refactor: move keyring to koharu-runtime

Cargo.lock

@@ -4610,14 +4610,12 @@ dependencies = [
  "anyhow",
  "bindgen",
  "clap",
- "dirs",
  "encoding_rs",
  "enumflags2",
  "flate2",
  "futures",
  "hf-hub",
  "image",
- "keyring",
  "koharu-runtime",
  "libloading 0.8.9",
  "minijinja",
@@ -4632,7 +4630,6 @@ dependencies = [
  "strum",
  "syn 2.0.117",
  "tar",
- "tempfile",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -4746,6 +4743,7 @@ name = "koharu-runtime"
 version = "0.47.8"
 dependencies = [
  "anyhow",
+ "atomicwrites",
  "camino",
  "dirs",
  "flate2",
@@ -4754,6 +4752,7 @@ dependencies = [
  "indexmap 2.14.0",
  "indicatif",
  "inventory",
+ "keyring",
  "koharu-core",
  "libloading 0.8.9",
  "num_cpus",

koharu-app/src/config.rs

@@ -2,8 +2,7 @@ use std::fs;
 
 use anyhow::{Context, Result};
 use camino::Utf8PathBuf;
-use koharu_llm::providers::{get_saved_api_key, set_saved_api_key};
-use koharu_runtime::default_app_data_root;
+use koharu_runtime::{SecretStore, default_app_data_root};
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
 use utoipa::ToSchema;
 
@@ -11,6 +10,8 @@ use crate::pipeline::{Artifact, Registry};
 
 const CONFIG_FILE: &str = "config.toml";
 const REDACTED: &str = "[REDACTED]";
+const SECRET_SERVICE: &str = "koharu";
+const PROVIDER_API_KEY_SECRET_PREFIX: &str = "llm_provider_api_key_";
 
 // ---------------------------------------------------------------------------
 // RedactedSecret
@@ -163,8 +164,9 @@ pub fn load() -> Result<AppConfig> {
     }
 
     // Populate api_key from credential storage for every known provider.
+    let secrets = SecretStore::new(SECRET_SERVICE);
     for provider in &mut config.providers {
-        if let Ok(Some(key)) = get_saved_api_key(&provider.id)
+        if let Ok(Some(key)) = secrets.get(&provider_api_key_secret_key(&provider.id))
             && !key.trim().is_empty()
         {
             provider.api_key = Some(RedactedSecret::new(key));
@@ -355,13 +357,19 @@ fn validate_engine_name(
 /// - `None` → clear from credential storage
 /// - `Some(RedactedSecret)` with value == "[REDACTED]" → unchanged
 pub fn sync_secrets(config: &AppConfig) -> Result<()> {
+    let secrets = SecretStore::new(SECRET_SERVICE);
     for provider in &config.providers {
         match &provider.api_key {
             Some(secret) if secret.expose() != REDACTED => {
-                set_saved_api_key(&provider.id, secret.expose())?;
+                let key = provider_api_key_secret_key(&provider.id);
+                if secret.expose().trim().is_empty() {
+                    secrets.delete(&key)?;
+                } else {
+                    secrets.set(&key, secret.expose())?;
+                }
             }
             None => {
-                set_saved_api_key(&provider.id, "")?;
+                secrets.delete(&provider_api_key_secret_key(&provider.id))?;
             }
             _ => {} // "[REDACTED]" means unchanged
         }
@@ -369,6 +377,10 @@ pub fn sync_secrets(config: &AppConfig) -> Result<()> {
     Ok(())
 }
 
+fn provider_api_key_secret_key(provider_id: &str) -> String {
+    format!("{PROVIDER_API_KEY_SECRET_PREFIX}{provider_id}")
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -413,6 +425,14 @@ mod tests {
         assert!(path.as_str().contains("Koharu"));
     }
 
+    #[test]
+    fn provider_api_key_secret_key_preserves_legacy_keyring_user() {
+        assert_eq!(
+            provider_api_key_secret_key("openai"),
+            "llm_provider_api_key_openai"
+        );
+    }
+
     #[test]
     fn invalid_pipeline_engines_reset_to_defaults() {
         let mut config = AppConfig::default();

koharu-llm/Cargo.toml

@@ -29,7 +29,6 @@ path = "bin/paddleocr-vl.rs"
 [dependencies]
 anyhow = { workspace = true }
 clap = { workspace = true, features = ["derive"] }
-dirs = { workspace = true }
 flate2 = { workspace = true }
 futures = { workspace = true }
 hf-hub = { workspace = true }
@@ -54,13 +53,6 @@ tracing-core = "0.1"
 zip = { workspace = true }
 encoding_rs = "0.8"
 enumflags2 = "0.7.12"
-keyring = { workspace = true }
-
-[target.'cfg(windows)'.dependencies]
-keyring = { workspace = true, features = ["windows-native"] }
-
-[target.'cfg(target_os = "macos")'.dependencies]
-keyring = { workspace = true, features = ["apple-native"] }
 
