Documentation
¶
Overview ¶
Package agentcreds locates Claude Code credentials on a host so the daemon can seed islands with them (and the CLI can push them to a remote daemon).
Claude Code stores its OAuth blob in two places depending on OS:
- macOS: the login Keychain, generic password "Claude Code-credentials"
- Linux: ~/.claude/.credentials.json
The bind-mount seeding in the daemon only ever saw the file, which is why islands hosted on macOS started unauthenticated even when the host itself was logged in.
Index ¶
- Constants
- Variables
- func ValidateClaude(blob []byte) error
- func ValidateCodex(blob []byte) error
- func ValidateMuse(blob []byte) error
- func WriteCodexSeed(dir string, blob []byte) (string, error)
- func WriteMuseSeed(dir string, blob []byte) (string, error)
- func WriteSeed(dir string, blob []byte) (string, error)
- type Source
Constants ¶
const CodexAuthFile = "auth.json"
CodexAuthFile is the credential file's name, in the host dir and in the seed dir alike. The name matters: the island shim copies it BY NAME, so a seed written under any other name is invisible to every island already built.
const MuseAuthFile = "auth.json"
MuseAuthFile is the credential filename the muse launcher reads.
The name matters less here than it does for Codex, and that is the whole design. Codex's island shim copies /opt/host/codex/auth.json BY NAME, so the filename is a contract with a script baked into the island image. Muse reads MUSE_AUTH_PATH — a full path, set on the launch line — so the daemon points it straight at the mounted seed and no shim exists to disagree with. Keeping the same filename anyway costs nothing and keeps the two seeds legible side by side in ~/.dejima/secrets.
Variables ¶
var ErrCodexNotFound = errors.New(
"no Codex credentials found (run `codex` and log in on this machine first)")
ErrCodexNotFound means this machine has no Codex login to push.
var ErrMuseNotFound = errors.New(
"no Muse credentials found (run `muse` and log in on this machine first)")
ErrMuseNotFound means this machine has no Muse login to push.
var ErrNotFound = errors.New("no Claude Code credentials found (run `claude` and log in, or `dejima auth push` from a logged-in machine)")
ErrNotFound means no credential source is available on this host.
Functions ¶
func ValidateClaude ¶
ValidateClaude checks that blob looks like a Claude Code credentials file: a JSON object with a claudeAiOauth key. Guards against pushing or seeding garbage that would wedge every new island's login.
func ValidateCodex ¶ added in v0.9.8
ValidateCodex rejects a blob that is not the credential file, so a push cannot store a truncated read or an unrelated file and have every island silently inherit it.
func ValidateMuse ¶ added in v0.9.16
ValidateMuse rejects a blob that is not the credential file, so a push cannot store a truncated read or an unrelated file and have every island silently inherit it.
func WriteCodexSeed ¶ added in v0.9.8
WriteCodexSeed stores a pushed Codex blob in the daemon's seed dir, as auth.json, atomically — an island starting mid-write must never read half a credential through the bind mount.
func WriteMuseSeed ¶ added in v0.9.16
WriteMuseSeed stores a pushed Muse blob in the daemon's seed dir, atomically — an island starting mid-write must never read half a credential through the bind mount.
Types ¶
type Source ¶
type Source string
Source identifies where credentials were found.
func LoadClaude ¶
LoadClaude returns the Claude Code credentials JSON from the freshest local source: the macOS Keychain on darwin, falling back to ~/.claude/.credentials.json.
Source Files