[ZSH] Confirming ssh-agent for coding agents' remote sudo

Start a second agent with the sudo key added via ssh-add -c, forwarded by
agent shells (see ~/.ssh/config); skip agent setup and SUDO_ASKPASS there.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

zsh/.zshrc

@@ -37,13 +37,24 @@ fi
 (( $+commands[safescp] )) && alias scp="safescp${_safe_redir:-}"
 unset _safe_redir
 
-if [[ -f ~/.ssh/sudo_key ]]; then
+_in_coding_agent="$CLAUDECODE$CODEX_SESSION_ID$PI_CODING_AGENT"
+if [[ -f ~/.ssh/sudo_key && -z $_in_coding_agent ]]; then
+    _sudo_fp=$(ssh-keygen -lf ~/.ssh/sudo_key | awk '{print $2}')
     [[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &>/dev/null
-    SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l |
-        grep -q "$(ssh-keygen -lf ~/.ssh/sudo_key | awk '{print $2}')" ||
+    SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l | grep -q "$_sudo_fp" ||
         SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add ~/.ssh/sudo_key
+    # agent forwarded by coding agents (see ~/.ssh/config): every signature,
+    # i.e. every remote sudo, needs confirmation via askpass
+    [[ -e /tmp/sudo-agent-confirm.sock ]] ||
+        SSH_ASKPASS=~/.ssh/askpass-agent-confirm.sh SSH_ASKPASS_REQUIRE=force \
+            ssh-agent -a /tmp/sudo-agent-confirm.sock &>/dev/null
+    SSH_AUTH_SOCK=/tmp/sudo-agent-confirm.sock ssh-add -l | grep -q "$_sudo_fp" ||
+        SSH_AUTH_SOCK=/tmp/sudo-agent-confirm.sock ssh-add -c ~/.ssh/sudo_key
+    unset _sudo_fp
 fi
-export SUDO_ASKPASS=$(command -v ssh-askpass)
+# no GUI password dialog for sudo from agent shells; a non-interactive sudo just fails
+[[ -z $_in_coding_agent ]] && export SUDO_ASKPASS=$(command -v ssh-askpass)
+unset _in_coding_agent
 
 if [[ -f ~/dotfiles/zsh/.p10k.mac.zsh ]]; then
     p10k_config=~/dotfiles/zsh/.p10k.mac.zsh