[bash] Fix dotup to always pull from public

PROJECT.org

@@ -0,0 +1,7 @@
+#+title: Project
+
+* Backlog
+** DONE Figure out why SSH key loading isn't working in terminal Emacs :personal:bug:dotfiles:emacs:ssh:
+:PROPERTIES:
+:ID:       f4d738a4-ffcb-7352-06f1-4f0dd89dff08
+:END:

bash/.aliases

@@ -16,7 +16,7 @@ alias push="git push"
 alias bookpull="rsync -aziuvhP rhea.local:/tank/books/ ~/.calibre/"
 alias bookpush="rsync -aziuvhP ~/.calibre/ rhea.local:/tank/books/"
 alias gpghup='gpgconf --kill gpg-agent && gpgconf --launch gpg-agent'
-alias dotup='(cd ~/.dotfiles && git pull && make)'
+alias dotup='(cd ~/.dotfiles && git pull public master && make)'
 
 
 # Vrobbler shortcuts

bin/.local/bin/load_keys

@@ -1,42 +1,87 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+log() { printf '%s\n' "$*" >&2; }
+
 HOST="${HOST:-$(hostname -s 2>/dev/null || hostname)}"
 PASS_BASE="personal/ssh"
 STORE_ROOT="${PASSWORD_STORE_DIR:-$HOME/.password-store}"
 ABS_BASE_PATH="${STORE_ROOT}/${PASS_BASE}"
 
-# Ensure ssh-agent is running
-if [[ -z "${SSH_AUTH_SOCK:-}" ]]; then
-    eval "$(ssh-agent -s)"
+log "load_keys: host=$HOST"
+log "load_keys: SSH_AUTH_SOCK=${SSH_AUTH_SOCK:-<unset>}"
+log "load_keys: PASSWORD_STORE_DIR=${PASSWORD_STORE_DIR:-<unset>}"
+log "load_keys: STORE_ROOT=$STORE_ROOT"
+log "load_keys: PASS_BASE=$PASS_BASE"
+
+# Require an existing ssh-agent (do NOT start one here)
+if [[ -z "${SSH_AUTH_SOCK:-}" || ! -S "${SSH_AUTH_SOCK:-}" ]]; then
+  log "ERROR: SSH_AUTH_SOCK is unset or not a socket: ${SSH_AUTH_SOCK:-<unset>}"
+  exit 2
 fi
 
-# Verify the base path exists
+# ssh-add -l exit codes: 0 = has keys, 1 = no keys, 2 = cannot connect
+rc=0
+ssh-add -l >/dev/null 2>&1 || rc=$?
+if [[ $rc -eq 2 ]]; then
+  log "ERROR: Cannot connect to ssh-agent at SSH_AUTH_SOCK=$SSH_AUTH_SOCK"
+  exit 2
+fi
+# rc 0 or 1 are OK here
+
+# pinentry hygiene (helps in emacs -nw)
+if [[ -t 0 || -t 1 || -t 2 ]]; then
+  export GPG_TTY="$(tty 2>/dev/null || true)"
+  gpg-connect-agent updatestartuptty /bye >/dev/null 2>&1 || true
+fi
+
+# Verify pass store path exists
 if [[ ! -d "$ABS_BASE_PATH" ]]; then
-  echo "ERROR: Base path not found in pass: $PASS_BASE" >&2
+  log "ERROR: Base path not found: $ABS_BASE_PATH"
   exit 1
 fi
 
+# Find host-matching identity directories
+dirs=()
+while IFS= read -r d; do
+  dirs+=("$d")
+done < <(find "$ABS_BASE_PATH" -mindepth 1 -maxdepth 1 -type d -name "*${HOST}*" 2>/dev/null || true)
 
-# Loop through each identity subdirectory
-echo -n "Loading ssh keys for host: "
-while IFS= read -r dir; do
-  IDENTITY=$(basename "$dir")
+if [[ ${#dirs[@]} -eq 0 ]]; then
+  log "ERROR: No identity directories matched '*${HOST}*' under '${PASS_BASE}'"
+  log "      Looked under: $ABS_BASE_PATH"
+  exit 1
+fi
 
-  # Find the latest .gpg file by name (ISO sort) and hostname
-  LATEST_FILE=$(find "$dir" -maxdepth 1 -name "*.gpg" -exec basename {} \; \
-    | sed 's/\.gpg$//' \
-    | sort -r \
-    | head -n 1)
+loaded=0
 
-  if [[ -z "$LATEST_FILE" ]]; then
+for dir in "${dirs[@]}"; do
+  identity="$(basename "$dir")"
+
+  # newest by filename (ISO date sort), portable
+  latest="$(
+    (cd "$dir" && ls -1 *.gpg 2>/dev/null | sed 's/\.gpg$//' | sort -r | head -n 1) || true
+  )"
+
+  if [[ -z "$latest" ]]; then
+    log "WARN: No .gpg files in ${PASS_BASE}/${identity}"
     continue
   fi
 
-  echo -n "$HOST"
+  entry="${PASS_BASE}/${identity}/${latest}"
+  log "Adding key from: $entry"
 
-  # Decrypt and pipe directly to ssh-add
-  # The '-' tells ssh-add to read the key from standard input (stdin)
-  pass show "${PASS_BASE}/${IDENTITY}/${LATEST_FILE}" | ssh-add - >/dev/null 2>&1
+  if pass show "$entry" | ssh-add - >/dev/null; then
+    loaded=1
+  else
+    log "ERROR: Failed to add key from: $entry"
+    exit 1
+  fi
+done
 
-done < <(find "$ABS_BASE_PATH" -mindepth 1 -maxdepth 1 -type d -name "*${HOST}*")
+if [[ $loaded -eq 0 ]]; then
+  log "ERROR: Matching directories found, but no keys were loaded."
+  exit 1
+fi
+
+log "OK: keys loaded into agent"

bin/.local/bin/ssh-agent-doctor

@@ -0,0 +1,130 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+ssh-agent-doctor: diagnose and select the best SSH_AUTH_SOCK.
+
+Usage:
+  ssh-agent-doctor            # human-readable report
+  ssh-agent-doctor --export   # print: export SSH_AUTH_SOCK='...'
+  ssh-agent-doctor --json     # minimal JSON-ish output (no jq required)
+
+Exit codes:
+  0  OK (agent reachable)
+  1  Socket found but agent has no identities (reachable)
+  2  No usable socket found OR cannot connect to agent
+EOF
+}
+
+mode="report"
+case "${1:-}" in
+  --export) mode="export" ;;
+  --json) mode="json" ;;
+  -h|--help) usage; exit 0 ;;
+  "") ;;
+  *) echo "Unknown arg: $1" >&2; usage; exit 2 ;;
+esac
+
+os="$(uname -s 2>/dev/null || echo unknown)"
+uid="$(id -u)"
+user="$(id -un 2>/dev/null || echo unknown)"
+home="${HOME:-/}"
+
+linux_sock="/run/user/${uid}/ssh-agent.socket"
+darwin_sock="${home}/.ssh/agent.sock"
+env_sock="${SSH_AUTH_SOCK:-}"
+
+is_sock() { [[ -n "${1:-}" && -S "$1" ]]; }
+
+pick_sock=""
+pick_reason=""
+
+if is_sock "$linux_sock"; then
+  pick_sock="$linux_sock"
+  pick_reason="linux_systemd_default"
+elif is_sock "$darwin_sock"; then
+  pick_sock="$darwin_sock"
+  pick_reason="darwin_launchd_default"
+elif is_sock "$env_sock"; then
+  pick_sock="$env_sock"
+  pick_reason="existing_env"
+fi
+
+check_agent() {
+  local sock="$1"
+  SSH_AUTH_SOCK="$sock" ssh-add -l >/dev/null 2>&1
+  return $?
+}
+
+if [[ "$mode" == "export" ]]; then
+  if [[ -z "$pick_sock" ]]; then
+    echo "echo 'ERROR: No ssh-agent socket found.' >&2"
+    echo "return 2 2>/dev/null || exit 2"
+    exit 0
+  fi
+  printf "export SSH_AUTH_SOCK='%s'\n" "$pick_sock"
+  exit 0
+fi
+
+if [[ "$mode" == "json" ]]; then
+  if [[ -z "$pick_sock" ]]; then
+    cat <<EOF
+{"ok":false,"user":"$user","uid":$uid,"os":"$os","picked":"","reason":"","error":"no_socket","candidates":{"linux":"$linux_sock","darwin":"$darwin_sock","env":"$env_sock"}}
+EOF
+    exit 2
+  fi
+
+  rc=0
+  check_agent "$pick_sock" || rc=$?
+  # ssh-add -l exit codes: 0 has keys, 1 no keys, 2 cannot connect
+  ok=false
+  status="unknown"
+  if [[ $rc -eq 0 ]]; then ok=true; status="has_identities"; fi
+  if [[ $rc -eq 1 ]]; then ok=true; status="no_identities"; fi
+  if [[ $rc -eq 2 ]]; then ok=false; status="cannot_connect"; fi
+
+  cat <<EOF
+{"ok":$ok,"user":"$user","uid":$uid,"os":"$os","picked":"$pick_sock","reason":"$pick_reason","ssh_add_l_exit":$rc,"status":"$status","candidates":{"linux":"$linux_sock","darwin":"$darwin_sock","env":"$env_sock"}}
+EOF
+  exit $rc
+fi
+
+# Human report mode
+echo "ssh-agent-doctor"
+echo "  user: $user (uid $uid)"
+echo "  os:   $os"
+echo
+echo "Candidates:"
+printf "  linux systemd: %s %s\n" "$linux_sock"  "$(is_sock "$linux_sock" && echo '[socket]' || echo '[missing]')"
+printf "  macOS launchd: %s %s\n" "$darwin_sock" "$(is_sock "$darwin_sock" && echo '[socket]' || echo '[missing]')"
+printf "  env SSH_AUTH_SOCK: %s %s\n" "${env_sock:-<unset>}" "$(is_sock "$env_sock" && echo '[socket]' || echo '[not socket]')"
+echo
+
+if [[ -z "$pick_sock" ]]; then
+  echo "Result: ❌ No usable SSH agent socket found."
+  echo "Hint: start your agent (systemd user on Linux, launchd agent on macOS) and re-run."
+  exit 2
+fi
+
+echo "Picked:"
+echo "  SSH_AUTH_SOCK=$pick_sock"
+echo "  reason=$pick_reason"
+echo
+
+rc=0
+check_agent "$pick_sock" || rc=$?
+
+if [[ $rc -eq 0 ]]; then
+  echo "Agent check: ✅ reachable, has identities"
+  SSH_AUTH_SOCK="$pick_sock" ssh-add -l || true
+  exit 0
+elif [[ $rc -eq 1 ]]; then
+  echo "Agent check: ✅ reachable, but has no identities loaded"
+  echo "Next: run your pass-based loader (load_keys)."
+  exit 1
+else
+  echo "Agent check: ❌ cannot connect to agent via that socket"
+  echo "This usually means the socket is stale or the agent died."
+  exit 2
+fi

bin/.local/bin/ssh-agent-env

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+uid="$(id -u)"
+
+linux_sock="/run/user/${uid}/ssh-agent.socket"
+darwin_sock="${HOME}/.ssh/agent.sock"
+
+pick_sock=""
+
+# Prefer Linux systemd socket if present
+if [[ -S "$linux_sock" ]]; then
+  pick_sock="$linux_sock"
+elif [[ -S "$darwin_sock" ]]; then
+  pick_sock="$darwin_sock"
+else
+  # Fall back to existing env if it's a socket
+  if [[ -n "${SSH_AUTH_SOCK:-}" && -S "${SSH_AUTH_SOCK}" ]]; then
+    pick_sock="$SSH_AUTH_SOCK"
+  fi
+fi
+
+if [[ -z "$pick_sock" ]]; then
+  echo "echo 'ERROR: No ssh-agent socket found.' >&2"
+  echo "echo 'Tried: $linux_sock and $darwin_sock' >&2"
+  echo "return 2 2>/dev/null || exit 2"
+  exit 0
+fi
+
+cat <<EOF
+export SSH_AUTH_SOCK='$pick_sock'
+EOF

bin/.local/bin/ssh-askpass-load-keys

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+# Load keys if agent empty
+if ! ssh-add -l >/dev/null 2>&1; then
+  ~/.local/bin/load_keys >/dev/null 2>&1
+fi
+
+# return empty passphrase
+echo ""

emacs/.config/doom/config.el

@@ -8,6 +8,18 @@
 (after! envrc
   (envrc-global-mode))
 
+;; Force user ssh-agent socket for all Emacs subprocesses.
+(defun my/apply-ssh-agent-env ()
+  "Set SSH_AUTH_SOCK in Emacs using ~/.local/bin/ssh-agent-env."
+  (let* ((cmd (expand-file-name "~/.local/bin/ssh-agent-env"))
+         (out (and (file-executable-p cmd)
+                   (string-trim (shell-command-to-string cmd)))))
+    ;; out looks like: export SSH_AUTH_SOCK='...'
+    (when (and out (string-match "SSH_AUTH_SOCK='\\([^']+\\)'" out))
+      (setenv "SSH_AUTH_SOCK" (match-string 1 out)))))
+
+(my/apply-ssh-agent-env)
+
 ;; load pinentry
 (when (require 'pinentry nil t)
   (pinentry-start))
@@ -443,36 +455,45 @@ Always open the result in `eww`."
 ;; Bind globally to C-c l
 (global-set-key (kbd "C-c l") #'life-scrobble-url)
 
