Skip to content

feat(agent): SSH agent backend (ok agent) — OKI-0014 #159

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
p1024k merged 18 commits into from
Aug 5, 2026
Merged

feat(agent): SSH agent backend (ok agent) — OKI-0014 #159

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
152b9db
build(agent): add ssh-agent backend dependencies
p1024k Jul 22, 2026
9029bbb
feat(audit): add SshSign operation variant
p1024k Jul 22, 2026
6e319f4
feat(agent): ed25519 signer with verified signatures
p1024k Jul 22, 2026
f9e07aa
feat(agent): load SSH identities with whitelist filtering
p1024k Jul 22, 2026
f5c61cf
docs(agent): correct identity zero-cache wording (transient whole-pay…
p1024k Jul 22, 2026
2d04bb7
feat(agent): ssh-agent protocol server over unix socket
p1024k Jul 22, 2026
435035d
fix(agent): serve multiple requests per connection for ssh interop
p1024k Jul 22, 2026
82fe62f
feat(agent): ok agent daemon entrypoint with unlock
p1024k Jul 22, 2026
c6aa966
fix(agent): apply process protections in run_agent for parity with TUI
p1024k Jul 22, 2026
faca8e5
feat(agent): rsa signer honoring sha2 flags
p1024k Jul 23, 2026
5736cab
feat(agent): ecdsa signer (nistp256/384/521)
p1024k Jul 23, 2026
c28e02c
feat(agent): audit successful ssh signatures
p1024k Jul 23, 2026
d7ab5af
feat(agent): dedicated agent instance lock coexisting with tui
p1024k Jul 23, 2026
29b041e
feat(agent): graceful shutdown, pidfile, idle-lock, cli lock reposition
p1024k Jul 23, 2026
f766262
docs(agent): document ok agent ssh backend
p1024k Jul 23, 2026
d0c8ec3
test(audit): include SshSign in display-name coverage guard
p1024k Jul 23, 2026
fc7fed1
docs(agent): expand ok agent README into a usage guide (EN + ZH)
p1024k Jul 23, 2026
92bc9f2
docs: bump README preview version to 0.8.0-preview.3 (EN + ZH)
p1024k Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@ This project is in first-preview status. Preview releases may change local vault

## Unreleased

- **SSH agent backend (`ok agent`)**: added a standalone ssh-agent daemon backed by the vault's SSH keys. Run `ok agent`, export the printed `SSH_AUTH_SOCK`, and `ssh-add -l` lists the vault's SSH keys. Supports ed25519, RSA (SHA2 256/512), and ECDSA (nistp256/384/521) signing in-process; private keys never leave the oak-keyring process and are not cached. Filter exposed identities with `--only NAME` (repeatable) or `--allow REGEX` (union semantics); auto-shut the daemon after inactivity with `--idle-lock SECS`. The agent uses a separate single-instance lock from the TUI so both can run against the same vault; successful signatures are recorded in the audit log (`SshSign`); graceful shutdown on SIGTERM/SIGINT or idle timeout.

## 0.8.0-preview.3

- **Security**: bumped `cmov` 0.5.3 → 0.5.4 to fix [GHSA-3rjw-m598-pq24](https://github.com/advisories/GHSA-3rjw-m598-pq24) — Cmov/CmovEq on aarch64 could produce wrong results when high register bits were set.
Expand Down
Loading