@sriinnu/runic 1.0.0 → 2.0.0

package/Sources/Runic/Core/Rendering/IconRenderer.swift

@@ -1,49 +1,49 @@
 import AppKit
 import RunicCore
 
-/// **IconRenderer** - Generates menubar status item icons with usage visualization
-///
-/// **Purpose:**
-/// Creates pixel-perfect 18×18pt (36×36px @2x) template images for the macOS menubar.
-/// Renders usage bars, stale indicators, and provider status into the icon.
-///
-/// **Responsibilities:**
-/// - Generate icons showing session/weekly usage patterns
-/// - Apply stale data dimming when data is > 5 minutes old
-/// - Cache rendered icons for performance (64 icon cache, 512 morph cache)
-/// - Support template (adapts to menubar theme) and vibrant appearances
-/// - Render loading animations and error states
-///
-/// **Performance:**
-/// - **O(1) icon cache lookup** via IconCacheKey hash
-/// - **O(1) morph cache** for animation frames
-/// - Cap cache sizes via `PerformanceConstants`
-/// - All rendering happens off main thread in `dispatchPrecondition(condition: .notOnQueue(.main))`
-///
-/// **Dependencies:**
-/// - `PerformanceConstants` - Cache sizes and timing
-/// - `UsageProvider` - Provider-specific rendering
-/// - `AppKit/CoreGraphics` - Image generation
-///
-/// **Usage:**
-/// ```swift
-/// let icon = IconRenderer.render(
-///     state: .usage(snap, status),
-///     indicator: .none,
-///     appearance: .template,
-///     dataMode: .remaining
-/// )
-/// statusItem.button?.image = icon
-/// ```
-
-enum IconAppearance: Sendable {
-    case template   // Adapts to menubar theme (light/dark mode)
-    case vibrant    // Full color rendering
+// **IconRenderer** - Generates menubar status item icons with usage visualization
+//
+// **Purpose:**
+// Creates pixel-perfect 18×18pt (36×36px @2x) template images for the macOS menubar.
+// Renders usage bars, stale indicators, and provider status into the icon.
+//
+// **Responsibilities:**
+// - Generate icons showing session/weekly usage patterns
+// - Apply stale data dimming when data is > 5 minutes old
+// - Cache rendered icons for performance (64 icon cache, 512 morph cache)
+// - Support template (adapts to menubar theme) and vibrant appearances
+// - Render loading animations and error states
+//
+// **Performance:**
+// - **O(1) icon cache lookup** via IconCacheKey hash
+// - **O(1) morph cache** for animation frames
+// - Cap cache sizes via `PerformanceConstants`
+// - All rendering happens off main thread in `dispatchPrecondition(condition: .notOnQueue(.main))`
+//
+// **Dependencies:**
+// - `PerformanceConstants` - Cache sizes and timing
+// - `UsageProvider` - Provider-specific rendering
+// - `AppKit/CoreGraphics` - Image generation
+//
+// **Usage:**
+// ```swift
+// let icon = IconRenderer.render(
+//     state: .usage(snap, status),
+//     indicator: .none,
+//     appearance: .template,
+//     dataMode: .remaining
+// )
+// statusItem.button?.image = icon
+// ```
+
+enum IconAppearance {
+    case template // Adapts to menubar theme (light/dark mode)
+    case vibrant // Full color rendering
 }
 
-enum IconDataMode: Sendable {
-    case remaining  // Show remaining quota
-    case used       // Show used quota
+enum IconDataMode {
+    case remaining // Show remaining quota
+    case used // Show used quota
 }
 
 enum IconRenderer {
@@ -53,17 +53,18 @@ enum IconRenderer {
     private static let outputSize = NSSize(width: 38, height: 22)
     private static let outputScale: CGFloat = 2
     private static let canvasPx = Int(outputSize.width * outputScale)
-    
-    // Infinity symbol base template - loaded lazily from Resources
+
+    /// Infinity symbol base template - loaded lazily from Resources
     private static let waveLogoTemplate: NSImage? = {
         guard let url = Bundle.main.url(forResource: "RunicMenubarIcon", withExtension: "svg"),
-              let image = NSImage(contentsOf: url) else {
+              let image = NSImage(contentsOf: url)
+        else {
             return nil
         }
         return image
     }()
 
-    private struct PixelGrid: Sendable {
+    private struct PixelGrid {
         let scale: CGFloat
 
         func pt(_ px: Int) -> CGFloat {
@@ -142,14 +143,19 @@ enum IconRenderer {
         }
     }
 
