@sriinnu/runic 1.0.0 → 1.2.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Srinivas Pendela
+Copyright (c) 2025-2026 Srinivas Pendela
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -24,73 +24,84 @@ Runic sits in your menubar and shows how much of your AI subscription you've use
 
 | | | |
 |---|---|---|
-| Claude | Codex | Cursor |
-| Gemini | Copilot | z.ai |
-| OpenRouter | Groq | DeepSeek |
-| Fireworks | Mistral | Perplexity |
-| Kimi | Together | Cohere |
-| xAI | Cerebras | SambaNova |
+| Claude (1M ctx) | Codex (400K ctx) | Cursor (128K ctx) |
+| Gemini (1M ctx) | Copilot (128K ctx) | z.ai (205K ctx) |
+| OpenRouter | Groq (128K ctx) | DeepSeek (64K ctx) |
+| Fireworks (128K ctx) | Mistral (128K ctx) | Perplexity (128K ctx) |
+| Kimi (128K ctx) | Together (128K ctx) | Cohere (128K ctx) |
+| xAI (128K ctx) | Cerebras (128K ctx) | SambaNova (128K ctx) |
 | Azure OpenAI | Bedrock | Vertex AI |
-| Qwen | MiniMax | Auggie |
+| Qwen (128K ctx) | MiniMax | Auggie |
 | Antigravity | Factory (Droid) | |
 
+Context windows are configurable via `Resources/provider-context-windows.json`.
+
 ## Features
 
-**Menu dropdown**
-- Provider tab bar with brand icons
-- Hero stat with today's token count and cost
-- Inline line chart (1h / 6h / 1d / 7d / 30d)
-- Glassmorphism stat cards with sparklines
-- Usage progress bars with sheen animation
+**Overview dashboard**
+- All providers at a glance with brand icons and progress bars
+- Activity ring showing average usage across providers
+- Context window, reset countdown, and usage window per provider
+- Combined 7-day stacked bar chart
+
+**Per-provider view**
+- Hero stat with provider icon, today's token count and cost
+- Inline line chart with 1h / 6h / 1d / 7d / 30d range picker
+- Glassmorphism stat cards (Peak Hour, This Week) with sparklines
+- Usage progress bars with sheen animation and glow effects
 - Live "Updated Xs ago" timestamp
 
-**Charts**
-- Usage timeline (area + line)
-- Today by hour (24-bar)
-- Last 7 days (weekly bars)
+**Charts** (submenus)
+- Usage timeline (area + line, Catmull-Rom interpolated)
+- Today by hour (24-bar chart with peak highlight)
+- Last 7 days (weekly bar chart)
 - Subscription utilization (Daily / Weekly / Monthly)
-- Usage window comparison (session vs weekly)
-- Model breakdown (donut)
-- Project breakdown (bar)
+- Usage window comparison (dual-line session vs weekly)
+- Model breakdown (donut chart)
+- Project breakdown (horizontal bar chart)
 
 **Analytics**
-- Token usage (input, output, cache)
+- Token usage tracking (input, output, cache)
 - Cost estimation with per-model pricing
-- Spend forecasting and budget alerts
+- Spend forecasting with budget breach detection
 - Project and model attribution
+- Anomaly detection
 
 **Export & Notifications**
 - Export as CSV or JSON
 - Budget breach alerts via macOS notifications
-- macOS widgets
+- macOS widgets (usage, history, compact, switcher)
 - CLI tool (`RunicCLI`)
 
 **Design**
 - Dark / Light / System theme
 - Liquid UI with glass materials and animated progress bars
-- SF Rounded typography
+- Staggered entrance animations and glass shimmer effects
+- SF Rounded typography with design tokens
 - VoiceOver accessible
 - Sparkle auto-updates
 
 ## Install
 
+**Download** the latest release from [GitHub Releases](https://github.com/sriinnu/Runic/releases/latest), unzip, and drag `Runic.app` to Applications. Signed and notarized — no Gatekeeper warnings.
+
+**Or build from source:**
+
 ```bash
 git clone https://github.com/sriinnu/Runic.git
 cd Runic
 ./Scripts/compile_and_run.sh
 ```
 
-Builds the app, signs it, installs to `/Applications`, and launches. The infinity icon appears in your menubar.
-
 ## Configure
 
 Open **Preferences** from the menubar. Each provider has its own settings:
 
-- **API-based** (Groq, Mistral, z.ai, etc.): Paste your API key
-- **CLI-based** (Claude, Codex): Detected automatically
+- **API-based** (Groq, Mistral, z.ai, etc.): Paste your API key — provider auto-enables
+- **CLI-based** (Claude, Codex): Detected automatically from local CLI
 - **Cloud** (Bedrock, Vertex AI): Set environment variables
 
-All tokens stored in macOS Keychain — no password prompts.
+All tokens stored in macOS Keychain with no password prompts.
 
 ## Privacy
 

package/Scripts/package_app.sh

@@ -218,9 +218,9 @@ cat > "$APP/Contents/Info.plist" <<PLIST
     <key>LSMinimumSystemVersion</key><string>14.0</string>
     <key>LSUIElement</key><true/>
     <key>CFBundleIconFile</key><string>Icon</string>
-    <key>NSHumanReadableCopyright</key><string>© 2026 Srinivas Pendela (hello@srinivas.dev). MIT License.</string>
+    <key>NSHumanReadableCopyright</key><string>© 2025-2026 Srinivas Pendela. MIT License.</string>
     <key>SUFeedURL</key><string>${FEED_URL}</string>
-    <key>SUPublicEDKey</key><string>AGCY8w5vHirVfGGDGc8Szc5iuOqupZSh9pMj/Qs67XI=</string>
+    <key>SUPublicEDKey</key><string>1Ay3r9lgXQtyOjzVSCjlT5dvQuRlJghNKa8Goqvhfz4=</string>
     <key>SUEnableAutomaticChecks</key><${AUTO_CHECKS}/>
     <key>CodexBuildTimestamp</key><string>${BUILD_TIMESTAMP}</string>
     <key>CodexGitCommit</key><string>${GIT_COMMIT}</string>

package/Sources/Runic/Controllers/StatusItemController+Actions.swift

@@ -6,7 +6,16 @@ extension StatusItemController {
     // MARK: - Actions reachable from menus
 
