passwd-sso-cli 0.4.55 → 0.4.57

package/dist/commands/agent.d.ts

@@ -2,9 +2,14 @@
  * `passwd-sso agent` — Start an SSH agent backed by vault SSH keys.
  *
  * Usage:
- *   eval $(passwd-sso agent --eval)   # Set SSH_AUTH_SOCK
+ *   eval $(passwd-sso agent --eval)   # fork a detached daemon, set SSH_AUTH_SOCK
  *   ssh-add -l                         # List vault SSH keys
  *   ssh -T git@github.com              # Use via agent
+ *
+ * Without --eval the agent runs in the foreground (Ctrl+C to stop). With
+ * --eval it forks a detached child holding the vault key (mirrors the decrypt
+ * agent) and the parent prints the export commands and exits, so command
+ * substitution returns instead of blocking.
  */
 export interface AgentOptions {
     eval?: boolean;

package/dist/commands/agent.js

@@ -2,19 +2,29 @@
  * `passwd-sso agent` — Start an SSH agent backed by vault SSH keys.
  *
  * Usage:
- *   eval $(passwd-sso agent --eval)   # Set SSH_AUTH_SOCK
+ *   eval $(passwd-sso agent --eval)   # fork a detached daemon, set SSH_AUTH_SOCK
  *   ssh-add -l                         # List vault SSH keys
  *   ssh -T git@github.com              # Use via agent
+ *
+ * Without --eval the agent runs in the foreground (Ctrl+C to stop). With
+ * --eval it forks a detached child holding the vault key (mirrors the decrypt
+ * agent) and the parent prints the export commands and exits, so command
+ * substitution returns instead of blocking.
  */
+import { spawn } from "node:child_process";
 import { apiRequest } from "../lib/api-client.js";
-import { decryptData } from "../lib/crypto.js";
+import { decryptData, hexEncode } from "../lib/crypto.js";
 import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
-import { getEncryptionKey, getUserId, isUnlocked } from "../lib/vault-state.js";
-import { autoUnlockIfNeeded } from "./unlock.js";
+import { getEncryptionKey, getUserId, getSecretKeyBytes, setEncryptionKey, isUnlocked, } from "../lib/vault-state.js";
+import { autoUnlockIfNeeded, readPassphrase, unlockWithPassphrase, } from "./unlock.js";
 import { loadKey, clearKeys } from "../lib/ssh-key-agent.js";
-import { startAgent, stopAgent } from "../lib/ssh-agent-socket.js";
+import { startAgent, stopAgent, setAgentDeps } from "../lib/ssh-agent-socket.js";
+import { authorizeSign } from "../lib/ssh-sign-authorizer.js";
+import { confirmSign } from "../lib/ssh-confirm.js";
 import { decryptAgentCommand } from "./agent-decrypt.js";
 import * as output from "../lib/output.js";
+/** Env flag marking the forked daemon child process. */
+const SSH_DAEMON_ENV = "_PSSO_SSH_DAEMON";
 /**
  * Build an SSH public key blob from the stored public key string.
  * The public key is in OpenSSH format: "ssh-ed25519 AAAA... comment"
@@ -30,34 +40,29 @@ function parsePublicKeyBlob(publicKeyStr) {
         return null;
     }
 }
-export async function agentCommand(opts) {
-    if (opts.decrypt) {
-        return decryptAgentCommand({ eval: opts.eval });
-    }
-    if (!await autoUnlockIfNeeded()) {
-        output.error("Vault is locked. Run `passwd-sso unlock` first, or set PSSO_PASSPHRASE.");
-        process.exit(1);
-    }
+/**
+ * Fetch every SSH_KEY entry, decrypt it, and load it into the in-memory
+ * agent. Returns the number of keys loaded. Exits the process on a fatal
+ * condition (no encryption key, fetch failure, no keys, none loadable).
+ */
+async function loadSshKeys() {
     const encryptionKey = getEncryptionKey();
     if (!encryptionKey) {
         output.error("Encryption key not available.");
         process.exit(1);
     }
     const userId = getUserId();
-    // Fetch all SSH_KEY entries from the vault
     const res = await apiRequest("/api/passwords?type=SSH_KEY&include=blob");
     if (!res.ok) {
         output.error(`Failed to fetch SSH keys: HTTP ${res.status}`);
         process.exit(1);
     }
-    const entries = res.data;
-    if (entries.length === 0) {
+    if (res.data.length === 0) {
         output.error("No SSH keys found in vault.");
         process.exit(1);
     }
-    // Decrypt and load each SSH key
     let loadedCount = 0;
-    for (const entry of entries) {
+    for (const entry of res.data) {
         try {
             const aad = entry.aadVersion >= 1 && userId
                 ? buildPersonalEntryAAD(userId, entry.id, VAULT_TYPE.BLOB)
@@ -69,7 +74,7 @@ export async function agentCommand(opts) {
             const publicKeyBlob = parsePublicKeyBlob(blob.publicKey);
             if (!publicKeyBlob)
                 continue;
-            await loadKey(entry.id, blob.privateKey, publicKeyBlob, blob.comment ?? blob.title ?? "", blob.passphrase);
+            await loadKey(entry.id, blob.privateKey, publicKeyBlob, blob.comment ?? blob.title ?? "", blob.passphrase, entry.requireReprompt);
             loadedCount++;
         }
         catch (err) {
@@ -80,23 +85,44 @@ export async function agentCommand(opts) {
         output.error("No valid SSH keys could be loaded.");
         process.exit(1);
     }
-    // Start the agent socket
-    const socketPath = startAgent();
-    if (opts.eval) {
-        // Output shell commands to set SSH_AUTH_SOCK
-        // The user runs: eval $(passwd-sso agent --eval)
-        console.log(`SSH_AUTH_SOCK=${socketPath}; export SSH_AUTH_SOCK;`);
-        console.log(`echo "Agent pid ${process.pid}";`);
+    return loadedCount;
+}
+export async function agentCommand(opts) {
+    if (opts.decrypt) {
+        return decryptAgentCommand({ eval: opts.eval });
+    }
+    // Internal daemon child (forked by --eval): receives the vault key via IPC.
+    if (process.env[SSH_DAEMON_ENV] === "1") {
+        return runDaemonChild();
+    }
+    // Unlock the vault in this (parent / foreground) process.
+    if (!(await autoUnlockIfNeeded())) {
+        if (opts.eval && process.stdin.isTTY) {
+            // Prompt on stderr so stdout stays clean for `eval $(...)` capture.
+            const passphrase = await readPassphrase("Master passphrase: ", { useStderr: true });
+            if (!passphrase || !(await unlockWithPassphrase(passphrase))) {
+                output.error("Vault unlock failed.");
+                process.exit(1);
+            }
+        }
+        else {
+            output.error("Vault is locked. Run `passwd-sso unlock` first, or set PSSO_PASSPHRASE.");
+            process.exit(1);
+        }
     }
-    else {
-        output.success(`SSH agent started with ${loadedCount} key(s).`);
-        output.info(`Socket: ${socketPath}`);
-        output.info("Set SSH_AUTH_SOCK:");
-        console.log(`  export SSH_AUTH_SOCK=${socketPath}`);
-        output.info("Or use:");
-        console.log(`  eval $(passwd-sso agent --eval)`);
+    if (opts.eval) {
+        return forkDaemon();
     }
-    // Keep process running until interrupted
+    // Foreground mode: load keys and serve in this process.
+    const loadedCount = await loadSshKeys();
+    setAgentDeps({ authorizeSign, confirmSign });
+    const socketPath = startAgent();
+    output.success(`SSH agent started with ${loadedCount} key(s).`);
+    output.info(`Socket: ${socketPath}`);
+    output.info("Set SSH_AUTH_SOCK:");
+    console.log(`  export SSH_AUTH_SOCK=${socketPath}`);
+    output.info("Or use:");
+    console.log(`  eval $(passwd-sso agent --eval)`);
     output.info("Press Ctrl+C to stop the agent.");
     // Handle vault lock → clear keys
     const checkLock = setInterval(() => {
@@ -113,4 +139,81 @@ export async function agentCommand(opts) {
         // Never resolves — process exits via signal handlers
     });
 }
+/**
+ * --eval mode: fork a detached child holding the vault key, print the
+ * SSH_AUTH_SOCK export commands, and exit so `eval $(...)` returns. Mirrors
+ * the decrypt agent's forkDaemon (agent-decrypt.ts).
+ */
+async function forkDaemon() {
+    const secretBytes = getSecretKeyBytes();
+    if (!secretBytes) {
+        output.error("Secret key bytes not available.");
+        process.exit(1);
+    }
+    // Send the raw secret bytes (not the derived CryptoKey) — the child derives
+    // the encryption key itself. Zero the source array after hex-encoding.
+    const secretHex = hexEncode(secretBytes);
+    secretBytes.fill(0);
+    const userId = getUserId();
+    // Reconstruct args for the child: drop --eval, preserve tsx loader flags.
+    const childArgs = [
+        ...process.execArgv.filter((a) => !a.startsWith("--eval")),
+        ...process.argv.slice(1).filter((a) => a !== "--eval"),
+    ];
+    const child = spawn(process.execPath, childArgs, {
+        detached: true,
+        stdio: ["ignore", "ignore", "inherit", "ipc"],
+        env: { ...process.env, [SSH_DAEMON_ENV]: "1" },
+    });
+    child.send({ secretHex, userId });
+    // Child reports the socket path once it is serving keys.
+    child.on("message", (msg) => {
+        console.log(`SSH_AUTH_SOCK='${msg.socketPath}'; export SSH_AUTH_SOCK;`);
+        console.log(`SSH_AGENT_PID='${child.pid}'; export SSH_AGENT_PID;`);
+        console.log(`trap 'kill ${child.pid} 2>/dev/null; rm -f ${msg.socketPath}' EXIT;`);
+        child.unref();
+        child.disconnect();
+        process.exit(0);
+    });
+    // Child exited before acknowledging (e.g., no loadable keys) → surface it.
+    child.on("exit", (code) => {
+        process.stderr.write(`Agent child exited unexpectedly with code ${code}\n`);
+        process.exit(1);
+    });
+    setTimeout(() => {
+        process.stderr.write("Error: Agent child did not respond within 10s.\n");
+        child.kill();
+        process.exit(1);
+    }, 10_000);
+}
+/**
+ * Internal daemon child: receives the vault secret via IPC, derives the
+ * encryption key, loads the SSH keys, starts the socket, and reports the
+ * socket path back to the parent. The listening socket keeps the process
+ * alive after the IPC channel is disconnected.
+ */
+function runDaemonChild() {
+    return new Promise((resolve) => {
+        process.on("message", async (msg) => {
+            try {
+                const { hexDecode, deriveEncryptionKey } = await import("../lib/crypto.js");
+                const secretBytes = hexDecode(msg.secretHex);
+                const key = await deriveEncryptionKey(secretBytes);
+                secretBytes.fill(0);
+                setEncryptionKey(key, msg.userId ?? undefined);
+                await loadSshKeys(); // exits(1) on no loadable keys → parent reports via "exit"
+                setAgentDeps({ authorizeSign, confirmSign });
+                const socketPath = startAgent();
+                process.send({ socketPath });
+                if (process.disconnect)
+                    process.disconnect();
+                resolve();
+            }
+            catch (err) {
+                process.stderr.write(`Daemon init error: ${err instanceof Error ? err.message : String(err)}\n`);
+                process.exit(1);
+            }
+        });
+    });
+}
 //# sourceMappingURL=agent.js.map