-    private struct RectPx: Hashable, Sendable {
+    private struct RectPx: Hashable {
         let x: Int
         let y: Int
         let w: Int
         let h: Int
 
-        var midXPx: Int { self.x + self.w / 2 }
-        var midYPx: Int { self.y + self.h / 2 }
+        var midXPx: Int {
+            self.x + self.w / 2
+        }
+
+        var midYPx: Int {
+            self.y + self.h / 2
+        }
 
         func rect() -> CGRect {
             Self.grid.rect(x: self.x, y: self.y, w: self.w, h: self.h)
@@ -215,13 +221,13 @@ enum IconRenderer {
                     dataMode: dataMode)
                 let accentColor = Self.vibrantAccentColor(pressure: pressure, stale: stale)
                 let baseColor = appearance == .template ? NSColor.labelColor : accentColor
-                
+
                 // Disable blink effect to prevent flicker
                 let opacityMultiplier = 1.0
-                
+
                 let fillColor = baseColor.withAlphaComponent((stale ? 0.55 : 1.0) * opacityMultiplier)
                 let baseAlpha: CGFloat = (stale ? 0.18 : (appearance == .template ? 0.28 : 0.38)) * opacityMultiplier
-                
+
                 let fillPercent = Self.iconFillPercent(
                     primary: topValue,
                     weekly: bottomValue,
@@ -265,33 +271,33 @@ enum IconRenderer {
 
     private static func sigilStyle(for style: IconStyle) -> SigilStyle {
         switch style {
-        case .codex: return .codex
-        case .claude: return .claude
-        case .zai: return .zai
-        case .gemini: return .gemini
-        case .antigravity: return .antigravity
-        case .cursor: return .cursor
-        case .factory: return .factory
-        case .copilot: return .copilot
-        case .minimax: return .minimax
-        case .openrouter: return .openrouter
-        case .groq: return .groq
-        case .deepseek: return .deepseek
-        case .fireworks: return .fireworks
-        case .mistral: return .mistral
-        case .perplexity: return .perplexity
-        case .kimi: return .kimi
-        case .auggie: return .auggie
-        case .together: return .together
-        case .cohere: return .cohere
-        case .xai: return .xai
-        case .cerebras: return .cerebras
-        case .sambanova: return .sambanova
-        case .azure: return .azure
-        case .bedrock: return .bedrock
-        case .vertexai: return .vertexai
-        case .qwen: return .qwen
-        case .combined: return .combined
+        case .codex: .codex
+        case .claude: .claude
+        case .zai: .zai
+        case .gemini: .gemini
+        case .antigravity: .antigravity
+        case .cursor: .cursor
+        case .factory: .factory
+        case .copilot: .copilot
+        case .minimax: .minimax
+        case .openrouter: .openrouter
+        case .groq: .groq
+        case .deepseek: .deepseek
+        case .fireworks: .fireworks
+        case .mistral: .mistral
+        case .perplexity: .perplexity
+        case .kimi: .kimi
+        case .auggie: .auggie
+        case .together: .together
+        case .cohere: .cohere
+        case .xai: .xai
+        case .cerebras: .cerebras
+        case .sambanova: .sambanova
+        case .azure: .azure
+        case .bedrock: .bedrock
+        case .vertexai: .vertexai
+        case .qwen: .qwen
+        case .combined: .combined
         }
     }
 
@@ -515,7 +521,7 @@ enum IconRenderer {
             let barHeightPx = 6
             let totalWidth = barWidthPx * 3 + barGapPx * 2
             let startX = centerXPx - totalWidth / 2
-            for idx in 0 ..< 3 {
+            for idx in 0..<3 {
                 let x = startX + idx * (barWidthPx + barGapPx)
                 let rect = Self.grid.rect(
                     x: x,
@@ -835,7 +841,8 @@ enum IconRenderer {
         fillColor: NSColor)
     {
         guard let waveLogo = self.waveLogoTemplate,
-              let ctx = NSGraphicsContext.current?.cgContext else {
+              let ctx = NSGraphicsContext.current?.cgContext
+        else {
             return
         }
 
