@sriinnu/runic 1.0.0 → 2.0.0

package/Sources/Runic/Core/Stores/CerebrasTokenStore.swift

@@ -1,5 +1,5 @@
-import RunicCore
 import Foundation
+import RunicCore
 import Security
 
 protocol CerebrasTokenStoring: Sendable {
@@ -53,29 +53,16 @@ struct KeychainCerebrasTokenStore: CerebrasTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
-
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +78,7 @@ struct KeychainCerebrasTokenStore: CerebrasTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -126,18 +114,4 @@ struct KeychainCerebrasTokenStore: CerebrasTokenStoring {
         }
         return q
     }
-
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/CohereTokenStore.swift

@@ -1,5 +1,5 @@
-import RunicCore
 import Foundation
+import RunicCore
 import Security
 
 protocol CohereTokenStoring: Sendable {
@@ -53,29 +53,16 @@ struct KeychainCohereTokenStore: CohereTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
-
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +78,7 @@ struct KeychainCohereTokenStore: CohereTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -126,18 +114,4 @@ struct KeychainCohereTokenStore: CohereTokenStoring {
         }
         return q
     }
-
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/CopilotTokenStore.swift

@@ -1,5 +1,5 @@
-import RunicCore
 import Foundation
+import RunicCore
 import Security
 
 protocol CopilotTokenStoring: Sendable {
@@ -53,29 +53,16 @@ struct KeychainCopilotTokenStore: CopilotTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
-
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +78,7 @@ struct KeychainCopilotTokenStore: CopilotTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -126,18 +114,4 @@ struct KeychainCopilotTokenStore: CopilotTokenStoring {
         }
         return q
     }
-
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/CustomProviderStore.swift

@@ -12,20 +12,20 @@ enum CustomProviderStoreError: LocalizedError {
     var errorDescription: String? {
         switch self {
         case let .providerNotFound(id):
-            return "Provider with ID '\(id)' not found."
+            "Provider with ID '\(id)' not found."
         case let .duplicateProvider(id):
-            return "Provider with ID '\(id)' already exists."
+            "Provider with ID '\(id)' already exists."
         case .invalidData:
-            return "Invalid provider data."
+            "Invalid provider data."
         case let .fileSystemError(message):
-            return "File system error: \(message)"
+            "File system error: \(message)"
         }
     }
 }
 
 // MARK: - Store
 
-public struct CustomProviderStore {
+public enum CustomProviderStore {
     private static let log = RunicLog.logger("custom-provider-store")
 
     // MARK: - Storage Location
@@ -41,8 +41,8 @@ public struct CustomProviderStore {
 
     /// Load all custom providers from disk.
     public static func load() -> CustomProvidersData {
-        guard FileManager.default.fileExists(atPath: storageURL.path) else {
-            Self.log.info("No custom providers file found, returning empty data.")
+        guard FileManager.default.fileExists(atPath: self.storageURL.path) else {
+            self.log.info("No custom providers file found, returning empty data.")
             return CustomProvidersData()
         }
 
@@ -54,7 +54,7 @@ public struct CustomProviderStore {
             Self.log.info("Loaded \(providersData.providers.count) custom provider(s).")
             return providersData
         } catch {
-            Self.log.error("Failed to load custom providers: \(error)")
+            self.log.error("Failed to load custom providers: \(error)")
             return CustomProvidersData()
         }
     }
@@ -67,7 +67,7 @@ public struct CustomProviderStore {
 
         do {
             let data = try encoder.encode(providersData)
-            try data.write(to: storageURL, options: .atomic)
+            try data.write(to: self.storageURL, options: .atomic)
             Self.log.info("Saved \(providersData.providers.count) custom provider(s).")
         } catch {
             Self.log.error("Failed to save custom providers: \(error)")
@@ -153,6 +153,6 @@ public struct CustomProviderStore {
     /// - Returns: Array of enabled custom provider configurations.
     public static func getEnabledProviders() -> [CustomProviderConfig] {
         let data = Self.load()
-        return data.providers.filter { $0.enabled }
+        return data.providers.filter(\.enabled)
     }
 }

package/Sources/Runic/Core/Stores/DeepSeekTokenStore.swift

@@ -1,5 +1,5 @@
-import RunicCore
 import Foundation
+import RunicCore
 import Security
 
 protocol DeepSeekTokenStoring: Sendable {
@@ -53,29 +53,16 @@ struct KeychainDeepSeekTokenStore: DeepSeekTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
-
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +78,7 @@ struct KeychainDeepSeekTokenStore: DeepSeekTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -126,18 +114,4 @@ struct KeychainDeepSeekTokenStore: DeepSeekTokenStoring {
         }
         return q
     }
-
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/FireworksTokenStore.swift