     @objc func refreshNow() {
-        Task { await self.store.refresh(trigger: .manual, forceTokenUsage: true) }
+        let provider = self.selectedMenuProvider
+        if let provider {
+            // Single provider selected — only refresh that one.
+            Task {
+                await self.store.refreshSingleProvider(provider)
+            }
+        } else {
+            // Overview — refresh all.
+            Task { await self.store.refresh(trigger: .manual, forceTokenUsage: true) }
+        }
     }
 
     @objc func installUpdate() {

package/Sources/Runic/Controllers/StatusItemController+Menu.swift

@@ -432,6 +432,13 @@ extension StatusItemController {
             totalToday += todayTokens
 
             let resetDesc = snapshot?.primary.resetDescription
+            let windowLabel = snapshot?.primary.label?.trimmingCharacters(in: .whitespacesAndNewlines)
+            let topModel = self.store.ledgerTopModel(for: provider)
+            let topModelContext: String? = if let model = topModel?.model {
+                UsageFormatter.modelContextLabel(for: model)
+            } else {
+                Self.defaultContextLabel(for: provider)
+            }
 
             summaries.append(OverviewMenuView.ProviderSummary(
                 id: provider.rawValue,
@@ -441,7 +448,9 @@ extension StatusItemController {
                 usedPercent: usedPercent,
                 todayTokens: todayTokens,
                 brandColor: brandColor,
-                resetDescription: resetDesc))
+                resetDescription: resetDesc,
+                windowLabel: windowLabel,
+                topModelContext: topModelContext))
 
             // Chart data — last 7 days
             let dailySummaries = self.store.ledgerAllDailySummary(for: provider)
@@ -450,7 +459,8 @@ extension StatusItemController {
                     id: "\(provider.rawValue)-\(summary.dayKey)",
                     date: summary.dayStart,
                     tokens: summary.totals.totalTokens,
-                    provider: meta.displayName))
+                    provider: meta.displayName,
+                    color: brandColor))
             }
         }
 
@@ -461,6 +471,7 @@ extension StatusItemController {
             summaries: activeSummaries.isEmpty ? summaries : activeSummaries,
             chartPoints: chartPoints,
             totalTodayTokens: totalToday,
+            totalProviders: UsageProvider.allCases.count,
             width: width)
     }
 
@@ -477,6 +488,23 @@ extension StatusItemController {
         return abbreviations[name] ?? String(name.prefix(6))
     }
 
+    /// Default flagship model context window per provider, loaded from
+    /// `Resources/provider-context-windows.json`. Update the JSON to add/change
+    /// context windows without recompiling.
+    private static let defaultContextWindows: [String: Int] = {
+        struct Entry: Decodable { let contextK: Int }
+        guard let url = Bundle.main.url(forResource: "provider-context-windows", withExtension: "json"),
+              let data = try? Data(contentsOf: url),
+              let dict = try? JSONDecoder().decode([String: Entry].self, from: data)
+        else { return [:] }
+        return dict.mapValues(\.contextK)
+    }()
+
+    private static func defaultContextLabel(for provider: UsageProvider) -> String? {
+        guard let k = self.defaultContextWindows[provider.rawValue] else { return nil }
+        return k >= 1_000 ? "ctx \(k / 1_000)M" : "ctx \(k)K"
+    }
+
     private func resolvedMenuProvider() -> UsageProvider? {
         let enabled = self.store.enabledProviders()
         if enabled.isEmpty { return .codex }

package/Sources/Runic/Core/Login/GeminiLoginRunner.swift

@@ -45,11 +45,8 @@ enum GeminiLoginRunner {
             }
 
             // Create a temporary shell script that runs gemini (auto-prompts for auth when no creds)
-            let scriptContent = """
-            #!/bin/bash
-            cd ~
-            "\(binary)"
-            """
+            let escaped = binary.replacingOccurrences(of: "'", with: "'\\''")
+            let scriptContent = "#!/bin/bash\ncd ~\n'\(escaped)'\n"
 
             let tempDir = FileManager.default.temporaryDirectory
             let scriptURL = tempDir.appendingPathComponent("gemini_login_\(UUID().uuidString).command")

package/Sources/Runic/Core/Stores/AuggieTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainAuggieTokenStore: AuggieTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainAuggieTokenStore: AuggieTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainAuggieTokenStore: AuggieTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/AzureOpenAITokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainAzureOpenAITokenStore: AzureOpenAITokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainAzureOpenAITokenStore: AzureOpenAITokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainAzureOpenAITokenStore: AzureOpenAITokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/CerebrasTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainCerebrasTokenStore: CerebrasTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainCerebrasTokenStore: CerebrasTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainCerebrasTokenStore: CerebrasTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/CohereTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainCohereTokenStore: CohereTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainCohereTokenStore: CohereTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainCohereTokenStore: CohereTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/CopilotTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainCopilotTokenStore: CopilotTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainCopilotTokenStore: CopilotTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainCopilotTokenStore: CopilotTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/DeepSeekTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainDeepSeekTokenStore: DeepSeekTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainDeepSeekTokenStore: DeepSeekTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainDeepSeekTokenStore: DeepSeekTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }