On macOS, pass-cli stores its local session key ("ProtonPassCLI") in the legacy file-based login keychain. Every pass-cli call that needs the key shows two separate password dialogs ("wants to access key" and "wants to use your confidential information"), and both need the full login password.

The item's access rules are pinned to the binary's exact build hash (cdhash). The Homebrew build is ad-hoc signed, so every update changes the hash and brings both prompts back. Clicking "Always Allow" is the only way to avoid them, and it removes the per-use check completely.

Request: on macOS, store the session key in the data protection keychain with a biometric access control (.biometryCurrentSet or .userPresence). That way pass-cli is unlocked with Touch ID, falling back to the device password. Apple requires a Developer-ID-signed build with a keychain-access-groups entitlement and an embedded provisioning profile for this, for example by shipping pass-cli inside a minimal app bundle (Apple TN3137, "On Mac keychains").

Why it matters: pass-cli is increasingly called by scripts and AI coding agents. Sometimes I want to give them a way to create/update proton pass item, but only with my explicit review and permission. A quick fingerprint per access, gives real human approval without typing the full login password many times a day. The desktop app and browser extensions already support Touch ID; the CLI is the gap.