Remote host detect when connected by a remote client

[adamcstephens]

Is it possible to detect on a remote host when there's an active connection from a client? I'm trying to figure out how I can dynamically change based on the connected clients. For example, on tmux I would enforce a single client and change SSH_AUTH_SOCK depending on whether connected locally or remotely.

Or alternatively, is there a way to get the SSH_AUTH_SOCK from outside the client?

[Gaurav-Gosain]

Good question! Part of this works today, and I'll add the rest.

Seeing who is connected. tuios list-clients --json lists every client with its id, pid and session, and tuios subscribe --types client-session-changed streams an event each time a client attaches, detaches or switches session. Each event has client_id, pid, session and attached.

Getting SSH_AUTH_SOCK from outside the client. When you ssh in and run tuios attach, the client is a normal process on the host, so its environment holds that connection's SSH_AUTH_SOCK and SSH_CONNECTION. On Linux you can read it from /proc/<pid>/environ. That gives you the usual stable-symlink trick:

#!/bin/sh
# Point ~/.ssh/agent.sock at the agent of the client that attached last.
link="$HOME/.ssh/agent.sock"
tuios subscribe --types client-session-changed | while read -r ev; do
  [ "$(printf '%s' "$ev" | jq -r '.attached')" = true ] || continue
  pid=$(printf '%s' "$ev" | jq -r '.pid')
  sock=$(tr '\0' '\n' < "/proc/$pid/environ" 2>/dev/null | sed -n 's/^SSH_AUTH_SOCK=//p')
  [ -S "$sock" ] && ln -sfn "$sock" "$link"
done

Then set SSH_AUTH_SOCK=$HOME/.ssh/agent.sock in your shell rc, and every pane follows whichever client attached last. An empty SSH_CONNECTION in that same environment tells you the client is local.

A few caveats:

• /proc is Linux only, so this does not work on macOS.
• A client served by tuios's own SSH or web server shows the server's pid, not your SSH session.

Enforcing a single client. There's no built-in way yet. tmux has attach -d and detach-client for this, and I'll add an equivalent, plus an option to follow the attached client's SSH_AUTH_SOCK automatically, so the script above isn't needed. I'll post here when they land.

[adamcstephens]

Would this work for tuios native remote hosts connections? I really like the way the remote hosts feature is integrated and am interested in using this client.

Attaching a client from the terminal makes sense and could be a workaround for non-remote clients.

[Gaurav-Gosain]

Glad you like the hosts feature! Short answer: the single-client part yes, the agent part not yet, but I'm adding it.

Single client. The attach -d / detach-client work I mentioned treats a host connection like any other client. So tuios attach -d --host <name> kicks the other clients off that remote session, and the new single_client option does the same automatically. A hub that just reconnects after a network blip doesn't count as a new attach, so it won't kick anyone.

SSH_AUTH_SOCK. This one doesn't work over host connections today. On the remote, the connection shows up in list-clients, but its pid is the shared tuios stdio-proxy process that the link runs over ssh, not anything tied to you. And the link doesn't forward your agent unless you ask it to.

I'm extending the agent-follow option so it works through hosts too:

• You turn on forwarding per host, with ForwardAgent yes in ~/.ssh/config or ssh_options = ["-A"] under [hosts.<name>]. It stays off by default.
• The remote panes then follow the agent of whichever client attached last, the same way local attaches will.
• On the hub, the link forwards the agent of the client attached there, so it chains through.

Until that lands, tuios attach --host <name> --ssh is the workaround. It runs a plain tuios attach on the remote over ssh -t, so the script from my earlier comment picks up that client's SSH_AUTH_SOCK (with -A or ForwardAgent yes on).

I'll post here when both land.

[Gaurav-Gosain]

Both are on main now, including the remote hosts part!

Single client. tuios attach -d detaches every other client of the session, the same as tmux. To make it the default, set this in your config:

[daemon]
single_client = true

tuios detach-client covers the rest (-s for a whole session, --all-other to keep only yourself). It works through host connections too, so tuios attach -d --host <name> takes over a remote session. Read-only viewers and a hub reconnecting after a network drop never kick anyone.

SSH agent. Set ssh_agent = "follow" under [daemon] and every pane's SSH_AUTH_SOCK points at a stable link to the agent of the client you used last. Add this to your shell rc so shells that were already running pick it up too:

p=$(tuios ssh-agent-path 2>/dev/null) && export SSH_AUTH_SOCK="$p"

For remote hosts, turn on forwarding for that host, either ForwardAgent yes in ~/.ssh/config or ssh_options = ["-A"] under [hosts.<name>]. Each host then gets its own link, and it follows whichever client is working on that host. Hosts without forwarding behave exactly as before.

Docs:

• https://tuios.dev/docs/ssh-agent
• https://tuios.dev/docs/sessions#one-client-for-each-session

It'll be in the next release. Thanks for the detailed ask, it made both features a lot better. Let me know how it works with your setup!