{"record":{"id":"cedcd5bd05c90599","repo":"stablyai/orca","slug":"could-not-read-macos-keychain-item-service-ac","errorCode":null,"errorMessage":"Could not read macOS Keychain item ${service}/${account}.","messagePattern":"Could not read macOS Keychain item (.+?)/(.+?)\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/claude-accounts/keychain.ts","lineNumber":118,"sourceCode":"}\n\nasync function readKeychainPassword(service: string, account: string): Promise<string | null> {\n  if (process.platform !== 'darwin') {\n    return null\n  }\n  try {\n    const { stdout } = await execSecurityCommand([\n      'find-generic-password',\n      '-s',\n      service,\n      '-a',\n      account,\n      '-w'\n    ])\n    if (stdout.trim()) {\n      return stdout.trim()\n    }\n    throw new Error(`Could not read macOS Keychain item ${service}/${account}.`)\n  } catch (error) {\n    if (isKeychainNotFoundError(error)) {\n      return null\n    }\n    throw error\n  }\n}\n\nasync function writeKeychainPassword(\n  service: string,\n  account: string,\n  contents: string\n): Promise<void> {\n  if (process.platform !== 'darwin') {\n    return\n  }\n  await execSecurity(['add-generic-password', '-U', '-s', service, '-a', account, '-w', contents])\n}","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/claude-accounts/keychain.ts#L100-L136","documentation":"Thrown by readKeychainPassword() when the macOS `security find-generic-password` command succeeded (exit 0) but returned an empty stdout, so no password value is available for the given service/account pair. It is re-raised only if the error is not a 'not found' (errSecItemNotFound) condition — an empty-but-successful read is treated as a corrupt/unexpected state.","triggerScenarios":"A Keychain item exists for the service/account but its password attribute is empty or whitespace. `security -w` returned a blank value. A migration or partial write left a malformed generic-password entry.","commonSituations":"Claude credentials were partially written to the Keychain (e.g. a prior add-generic-password with an empty -w). Manual editing of Keychain items. A broken macOS Keychain sync (iCloud Keychain) produced an empty value.","solutions":["Delete the empty Keychain item (Keychain Access or `security delete-generic-password -s <service> -a <account>`) and re-run the login flow that populates it.","Inspect the item in Keychain Access to confirm it has a non-empty password attribute.","Verify the correct service/account pair is being queried (ACTIVE_CLAUDE_SERVICE vs ORCA_CLAUDE_SERVICE).","Re-authenticate the Claude account so the credential is rewritten."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function isKeychainEmptyReadError(error: unknown): boolean {\n  return error instanceof Error && /Could not read macOS Keychain item/.test(error.message)\n}","tryCatchPattern":"try {\n  return await readKeychainPassword(service, account)\n} catch (error) {\n  if (isKeychainNotFoundError(error)) return null\n  if (error instanceof Error && /Could not read macOS Keychain item/.test(error.message)) {\n    // empty/corrupt item — prompt re-auth\n    return null\n  }\n  throw error\n}","preventionTips":["Validate Keychain items have non-empty values after writing them.","Re-run the credential-writing flow if an item reads back empty.","Inspect Keychain Access for malformed entries.","Use deleteKeychainPassword + rewrite to repair corrupt items."],"tags":["macos","keychain","security","credentials"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}