Could we get an option to force the SSH approval prompt to the foreground?

Hi! I'm a long-time fan of the SSH agent — keys in 1Password with a biometric prompt is genuinely the best setup I've used. But the background-prompt suppression change has broken it for me, and I'm hoping there's room for an opt-out.

What I'm seeing

After the update, signing stopped working from my terminal tooling. ssh-add -l still lists my keys, but:

$ ssh-add -T prod-key.pub

Agent signature failed for prod-key.pub: communication with agent failed

The logs show the prompt being raised and then quietly timing out:

07:16:42 Notifying user through tray icon that they have a background prompt waiting

07:17:42 ssh authorization prompt timed out

07:18:27 Notifying user through tray icon that they have a background prompt waiting

07:19:27 ssh authorization prompt timed out

So the agent is working exactly as documented — the request just never reaches me.

Why the prompt matters to me

I use an AI coding assistant that has shell access to my repos, and some of my SSH hosts are production servers ( [removed by moderator] ). I don't want that assistant to have silent, unattended access to production.

The approval prompt was what made this safe. Keys stay in 1Password, and every time something wanted to touch a prod host, I got a modal and made a real allow/deny call. That's the whole reason I chose the 1Password agent.

I understand the reasoning behind suppression — nobody wants a surprise prompt because their IDE ran a background git fetch mid-movie. That makes sense when a background request is just noise. In my case it's the opposite: the background request is the one I most want to see, because it's the unattended one. The foreground requests are the ones I already know about.

The dot doesn't quite work as a substitute

• It's a small static dot with no sound, no modal, and no focus change. I never notice it.
• It's on a 60-second timer, so even if I'm watching for it, I have to catch it within a minute.
• The downstream error is misleading. SSH reports communication with agent failed, falls back to other auth, and dies with Too many authentication failures. Nothing says "approval pending" — I only found the cause by reading the 1Password log.

One side effect worth flagging

The workaround I keep seeing for automation is to move keys out of 1Password onto disk as plain files. I really don't want to do that — it's worse security, and it's the exact thing your SSH agent solves so well. It'd be a shame if this change nudged the people who most want a hardware-gated approval step away from using 1Password for it. I'm sure that's not the intent.

What would help

Any one of these would fix it for me:

1. A setting to force foreground prompts — something like "Always bring SSH approval prompts to the foreground." Opt-in and off by default, so the mid-movie case is untouched.
2. Per-key or per-vault control — let me mark specific keys as "never suppress." Suppression is fine for a low-stakes git key; a prod key is a different story, and they're already separate items.
3. At minimum, make it noticeable — a real notification instead of a silent dot, plus a longer or configurable timeout.

Worth mentioning this came up before in "SSH Prompt does not show up when initiated from background process" (#146042), pinned to a change between 8.10.13 and 8.10.16. It didn't get a reply, and the reporter ended up downgrading. Would love to see this one get picked up.

Happy to share full logs or test a beta build. Thanks for taking a look!

Setup: 1Password 8.12.28, macOS 26.6 (Apple silicon), OpenSSH 10.3p1, keys in Private vault, default agent.toml.