{"record":{"id":"648b9932fcb8ed2d","repo":"stablyai/orca","slug":"cannot-capture-current-claude-keychain-credentials","errorCode":null,"errorMessage":"Cannot capture current Claude Keychain credentials","messagePattern":"Cannot capture current Claude Keychain credentials","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/claude-accounts/runtime-auth-service.ts","lineNumber":1182,"sourceCode":"        : existsSync(paths.credentialsPath)\n          ? readFileSync(paths.credentialsPath, 'utf-8')\n          : null\n    const keychainCredentialsJson = await this.readAggregateClaudeKeychainCredentialsBestEffort(\n      paths.configDir\n    )\n    const scopedKeychainCredentials =\n      process.platform === 'darwin'\n        ? await this.readActiveClaudeKeychainCredentialsForSnapshot(paths.configDir)\n        : ({ status: 'captured', credentialsJson: null } as const)\n    const legacyKeychainCredentialsJson =\n      process.platform === 'darwin'\n        ? await this.readActiveClaudeKeychainCredentialsForSnapshot()\n        : ({ status: 'captured', credentialsJson: null } as const)\n    if (\n      scopedKeychainCredentials.status === 'failed' ||\n      legacyKeychainCredentialsJson.status === 'failed'\n    ) {\n      throw new Error('Cannot capture current Claude Keychain credentials')\n    }\n    const scopedKeychainCredentialsJson =\n      scopedKeychainCredentials.status === 'captured'\n        ? this.snapshotKeychainCredentials(\n            scopedKeychainCredentials.credentialsJson,\n            options.previousSnapshot,\n            'scoped',\n            options.managedCredentialsJson\n          )\n        : undefined\n    const legacyKeychainSnapshotJson =\n      legacyKeychainCredentialsJson.status === 'captured'\n        ? this.snapshotKeychainCredentials(\n            legacyKeychainCredentialsJson.credentialsJson,\n            options.previousSnapshot,\n            'legacy',\n            options.managedCredentialsJson\n          )","sourceCodeStart":1164,"sourceCodeEnd":1200,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/claude-accounts/runtime-auth-service.ts#L1164-L1200","documentation":"Thrown during captureSystemDefaultSnapshot() when either readActiveClaudeKeychainCredentialsForSnapshot (scoped or legacy) returns status 'failed' on macOS. This means the Keychain read did not merely return 'no item' (captured with null) but actively failed (e.g. locked Keychain, permission denied, security CLI error). The snapshot cannot proceed because it must record the pre-existing Keychain state to restore it later.","triggerScenarios":"On macOS, reading the scoped or legacy Claude Keychain item failed with a non-notFound error (permission denied, Keychain locked, corrupt item, security CLI crash) during a system-default snapshot capture.","commonSituations":"Keychain is locked at snapshot time. macOS permission prompt for Orca accessing Keychain was denied. Corrupt login.keychain-db. MDM restricting security CLI access. iCloud Keychain in a bad state.","solutions":["Unlock the login Keychain and grant Orca Keychain access, then retry the operation that triggered the snapshot.","Run Keychain Access repair on login.keychain-db.","Ensure Orca is authorized (Privacy & Security > Automation) to drive the security CLI.","If the Keychain item is corrupt, delete it and re-authenticate the Claude account."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await captureSystemDefaultSnapshot()\n} catch (error) {\n  if (error instanceof Error && /Cannot capture current Claude Keychain/.test(error.message)) {\n    // prompt user to unlock Keychain, then retry\n    return\n  }\n  throw error\n}","preventionTips":["Ensure the login Keychain is unlocked before triggering snapshots.","Grant Orca and the security CLI Keychain access in Privacy & Security.","Repair corrupt Keychains proactively.","Avoid snapshotting while macOS is prompting for Keychain approval."],"tags":["macos","keychain","snapshot","claude-accounts","credentials"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}