Two thoughts on this:

1. The Secure Enclave being inaccessible when you're not present is a feature, not a bug. If you need to run headless then its not the correct solution to your problem and you'll have to find another.

2. You don't need an SSH agent proxy, you can use a `match` block in your `ssh_config` with something like `host * exec "test -z $SSH_TTY` to check whether you're operating over an SSH connection and select Secretive's SSH agent if you're using the machine locally.

I got a similar idea recently. I was becoming annoyed with the coding agent, running on my laptop, being unable to use sudo (with my supervision) when ssh-ing to my remote server. I wanted to build this as a PAM module. I started building this but after a while I googled (well… asked an agent) a bit more and found out that it already exists: https://github.com/z4yx/pam_rssh

I’m a happy user!