Improve SSH_AUTH_SOCK handling.

dotfiles/shenv

@@ -97,10 +97,12 @@ export LVM_SUPPRESS_FD_WARNINGS=1
 export EARTHLY_SSH_AUTH_SOCK=""
 
 # Handle SSH_AUTH_SOCK for tmux consistency
-_SSH_AUTH_LINK="${HOME}/.ssh/ssh_auth_sock"
+case "$-" in
+  *i*)
+    _SSH_AUTH_LINK="${HOME}/.ssh/ssh_auth_sock"
 
-# Helper to check if a path is our link or points to it
+    # Helper to check if a path is our link or points to it
-_is_link_path() {
+    _is_link_path() {
       [ -z "$1" ] && return 1
       _target="${_SSH_AUTH_LINK:-${HOME}/.ssh/ssh_auth_sock}"
       [ "$1" = "${_target}" ] && { unset -v _target; return 0; }
@@ -113,12 +115,21 @@ _is_link_path() {
       fi
       unset -v _target
       return 1
-}
+    }
 
-# Helper to check if an SSH socket is valid and useful via ssh-add return codes
+    # Helper to check if an SSH socket is valid and useful
-_is_valid_ssh_sock() {
+    _is_valid_ssh_sock() {
       [ -z "$1" ] && return 1
       [ -S "$1" ] || return 1
+
+      if command -v nc >/dev/null 2>&1; then
+        # Use nc to quickly check if the socket is listening.
+        # We use -N to shutdown the socket after EOF on stdin (for OpenBSD netcat compatibility).
+        if echo '' | nc -w 1 -N -U "$1" >/dev/null 2>&1; then
+          return 0
+        fi
+      fi
+
       if command -v ssh-add >/dev/null 2>&1; then
         SSH_AUTH_SOCK="$1" ssh-add -l >/dev/null 2>&1
         case "$?" in
@@ -126,11 +137,15 @@ _is_valid_ssh_sock() {
           *)   return 1 ;;
         esac
       fi
-  return 0
-}
 
-# Function to get the path to the socket for the local ssh-agent
+      if command -v nc >/dev/null 2>&1; then
-get_local_ssh_agent_sock() {
+        return 1
+      fi
+      return 0
+    }
+
+    # Function to get the path to the socket for the local ssh-agent
+    get_local_ssh_agent_sock() {
       _found=""
       if [ "$(uname)" = "Darwin" ]; then
         _found=$(launchctl getenv SSH_AUTH_SOCK 2>/dev/null)
@@ -180,10 +195,10 @@ get_local_ssh_agent_sock() {
 
       unset -v _found _u _p _search _d
       return 1
-}
+    }
 
-# Function to reset SSH_AUTH_SOCK to the local ssh-agent
+    # Function to reset SSH_AUTH_SOCK to the local ssh-agent
-reset_ssh_socket() {
+    reset_ssh_socket() {
       _rss_sock=$(get_local_ssh_agent_sock)
       if [ -n "${_rss_sock}" ]; then
         _rss_link="${HOME}/.ssh/ssh_auth_sock"
@@ -201,26 +216,26 @@ reset_ssh_socket() {
         unset -v _rss_sock
         return 1
       fi
-}
+    }
 
-_CANDIDATE=""
+    _CANDIDATE=""
 
-# 1. If current environment has a valid socket that is NOT our link, it's a prime candidate
+    # 1. If current environment has a valid socket that is NOT our link, it's a prime candidate
-# (e.g. fresh SSH login: sshd sets SSH_AUTH_SOCK to the raw forwarded socket before ssh/rc
+    # (e.g. fresh SSH login: sshd sets SSH_AUTH_SOCK to the raw forwarded socket before ssh/rc
-# rewrites it to the stable symlink; the shell inherits the original raw path).
+    # rewrites it to the stable symlink; the shell inherits the original raw path).
-if ! _is_link_path "${SSH_AUTH_SOCK:-}" && _is_valid_ssh_sock "${SSH_AUTH_SOCK:-}"; then
+    if ! _is_link_path "${SSH_AUTH_SOCK:-}" && _is_valid_ssh_sock "${SSH_AUTH_SOCK:-}"; then
       _CANDIDATE="${SSH_AUTH_SOCK}"
-fi
+    fi
 
-# 2. Only look for a system agent if the stable link is already broken. If the link is
+    # 2. Only look for a system agent if the stable link is already broken. If the link is
-# valid (e.g. a tmux pane where SSH_AUTH_SOCK points to our symlink which ssh/rc just
+    # valid (e.g. a tmux pane where SSH_AUTH_SOCK points to our symlink which ssh/rc just
-# updated to the forwarded socket), leave it alone — don't clobber it with a local agent.
+    # updated to the forwarded socket), leave it alone — don't clobber it with a local agent.
-if [ -z "${_CANDIDATE}" ] && ! _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
+    if [ -z "${_CANDIDATE}" ] && ! _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
       _CANDIDATE=$(get_local_ssh_agent_sock)
-fi
+    fi
 
-# 3. Sync the stable link if we found a valid "real" socket.
+    # 3. Sync the stable link if we found a valid "real" socket.
-if [ -n "${_CANDIDATE}" ] && ! _is_link_path "${_CANDIDATE}" && _is_valid_ssh_sock "${_CANDIDATE}"; then
+    if [ -n "${_CANDIDATE}" ] && ! _is_link_path "${_CANDIDATE}" && _is_valid_ssh_sock "${_CANDIDATE}"; then
       mkdir -p "$(dirname "${_SSH_AUTH_LINK}")"
       ln -sf "${_CANDIDATE}" "${_SSH_AUTH_LINK}"
       export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
@@ -228,12 +243,14 @@ if [ -n "${_CANDIDATE}" ] && ! _is_link_path "${_CANDIDATE}" && _is_valid_ssh_so
       if command -v systemctl >/dev/null 2>&1; then
         systemctl --user set-environment SSH_AUTH_SOCK="${_SSH_AUTH_LINK}" 2>/dev/null
       fi
-elif _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
+    elif _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
       # If we found nothing better but the link is valid, use it.
       export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
-fi
+    fi
 
-unset _SSH_AUTH_LINK _CANDIDATE
+    unset _SSH_AUTH_LINK _CANDIDATE
+    ;;
+esac
 
 # Setup XDG-like dirs on MacOS
 # Based on https://leebyron.com/til/mac-xdg/