stablyai/orca · error · Error

Cannot capture current Claude Keychain credentials

Error message

Cannot capture current Claude Keychain credentials

What it means

Thrown during captureSystemDefaultSnapshot() when either readActiveClaudeKeychainCredentialsForSnapshot (scoped or legacy) returns status 'failed' on macOS. This means the Keychain read did not merely return 'no item' (captured with null) but actively failed (e.g. locked Keychain, permission denied, security CLI error). The snapshot cannot proceed because it must record the pre-existing Keychain state to restore it later.

Source

Thrown at src/main/claude-accounts/runtime-auth-service.ts:1182

        : existsSync(paths.credentialsPath)
          ? readFileSync(paths.credentialsPath, 'utf-8')
          : null
    const keychainCredentialsJson = await this.readAggregateClaudeKeychainCredentialsBestEffort(
      paths.configDir
    )
    const scopedKeychainCredentials =
      process.platform === 'darwin'
        ? await this.readActiveClaudeKeychainCredentialsForSnapshot(paths.configDir)
        : ({ status: 'captured', credentialsJson: null } as const)
    const legacyKeychainCredentialsJson =
      process.platform === 'darwin'
        ? await this.readActiveClaudeKeychainCredentialsForSnapshot()
        : ({ status: 'captured', credentialsJson: null } as const)
    if (
      scopedKeychainCredentials.status === 'failed' ||
      legacyKeychainCredentialsJson.status === 'failed'
    ) {
      throw new Error('Cannot capture current Claude Keychain credentials')
    }
    const scopedKeychainCredentialsJson =
      scopedKeychainCredentials.status === 'captured'
        ? this.snapshotKeychainCredentials(
            scopedKeychainCredentials.credentialsJson,
            options.previousSnapshot,
            'scoped',
            options.managedCredentialsJson
          )
        : undefined
    const legacyKeychainSnapshotJson =
      legacyKeychainCredentialsJson.status === 'captured'
        ? this.snapshotKeychainCredentials(
            legacyKeychainCredentialsJson.credentialsJson,
            options.previousSnapshot,
            'legacy',
            options.managedCredentialsJson
          )

View on GitHub (pinned to 1136503c6a)

Solutions

Unlock the login Keychain and grant Orca Keychain access, then retry the operation that triggered the snapshot.
Run Keychain Access repair on login.keychain-db.
Ensure Orca is authorized (Privacy & Security > Automation) to drive the security CLI.
If the Keychain item is corrupt, delete it and re-authenticate the Claude account.

Defensive patterns

Strategy: try-catch

Try / catch

try {
  await captureSystemDefaultSnapshot()
} catch (error) {
  if (error instanceof Error && /Cannot capture current Claude Keychain/.test(error.message)) {
    // prompt user to unlock Keychain, then retry
    return
  }
  throw error
}

Prevention

Ensure the login Keychain is unlocked before triggering snapshots.
Grant Orca and the security CLI Keychain access in Privacy & Security.
Repair corrupt Keychains proactively.
Avoid snapshotting while macOS is prompting for Keychain approval.

When it happens

Trigger: On macOS, reading the scoped or legacy Claude Keychain item failed with a non-notFound error (permission denied, Keychain locked, corrupt item, security CLI crash) during a system-default snapshot capture.

Common situations: Keychain is locked at snapshot time. macOS permission prompt for Orca accessing Keychain was denied. Corrupt login.keychain-db. MDM restricting security CLI access. iCloud Keychain in a bad state.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/648b9932fcb8ed2d. Report an issue: GitHub.