 [build-dependencies]
 anyhow = { workspace = true }
@@ -71,6 +63,3 @@ quote = "1.0"
 reqwest = { workspace = true }
 syn = { version = "2.0", features = ["full"] }
 tar = "0.4"
-
-[dev-dependencies]
-tempfile = { workspace = true }

koharu-llm/src/providers/mod.rs

@@ -19,7 +19,6 @@ pub(crate) fn resolve_system_prompt(custom: Option<&str>, target_language: Langu
 pub mod caiyun;
 mod chat_completions;
 pub mod claude;
-mod credentials;
 pub mod deepl;
 pub mod deepseek;
 pub mod gemini;
@@ -27,8 +26,6 @@ pub mod google_translate;
 pub mod openai;
 pub mod openai_compatible;
 
-pub use credentials::{get_saved_api_key, set_saved_api_key};
-
 #[derive(Debug, Clone, Copy)]
 pub struct ProviderModelDescriptor {
     pub id: &'static str,

koharu-runtime/Cargo.toml

@@ -13,6 +13,7 @@ publish.workspace = true
 
 [dependencies]
 anyhow = { workspace = true }
+atomicwrites = { workspace = true }
 camino = { workspace = true }
 koharu-core = { workspace = true }
 dirs = { workspace = true }
@@ -21,6 +22,7 @@ hf-hub = { workspace = true }
 indexmap = { workspace = true }
 indicatif = { workspace = true }
 inventory = { workspace = true }
+keyring = { workspace = true }
 reqwest = { workspace = true }
 reqwest-middleware = { workspace = true }
 reqwest-retry = { workspace = true }
@@ -38,5 +40,11 @@ tar = "0.4"
 [target.'cfg(target_os = "windows")'.dependencies]
 windows-sys = { workspace = true }
 
+[target.'cfg(windows)'.dependencies]
+keyring = { workspace = true, features = ["windows-native"] }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+keyring = { workspace = true, features = ["apple-native"] }
+
 [dev-dependencies]
 tempfile = { workspace = true }

koharu-runtime/src/lib.rs

@@ -6,6 +6,7 @@ mod llama;
 mod loader;
 pub mod packages;
 mod runtime;
+mod secrets;
 mod zluda;
 
 pub use cuda::{
@@ -19,3 +20,4 @@ pub use packages::{PackageCatalog as Catalog, PackageFuture, PackageKind, Packag
 pub use runtime::{
     ComputePolicy, Runtime, RuntimeHttpConfig, RuntimeManager, default_app_data_root,
 };
+pub use secrets::{SecretStore, delete_secret, get_secret, set_secret};

koharu-llm/src/providers/credentials.rs → koharu-runtime/src/secrets.rs

@@ -2,12 +2,39 @@ use std::sync::Once;
 
 use keyring::Entry;
 
-const API_KEY_SERVICE: &str = "koharu";
-
 static INIT_CREDENTIAL_STORE: Once = Once::new();
 
-pub fn get_saved_api_key(provider: &str) -> anyhow::Result<Option<String>> {
-    let entry = provider_entry(provider)?;
+/// Service-scoped access to Koharu's platform-backed string secret storage.
+#[derive(Debug, Clone)]
+pub struct SecretStore {
+    service: String,
+}
+
+impl SecretStore {
+    pub fn new(service: impl Into<String>) -> Self {
+        Self {
+            service: service.into(),
+        }
+    }
+
+    /// Load a secret by key, returning `None` when no credential exists.
+    pub fn get(&self, key: &str) -> anyhow::Result<Option<String>> {
+        get_secret(&self.service, key)
+    }
+
+    /// Store a secret by key. Use `delete` to clear an existing credential.
+    pub fn set(&self, key: &str, secret: &str) -> anyhow::Result<()> {
+        set_secret(&self.service, key, secret)
+    }
+
+    /// Clear a secret by key. Missing credentials are treated as success.
+    pub fn delete(&self, key: &str) -> anyhow::Result<()> {
+        delete_secret(&self.service, key)
+    }
+}
+
+pub fn get_secret(service: &str, key: &str) -> anyhow::Result<Option<String>> {
+    let entry = secret_entry(service, key)?;
     match entry.get_password() {
         Ok(value) => Ok(Some(value)),
         Err(keyring::Error::NoEntry) => Ok(None),
@@ -15,29 +42,26 @@ pub fn get_saved_api_key(provider: &str) -> anyhow::Result<Option<String>> {
     }
 }
 
