This repository has no description
tools.ssh-agent-pick: offer local agents (ssh-tpm-agent, phonetpm, gpg, gcr) alongside forwarded ones
author
lassulus
date
(Oct 6, 2026, 1:24 PM CEST)
commit
d205383c
d205383c1fd46b855f2c476cf71aa20aaa27c555
parent
0ff6eab4
0ff6eab40df0c48c76452590a855badf56858d9c
+27
-9
+26
-8
tools/ssh-agent-pick/ssh-agent-pick.sh
+26
-8
tools/ssh-agent-pick/ssh-agent-pick.sh
···
1
1
#!/usr/bin/env bash
2
-
# Pick one of your live forwarded SSH agents and print an export line.
2
+
# Pick one of your live SSH agents (forwarded or local) and print an export line.
3
3
# Usage: eval "$(ssh-agent-pick)"
4
4
5
5
uid=$(id -u)
6
+
rt=${XDG_RUNTIME_DIR:-/run/user/$uid}
6
7
cands=()
7
8
labels=()
8
9
9
-
# newest first: sshd creates the socket when the connection is established
10
+
# local agents (configs/tpm2.nix, configs/phonetpm.nix, gpg-agent, gcr).
11
+
# rbw's agent is left out: listing keys blocks on a vault unlock prompt.
12
+
local_socks=(
13
+
"$rt/ssh-tpm-agent.sock"
14
+
"$rt/phonetpm/agent.sock"
15
+
"$rt/gnupg/S.gpg-agent.ssh"
16
+
"$rt/gcr/ssh"
17
+
)
18
+
19
+
# newest first: sshd creates a forwarded socket when the connection is established
10
20
while IFS= read -r -d '' line; do
11
21
sock=${line#* }
12
22
[ -S "$sock" ] || continue
13
23
[ "$(stat -c %u "$sock")" = "$uid" ] || continue
14
24
rc=0
15
-
keys=$(SSH_AUTH_SOCK=$sock ssh-add -l 2>/dev/null) || rc=$?
16
-
[ "$rc" -le 1 ] || continue # 2 = cannot connect (stale)
25
+
# timeout: an agent waiting on an unlock prompt must not hang the picker
26
+
keys=$(SSH_AUTH_SOCK=$sock timeout 3 ssh-add -l 2>/dev/null) || rc=$?
27
+
[ "$rc" -le 1 ] || continue # 2 = cannot connect (stale), 124 = timed out
17
28
if [ "$rc" -eq 1 ]; then
18
29
keys="(no identities)"
19
30
else
20
31
keys=$(printf '%s\n' "$keys" | awk '{ $1 = $2 = ""; $NF = ""; sub(/^ +/, ""); sub(/ +$/, ""); print }' | paste -sd, -)
21
32
fi
22
33
since=$(date -d "@${line%% *}" '+%F %T')
34
+
case $sock in
35
+
"$rt"/*) kind=local ;;
36
+
*) kind=forwarded ;;
37
+
esac
23
38
cands+=("$sock")
24
-
labels+=("$since $keys $sock")
25
-
done < <(find /tmp/ssh-* "$HOME/.ssh/agent" -maxdepth 1 -type s \( -name 'agent.*' -o -name '*.sshd.*' \) \
26
-
-printf '%T@ %p\0' 2>/dev/null | sort -zrn)
39
+
labels+=("$since $kind $keys $sock")
40
+
done < <({
41
+
# errexit applies in here: a failing find must not skip the next one
42
+
find /tmp/ssh-* "$HOME/.ssh/agent" -maxdepth 1 -type s \( -name 'agent.*' -o -name '*.sshd.*' \) -printf '%T@ %p\0' || true
43
+
find "${local_socks[@]}" -maxdepth 0 -type s -printf '%T@ %p\0' || true
44
+
} 2>/dev/null | sort -zrn)
27
45
28
46
if [ ${#cands[@]} -eq 0 ]; then
29
-
echo "ssh-agent-pick: no live forwarded agent found" >&2
47
+
echo "ssh-agent-pick: no live agent found" >&2
30
48
exit 1
31
49
fi
32
50
+1
-1
tools/ssh-agent-pick/usage.kdl
+1
-1
tools/ssh-agent-pick/usage.kdl
···
1
1
bin "ssh-agent-pick"
2
-
about "Choose one of your live forwarded SSH agents (newest first) and print an `export SSH_AUTH_SOCK=...` line; use as eval \"$(ssh-agent-pick)\""
2
+
about "Choose one of your live SSH agents (forwarded or local, e.g. ssh-tpm-agent; newest first) and print an `export SSH_AUTH_SOCK=...` line; use as eval \"$(ssh-agent-pick)\""