agilous · March 31, 2026 14:08 · ryantullis · Mar 31, 2026
diff --git a/0-1Password SSH Agent Forwarding for Devcontainers-README.md b/0-1Password SSH Agent Forwarding for Devcontainers-README.md
diff --git a/1password-ssh-devcontainer-guide.md b/1password-ssh-devcontainer-guide.md
diff --git a/LICENSE b/LICENSE
 MIT License

 Copyright (c) 2026 Bill Barnett

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:

 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.

 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
diff --git a/setup-ssh-agent.sh b/setup-ssh-agent.sh
 #!/bin/bash
 # shellcheck shell=bash
 # Setup SSH agent for 1Password in devcontainer
 # Supports macOS (Docker Desktop), Linux (native Docker), and Windows (WSL2)

 set -e

 # Script version
 SCRIPT_VERSION="1.0.0"

 # Show usage information
 show_help() {
    cat << EOF
 Usage: $(basename "$0") [OPTIONS]

 Setup SSH agent for 1Password in devcontainers.
 Detects and configures the appropriate SSH agent socket for macOS (Docker Desktop),
 Linux (native Docker), and Windows (WSL2).

 OPTIONS:
    -h, --help      Show this help message and exit
    -v, --version   Show version information and exit

 ENVIRONMENT:
    SSH_AUTH_SOCK   Will be set to the detected socket path
    HOME            Used to determine user home directory

 EXAMPLES:
    $(basename "$0")              # Run setup
    source ~/.ssh-agent-env       # Load the configured SSH_AUTH_SOCK

 For more information, see: https://github.com/agilous/1password-ssh-devcontainer-guide
 EOF
 }

 # Show version
 show_version() {
    echo "setup-ssh-agent.sh version $SCRIPT_VERSION"
 }

 # Parse command line arguments
 parse_args() {
    while [[ $# -gt 0 ]]; do
        case "$1" in
            -h|--help)
                show_help
                exit 0
                ;;
            -v|--version)
                show_version
                exit 0
                ;;
            *)
                echo "Unknown option: $1" >&2
                echo "Use --help for usage information." >&2
                exit 1
                ;;
        esac
        shift
    done
 }

 # Colors for output
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
 NC='\033[0m' # No Color

 log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
 log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

 # Portable stat function for getting file permissions
 # Returns octal permissions (e.g., 644, 755)
 get_file_perms() {
    local file="$1"
    if [[ "$(uname -s)" == "Darwin" ]]; then
        stat -f '%Lp' "$file" 2>/dev/null
    else
        stat -c '%a' "$file" 2>/dev/null
    fi
 }

 # Portable stat function for getting file group
 get_file_group() {
    local file="$1"
    if [[ "$(uname -s)" == "Darwin" ]]; then
        stat -f '%Sg' "$file" 2>/dev/null
    else
        stat -c '%G' "$file" 2>/dev/null
    fi
 }

 # Get current username
 get_current_user() {
    whoami
 }

 # Possible SSH agent socket locations (checked in order of priority)
 #
 # 1. Docker Desktop magic socket (macOS + Docker Desktop)
 #    This is the ONLY method that works on macOS with Docker Desktop.
 #    Direct socket mounts fail because Docker runs in a VM.
 DOCKER_DESKTOP_SOCK="/run/host-services/ssh-auth.sock"

 # 2. Direct mount from host - Linux native Docker
 #    These work when the host socket is directly mounted into the container.
 #    Note: We use $HOME instead of hardcoded /home/vscode to support any user
 ONEPASSWORD_SOCK="${HOME}/.1password/agent.sock"

 # 3. Direct mount from host - Windows/WSL2
 #    Windows uses a different socket path via npiperelay bridge
 WSL2_SSH_SOCK="${HOME}/.ssh/agent.sock"

