Keychain & Doctor

Credentials in your login session

Cavvy’s daemon runs in your macOS login session, not as a system service. That is why coding agents reach the credentials they keep in the macOS Keychain. Sessions also find security at /usr/bin/security, even when another security comes first on your PATH.

If the daemon ever runs outside your login session, for example because it was started over SSH, Cavvy says so and offers Restart Daemon….

Use the built-in Doctor

If an agent cannot access its credentials, open Cavvy’s built-in Doctor: choose Run Doctor from a task’s More menu (…), or on the server’s page in Settings → Servers. It explains why access is failing so you can understand the cause before changing your setup. Each check that fails says what to do next.

Run Again checks once more after you fixed something, Copy Report copies the result, for example for a support request. The same checks run from the command line, as the daemon sees them:

$ cavvy doctor
✓ Claude Code on PATH — /Users/you/.local/bin/claude
✓ Daemon runs in your login session — launchd session: Aqua
✓ Not started from an SSH session — no SSH_CONNECTION in daemon environment
✓ `security` resolves to /usr/bin/security — /usr/bin/security
! Claude Code credentials readable — no Claude Code credential in the keychain
    → Run `claude` and complete /login once.
✓ No duplicate Claude Code keychain items — 0 item(s)

Credentials on servers

Agents on a server run in the server’s environment and use the logins they have there. Sign them in from Settings → Agents; see Servers. Cavvy uses your existing SSH configuration to connect and does not store SSH keys.