From 5452e50080ff4d514d13ce7d53e7fbc1442a8cd8 Mon Sep 17 00:00:00 2001
From: henrygd <hank@henrygd.me>
Date: Wed, 4 Feb 2026 18:48:55 -0500
Subject: [PATCH] add DISABLE_SSH env var (#1061)

---
 agent/server.go      |  3 +++
 agent/server_test.go | 20 ++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/agent/server.go b/agent/server.go
index c700bbf3..bef024ff 100644
--- a/agent/server.go
+++ b/agent/server.go
@@ -36,6 +36,9 @@ var hubVersions map[string]semver.Version
 // and begins listening for connections. Returns an error if the server
 // is already running or if there's an issue starting the server.
 func (a *Agent) StartServer(opts ServerOptions) error {
+	if disableSSH, _ := GetEnv("DISABLE_SSH"); disableSSH == "true" {
+		return errors.New("SSH disabled")
+	}
 	if a.server != nil {
 		return errors.New("server already started")
 	}
diff --git a/agent/server_test.go b/agent/server_test.go
index 27486eba..de18b710 100644
--- a/agent/server_test.go
+++ b/agent/server_test.go
@@ -1,3 +1,6 @@
+//go:build testing
+// +build testing
+
 package agent
 
 import (
@@ -180,6 +183,23 @@ func TestStartServer(t *testing.T) {
 	}
 }
 
+func TestStartServerDisableSSH(t *testing.T) {
+	os.Setenv("BESZEL_AGENT_DISABLE_SSH", "true")
+	defer os.Unsetenv("BESZEL_AGENT_DISABLE_SSH")
+
+	agent, err := NewAgent("")
+	require.NoError(t, err)
+
+	opts := ServerOptions{
+		Network: "tcp",
+		Addr:    ":45990",
+	}
+
+	err = agent.StartServer(opts)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "SSH disabled")
+}
+
 /////////////////////////////////////////////////////////////////
 //////////////////// ParseKeys Tests ////////////////////////////
 /////////////////////////////////////////////////////////////////