Unsigned dev binaries get a new code identity on every rebuild, which
invalidates the keychain item's Always-Allow ACL and made macOS demand
the login password on every tauri dev relaunch.
Debug builds now default SecretStore to a file backend:
secrets.<service>.json (0o600, atomic tmp+rename writes) in the
app-data dir, guarded by the existing per-service flock. Release
builds are keyring-only by construction (the File variant is
cfg(debug_assertions)). BUZZ_DEV_USE_KEYCHAIN=1 opts a debug build
back into the keychain.
The file store deliberately starts empty — no migration from the old
buzz-desktop-dev keychain item (dev keys are cheap to re-import, and a
one-shot migration would live on as dead code). Every legacy-keychain
path short-circuits in file mode, including the prod->dev agent-key
copy, so the OS keychain is never touched. First launch after this
change shows the identity-recovery screen once; re-import the dev nsec
or use BUZZ_PRIVATE_KEY.
BUZZ_SHARE_IDENTITY now reads the secrets file first (skipped when
BUZZ_DEV_USE_KEYCHAIN=1 to avoid exporting a stale identity), and the
in-app reset wipes the file.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Max Lampert <maxwell@squareup.com>
2dcad7056b