[yk-sgr]

Stacked on #5. Last of the stack.

What changes

credentials = "keychain" in config.toml keeps both sign-ins in the macOS Keychain instead of files: the Web API token (webapi-token.json) and librespot's reusable streaming credentials (session/credentials.json).

• New secret store in cloofy-os. It uses the login keychain through security-framework (already in the tree via rustls), as generic passwords under the service cloofy. On other systems it isn't available, and the setting fails with a clear message instead of being ignored silently.
• Secret in cloofy-spotify. A sign-in lives either in a private file or in the keychain. Paths carries the mode, so every existing call site (paths.webapi_token(), session::prepare(paths)) stays the same.
• Moving from files. A file in the old place always wins and moves into the keychain when read. That covers switching from files, and cloofy login, where librespot writes the real reusable credentials (with their auth_type) itself: they move over right after. The rest of the time, librespot's cache gets no credentials file.
• Refreshed credentials. After every connection, cloofy updates the stored credentials when Spotify handed out new ones (session::remember), as librespot does for files. PendingSession::connect (used by login, doctor, query) does it itself; the Spirc connections in the TUI and in play/connect call it explicitly.

Why it's off by default

macOS ties keychain access to the binary's code signature. For an unsigned, ad-hoc signed build, every update is a new binary, so macOS asks again whether cloofy may use its items. Once releases are signed, this can become the default.

Verified

• A round trip in the real login keychain (#[ignore]d, since CI can't answer keychain prompts): save, overwrite, read, delete, plus moving a file into the keychain.
• End-to-end with the real binary, using fake credentials in a temporary XDG environment with credentials = "keychain":
  • Run 1: both files moved into the keychain.
  • Run 2: with no files left, cloofy doctor read the token from the keychain (401 from Spotify for the fake token, not "not logged in").
  • Both items were deleted afterwards.
• Unit tests: private-file storage (mode 0600), and the credentials values.

To test by hand

• Set credentials = "keychain" and start cloofy: the files in ~/.local/share/cloofy disappear, and Keychain Access shows two cloofy items
• Restart: cloofy is still signed in
• cloofy login --force: still signed in, and no credentials.json remains
• Remove the setting: cloofy login is needed again (sign-ins aren't moved back to files)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b683b844-49a3-4037-bad2-3aa93b92c439

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[parda21]

Merged through #7. The only conflicts were with the audit work: the Web API client keeps its new timeouts and rate-limit retries and reads its token from your Secret, and the supervisor saves renewed credentials before subscribing to Connect pushes.

🤖 Generated with Claude Code