[piekstra]

Problem

Every cr upgrade raises a Keychain prompt for each credential it reads. Always Allow adds a partition entry for that exact build, because a binary without a TeamIdentifier is identified by its cdhash, so the next release counts as a new application even though its designated requirement is stable.

Change

Bump cli-common from v0.4.1 to v0.5.1. v0.5.1 reads Keychain secrets through the system /usr/bin/security, whose ACL and apple-tool: partition entries do not change when cr does, and returns the exact stored bytes, so a multi-line value such as a GitHub App private key survives the read. v0.5.0 adds Store.ListProfiles, which needs no change here because cr uses the concrete *credstore.Store.

The README states the behaviour under Platform Support.

What a user sees

• One prompt naming security for each item that does not yet trust it. Choose Always Allow.
• No read prompts across upgrades after that.
• An item that already trusts security raises no prompt at all.
• A new item, written by cr set-credential or cr init, raises that one prompt on its first read. Writes still run as the cr binary.
• A prompt left unanswered fails the read after 60 seconds with an error naming the pending approval.

Verification

Check	Result
make lint build	Pass, 0 lint issues
go test -tags=keyring_nopassage -count=1 ./...	3933 pass, 34 skip, 3 fail. All 3 are TestPiRPCReviewerImageProcessingBounds under full-suite load, with no credstore dependency. The package passes alone at this pin.
Freshly built ad-hoc-signed binary, cr me --profile, on an item that already trusts security	Read in 13 ms with no prompt, and the item's partition list gained no entry

Not verified: the Always Allow click on an item that does not trust security, because a probe raises a dialog on the owner's screen, and a Homebrew cask upgrade of an installed cr.

[piekstra-dev]

Automated PR Review

Reviewed commit: 86b29a953ca6
Profile: reviewer - Posting as: piekstra-dev

Summary

Reviewer	Findings
automation:ci-release	0
documentation:docs	0
go:implementation-tests	0
policies:conventions	0
privacy:captured-data	0
structure:repo-health	0
security:code-auditor	0

Reviewer Coverage

Complete coverage details are retained in the local coverage.json artifact.

• automation:ci-release — complete (broad); scope: 1 file; examples: go.mod; body-inspected: 1 file; examples: go.mod; skipped: none; constraints: Did not run build, lint, or tests; reviewed the go.mod and go.sum diff only. Did not verify the cli-common v0.5.1 checksums against the Go checksum database.
• documentation:docs — complete (broad); scope: 1 file; examples: README.md; body-inspected: 1 file; examples: README.md; skipped: none; constraints: Claims about cli-common v0.5.1 behavior (system security tool, 60s timeout) were taken from the PR description and not verified against the dependency source.
• go:implementation-tests — complete (broad); scope: 1 file; examples: go.mod; body-inspected: 1 file; examples: go.mod; skipped: none; constraints: Did not inspect the cli-common v0.5.1 module source; behavior claims rely on the PR description. Review limited to the go.mod and go.sum diff; did not build or run tests.
• policies:conventions — complete (broad); scope: 2 files; examples: README.md, go.mod; body-inspected: 2 files; examples: README.md, go.mod; skipped: none; constraints: Shared cli-common docs were not available in context; review limited to the visible diff and repo files. go.sum was checked only as context to confirm it carries the v0.5.1 entries.
• privacy:captured-data — complete (constrained); scope: 2 files; examples: README.md, go.mod; body-inspected: 2 files; examples: README.md, go.mod; skipped: none; constraints: none
• structure:repo-health — complete (broad); scope: 1 file; examples: go.mod; body-inspected: 1 file; examples: go.mod; skipped: none; constraints: Reviewed only the go.mod/go.sum diff; did not inspect cli-common v0.5.1 source or run builds/tests. The Keychain behavior change (reads via ) is not verified here; PR states the Always Allow path was not exercised.
• security:code-auditor — complete (broad); scope: 2 files; examples: README.md, go.mod; body-inspected: 2 files; examples: README.md, go.mod; skipped: none; constraints: Did not inspect the cli-common v0.5.1 source; the review covers only the dependency pin, go.sum hashes and README text in this PR. The go.sum h1 hash for cli-common v0.5.1 was not checked against the Go checksum database.

0 PR discussion threads considered. 0 summarized; 0 resolved.

---

Completed in 1m 09s | $0.50 | claude-sonnet-5-5 | cr 0.10.363

Field	Value
Model	claude-sonnet-5-5
Reviewers	automation:ci-release, documentation:docs, go:implementation-tests, policies:conventions, privacy:captured-data, structure:repo-health, security:code-auditor
Engine	claude_cli · claude-sonnet-5-5
Reviewed by	cr · piekstra-dev
Duration	1m 09s wall · 2m 45s compute
Cost	$0.50
Tokens	72 in / 8.4k out

Per-workstream usage

• orchestrator-selection — claude-sonnet-5-5
  • In: 6
  • Out: 1.0k
  • Cache read: 20.1k
  • Cache create: 12.0k
  • Cost: $0.06
  • Duration: 14s
• automation:ci-release — claude-sonnet-5-5
  • In: 8
  • Out: 1.1k
  • Cache read: 33.4k
  • Cache create: 9.2k
  • Cost: $0.05
  • Duration: 22s
• documentation:docs — claude-sonnet-5-5
  • In: 10
  • Out: 1.2k
  • Cache read: 46.1k
  • Cache create: 9.2k
  • Cost: $0.05
  • Duration: 17s
• go:implementation-tests — claude-sonnet-5-5
  • In: 8
  • Out: 943
  • Cache read: 34.0k
  • Cache create: 9.4k
  • Cost: $0.05
  • Duration: 17s
• policies:conventions — claude-sonnet-5-5
  • In: 10
  • Out: 1.1k
  • Cache read: 43.3k
  • Cache create: 8.2k
  • Cost: $0.05
  • Duration: 14s
• privacy:captured-data — claude-sonnet-5-5
  • In: 8
  • Out: 883
  • Cache read: 37.1k
  • Cache create: 10.8k
  • Cost: $0.06
  • Duration: 21s
• structure:repo-health — claude-sonnet-5-5
  • In: 8
  • Out: 979
  • Cache read: 33.1k
  • Cache create: 9.0k
  • Cost: $0.05
  • Duration: 37s
• security:code-auditor — claude-sonnet-5-5
  • In: 8
  • Out: 922
  • Cache read: 35.0k
  • Cache create: 10.1k
  • Cost: $0.05
  • Duration: 12s
• orchestrator-rollup — claude-sonnet-5-5
  • In: 6
  • Out: 339
  • Cache read: 46.9k
  • Cache create: 2.8k
  • Cost: $0.08
  • Duration: 6s