 # 4. VS Code's forwarded SSH agent (fallback)
 #    VS Code sometimes creates its own forwarded socket.
 VSCODE_SSH_SOCK=$(ls /tmp/vscode-ssh-auth-*.sock 2>/dev/null | head -1)

 setup_ssh_agent() {
    # Check for Docker Desktop magic socket (macOS with Docker Desktop)
    # This must be checked FIRST because on macOS, the direct mount paths
    # may appear to exist but won't actually work.
    if [ -S "$DOCKER_DESKTOP_SOCK" ]; then
        export SSH_AUTH_SOCK="$DOCKER_DESKTOP_SOCK"
        log_info "Using Docker Desktop SSH agent forwarding at $DOCKER_DESKTOP_SOCK"

    # Check for 1Password socket (mounted from host - Linux native Docker)
    elif [ -S "$ONEPASSWORD_SOCK" ]; then
        export SSH_AUTH_SOCK="$ONEPASSWORD_SOCK"
        log_info "Using 1Password SSH agent at $ONEPASSWORD_SOCK"

    # Check for WSL2 socket (mounted from host - Windows/WSL2)
    elif [ -S "$WSL2_SSH_SOCK" ]; then
        export SSH_AUTH_SOCK="$WSL2_SSH_SOCK"
        log_info "Using WSL2 SSH agent bridge at $WSL2_SSH_SOCK"

    # Fallback to VS Code's forwarded agent
    elif [ -S "$VSCODE_SSH_SOCK" ]; then
        export SSH_AUTH_SOCK="$VSCODE_SSH_SOCK"
        log_warn "1Password socket not found, using VS Code SSH agent forwarding"
        log_warn "For 1Password support, ensure your host SSH_AUTH_SOCK points to 1Password"

    else
        log_error "No SSH agent socket found!"
        log_error ""
        log_error "To use 1Password SSH agent, configure your host machine:"
        log_error ""
        log_error "  macOS (Docker Desktop):"
        log_error "    1. Enable SSH agent in 1Password Settings > Developer"
        log_error "    2. Run: launchctl setenv SSH_AUTH_SOCK \"\$HOME/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock\""
        log_error "    3. Restart Docker Desktop"
        log_error "    4. Rebuild the devcontainer"
        log_error ""
        log_error "  Linux (native Docker):"
        log_error "    1. Enable SSH agent in 1Password Settings > Developer"
        log_error "    2. Add to ~/.bashrc or ~/.zshrc:"
        log_error "       export SSH_AUTH_SOCK=~/.1password/agent.sock"
        log_error "    3. Rebuild the devcontainer"
        log_error ""
        log_error "  Windows (WSL2):"
        log_error "    1. Enable SSH agent in 1Password Settings > Developer"
        log_error "    2. Install npiperelay on Windows:"
        log_error "       - Download from https://github.com/jstarks/npiperelay/releases"
        log_error "       - Extract to C:\\Users\\USERNAME\\bin\\"
        log_error "    3. Install socat in WSL: sudo apt install socat"
        log_error "    4. Add to ~/.bashrc or ~/.zshrc:"
        log_error "       export SSH_AUTH_SOCK=\"\$HOME/.ssh/agent.sock\""
        log_error "       if ! ss -a 2>/dev/null | grep -q \"\$SSH_AUTH_SOCK\"; then"
        log_error "           rm -f \"\$SSH_AUTH_SOCK\""
        log_error "           (setsid socat UNIX-LISTEN:\"\$SSH_AUTH_SOCK\",fork \\"
        log_error "               EXEC:\"/mnt/c/Users/USERNAME/bin/npiperelay.exe -ei -s //./pipe/openssh-ssh-agent\",nofork &)"
        log_error "       fi"
        log_error "    5. Use full path to npiperelay.exe (not just the filename)"
        log_warn "Continuing without SSH agent; Git SSH signing will not be auto-configured."
        return 0
    fi

    # Verify agent has identities
    if ssh-add -l &>/dev/null; then
        local key_count=$(ssh-add -l | wc -l)
        log_info "SSH agent has $key_count key(s) available"

