Stabilize desktop identity and quiet passive keychain reads

.github/workflows/release.yml

@@ -96,11 +96,6 @@ jobs:
       - name: Install frontend dependencies
         run: npm ci --legacy-peer-deps
 
-      - name: Patch macOS Bundle ID
-        if: matrix.platform == 'macos-latest'
-        run: |
-          node -e 'const fs=require("fs"); let c=JSON.parse(fs.readFileSync("src-tauri/tauri.conf.json")); c.identifier="com.zync.desktop"; fs.writeFileSync("src-tauri/tauri.conf.json", JSON.stringify(c, null, 2));'
-
       - name: Build the app
         uses: tauri-apps/tauri-action@v0
         env:

CHANGELOG.md

@@ -4,7 +4,13 @@ All notable changes to Zync are documented in this file. The format is based on
 
 ## [Unreleased]
 
+### Changed
+- **Canonical desktop app identity**: Standardized the Tauri bundle identifier to `in.thesudoer.zync` across platforms and added copy-only first-launch migration from legacy default app data/config directories (`zync`, `com.zync.desktop`) while preserving custom `dataPath` locations.
+
 ### Fixed
+- **macOS Keychain prompt reduction**: Avoided passive status reads of OS credential-store secrets for Vault remember-device state, sync collection cache state, and Google sync status so macOS prompts are limited to real secret use instead of routine refreshes.
+- **Sync collection key recovery states**: Preserved first-time setup with provider-selected collection IDs while keeping remote relink failures explicit when no recoverable key wrap exists.
+- **Legacy Google token migration**: Preserved migration of plaintext refresh tokens into the OS credential store even when only metadata/status is read.
 - **Command palette theme switching**: Preserved active plugin worker requester across quick-pick dispatches and fallback resolution, restoring `Preferences: Color Theme` selection from the command palette. ([e3f1732])
 - **Default Dark theme in theme picker**: Added `builtin_dark` plugin registration and included `'dark'` in trusted built-in theme choices so `Dark (Default)` is available in the theme selection list and Appearance settings. ([e3f1732])
 - **Quick-pick lifecycle & abandonment cleanup**: Extracted `cancelActiveQuickPick` helper in `CommandPalette.tsx` to dispatch cancellation on `Escape`, backdrop close, mode switches, and before request replacement, preventing dangling worker promises. ([e3f1732])

docs/SETTINGS_SYSTEM.md

@@ -79,6 +79,8 @@ No local override file should be assumed active unless explicitly implemented in
 
 If canonical native settings are missing, backend performs one-time migration from legacy candidates (for example old app-data path or `~/.zync/settings.json`).
 
+The canonical Tauri bundle identifier is `in.thesudoer.zync`. On first launch after this identity change, backend performs a copy-only migration from legacy default app data/config directories for `zync` and `com.zync.desktop` when the new default directory is empty. User-configured `dataPath` values are respected and are not moved automatically.
+
 ## Key Files
 
 ### Frontend

src-tauri/src/commands.rs

@@ -145,10 +145,17 @@ fn get_legacy_settings_candidates(app: &AppHandle) -> Vec<std::path::PathBuf> {
     if let Ok(app_data_dir) = app.path().app_data_dir() {
         candidates.push(app_data_dir.join("settings.json"));
     }
+    candidates.extend(
+        crate::identity_migration::legacy_app_data_dir_candidates(
+            app.path().app_data_dir().ok().as_deref(),
+        )
+        .into_iter()
+        .map(|path| path.join("settings.json")),
+    );
     if let Ok(home_dir) = app.path().home_dir() {
         candidates.push(home_dir.join(".zync").join("settings.json"));
     }
-    candidates
+    crate::identity_migration::dedupe_paths(candidates)
 }
 
 /// Write file content atomically via temporary file + rename.
@@ -501,6 +508,12 @@ pub fn get_data_dir(app: &AppHandle) -> std::path::PathBuf {
         .unwrap_or_else(|_| std::path::PathBuf::from("."));
     let merged_settings =
         read_effective_settings(app).unwrap_or_else(|_| Value::Object(serde_json::Map::new()));
+    let has_custom_data_path = merged_settings
+        .get("dataPath")
+        .and_then(|v| v.as_str())
+        .is_some_and(|value| !value.trim().is_empty());
+
+    crate::identity_migration::migrate_default_dirs(app, &default_dir, has_custom_data_path);
 
     let (resolved, cache_result) =
         if let Some(data_path) = merged_settings.get("dataPath").and_then(|v| v.as_str()) {