agent

type Agent interface {
	// List returns the identities known to the agent.
	//
	//
	// If a session is provided, the agent may filter the returned keys based
	// on destination constraints. For example, keys that are not permitted
	// for the current session hops may be hidden to prevent enumeration.
	List(ctx context.Context, session *Session) ([]*Key, error)

	// Sign has the agent sign the data using a protocol 2 key as defined
	// in [PROTOCOL.agent] section 2.6.2.
	//
	// The options parameter allows passing the current Session state. The agent
	// validates the request against the session bindings and the key's
	// constraints before signing.
	Sign(ctx context.Context, key ssh.PublicKey, data []byte, options *SignOptions) (*ssh.Signature, error)

	// Add adds a private key to the agent.
	//
	// If a session is provided, the agent verifies that the operation is
	// permitted within the context of that session.
	Add(ctx context.Context, key InputKey, session *Session) error

	// Remove removes all identities with the given public key.
	//
	// If a session is provided, the agent may refuse to remove a key if the
	// session constraints do not allow visibility of that key (preventing
	// oracle attacks).
	Remove(ctx context.Context, key ssh.PublicKey, session *Session) error

	// RemoveAll removes all identities.
	RemoveAll(ctx context.Context, session *Session) error

	// Lock locks the agent. Sign and Remove will fail, and List will empty an empty list.
	Lock(ctx context.Context, passphrase []byte, session *Session) error

	// Unlock undoes the effect of Lock
	Unlock(ctx context.Context, passphrase []byte, session *Session) error

	// Extension processes a custom extension request. Standard-compliant agents
	// are not required to support any extensions, but this method allows agents
	// to implement vendor-specific methods or add experimental features. See
	// [PROTOCOL.agent] section 4.7.
	//
	// The session parameter provides the current session context, which may be
	// relevant for extensions that verify the connection topology or session
	// bindings.
	//
	// If agent extensions are unsupported entirely this method MUST return an
	// ErrExtensionUnsupported error. Similarly, if just the specific
	// extensionType in the request is unsupported by the agent then
	// ErrExtensionUnsupported MUST be returned.
	//
	// In the case of success, since [PROTOCOL.agent] section 4.7 specifies that
	// the contents of the response are unspecified (including the type of the
	// message), the complete response will be returned as a []byte slice,
	// including the "type" byte of the message.
	Extension(ctx context.Context, extensionType string, contents []byte, session *Session) ([]byte, error)
}

type Client struct {
	// contains filtered or unexported fields
}

type ConstraintExtension struct {
	// ExtensionName consist of a UTF-8 string suffixed by the
	// implementation domain following the naming scheme defined
	// in Section 4.2 of RFC 4251, e.g.  "[email protected]".
	ExtensionName string
	// ExtensionDetails contains the actual content of the extended
	// constraint.
	ExtensionDetails []byte
}

type DestinationConstraint struct {
	From HostIdentity
	To   HostIdentity
}

type HostIdentity struct {
	Username string
	Hostname string
	HostKeys []KeySpec
}

type InputKey struct {
	// PrivateKey must be a *rsa.PrivateKey, *dsa.PrivateKey,
	// ed25519.PrivateKey or *ecdsa.PrivateKey, which will be inserted into the
	// agent.
	PrivateKey interface{}
	// Certificate, if not nil, is communicated to the agent and will be
	// stored with the key.
	Certificate *ssh.Certificate
	// Comment is an optional, free-form string.
	Comment string
	// LifetimeSecs, if not zero, is the number of seconds that the
	// agent will store the key for.
	LifetimeSecs uint32
	// ConfirmBeforeUse, if true, requests that the agent confirm with the
	// user before each use of this key.
	ConfirmBeforeUse bool
	// ConstraintExtensions are the experimental or private-use constraints
	// defined by users.
	ConstraintExtensions []ConstraintExtension
}

type Key struct {
	Format  string
	Blob    []byte
	Comment string
}

type KeySpec struct {
	Key ssh.PublicKey
	CA  bool
}

type PublicKeyUserAuthRequest struct {
	User      string
	Service   string
	Method    string
	SessionID []byte
	Algorithm string
	PublicKey ssh.PublicKey
	// HostKey is not nil for [email protected] method.
	HostKey ssh.PublicKey
}

type RestrictDestinationConstraintExtension struct {
	Constraints []DestinationConstraint
}

type Session struct {
	// Binds contains the list of hops recorded for this connection.
	Binds []SessionBind
	// BindsAttempted indicates if the client has attempted to send session-bind
	// messages, even if the list is empty.
	BindsAttempted bool
}

type SessionBind struct {
	HostKey    ssh.PublicKey
	SessionID  []byte
	Forwarding bool
}

type SignOptions struct {
	Flags SignatureFlags
	// Session represents the current session state associated with the request.
	Session *Session
}

type SignatureFlags uint32