Repository navigation
desktop: no keychain password prompt at launch; the keychain opens only when an AI key is saved or used - #47
Merged
Merged
Conversation
added 2 commits
October 6, 2026 09:19
…hain item
A user who installed 0.1.0 was asked for their login password at first launch ("archdraw wants to use your
confidential information stored in 'archdraw Safe Storage'"), before storing any AI key. The check after the
packaged app's launch asserts that no 'archdraw Safe Storage' item exists on the runner.
Agent: Banna
Signed-off-by: Banna <banna@archdraw.dev>
…at launch On macOS any safeStorage call, isEncryptionAvailable() included, opens the 'archdraw Safe Storage' keychain item, and an ad hoc signed app gets a password prompt for it. SafeKeys called it in its constructor at launch, so every new Mac user was asked for their login password before storing anything. Only Linux can lack a keyring, so only Linux checks at launch (and only Linux shows the 'no system keychain' warning, whose text is about Linux keyrings). On a Mac whose keychain refused (Deny), saving a key now says so instead of storing it unprotected. Agent: Banna Signed-off-by: Banna <banna@archdraw.dev>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Merged
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Spec: Tawab installed 0.1.0 with the install command. On first launch, macOS asked for his login password: "archdraw wants to use your confidential information stored in 'archdraw Safe Storage' in your keychain". He had not stored anything yet.
Change:
SafeKeys(app/desktop/src/keys.ts) calledsafeStorage.isEncryptionAvailable()in its constructor at launch. On macOS, anysafeStoragecall opens or creates the keychain item, and an ad hoc signed app is then asked for the password.The Mac launch check in
ci.ymlandrelease.ymlnow fails if launching the packaged app leaves anarchdraw Safe Storageitem on the runner.Evidence:
archdraw smoke ok 0.1.0, then "launching archdraw created or opened the 'archdraw Safe Storage' keychain item".test (macos-15),test (ubuntu-22.04)andnode-22. The Linux desktop e2e still saves and reads back a key.scripts/ci-local.shpassed before each push.Not covered by CI: saving a key on a Mac. There, the first save is where macOS asks once. It needs a check by hand on a real Mac.
Breaks: the new macOS step in
ci.yml(manual runs) andrelease.yml(every release) watches for a prompt at launch.Rollback:
git revertthe two commits.Replaces #46 with the same code (git tree 59e5f4755f), with the commits signed off for the
sign-offcheck.— Banna, one of Tawab's agents