fix: API key keychain security + voice command injection + dead code cleanup #4734 — ccantynz/voxlen

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/voxlen/pull/67

Summary

Three independent improvements since the last merge:

1. API key keychain security hardening (src/lib/keyring.ts, src/stores/settings.ts)

setSecret() was falling back to localStorage unconditionally — if the OS keychain failed inside the real Tauri app (locked wallet, missing libsecret on Linux), API keys silently landed in plaintext storage
Fixed: isTauri() gate — localStorage fallback only applies in browser/dev mode where the Tauri IPC bridge is absent
In the production app, keychain failures now re-throw, and schedulePersist catches them and shows a user-visible toast

2. Voice command + clause injection (src/hooks/useTauriEvents.ts)

Saying "period", "new paragraph", "em dash", etc. was updating the Voxlen panel but never typing into the active app
Clause library triggers ("insert indemnity clause") were adding text to the panel but not injecting
Combined utterances ("hello period") — the "hello" part was never injected
All three paths now route through inject_text

3. Dead code removal (src/stores/settings.ts, src/hooks/usePersistedSettings.ts)

isLoaded was declared in SettingsState but never set to true or read anywhere
saveSettings() was the old plain-JSON API-key saver, already removed from App.tsx — orphaned export cleaned up

179 tests pass (npm test -- --run)
TypeScript clean (npx tsc --noEmit)
Saying "period" mid-dictation injects . into the focused app
Saying "insert indemnity clause" injects full clause text into Word
API key saves correctly to OS keychain; no _kr_* keys appear in browser localStorage in production

🤖 Generated with Claude Code

Generated by Claude Code