WIP new setup page

This reverts commit 9b02afb20c.

.github/templates/release.md

@@ -1,16 +0,0 @@
-Update description
-
-## Features
-
-
-## Fixes
-
-
-## Minimum macOS Version
-
-
-## Build
-https://github.com/maxgoedjen/secretive/actions/runs/RUN_ID
-
-## Attestation
-https://github.com/maxgoedjen/secretive/attestations/ATTESTATION_ID

.github/workflows/add-to-project.yml

@@ -0,0 +1,16 @@
+name: Add bugs to bugs project
+
+on:
+  issues:
+    types:
+      - opened
+
+jobs:
+  add-to-project:
+    name: Add issue to project
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/add-to-project@v1.0.1
+        with:
+          project-url: https://github.com/users/maxgoedjen/projects/1
+          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/nightly.yml

@@ -3,19 +3,13 @@ name: Nightly
 on: 
   schedule: 
     - cron: "0 8 * * *"
-  workflow_dispatch:
-  
 jobs:
   build:
 #     runs-on: macOS-latest
     runs-on: macos-15
-    permissions:
-      id-token: write
-      contents: write
-      attestations: write
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v4
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -26,7 +20,7 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta.app
     - name: Update Build Number
       env:
         RUN_ID: ${{ github.run_id }}
@@ -36,23 +30,25 @@ jobs:
             sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Secretive/Credits.rtf
     - name: Build
       run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Create ZIP
+    - name: Create ZIPs
       run: |
             ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
+            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Archive.zip
     - name: Notarize
       env: 
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
         APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
       run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
+    - name: Document SHAs
+      run: |
+            echo "sha-512:"
+            shasum -a 512 Secretive.zip
+            shasum -a 512 Archive.zip
+            echo "sha-256:"
+            shasum -a 256 Secretive.zip
+            shasum -a 256 Archive.zip
     - name: Upload App to Artifacts
-      id: upload
       uses: actions/upload-artifact@v4
       with:
         name: Secretive.zip
         path: Secretive.zip
-    - name: Attest
-      id: attest
-      uses: actions/attest-build-provenance@v2
-      with:
-        subject-name: "Secretive.zip"
-        subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}

.github/workflows/release.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: macos-15
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v4
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -21,19 +21,18 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta.app
     - name: Test
-      run: swift test --build-system swiftbuild --package-path Sources/Packages
+      run: |
+            pushd Sources/Packages
+            swift test
+            popd
   build:
 #     runs-on: macOS-latest
     runs-on: macos-15
-    permissions:
-      id-token: write
-      contents: write
-      attestations: write
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v4
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -44,7 +43,7 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta.app
     - name: Update Build Number
       env:
         TAG_NAME: ${{ github.ref }}
@@ -56,34 +55,64 @@ jobs:
             sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Secretive/Credits.rtf
     - name: Build
       run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Create ZIP
+    - name: Create ZIPs
       run: |
             ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
+            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Archive.zip
     - name: Notarize
       env: 
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
         APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
       run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
+    - name: Document SHAs
+      run: |
+            echo "sha-512:"
+            shasum -a 512 Secretive.zip
+            shasum -a 512 Archive.zip
+            echo "sha-256:"
+            shasum -a 256 Secretive.zip
+            shasum -a 256 Archive.zip
+    - name: Create Release
+      id: create_release
+      uses: actions/create-release@v1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        tag_name: ${{ github.ref }}
+        release_name: ${{ github.ref }}
+        body: |
+          Update description
+
+          ## Features
+
+
+          ## Fixes
+
+
+          ## Minimum macOS Version
+
+
+          ## Build
+          https://github.com/maxgoedjen/secretive/actions/runs/${{ github.run_id }}
+        draft: true
+        prerelease: false
+    - name: Upload App to Release
+      id: upload-release-asset-app
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.create_release.outputs.upload_url }}
+        asset_path: ./Secretive.zip
+        asset_name: Secretive.zip
+        asset_content_type: application/zip
     - name: Upload App to Artifacts
-      id: upload
       uses: actions/upload-artifact@v4
       with:
         name: Secretive.zip
         path: Secretive.zip
-    - name: Attest
-      id: attest
-      uses: actions/attest-build-provenance@v2
+    - name: Upload Archive to Artifacts
+      uses: actions/upload-artifact@v4
       with:
-        subject-name: "Secretive.zip"
-        subject-digest: ${{ steps.upload.outputs.artifact-digest }}
-    - name: Create Release
-      run: |
-            sed -i.tmp "s/RUN_ID/$RUN_ID/g" .github/templates/release.md
-            sed -i.tmp "s/ATTESTATION_ID/$ATTESTATION_ID/g" .github/templates/release.md
-            gh release create $TAG_NAME -d -F .github/templates/release.md
-            gh release upload Secretive.zip
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        TAG_NAME: ${{ github.ref }}
-        RUN_ID: ${{ github.run_id }}
-        ATTESTATION_ID: ${{ steps.attest.outputs.attestation-id }}
+        name: Xcode_Archive.zip
+        path: Archive.zip

.github/workflows/test.yml

@@ -7,10 +7,11 @@ jobs:
     runs-on: macos-15
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v4
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
-    - name: Test Main Packages
-      run: swift test --build-system swiftbuild --package-path Sources/Packages
-    - name: Test SecretKit Packages
-      run: swift test --build-system swiftbuild
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta.app
+    - name: Test
+      run: |
+            pushd Sources/Packages
+            swift test
+            popd

APP_CONFIG.md

@@ -1,3 +1,116 @@
-# App Configuration
+# Setting up Third Party Apps FAQ
 
-Instructions for setting up apps and shells has moved to [secretive-config-instructions](https://github.com/maxgoedjen/secretive-config-instructions)!
+## Tower
+
+Tower provides [instructions](https://www.git-tower.com/help/mac/integration/environment).
+
+## GitHub Desktop
+
+Should just work, no configuration needed
+
+## Fork
+
+Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
+
+```
+Host *
+	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
+```
+
+## VS Code
+
+Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
+
+```
+Host *
+	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
+```
+
+## nushell
+
+Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
+
+```
+Host *
+	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
+```
+
+## Cyberduck
+
+Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
+
+```
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>link-ssh-auth-sock</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/sh</string>
+    <string>-c</string>
+    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>
+```
+
+Log out and log in again before launching Cyberduck.
+
+## Mountain Duck
+
+Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
+
+```
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>link-ssh-auth-sock</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/sh</string>
+    <string>-c</string>
+    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>
+```
+
+Log out and log in again before launching Mountain Duck.
+
+## GitKraken
+
+Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
+
+```
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>link-ssh-auth-sock</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/sh</string>
+    <string>-c</string>
+    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>
+```
+
+Log out and log in again before launching Gitkraken. Then enable "Use local SSH agent in GitKraken Preferences (Located under Preferences -> SSH)
+
+# The app I use isn't listed here!
+
+If you know how to get it set up, please open a PR for this page and add it! Contributions are very welcome.
+If you're not able to get it working, please file a [GitHub issue](https://github.com/maxgoedjen/secretive/issues/new) for it. No guarantees we'll be able to get it working, but chances are someone else in the community might be able to.

CONTRIBUTING.md

@@ -20,7 +20,7 @@ If you'd like to contribute a translation, please see [Localizing](LOCALIZING.md
 
 ## Credits
 
-If you make a material contribution to the app, please add yourself to the end of the [credits](https://github.com/maxgoedjen/secretive/blob/main/Sources/Secretive/Credits.rtf).
+If you make a material contribution to the app, please add yourself to the end of the [credits](https://github.com/maxgoedjen/secretive/blob/main/Secretive/Credits.rtf).
 
 ## Collaborator Status
 

Design/Icon.icon/icon.json

@@ -1,59 +0,0 @@
-{
-  "fill" : {
-    "solid" : "srgb:0.00000,0.53333,1.00000,0.00000"
-  },
-  "groups" : [
-    {
-      "blur-material" : 0.5,
-      "layers" : [
-        {
-          "image-name" : "Icon 7.png",
-          "name" : "Signature",
-          "position" : {
-            "scale" : 1,
-            "translation-in-points" : [
-              64.00083178971097,
-              -58.21801551632592
-            ]
-          }
-        },
-        {
-          "image-name" : "Rectangle Copy 10.png",
-          "name" : "Border"
-        },
-        {
-          "fill-specializations" : [
-            {
-              "appearance" : "tinted",
-              "value" : {
-                "solid" : "display-p3:0.00000,0.00000,0.00000,0.50000"
-              }
-            }
-          ],
-          "image-name" : "Rectangle 2 8.png",
-          "name" : "Backing",
-          "opacity-specializations" : [
-            {
-              "appearance" : "tinted",
-              "value" : 1
-            }
-          ]
-        }
-      ],
-      "shadow" : {
-        "kind" : "layer-color",
-        "opacity" : 0.5
-      },
-      "specular" : true,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.5
-      }
-    }
-  ],
-  "supported-platforms" : {
-    "squares" : [
-      "macOS"
-    ]
-  }
-}

FAQ.md

@@ -6,7 +6,7 @@ The secure enclave doesn't allow import or export of private keys. For any new c
 
 ### Secretive doesn't work with my git client/app
 
-Secretive relies on the `SSH_AUTH_SOCK` environment variable being respected. The `git` and `ssh` command line tools natively respect this, but third party apps may require some configuration to work. A non-exhaustive list of setup steps is provided in the [secretive-config-instructions](https://github.com/maxgoedjen/secretive-config-instructions) repo.
+Secretive relies on the `SSH_AUTH_SOCK` environment variable being respected. The `git` and `ssh` command line tools natively respect this, but third party apps may require some configuration to work. A non-exhaustive list of setup steps is provided in the [App Config FAQ](APP_CONFIG.md).
 
 ### Secretive isn't working for me
 

Package.swift

@@ -1,69 +0,0 @@
-// swift-tools-version:6.2
-// The swift-tools-version declares the minimum version of Swift required to build this package.
-
-import PackageDescription
-
-// This is basically the same package as `Sources/Packages/Package.swift`, but thinned slightly.
-// Ideally this would be the same package, but SPM requires it to be at the root of the project,
-// and Xcode does _not_ like that, so they're separate.
-let package = Package(
-    name: "SecretKit",
-    defaultLocalization: "en",
-    platforms: [
-        .macOS(.v14)
-    ],
-    products: [
-        .library(
-            name: "SecretKit",
-            targets: ["SecretKit"]),
-        .library(
-            name: "SecureEnclaveSecretKit",
-            targets: ["SecureEnclaveSecretKit"]),
-        .library(
-            name: "SmartCardSecretKit",
-            targets: ["SmartCardSecretKit"]),
-    ],
-    dependencies: [
-    ],
-    targets: [
-        .target(
-            name: "SecretKit",
-            dependencies: [],
-            path: "Sources/Packages/Sources/SecretKit",
-            resources: [localization],
-            swiftSettings: swiftSettings
-        ),
-        .testTarget(
-            name: "SecretKitTests",
-            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
-            path: "Sources/Packages/Tests/SecretKitTests",
-            swiftSettings: swiftSettings
-        ),
-        .target(
-            name: "SecureEnclaveSecretKit",
-            dependencies: ["SecretKit"],
-            path: "Sources/Packages/Sources/SecureEnclaveSecretKit",
-            resources: [localization],
-            swiftSettings: swiftSettings
-        ),
-        .target(
-            name: "SmartCardSecretKit",
-            dependencies: ["SecretKit"],
-            path: "Sources/Packages/Sources/SmartCardSecretKit",
-            resources: [localization],
-            swiftSettings: swiftSettings
-        ),
-    ]
-)
-
-var localization: Resource {
-    .process("../../Resources/Localizable.xcstrings")
-}
-
-var swiftSettings: [PackageDescription.SwiftSetting] {
-    [
-        .swiftLanguageMode(.v6),
-        // This freaks out Xcode in a dependency context.
-        // .treatAllWarnings(as: .error),
-    ]
-}

README.md

@@ -1,4 +1,4 @@
-# Secretive [![Test](https://github.com/maxgoedjen/secretive/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/maxgoedjen/secretive/actions/workflows/test.yml) ![Release](https://github.com/maxgoedjen/secretive/workflows/Release/badge.svg)
+# Secretive ![Test](https://github.com/maxgoedjen/secretive/workflows/Test/badge.svg) ![Release](https://github.com/maxgoedjen/secretive/workflows/Release/badge.svg)
 
 
 Secretive is an app for storing and managing SSH keys in the Secure Enclave. It is inspired by the [sekey project](https://github.com/sekey/sekey), but rewritten in Swift with no external dependencies and with a handy native management app.
@@ -49,7 +49,7 @@ There's a [FAQ here](FAQ.md).
 
 ### Auditable Build Process
 
-Builds are produced by GitHub Actions with an auditable build and release generation process. Starting with Secretive 3.0, builds are attested using [GitHub Artifact Attestation](https://docs.github.com/en/actions/concepts/security/artifact-attestations). Attestations are viewable in the build log for a build, and also on the [main attestation page](https://github.com/maxgoedjen/secretive/attestations).
+Builds are produced by GitHub Actions with an auditable build and release generation process. Each build has a "Document SHAs" step, which will output SHA checksums for the build produced by the GitHub Action, so you can verify that the source code for a given build corresponds to any given release.
 
 ### A Note Around Code Signing and Keychains
 
@@ -61,4 +61,4 @@ Because secrets in the Secure Enclave are not exportable, they are not able to b
 
 ## Security
 
-Secretive's security policy is detailed in [SECURITY.md](SECURITY.md). To report security issues, please use [GitHub's private reporting feature.](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability)
+If you discover any vulnerabilities in this project, please notify [max.goedjen@gmail.com](mailto:max.goedjen@gmail.com) with the subject containing "SECRETIVE SECURITY."

SECURITY.md

@@ -1,27 +1,9 @@
 # Security Policy
 
-## Security Principles
-
-Secretive is designed with a few general tenets in mind:
-
-### It's Hard to Leak a Key Secretive Can't Read The Key Material
-
-Secretive only operates on hardware-backed keys. In general terms, this means that it should be _very_ hard for Secretive to have any sort of bug that causes a key to be shared, because Secretive can't access private key data even if it wants to.
-
-### Simplicity and Auditability
-
-Secretive won't expand to have every feature it could possibly have. Part of the goal of the app is that it is possible for consumers to reasonably audit the code, and that often means not implementing features that might be cool, but which would significantly inflate the size of the codebase.
-
-### Dependencies
-
-Both in support of the previous principle and to rule out supply chain attacks, Secretive does not rely on any third party dependencies. 
-
-There are limited exceptions to this, particularly in the build process, but the app itself does not depend on any third party code.
-
 ## Supported Versions
 
 The latest version on the [Releases page](https://github.com/maxgoedjen/secretive/releases) is the only currently supported version.
 
 ## Reporting a Vulnerability
 
-To report security issues, please use [GitHub's private reporting feature.](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability)
+If you discover any vulnerabilities in this project, please notify max.goedjen@gmail.com with the subject containing "SECRETIVE SECURITY."

Sources/Packages/Package.swift

@@ -1,11 +1,10 @@
-// swift-tools-version:6.2
+// swift-tools-version:6.1
 // The swift-tools-version declares the minimum version of Swift required to build this package.
 
 import PackageDescription
 
 let package = Package(
     name: "SecretivePackages",
-    defaultLocalization: "en",
     platforms: [
         .macOS(.v14)
     ],
@@ -28,66 +27,65 @@ let package = Package(
         .library(
             name: "Brief",
             targets: ["Brief"]),
+        .library(
+            name: "Common",
+            targets: ["Common"]),
     ],
     dependencies: [
     ],
     targets: [
         .target(
             name: "SecretKit",
-            dependencies: [],
-            resources: [localization],
-            swiftSettings: swiftSettings,
+            dependencies: ["Common"],
+            swiftSettings: swiftSettings
         ),
         .testTarget(
             name: "SecretKitTests",
             dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
-            swiftSettings: swiftSettings,
+            swiftSettings: swiftSettings
         ),
         .target(
             name: "SecureEnclaveSecretKit",
-            dependencies: ["SecretKit"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
+            dependencies: ["Common", "SecretKit"],
+            swiftSettings: swiftSettings
         ),
         .target(
             name: "SmartCardSecretKit",
-            dependencies: ["SecretKit"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
+            dependencies: ["Common", "SecretKit"],
+            swiftSettings: swiftSettings
         ),
         .target(
             name: "SecretAgentKit",
-            dependencies: ["SecretKit", "SecretAgentKitHeaders"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
+            dependencies: ["Common", "SecretKit", "SecretAgentKitHeaders"],
+            swiftSettings: swiftSettings
         ),
         .systemLibrary(
-            name: "SecretAgentKitHeaders",
+            name: "SecretAgentKitHeaders"
         ),
         .testTarget(
             name: "SecretAgentKitTests",
-            dependencies: ["SecretAgentKit"],
-        ),
+            dependencies: ["SecretAgentKit"])
+        ,
         .target(
             name: "Brief",
-            dependencies: [],
-            resources: [localization],
-            swiftSettings: swiftSettings,
+            dependencies: ["Common"],
+            swiftSettings: swiftSettings
         ),
         .testTarget(
             name: "BriefTests",
-            dependencies: ["Brief"],
+            dependencies: ["Brief"]
+        ),
+        .target(
+            name: "Common",
+            dependencies: [],
+            swiftSettings: swiftSettings
         ),
     ]
 )
 
-var localization: Resource {
-    .process("../../Resources/Localizable.xcstrings")
-}
-
 var swiftSettings: [PackageDescription.SwiftSetting] {
     [
         .swiftLanguageMode(.v6),
-        .treatAllWarnings(as: .error),
+        .unsafeFlags(["-warnings-as-errors"])
     ]
 }

Sources/Packages/Sources/Brief/Updater.swift

@@ -1,18 +1,15 @@
 import Foundation
 import Observation
+import os
+import Common
 
