agentcreds

package

v0.9.11 Latest Latest Go to latest Published: Sep 10, 2026 License: Apache-2.0 Imports: 8 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/aoos/dejima

Links

Open Source Insights

Documentation ¶

Overview ¶

Package agentcreds locates Claude Code credentials on a host so the daemon can seed islands with them (and the CLI can push them to a remote daemon).

Claude Code stores its OAuth blob in two places depending on OS:

macOS: the login Keychain, generic password "Claude Code-credentials"
Linux: ~/.claude/.credentials.json

The bind-mount seeding in the daemon only ever saw the file, which is why islands hosted on macOS started unauthenticated even when the host itself was logged in.

Index ¶

Constants
Variables
func ValidateClaude(blob []byte) error
func ValidateCodex(blob []byte) error
func WriteCodexSeed(dir string, blob []byte) (string, error)
func WriteSeed(dir string, blob []byte) (string, error)
type Source
- func LoadClaude() ([]byte, Source, error)
- func LoadCodex() ([]byte, Source, error)

Constants ¶

View Source

const CodexAuthFile = "auth.json"

CodexAuthFile is the credential file's name, in the host dir and in the seed dir alike. The name matters: the island shim copies it BY NAME, so a seed written under any other name is invisible to every island already built.

Variables ¶

View Source

var ErrCodexNotFound = errors.New(
	"no Codex credentials found (run `codex` and log in on this machine first)")

ErrCodexNotFound means this machine has no Codex login to push.

View Source

var ErrNotFound = errors.New("no Claude Code credentials found (run `claude` and log in, or `dejima auth push` from a logged-in machine)")

ErrNotFound means no credential source is available on this host.

Functions ¶

func ValidateClaude ¶

func ValidateClaude(blob []byte) error

ValidateClaude checks that blob looks like a Claude Code credentials file: a JSON object with a claudeAiOauth key. Guards against pushing or seeding garbage that would wedge every new island's login.

func ValidateCodex ¶ added in v0.9.8

func ValidateCodex(blob []byte) error

ValidateCodex rejects a blob that is not the credential file, so a push cannot store a truncated read or an unrelated file and have every island silently inherit it.

func WriteCodexSeed ¶ added in v0.9.8

func WriteCodexSeed(dir string, blob []byte) (string, error)

WriteCodexSeed stores a pushed Codex blob in the daemon's seed dir, as auth.json, atomically — an island starting mid-write must never read half a credential through the bind mount.

func WriteSeed ¶

func WriteSeed(dir string, blob []byte) (string, error)

WriteSeed persists blob as the seed credentials file (0600) inside dir, creating dir (0700) if needed. Returns the file path.

Types ¶

type Source ¶

type Source string

Source identifies where credentials were found.

const (
	SourceKeychain Source = "keychain"
	SourceFile     Source = "file"
)

func LoadClaude ¶

func LoadClaude() ([]byte, Source, error)

LoadClaude returns the Claude Code credentials JSON from the freshest local source: the macOS Keychain on darwin, falling back to ~/.claude/.credentials.json.

func LoadCodex ¶ added in v0.9.8

func LoadCodex() ([]byte, Source, error)

LoadCodex returns this host's Codex auth blob.

Source Files ¶

View all Source files

agentcreds.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL