes automatically (via GET /info/refs) and never actually triggers the chain, whereas SSH was executing the chain and erroring out in parsePush.

I fixed it by modifying the endHandler in src/proxy/ssh/server.ts to actually parse the packet lines beforehand, detect and skip no-op pushes and keeping the data integrity and chain execution bits intact.

[kriswest]

@re-vlad

[andypols]

LGTM. Checked it out and it worked as expected.

[kriswest]

This looks pretty good to me, a few minor comments and one concern - the disabling of config validation. What is the validation issue with the SSH config thats causing that ? If its a JSON schema issue I may be able to help resolve.

[fabiovincenzi]

Thanks for the review @kriswest! I believe all your comments have been addressed. Let me know if anything else needs attention.

[kriswest]

LGTM after comments were dealt with

[kriswest]

@jescalada's early comments still need to be resolved to merge: #1332 (review)

[jescalada]

Just verified that the older comments have been dealt with - ready to merge! 🚀