-(after! magit
-  (defvar my/ssh-key-injector-script
-    (expand-file-name "~/.local/bin/load_keys"))
-
-  (defun my/ssh-agent-has-keys-p (&rest _ignore)
-    "Non-nil if ssh-agent currently has at least one identity loaded."
-    (eq 0 (call-process "ssh-add" nil nil nil "-l")))
-
-  (defun my/ensure-ssh-keys-loaded (&rest _ignore)
-    "Ensure ssh-agent has keys loaded; if not, run injector script."
-    (unless (file-executable-p my/ssh-key-injector-script)
-      (user-error "SSH injector script not executable: %s" my/ssh-key-injector-script))
-    (let ((buf (get-buffer-create "*ssh-key-injector*")))
-      (with-current-buffer buf (erase-buffer))
-      (let ((exit (call-process-shell-command my/ssh-key-injector-script nil buf t)))
-        (unless (eq exit 0)
-          (display-buffer buf)
-          (user-error "SSH key injection failed (see *ssh-key-injector*)")))))
-
-  ;; IMPORTANT: remove then re-add, so we don't keep an old advised function object around
-  (advice-remove 'magit-status #'my/ensure-ssh-keys-loaded)
-  (advice-add 'magit-status :before #'my/ensure-ssh-keys-loaded)
-
-  ;; optional:
-  (advice-remove 'magit-fetch  #'my/ensure-ssh-keys-loaded)
-  (advice-add    'magit-fetch  :before #'my/ensure-ssh-keys-loaded)
-  (advice-remove 'magit-push   #'my/ensure-ssh-keys-loaded)
-  (advice-add    'magit-push   :before #'my/ensure-ssh-keys-loaded)
-  (advice-remove 'magit-pull   #'my/ensure-ssh-keys-loaded)
-  (advice-add    'magit-pull   :before #'my/ensure-ssh-keys-loaded))
+                                        ; (after! magit
+                                        ;   (defvar my/ssh-key-injector-script (expand-file-name "~/.local/bin/load_keys"))
+                                        ; 
+                                        ;   (defun my/ssh-add-status ()
+                                        ;     (call-process "ssh-add" nil nil nil "-l"))
+                                        ; 
+                                        ;   (defun my/run-ssh-key-injector ()
+                                        ;     (my/apply-ssh-agent-env)
+                                        ;     (let* ((buf (get-buffer-create "*ssh-key-injector*"))
+                                        ;            (process-connection-type t)
+                                        ;            (process-environment (copy-sequence process-environment)))
+                                        ;       (unless (file-executable-p my/ssh-key-injector-script)
+                                        ;         (user-error "SSH injector script not executable: %s" my/ssh-key-injector-script))
+                                        ;       (with-current-buffer buf
+                                        ;         (erase-buffer)
+                                        ;         (insert (format "Emacs SSH_AUTH_SOCK=%s\n\n" (or (getenv "SSH_AUTH_SOCK") "<unset>"))))
+                                        ;       (let ((proc (make-process
+                                        ;                    :name "ssh-key-injector"
+                                        ;                    :buffer buf
+                                        ;                    :stderr buf
+                                        ;                    :command (list my/ssh-key-injector-script)
+                                        ;                    :noquery t)))
+                                        ;         (while (process-live-p proc)
+                                        ;           (accept-process-output proc 0.05))
+                                        ;         (unless (eq (process-exit-status proc) 0)
+                                        ;           (display-buffer buf)
+                                        ;           (user-error "SSH key injection failed. See *ssh-key-injector*.")))))
+                                        ; 
+                                        ;   (defun my/ensure-ssh-keys-loaded (&rest _ignore)
+                                        ;     (pcase (my/ssh-add-status)
+                                        ;       (0 nil)
+                                        ;       (1 (my/run-ssh-key-injector))
+                                        ;       (2 (user-error "No reachable ssh-agent (SSH_AUTH_SOCK=%s)"
+                                        ;                      (or (getenv "SSH_AUTH_SOCK") "<unset>")))
+                                        ;       (_ (my/run-ssh-key-injector))))
+                                        ; 
+                                        ;   (dolist (fn '(magit-status magit-fetch magit-push magit-pull))
+                                        ;     (advice-remove fn #'my/ensure-ssh-keys-loaded)
+                                        ;     (advice-add fn :before #'my/ensure-ssh-keys-loaded)))
 