package/dist/lib/oauth.js

@@ -9,7 +9,7 @@ import { createServer, } from "node:http";
 import { spawn } from "node:child_process";
 const CALLBACK_TIMEOUT_MS = 120_000; // 2 minutes
 const CLI_CLIENT_NAME = "passwd-sso-cli";
-const CLI_SCOPES = "credentials:list credentials:use vault:status vault:unlock-data passwords:read passwords:write";
+const CLI_SCOPES = "credentials:list credentials:use vault:status vault:unlock-data passwords:read passwords:write ssh:sign";
 const MCP_TOKEN_ENDPOINT = "/api/mcp/token";
 // ─── PKCE helpers ─────────────────────────────────────────────────────────────
 export function generateCodeVerifier() {

package/dist/lib/ssh-agent-protocol.d.ts

@@ -2,15 +2,20 @@
  * SSH agent protocol constants and framing helpers.
  *
  * Implements the subset of the SSH agent protocol needed for key listing
- * and signing operations. Reference: draft-miller-ssh-agent.
+ * and signing operations. Reference: RFC 9987 (SSH Agent Protocol).
  */
 /** Client → Agent */
 export declare const SSH2_AGENTC_REQUEST_IDENTITIES = 11;
 export declare const SSH2_AGENTC_SIGN_REQUEST = 13;
+export declare const SSH_AGENTC_REMOVE_ALL_IDENTITIES = 19;
+export declare const SSH_AGENTC_EXTENSION = 27;
 /** Agent → Client */
 export declare const SSH2_AGENT_FAILURE = 5;
+export declare const SSH_AGENT_SUCCESS = 6;
 export declare const SSH2_AGENT_IDENTITIES_ANSWER = 12;
 export declare const SSH2_AGENT_SIGN_RESPONSE = 14;
+export declare const SSH_AGENT_EXTENSION_FAILURE = 28;
+export declare const SSH_AGENT_EXTENSION_RESPONSE = 29;
 export declare const SSH_AGENT_RSA_SHA2_256 = 2;
 export declare const SSH_AGENT_RSA_SHA2_512 = 4;
 /**
@@ -54,3 +59,23 @@ export declare function buildIdentitiesAnswer(keys: {
  * Build an SSH2_AGENT_SIGN_RESPONSE.
  */
 export declare function buildSignResponse(signature: Buffer): Buffer;
+/**
+ * Build an SSH_AGENT_SUCCESS response (RFC 9987 §4.1).
+ */
+export declare function buildSuccess(): Buffer;
+/**
+ * Build an SSH_AGENT_EXTENSION_RESPONSE (RFC 9987 §4.7).
+ *
+ * @param payload The extension-specific response payload bytes
+ */
+export declare function buildExtensionResponse(payload: Buffer): Buffer;
+/**
+ * Parse an SSH_AGENTC_EXTENSION message buffer.
+ *
+ * @param msgBuf The full message body (msgBuf[0] is the SSH_AGENTC_EXTENSION type byte).
+ * @returns The extension name (utf-8) and the remaining bytes after the name string.
+ */
+export declare function readExtensionRequest(msgBuf: Buffer): {
+    extName: string;
+    rest: Buffer;
+};

package/dist/lib/ssh-agent-protocol.js

@@ -2,16 +2,21 @@
  * SSH agent protocol constants and framing helpers.
  *
  * Implements the subset of the SSH agent protocol needed for key listing
- * and signing operations. Reference: draft-miller-ssh-agent.
+ * and signing operations. Reference: RFC 9987 (SSH Agent Protocol).
  */
 // ─── Message types ────────────────────────────────────────────
 /** Client → Agent */
 export const SSH2_AGENTC_REQUEST_IDENTITIES = 11;
 export const SSH2_AGENTC_SIGN_REQUEST = 13;
+export const SSH_AGENTC_REMOVE_ALL_IDENTITIES = 19;
+export const SSH_AGENTC_EXTENSION = 27;
 /** Agent → Client */
 export const SSH2_AGENT_FAILURE = 5;
+export const SSH_AGENT_SUCCESS = 6;
 export const SSH2_AGENT_IDENTITIES_ANSWER = 12;
 export const SSH2_AGENT_SIGN_RESPONSE = 14;
+export const SSH_AGENT_EXTENSION_FAILURE = 28;
+export const SSH_AGENT_EXTENSION_RESPONSE = 29;
 // ─── Signature algorithm flags (SSH2_AGENTC_SIGN_REQUEST flags field) ─
 export const SSH_AGENT_RSA_SHA2_256 = 2;
 export const SSH_AGENT_RSA_SHA2_512 = 4;
@@ -105,4 +110,36 @@ export function buildSignResponse(signature) {
     sigString.copy(body, 1);
     return frameMessage(body);
 }
+/**
+ * Build an SSH_AGENT_SUCCESS response (RFC 9987 §4.1).
+ */
+export function buildSuccess() {
+    const body = Buffer.alloc(1);
+    body[0] = SSH_AGENT_SUCCESS;
+    return frameMessage(body);
+}
+/**
+ * Build an SSH_AGENT_EXTENSION_RESPONSE (RFC 9987 §4.7).
+ *
+ * @param payload The extension-specific response payload bytes
+ */
+export function buildExtensionResponse(payload) {
+    const body = Buffer.alloc(1 + payload.length);
+    body[0] = SSH_AGENT_EXTENSION_RESPONSE;
+    payload.copy(body, 1);
+    return frameMessage(body);
+}
+/**
+ * Parse an SSH_AGENTC_EXTENSION message buffer.
+ *
+ * @param msgBuf The full message body (msgBuf[0] is the SSH_AGENTC_EXTENSION type byte).
+ * @returns The extension name (utf-8) and the remaining bytes after the name string.
+ */
+export function readExtensionRequest(msgBuf) {
+    // msgBuf[0] = type byte (SSH_AGENTC_EXTENSION); extension name starts at offset 1
+    const { data, nextOffset } = readString(msgBuf, 1);
+    const extName = data.toString("utf-8");
+    const rest = msgBuf.subarray(nextOffset);
+    return { extName, rest };
+}
 //# sourceMappingURL=ssh-agent-protocol.js.map

package/dist/lib/ssh-agent-socket.d.ts

@@ -1,9 +1,49 @@
 /**
  * SSH agent Unix domain socket server.
  *
- * Creates a Unix socket that implements the SSH agent protocol,
- * serving keys from the passwd-sso vault.
+ * Creates a Unix socket that implements the SSH agent protocol (RFC 9987),
+ * serving keys from the passwd-sso vault. Supports:
+ *   - REQUEST_IDENTITIES (11)
+ *   - SIGN_REQUEST (13) — with per-signature server authorization
+ *   - REMOVE_ALL_IDENTITIES (19)
+ *   - EXTENSION (27): query, session-bind@openssh.com
  */
+import type { Socket } from "node:net";
+import type { SessionBinding } from "./ssh-session-bind.js";
+import { authorizeSign as defaultAuthorizeSign } from "./ssh-sign-authorizer.js";
+import { confirmSign as defaultConfirmSign } from "./ssh-confirm.js";
+/** Per-connection state: the verified session-bind from session-bind@openssh.com */
+export type ConnectionContext = {
+    binding: SessionBinding | null;
+};
+type AuthorizeFn = typeof defaultAuthorizeSign;
+type ConfirmFn = typeof defaultConfirmSign;
+/**
+ * Inject authorize/confirm dependencies.
+ * Must be called before the first connection. Mirrors the setEncryptionKey pattern.
+ */
+export declare function setAgentDeps(deps: {
+    authorizeSign?: AuthorizeFn;
+    confirmSign?: ConfirmFn;
+}): void;
+/**
+ * Handle a single SSH agent protocol message.
+ * Exported for unit testing (mirrors agent-decrypt.ts).
+ */
+export declare function handleMessage(msgBuf: Buffer, ctx: ConnectionContext): Promise<Buffer>;
+/**
+ * Handle a connected client socket with sequential, in-order message processing.
+ *
+ * RFC 9987 requires replies in the same order as requests. The async sign path
+ * (authorize + optional confirm) would allow a second reply to overtake the
+ * first if handled concurrently. We prevent this with a single-in-flight drain:
+ * the data handler enqueues complete frames into a per-connection buffer, then
+ * the drain loop processes one frame at a time, awaiting each reply before
+ * dequeuing the next.
+ *
+ * Exported for unit testing (mirrors agent-decrypt.ts).
+ */
+export declare function handleConnection(socket: Socket): void;
 /**
  * Start the SSH agent socket server.
  *
@@ -18,3 +58,4 @@ export declare function stopAgent(): void;
  * Get the current socket path, or null if not running.
  */
 export declare function getSocketPath(): string | null;
+export {};

package/dist/lib/ssh-agent-socket.js

@@ -1,54 +1,39 @@
 /**
  * SSH agent Unix domain socket server.
  *
- * Creates a Unix socket that implements the SSH agent protocol,
- * serving keys from the passwd-sso vault.
+ * Creates a Unix socket that implements the SSH agent protocol (RFC 9987),
+ * serving keys from the passwd-sso vault. Supports:
+ *   - REQUEST_IDENTITIES (11)
+ *   - SIGN_REQUEST (13) — with per-signature server authorization
+ *   - REMOVE_ALL_IDENTITIES (19)
+ *   - EXTENSION (27): query, session-bind@openssh.com
  */
 import { createServer } from "node:net";
 import { mkdirSync, lstatSync, chmodSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
-import { readUint32, readString, SSH2_AGENTC_REQUEST_IDENTITIES, SSH2_AGENTC_SIGN_REQUEST, buildFailure, buildIdentitiesAnswer, buildSignResponse, } from "./ssh-agent-protocol.js";
-import { getLoadedKeys, findKeyByBlob, signData } from "./ssh-key-agent.js";
-let server = null;
-let socketPath = null;
+import { readUint32, readString, encodeString, SSH2_AGENTC_REQUEST_IDENTITIES, SSH2_AGENTC_SIGN_REQUEST, SSH_AGENTC_REMOVE_ALL_IDENTITIES, SSH_AGENTC_EXTENSION, buildFailure, buildSuccess, buildIdentitiesAnswer, buildSignResponse, buildExtensionResponse, readExtensionRequest, } from "./ssh-agent-protocol.js";
+import { getLoadedKeys, findKeyByBlob, signData, clearKeys, } from "./ssh-key-agent.js";
+import { parseSessionBind, verifySessionBind, fingerprintPublicKey, } from "./ssh-session-bind.js";
+import { authorizeSign as defaultAuthorizeSign } from "./ssh-sign-authorizer.js";
+import { confirmSign as defaultConfirmSign } from "./ssh-confirm.js";
+let _authorizeSign = defaultAuthorizeSign;
+let _confirmSign = defaultConfirmSign;
 /**
- * Get the socket directory path.
- * Prefers $XDG_RUNTIME_DIR/passwd-sso/, falls back to /tmp/passwd-sso-<uid>/
+ * Inject authorize/confirm dependencies.
+ * Must be called before the first connection. Mirrors the setEncryptionKey pattern.
  */
-function getSocketDir() {
-    const xdg = process.env.XDG_RUNTIME_DIR;
-    if (xdg)
-        return join(xdg, "passwd-sso");
-    const uid = process.getuid?.();
-    if (uid === undefined) {
-        throw new Error("Cannot determine user ID for socket directory");
-    }
-    return join("/tmp", `passwd-sso-${uid}`);
-}
-/**
- * Create the socket directory with proper permissions.
- * Validates ownership and mode to prevent symlink attacks.
- */
-function ensureSocketDir(dir) {
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    // Verify ownership and permissions (TOCTOU mitigation — lstatSync to avoid following symlinks)
-    const stat = lstatSync(dir);
-    if (!stat.isDirectory()) {
-        throw new Error(`Socket path ${dir} is not a directory (possible symlink attack)`);
-    }
-    const uid = process.getuid?.();
-    if (uid !== undefined && stat.uid !== uid) {
-        throw new Error(`Socket directory ${dir} is owned by uid ${stat.uid}, expected ${uid}`);
-    }
-    const mode = stat.mode & 0o7777;
-    if (mode !== 0o700) {
-        throw new Error(`Socket directory ${dir} has mode ${mode.toString(8)}, expected 700`);
-    }
+export function setAgentDeps(deps) {
+    if (deps.authorizeSign !== undefined)
+        _authorizeSign = deps.authorizeSign;
+    if (deps.confirmSign !== undefined)
+        _confirmSign = deps.confirmSign;
 }
+// ─── Message handler ───────────────────────────────────────────
 /**
  * Handle a single SSH agent protocol message.
+ * Exported for unit testing (mirrors agent-decrypt.ts).
  */
-function handleMessage(msgBuf) {
+export async function handleMessage(msgBuf, ctx) {
     if (msgBuf.length < 1)
         return buildFailure();
     const msgType = msgBuf[0];
@@ -67,56 +52,168 @@ function handleMessage(msgBuf) {
                 const { data: keyBlob, nextOffset: afterKey } = readString(msgBuf, offset);
                 offset = afterKey;
                 // Read data to sign
-                const { data, nextOffset: afterData } = readString(msgBuf, offset);
+                const { data: dataToSign, nextOffset: afterData } = readString(msgBuf, offset);
                 offset = afterData;
                 // Read flags
-                const flags = offset + 4 <= msgBuf.length
-                    ? readUint32(msgBuf, offset)
-                    : 0;
-                // Find the key
+                const flags = offset + 4 <= msgBuf.length ? readUint32(msgBuf, offset) : 0;
+                // Resolve key
                 const key = findKeyByBlob(keyBlob);
                 if (!key)
                     return buildFailure();
-                // Perform signing
-                const signature = signData(key, data, flags);
+                // Per-key confirmation gate
+                if (key.requireReprompt) {
+                    const label = key.comment || key.entryId;
+                    const allowed = await _confirmSign(label);
+                    if (!allowed)
+                        return buildFailure();
+                }
+                // Per-signature server authorization
+                const fingerprint = fingerprintPublicKey(key.publicKeyBlob);
+                const authorized = await _authorizeSign({
+                    keyId: key.entryId,
+                    fingerprint,
+                    binding: ctx.binding,
+                });
+                if (!authorized)
+                    return buildFailure();
+                // Perform signing locally
+                const signature = signData(key, dataToSign, flags);
                 return buildSignResponse(signature);
             }
             catch {
                 return buildFailure();
             }
         }
+        case SSH_AGENTC_REMOVE_ALL_IDENTITIES: {
+            clearKeys();
+            return buildSuccess();
+        }
+        case SSH_AGENTC_EXTENSION: {
+            const { extName, rest } = readExtensionRequest(msgBuf);
+            if (extName === "query") {
+                // Advertise supported extension names as a sequence of SSH strings.
+                // OpenSSH PROTOCOL.agent: query response body = concatenated string(name) entries.
+                const payload = Buffer.concat([
+                    encodeString("query"),
+                    encodeString("session-bind@openssh.com"),
+                ]);
+                return buildExtensionResponse(payload);
+            }
+            if (extName === "session-bind@openssh.com") {
+                try {
+                    const parsed = parseSessionBind(rest);
+                    if (!verifySessionBind(parsed))
+                        return buildFailure();
+                    ctx.binding = {
+                        hostKeyFingerprint: fingerprintPublicKey(parsed.hostKeyBlob),
+                        forwarded: parsed.isForwarding,
+                    };
+                    return buildSuccess();
+                }
+                catch {
+                    return buildFailure();
+                }
+            }
+            // Unknown extension — RFC 9987 requires an empty SSH_AGENT_FAILURE.
+            return buildFailure();
+        }
         default:
             return buildFailure();
     }
 }
+// ─── Connection handler ────────────────────────────────────────
 /**
- * Handle data from a connected client.
- * SSH agent protocol uses length-prefixed messages.
+ * Handle a connected client socket with sequential, in-order message processing.
+ *
+ * RFC 9987 requires replies in the same order as requests. The async sign path
+ * (authorize + optional confirm) would allow a second reply to overtake the
+ * first if handled concurrently. We prevent this with a single-in-flight drain:
+ * the data handler enqueues complete frames into a per-connection buffer, then
+ * the drain loop processes one frame at a time, awaiting each reply before
+ * dequeuing the next.
+ *
+ * Exported for unit testing (mirrors agent-decrypt.ts).
  */
-function handleConnection(socket) {
+export function handleConnection(socket) {
+    const ctx = { binding: null };
     let buffer = Buffer.alloc(0);
-    socket.on("data", (chunk) => {
-        buffer = Buffer.concat([buffer, chunk]);
-        // Process complete messages
-        while (buffer.length >= 4) {
-            const msgLen = readUint32(buffer, 0);
-            // Reject absurdly large messages (DoS protection)
-            if (msgLen > 256 * 1024) {
-                socket.destroy();
-                return;
+    let isProcessing = false;
+    async function drain() {
+        if (isProcessing)
+            return;
+        isProcessing = true;
+        try {
+            while (buffer.length >= 4) {
+                const msgLen = readUint32(buffer, 0);
+                // Reject absurdly large messages before dequeuing (DoS protection)
+                if (msgLen > 256 * 1024) {
+                    socket.destroy();
+                    buffer = Buffer.alloc(0);
+                    return;
+                }
+                if (buffer.length < 4 + msgLen)
+                    break; // Need more data
+                const msgBuf = buffer.subarray(4, 4 + msgLen);
+                buffer = buffer.subarray(4 + msgLen);
+                let reply;
+                try {
+                    reply = await handleMessage(msgBuf, ctx);
+                }
+                catch {
+                    reply = buildFailure();
+                }
+                socket.write(reply);
             }
-            if (buffer.length < 4 + msgLen)
-                break; // Need more data
-            const msgBuf = buffer.subarray(4, 4 + msgLen);
-            buffer = buffer.subarray(4 + msgLen);
-            const response = handleMessage(msgBuf);
-            socket.write(response);
         }
+        finally {
+            isProcessing = false;
+        }
+    }
+    socket.on("data", (chunk) => {
+        buffer = Buffer.concat([buffer, chunk]);
+        void drain();
     });
     socket.on("error", () => {
         // Silently handle client disconnects
     });
 }
+// ─── Server lifecycle ──────────────────────────────────────────
+let server = null;
+let socketPath = null;
+/**
+ * Get the socket directory path.
+ * Prefers $XDG_RUNTIME_DIR/passwd-sso/, falls back to /tmp/passwd-sso-<uid>/
+ */
+function getSocketDir() {
+    const xdg = process.env.XDG_RUNTIME_DIR;
+    if (xdg)
+        return join(xdg, "passwd-sso");
+    const uid = process.getuid?.();
+    if (uid === undefined) {
+        throw new Error("Cannot determine user ID for socket directory");
+    }
+    return join("/tmp", `passwd-sso-${uid}`);
+}
+/**
+ * Create the socket directory with proper permissions.
+ * Validates ownership and mode to prevent symlink attacks.
+ */
+function ensureSocketDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // Verify ownership and permissions (TOCTOU mitigation — lstatSync to avoid following symlinks)
+    const stat = lstatSync(dir);
+    if (!stat.isDirectory()) {
+        throw new Error(`Socket path ${dir} is not a directory (possible symlink attack)`);
+    }
+    const uid = process.getuid?.();
+    if (uid !== undefined && stat.uid !== uid) {
+        throw new Error(`Socket directory ${dir} is owned by uid ${stat.uid}, expected ${uid}`);
+    }
+    const mode = stat.mode & 0o7777;
+    if (mode !== 0o700) {
+        throw new Error(`Socket directory ${dir} has mode ${mode.toString(8)}, expected 700`);
+    }
+}
 /**
  * Start the SSH agent socket server.
  *

package/dist/lib/ssh-confirm.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Per-signature confirmation gate for SSH keys with requireReprompt = true.
+ *
+ * When a key entry requires confirmation, this module prompts the user on the
+ * controlling terminal before each signature. If no TTY is available the
+ * request is denied (fail-closed) with a logged explanation.
+ *
+ * Precedent: unlock.ts uses process.stdin.isTTY for the same TTY-detection
+ * pattern. Prompt and isTTY are injectable via deps so tests need no real TTY.
+ */
+/**
+ * Optional dependency overrides, primarily for testing.
+ */
+export interface ConfirmDeps {
+    /** Override for process.stdin.isTTY */
+    isTTY?: boolean;
+    /** Override for the readline prompt function */
+    prompt?: (question: string) => Promise<string>;
+}
+/**
+ * Ask the user to confirm an SSH signing operation on the controlling TTY.
+ *
+ * Returns true only when the user explicitly answers "y" or "yes"
+ * (case-insensitive). Any other answer, Ctrl-C, or absence of a TTY → false.
+ */
+export declare function confirmSign(keyLabel: string, deps?: ConfirmDeps): Promise<boolean>;

package/dist/lib/ssh-confirm.js

@@ -0,0 +1,46 @@
+/**
+ * Per-signature confirmation gate for SSH keys with requireReprompt = true.
+ *
+ * When a key entry requires confirmation, this module prompts the user on the
+ * controlling terminal before each signature. If no TTY is available the
+ * request is denied (fail-closed) with a logged explanation.
+ *
+ * Precedent: unlock.ts uses process.stdin.isTTY for the same TTY-detection
+ * pattern. Prompt and isTTY are injectable via deps so tests need no real TTY.
+ */
+import { createInterface } from "node:readline";
+/**
+ * Ask the user to confirm an SSH signing operation on the controlling TTY.
+ *
+ * Returns true only when the user explicitly answers "y" or "yes"
+ * (case-insensitive). Any other answer, Ctrl-C, or absence of a TTY → false.
+ */
+export async function confirmSign(keyLabel, deps) {
+    const hasTTY = deps?.isTTY ?? process.stdin.isTTY;
+    if (!hasTTY) {
+        process.stderr.write(`SSH signing with "${keyLabel}" requires confirmation but no TTY is available. ` +
+            "Run the agent in the foreground (not via eval) to allow per-key confirmation.\n");
+        return false;
+    }
+    const promptFn = deps?.prompt ?? defaultPrompt;
+    const answer = await promptFn(`Allow SSH signing with "${keyLabel}"? [y/N] `);
+    const trimmed = answer.trim().toLowerCase();
+    return trimmed === "y" || trimmed === "yes";
+}
+/**
+ * Default readline-based prompt over process.stdin / process.stdout.
+ * Mirrors the pattern used in unlock.ts (readPassphrase).
+ */
+function defaultPrompt(question) {
+    return new Promise((resolve) => {
+        const rl = createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+//# sourceMappingURL=ssh-confirm.js.map

