From fec20db57cf9e4cd12fc83d7be19213b1cd8aca9 Mon Sep 17 00:00:00 2001
From: NimBold <NimBold@users.noreply.github.com>
Date: Wed, 24 Jun 2026 22:14:08 +0330
Subject: [PATCH] fix(backend): absolutely eliminate keychain access on startup

This entirely removes 'sanitize_current_settings_and_restore_token' from 'db::init' and removes the keychain hydration from 'setup()'. The backend will now never access the keychain during bootstrapping, relying purely on the frontend to explicitly trigger token hydration and migration via Tauri IPC when the UI mounts. This guarantees the macOS system prompt will never block the app from opening, and will only appear after the window is fully visible.
---
 src-tauri/src/db.rs  |  9 ++++-----
 src-tauri/src/lib.rs | 24 ++++++++----------------
 2 files changed, 12 insertions(+), 21 deletions(-)

diff --git a/src-tauri/src/db.rs b/src-tauri/src/db.rs
index cb749b4..1195939 100644
--- a/src-tauri/src/db.rs
+++ b/src-tauri/src/db.rs
@@ -76,15 +76,14 @@ fn init_at_path_internal(app_data_dir: &Path, force_disable_keychain: bool) -> R
         backup_database(&connection, &database_path, &format!("schema-v{version}"))?;
     }
     migrate_schema(&mut connection, version)?;
-    let (current_token_pending, keychain_granted) =
-        sanitize_current_settings_and_restore_token(&connection, false)?;
-        
-    let allow_keychain = keychain_granted && !force_disable_keychain;
 
+    // We no longer touch the keychain on backend startup.
+    // Legacy imports will safely preserve any pairing token in the JSON payload.
+    // The frontend will manually trigger migration to the keychain via IPC if access is granted.
     import_legacy_data(
         &mut connection,
         app_data_dir,
-        allow_keychain && !current_token_pending,
+        false,
     )?;
 
     Ok(DbState {
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 7226593..88ff710 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -3900,22 +3900,14 @@ pub fn run() {
             let database = crate::db::init(app.handle())
                 .map_err(|error| format!("failed to initialize persistence: {error}"))?;
             let initial_pairing_token = {
-                let mut connection = database.lock()?;
-                let skip_keychain = !crate::db::is_keychain_access_granted(&connection).unwrap_or(false);
-                match crate::db::hydrate_pairing_token(&mut connection, skip_keychain) {
-                    Ok((token, _)) => token,
-                    Err(error) => {
-                        log::warn!(
-                            "Secure credential storage unavailable; using session-only extension token: {}",
-                            error
-                        );
-                        format!(
-                            "{}{}",
-                            uuid::Uuid::new_v4().simple(),
-                            uuid::Uuid::new_v4().simple()
-                        )
-                    }
-                }
+                // Generate a temporary session token for the extension server on startup.
+                // The frontend will hydrate the real token via IPC once it mounts, 
+                // avoiding any macOS system prompts before the UI is fully visible.
+                format!(
+                    "{}{}",
+                    uuid::Uuid::new_v4().simple(),
+                    uuid::Uuid::new_v4().simple()
+                )
             };
             {
                 let mut pairing_token = extension_pairing_token