1.1 KiB
Storage
Sherlock stores credentials only in the OS keyring through internal/keyring.
There are no plaintext token files and no sherlock daemon state.
Wallet
Each service has one wallet entry under keyring service sherlock and account
service:<name>. A services-index side entry makes sherlock status portable
across keyring backends.
Stored data includes the service tokens, expiry times, OAuth issuer/client/scopes needed for refresh, and user identity metadata.
Pre-flight
keyring.Open() probes the OS keyring before returning a store. Missing or
locked keyrings return *keyring.UnavailableError with a remediation hint;
CLI/MCP callers exit with keyring failure rather than silently falling back.
Runtime files
Runtime files live under $XDG_RUNTIME_DIR/sherlock/ or the sibling runtime
directory:
<agent>.mcp.json: generated MCP config, mode 0600.sherlock.refresh.lock: cross-process token refresh lock.sherlock.login.lock: cross-process first-login lock.
Platform note
Linux needs a Secret Service provider available in the user session. macOS uses Keychain; Windows uses Credential Manager.