@@ -867,7 +874,7 @@ enum IconRenderer {
         credits: Double?,
         dataMode: IconDataMode) -> Double
     {
-        let values = [primary, weekly, credits].compactMap { $0 }
+        let values = [primary, weekly, credits].compactMap(\.self)
         guard !values.isEmpty else { return 0 }
         let normalized = values.map { max(0, min($0 / 100, 1)) }
         switch dataMode {
@@ -884,11 +891,10 @@ enum IconRenderer {
         let safe = NSColor(calibratedRed: 0.12, green: 0.86, blue: 0.78, alpha: 1)
         let warn = NSColor(calibratedRed: 1.00, green: 0.72, blue: 0.30, alpha: 1)
         let hot = NSColor(calibratedRed: 1.00, green: 0.31, blue: 0.44, alpha: 1)
-        let color: NSColor
-        if clamped <= 0.5 {
-            color = self.mixColor(safe, warn, p: clamped / 0.5)
+        let color: NSColor = if clamped <= 0.5 {
+            self.mixColor(safe, warn, p: clamped / 0.5)
         } else {
-            color = self.mixColor(warn, hot, p: (clamped - 0.5) / 0.5)
+            self.mixColor(warn, hot, p: (clamped - 0.5) / 0.5)
         }
         if stale {
             return color.withAlphaComponent(0.72)

package/Sources/Runic/Core/Rendering/IconView.swift

@@ -19,7 +19,9 @@ struct IconView: View {
     private let cycleIntervalTicks = 20
     private let patterns = LoadingPattern.allCases
 
-    private var isLoading: Bool { self.showLoadingAnimation && self.snapshot == nil }
+    private var isLoading: Bool {
+        self.showLoadingAnimation && self.snapshot == nil
+    }
 
     var body: some View {
         Group {

package/Sources/Runic/Core/RunicColors.swift

@@ -14,12 +14,12 @@ enum RunicColors {
     /// Ordered palette for chart series. Colors chosen for distinguishability in
     /// both light and dark mode and for common color-vision deficiencies.
     static let chartPalette: [Color] = [
-        Color(red: 0.26, green: 0.55, blue: 0.96),  // blue
-        Color(red: 0.94, green: 0.53, blue: 0.18),  // orange
-        Color(red: 0.46, green: 0.75, blue: 0.36),  // green
-        Color(red: 0.80, green: 0.45, blue: 0.92),  // purple
-        Color(red: 0.26, green: 0.78, blue: 0.86),  // teal
-        Color(red: 0.94, green: 0.74, blue: 0.26),  // yellow
+        Color(red: 0.26, green: 0.55, blue: 0.96), // blue
+        Color(red: 0.94, green: 0.53, blue: 0.18), // orange
+        Color(red: 0.46, green: 0.75, blue: 0.36), // green
+        Color(red: 0.80, green: 0.45, blue: 0.92), // purple
+        Color(red: 0.26, green: 0.78, blue: 0.86), // teal
+        Color(red: 0.94, green: 0.74, blue: 0.26), // yellow
     ]
 
     /// Returns a chart color for the given index, wrapping around if needed.

package/Sources/Runic/Core/RunicSpacing.swift

@@ -33,16 +33,16 @@ enum RunicSpacing {
     // MARK: - Semantic Spacing
 
     /// Horizontal padding for menu content
-    static let menuHorizontalPadding: CGFloat = sm  // 12pt
+    static let menuHorizontalPadding: CGFloat = sm // 12pt
 
     /// Vertical padding for menu content
-    static let menuVerticalPadding: CGFloat = xs  // 8pt
+    static let menuVerticalPadding: CGFloat = xs // 8pt
 
     /// Spacing between cards in menu
-    static let cardSpacing: CGFloat = xs  // 8pt
+    static let cardSpacing: CGFloat = xs // 8pt
 
     /// Spacing between major sections
-    static let sectionSpacing: CGFloat = lg  // 24pt
+    static let sectionSpacing: CGFloat = lg // 24pt
 
     // MARK: - Preferences Spacing
 
@@ -50,13 +50,13 @@ enum RunicSpacing {
     static let compact: CGFloat = 6
 
     /// Standardized spacing for toggle rows
-    static let toggleRowSpacing: CGFloat = xs  // 8pt
+    static let toggleRowSpacing: CGFloat = xs // 8pt
 
     /// Spacing after section headers
-    static let sectionHeaderSpacing: CGFloat = md  // 16pt
+    static let sectionHeaderSpacing: CGFloat = md // 16pt
 