        # Configure git to use SSH signing if keys are available
        if command -v git &>/dev/null; then
            SIGNING_KEY=$(ssh-add -L 2>/dev/null | head -1)
            if [ -n "$SIGNING_KEY" ]; then
                git config --global gpg.format ssh
                git config --global user.signingkey "$SIGNING_KEY"
                git config --global commit.gpgsign true
                git config --global tag.gpgsign true
                log_info "Git configured for SSH commit signing"
            fi
        fi
    else
        log_warn "SSH agent is available but has no identities"
        log_warn "Make sure 1Password is unlocked and SSH keys are available"
    fi
 }

 # Write SSH_AUTH_SOCK to a file that can be sourced by shells
 write_env_file() {
    # Create a stable symlink so remoteEnv in devcontainer.json always works.
    # The IDE's SCM panel (commit button) runs git in a non-interactive process
    # that doesn't source shell rc files, so it needs SSH_AUTH_SOCK set via
    # remoteEnv — which requires a fixed, predictable path.
    STABLE_SOCK="/tmp/ssh-agent-stable.sock"
    ln -sf "$SSH_AUTH_SOCK" "$STABLE_SOCK"
    export SSH_AUTH_SOCK="$STABLE_SOCK"

    local env_file="${HOME}/.ssh-agent-env"
    echo "export SSH_AUTH_SOCK=\"${STABLE_SOCK}\"" > "$env_file"
    log_info "SSH agent config written to $env_file"
    log_info "Add 'source ~/.ssh-agent-env' to your shell rc file if needed"
 }

 # Fix permissions for SSH agent socket access
 fix_socket_permissions() {
    local current_user
    current_user=$(get_current_user)

    # Docker Desktop magic socket (macOS) - chmod directly since it's recreated on each Docker start
    if [ -S "$DOCKER_DESKTOP_SOCK" ]; then
        local socket_perms
        socket_perms=$(get_file_perms "$DOCKER_DESKTOP_SOCK")
        if [ "$socket_perms" != "660" ] && [ "$socket_perms" != "666" ] && [ "$socket_perms" != "777" ]; then
            log_info "Fixing permissions on Docker Desktop SSH socket..."
            sudo chmod 660 "$DOCKER_DESKTOP_SOCK" 2>/dev/null || {
                log_warn "Could not fix socket permissions. You may need to run:"
                log_warn "  sudo chmod 660 $DOCKER_DESKTOP_SOCK"
            }
        fi
    fi

    # Direct socket mounts (Linux) - add user to root group
    if [ -S "$ONEPASSWORD_SOCK" ]; then
        # Check if socket is owned by root group and we're not in it
        local socket_group
        socket_group=$(get_file_group "$ONEPASSWORD_SOCK")
        if [ "$socket_group" = "root" ] && ! id -nG | grep -qw root; then
            log_info "Adding $current_user to root group for 1Password socket access..."
            sudo usermod -aG root "$current_user" 2>/dev/null || true
            log_info "Group membership updated (takes effect in new terminal sessions)"
        fi
    fi

    # WSL2 socket mounts - add user to root group if needed
    if [ -S "$WSL2_SSH_SOCK" ]; then
        local socket_group
        socket_group=$(get_file_group "$WSL2_SSH_SOCK")
        if [ "$socket_group" = "root" ] && ! id -nG | grep -qw root; then
            log_info "Adding $current_user to root group for WSL2 socket access..."
            sudo usermod -aG root "$current_user" 2>/dev/null || true
            log_info "Group membership updated (takes effect in new terminal sessions)"
        fi
    fi
 }

 # Main
 main() {
    # Parse arguments first (handles --help, --version)
    parse_args "$@"

    log_info "Setting up SSH agent for devcontainer..."

