@sriinnu/runic 1.0.0 → 1.2.0

package/Sources/Runic/Core/Stores/FireworksTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainFireworksTokenStore: FireworksTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainFireworksTokenStore: FireworksTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainFireworksTokenStore: FireworksTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/GroqTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainGroqTokenStore: GroqTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainGroqTokenStore: GroqTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainGroqTokenStore: GroqTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/KimiTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainKimiTokenStore: KimiTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainKimiTokenStore: KimiTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainKimiTokenStore: KimiTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/MiniMaxCookieHeaderStore.swift

@@ -53,29 +53,17 @@ struct KeychainMiniMaxCookieHeaderStore: MiniMaxCookieHeaderStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteHeader(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteHeader(dataProtection: false)
+        try? self.deleteHeader(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainMiniMaxCookieHeaderStore: MiniMaxCookieHeaderStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainMiniMaxCookieHeaderStore: MiniMaxCookieHeaderStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/MiniMaxGroupIDStore.swift

@@ -53,29 +53,17 @@ struct KeychainMiniMaxGroupIDStore: MiniMaxGroupIDStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteGroupID(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteGroupID(dataProtection: false)
+        try? self.deleteGroupID(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainMiniMaxGroupIDStore: MiniMaxGroupIDStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainMiniMaxGroupIDStore: MiniMaxGroupIDStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/MiniMaxTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainMiniMaxTokenStore: MiniMaxTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainMiniMaxTokenStore: MiniMaxTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainMiniMaxTokenStore: MiniMaxTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/MistralTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainMistralTokenStore: MistralTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainMistralTokenStore: MistralTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainMistralTokenStore: MistralTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/OpenRouterTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainOpenRouterTokenStore: OpenRouterTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainOpenRouterTokenStore: OpenRouterTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainOpenRouterTokenStore: OpenRouterTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/PerplexityTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainPerplexityTokenStore: PerplexityTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainPerplexityTokenStore: PerplexityTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainPerplexityTokenStore: PerplexityTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/QwenTokenStore.swift

@@ -53,29 +53,17 @@ struct KeychainQwenTokenStore: QwenTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
 
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +79,7 @@ struct KeychainQwenTokenStore: QwenTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -127,17 +116,4 @@ struct KeychainQwenTokenStore: QwenTokenStoring {
         return q
     }
 
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }