Repository navigation
Conversation
CredentialStoreKey now reads and creates its key through SwiftKeychain's KeychainKey.loadOrCreate, which adds a new key rather than storing over one, so two processes starting at once agree on a key. The hand-written SecItem code, KeychainAccess, SystemKeychain and CredentialKeyError are gone in favour of SwiftKeychain's types. The item is the one every earlier version wrote: same service and account, after first unlock on this device only, not synchronized, no access group, and on macOS the login keychain (SystemKeychain(dataProtection: false)). Tests pin each of those and read a key seeded at the old identity. SwiftKeychain is depended on for macOS, iOS and visionOS only; Linux, tvOS and watchOS compile the key out. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PtLUw634m85L9ucJTrftoD
CHANGELOG Unreleased gains a Breaking section; the migration guide maps each removed name to SwiftKeychain's and says stored credentials are untouched; README and persistent()'s documentation say which platforms keep the key in the Keychain and where it lives on macOS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PtLUw634m85L9ucJTrftoD
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
CredentialStoreKeynow keeps its key through SwiftKeychain 0.1.1 (KeychainKey.loadOrCreate) instead of hand-writtenSecItemcode. The design is unchanged: one key in the Keychain, credentials in the encrypted files.KeychainClientStorageis deliberately not used — that would strand every stored credential.Compatibility (the whole risk)
The key is read from the exact item every earlier version wrote:
com.swiftmcpclient.credential-store, accountcredential-encryption-key.afterFirstUnlockThisDeviceOnly, not synchronizable, no access groupSystemKeychain(dataProtection: false)— the old code never setkSecUseDataProtectionKeychain. On iOS the flag is ignored.Pinned by tests against literal strings (not the type's own constants):
CredentialStoreKey.itemfield by field, the defaultkeychainis aSystemKeychainwithdataProtection == false, and a key seeded at the old identity inInMemoryKeychaincomes back byte for byte with nothing added.Breaking (0.15.0)
KeychainAccess,SystemKeychain,CredentialKeyError; SwiftKeychain's types replace them. No@_exported import— callers that name them depend on and import SwiftKeychain.loadOrCreate()/delete()arethrows(KeychainError);persistent()throws it too.CredentialStoreKey.item,CredentialStoreKey.keychain;CredentialStoreKeyisSendable.CredentialStoreKeyandMCPOAuthSession.persistent()are now macOS/iOS/visionOS only. They used to compile on tvOS/watchOS too; SwiftKeychain does not support those platforms.CHANGELOG (Unreleased → Breaking) and a MigrationGuide section with an old → new table cover it.
Also
Package.resolvedgains onlyswiftkeychain(no traits). The product is linked withcondition: .when(platforms: [.macOS, .iOS, .visionOS]); Linux compiles the key out.persistent()and logs the error generically.Note for merging
The main checkout of this repo has uncommitted changes from 2026-10-08 (not part of this PR) touching
CHANGELOG.md,MCPOAuthSession.swift,MigrationGuide.md,OAuthHTTP.swift, the transports and DocC guides. They will need merging with this branch later; expect conflicts in the CHANGELOG Unreleased section and aroundpersistent().Verification
swift test: 677 tests in 90 suites pass (macOS).quality-gate: 0 errors / 0 warnings, no new suppressions.🤖 Generated with Claude Code
https://claude.ai/code/session_01PtLUw634m85L9ucJTrftoD