-pub fn set_saved_api_key(provider: &str, api_key: &str) -> anyhow::Result<()> {
-    let entry = provider_entry(provider)?;
-    if api_key.trim().is_empty() {
-        return match entry.delete_credential() {
-            Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
-            Err(err) => Err(err.into()),
-        };
-    }
-
-    entry.set_password(api_key)?;
+pub fn set_secret(service: &str, key: &str, secret: &str) -> anyhow::Result<()> {
+    secret_entry(service, key)?.set_password(secret)?;
     Ok(())
 }
 
-fn provider_entry(provider: &str) -> anyhow::Result<Entry> {
-    INIT_CREDENTIAL_STORE.call_once(configure_platform_store);
+pub fn delete_secret(service: &str, key: &str) -> anyhow::Result<()> {
+    match secret_entry(service, key)?.delete_credential() {
+        Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
+        Err(err) => Err(err.into()),
+    }
+}
 
-    let username = format!("llm_provider_api_key_{provider}");
-    Ok(Entry::new(API_KEY_SERVICE, &username)?)
+fn secret_entry(service: &str, key: &str) -> anyhow::Result<Entry> {
+    INIT_CREDENTIAL_STORE.call_once(configure_platform_store);
+    Ok(Entry::new(service, key)?)
 }
 
 #[cfg(target_os = "linux")]
 fn configure_platform_store() {
-    let root = koharu_runtime::default_app_data_root()
+    let root = crate::runtime::default_app_data_root()
         .as_std_path()
         .join("secrets")
         .join("keyring");
@@ -51,14 +75,14 @@ fn configure_platform_store() {}
 mod filesystem {
     use std::fmt::Write as _;
     use std::fs;
+    use std::io;
+    use std::io::Write as _;
     use std::path::{Path, PathBuf};
-    use std::sync::atomic::{AtomicU64, Ordering};
 
+    use atomicwrites::{AtomicFile, OverwriteBehavior};
     use keyring::credential::{Credential, CredentialApi, CredentialBuilderApi};
     use keyring::{Error, Result};
 
-    static TEMP_ID: AtomicU64 = AtomicU64::new(0);
-
     #[derive(Debug)]
     pub(super) struct Builder {
         root: PathBuf,
@@ -98,15 +122,6 @@ mod filesystem {
         fn path(&self) -> PathBuf {
             self.root.join(&self.name)
         }
-
-        fn temp_path(&self) -> PathBuf {
-            self.root.join(format!(
-                "{}.tmp-{}-{}",
-                self.name,
-                std::process::id(),
-                TEMP_ID.fetch_add(1, Ordering::Relaxed)
-            ))
-        }
     }
 
     impl CredentialApi for FileCredential {
@@ -115,14 +130,12 @@ mod filesystem {
             set_mode(&self.root, 0o700)?;
 
             let path = self.path();
-            let temp_path = self.temp_path();
-            fs::write(&temp_path, secret).map_err(storage_error)?;
-            set_mode(&temp_path, 0o600)?;
-
-            fs::rename(&temp_path, &path).map_err(|err| {
-                let _ = fs::remove_file(&temp_path);
-                storage_error(err)
-            })?;
+            AtomicFile::new(&path, OverwriteBehavior::AllowOverwrite)
+                .write(|file| -> io::Result<()> {
+                    set_file_mode(file, 0o600)?;
+                    file.write_all(secret)
+                })
+                .map_err(atomic_write_error)?;
             set_mode(&path, 0o600)
         }
 
@@ -157,6 +170,26 @@ mod filesystem {
         Ok(())
     }
 
+    #[cfg(unix)]
+    fn set_file_mode(file: &fs::File, mode: u32) -> io::Result<()> {
+        use std::os::unix::fs::PermissionsExt;
+
+        file.set_permissions(fs::Permissions::from_mode(mode))
+    }
+
+    #[cfg(not(unix))]
+    fn set_file_mode(_file: &fs::File, _mode: u32) -> io::Result<()> {
+        Ok(())
+    }
+
+    fn atomic_write_error(err: atomicwrites::Error<io::Error>) -> Error {
+        match err {
+            atomicwrites::Error::Internal(err) | atomicwrites::Error::User(err) => {
+                storage_error(err)
+            }
+        }
+    }
+
     fn storage_error(err: std::io::Error) -> Error {
         Error::NoStorageAccess(Box::new(err))
     }