     /// Spacing within stepper controls
-    static let stepperControlSpacing: CGFloat = xs  // 8pt
+    static let stepperControlSpacing: CGFloat = xs // 8pt
 
     // MARK: - Chart Metrics
 

package/Sources/Runic/Core/RunicTypography.swift

@@ -0,0 +1,206 @@
+import CoreText
+import SwiftUI
+
+// MARK: - Typography tokens
+
+/// App-wide font design token.
+enum RunicTypography {
+    static let typeSize: DynamicTypeSize = .xLarge
+
+    /// Register all TTF/OTF fonts found in the app bundle's Fonts directory.
+    /// Call once at launch before any UI is created.
+    static func registerFonts() {
+        guard let fontsURL = Bundle.main.url(forResource: "Fonts", withExtension: nil)
+            ?? Bundle.main.resourceURL?.appendingPathComponent("Fonts")
+        else { return }
+        guard let enumerator = FileManager.default.enumerator(
+            at: fontsURL,
+            includingPropertiesForKeys: nil,
+            options: [.skipsHiddenFiles])
+        else { return }
+        for case let fileURL as URL in enumerator
+            where fileURL.pathExtension.lowercased() == "ttf" || fileURL.pathExtension.lowercased() == "otf"
+        {
+            CTFontManagerRegisterFontsForURL(fileURL as CFURL, .process, nil)
+        }
+    }
+
+    /// Discover bundled font family names from the Fonts directory.
+    static func discoverBundledFontFamilies() -> [String] {
+        guard let fontsURL = Bundle.main.url(forResource: "Fonts", withExtension: nil)
+            ?? Bundle.main.resourceURL?.appendingPathComponent("Fonts")
+        else { return [] }
+        guard let enumerator = FileManager.default.enumerator(
+            at: fontsURL,
+            includingPropertiesForKeys: nil,
+            options: [.skipsHiddenFiles])
+        else { return [] }
+        var families = Set<String>()
+        for case let fileURL as URL in enumerator
+            where fileURL.pathExtension.lowercased() == "ttf" || fileURL.pathExtension.lowercased() == "otf"
+        {
+            if let descriptors = CTFontManagerCreateFontDescriptorsFromURL(fileURL as CFURL) as? [CTFontDescriptor] {
+                for desc in descriptors {
+                    if let name = CTFontDescriptorCopyAttribute(desc, kCTFontFamilyNameAttribute) as? String {
+                        families.insert(name)
+                    }
+                }
+            }
+        }
+        return families.sorted()
+    }
+}
+
+// MARK: - Available font choices
+
+/// A selectable font option shown in preferences.
+struct RunicFontChoice: Identifiable, Hashable {
+    let id: String
+    let displayName: String
+
+    /// System fonts — always available, no bundling.
+    static let sfPro = RunicFontChoice(id: "__sf_pro__", displayName: "SF Pro")
+    static let sfMono = RunicFontChoice(id: "__sf_mono__", displayName: "SF Mono")
+
+    /// Font used to render this choice's name in the picker (preview in its own typeface).
+    var previewFont: Font {
+        switch self.id {
+        case Self.sfPro.id: .system(.body)
+        case Self.sfMono.id: .system(.body, design: .monospaced)
+        default: Font.custom(self.id, fixedSize: 13)
+        }
+    }
+
+    /// Build the full list: system fonts first, then bundled custom fonts.
+    static func availableChoices() -> [RunicFontChoice] {
+        var choices: [RunicFontChoice] = [.sfPro, .sfMono]
+        for family in RunicTypography.discoverBundledFontFamilies() {
+            choices.append(RunicFontChoice(id: family, displayName: family))
+        }
+        return choices
+    }
+}
+
+// MARK: - Dynamic SwiftUI Font Scale
+
+@MainActor
+enum RunicFont {
+    /// The active font family identifier. Updated from SettingsStore.
+    static var family: String = "Fira Code"
+
+    private static var isSystemFont: Bool {
+        family.hasPrefix("__")
+    }
+
+    /// Font design used by `.runicTypography()` for system-font fallback.
+    static var systemFallbackDesign: Font.Design {
+        family == RunicFontChoice.sfPro.id ? .default : .monospaced
+    }
+
+    // MARK: Semantic sizes
+
+    static var caption2: Font {
+        makeFont(size: 10, relativeTo: .caption2)
+    }
+
+    static var caption: Font {
+        makeFont(size: 11, relativeTo: .caption)
+    }
+
+    static var footnote: Font {
