diff --git a/emacs/.config/doom/config.el b/emacs/.config/doom/config.el
index 1a851a0..9837501 100644
--- a/emacs/.config/doom/config.el
+++ b/emacs/.config/doom/config.el
@@ -484,3 +484,44 @@ Always open the result in `eww`."
       (apheleia-mode -1))))
 
 (add-hook 'find-file-hook #'my/disable-apheleia-in-certain-projects)
+
+(require 'acp)
+(require 'agent-shell)
+;; --- pass integration ---
+(after! auth-source-pass
+  ;; Ensure pass is used as an auth-source backend
+  (auth-source-pass-enable))
+
+(defun +pass-line1 (entry)
+  "Return first line from `pass show ENTRY` (trimmed)."
+  (string-trim
+   (shell-command-to-string (format "pass show %s 2>/dev/null | head -n 1" entry))))
+
+(after! agent-shell
+  ;; OpenAI (ChatGPT API)
+  (setq agent-shell-openai-authentication
+        (agent-shell-openai-make-authentication
+         :api-key (lambda () (+pass-line1 "work/hungryroot/apikeys/chatgpt"))))
+
+  ;; Anthropic (Claude)
+  (setq agent-shell-anthropic-authentication
+        (agent-shell-anthropic-make-authentication
+         :api-key (lambda () (+pass-line1 "work/hungryroot/apikeys/anthropic"))))
+
+  ;; Google (Gemini)
+  (setq agent-shell-google-authentication
+        (agent-shell-google-make-authentication
+         :api-key (lambda () (+pass-line1 "work/hungryroot/apikeys/gemini")))))
+
+;;(use-package agent-shell
+;;  :config
+;;  ;; Evil state-specific RET behavior: insert mode = newline, normal mode = send
+;;  (evil-define-key 'insert agent-shell-mode-map (kbd "RET") #'newline)
+;;  (evil-define-key 'normal agent-shell-mode-map (kbd "RET") #'comint-send-input)
+;;
+;;  ;; Configure *agent-shell-diff* buffers to start in Emacs state
+;;  (add-hook 'diff-mode-hook
+;;	    (lambda ()
+;;	      (when (string-match-p "\\*agent-shell-diff\\*" (buffer-name))
+;;		(evil-emacs-state)))))
+
diff --git a/emacs/.config/doom/custom.el b/emacs/.config/doom/custom.el
index a541570..896ee51 100644
--- a/emacs/.config/doom/custom.el
+++ b/emacs/.config/doom/custom.el
@@ -5,8 +5,7 @@
  ;; If there is more than one, they won't work right.
  '(magit-todos-insert-after '(bottom) nil nil "Changed by setter of obsolete option `magit-todos-insert-at'")
  '(package-selected-packages
-   '(agent-shell csv-mode direnv ef-themes helix-theme just-mode justl magit-todos
-     nov pinentry vulpea w3m))
+   '(csv-mode direnv ef-themes helix-theme just-mode justl magit-todos nov pinentry vulpea w3m))
  '(safe-local-variable-values '((pytest-global-name . "docker-compose run --rm test --"))))
 (custom-set-faces
  ;; custom-set-faces was added by Custom.
diff --git a/emacs/.config/doom/packages.el b/emacs/.config/doom/packages.el
index e633357..2cbe085 100644
--- a/emacs/.config/doom/packages.el
+++ b/emacs/.config/doom/packages.el
@@ -18,6 +18,10 @@
 (package! git-link)
 (package! blacken)
 (package! org-modern)
+(package! shell-maker)
+(package! acp)
+(package! agent-shell)
+(package! auth-source-pass)
 
 (package! org-todoist
   :recipe (:host github
diff --git a/password-store/.password-store/work/hungryroot/apikeys/anthropic.gpg b/password-store/.password-store/work/hungryroot/apikeys/anthropic.gpg
new file mode 100644
index 0000000..686d77e
Binary files /dev/null and b/password-store/.password-store/work/hungryroot/apikeys/anthropic.gpg differ
diff --git a/password-store/.password-store/work/hungryroot/apikeys/chatgpt.gpg b/password-store/.password-store/work/hungryroot/apikeys/chatgpt.gpg
new file mode 100644
index 0000000..5a8a948
Binary files /dev/null and b/password-store/.password-store/work/hungryroot/apikeys/chatgpt.gpg differ
diff --git a/password-store/.password-store/work/hungryroot/apikeys/gemini.gpg b/password-store/.password-store/work/hungryroot/apikeys/gemini.gpg
new file mode 100644
index 0000000..ced509d
Binary files /dev/null and b/password-store/.password-store/work/hungryroot/apikeys/gemini.gpg differ