# A graphical pinentry never grabs the tty, so a passphrase prompt can't take
# over a terminal driven by a coding agent. The cache lasts a working day, and
# an unattended signature fails after two minutes instead of blocking forever.

{ config, pkgs, ... }:

{
  programs.gnupg.agent = {
    enable = true;
    pinentryPackage = pkgs.pinentry-qt;
    settings = {
      default-cache-ttl = 86400;
      max-cache-ttl = 86400;
      pinentry-timeout = 120;
    };
  };

  environment.systemPackages = [
    pkgs.pinentry-curses # fallback for sessions without a display
    # prime the passphrase cache on demand, e.g. before an agent session
    (pkgs.writeShellScriptBin "gpg-unlock" ''
      echo | ${config.programs.gnupg.package}/bin/gpg --clearsign --output /dev/null
      echo "gpg key unlocked"
    '')
  ];
}