add ssh agent forwarding support (ForwardAgent / ssh:forwardagent)

[cghamburg]

Fixes #2718

What

Adds SSH agent forwarding to Wave's built-in connections. Wave already uses the local ssh agent for authentication but never forwarded it, so SSH_AUTH_SOCK stayed empty in remote shells (see #2718).

• ForwardAgent is now parsed from ~/.ssh/config (accepts yes/no)
• new internal config key ssh:forwardagent (overrides ssh config, works with conn:ignoresshconfig)
• when enabled, forwarding is set up on the ssh client after connect and requested per interactive shell session (both the wsh and no-wsh paths)
• failures are non-fatal: the shell still starts, errors show up in the connection debug log ([conndebug])

How

Instead of x/crypto's agent.ForwardToAgent (which serves all forwarded channels over the single agent connection opened at auth time), the client registers its own auth-agent@openssh.com channel handler and dials the agent socket freshly per channel — matching openssh behavior. This way:

• forwarding survives agent restarts (e.g. 1Password relock)
• forwarding works independently of IdentitiesOnly, which in openssh only restricts auth keys and does not disable forwarding
• the same code path works with Windows named pipes (\\.\pipe\openssh-ssh-agent) via the existing dialIdentityAgent

Like openssh, the agent is only forwarded to the final destination, never to ProxyJump hops.

Partial implementation notes

• ForwardAgent only accepts yes/no; an explicit socket path or env var name (accepted by openssh >= 7.3) behaves as no — documented as "(partial)" in the keyword table, consistent with AddKeysToAgent
• known limitation: durable sessions (term:durable) run their shells under the remote connserver rather than an sshd session, so sshd never sets SSH_AUTH_SOCK there. Supporting that would need Wave to serve a stable agent socket on the remote itself (listen via the ssh connection at a fixed path + re-listen on reconnect) — left as a follow-up

Testing

Verified manually (macOS host, Linux remote, RSA key in agent): with ForwardAgent yes in ssh config, a Wave terminal block on the connection gets SSH_AUTH_SOCK set, ssh-add -l lists the local key, and an onward ssh hop from the remote authenticates via the forwarded agent. Without the setting, behavior is unchanged.

🤖 Generated with Claude Code

[coderabbitai]

Walkthrough

This PR adds support for SSH agent forwarding. It introduces a new ssh:forwardagent configuration keyword (schema, TypeScript type, docs, and Go config struct), extends SSH config parsing/merging to recognize ForwardAgent, and implements per-channel agent forwarding in the SSH client that redials the local agent socket for each forwarded channel. ConnectToClient now returns a forwarding-status boolean, which SSHConn tracks via a new ForwardAgent field and GetForwardAgent() getter. Shell session startup requests agent forwarding when enabled.

Estimated code review effort: 3 (Moderate) | ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding SSH agent forwarding support and the related config key.
Description check	✅ Passed	The description matches the code changes and explains the feature, behavior, and implementation approach.
Linked Issues check	✅ Passed	Adds SSH agent forwarding as requested in #2718, including config parsing and session forwarding on both shell paths.
Out of Scope Changes check	✅ Passed	The changes stay within SSH agent forwarding support, with only related docs, schema, and type updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Biome (2.5.1)

frontend/types/gotypes.d.ts

File contains syntax errors that prevent linting: Line 1880: Expected a property, or a signature but instead found '#'.; Line 1880: Expected an expression, or an assignment but instead found ':'.; Line 1880: Expected an expression but instead found ']'.; Line 2193: Expected a statement but instead found '}'.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

🧹 Nitpick comments (1)

pkg/remote/sshclient.go (1)

842-901: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift

Consider adding test coverage for the agent forwarding implementation.

The new setupAgentForwarding and forwardAgentChannel functions implement critical SSH agent forwarding logic with multiple code paths (agent dial failure, channel accept failure, bidirectional copy, half-close semantics, Windows fallback). No tests are included in this PR.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/remote/sshclient.go` around lines 842 - 901, Add test coverage for the
new SSH agent forwarding flow in setupAgentForwarding and forwardAgentChannel.
Cover the key paths: successful setup, dialIdentityAgent failure,
already-enabled forwarding, channel acceptance, and bidirectional copy behavior
including half-close handling and the CloseWrite fallback. Use tests that
exercise the auth-agent@openssh.com channel handling so the forwarding behavior
stays verified across restarts and platform differences.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/remote/sshclient.go`:
- Around line 842-901: Add test coverage for the new SSH agent forwarding flow
in setupAgentForwarding and forwardAgentChannel. Cover the key paths: successful
setup, dialIdentityAgent failure, already-enabled forwarding, channel
acceptance, and bidirectional copy behavior including half-close handling and
the CloseWrite fallback. Use tests that exercise the auth-agent@openssh.com
channel handling so the forwarding behavior stays verified across restarts and
platform differences.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 28a427e6-8bc2-442a-b7de-6bd642d67d8f

📥 Commits

Reviewing files that changed from the base of the PR and between c99022c and 3557384.

📒 Files selected for processing (7)

• docs/docs/connections.mdx
• frontend/types/gotypes.d.ts
• pkg/remote/conncontroller/conncontroller.go
• pkg/remote/sshclient.go
• pkg/shellexec/shellexec.go
• pkg/wconfig/settingsconfig.go
• schema/connections.json