Improved mac dev station role

ansible/roles/macos_dev_station/tasks/main.yml

@@ -165,6 +165,38 @@
     - macos_dev_station_service_user_enabled | bool
     - macos_dev_station_oh_my_zsh_enabled | bool
 
+- name: Ensure .zshrc has ssh-agent startup for devstation
+  become: true
+  ansible.builtin.blockinfile:
+    path: "{{ macos_dev_station_service_home }}/.zshrc"
+    block: |
+      # ansible: macos_dev_station ssh-agent
+      export SSH_AUTH_SOCK="{{ macos_dev_station_ssh_agent_socket }}"
+      if [ -S "$SSH_AUTH_SOCK" ] && ssh-add -l &>/dev/null; then
+        # Agent socket exists and has keys — nothing to do
+        true
+      else
+        if [ -S "$SSH_AUTH_SOCK" ]; then
+          # Socket exists but agent is dead or has no keys — restart
+          rm -f "$SSH_AUTH_SOCK"
+          eval "$(ssh-agent -a "$SSH_AUTH_SOCK" 2>/dev/null)" || true
+        else
+          # No socket — start fresh agent
+          eval "$(ssh-agent -a "$SSH_AUTH_SOCK" 2>/dev/null)" || true
+        fi
+        if [ -f "{{ macos_dev_station_scripts_dir }}/ssh-agent-start.sh" ]; then
+          source "{{ macos_dev_station_scripts_dir }}/ssh-agent-start.sh"
+        fi
+      fi
+    marker: "# {mark} ansible: macos_dev_station ssh-agent"
+    create: true
+    mode: "0644"
+    owner: "{{ macos_dev_station_service_user }}"
+    group: "{{ macos_dev_station_service_group }}"
+  when:
+    - macos_dev_station_service_user_enabled | bool
+    - macos_dev_station_ssh_agent_enabled | bool
+
 - name: Install managed MCP server runtimes
   ansible.builtin.include_tasks: mcp_installers.yml
   when:
@@ -294,6 +326,80 @@
     - __macos_access_ssh_group.rc == 0
     - __macos_access_ssh_member.rc != 0
 
+- name: Render ssh-agent launch daemon
+  become: true
+  ansible.builtin.template:
+    src: ssh-agent.plist.j2
+    dest: "{{ macos_dev_station_launchd_plist_dir }}/com.a13labs.ssh-agent.plist"
+    mode: "0644"
+    owner: root
+    group: wheel
+  when:
+    - macos_dev_station_service_user_enabled | bool
+    - macos_dev_station_ssh_agent_enabled | bool
+  notify: Restart ssh-agent launch daemon
+
+- name: Render ssh-agent starter script
+  become: true
+  ansible.builtin.template:
+    src: ssh-agent-start.sh.j2
+    dest: "{{ macos_dev_station_scripts_dir }}/ssh-agent-start.sh"
+    mode: "0755"
+    owner: "{{ macos_dev_station_service_user }}"
+    group: "{{ macos_dev_station_service_group }}"
+  when:
+    - macos_dev_station_service_user_enabled | bool
+    - macos_dev_station_ssh_agent_enabled | bool
+  notify: Restart ssh-agent launch daemon
+
+- name: Ensure ssh_config has ssh-agent settings for devstation
+  become: true
+  ansible.builtin.blockinfile:
+    path: "{{ macos_dev_station_service_home }}/.ssh/config"
+    block: |
+      Host *
+        AddKeysToAgent yes
+        ServerAliveInterval 60
+        ServerAliveCountMax 3
+    marker: "# {mark} ansible: macos_dev_station ssh-agent"
+    create: true
+    mode: "0600"
+    owner: "{{ macos_dev_station_service_user }}"
+    group: "{{ macos_dev_station_service_group }}"
+  when:
+    - macos_dev_station_service_user_enabled | bool
+    - macos_dev_station_ssh_agent_enabled | bool
+
+- name: Check ssh-agent launch daemon status
+  become: true
+  ansible.builtin.command: launchctl print system/com.a13labs.ssh-agent
+  register: __ssh_agent_status
+  failed_when: false
+  changed_when: false
+  when:
+    - macos_dev_station_manage_launchd | bool
+    - macos_dev_station_ssh_agent_enabled | bool
+    - macos_dev_station_service_user_enabled | bool
+
+- name: Bootstrap ssh-agent launch daemon if missing
+  become: true
+  ansible.builtin.command: >-
+    launchctl bootstrap system {{ macos_dev_station_launchd_plist_dir }}/com.a13labs.ssh-agent.plist
+  changed_when: true
+  when:
+    - macos_dev_station_manage_launchd | bool
+    - macos_dev_station_ssh_agent_enabled | bool
+    - macos_dev_station_service_user_enabled | bool
+    - __ssh_agent_status.rc != 0
+
+- name: Ensure ssh-agent launch daemon is enabled
+  become: true
+  ansible.builtin.command: launchctl enable system/com.a13labs.ssh-agent
+  changed_when: false
+  when:
+    - macos_dev_station_manage_launchd | bool
+    - macos_dev_station_ssh_agent_enabled | bool
+
 - name: Remove legacy user launch agent plists for hard mode
   ansible.builtin.file:
     path: "{{ ansible_facts['env']['HOME'] }}/Library/LaunchAgents/{{ item }}"