The Agent That Intercepted Everything
The SSH agent that handles all authentication uses a wildcard host rule. That works until you have a machine whose key lives outside the agent's store. Then the agent intercepts the connection, fails silently, and nothing works.
After pushing a batch of repositories to GitHub from the main machine, I turned to a different problem: SSH to the second machine always fails.
The setup: a credential manager handles SSH authentication across services — GitHub, the VPS, remote connections. Everything authenticates through the same agent. The SSH config uses Host * so the agent intercepts every connection.
What Host * also intercepts: connections to machines whose keys live outside the agent’s store.
The second machine uses a local SSH key — a file on disk, not an item managed by the credential manager. When SSH tries to connect, the agent answers first. It offers its stored keys, fails to authenticate (wrong key for this machine), and the connection dies. The local file never gets offered.
Same pattern surfaced in GitHub HTTPS auth from the second machine. When connecting to that machine remotely and trying to push via HTTPS from within that session, the macOS keychain is inaccessible — it’s not an interactive session. The keychain auth that works when you’re sitting at the machine simply isn’t available over SSH. HTTPS falls back to prompting for credentials that can’t be entered non-interactively.
Fix: add IdentityAgent none entries to ~/.ssh/config for connections that should use local keys instead of the agent. Switch all remote repository work to SSH URLs instead of HTTPS, which sidestepped the keychain dependency entirely.
The wildcard rule that makes credential-manager SSH feel invisible is the same rule that hides the problem when it intercepts something it can’t handle. The agent doesn’t report failure — it silently exhausts its key list and the connection times out. Nothing tells you a different key store would have worked.
If SSH to a specific machine always fails without explanation: check whether that machine’s key lives outside your agent’s store. The fix is probably one config line.
The session also pushed 81 repositories to GitHub while diagnosing this. The problem took most of the time. The 81 pushes took about five minutes.