    # Create .1password directory if it doesn't exist (for mount point)
    mkdir -p "${HOME}/.1password" 2>/dev/null || true

    fix_socket_permissions
    setup_ssh_agent
    write_env_file

    echo ""
    log_info "SSH agent setup complete!"
 }

 main "$@"
Platform	Docker	Status
macOS	Docker Desktop	Tested
Linux	Native Docker	Untested
Windows	WSL2 + Docker Desktop	Tested
	MIT License

	Copyright (c) 2026 Bill Barnett

	Permission is hereby granted, free of charge, to any person obtaining a copy
	of this software and associated documentation files (the "Software"), to deal
	in the Software without restriction, including without limitation the rights
	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	copies of the Software, and to permit persons to whom the Software is
	furnished to do so, subject to the following conditions:

	The above copyright notice and this permission notice shall be included in all
	copies or substantial portions of the Software.

	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
	IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
	AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
	LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
	OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
	SOFTWARE.
	#!/bin/bash
	# shellcheck shell=bash
	# Setup SSH agent for 1Password in devcontainer
	# Supports macOS (Docker Desktop), Linux (native Docker), and Windows (WSL2)

	set -e

	# Script version
	SCRIPT_VERSION="1.0.0"

	# Show usage information
	show_help() {
	cat << EOF
	Usage: $(basename "$0") [OPTIONS]

	Setup SSH agent for 1Password in devcontainers.
	Detects and configures the appropriate SSH agent socket for macOS (Docker Desktop),
	Linux (native Docker), and Windows (WSL2).

	OPTIONS:
	-h, --help Show this help message and exit
	-v, --version Show version information and exit

	ENVIRONMENT:
	SSH_AUTH_SOCK Will be set to the detected socket path
	HOME Used to determine user home directory

	EXAMPLES:
	$(basename "$0") # Run setup
	source ~/.ssh-agent-env # Load the configured SSH_AUTH_SOCK

	For more information, see: https://github.com/agilous/1password-ssh-devcontainer-guide
	EOF
	}

	# Show version
	show_version() {
	echo "setup-ssh-agent.sh version $SCRIPT_VERSION"
	}

	# Parse command line arguments
	parse_args() {
	while [[ $# -gt 0 ]]; do
	case "$1" in
	-h\|--help)
	show_help
	exit 0
	;;
	-v\|--version)
	show_version
	exit 0
	;;
	*)
	echo "Unknown option: $1" >&2
	echo "Use --help for usage information." >&2
	exit 1
	;;
	esac
	shift
	done
	}

	# Colors for output
	RED='\033[0;31m'
	GREEN='\033[0;32m'
	YELLOW='\033[1;33m'
	NC='\033[0m' # No Color

	log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
	log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
	log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

	# Portable stat function for getting file permissions
	# Returns octal permissions (e.g., 644, 755)
	get_file_perms() {
	local file="$1"
	if [[ "$(uname -s)" == "Darwin" ]]; then
	stat -f '%Lp' "$file" 2>/dev/null
	else
	stat -c '%a' "$file" 2>/dev/null
	fi
	}

	# Portable stat function for getting file group
	get_file_group() {
	local file="$1"
	if [[ "$(uname -s)" == "Darwin" ]]; then
	stat -f '%Sg' "$file" 2>/dev/null
	else
	stat -c '%G' "$file" 2>/dev/null
	fi
	}

	# Get current username
	get_current_user() {
	whoami
	}

	# Possible SSH agent socket locations (checked in order of priority)
	#
	# 1. Docker Desktop magic socket (macOS + Docker Desktop)
	# This is the ONLY method that works on macOS with Docker Desktop.
	# Direct socket mounts fail because Docker runs in a VM.
	DOCKER_DESKTOP_SOCK="/run/host-services/ssh-auth.sock"

	# 2. Direct mount from host - Linux native Docker
	# These work when the host socket is directly mounted into the container.
	# Note: We use $HOME instead of hardcoded /home/vscode to support any user
	ONEPASSWORD_SOCK="${HOME}/.1password/agent.sock"

	# 3. Direct mount from host - Windows/WSL2
	# Windows uses a different socket path via npiperelay bridge
	WSL2_SSH_SOCK="${HOME}/.ssh/agent.sock"

