fix(ssh): stabilise forwarded ssh-agent socket across reconnects

Forwarded SSH_AUTH_SOCK lives at /tmp/ssh-XXX/agent.NNN — a
per-connection path that disappears on disconnect, leaving every
long-running zellij pane (and its children: claude-code, nvim, …)
pointing at a dead socket. Reattaching after reconnect doesn't help:
the env was captured when zellij first started.

Fix: maintain ~/.ssh/agent.sock as a symlink, re-aimed at the live
forwarded socket on every login (zprofile). Export the stable path so
processes inherit a value that survives reconnects — git fetch /
commit signing keep working in re-attached zellij panes with zero
per-pane re-export.

Adds 'ssh-agent-refresh' helper for transitional panes still holding
the dead per-connection path: re-exports SSH_AUTH_SOCK to the stable
symlink and validates with ssh-add -l. Already-running children
(claude-code) must still be restarted since env is inherited, not
observed.

1 files changed, 23 insertions, 0 deletions

diff --git a/dot_config/zsh/dot_zshrc b/dot_config/zsh/dot_zshrc
index 2eea559..961a5b4 100644
--- a/dot_config/zsh/dot_zshrc
+++ b/dot_config/zsh/dot_zshrc
@@ -389,6 +389,29 @@ reload-env() {
 	done < "/proc/$pid/environ"
 }
 
+# Refresh the ssh-agent socket inside a zellij pane that has outlived
+# its originating SSH connection. zprofile keeps ~/.ssh/agent.sock
+# aimed at the live forwarded socket on every reconnect, so the stable
+# path is current — this just re-exports it for shells whose own
+# SSH_AUTH_SOCK still holds the dead per-connection path captured
+# when zellij was first started. Already-running children
+# (claude-code, etc.) must still be restarted: env is inherited, not
+# observed.
+ssh-agent-refresh() {
+	local sock="$HOME/.ssh/agent.sock"
+	if [[ ! -e $sock ]]; then
+		echo "ssh-agent-refresh: $sock missing; reconnect over ssh first to seed it" >&2
+		return 1
+	fi
+	export SSH_AUTH_SOCK="$sock"
+	if ssh-add -l >/dev/null 2>&1; then
+		print -r -- "ssh-agent: live → $(readlink -f -- "$sock")"
+	else
+		echo "ssh-agent-refresh: stable socket exists but ssh-add -l failed; agent forwarding off?" >&2
+		return 1
+	fi
+}
+
 # Just
 alias j='just'
 alias dj='just --justfile ~/dotfiles/justfile --working-directory ~/dotfiles'