[rudycelekli]

What was wrong

ssh-agent-key-enumeration requires the list flag to be the first argument of ssh-add (ssh-add\s+(-[A-Za-z]*[lL])). Putting any option first hides the listing. So ssh-add -E md5 -l, the usual way to list loaded keys with MD5 fingerprints, went unflagged.

The fix

The -l/-L flag may come after other arguments in the same command: ssh-add\b[^;&|]*\s-[A-Za-z]*[lL]. Adding a key whose path contains -l (ssh-add ~/.ssh/deploy-lab) still does not match, because the flag must start a word. The rule version is now 2.

Tests

I added a match fixture for ssh-add -E md5 -l and a no_match for ssh-add ~/.ssh/deploy-lab. Before the fix:

ssh-agent-key-enumeration/ssh_add_list_with_hash_option: expected match, got no_match

What I ran

cd pkg/asymptoteobserve && go test -count=1 ./...   # all ok (go1.27.2)