Run ssh-agent via fish shell

fish-agent.sh

#!/bin/bash
#
# Convert ssh-agent output to fish shell
#

eval "$(ssh-agent)" >/dev/null

echo "set SSH_AUTH_SOCK \"$SSH_AUTH_SOCK\"; export SSH_AUTH_SOCK"
echo "set SSH_AGENT_PID \"$SSH_AGENT_PID\"; export SSH_AGENT_PID"

Thanks! Came in very handy.

eval (ssh-agent -c)

Consider to use

fish_ssh_agent

Utility functions to start your ssh agent when using fish shell. You will only need to run ssh-add and type your password once, after the running ssh_agent should do the work for you. Need to run once, environment variables shared between sessions.

# config.fish
if test -z (pgrep ssh-agent)
  eval (ssh-agent -c)
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
  set -Ux SSH_AGENT_PID $SSH_AGENT_PID
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
end

# config.fish
if test -z (pgrep ssh-agent)
  eval (ssh-agent -c)
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
  set -Ux SSH_AGENT_PID $SSH_AGENT_PID
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
end

Excellent. Thank you!

# config.fish
if test -z (pgrep ssh-agent)
  eval (ssh-agent -c)
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
  set -Ux SSH_AGENT_PID $SSH_AGENT_PID
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
end

is it worth it adding ssh-add somewhere in here so you only need to input your passphrase once per session?

# config.fish
if test -z (pgrep ssh-agent)
  eval (ssh-agent -c) > /dev/null
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
  set -Ux SSH_AGENT_PID $SSH_AGENT_PID
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
end

# config.fish
if test -z (pgrep ssh-agent)
  eval (ssh-agent -c)
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
  set -Ux SSH_AGENT_PID $SSH_AGENT_PID
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
end

work for msys2+fish installation 👍

# config.fish
if not pgrep --full ssh-agent | string collect > /dev/null
  eval (ssh-agent -c)
  set -Ux SSH_AGENT_PID $SSH_AGENT_PID
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
end

works in WSL too

edited after hint from robfordww

No need to export set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK twice!

Better twice, just to be sure!

Better twice, just to be sure!

this is a joke right?

Further, this handles better the case when ssh-agent pgrep might return multiple processes.

if test -z (pgrep ssh-agent | string collect)
    eval (ssh-agent -c)
    set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
    set -Ux SSH_AGENT_PID $SSH_AGENT_PID
end

consider this

function sshagent_findsockets
	find /tmp -uid (id -u) -type s -name agent.\* 2>/dev/null
end

function sshagent_testsocket
    if [ ! -x (command which ssh-add) ] ;
        echo "ssh-add is not available; agent testing aborted"
        return 1
    end

    if [ X"$argv[1]" != X ] ;
    	set -xg SSH_AUTH_SOCK $argv[1]
    end

    if [ X"$SSH_AUTH_SOCK" = X ]
    	return 2
    end

    if [ -S $SSH_AUTH_SOCK ] ;
        ssh-add -l > /dev/null
        if [ $status = 2 ] ;
            echo "Socket $SSH_AUTH_SOCK is dead!  Deleting!"
            rm -f $SSH_AUTH_SOCK
            return 4
        else ;
            echo "Found ssh-agent $SSH_AUTH_SOCK"
            return 0
        end
    else ;
        echo "$SSH_AUTH_SOCK is not a socket!"
        return 3
    end
end


function ssh_agent_init
    # ssh agent sockets can be attached to a ssh daemon process or an
    # ssh-agent process.

    set -l AGENTFOUND 0

    # Attempt to find and use the ssh-agent in the current environment
    if sshagent_testsocket ;
        set AGENTFOUND 1
    end

    # If there is no agent in the environment, search /tmp for
    # possible agents to reuse before starting a fresh ssh-agent
    # process.
    if [ $AGENTFOUND = 0 ];
        for agentsocket in (sshagent_findsockets)
            if [ $AGENTFOUND != 0 ] ;
	            break
            end
            if sshagent_testsocket $agentsocket ;
	       set AGENTFOUND 1
	    end

        end
    end

    # If at this point we still haven't located an agent, it's time to
    # start a new one
    if [ $AGENTFOUND = 0 ] ;
	echo need to start a new agent
	eval (ssh-agent -c)
    end

    # Finally, show what keys are currently in the agent
    # ssh-add -l
end

ssh_agent_init

I don't really like the set -U which will prevent from running multiple agents if needed
SSH_AGENT_PID is not mandatory

Your code shows the ssh id agent number after every instance of a terminal is opened, please tell me how to hide that.

Isn't it only for new instances (when ssh-agent is not running) ?
but, I think you have to redirect the eval to /dev/null
or maybe my prompt is overriding the ouput 🤷

+1 @Optiligence 's answer.

Isn't it only for new instances (when ssh-agent is not running) ? but, I think you have to redirect the eval to /dev/null or maybe my prompt is overriding the ouput shrug

uhhhh, see the thing is I am a beginner and I don't know anything about fish/bash scripting so can you please tell me how am I supposed to fix it?

To remove the agent pid information replace eval (ssh-agent -c) with eval (ssh-agent -c | head -n2)

@thibault-ketterer would you care create a MR of your snippet into https://github.com/danhper/fish-ssh-agent?

I am astonished, that no solution bothers to cleanup started agents, ie with on of those for security:

trap "kill $SSH_AGENT_PID" exit
trap "ssh-agent -k" exit

See also https://rabexc.org/posts/pitfalls-of-ssh-agents. Ideally the WM has a ssh-agent instance one could use instead of spawning a new one in each terminal.

worked with eval (ssh-agent -c) without any quote
my fish libs

jorgebucaran/fisher
edc/bass

@haidang666 you'll need to run this in each new session/window/tab, and this will open new process every time.

if u wanna avoid zoo of agent processes see how univesal variables used in fish_ssh_agent

does anyone know how to unsubscribe from these notifications? Is it life-time?

Click unsubscribe at the top of this page or within the email

For systemd users running a single agent, the modern "proper" way to do this is to launch the ssh-agent user service (in Fedora it's provided by the openssh-clients package). Then all you have to add is:
set -gx SSH_AUTH_SOCK "$XDG_RUNTIME_DIR/ssh-agent.socket"

eval (ssh-agent -c)

This works! Thank you!

If you're using macOS, you don't need to manage ssh-agent (whether it be your Fish config or any other shell).

Instead, run this for each key you use to store the passphrase in the Keychain:

ssh-add --apple-use-keychain ~/.ssh/my_key
# This flag works with Apple's `/usr/bin/ssh-add`.
# (Other `ssh` versions may lack the flag.)

Then add this to ~/.ssh/config:

Host *
    UseKeychain yes
    AddKeysToAgent yes

With the above settings:

• on first use of each key,
• ssh will look up the passphrase from your Keychain,
• and load the key into the agent,
• without prompting you.

You get to avoid the complexities of starting and stopping ssh-agent correctly. No startup code, no stale sockets, no orphaned agent processes.

P.S. This answer matches my experience, and Claude Sonnet 4.6 agrees.