yubikey-agent: release the connection on macOS for YK 5

Updates #4

main.go

@@ -160,6 +160,19 @@ func (a *Agent) ensureYK() error {
 	return nil
 }
 
+func (a *Agent) maybeReleaseYK() {
+	// On macOS, YubiKey 5s persist the PIN cache even across sessions (and even
+	// processes), so we can release the lock on the key, to let other
+	// applications like age-plugin-yubikey use it.
+	if runtime.GOOS != "darwin" || a.yk.Version().Major < 5 {
+		return
+	}
+	if err := a.yk.Close(); err != nil {
+		log.Println("Failed to automatically release YubiKey lock:", err)
+	}
+	a.yk = nil
+}
+
 func (a *Agent) connectToYK() (*piv.YubiKey, error) {
 	yk, err := openYK()
 	if err != nil {
@@ -216,6 +229,7 @@ func (a *Agent) List() ([]*agent.Key, error) {
 	if err := a.ensureYK(); err != nil {
 		return nil, fmt.Errorf("could not reach YubiKey: %w", err)
 	}
+	defer a.maybeReleaseYK()
 
 	pk, err := getPublicKey(a.yk, piv.SlotAuthentication)
 	if err != nil {
@@ -252,6 +266,7 @@ func (a *Agent) Signers() ([]ssh.Signer, error) {
 	if err := a.ensureYK(); err != nil {
 		return nil, fmt.Errorf("could not reach YubiKey: %w", err)
 	}
+	defer a.maybeReleaseYK()
 
 	return a.signers()
 }
@@ -286,6 +301,7 @@ func (a *Agent) SignWithFlags(key ssh.PublicKey, data []byte, flags agent.Signat
 	if err := a.ensureYK(); err != nil {
 		return nil, fmt.Errorf("could not reach YubiKey: %w", err)
 	}
+	defer a.maybeReleaseYK()
 
 	signers, err := a.signers()
 	if err != nil {