From 10f93271cf441114538e2aedd84cc9650ed83a2b Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Mon, 12 Oct 2026 09:21:44 +0100 Subject: [PATCH] fix: probe the keychain with a read instead of writing an item at every launch Startup wrote and deleted a probe item to see whether the keychain works, waking D-Bus on Linux and risking a Keychain prompt on macOS. A read of a missing entry answering 'no entry' proves the same; if a later write is refused anyway, set_checked already falls back to the vault (F11). Not verified against a live Secret Service or macOS Keychain in this environment (no secret service here; the probe correctly reports it unavailable). --- rust/core/src/secrets.rs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rust/core/src/secrets.rs b/rust/core/src/secrets.rs index 5aff27e..5a5d1ad 100644 --- a/rust/core/src/secrets.rs +++ b/rust/core/src/secrets.rs @@ -272,9 +272,12 @@ impl Keychain { Keychain { service: service.into(), legacy: legacy.map(Into::into) } } + /// Probes with a read of an entry that doesn't exist: "no entry" proves the keychain answers, + /// without writing an item at every launch (which wakes D-Bus and can prompt on macOS). If + /// writes later fail anyway, `Secrets::set_checked` falls back to the vault. pub fn available(&self) -> bool { let service = self.service.clone(); - off_runtime(move || entry(&service, "__nexus_keychain_probe__").and_then(|e| e.set_password("probe").and_then(|_| e.delete_credential())).is_ok()) + off_runtime(move || matches!(entry(&service, "__nexus_keychain_probe__").and_then(|e| e.get_password()), Ok(_) | Err(keyring::Error::NoEntry))) } /// Reads a secret; a miss under the current service falls back to the legacy one and copies