package/dist/lib/ssh-key-agent.d.ts

@@ -8,6 +8,8 @@ import type { KeyObject } from "node:crypto";
 export interface LoadedSshKey {
     /** Entry ID from the vault */
     entryId: string;
+    /** Whether each signature requires explicit user confirmation */
+    requireReprompt: boolean;
     /** PEM-encoded private key */
     pem: string;
     /** Optional passphrase for encrypted keys */
@@ -24,9 +26,9 @@ export interface LoadedSshKey {
 /**
  * Load a PEM private key into memory.
  *
- * @returns The public key blob for identity listing
+ * @returns The loaded key record
  */
-export declare function loadKey(entryId: string, pem: string, publicKeyBlob: Buffer, comment: string, passphrase?: string): Promise<LoadedSshKey>;
+export declare function loadKey(entryId: string, pem: string, publicKeyBlob: Buffer, comment: string, passphrase?: string, requireReprompt?: boolean): Promise<LoadedSshKey>;
 /**
  * Get all loaded keys for identity listing.
  */

package/dist/lib/ssh-key-agent.js

@@ -11,9 +11,9 @@ const loadedKeys = new Map();
 /**
  * Load a PEM private key into memory.
  *
- * @returns The public key blob for identity listing
+ * @returns The loaded key record
  */
-export async function loadKey(entryId, pem, publicKeyBlob, comment, passphrase) {
+export async function loadKey(entryId, pem, publicKeyBlob, comment, passphrase, requireReprompt) {
     let keyObject;
     try {
         keyObject = createPrivateKey({
@@ -26,8 +26,11 @@ export async function loadKey(entryId, pem, publicKeyBlob, comment, passphrase)
         keyObject = await parseOpenSshPrivateKey(pem, passphrase);
     }
     const keyType = detectKeyType(keyObject);
+    // Non-boolean requireReprompt (serializer regression) defaults deny-side to true.
+    const reprompt = typeof requireReprompt === "boolean" ? requireReprompt : true;
     const loaded = {
         entryId,
+        requireReprompt: reprompt,
         pem,
         passphrase,
         publicKeyBlob,

package/dist/lib/ssh-session-bind.d.ts

@@ -0,0 +1,77 @@
+/**
+ * SSH session-bind@openssh.com extension parser and verifier.
+ *
+ * Parses and cryptographically verifies the session-bind extension payload
+ * so the agent can record the host-key fingerprint and forwarding flag for
+ * audit metadata without trusting unauthenticated client assertions.
+ *
+ * Reference: RFC 9987 §4.7 + OpenSSH PROTOCOL.agent
+ */
+import type { KeyObject } from "node:crypto";
+/** Verified session-binding metadata, usable as audit context. */
+export type SessionBinding = {
+    /** SHA256 fingerprint of the host public key ("SHA256:<base64nopad>") */
+    hostKeyFingerprint: string;
+    /** True if the agent is operating over a forwarded connection */
+    forwarded: boolean;
+};
+/**
+ * Parse the payload of a session-bind@openssh.com extension message.
+ *
+ * The contents (after the extension name string) are:
+ *   string  hostkey          (SSH wire-format public key blob)
+ *   string  session-identifier
+ *   string  signature        (SSH wire-format signature blob)
+ *   bool    is_forwarding    (1 byte: 0x01 = true, 0x00 = false)
+ *
+ * @param rest Bytes immediately following the extension name string
+ */
+export declare function parseSessionBind(rest: Buffer): {
+    hostKeyBlob: Buffer;
+    sessionId: Buffer;
+    signature: Buffer;
+    isForwarding: boolean;
+};
+type ParsedPublicKey = {
+    key: KeyObject;
+    keyType: string;
+};
+/**
+ * Convert an SSH wire-format public key blob into a Node.js KeyObject.
+ *
+ * Supported types:
+ *   - ssh-ed25519
+ *   - ssh-rsa
+ *   - ecdsa-sha2-nistp256 / nistp384 / nistp521
+ *
+ * Throws an Error for unsupported key types so the caller (verifySessionBind)
+ * can catch it and return false.
+ */
+export declare function sshWirePublicKeyToKeyObject(blob: Buffer): ParsedPublicKey;
+/**
+ * Verify that the session-bind signature is valid.
+ *
+ * The host proves session control by signing the session identifier with the
+ * host private key. This binds the agent connection to a specific SSH session
+ * and host, preventing forwarded-agent hijack attacks.
+ *
+ * Algorithm binding (RFC 9987 §3.2): the signature algorithm name embedded in
+ * the signature blob must be consistent with the host-key type. Inconsistent
+ * algorithm names are rejected to prevent downgrade attacks.
+ *
+ * Returns false (never throws) on any parse error, unsupported type, or
+ * invalid signature.
+ */
+export declare function verifySessionBind(parsed: {
+    hostKeyBlob: Buffer;
+    sessionId: Buffer;
+    signature: Buffer;
+    isForwarding: boolean;
+}): boolean;
+/**
+ * Compute the standard OpenSSH SHA256 fingerprint of a public key blob.
+ *
+ * Format: "SHA256:<base64-no-padding>" (matches `ssh-keygen -l -E sha256` output).
+ */
+export declare function fingerprintPublicKey(blob: Buffer): string;
+export {};

