{"record":{"id":"c723306aa72fd522","repo":"zed-industries/zed","slug":"reading-password-failed-status","errorCode":null,"errorMessage":"reading password failed: {status}","messagePattern":"reading password failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/gpui_macos/src/platform.rs","lineNumber":1237,"sourceCode":"\n    fn read_credentials(&self, url: &str) -> Task<Result<Option<(String, Vec<u8>)>>> {\n        let url = url.to_string();\n        self.background_executor().spawn(async move {\n            let url = CFString::from(url.as_str());\n            let cf_true = CFBoolean::true_value().as_CFTypeRef();\n\n            unsafe {\n                use security::*;\n\n                // Find any credentials for the given server URL.\n                let mut attrs = CFMutableDictionary::with_capacity(5);\n                attrs.set(kSecClass as *const _, kSecClassInternetPassword as *const _);\n                attrs.set(kSecAttrServer as *const _, url.as_CFTypeRef());\n                attrs.set(kSecReturnAttributes as *const _, cf_true);\n                attrs.set(kSecReturnData as *const _, cf_true);\n\n                let mut result = CFTypeRef::from(ptr::null());\n                let status = SecItemCopyMatching(attrs.as_concrete_TypeRef(), &mut result);\n                match status {\n                    security::errSecSuccess => {}\n                    security::errSecItemNotFound | security::errSecUserCanceled => return Ok(None),\n                    _ => anyhow::bail!(\"reading password failed: {status}\"),\n                }\n\n                let result = CFType::wrap_under_create_rule(result)\n                    .downcast::<CFDictionary>()\n                    .context(\"keychain item was not a dictionary\")?;\n                let username = result\n                    .find(kSecAttrAccount as *const _)\n                    .context(\"account was missing from keychain item\")?;\n                let username = CFType::wrap_under_get_rule(*username)\n                    .downcast::<CFString>()\n                    .context(\"account was not a string\")?;\n                let password = result\n                    .find(kSecValueData as *const _)\n                    .context(\"password was missing from keychain item\")?;","sourceCodeStart":1219,"sourceCodeEnd":1255,"githubUrl":"https://github.com/zed-industries/zed/blob/9d272b036335401f339d024ea94968fd51016c40/crates/gpui_macos/src/platform.rs#L1219-L1255","documentation":"On macOS, reading a stored password queries the keychain via SecItemCopyMatching for internet passwords matching the server URL. Success (errSecSuccess), errSecItemNotFound and errSecUserCanceled are handled specially; every other OSStatus takes this bail with the raw code. Frequent codes: -25293 errSecAuthFailed, -25291 errSecNotAvailable, -25308 errSecInteractionNotAllowed, -34018 errSecMissingEntitlement.","triggerScenarios":"Keychain locked or access to the item denied (auth failed); missing keychain-access entitlement in a sandboxed or unsigned build; no keychain available (SSH/CI session without a user login); item access requiring UI interaction in a context that forbids it.","commonSituations":"Dev builds run without proper code signing or entitlements; hardened runtime blocking keychain access; corrupted keychain or changed item ACLs after re-signing; credentials code first tested only via cargo run.","solutions":["Look up the numeric status in OSStatus tables to identify the failure class (-34018 entitlement, -25293 auth, -25308 interaction, -25291 unavailable)","If -34018 or -25293: verify code signing and keychain-access entitlements on the build","If -25308 or a locked keychain: perform the read while a UI session exists or prompt the user to unlock","Degrade gracefully: catch the error and prompt the user to re-enter credentials, then re-store them"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match keychain.read_password(&url).await {\n    Ok(Some(cred)) => use_credentials(cred),\n    Ok(None) => prompt_for_credentials().await,\n    Err(err) => {\n        // auth failed / missing entitlement / unavailable: never crash on keychain state\n        log::warn!(\"keychain read failed: {err}\");\n        prompt_for_credentials().await\n    }\n}","preventionTips":["Never assume keychain reads succeed; always offer an interactive fallback","Map known OSStatus codes to actionable user messages","Test credential flows in signed builds with correct entitlements, not only via cargo run"],"tags":["macos","keychain","credentials","security","osstatus"],"backgroundTag":"macos-keychain-error","analyzedSha":"9d272b036335401f339d024ea94968fd51016c40","analyzedAt":"2026-08-20T19:29:52.058Z","contentChangedAt":"2026-08-20T19:29:52.058Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}