feat(ssh-helpers): preset GIT_SSH_COMMAND on interactive -A logins

On an interactive forwarded login (ssh-with-password/-key with -A and no
remote command), start the remote shell with GIT_SSH_COMMAND='ssh -F
/dev/null' so 'git push' over there uses the forwarded agent key. Without
it, a machine whose repo-managed ~/.ssh/config pins 'IdentitiesOnly yes' to
a local, push-less key (e.g. ~/.ssh/id) shadows the forwarded key and the
push is denied. -F /dev/null reads no config, so only the forwarded key is
offered; the custom-named local key is not a default identity so it is not
picked up.

Adds two helpers to ssh-with-agent.bash: swa_has_remote_command (an
ssh-arg parser that tells an interactive login from a passed command, so a
supplied remote command still runs verbatim) and swa_remote_git_push_init
(emits the remote init line). scp wrappers are left untouched — there is no
interactive shell to inject into.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: LTSCommerce

files/home/.local/bin/ssh-with-agent.bash

@@ -25,6 +25,57 @@ swa_wants_agent_forward() {
     return 1
 }
 
+# swa_remote_git_push_init — print the remote-shell init run on an interactive
+# forwarded login. It presets GIT_SSH_COMMAND so `git push` on the remote uses
+# the FORWARDED agent and ignores that machine's ~/.ssh/config (its
+# `IdentitiesOnly yes` + custom-named key would otherwise shadow the forwarded
+# key and authenticate as the wrong, push-less account). `-F /dev/null` reads no
+# config, so only the forwarded agent key is offered, then a login shell is
+# exec'd. The \$SHELL is deliberately left for the REMOTE shell to expand.
+swa_remote_git_push_init() {
+    printf '%s' "export GIT_SSH_COMMAND=\"ssh -F /dev/null\"; exec \"\$SHELL\" -l"
+}
+
+# swa_has_remote_command ARGS... — succeed (0) when the ssh args include a remote
+# command (a non-option token after the destination), i.e. NOT an interactive
+# login. Mirrors ssh's own option parsing: the short options below take a
+# following argument, everything else is a boolean flag or the destination.
+swa_has_remote_command() {
+    local argopts="bBcDEeFIiJLlmOopQRSWw"
+    local t cl ch n i skip_next=0 seen_host=0
+    for t in "$@"; do
+        if [ "$skip_next" -eq 1 ]; then
+            skip_next=0
+            continue
+        fi
+        case "$t" in
+            -*)
+                cl="${t#-}"
+                n=${#cl}
+                i=0
+                while [ "$i" -lt "$n" ]; do
+                    ch="${cl:$i:1}"
+                    if [[ "$argopts" == *"$ch"* ]]; then
+                        # Arg-taking option: it consumes the rest of this token as
+                        # its value, or the next token when it is the cluster's tail.
+                        [ "$i" -eq $((n - 1)) ] && skip_next=1
+                        break
+                    fi
+                    i=$((i + 1))
+                done
+                ;;
+            *)
+                if [ "$seen_host" -eq 0 ]; then
+                    seen_host=1
+                else
+                    return 0
+                fi
+                ;;
+        esac
+    done
+    return 1
+}
+
 # swa_discover_keys — print candidate private keys in SWA_SSH_DIR, one per line.
 # Skips public keys and the usual non-key files.
 swa_discover_keys() {

files/home/.local/bin/ssh-with-key

@@ -11,8 +11,11 @@
 # Agent forwarding: pass -A (or -o ForwardAgent=yes) and a fresh, dedicated
 # ssh-agent is started for this session — you are asked which keys to add — and
 # forwarded to the remote host. The agent is killed again when the connection
-# closes. Auth to THIS host is unaffected: it still uses only the -i key because
-# IdentitiesOnly=yes ignores every agent-held identity.
+# closes. For an interactive login (no remote command given) the remote shell is
+# started with GIT_SSH_COMMAND preset, so `git push` over there uses the
+# forwarded key even on a machine whose ~/.ssh/config pins IdentitiesOnly to a
+# local, push-less key. Auth to THIS host is unaffected: it still uses only the
+# -i key because IdentitiesOnly=yes ignores every agent-held identity.
 #
 # Usage:
 #   ssh-with-key [-i KEYPATH] [ssh-args...] user@host
@@ -121,7 +124,14 @@ if swa_wants_agent_forward "$@"; then
     # NOT exec — running ssh as a child lets the EXIT trap kill the agent after.
     swa_start_ephemeral_agent
     rc=0
-    ssh "${opts[@]}" "$@" || rc=$?
+    if swa_has_remote_command "$@"; then
+        # User supplied their own remote command — just forward the agent.
+        ssh "${opts[@]}" "$@" || rc=$?
+    else
+        # Interactive login: preset GIT_SSH_COMMAND on the remote so `git push`
+        # there uses the forwarded agent (-t for a real shell, see the lib note).
+        ssh -t "${opts[@]}" "$@" "$(swa_remote_git_push_init)" || rc=$?
+    fi
     exit "$rc"
 fi
 

files/home/.local/bin/ssh-with-password

@@ -17,8 +17,11 @@
 # Agent forwarding: pass -A (or -o ForwardAgent=yes) and a fresh, dedicated
 # ssh-agent is started for this session — you are asked which keys to add — and
 # forwarded to the remote host. The agent is killed again when the connection
-# closes. Auth to THIS host is unaffected: it stays password-only because
-# PubkeyAuthentication=no blocks every key regardless of the forwarded agent.
+# closes. For an interactive login (no remote command given) the remote shell is
+# started with GIT_SSH_COMMAND preset, so `git push` over there uses the
+# forwarded key even on a machine whose ~/.ssh/config pins IdentitiesOnly to a
+# local, push-less key. Auth to THIS host is unaffected: it stays password-only
+# because PubkeyAuthentication=no blocks every key regardless of the agent.
 set -euo pipefail
 
 if [ "$#" -eq 0 ] || [ "${1:-}" = "--help" ] || [ "${1:-}" = "-h" ]; then
@@ -56,7 +59,14 @@ if swa_wants_agent_forward "$@"; then
     # NOT exec — running ssh as a child lets the EXIT trap kill the agent after.
     swa_start_ephemeral_agent
     rc=0
-    ssh "${opts[@]}" "$@" || rc=$?
+    if swa_has_remote_command "$@"; then
+        # User supplied their own remote command — just forward the agent.
+        ssh "${opts[@]}" "$@" || rc=$?
+    else
+        # Interactive login: preset GIT_SSH_COMMAND on the remote so `git push`
+        # there uses the forwarded agent (-t for a real shell, see the lib note).
+        ssh -t "${opts[@]}" "$@" "$(swa_remote_git_push_init)" || rc=$?
+    fi
     exit "$rc"
 fi