Skip to content

Use the saved account for agent actions and read the Keychain once per process - #16

Open
MainSequenceDev wants to merge 1 commit into
mainfrom
claude/agent-account-keychain-cache
Open

MainSequenceDev wants to merge 1 commit into
mainfrom
claude/agent-account-keychain-cache

Conversation

@MainSequenceDev

Copy link
Copy Markdown
Contributor

Why

Agent search in the Claude Desktop plugin was slow. Timing one search through the worker against the local backend (127.0.0.1:8000):

Stage Before After
GET /api/v1/users/me/ 0.8–1.1 s removed
Keychain reads (/usr/bin/security) 16 programs, ~0.35 s 2 programs, ~30 ms
MCP handshake (initialize, notifications/initialized, tools/list) ~1.3 s unchanged
tools/call agent.search (backend) 6–13 s unchanged

Most of the remaining time is the backend's query embedding, tracked separately on the backend.

Changes

  • Agent actions take the account saved at sign-in. login already stores the username after its one users/me call. AgentClient now uses status(backend) and falls back to status(backend, true) only when an older session has no saved name. The readiness loop no longer asks the backend on every poll either.
  • One Keychain read per process. MachineSessionService.saved() caches each backend's session. It rereads only where another process may have rotated the pair: renewal, retrying a rejected token, and the check after writing. Logout drops the cached entry.
  • No silent account switch. A reread that finds a different account than the one this process started with fails with AUTH_REJECTED ("account changed in another process").

Tests

  • discovery takes the account saved at sign-in and checks the backend only when none was saved
  • one process reads the saved session once and never switches account on a reread
  • npm test: 114/114 pass.

No version bump or tag in this PR; release separately.

🤖 Generated with Claude Code

…r process

Agent actions checked the account with GET /api/v1/users/me/ on every call,
although sign-in already saves the account name with the session. They now
take the saved name and ask the backend only when an older session has none.

Each session read ran two /usr/bin/security programs, and one agent search
read the session eight times. MachineSessionService now reads a backend's
session once per process and rereads it only to renew or to retry a rejected
token. A reread that finds a different account fails instead of switching
accounts under the running action.

Measured against the local backend: an agent search drops from 16 Keychain
programs and a users/me round trip (about 1.2 s) to 2 programs and none.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant