yubikey-agent: switch to gui domain for hardware key PIN prompts

yubikey-agent triggers OS-level CCID/PIV PIN entry dialogs when SSH
authentication is requested. These system security prompts require
access to the macOS Aqua session (window server). Running in the user
domain (LimitLoadToSessionType=Background) blocks these prompts,
causing authentication to fail or hang.

Revert to the default gui domain so PIN prompts can render in the
graphical login session.
This commit is contained in:
Austin Horstman 2026-07-07 21:57:26 -05:00
parent 7a62d63707
commit cee3f0e7fe
2 changed files with 0 additions and 3 deletions

View file

@ -82,7 +82,6 @@ in
launchd.agents.yubikey-agent = {
enable = true;
domain = lib.mkDefault "user";
config = {
ProgramArguments = [
"${cfg.package}/bin/yubikey-agent"

View file

@ -23,8 +23,6 @@
</dict>
<key>Label</key>
<string>org.nix-community.home.yubikey-agent</string>
${"\t"}<key>LimitLoadToSessionType</key>
${"\t"}<string>Background</string>
<key>ProcessType</key>
<string>Background</string>
<key>ProgramArguments</key>