SECTION 01 / ORIENTATION
Operator’s overview
Lanyard gives every shell, multiplexer, SSH client, and Git process one durable SSH agent address while routing each request to the agents that are actually available.
The assignment
Set SSH_AUTH_SOCK once—to Lanyard’s stable socket—and stop carrying temporary agent paths across session boundaries. Lanyard discovers forwarded OpenSSH agents, accepts explicit registrations, and keeps a static local agent such as 1Password in reserve.
DEFAULT SOCKET
$XDG_RUNTIME_DIR/lanyard-ssh-agent/agent.sockWhat it handles
- Normal SSH public-key authentication.
- Git commit and tag signing with
gpg.format = ssh. - Sessions that outlive the forwarded agent which created them.
- Multiple simultaneous remote logins, without manual socket surgery.
What it does not do
Lanyard is not an agent, keychain, secret store, or forwarding transport. It cannot unlock 1Password and it never reads private key material. It is a deliberately read-only protocol router.