feat: support SSH key auth and load env file for connector

- Allow Linux VM shell/SFTP to fallback to SSH key if password is missing
- Use resolved credential type for upstream SSH auth and audit logging
- Load connector.env file to ensure config persists when spawned by OS URL handlers

Author: ankitdistrictd

apps/api/internal/handlers/sessions.go

@@ -499,8 +499,15 @@ func (h *SessionsHandler) Launch(w http.ResponseWriter, r *http.Request) {
 	if asset.Type == assets.TypeLinuxVM && (req.Action == access.ActionShell || req.Action == access.ActionSFTP) {
 		cred, err := h.credentialsService.ResolveForAsset(r.Context(), asset.ID, credentials.TypePassword)
 		if err != nil {
-			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to resolve linux credential"})
-			return
+			if !errors.Is(err, credentials.ErrCredentialNotFound) {
+				writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to resolve linux credential"})
+				return
+			}
+			cred, err = h.credentialsService.ResolveForAsset(r.Context(), asset.ID, credentials.TypeSSHKey)
+			if err != nil {
+				writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to resolve linux credential"})
+				return
+			}
 		}
 		upstreamUsername := strings.TrimSpace(cred.Username)
 		if req.Action == access.ActionShell {

apps/api/internal/sshproxy/server.go

@@ -389,22 +389,41 @@ func (s *Server) handleConn(rawConn net.Conn, cfg *ssh.ServerConfig) {
 }
 
 func (s *Server) connectUpstream(ctx context.Context, launch sessions.LaunchContext) (*ssh.Client, *ssh.Session, string, error) {
+	credType := credentials.TypePassword
 	cred, err := s.credSvc.ResolveForAsset(ctx, launch.AssetID, credentials.TypePassword)
 	if err != nil {
-		return nil, nil, "", fmt.Errorf("resolve password credential: %w", err)
+		if !errors.Is(err, credentials.ErrCredentialNotFound) {
+			return nil, nil, "", fmt.Errorf("resolve password credential: %w", err)
+		}
+		cred, err = s.credSvc.ResolveForAsset(ctx, launch.AssetID, credentials.TypeSSHKey)
+		if err != nil {
+			return nil, nil, "", fmt.Errorf("resolve ssh credential: %w", err)
+		}
+		credType = credentials.TypeSSHKey
 	}
 	launch.UpstreamUsername = strings.TrimSpace(cred.Username)
-	if err := s.sessionsSvc.RecordCredentialUsage(ctx, launch, credentials.TypePassword, "proxy_upstream_auth", launch.RequestID); err != nil {
+	if err := s.sessionsSvc.RecordCredentialUsage(ctx, launch, credType, "proxy_upstream_auth", launch.RequestID); err != nil {
 		s.logger.Warn("failed to write credential usage audit", "session_id", launch.SessionID, "request_id", launch.RequestID, "error", err)
 	}
 	if strings.TrimSpace(cred.Username) == "" {
 		return nil, nil, "", fmt.Errorf("credential username is required for ssh")
 	}
 
+	var authMethod ssh.AuthMethod
+	if credType == credentials.TypeSSHKey {
+		signer, parseErr := ssh.ParsePrivateKey([]byte(cred.Secret))
+		if parseErr != nil {
+			return nil, nil, "", fmt.Errorf("parse ssh private key: %w", parseErr)
+		}
+		authMethod = ssh.PublicKeys(signer)
+	} else {
+		authMethod = ssh.Password(cred.Secret)
+	}
+
 	clientCfg := &ssh.ClientConfig{
 		User: cred.Username,
 		Auth: []ssh.AuthMethod{
-			ssh.Password(cred.Secret),
+			authMethod,
 		},
 		HostKeyCallback: s.hostKeyCallback,
 		Timeout:         10 * time.Second,

apps/connector/cmd/connector/main.go

@@ -457,10 +457,60 @@ func spawnBackgroundServe() error {
 		return err
 	}
 	cmd := exec.Command(exePath, "serve")
-	cmd.Env = os.Environ()
+	// Load env file so the spawned server inherits config even when this process
+	// was launched by the OS URL handler (Chrome/Windows) with a minimal environment
+	// that has no ACCESSD_* variables set (e.g. MSI-registered URL handler on Windows).
+	cmd.Env = envWithConnectorEnvFile()
 	return cmd.Start()
 }
 
+// envWithConnectorEnvFile returns os.Environ() merged with values from the
+// connector env file (~/.config/accessd/connector.env). Env file values fill
+// in missing variables but do not override values already present in the
+// process environment.
+func envWithConnectorEnvFile() []string {
+	home, err := os.UserHomeDir()
+	if err != nil || home == "" {
+		return os.Environ()
+	}
+	envFilePath := home + "/.config/accessd/connector.env"
+	data, err := os.ReadFile(envFilePath)
+	if err != nil {
+		return os.Environ()
+	}
+
+	// Index current environment so we can fill gaps without overwriting.
+	current := os.Environ()
+	set := make(map[string]struct{}, len(current))
+	for _, kv := range current {
+		if i := strings.Index(kv, "="); i > 0 {
+			set[kv[:i]] = struct{}{}
+		}
+	}
+
+	extra := current
+	for _, line := range strings.Split(string(data), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		i := strings.Index(line, "=")
+		if i <= 0 {
+			continue
+		}
+		key := strings.TrimSpace(line[:i])
+		if key == "" {
+			continue
+		}
+		if _, already := set[key]; already {
+			continue // don't override env vars already set
+		}
+		extra = append(extra, line)
+		set[key] = struct{}{}
+	}
+	return extra
+}
+
 func withLogging(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		start := time.Now()