package/dist/lib/ssh-session-bind.js

@@ -0,0 +1,272 @@
+/**
+ * SSH session-bind@openssh.com extension parser and verifier.
+ *
+ * Parses and cryptographically verifies the session-bind extension payload
+ * so the agent can record the host-key fingerprint and forwarding flag for
+ * audit metadata without trusting unauthenticated client assertions.
+ *
+ * Reference: RFC 9987 §4.7 + OpenSSH PROTOCOL.agent
+ */
+import { createPublicKey, createVerify, verify as cryptoVerify, createHash, } from "node:crypto";
+import { readString } from "./ssh-agent-protocol.js";
+// ─── Parsing ──────────────────────────────────────────────────
+/**
+ * Parse the payload of a session-bind@openssh.com extension message.
+ *
+ * The contents (after the extension name string) are:
+ *   string  hostkey          (SSH wire-format public key blob)
+ *   string  session-identifier
+ *   string  signature        (SSH wire-format signature blob)
+ *   bool    is_forwarding    (1 byte: 0x01 = true, 0x00 = false)
+ *
+ * @param rest Bytes immediately following the extension name string
+ */
+export function parseSessionBind(rest) {
+    let offset = 0;
+    const { data: hostKeyBlob, nextOffset: o1 } = readString(rest, offset);
+    offset = o1;
+    const { data: sessionId, nextOffset: o2 } = readString(rest, offset);
+    offset = o2;
+    const { data: signature, nextOffset: o3 } = readString(rest, offset);
+    offset = o3;
+    if (offset >= rest.length) {
+        throw new Error("session-bind payload too short: missing is_forwarding byte");
+    }
+    const isForwarding = rest[offset] !== 0;
+    return { hostKeyBlob, sessionId, signature, isForwarding };
+}
+/**
+ * Convert an SSH wire-format public key blob into a Node.js KeyObject.
+ *
+ * Supported types:
+ *   - ssh-ed25519
+ *   - ssh-rsa
+ *   - ecdsa-sha2-nistp256 / nistp384 / nistp521
+ *
+ * Throws an Error for unsupported key types so the caller (verifySessionBind)
+ * can catch it and return false.
+ */
+export function sshWirePublicKeyToKeyObject(blob) {
+    const { data: keyTypeBuf, nextOffset } = readString(blob, 0);
+    const keyType = keyTypeBuf.toString("utf-8");
+    switch (keyType) {
+        case "ssh-ed25519": {
+            const { data: pubPoint } = readString(blob, nextOffset);
+            if (pubPoint.length !== 32) {
+                throw new Error(`Invalid Ed25519 public key length: ${pubPoint.length}`);
+            }
+            const key = createPublicKey({
+                key: {
+                    kty: "OKP",
+                    crv: "Ed25519",
+                    x: base64url(pubPoint),
+                },
+                format: "jwk",
+            });
+            return { key, keyType };
+        }
+        case "ssh-rsa": {
+            // SSH RSA wire format: string(e), string(n) — both big-endian mpints
+            const { data: e, nextOffset: o1 } = readString(blob, nextOffset);
+            const { data: n } = readString(blob, o1);
+            const key = createPublicKey({
+                key: {
+                    kty: "RSA",
+                    n: base64url(stripLeadingZero(n)),
+                    e: base64url(stripLeadingZero(e)),
+                },
+                format: "jwk",
+            });
+            return { key, keyType };
+        }
+        case "ecdsa-sha2-nistp256":
+        case "ecdsa-sha2-nistp384":
+        case "ecdsa-sha2-nistp521": {
+            // SSH ECDSA wire format: string(curve-name), string(Q point 0x04||x||y)
+            const { data: curveNameBuf, nextOffset: o1 } = readString(blob, nextOffset);
+            const curveName = curveNameBuf.toString("utf-8");
+            const { data: qPoint } = readString(blob, o1);
+            const curveMap = {
+                "nistp256": { crv: "P-256", size: 32 },
+                "nistp384": { crv: "P-384", size: 48 },
+                "nistp521": { crv: "P-521", size: 66 },
+            };
+            const curve = curveMap[curveName];
+            if (!curve) {
+                throw new Error(`Unsupported ECDSA curve: ${curveName}`);
+            }
+            if (qPoint[0] !== 0x04) {
+                throw new Error("Only uncompressed ECDSA points are supported");
+            }
+            const x = qPoint.subarray(1, 1 + curve.size);
+            const y = qPoint.subarray(1 + curve.size, 1 + 2 * curve.size);
+            const key = createPublicKey({
+                key: {
+                    kty: "EC",
+                    crv: curve.crv,
+                    x: base64url(x),
+                    y: base64url(y),
+                },
+                format: "jwk",
+            });
+            return { key, keyType };
+        }
+        default:
+            throw new Error(`Unsupported SSH public key type: ${keyType}`);
+    }
+}
+// ─── Signature verification ────────────────────────────────────
+/**
+ * Verify that the session-bind signature is valid.
+ *
+ * The host proves session control by signing the session identifier with the
+ * host private key. This binds the agent connection to a specific SSH session
+ * and host, preventing forwarded-agent hijack attacks.
+ *
+ * Algorithm binding (RFC 9987 §3.2): the signature algorithm name embedded in
+ * the signature blob must be consistent with the host-key type. Inconsistent
+ * algorithm names are rejected to prevent downgrade attacks.
+ *
+ * Returns false (never throws) on any parse error, unsupported type, or
+ * invalid signature.
+ */
+export function verifySessionBind(parsed) {
+    try {
+        const { key, keyType } = sshWirePublicKeyToKeyObject(parsed.hostKeyBlob);
+        // Parse the SSH signature blob: string(algo-name) + string(raw-sig)
+        const { data: algoNameBuf, nextOffset } = readString(parsed.signature, 0);
+        const algoName = algoNameBuf.toString("utf-8");
+        const { data: rawSig } = readString(parsed.signature, nextOffset);
+        // Algorithm-binding check: reject mismatched algo/key pairs
+        if (!isAlgoConsistentWithKeyType(algoName, keyType)) {
+            return false;
+        }
+        return verifySshSignature(key, keyType, algoName, rawSig, parsed.sessionId);
+    }
+    catch {
+        // Any parse or crypto error → treat as invalid
+        return false;
+    }
+}
+// ─── Fingerprint ──────────────────────────────────────────────
+/**
+ * Compute the standard OpenSSH SHA256 fingerprint of a public key blob.
+ *
+ * Format: "SHA256:<base64-no-padding>" (matches `ssh-keygen -l -E sha256` output).
+ */
+export function fingerprintPublicKey(blob) {
+    const digest = createHash("sha256").update(blob).digest("base64");
+    // Remove trailing "=" padding to match OpenSSH output
+    const base64noPad = digest.replace(/=+$/, "");
+    return `SHA256:${base64noPad}`;
+}
+// ─── Internal helpers ─────────────────────────────────────────
+/**
+ * Check that a signature algorithm name is consistent with the host key type.
+ *
+ * Prevents an attacker from substituting a weaker algorithm (e.g. ssh-rsa/SHA1)
+ * for a key that supports stronger hashes, or from mixing algorithms across
+ * key families entirely.
+ */
+function isAlgoConsistentWithKeyType(algoName, keyType) {
+    switch (keyType) {
+        case "ssh-ed25519":
+            return algoName === "ssh-ed25519";
+        case "ssh-rsa":
+            // RSA host key: require SHA-2 signatures only. Modern OpenSSH (7.8+) emits
+            // rsa-sha2-256/512 for session-bind even with ssh-rsa host keys; the legacy
+            // ssh-rsa (SHA-1) signature algorithm is rejected (no SHA-1 in the trust path).
+            return algoName === "rsa-sha2-256" || algoName === "rsa-sha2-512";
+        case "ecdsa-sha2-nistp256":
+            return algoName === "ecdsa-sha2-nistp256";
+        case "ecdsa-sha2-nistp384":
+            return algoName === "ecdsa-sha2-nistp384";
+        case "ecdsa-sha2-nistp521":
+            return algoName === "ecdsa-sha2-nistp521";
+        default:
+            return false;
+    }
+}
+/**
+ * Dispatch to the correct crypto.verify call based on algorithm.
+ */
+function verifySshSignature(key, keyType, algoName, rawSig, data) {
+    switch (keyType) {
+        case "ssh-ed25519":
+            // Ed25519: no hash (null), raw 64-byte signature
+            return cryptoVerify(null, data, key, rawSig);
+        case "ssh-rsa": {
+            const hash = algoName === "rsa-sha2-512" ? "sha512" : "sha256";
+            const verifier = createVerify(hash);
+            verifier.update(data);
+            return verifier.verify(key, rawSig);
+        }
+        case "ecdsa-sha2-nistp256":
+        case "ecdsa-sha2-nistp384":
+        case "ecdsa-sha2-nistp521": {
+            const hashMap = {
+                "ecdsa-sha2-nistp256": "sha256",
+                "ecdsa-sha2-nistp384": "sha384",
+                "ecdsa-sha2-nistp521": "sha512",
+            };
+            const hash = hashMap[keyType];
+            // SSH ECDSA raw sig: string(r) || string(s) — convert to DER for Node crypto
+            const derSig = sshEcdsaToDer(rawSig);
+            const verifier = createVerify(hash);
+            verifier.update(data);
+            return verifier.verify(key, derSig);
+        }
+        default:
+            return false;
+    }
+}
+/**
+ * Convert an SSH ECDSA signature (string(r) || string(s)) to DER format.
+ *
+ * SSH format: uint32(rLen) || r || uint32(sLen) || s
+ * DER format: SEQUENCE { INTEGER r, INTEGER s }
+ *
+ * This is the inverse of derToSshEcdsa in ssh-key-agent.ts.
+ */
+function sshEcdsaToDer(sshSig) {
+    const { data: r, nextOffset } = readString(sshSig, 0);
+    const { data: s } = readString(sshSig, nextOffset);
+    // DER definite-length encoding: short form (<128) is one byte; long form
+    // (>=128) is 0x80|n followed by n big-endian length bytes. P-521 signatures
+    // push the SEQUENCE length past 127, so short-form-only encoding is invalid.
+    const encodeLen = (len) => {
+        if (len < 0x80)
+            return Buffer.from([len]);
+        const bytes = [];
+        let v = len;
+        while (v > 0) {
+            bytes.unshift(v & 0xff);
+            v >>= 8;
+        }
+        return Buffer.from([0x80 | bytes.length, ...bytes]);
+    };
+    // DER-encode each integer: 0x02 + length + value (with leading 0x00 if MSB set)
+    const encodeInt = (n) => {
+        const needsPad = n[0] !== undefined && (n[0] & 0x80) !== 0;
+        const value = needsPad ? Buffer.concat([Buffer.from([0x00]), n]) : n;
+        return Buffer.concat([Buffer.from([0x02]), encodeLen(value.length), value]);
+    };
+    const rDer = encodeInt(r);
+    const sDer = encodeInt(s);
+    const seq = Buffer.concat([rDer, sDer]);
+    return Buffer.concat([Buffer.from([0x30]), encodeLen(seq.length), seq]);
+}
+function base64url(buf) {
+    return Buffer.from(buf)
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+function stripLeadingZero(buf) {
+    let i = 0;
+    while (i < buf.length - 1 && buf[i] === 0)
+        i++;
+    return i > 0 ? buf.subarray(i) : buf;
+}
+//# sourceMappingURL=ssh-session-bind.js.map

