Limit ssh key lifetime to 12h in SSH sessions

CLAUDE.md

@@ -19,6 +19,7 @@ and adds `bin/` to PATH. `$LWS` points to repo root.
 - `is_slow_init` / `is_fast_init` — check `LWS_FAST` mode
 - `is_interactive_shell` — true when `[[ $- == *i* ]]`
 - `is_wsl` — detect WSL environment
+- `is_ssh_session` — true when logged in over SSH
 - `true_false <val>` — normalize `1/true/yes` to boolean
 - `prepend_path` / `append_path` / `prepend_path_try` / `append_path_try` — safe PATH manipulation
 - `source_try <file>` — source file if it exists

functions.sh

@@ -156,3 +156,8 @@ function true_false() {
 function is_wsl() {
   grep -q -i wsl /proc/version
 }
+
+function is_ssh_session() {
+  # sshd sets SSH_CONNECTION only in sessions opened over SSH
+  [[ -n "${SSH_CONNECTION:-}" ]]
+}

rc/ssh-agent.sh

@@ -7,6 +7,13 @@ function _log() {
 _SSH_AGENT_NO_KEYS=1
 _SSH_AGENT_NOT_RUNNING=2
 
+SSH_KEY_TIMEOUT_HOURS=${SSH_KEY_TIMEOUT_HOURS:-12}
+SSH_KEY_TIMEOUT_MINUTES=$((SSH_KEY_TIMEOUT_HOURS * 60))
+
+function _should_limit_key_lifetime() {
+  ! is_wsl && is_ssh_session
+}
+
 for key in id_ecdsa id_rsa; do
   key_filename="$HOME/.ssh/$key"
 
@@ -43,7 +50,12 @@ for key in id_ecdsa id_rsa; do
         ssh-add "$key_filename"
       fi
     else
-      eval "$(keychain --eval --quiet --agents ssh $key)"
+      keychain_args=()
+      if _should_limit_key_lifetime; then
+        _log "Limiting key lifetime to $SSH_KEY_TIMEOUT_HOURS hours"
+        keychain_args=(--timeout "$SSH_KEY_TIMEOUT_MINUTES")
+      fi
+      eval "$(keychain --eval --quiet "${keychain_args[@]}" --agents ssh $key)"
     fi
 
     break