Improved mac dev station role

ansible/roles/macos_dev_station/templates/ssh-agent-start.sh.j2

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+# SSH agent starter — idempotent, safe to source from concurrent services.
+# The ssh-agent daemon is already running; this just adds keys and exports the socket.
+
+export SSH_AUTH_SOCK="{{ macos_dev_station_ssh_agent_socket }}"
+
+# Wait for the agent socket to appear
+__wait=0
+while [ ! -S "$SSH_AUTH_SOCK" ] && [ "$__wait" -lt 15 ]; do
+  sleep 1
+  __wait=$(( __wait + 1 ))
+done
+
+# Add keys if the agent is running but has none loaded
+if [ -S "$SSH_AUTH_SOCK" ]; then
+  if ssh-add -l 2>/dev/null | grep -q "The agent has no identities"; then
+    for _key in {{ macos_dev_station_ssh_agent_keys | map('quote') | join(' ') }}; do
+      if [ -f "$_key" ]; then
+        if [ -n "{{ macos_dev_station_ssh_agent_passphrase }}" ]; then
+          printf '%s\n' "{{ macos_dev_station_ssh_agent_passphrase }}" | ssh-add "$_key" 2>/dev/null || true
+        else
+          ssh-add "$_key" 2>/dev/null || true
+        fi
+      fi
+    done
+  fi
+fi

ansible/roles/macos_dev_station/templates/ssh-agent.plist.j2

@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>Label</key>
+    <string>com.a13labs.ssh-agent</string>
+
+    <key>UserName</key>
+    <string>{{ macos_dev_station_service_user }}</string>
+
+    <key>ProgramArguments</key>
+    <array>
+      <string>ssh-agent</string>
+      <string>-a</string>
+      <string>{{ macos_dev_station_ssh_agent_socket }}</string>
+    </array>
+
+    <key>RunAtLoad</key>
+    <true/>
+
+    <key>KeepAlive</key>
+    <true/>
+
+    <key>StandardOutPath</key>
+    <string>{{ macos_dev_station_logs_dir }}/ssh-agent.log</string>
+
+    <key>StandardErrorPath</key>
+    <string>{{ macos_dev_station_logs_dir }}/ssh-agent.err.log</string>
+
+    <key>EnvironmentVariables</key>
+    <dict>
+      <key>PATH</key>
+      <string>{{ macos_dev_station_path }}</string>
+      <key>HOME</key>
+      <string>{{ macos_dev_station_service_home }}</string>
+      <key>SSH_AUTH_SOCK</key>
+      <string>{{ macos_dev_station_ssh_agent_socket }}</string>
+    </dict>
+  </dict>
+</plist>

ansible/roles/macos_dev_station/templates/start-ide.sh.j2

@@ -2,6 +2,10 @@
 
 set -euo pipefail
 
+{% if macos_dev_station_ssh_agent_enabled | bool %}
+source "{{ macos_dev_station_scripts_dir }}/ssh-agent-start.sh"
+{% endif %}
+
 cd {{ macos_dev_station_workspace_dir }}
 
 exec code-server \

ansible/roles/macos_dev_station/templates/start-opencode.sh.j2

@@ -2,6 +2,10 @@
 
 set -euo pipefail
 
+{% if macos_dev_station_ssh_agent_enabled | bool %}
+source "{{ macos_dev_station_scripts_dir }}/ssh-agent-start.sh"
+{% endif %}
+
 cd {{ macos_dev_station_workspace_dir }}
 
 exec {{ macos_dev_station_opencode_command }}