programs: ship ssh-to-age

hosts/common/programs/assorted.nix

@@ -186,7 +186,7 @@ in
       "snapper"
       "sops"  # for manually viewing secrets; outside `sane-secrets` (TODO: improve sane-secrets!)
       "speedtest-cli"
-      # "ssh-to-age"
+      "ssh-to-age" # used when provisioning a new nixos host
       "strings"
       "sudo"
       # "tageditor"  # music tagging
@@ -1119,6 +1119,8 @@ in
 
     sqlite.sandbox.method = null;  #< TODO: sandbox
 
+    ssh-to-age.sandbox.autodetectCliPaths = "existingFile";
+
     # N.B. if you call sshfs-fuse from the CLI -- without `mount.fuse` -- disable sandboxing
     sshfs-fuse.sandbox.net = "all";
     sshfs-fuse.sandbox.autodetectCliPaths = "parent";