From e76c3efe4e18cc9d9f35988cf43c2bc5a1362ce8 Mon Sep 17 00:00:00 2001
From: Alex Clarke <alex.j.tusa@gmail.com>
Date: Tue, 4 Aug 2026 10:56:50 -0600
Subject: [PATCH] feat: integrated the git-ssh-sign kit into the coyote sandbox
 kit

---
 .../files/home/.config/git/hooks/pre-commit   | 21 ++++++++++
 assets/sbx-kit/spec.yaml                      | 41 +++++++++++++++++++
 2 files changed, 62 insertions(+)
 create mode 100755 assets/sbx-kit/files/home/.config/git/hooks/pre-commit

diff --git a/assets/sbx-kit/files/home/.config/git/hooks/pre-commit b/assets/sbx-kit/files/home/.config/git/hooks/pre-commit
new file mode 100755
index 0000000..3432df5
--- /dev/null
+++ b/assets/sbx-kit/files/home/.config/git/hooks/pre-commit
@@ -0,0 +1,21 @@
+#!/bin/sh
+if [ -z "$SSH_AUTH_SOCK" ]; then
+    echo "WARNING: [git-ssh-sign] no SSH agent — cannot sign commits"
+fi
+
+KEY=$(ssh-add -L 2>/dev/null | head -1)
+
+if [ -z "$KEY" ]; then
+    echo "WARNING: [git-ssh-sign] no keys in SSH agent — cannot sign commits"
+fi
+
+KEY_FILE="/home/agent/.config/git/signing_key.pub"
+mkdir -p "$(dirname "$KEY_FILE")"
+printf '%s\n' "$KEY" > "$KEY_FILE"
+EMAIL=$(git config user.email 2>/dev/null || echo "agent@sandbox.local")
+printf '%s %s\n' "$EMAIL" "$KEY" > "/home/agent/.config/git/allowed_signers"
+
+local_hook="$(git rev-parse --git-dir)/hooks/pre-commit"
+if [ -x "$local_hook" ]; then
+    exec "$local_hook" "$@"
+fi
diff --git a/assets/sbx-kit/spec.yaml b/assets/sbx-kit/spec.yaml
index f985a2d..6f24c68 100644
--- a/assets/sbx-kit/spec.yaml
+++ b/assets/sbx-kit/spec.yaml
@@ -238,6 +238,47 @@ environment:
     - ZHIPUAI_API_KEY
 
 commands:
+  initFiles:
+    - path: /home/agent/.config/git/ssh-signing-key-command
+      mode: '0755'
+      description: Resolve the forwarded SSH agent key for Git SSH signing
+      content: |
+        #!/bin/sh
+        set -e
+
+        if [ -z "$SSH_AUTH_SOCK" ]; then
+            echo "WARNING: [git-ssh-sign] no SSH agent - cannot sign commits" >&2
+        fi
+
+        key=$(ssh-add -L 2>/dev/null | head -n 1)
+        if [ -z "$key" ]; then
+            echo "WARNING: [git-ssh-sign] no keys in SSH agent - cannot sign commits" >&2
+        fi
+
+        config_dir="$GIT_SSH_SIGN_CONFIG_DIR"
+        if [ -z "$config_dir" ]; then
+            config_dir="/home/agent/.config/git"
+        fi
+        mkdir -p "$config_dir"
+
+        email=$(git config user.email 2>/dev/null || printf '%s' "agent@sandbox.local")
+        printf '%s %s\n' "$email" "$key" > "$config_dir/allowed_signers"
+        printf 'key::%s\n' "$key"
+
+  install:
+    - command: |
+        git config --system gpg.format ssh
+        git config --system --unset-all user.signingKey || true
+        git config --system commit.gpgSign true
+        git config --system tag.gpgSign true
+        git config --system gpg.ssh.defaultKeyCommand /home/agent/.config/git/ssh-signing-key-command
+        git config --system gpg.ssh.allowedSignersFile /home/agent/.config/git/allowed_signers
+        if [ "$(git config --system --get core.hooksPath || true)" = "/home/agent/.config/git/hooks" ]; then
+            git config --system --unset-all core.hooksPath
+        fi
+      user: '0'
+      description: Configure SSH commit signing with a dynamic key command
+
   startup:
     - command:
         [