 (defun my/disable-apheleia-in-certain-projects ()
   (when-let ((root (and (fboundp 'project-root)

emacs/.config/doom/custom.el

@@ -5,7 +5,7 @@
  ;; If there is more than one, they won't work right.
  '(magit-todos-insert-after '(bottom) nil nil "Changed by setter of obsolete option `magit-todos-insert-at'")
  '(package-selected-packages
-   '(csv-mode direnv ef-themes helix-theme just-mode justl magit-todos nov pinentry vulpea w3m))
+   '(csv-mode acp agent-shell direnv ef-themes helix-theme just-mode justl magit-todos nov pinentry vulpea w3m))
  '(safe-local-variable-values '((pytest-global-name . "docker-compose run --rm test --"))))
 (custom-set-faces
  ;; custom-set-faces was added by Custom.

gnome/.local/share/custom-gconf.conf

@@ -262,14 +262,19 @@ name='App Pinner Position 6'
 
 [media-keys/custom-keybindings/custom0]
 binding='<Super>t'
-command='/usr/bin/alacritty'
-name='Alacritty'
+command='/usr/bin/kitty'
+name='Launch Kitty'
 
 [media-keys/custom-keybindings/custom1]
 binding='<Super>f'
 command='/usr/bin/firefox --new-window'
 name='Launch Firefox'
 
+[media-keys/custom-keybindings/custom2]
+binding='<Super>e'
+command='/usr/bin/emacsclient -nw'
+name='Launch Emacs'
+
 [mouse]
 natural-scroll=true
 speed=0.0
@@ -773,19 +778,6 @@ binding='<Shift><Super>s'
 command='dbus-send --session --type=method_call --dest=org.gnome.Shell /org/gnome/Shell/Extensions/AppPinner org.gnome.Shell.Extensions.AppPinner.LaunchPosition uint32:6'
 name='App Pinner Position 6'
 
-[org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0]
-binding='<Super>t'
-command='/usr/bin/alacritty'
-name='Alacritty'
-
-[org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1]
-binding='<Super>f'
-command='/usr/bin/firefox --new-window'
-name='Launch Firefox'
-
-[org/gnome/settings-daemon/plugins/power]
-sleep-inactive-ac-type='nothing'
-
 [org/gnome/shell]
 app-picker-layout=[{'Alacritty.desktop': <{'position': <0>}>, 'bssh.desktop': <{'position': <1>}>, 'org.gnome.Weather.desktop': <{'position': <2>}>, 'org.gnome.clocks.desktop': <{'position': <3>}>, 'bvnc.desktop': <{'position': <4>}>, 'avahi-discover.desktop': <{'position': <5>}>, 'cmake-gui.desktop': <{'position': <6>}>, 'org.gnome.Totem.desktop': <{'position': <7>}>, 'org.gnome.Calculator.desktop': <{'position': <8>}>, 'eos-update-notifier-configure.desktop': <{'position': <9>}>, 'emacs.desktop': <{'position': <10>}>, 'org.gnome.Settings.desktop': <{'position': <11>}>, 'org.gnome.SystemMonitor.desktop': <{'position': <12>}>, 'eos-apps-info.desktop': <{'position': <13>}>, 'Utilities': <{'position': <14>}>, 'eos-log-tool.desktop': <{'position': <15>}>, 'eos-quickstart.desktop': <{'position': <16>}>, 'eos-update.desktop': <{'position': <17>}>, 'org.gnome.Extensions.desktop': <{'position': <18>}>, 'yad-icon-browser.desktop': <{'position': <19>}>, 'org.gnome.Meld.desktop': <{'position': <20>}>, 'gnome-nettool.desktop': <{'position': <21>}>}, {'org.gnome.PowerStats.desktop': <{'position': <0>}>, 'qv4l2.desktop': <{'position': <1>}>, 'qvidcap.desktop': <{'position': <2>}>, 'reflector-simple.desktop': <{'position': <3>}>, 'stoken-gui.desktop': <{'position': <4>}>, 'stoken-gui-small.desktop': <{'position': <5>}>, 'org.gnome.TextEditor.desktop': <{'position': <6>}>, 'uxterm.desktop': <{'position': <7>}>, 'vim.desktop': <{'position': <8>}>, 'org.pulseaudio.pavucontrol.desktop': <{'position': <9>}>, 'welcome.desktop': <{'position': <10>}>, 'xterm.desktop': <{'position': <11>}>, 'yad-settings.desktop': <{'position': <12>}>, 'htop.desktop': <{'position': <13>}>, 'Anno 1404 - History Edition.desktop': <{'position': <14>}>, 'Bastion.desktop': <{'position': <15>}>, 'org.gnome.Calendar.desktop': <{'position': <16>}>, 'Cities Skylines.desktop': <{'position': <17>}>, 'org.gnome.Contacts.desktop': <{'position': <18>}>, 'org.fcitx.Fcitx5.desktop': <{'position': <19>}>, 'fcitx5-configtool.desktop': <{'position': <20>}>, 'Kerbal Space Program.desktop': <{'position': <21>}>, "No Man's Sky.desktop": <{'position': <22>}>, 'jconsole-java-openjdk.desktop': <{'position': <23>}>}, {'jshell-java-openjdk.desktop': <{'position': <0>}>, 'org.gnome.Photos.desktop': <{'position': <1>}>, 'Proton Hotfix.desktop': <{'position': <2>}>, 'com.libretro.RetroArch.desktop': <{'position': <3>}>, 'Steam Linux Runtime 1.0 (scout).desktop': <{'position': <4>}>, 'Steam Linux Runtime 2.0 (soldier).desktop': <{'position': <5>}>, 'Steam Linux Runtime 3.0 (sniper).desktop': <{'position': <6>}>, "Wasteland 2 Director's Cut.desktop": <{'position': <7>}>, 'Zoom.desktop': <{'position': <8>}>}]
 command-history=['r']