package/dist/lib/ssh-sign-authorizer.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Per-signature server authorization for the SSH agent.
+ *
+ * Before each signature, the agent POSTs to /api/vault/ssh/sign-authorize to
+ * authorize the operation and emit an audit event server-side. The result is
+ * never cached — one authorize call per signature ensures immediate revocation
+ * and a complete audit trail.
+ *
+ * Threat-model note: this is an honest-agent audit/revocation control. A
+ * compromised agent process that already holds the decrypted private key can
+ * always sign locally; per-sign authorize cannot prevent that. The value is
+ * audit completeness and immediate policy enforcement for an honest agent.
+ */
+import type { SessionBinding } from "./ssh-session-bind.js";
+/**
+ * Authorize a single SSH signing operation against the server.
+ *
+ * Returns true only on HTTP 200 with `authorized === true`.
+ * Any other status, network error, or malformed response → false (fail-closed).
+ */
+export declare function authorizeSign(args: {
+    keyId: string;
+    fingerprint: string;
+    binding: SessionBinding | null;
+}): Promise<boolean>;
+/**
+ * Reset the one-time scope hint guard.
+ * Exposed for testing only — do not call from production code.
+ *
+ * @internal
+ */
+export declare function _resetScopeHintForTest(): void;

package/dist/lib/ssh-sign-authorizer.js

@@ -0,0 +1,61 @@
+/**
+ * Per-signature server authorization for the SSH agent.
+ *
+ * Before each signature, the agent POSTs to /api/vault/ssh/sign-authorize to
+ * authorize the operation and emit an audit event server-side. The result is
+ * never cached — one authorize call per signature ensures immediate revocation
+ * and a complete audit trail.
+ *
+ * Threat-model note: this is an honest-agent audit/revocation control. A
+ * compromised agent process that already holds the decrypted private key can
+ * always sign locally; per-sign authorize cannot prevent that. The value is
+ * audit completeness and immediate policy enforcement for an honest agent.
+ */
+import { apiRequest } from "./api-client.js";
+import * as output from "./output.js";
+// One-time hint guard: print "re-run `passwd-sso login`" at most once per run.
+let scopeHintEmitted = false;
+/**
+ * Authorize a single SSH signing operation against the server.
+ *
+ * Returns true only on HTTP 200 with `authorized === true`.
+ * Any other status, network error, or malformed response → false (fail-closed).
+ */
+export async function authorizeSign(args) {
+    const { keyId, fingerprint, binding } = args;
+    try {
+        const body = { keyId, fingerprint };
+        if (binding) {
+            body.host = {
+                hostKeyFingerprint: binding.hostKeyFingerprint,
+                forwarded: binding.forwarded,
+            };
+        }
+        const res = await apiRequest("/api/vault/ssh/sign-authorize", { method: "POST", body });
+        if (res.ok && res.status === 200 && res.data.authorized === true) {
+            return true;
+        }
+        // On scope-deny (401/403 with reason "unauthorized"), print a one-time hint.
+        if ((res.status === 401 || res.status === 403) && res.data.reason === "unauthorized") {
+            if (!scopeHintEmitted) {
+                scopeHintEmitted = true;
+                output.warn("Re-run `passwd-sso login` to grant SSH signing (ssh:sign scope).");
+            }
+        }
+        return false;
+    }
+    catch (err) {
+        output.warn(`SSH sign authorize failed: ${err instanceof Error ? err.message : "network error"}`);
+        return false;
+    }
+}
+/**
+ * Reset the one-time scope hint guard.
+ * Exposed for testing only — do not call from production code.
+ *
+ * @internal
+ */
+export function _resetScopeHintForTest() {
+    scopeHintEmitted = false;
+}
+//# sourceMappingURL=ssh-sign-authorizer.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passwd-sso-cli",
-  "version": "0.4.55",
+  "version": "0.4.57",
   "description": "CLI for passwd-sso password manager",
   "type": "module",
   "license": "MIT",
@@ -48,7 +48,7 @@
     "@types/node": "^22.15.3",
     "tsx": "^4.19.4",
     "typescript": "^5.9.0-beta",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.8"
   },
   "overrides": {
     "postcss": ">=8.5.10"