From f762a6bd40fe95efcdfc0cd6c52d0ad1ddcd0a61 Mon Sep 17 00:00:00 2001 From: Fabian Ising Date: Wed, 7 Oct 2026 21:50:36 +0200 Subject: [PATCH] [ZSH] Confirming ssh-agent for coding agents' remote sudo Start a second agent with the sudo key added via ssh-add -c, forwarded by agent shells (see ~/.ssh/config); skip agent setup and SUDO_ASKPASS there. Co-Authored-By: Claude Fable 5.1 --- zsh/.zshrc | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/zsh/.zshrc b/zsh/.zshrc index a581eba..ea0cc11 100644 --- a/zsh/.zshrc +++ b/zsh/.zshrc @@ -37,13 +37,24 @@ fi (( $+commands[safescp] )) && alias scp="safescp${_safe_redir:-}" unset _safe_redir -if [[ -f ~/.ssh/sudo_key ]]; then +_in_coding_agent="$CLAUDECODE$CODEX_SESSION_ID$PI_CODING_AGENT" +if [[ -f ~/.ssh/sudo_key && -z $_in_coding_agent ]]; then + _sudo_fp=$(ssh-keygen -lf ~/.ssh/sudo_key | awk '{print $2}') [[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &>/dev/null - SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l | - grep -q "$(ssh-keygen -lf ~/.ssh/sudo_key | awk '{print $2}')" || + SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l | grep -q "$_sudo_fp" || SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add ~/.ssh/sudo_key + # agent forwarded by coding agents (see ~/.ssh/config): every signature, + # i.e. every remote sudo, needs confirmation via askpass + [[ -e /tmp/sudo-agent-confirm.sock ]] || + SSH_ASKPASS=~/.ssh/askpass-agent-confirm.sh SSH_ASKPASS_REQUIRE=force \ + ssh-agent -a /tmp/sudo-agent-confirm.sock &>/dev/null + SSH_AUTH_SOCK=/tmp/sudo-agent-confirm.sock ssh-add -l | grep -q "$_sudo_fp" || + SSH_AUTH_SOCK=/tmp/sudo-agent-confirm.sock ssh-add -c ~/.ssh/sudo_key + unset _sudo_fp fi -export SUDO_ASKPASS=$(command -v ssh-askpass) +# no GUI password dialog for sudo from agent shells; a non-interactive sudo just fails +[[ -z $_in_coding_agent ]] && export SUDO_ASKPASS=$(command -v ssh-askpass) +unset _in_coding_agent if [[ -f ~/dotfiles/zsh/.p10k.mac.zsh ]]; then p10k_config=~/dotfiles/zsh/.p10k.mac.zsh