kitty/.config/kitty/kitty.conf

@@ -3,7 +3,7 @@
 include ./kitty-themes/themes/Monokai.conf
 
 font_family IBM Plex Mono
-font_size 10.0
+font_size 12.0
 enable_audio_bell no
 visual_bell_duration 0.1
 window_padding_width 12
@@ -15,3 +15,4 @@ confirm_os_window_close -1
 remember_window_size  no
 initial_window_width  70c
 initial_window_height 15c
+linux_display_server x11

launchd/Library/LaunchAgents/com.powellc.ssh-agent.service

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
+ "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+
+  <key>Label</key>
+  <string>com.user.ssh-agent</string>
+
+  <key>ProgramArguments</key>
+  <array>
+    <string>/usr/bin/ssh-agent</string>
+    <string>-D</string>
+    <string>-a</string>
+    <string>$HOME/.ssh/agent.sock</string>
+  </array>
+
+  <key>RunAtLoad</key>
+  <true/>
+
+  <key>KeepAlive</key>
+  <true/>
+
+</dict>
+</plist>

zsh/.zshrc

@@ -1,15 +1,18 @@
 # If you come from bash you might have to change your $PATH.
 export GOPATH="$HOME/.go"
 export PATH=$HOME/.bin:$HOME/var/bin:/usr/local/bin:$PATH:$HOME/.go/bin:$HOME/.local/bin
-
 export GIT_CU_DIR="$HOME/src"
 export ZSH="$HOME/.oh-my-zsh"
+export GPG_TTY=$(tty)
+
+export SSH_ASKPASS="$HOME/.local/bin/ssh-askpass-load-keys"
+export SSH_ASKPASS_REQUIRE=force
+
+#load_keys &>/dev/null
 
 ZSH_THEME="robbyrussell"
 
 plugins=(git z fzf asdf direnv emacs yarn aws)
-eval $(ssh-agent)
-load_keys &>/dev/null
 
 source $ZSH/oh-my-zsh.sh
 
@@ -61,10 +64,8 @@ esac
 [[ -d "/home/linuxbrew/.linuxbrew/bin" ]] && export PATH=/home/linuxbrew/.linuxbrew/bin:$PATH
 
 eval "$(direnv hook /bin/zsh)"
-export GPG_TTY=$(tty)
 
 . ${ASDF_DATA_DIR:-$HOME/.asdf}/plugins/golang/set-env.zsh &>/dev/null
-load_keys &>/dev/null
 
 # opencode
 [[ -d "$HOME/.npm-global" ]] && export PATH="$HOME/.npm-global/bin":$PATH