From 501f7306ed296b94e1e64b79b3281375a3f46d6c Mon Sep 17 00:00:00 2001 From: Gabriel Brown Date: Fri, 18 Sep 2026 17:28:56 -0400 Subject: [PATCH] Point every ssh host at the desktop keyring agent Claude Code and Codex start their shells without SSH_AUTH_SOCK. id_ed25519 has a passphrase, so batch ssh from a harness had no way to unlock it and failed with "Permission denied (publickey)" against server.gib, junior.gib and git.gbrown.org. The key and the per-host blocks were right the whole time, which made it read as a key problem and cost several rounds of checking keys that were never wrong. The desktop keyring agent at $XDG_RUNTIME_DIR/keyring/ssh already holds the key unlocked for the interactive session. A Host * block with IdentityAgent points every host at that socket, so a shell that inherits no agent gets the same one the terminal uses. --- user/ssh/config | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/user/ssh/config b/user/ssh/config index 59104eb..9aa9512 100644 --- a/user/ssh/config +++ b/user/ssh/config @@ -14,3 +14,10 @@ Host git.gbrown.org User git IdentityFile ~/.ssh/id_ed25519 IdentitiesOnly yes + +# Agent harnesses (Claude Code, Codex) start their shells without +# SSH_AUTH_SOCK, and id_ed25519 has a passphrase, so batch ssh from them fails +# with "Permission denied (publickey)" even though the key is right. The +# desktop keyring agent already holds the unlocked key; point every host at it. +Host * + IdentityAgent ${XDG_RUNTIME_DIR}/keyring/ssh