agentcreds

Documentation

Overview

Package agentcreds locates Claude Code credentials on a host so the daemon can seed islands with them (and the CLI can push them to a remote daemon).

Claude Code stores its OAuth blob in two places depending on OS:

• macOS: the login Keychain, generic password "Claude Code-credentials"
• Linux: ~/.claude/.credentials.json

The bind-mount seeding in the daemon only ever saw the file, which is why islands hosted on macOS started unauthenticated even when the host itself was logged in.

Index

• Variables
• func ValidateClaude(blob []byte) error
• func WriteSeed(dir string, blob []byte) (string, error)
• type Source
  • func LoadClaude() ([]byte, Source, error)

Variables

var ErrNotFound = errors.New("no Claude Code credentials found (run `claude` and log in, or `dejima auth push` from a logged-in machine)")

ErrNotFound means no credential source is available on this host.

Functions

func ValidateClaude

func ValidateClaude(blob []byte) error

ValidateClaude checks that blob looks like a Claude Code credentials file: a JSON object with a claudeAiOauth key. Guards against pushing or seeding garbage that would wedge every new island's login.

func WriteSeed

func WriteSeed(dir string, blob []byte) (string, error)

WriteSeed persists blob as the seed credentials file (0600) inside dir, creating dir (0700) if needed. Returns the file path.

Types

type Source

type Source string

Source identifies where credentials were found.

const (
	SourceKeychain Source = "keychain"
	SourceFile     Source = "file"
)

func LoadClaude

func LoadClaude() ([]byte, Source, error)

LoadClaude returns the Claude Code credentials JSON from the freshest local source: the macOS Keychain on darwin, falling back to ~/.claude/.credentials.json.