Fixes!

features/encryption/default.nix

@@ -31,6 +31,10 @@
         enableSshSupport = true;
         grabKeyboardAndMouse = false;
         pinentry.package = pkgs.pinentry-emacs;
+        extraConfig = ''
+          allow-emacs-pinentry
+          allow-loopback-pinentry
+        '';
       };
       home.file.".ssh/config".source = ./ssh-config;
       home.file.".ssh/gpg-as-ssh.pub".source = ./gpg-as-ssh.pub;

features/lauretta/emacs/_pkg.nix

@@ -16,5 +16,6 @@ orgTrivialBuild {
 
     agent-shell
     org-caldav
+    pinentry
   ];
 }

features/lauretta/emacs/config.org

@@ -34,6 +34,19 @@
    :models '(openai/gpt-oss-120b)))
 #+end_src
 
+** GPG Pinentry
+
+gpg-agent is configured with =pinentry.package = pkgs.pinentry-emacs=, which
+needs a running Emacs-side pinentry service to hand it prompts over a
+loopback socket. Without =pinentry-start=, the pinentry-emacs binary can't
+reach Emacs and falls back to the curses pinentry (visible as a TUI prompt
+when committing from vterm) or hangs entirely (as seen from Magit).
+
+#+begin_src emacs-lisp
+(require 'pinentry)
+(pinentry-start)
+#+end_src
+
 ** Agent Shell
 
 #+begin_src emacs-lisp