Module cache 

The durable endpoint-credential cache (RFC 0031 §11). Access + refresh tokens with expiry, persisted in the durable store under Kind::Cred, keyed by a hash of the login target (e.g. mcp:github, intelligence). Written by agentd login and read at daemon startup to seed a provider; refreshed in-memory during a run, re-loaded (and re-refreshed from the refresh token) on restart.

Redaction (RFC 0031 §13): a cred record holds live tokens — it is excluded from all logs, audit, and the agent:// read surface. The Kind::Cred class is non-indexed and never appears in the manifest.

Structs

CachedCred

A cached credential for one endpoint (RFC 0031 §11). Never logged.

Functions

cred_id

The stable, filesystem-safe record id for a login target.

default_dir

The default per-user credential directory (RFC 0031 §11): $AGENTD_CRED_DIR, else $XDG_STATE_HOME/agentd/creds, else $HOME/.local/state/agentd/creds, else the OS temp dir.

evict

Evict the credential for target (agentd logout).

evict_file

Evict a credential from the file cache (agentd logout). Absent = success.

load

Load the cached credential for target, if present and parseable.

load_file

Load a credential from the file cache, if present and parseable.

now_ms

Milliseconds since the Unix epoch (for expires_at_ms).

store

Store (or replace) the credential for target.

store_file

Write a credential to the file cache (creating the dir; the file is 0600).