SSH_AGENTC_ADD_ID_CONSTRAINED (command 25) not supported — breaks step ssh login and ssh-add -t

[christian-blades-cb]

Describe the bug

ssh-agent-mux returns an error for SSH agent protocol command 25
(SSH_AGENTC_ADD_ID_CONSTRAINED), which is used when adding a key or
certificate with constraints (lifetime, confirm-before-use, etc.).

Error from step:
SSH Agent: error adding key to agent: agent: failure

Error from ssh-agent-mux:
ERROR [ssh_agent_lib::agent] Error handling message: Proto(UnsupportedCommand { command: 25 })

To Reproduce

Prerequisites: ssh-agent-mux running with SSH_AUTH_SOCK pointing to its socket.

Option A — Minimal reproduction (no CA required)

ssh-keygen -t ed25519 -f /tmp/test_key -N ""
ssh-add -t 3600 /tmp/test_key

-t sets a lifetime constraint, which causes ssh-add to use
SSH_AGENTC_ADD_ID_CONSTRAINED (command 25) instead of the plain
SSH_AGENTC_ADD_IDENTITY (command 17).

Option B — Full reproduction with step ssh login

Minimal step-ca setup

1. Install step and step-ca

macOS

brew install step

Debian/Ubuntu

apt-get install -y step-cli step-ca

Arch

pacman -S step-cli step-ca

2. Initialize a CA with SSH support

step ca init \
  --name "Test CA" \                                                                                                                                                                                                                                                                                                                                                                                                                    
  --dns localhost \
  --address :9000 \                                                                                                                                                                                                                                                                                                                                                                                                                     
  --provisioner admin@example.com \
  --ssh

Enter a password when prompted (used to encrypt the CA key and as the
provisioner password). Note the root fingerprint printed at the end, or
retrieve it later:

FINGERPRINT=$(step certificate fingerprint "$(step path)/certs/root_ca.crt")

3. Start the CA (leave running in a separate terminal)

step-ca "$(step path)/config/ca.json"

Enter the CA key password when prompted.

4. Bootstrap the client

step ca bootstrap \                                                                                                                                                                                                                                                                                                                                                                                                                     
  --ca-url https://localhost:9000 \
  --fingerprint "$FINGERPRINT" \
  --install

5. Trigger the bug

step ssh login user@example.com

Enter the provisioner password when prompted. step will generate a
short-lived SSH certificate and attempt to add it to the agent with a
lifetime constraint matching the certificate validity — which sends
command 25 and triggers the failure.

Expected behavior

Constrained identities are added successfully and proxied to the upstream
agent(s). SSH_AGENTC_ADD_ID_CONSTRAINED (25) is a standard SSH agent
protocol command. Constraints include:

• SSH_AGENT_CONSTRAIN_LIFETIME (1) — key expires after N seconds
• SSH_AGENT_CONSTRAIN_CONFIRM (2) — require confirmation before each use

step ssh login uses a lifetime constraint derived from the certificate's
validity period, which is the expected behavior for short-lived SSH
certificates.

Context

• The agent: failure response originates from
  https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.50.0:ssh/agent/client.go;l=752
  — the catch-all error when the agent replies with SSH_AGENT_FAILURE.
• ssh-agent-mux version: 0.2.0
• OS: NixOS 25.11

[christian-blades-cb]

Possibly related to #56

Apologies in advance, I asked Claude to put together the reproduction steps. They appear to be accurate. If I wrote it up myself I'd be at it for the next couple hours.

[overhacked]

Thanks for the report. I haven't had time to implement a test to reproduce and work on a fix for this, but it is on my TODO list. Ah, I just reviewed #90, so once #56 is able to be resolved (a week or two?), I will also bump ssh-agent-lib for that release.