Skip to content

Keep macOS keychain reachable in manager-spawned agy homes - #8

Open
jcoble wants to merge 2 commits into
zcop:mainfrom
jcoble:fix/macos-keychain-access
Open

jcoble wants to merge 2 commits into
zcop:mainfrom
jcoble:fix/macos-keychain-access

Conversation

@jcoble

@jcoble jcoble commented Oct 1, 2026

Copy link
Copy Markdown

Problem

agy reaches the macOS login keychain through the security CLI, which resolves keychains relative to $HOME. agy-cli-manager spawns agy with isolated, spoofed homes (account dirs, runtime dir, temporary login home), so every manager-mediated agy run — login, warmup, models, usage/identity probes — fails with "keychain could not be found".

Changes

  • Add _ensure_keychain_access(): on macOS, symlink Library/Keychains in the spoofed home to the real ~/Library/Keychains; no-op on other platforms and failure-tolerant.
  • Wire it into all four agy spawn points: warmup, models, the /usage identity probe, and interactive login.
  • Fix three pre-existing test failures caused by the macOS /var → /private/var symlink: tests compared unresolved temp paths against production-resolved paths (set_live_dir persists the resolved live dir), so resolve the temp base up front in both test modules.
  • Two new regression tests for the keychain link and a CHANGELOG entry under Unreleased → Fixes.

Verification

  • Full suite: 42/42 pass (previously 39/42 with the three pre-existing macOS path failures).
  • Verified manually: with a spoofed HOME, security default-keychain fails without the symlink and resolves the login keychain with it.

Conversation: https://app.warp.dev/conversation/9fd1ad5b-45dd-49f5-9321-44feed4e6e85

Co-Authored-By: Warp agent@warp.dev

jcoble and others added 2 commits October 1, 2026 05:18
agy resolves the login keychain through the `security` CLI relative to
$HOME, so the isolated profile homes used for warmup, models, usage
probes, and interactive login failed with "keychain could not be
found". Symlink the real ~/Library/Keychains into each spoofed home
before spawning agy (macOS only, no-op elsewhere).

Co-Authored-By: Warp <agent@warp.dev>
On macOS tempfile paths live under /var, a symlink to /private/var.
Production code persists resolved paths (set_live_dir, profile
resolution), so cursor keys, log event paths, and spawned HOME values
come back resolved while tests compared unresolved ones. Resolve the
temp base up front in both test modules.

Co-Authored-By: Warp <agent@warp.dev>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant