diff options
Diffstat (limited to 'dot_config')
| -rw-r--r-- | dot_config/git/config | 3 | ||||
| -rw-r--r-- | dot_config/zsh/dot_zprofile | 31 | ||||
| -rw-r--r-- | dot_config/zsh/dot_zshrc | 43 |
3 files changed, 13 insertions, 64 deletions
diff --git a/dot_config/git/config b/dot_config/git/config index 3874410..6416efc 100644 --- a/dot_config/git/config +++ b/dot_config/git/config @@ -153,6 +153,5 @@ [credential "smtp://127.0.0.1:1025"] helper = "!f() { test \"$1\" = get && printf 'password=%s\\n' \"$(pass show proton/bridge-smtp)\"; }; f" [include] - ; Machine-local overrides (e.g. SSH-format signing on the remote-dev VM). - ; Git silently skips this if the file is absent. + ; Machine-local overrides. Git silently skips this if the file is absent. path = ~/.config/git/config.local diff --git a/dot_config/zsh/dot_zprofile b/dot_config/zsh/dot_zprofile index 20852db..9150382 100644 --- a/dot_config/zsh/dot_zprofile +++ b/dot_config/zsh/dot_zprofile @@ -75,33 +75,10 @@ export LESS="-F --RAW-CONTROL-CHARS" # ── GPG / SSH ───────────────────────────────────────────────────────────────── unset SSH_AGENT_PID -# Forwarded ssh-agent sockets live at /tmp/ssh-XXX/agent.NNN — a path -# that disappears the moment the originating ssh connection drops, -# leaving any long-running zellij pane (and its children: claude, -# nvim, etc.) pointing at a dead socket. Keep a stable -# ~/.ssh/agent.sock symlink that we re-aim on every login, and export -# the stable path so processes inherit a value that survives -# reconnects. Reattaching a zellij session after `ssh` → signing / -# git-fetch keep working without any per-pane re-export. -if [[ -n "$SSH_CONNECTION" && -S "$SSH_AUTH_SOCK" ]]; then - stable_sock="$HOME/.ssh/agent.sock" - # Only retarget if the current symlink target is dead. Sshd unlinks - # the per-connection socket file on disconnect, so [[ -S ]] on the - # resolved path is a reliable liveness probe. Avoiding gratuitous - # retargets keeps multi-connection setups stable: the first - # connection seeds the symlink, subsequent logins keep using it, - # and only if that connection drops does the next login retarget. - current_target="$(readlink "$stable_sock" 2>/dev/null)" - if [[ ! -S "$current_target" ]]; then - ln -sfn "$SSH_AUTH_SOCK" "$stable_sock" - fi - export SSH_AUTH_SOCK="$stable_sock" - unset stable_sock current_target -else - # Local login: route ssh auth through gpg-agent. - SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)" - export SSH_AUTH_SOCK -fi +# Always route SSH auth through the machine-local gpg-agent. The VM imports its +# own work GPG key; we deliberately do not use forwarded ssh-agent sockets. +SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)" +export SSH_AUTH_SOCK # ── FZF ─────────────────────────────────────────────────────────────────────── export FZF_DEFAULT_COMMAND="fd --type file --follow --hidden --exclude .git --color=always" diff --git a/dot_config/zsh/dot_zshrc b/dot_config/zsh/dot_zshrc index d78c9e5..113955c 100644 --- a/dot_config/zsh/dot_zshrc +++ b/dot_config/zsh/dot_zshrc @@ -407,41 +407,6 @@ reload-env() { done < "/proc/$pid/environ" } -# Refresh the ssh-agent socket inside a zellij pane that has outlived -# its originating SSH connection. zprofile keeps ~/.ssh/agent.sock -# aimed at the live forwarded socket on every reconnect, so the stable -# path is current — this just re-exports it for shells whose own -# SSH_AUTH_SOCK still holds the dead per-connection path captured -# when zellij was first started. Already-running children -# (claude-code, etc.) must still be restarted: env is inherited, not -# observed. -ssh-agent-refresh() { - local stable="$HOME/.ssh/agent.sock" - local current sock - current="$(readlink "$stable" 2>/dev/null)" - # Healthy path: existing target still responsive. - if [[ -S "$current" ]] && SSH_AUTH_SOCK="$current" ssh-add -l >/dev/null 2>&1; then - export SSH_AUTH_SOCK="$stable" - print -r -- "ssh-agent: live → $current" - return 0 - fi - # Symlink dead — scan all forwarded sockets from any concurrent ssh - # session and retarget to the first one that responds to ssh-add. - # Handles the case where the connection that originally seeded the - # symlink has dropped but another session is still alive. - for sock in /tmp/ssh-*/agent.*(N); do - [[ -S $sock ]] || continue - if SSH_AUTH_SOCK="$sock" ssh-add -l >/dev/null 2>&1; then - ln -sfn "$sock" "$stable" - export SSH_AUTH_SOCK="$stable" - print -r -- "ssh-agent: re-pointed → $sock" - return 0 - fi - done - print -r -- "ssh-agent-refresh: no live forwarded agent found; reconnect over ssh with -A first" >&2 - return 1 -} - # Just alias j='just' alias dj='just --justfile ~/dotfiles/justfile --working-directory ~/dotfiles' @@ -489,6 +454,14 @@ _dot_compdef lsd l=lsd la=lsd lt=lsd unfunction _dot_compdef # ── GPG agent ───────────────────────────────────────────────────────────────── +# Interactive shells can outlive the login environment that spawned them +# (notably inside zellij). If they inherited an old forwarded-agent socket, +# switch back to the machine-local gpg-agent SSH socket. +if [[ -z "$SSH_AUTH_SOCK" || "$SSH_AUTH_SOCK" == /tmp/ssh-* || "$SSH_AUTH_SOCK" == "$HOME/.ssh/agent.sock" ]]; then + SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)" + export SSH_AUTH_SOCK +fi + # Set GPG_TTY to this shell's actual TTY (not the login console) and tell # the agent so pinentry prompts appear in the right terminal export GPG_TTY=$TTY |