stablyai/orca · error · Error

Could not read macOS Keychain item ${service}/${account}.

Error message

Could not read macOS Keychain item ${service}/${account}.

What it means

Thrown by readKeychainPassword() when the macOS `security find-generic-password` command succeeded (exit 0) but returned an empty stdout, so no password value is available for the given service/account pair. It is re-raised only if the error is not a 'not found' (errSecItemNotFound) condition — an empty-but-successful read is treated as a corrupt/unexpected state.

Source

Thrown at src/main/claude-accounts/keychain.ts:118

}

async function readKeychainPassword(service: string, account: string): Promise<string | null> {
  if (process.platform !== 'darwin') {
    return null
  }
  try {
    const { stdout } = await execSecurityCommand([
      'find-generic-password',
      '-s',
      service,
      '-a',
      account,
      '-w'
    ])
    if (stdout.trim()) {
      return stdout.trim()
    }
    throw new Error(`Could not read macOS Keychain item ${service}/${account}.`)
  } catch (error) {
    if (isKeychainNotFoundError(error)) {
      return null
    }
    throw error
  }
}

async function writeKeychainPassword(
  service: string,
  account: string,
  contents: string
): Promise<void> {
  if (process.platform !== 'darwin') {
    return
  }
  await execSecurity(['add-generic-password', '-U', '-s', service, '-a', account, '-w', contents])
}

View on GitHub (pinned to 1136503c6a)

Solutions

Delete the empty Keychain item (Keychain Access or `security delete-generic-password -s <service> -a <account>`) and re-run the login flow that populates it.
Inspect the item in Keychain Access to confirm it has a non-empty password attribute.
Verify the correct service/account pair is being queried (ACTIVE_CLAUDE_SERVICE vs ORCA_CLAUDE_SERVICE).
Re-authenticate the Claude account so the credential is rewritten.

Defensive patterns

Strategy: try-catch

Type guard

function isKeychainEmptyReadError(error: unknown): boolean {
  return error instanceof Error && /Could not read macOS Keychain item/.test(error.message)
}

Try / catch

try {
  return await readKeychainPassword(service, account)
} catch (error) {
  if (isKeychainNotFoundError(error)) return null
  if (error instanceof Error && /Could not read macOS Keychain item/.test(error.message)) {
    // empty/corrupt item — prompt re-auth
    return null
  }
  throw error
}

Prevention

Validate Keychain items have non-empty values after writing them.
Re-run the credential-writing flow if an item reads back empty.
Inspect Keychain Access for malformed entries.
Use deleteKeychainPassword + rewrite to repair corrupt items.

When it happens

Trigger: A Keychain item exists for the service/account but its password attribute is empty or whitespace. `security -w` returned a blank value. A migration or partial write left a malformed generic-password entry.

Common situations: Claude credentials were partially written to the Keychain (e.g. a prior add-generic-password with an empty -w). Manual editing of Keychain items. A broken macOS Keychain sync (iCloud Keychain) produced an empty value.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/cedcd5bd05c90599. Report an issue: GitHub.