fix(credentials): reduce duplicate keychain prompts

Author: scari

AgentBar/Services/CopilotUsageProvider.swift

@@ -58,7 +58,13 @@ final class CopilotUsageProvider: UsageProviderProtocol, @unchecked Sendable {
         } else {
             self.primaryCredentialProvider = { Self.readGHCLIToken() }
             self.fallbackCredentialProvider = fallbackCredentialProvider ?? {
-                KeychainManager.load(account: ServiceType.copilot.keychainAccount)
+                guard UserDefaults.standard.bool(
+                    forKey: CopilotCredentialSettings.manualPATEnabledKey,
+                    defaultValue: false
+                ) else {
+                    return nil
+                }
+                return KeychainManager.load(account: ServiceType.copilot.keychainAccount)
             }
         }
     }

AgentBar/Services/ZaiUsageProvider.swift

@@ -28,6 +28,8 @@ final class ZaiUsageProvider: UsageProviderProtocol, @unchecked Sendable {
 
     private let apiClient: APIClient
     private let credentialProvider: @Sendable () -> String?
+    private let credentialLock = NSLock()
+    nonisolated(unsafe) private var cachedCredential: String??
 
     /// Minimum cache TTL to avoid excessive API requests (Z.ai is API-based).
     static let minCacheTTL: TimeInterval = 60
@@ -43,10 +45,11 @@ final class ZaiUsageProvider: UsageProviderProtocol, @unchecked Sendable {
         self.credentialProvider = credentialProvider ?? {
             KeychainManager.load(account: ServiceType.zai.keychainAccount)
         }
+        self.cachedCredential = nil
     }
 
     func isConfigured() async -> Bool {
-        credentialProvider() != nil
+        resolveCredential() != nil
     }
 
     /// Returns cached response if within minimum TTL, nil otherwise.
@@ -74,7 +77,7 @@ final class ZaiUsageProvider: UsageProviderProtocol, @unchecked Sendable {
             return cached
         }
 
-        guard let apiKey = credentialProvider() else {
+        guard let apiKey = resolveCredential() else {
             throw APIError.unauthorized
         }
 
@@ -163,4 +166,17 @@ final class ZaiUsageProvider: UsageProviderProtocol, @unchecked Sendable {
         }
     }
 
+    private func resolveCredential() -> String? {
+        credentialLock.lock()
+        if let cachedCredential {
+            credentialLock.unlock()
+            return cachedCredential
+        }
+
+        let loadedCredential = credentialProvider()
+        cachedCredential = loadedCredential
+        credentialLock.unlock()
+        return loadedCredential
+    }
+
 }

AgentBar/Utilities/UserDefaultsExtensions.swift

@@ -19,6 +19,11 @@ enum BuyMeACoffeeSettings {
     static let hideButtonKey = "hideBuyMeACoffeeButton"
 }
 
+enum CopilotCredentialSettings {
+    /// Enables Keychain fallback for Copilot when gh CLI token is unavailable.
+    static let manualPATEnabledKey = "copilotManualPATEnabled"
+}
+
 extension UserDefaults {
     func bool(forKey key: String, defaultValue: Bool) -> Bool {
         guard object(forKey: key) != nil else { return defaultValue }

AgentBar/Views/Settings/SettingsView.swift

@@ -34,6 +34,7 @@ struct SettingsView: View {
     @AppStorage("geminiDailyLimit") private var geminiDailyLimit: Double = 1_000
 
     @AppStorage("copilotEnabled") private var copilotEnabled = true
+    @AppStorage(CopilotCredentialSettings.manualPATEnabledKey) private var copilotManualPATEnabled = false
 
     @AppStorage("cursorEnabled") private var cursorEnabled = true
     @AppStorage("cursorPlan") private var cursorPlan: String = CursorPlan.pro.rawValue
@@ -587,6 +588,9 @@ struct SettingsView: View {
             hasSavedToken: hasSavedCopilotPAT
         )
         hasSavedCopilotPAT = outcome.hasSavedToken
+        if outcome.didSave {
+            copilotManualPATEnabled = true
+        }
         copilotPAT = outcome.tokenFieldValue
         return outcome.didSave
     }
@@ -649,7 +653,11 @@ struct SettingsView: View {
     }
 
     private func loadAPIKeys() {
-        hasSavedCopilotPAT = KeychainManager.load(account: ServiceType.copilot.keychainAccount) != nil
+        if copilotManualPATEnabled {
+            hasSavedCopilotPAT = KeychainManager.load(account: ServiceType.copilot.keychainAccount) != nil
+        } else {
+            hasSavedCopilotPAT = false
+        }
         hasSavedZaiAPIKey = KeychainManager.load(account: ServiceType.zai.keychainAccount) != nil
         copilotPAT = ""
         zaiAPIKey = ""