From 282bc793223f243e5b925850f2f4bd9b840762a7 Mon Sep 17 00:00:00 2001
From: Sridhar Ratnakumar <3998+srid@users.noreply.github.com>
Date: Sat, 14 Mar 2026 15:29:45 -0400
Subject: [PATCH] ssh agent forwarding fix for zellij (#106)

---
 configurations/nixos/pureintent/default.nix |  1 +
 modules/home/cli/ssh-agent-forwarding.nix   | 43 +++++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100644 modules/home/cli/ssh-agent-forwarding.nix

diff --git a/configurations/nixos/pureintent/default.nix b/configurations/nixos/pureintent/default.nix
index 921b52e..d165778 100644
--- a/configurations/nixos/pureintent/default.nix
+++ b/configurations/nixos/pureintent/default.nix
@@ -17,6 +17,7 @@ in
 
   users.users.${flake.config.me.username}.linger = true;
   home-manager.sharedModules = [
+    "${homeMod}/cli/ssh-agent-forwarding.nix"
     "${homeMod}/work/juspay.nix"
     "${homeMod}/services/vira.nix"
 
diff --git a/modules/home/cli/ssh-agent-forwarding.nix b/modules/home/cli/ssh-agent-forwarding.nix
new file mode 100644
index 0000000..9f11b79
--- /dev/null
+++ b/modules/home/cli/ssh-agent-forwarding.nix
@@ -0,0 +1,43 @@
+# Fix SSH agent forwarding for long-running sessions (zellij, tmux, etc.)
+#
+# Problem: SSH agent forwarding creates a new socket path on each connection
+# (e.g., /tmp/ssh-XXXXXX/agent.1234). Long-running processes (zellij, daemons)
+# have the old SSH_AUTH_SOCK baked in, so they can't auth after reconnect.
+#
+# Solution: Use a stable symlink that gets updated on each SSH connect.
+# Git/ssh read the symlink at execution time, so they always find the current socket.
+#
+# How it works:
+# 1. On each SSH connect to this machine: ~/.ssh/rc updates the symlink
+# 2. SSH_AUTH_SOCK points to the symlink path (set in zellij)
+# 3. Git/ssh follow the symlink to the current valid socket
+#
+# Reference: https://stackoverflow.com/a/23187030
+
+{ config, lib, pkgs, ... }:
+
+let
+  sshAuthSockLink = "${config.home.homeDirectory}/.ssh/ssh_auth_sock";
+in
+{
+  # Create ~/.ssh/rc to update symlink on each SSH connect
+  # This runs on the remote machine when someone SSHs in with agent forwarding
+  home.file.".ssh/rc" = {
+    executable = true;
+    text = ''
+      #!/bin/sh
+      # Update symlink to current SSH agent socket
+      if [ -n "$SSH_AUTH_SOCK" ] && [ "$SSH_AUTH_SOCK" != "${sshAuthSockLink}" ]; then
+        ln -sf "$SSH_AUTH_SOCK" "${sshAuthSockLink}"
+      fi
+    '';
+  };
+
+  programs.zellij.settings = {
+    # Set stable SSH_AUTH_SOCK for all zellij sessions
+    # New panes inherit this, and git/ssh follow the symlink at runtime
+    env = {
+      SSH_AUTH_SOCK = sshAuthSockLink;
+    };
+  };
+}