+        makeFont(size: 12, relativeTo: .footnote)
+    }
+
+    static var callout: Font {
+        makeFont(size: 13, relativeTo: .callout)
+    }
+
+    static var body: Font {
+        makeFont(size: 13, relativeTo: .body)
+    }
+
+    static var subheadline: Font {
+        makeFont(size: 12, relativeTo: .subheadline)
+    }
+
+    static var headline: Font {
+        makeFont(size: 13, relativeTo: .headline).weight(.bold)
+    }
+
+    static var title3: Font {
+        makeFont(size: 15, relativeTo: .title3)
+    }
+
+    static var title2: Font {
+        makeFont(size: 17, relativeTo: .title2)
+    }
+
+    static var title: Font {
+        makeFont(size: 22, relativeTo: .title)
+    }
+
+    static var largeTitle: Font {
+        makeFont(size: 26, relativeTo: .largeTitle)
+    }
+
+    /// Custom fixed size.
+    static func system(size: CGFloat) -> Font {
+        switch self.family {
+        case RunicFontChoice.sfPro.id: .system(size: size)
+        case RunicFontChoice.sfMono.id: .system(size: size, design: .monospaced)
+        default: Font.custom(self.family, fixedSize: size)
+        }
+    }
+
+    /// Custom fixed size with weight.
+    static func system(size: CGFloat, weight: Font.Weight) -> Font {
+        switch self.family {
+        case RunicFontChoice.sfPro.id: .system(size: size, weight: weight)
+        case RunicFontChoice.sfMono.id: .system(size: size, weight: weight, design: .monospaced)
+        default: Font.custom(self.family, fixedSize: size).weight(weight)
+        }
+    }
+
+    // MARK: Private
+
+    private static func makeFont(size: CGFloat, relativeTo style: Font.TextStyle) -> Font {
+        switch self.family {
+        case RunicFontChoice.sfPro.id: .system(style)
+        case RunicFontChoice.sfMono.id: .system(style, design: .monospaced)
+        default: Font.custom(self.family, size: size, relativeTo: style)
+        }
+    }
+}
+
+// MARK: - AppKit NSFont
+
+extension RunicFont {
+    static func nsFont(size: CGFloat, weight: NSFont.Weight = .regular) -> NSFont {
+        switch self.family {
+        case RunicFontChoice.sfPro.id:
+            return .systemFont(ofSize: size, weight: weight)
+        case RunicFontChoice.sfMono.id:
+            return .monospacedSystemFont(ofSize: size, weight: weight)
+        default:
+            let traits: [NSFontDescriptor.TraitKey: Any] = [.weight: weight]
+            let descriptor = NSFontDescriptor(fontAttributes: [
+                .family: family,
+                .traits: traits,
+            ])
+            return NSFont(descriptor: descriptor, size: size)
+                ?? .monospacedSystemFont(ofSize: size, weight: weight)
+        }
+    }
+}
+
+// MARK: - View modifier
+
+extension View {
+    /// Apply the selected font as the default, with system fallback design and xLarge dynamic type.
+    func runicTypography() -> some View {
+        self
+            .font(RunicFont.body)
+            .fontDesign(RunicFont.systemFallbackDesign)
+            .dynamicTypeSize(RunicTypography.typeSize)
+    }
+}

package/Sources/Runic/Core/Stores/AuggieTokenStore.swift

@@ -1,5 +1,5 @@
-import RunicCore
 import Foundation
+import RunicCore
 import Security
 
 protocol AuggieTokenStoring: Sendable {
@@ -53,29 +53,16 @@ struct KeychainAuggieTokenStore: AuggieTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
-
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +78,7 @@ struct KeychainAuggieTokenStore: AuggieTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -126,18 +114,4 @@ struct KeychainAuggieTokenStore: AuggieTokenStoring {
         }
         return q
     }
-
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/AzureOpenAITokenStore.swift

@@ -1,5 +1,5 @@
-import RunicCore
 import Foundation
+import RunicCore
 import Security
 
 protocol AzureOpenAITokenStoring: Sendable {
@@ -53,29 +53,16 @@ struct KeychainAzureOpenAITokenStore: AzureOpenAITokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
-
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +78,7 @@ struct KeychainAzureOpenAITokenStore: AzureOpenAITokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -126,18 +114,4 @@ struct KeychainAzureOpenAITokenStore: AzureOpenAITokenStoring {
         }
         return q
     }
-
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }