fix: single Keychain entry for all credentials; prepare v0.5.1 release - #36
Merged
Merged
Conversation
macOS ties a Keychain "Always Allow" grant to the IDE code signature, so every IDE (especially EAP) update re-prompted once per stored account. CredentialsStore now keeps every secret in one PasswordSafe entry (a JSON vault accountId -> secret), read once per session and cached in memory. Legacy per-account entries are migrated into the vault on first access and deleted, so after migration an IDE update costs a single prompt.
Bump pluginVersion to 0.5.1, add the 0.5.1 CHANGELOG entry, update the README/DEVELOPMENT version references, the What's New notification and the Marketplace change-notes (backfilling the missing 0.5.0 entry).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v0.5.1 (patch)
Fixes the macOS Keychain prompt storm and prepares the 0.5.1 release.
Problem
CredentialsStorekept one PasswordSafe (Keychain) entry per account. macOS ties an "Always Allow" grant to the IDE's code signature, so every IDE update (EAP builds especially) revoked the grant and re-prompted once per account — with ten accounts that meant ten password dialogs after every update.Fix
TokenPulse — vault), a JSON mapaccountId → secret, read once per IDE session and cached in memory. An IDE update now costs at most one prompt.CredentialsStoreAPI is unchanged, so no callers had to change. Storage sits behind an internalSecretBackendseam, which keeps the store unit-testable without PasswordSafe.Release prep (same as #35)
pluginVersion = 0.5.1[0.5.1] - 2026-09-23entry + Quick Navigation rowpluginVersionandgit tag→ 0.5.1change-notesfor 0.5.1, plus the 0.5.0 entry that was missingTesting
CredentialsStoreTest(10 cases): single vault entry, round-trip, one backend read for 10 accounts, remove, legacy migration + deletion, one-time lookup for missing legacy entries, corrupt vault../gradlew test platformTest koverVerify detekt— 791 tests, 0 failures../gradlew verifyPluginagainst IU-2026.2.3 — Compatible.Known limitation
If the user clicks Deny on the single vault prompt, the store treats the vault as empty for that session. Adding or editing an account in that same session then overwrites the vault, and secrets already migrated into it are lost. Secrets not yet migrated stay in their per-account entries.
After merge
Tag
v0.5.1on the merge commit and push —release.ymlhandles the rest.