[ GARDE-MANGER · 0.6.0 ]
Authenticated sessions for agent machines.
Mirror the browser auth and secrets you choose from your daily driver to the machine your agent runs on, sealed with AES-256-GCM end to end. Opt-in only.
Part of the Brigade fleet · brigade.tools · escoffierlabs.dev
[ 01 · FLOW ]
Source to sink
Your agents run on machines that have never logged in to anything. Agent Pantry mirrors the cookies, browser auth state, and secrets you choose from your daily driver to the machine your agent runs on, encrypted end to end.
[ 02 · SHELVES ]
What it does
Opt-in by domain
Nothing syncs unless you allow it. Cookie movement is filtered through an explicit domain allow or deny policy, so the agent gets the sessions it needs and nothing else.
Sealed in transit
Every diff ships in an AES-256-GCM frame with HKDF per-session key derivation and a monotonic replay counter. Stale or replayed frames are rejected at the sink, and the pre-shared key rotates in place with zero sync downtime.
Reads real browsers
Chromium-family stores (Chrome, Brave, Edge), Firefox, and Chrome DevTools Protocol for app-bound Chrome v127+. Keyring, DPAPI, and fallback decryption handled per platform.
Lands where tools look
Sidecar SQLite by default, plus opt-in surfaces and adapters: Netscape cookies.txt, gh CLI, OpenClaw, Hermes Agent bundles, and a Windows real-Chrome re-encrypt surface.
Runs as a service
One command writes a systemd unit or Windows Scheduled Task. Auto-reconnect with exponential backoff keeps the pantry stocked through restarts and flaky links.
Diagnosable on purpose
doctor validates config, key, surfaces, and connectivity, and flags misspelled or misplaced config keys; status reports what synced and when. Both speak JSON for scripting.
[ 03 · COMMANDS ]
agentpantry init Write a commented starter config for this machine, as a source or a sink. agentpantry keygen Generate the 32-byte pre-shared key both sides use. agentpantry rotate-key Rotate the pre-shared key in place with a dual-key grace window; -finish retires the old key. agentpantry source Run on your daily driver: watch browsers and secrets, send sealed diffs. agentpantry sink Run on the agent machine: verify frames, apply diffs to surfaces. agentpantry doctor Validate config, key, role, surfaces, and connectivity before trusting it. agentpantry status Report active role, peer, surfaces, last sync, and synced domains. agentpantry install-service Write a systemd unit (or Scheduled Task on Windows) so sync survives reboots. agentpantry version Print version, commit, build date, Go version, and platform. agentpantry help List every command with a one-line description. [ 04 · SECURITY ]
What is sealed, what is not
Agent Pantry moves real credentials, so it is explicit about its boundaries. Transport is sealed with AES-256-GCM and per-session derived keys over a pre-shared key you generate and copy yourself. Replay protection is monotonic and strict. CDP capture binds to loopback only. The pre-shared key rotates in place: the sink honors a short dual-key grace window while you distribute the new key, and doctor and status surface the rotation state until you finish it.
It is equally explicit about what it does not protect: the sink writes a plaintext sidecar by default, because that is what agent tooling can read. The machine your agent runs on must be a machine you trust. The threat model documents what is protected, what is not, and what stays your responsibility as the operator.
[ 05 · WHY NOT MANUAL COPYING ]
Agent Pantry vs manual export and paste
Manual copying needs no install and is fine for a one-off. Agent Pantry earns its keep when sessions rotate, when you run more than one agent machine, or when you want a scope you set once and a record of what moved.
How sessions get there
A source process watches the browsers you pick and sends sealed diffs to the sink when a cookie or secret changes, versus exporting cookies and copying credentials by hand each time a session changes or expires.
Scope control
Explicit domain allowlist, nothing moves unless you allow it, versus deciding per copy, where it is easy to grab a whole cookie jar and ship more than the agent needs.
Replay protection
A strict monotonic replay counter at the sink rejects stale or replayed frames. Manual copying has none: a captured file or token can be reused until you notice and revoke it.
Audit of what moved
status reports the active peer, surfaces, last sync, and synced domains, versus whatever you remember pasting, with no record unless you keep one yourself.
[ 06 · WHAT IT IS NOT ]
When to use it, when you do not
Use it when your agent runs on a headless, remote, or containerized machine that is not signed in to the services it needs to use, and you want to choose exactly which domains and secrets reach it, keep them sealed in transit, and have them stay current as sessions rotate without re-copying by hand.
You do not need it when your agent runs on your own machine, where you are already logged in. There is nothing to mirror. Adding a sync here only moves credentials you already have to a place you already have them.
Agent Pantry is a transport, not a scanner or a browser driver. If you want to catch secrets leaking into a repo, use a secret scanner like gitleaks. If you want a script to drive a browser end to end, use Playwright. If you just want to find a value in a file, grep is the right tool. Agent Pantry moves the auth you already have to a machine you trust, on your terms.
[ 07 · INSTALL ]
Install Agent Pantry, then wire it into Brigade when you want the station on your line:
Attach via Brigade:
brigade add pantry
Brigade itself:
brigade.tools
·
pipx install brigade-cli
More from Escoffier Labs
Local-first tools for AI coding agents
One kitchen, one brigade. Each tool does one job well, and they share one reviewed source of memory, config, and receipts.