	# 4. VS Code's forwarded SSH agent (fallback)
	# VS Code sometimes creates its own forwarded socket.
	VSCODE_SSH_SOCK=$(ls /tmp/vscode-ssh-auth-*.sock 2>/dev/null \| head -1)

	setup_ssh_agent() {
	# Check for Docker Desktop magic socket (macOS with Docker Desktop)
	# This must be checked FIRST because on macOS, the direct mount paths
	# may appear to exist but won't actually work.
	if [ -S "$DOCKER_DESKTOP_SOCK" ]; then
	export SSH_AUTH_SOCK="$DOCKER_DESKTOP_SOCK"
	log_info "Using Docker Desktop SSH agent forwarding at $DOCKER_DESKTOP_SOCK"

	# Check for 1Password socket (mounted from host - Linux native Docker)
	elif [ -S "$ONEPASSWORD_SOCK" ]; then
	export SSH_AUTH_SOCK="$ONEPASSWORD_SOCK"
	log_info "Using 1Password SSH agent at $ONEPASSWORD_SOCK"

	# Check for WSL2 socket (mounted from host - Windows/WSL2)
	elif [ -S "$WSL2_SSH_SOCK" ]; then
	export SSH_AUTH_SOCK="$WSL2_SSH_SOCK"
	log_info "Using WSL2 SSH agent bridge at $WSL2_SSH_SOCK"

	# Fallback to VS Code's forwarded agent
	elif [ -S "$VSCODE_SSH_SOCK" ]; then
	export SSH_AUTH_SOCK="$VSCODE_SSH_SOCK"
	log_warn "1Password socket not found, using VS Code SSH agent forwarding"
	log_warn "For 1Password support, ensure your host SSH_AUTH_SOCK points to 1Password"

	else
	log_error "No SSH agent socket found!"
	log_error ""
	log_error "To use 1Password SSH agent, configure your host machine:"
	log_error ""
	log_error " macOS (Docker Desktop):"
	log_error " 1. Enable SSH agent in 1Password Settings > Developer"
	log_error " 2. Run: launchctl setenv SSH_AUTH_SOCK \"\$HOME/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock\""
	log_error " 3. Restart Docker Desktop"
	log_error " 4. Rebuild the devcontainer"
	log_error ""
	log_error " Linux (native Docker):"
	log_error " 1. Enable SSH agent in 1Password Settings > Developer"
	log_error " 2. Add to ~/.bashrc or ~/.zshrc:"
	log_error " export SSH_AUTH_SOCK=~/.1password/agent.sock"
	log_error " 3. Rebuild the devcontainer"
	log_error ""
	log_error " Windows (WSL2):"
	log_error " 1. Enable SSH agent in 1Password Settings > Developer"
	log_error " 2. Install npiperelay on Windows:"
	log_error " - Download from https://github.com/jstarks/npiperelay/releases"
	log_error " - Extract to C:\\Users\\USERNAME\\bin\\"
	log_error " 3. Install socat in WSL: sudo apt install socat"
	log_error " 4. Add to ~/.bashrc or ~/.zshrc:"
	log_error " export SSH_AUTH_SOCK=\"\$HOME/.ssh/agent.sock\""
	log_error " if ! ss -a 2>/dev/null \| grep -q \"\$SSH_AUTH_SOCK\"; then"
	log_error " rm -f \"\$SSH_AUTH_SOCK\""
	log_error " (setsid socat UNIX-LISTEN:\"\$SSH_AUTH_SOCK\",fork \\"
	log_error " EXEC:\"/mnt/c/Users/USERNAME/bin/npiperelay.exe -ei -s //./pipe/openssh-ssh-agent\",nofork &)"
	log_error " fi"
	log_error " 5. Use full path to npiperelay.exe (not just the filename)"
	log_warn "Continuing without SSH agent; Git SSH signing will not be auto-configured."
	return 0
	fi

	# Verify agent has identities
	if ssh-add -l &>/dev/null; then
	local key_count=$(ssh-add -l \| wc -l)
	log_info "SSH agent has $key_count key(s) available"

	# Configure git to use SSH signing if keys are available
	if command -v git &>/dev/null; then
	SIGNING_KEY=$(ssh-add -L 2>/dev/null \| head -1)
	if [ -n "$SIGNING_KEY" ]; then
	git config --global gpg.format ssh
	git config --global user.signingkey "$SIGNING_KEY"
	git config --global commit.gpgsign true
	git config --global tag.gpgsign true
	log_info "Git configured for SSH commit signing"
	fi
	fi
	else
	log_warn "SSH agent is available but has no identities"
	log_warn "Make sure 1Password is unlocked and SSH keys are available"
	fi
	}

	# Write SSH_AUTH_SOCK to a file that can be sourced by shells
	write_env_file() {
	# Create a stable symlink so remoteEnv in devcontainer.json always works.
	# The IDE's SCM panel (commit button) runs git in a non-interactive process
	# that doesn't source shell rc files, so it needs SSH_AUTH_SOCK set via
	# remoteEnv — which requires a fixed, predictable path.
	STABLE_SOCK="/tmp/ssh-agent-stable.sock"
	ln -sf "$SSH_AUTH_SOCK" "$STABLE_SOCK"
	export SSH_AUTH_SOCK="$STABLE_SOCK"

	local env_file="${HOME}/.ssh-agent-env"
	echo "export SSH_AUTH_SOCK=\"${STABLE_SOCK}\"" > "$env_file"
	log_info "SSH agent config written to $env_file"
	log_info "Add 'source ~/.ssh-agent-env' to your shell rc file if needed"
	}

	# Fix permissions for SSH agent socket access
	fix_socket_permissions() {
	local current_user
	current_user=$(get_current_user)

	# Docker Desktop magic socket (macOS) - chmod directly since it's recreated on each Docker start
	if [ -S "$DOCKER_DESKTOP_SOCK" ]; then
	local socket_perms
	socket_perms=$(get_file_perms "$DOCKER_DESKTOP_SOCK")
	if [ "$socket_perms" != "660" ] && [ "$socket_perms" != "666" ] && [ "$socket_perms" != "777" ]; then
	log_info "Fixing permissions on Docker Desktop SSH socket..."
	sudo chmod 660 "$DOCKER_DESKTOP_SOCK" 2>/dev/null \|\| {
	log_warn "Could not fix socket permissions. You may need to run:"
	log_warn " sudo chmod 660 $DOCKER_DESKTOP_SOCK"
	}
	fi
	fi

	# Direct socket mounts (Linux) - add user to root group
	if [ -S "$ONEPASSWORD_SOCK" ]; then
	# Check if socket is owned by root group and we're not in it
	local socket_group
	socket_group=$(get_file_group "$ONEPASSWORD_SOCK")
	if [ "$socket_group" = "root" ] && ! id -nG \| grep -qw root; then
	log_info "Adding $current_user to root group for 1Password socket access..."
	sudo usermod -aG root "$current_user" 2>/dev/null \|\| true
	log_info "Group membership updated (takes effect in new terminal sessions)"
	fi
	fi

	# WSL2 socket mounts - add user to root group if needed
	if [ -S "$WSL2_SSH_SOCK" ]; then
	local socket_group
	socket_group=$(get_file_group "$WSL2_SSH_SOCK")
	if [ "$socket_group" = "root" ] && ! id -nG \| grep -qw root; then
	log_info "Adding $current_user to root group for WSL2 socket access..."
	sudo usermod -aG root "$current_user" 2>/dev/null \|\| true
	log_info "Group membership updated (takes effect in new terminal sessions)"
	fi
	fi
	}

	# Main
	main() {
	# Parse arguments first (handles --help, --version)
	parse_args "$@"

	log_info "Setting up SSH agent for devcontainer..."

	# Create .1password directory if it doesn't exist (for mount point)
	mkdir -p "${HOME}/.1password" 2>/dev/null \|\| true

	fix_socket_permissions
	setup_ssh_agent
	write_env_file

	echo ""
	log_info "SSH agent setup complete!"
	}

	main "$@"