@@ -1,5 +1,5 @@
-import RunicCore
 import Foundation
+import RunicCore
 import Security
 
 protocol FireworksTokenStoring: Sendable {
@@ -53,29 +53,16 @@ struct KeychainFireworksTokenStore: FireworksTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
-
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +78,7 @@ struct KeychainFireworksTokenStore: FireworksTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -126,18 +114,4 @@ struct KeychainFireworksTokenStore: FireworksTokenStoring {
         }
         return q
     }
-
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/GroqTokenStore.swift

@@ -1,5 +1,5 @@
-import RunicCore
 import Foundation
+import RunicCore
 import Security
 
 protocol GroqTokenStoring: Sendable {
@@ -53,29 +53,16 @@ struct KeychainGroqTokenStore: GroqTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
-
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +78,7 @@ struct KeychainGroqTokenStore: GroqTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -126,18 +114,4 @@ struct KeychainGroqTokenStore: GroqTokenStoring {
         }
         return q
     }
-
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/KimiTokenStore.swift

@@ -1,5 +1,5 @@
-import RunicCore
 import Foundation
+import RunicCore
 import Security
 
 protocol KimiTokenStoring: Sendable {
@@ -53,29 +53,16 @@ struct KeychainKimiTokenStore: KimiTokenStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
-
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteToken(dataProtection: false)
-        }
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteToken(dataProtection: false)
+        try? self.deleteToken(dataProtection: true)
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +78,7 @@ struct KeychainKimiTokenStore: KimiTokenStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -126,18 +114,4 @@ struct KeychainKimiTokenStore: KimiTokenStoring {
         }
         return q
     }
-
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }

package/Sources/Runic/Core/Stores/MiniMaxCookieHeaderStore.swift

@@ -1,5 +1,5 @@
-import RunicCore
 import Foundation
+import RunicCore
 import Security
 
 protocol MiniMaxCookieHeaderStoring: Sendable {
@@ -53,29 +53,16 @@ struct KeychainMiniMaxCookieHeaderStore: MiniMaxCookieHeaderStoring {
         }
 
         let data = cleaned!.data(using: .utf8)!
-        let query = self.baseQuery(dataProtection: false)
-        let attributes: [String: Any] = [
-            kSecValueData as String: data,
-            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
-        ]
-
-        // Try update first.
-        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
-        if updateStatus == errSecSuccess { return }
-
-        if updateStatus != errSecItemNotFound {
-            // Item exists but update failed — delete and re-add to reset ACL.
-            try? self.deleteHeader(dataProtection: false)
-        }
 
-        var addQuery = query
-        for (key, value) in attributes { addQuery[key] = value }
+        // Always delete-then-add to ensure SecAccess ACL is set.
+        // SecItemUpdate does NOT update the ACL, so existing items with
+        // missing or stale ACLs would continue to prompt for passwords.
+        try? self.deleteHeader(dataProtection: false)
+        try? self.deleteHeader(dataProtection: true)
 
-        // Grant the calling app permanent access so macOS never shows a
-        // Keychain password dialog for this item.
-        if let access = Self.createSelfAccess() {
-            addQuery[kSecAttrAccess as String] = access
-        }
+        var addQuery = self.baseQuery(dataProtection: false)
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
 
         let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
         guard addStatus == errSecSuccess else {
@@ -91,6 +78,7 @@ struct KeychainMiniMaxCookieHeaderStore: MiniMaxCookieHeaderStoring {
         var query = self.baseQuery(dataProtection: dataProtection)
         query[kSecMatchLimit as String] = kSecMatchLimitOne
         query[kSecReturnData as String] = true
+        query[kSecUseAuthenticationUI as String] = kSecUseAuthenticationUIFail
 
         let status = SecItemCopyMatching(query as CFDictionary, &result)
         if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
@@ -126,18 +114,4 @@ struct KeychainMiniMaxCookieHeaderStore: MiniMaxCookieHeaderStoring {
         }
         return q
     }
-
-    /// Creates a SecAccess that grants the calling application permanent
-    /// read/write access without triggering the macOS Keychain password dialog.
-    private static func createSelfAccess() -> SecAccess? {
-        var trustedSelf: SecTrustedApplication?
-        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
-              let trustedSelf else { return nil }
-        var access: SecAccess?
-        guard SecAccessCreate(
-            "Runic API Token" as CFString,
-            [trustedSelf] as CFArray,
-            &access) == errSecSuccess else { return nil }
-        return access
-    }
 }