Files
dotfiles/zsh/.zshrc
T
Fabian IsingandClaude Fable 5.1 f762a6bd40 [ZSH] Confirming ssh-agent for coding agents' remote sudo
Start a second agent with the sudo key added via ssh-add -c, forwarded by
agent shells (see ~/.ssh/config); skip agent setup and SUDO_ASKPASS there.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-07 21:50:36 +02:00

94 lines
4.1 KiB
Bash

# Powerlevel10k instant prompt and machine-local layers must remain first.
[[ -f ~/.zsh/.powerline_config ]] && source ~/.zsh/.powerline_config
[[ -f ~/.zsh/.user_config ]] && source ~/.zsh/.user_config
[[ -f ~/.zsh/.virtual_env_config.zsh ]] && source ~/.zsh/.virtual_env_config.zsh
[[ -f ~/.zsh/.local_config ]] && source ~/.zsh/.local_config
[[ -f ~/.zsh/.env.local ]] && source ~/.zsh/.env.local
source "${ZDOTDIR:-$HOME}/.zsh/lib/updates.zsh"
export LC_OSC52=1
# Completions for tools installed under ~/.local (e.g. tools-repo's safe*
# wrappers). Must precede antidote, whose completion plugin runs compinit.
fpath=("$HOME/.local/share/zsh/site-functions" $fpath)
plugins_txt=${ZDOTDIR:-$HOME}/.zsh/.zsh_plugins.txt
static_file=${ZDOTDIR:-$HOME}/.cache/zsh/.zsh_plugins.zsh
source "${ZDOTDIR:-$HOME}/.zsh/lib/antidote.zsh"
source "${ZDOTDIR:-$HOME}/.zsh/lib/interactive.zsh"
bindkey '^w' kill-region
bindkey -v
VI_MODE_SET_CURSOR=true
[[ -f ~/.zsh/.mac_config.zsh ]] && source ~/.zsh/.mac_config.zsh
if (( $+commands[go] )); then
export GOPATH="$(go env GOPATH 2>/dev/null)"
[[ -n "$GOPATH" ]] && path+=("$GOPATH/bin")
fi
# Use safe wrappers after ~/.local/bin has been added to PATH.
# Agent shells: </dev/null makes the prompt decline (exit 1) instead of blocking.
if [[ -n ${CLAUDECODE:-} || -n ${CODEX_SHELL:-} ]]; then
_safe_redir=' </dev/null'
fi
(( $+commands[safecp] )) && alias cp="safecp${_safe_redir:-}"
(( $+commands[safemv] )) && alias mv="safemv${_safe_redir:-}"
(( $+commands[safescp] )) && alias scp="safescp${_safe_redir:-}"
unset _safe_redir
_in_coding_agent="$CLAUDECODE$CODEX_SESSION_ID$PI_CODING_AGENT"
if [[ -f ~/.ssh/sudo_key && -z $_in_coding_agent ]]; then
_sudo_fp=$(ssh-keygen -lf ~/.ssh/sudo_key | awk '{print $2}')
[[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &>/dev/null
SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l | grep -q "$_sudo_fp" ||
SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add ~/.ssh/sudo_key
# agent forwarded by coding agents (see ~/.ssh/config): every signature,
# i.e. every remote sudo, needs confirmation via askpass
[[ -e /tmp/sudo-agent-confirm.sock ]] ||
SSH_ASKPASS=~/.ssh/askpass-agent-confirm.sh SSH_ASKPASS_REQUIRE=force \
ssh-agent -a /tmp/sudo-agent-confirm.sock &>/dev/null
SSH_AUTH_SOCK=/tmp/sudo-agent-confirm.sock ssh-add -l | grep -q "$_sudo_fp" ||
SSH_AUTH_SOCK=/tmp/sudo-agent-confirm.sock ssh-add -c ~/.ssh/sudo_key
unset _sudo_fp
fi
# no GUI password dialog for sudo from agent shells; a non-interactive sudo just fails
[[ -z $_in_coding_agent ]] && export SUDO_ASKPASS=$(command -v ssh-askpass)
unset _in_coding_agent
if [[ -f ~/dotfiles/zsh/.p10k.mac.zsh ]]; then
p10k_config=~/dotfiles/zsh/.p10k.mac.zsh
else
p10k_config=~/dotfiles/zsh/.p10k.zsh
fi
source "${ZDOTDIR:-$HOME}/.zsh/lib/prompt.zsh"
alias screenshot_mode='powerlevel10k_plugin_unload; export PS1="$ "; python3 ~/.config/alacritty/screenshot_mode.py on'
alias screenshot_mode_off='prompt_powerlevel9k_setup; python3 ~/.config/alacritty/screenshot_mode.py off'
antidote update &>/dev/null &|
[[ -d "$HOME/.lmstudio/bin" ]] && path+=("$HOME/.lmstudio/bin")
[[ -d "$HOME/.runai/bin" ]] && path+=("$HOME/.runai/bin")
runai_bin="$HOME/.runai/bin/runai"
runai_completion=${ZDOTDIR:-$HOME}/.cache/zsh/runai-completion.zsh
if [[ -x "$runai_bin" ]]; then
if [[ ! -s "$runai_completion" || "$runai_bin" -nt "$runai_completion" ]]; then
runai_completion_tmp="$runai_completion.$$.tmp"
if "$runai_bin" --quiet completion zsh >| "$runai_completion_tmp"; then
command mv -f "$runai_completion_tmp" "$runai_completion"
else
command rm -f "$runai_completion_tmp"
fi
fi
[[ -s "$runai_completion" ]] && source "$runai_completion"
fi
# Keep this last: activate must snapshot the fully built PATH for deactivate.
typeset -U path PATH
[[ -z "${VIRTUAL_ENV:-}" ]] && unset VIRTUAL_ENV
if [[ -n "$VIRTUAL_ENV" && -f "$VIRTUAL_ENV/bin/activate" ]]; then
if [[ ${PATH%%:*} != "$VIRTUAL_ENV/bin" ]]; then
source "$VIRTUAL_ENV/bin/activate"
fi
fi