Apple Watch stalls-out when a plethora of authentication requests come through

Actually, maybe this belongs in the Apple Watch category.

Ping.

The SSH category is the right place! Having many consecutive prompts is not the intended experience, this should not be happening and we're investigating the issue. We'll keep you posted here.

To help us out, could you describe what kind of processes are running in those iTerm tabs? Is there something polling in the background by any chance?

It's a blend of op calls happening in ~/.profile, and maybe a ssh -T git@github.com to validate my key.

I've had more than one experience where some piece of software ends up logging all of my environment variables to a logfile, then that logfile gets pushed out to the internet. (One of those times was when I worked at AWS before IAM existed and root credentials for the AWS account that everyone in the SDK/Console teams used ended up on the internet. Certain features of IAM, Athena, and the https://github.com/awslabs/git-secrets repo are my fault.)

Essentially, I've been moving credentials out of plain text files and into 1Password. Presently I'm sourcing them from op into my current shell session, but I think I want to write something like AWS Vault that can fetch a token and pass it to a command running inside a sub-shell so that the credential never gets exposed to the parent-most scope of the current shell session. But that's a whole other topic.

Right now, it's just my Apple Watch getting overwhelmed when ~/.profile gets executed many times in rapid succession, which I've narrowed down to a single op call, and a single ssh call.

Ah, thanks for clarifying that. Looking at your comment, I'd recommend to move the op calls that require authentication out of your shell profile. The CLI has an even stricter authorization model than SSH does, and wasn't really built to use in global shell profiles.

A better approach I'd suggest looking into is to use op run. Instead of loading every secret into every shell, you'd load your secrets only when they're needed. This works nicely with aliases, e.g. alias terraform='op run -- terraform'. And if you then run terraform, that's the moment you'll get prompted.