refactor(calendar-sync): defer auto-start until first agenda use

calendar-sync ran calendar-sync-start at load, which syncs immediately and then every interval. Every configured calendar resolves its .ics feed URL from a :secret-host in authinfo.gpg, so both the immediate sync and each timer tick decrypt authinfo.gpg. On a cold gpg-agent (after a reboot) that surfaced as a GPG passphrase prompt right after startup, before I'd asked for anything needing a secret.

I deferred the whole start, immediate sync and recurring timer alike, to the first org-agenda use via a one-shot org-agenda-mode-hook. The unlock now happens when I actually open the agenda. A manual calendar-sync-start or calendar-sync-now still works on demand.

1 files changed, 19 insertions, 3 deletions

diff --git a/modules/calendar-sync.el b/modules/calendar-sync.el
index 1079a72be..297d1fe61 100644
--- a/modules/calendar-sync.el
+++ b/modules/calendar-sync.el
@@ -381,12 +381,28 @@ Syncs all calendars immediately, then every `calendar-sync-interval-minutes'."
     ;; User can manually sync or it will happen on next timer tick if auto-sync is enabled
     ))
 
-;; Start auto-sync if enabled and calendars are configured
-;; Syncs immediately then every calendar-sync-interval-minutes (default: 60 minutes)
+;; Defer auto-sync until calendar data is first needed.
+;;
+;; The :secret-host feed URLs live in authinfo.gpg, and BOTH the immediate sync
+;; and every periodic timer tick resolve them.  Calling `calendar-sync-start' at
+;; load (immediate sync + recurring timer) therefore decrypts authinfo.gpg right
+;; after startup, prompting for the GPG passphrase on a cold gpg-agent (e.g.
+;; after a reboot).  Defer the whole start to the first org-agenda use, so the
+;; unlock happens when the user actually asks for calendar data.  A manual
+;; `calendar-sync-start' / `calendar-sync-now' still works on demand.
+(defun calendar-sync--auto-start-on-first-agenda ()
+  "Start auto-sync on the first org-agenda use, then remove this hook.
+One-shot: deferring `calendar-sync-start' until the agenda is first built keeps a
+cold gpg-agent from being prompted for the authinfo passphrase at startup.
+Removes itself before starting so a `calendar-sync-start' error can't re-fire it."
+  (remove-hook 'org-agenda-mode-hook #'calendar-sync--auto-start-on-first-agenda)
+  (calendar-sync-start))
+
+;; Arm the deferred start when auto-sync is enabled and calendars are configured.
 (when (and calendar-sync-auto-start
            calendar-sync-calendars
            (not noninteractive))
-  (calendar-sync-start))
+  (add-hook 'org-agenda-mode-hook #'calendar-sync--auto-start-on-first-agenda))
 
 
 (provide 'calendar-sync)