 /// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version.
-@Observable public final class Updater: UpdaterProtocol, Sendable {
+@Observable public final class Updater: UpdaterProtocol, ObservableObject, Sendable {
 
-    private let state = State()
-    @MainActor @Observable public final class State {
-        var update: Release? = nil
-        nonisolated init() {}
-    }
     public var update: Release? {
-        state.update
+        _update.lockedValue
     }
-
+    private let _update: OSAllocatedUnfairLock<Release?> = .init(uncheckedState: nil)
     public let testBuild: Bool
 
     /// The current OS version.
@@ -26,12 +23,7 @@ import Observation
     ///   - checkFrequency: The interval at which the Updater should check for updates. Subject to a tolerance of 1 hour.
     ///   - osVersion: The current OS version.
     ///   - currentVersion: The current version of the app that is running.
-    public init(
-        checkOnLaunch: Bool,
-        checkFrequency: TimeInterval = Measurement(value: 24, unit: UnitDuration.hours).converted(to: .seconds).value,
-        osVersion: SemVer = SemVer(ProcessInfo.processInfo.operatingSystemVersion),
-        currentVersion: SemVer = SemVer(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.0.0")
-    ) {
+    public init(checkOnLaunch: Bool, checkFrequency: TimeInterval = Measurement(value: 24, unit: UnitDuration.hours).converted(to: .seconds).value, osVersion: SemVer = SemVer(ProcessInfo.processInfo.operatingSystemVersion), currentVersion: SemVer = SemVer(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.0.0")) {
         self.osVersion = osVersion
         self.currentVersion = currentVersion
         testBuild = currentVersion == SemVer("0.0.0")
@@ -62,7 +54,7 @@ import Observation
         guard !release.critical else { return }
         defaults.set(true, forKey: release.name)
         await MainActor.run {
-            state.update = nil
+            _update.lockedValue = nil
         }
     }
 
@@ -83,7 +75,7 @@ extension Updater {
         let latestVersion = SemVer(release.name)
         if latestVersion > currentVersion {
             await MainActor.run {
-                state.update = release
+                _update.lockedValue = release
             }
         }
     }

Sources/Packages/Sources/Brief/UpdaterProtocol.swift

@@ -1,13 +1,13 @@
 import Foundation
+import os
 
 /// A protocol for retreiving the latest available version of an app.
-public protocol UpdaterProtocol: Observable, Sendable {
+public protocol UpdaterProtocol: Observable {
 
     /// The latest update
-    @MainActor var update: Release? { get }
+    var update: Release? { get }
     /// A boolean describing whether or not the current build of the app is a "test" build (ie, a debug build or otherwise special build)
     var testBuild: Bool { get }
 
-    func ignore(release: Release) async
 }
 

Sources/Packages/Sources/Common/Locks.swift

@@ -0,0 +1,14 @@
+import os
+
+public extension OSAllocatedUnfairLock where State: Sendable {
+    
+    var lockedValue: State {
+        get {
+            withLock { $0 }
+        }
+        nonmutating set {
+            withLock { $0 = newValue }
+        }
+    }
+
+}

Sources/Packages/Sources/SecretAgentKit/Agent.swift

@@ -9,8 +9,8 @@ public final class Agent: Sendable {
 
     private let storeList: SecretStoreList
     private let witness: SigningWitness?
-    private let publicKeyWriter = OpenSSHPublicKeyWriter()
-    private let signatureWriter = OpenSSHSignatureWriter()
+    private let writer = OpenSSHKeyWriter()
+    private let requestTracer = SigningRequestTracer()
     private let certificateHandler = OpenSSHCertificateHandler()
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "Agent")
 
@@ -22,9 +22,7 @@ public final class Agent: Sendable {
         logger.debug("Agent is running")
         self.storeList = storeList
         self.witness = witness
-        Task { @MainActor in
-            await certificateHandler.reloadCertificates(for: storeList.allSecrets)
-        }
+        certificateHandler.reloadCertificates(for: storeList.allSecrets)
     }
     
 }
@@ -33,26 +31,28 @@ extension Agent {
 
     /// Handles an incoming request.
     /// - Parameters:
-    ///   - data: The data to handle.
-    ///   - provenance: The origin of the request.
-    /// - Returns: A response data payload.
-    public func handle(data: Data, provenance: SigningRequestProvenance) async throws -> Data {
+    ///   - reader: A ``FileHandleReader`` to read the content of the request.
+    ///   - writer: A ``FileHandleWriter`` to write the response to.
+    /// - Return value: 
+    ///   - Boolean if data could be read
+    @discardableResult public func handle(reader: FileHandleReader, writer: FileHandleWriter) async -> Bool {
         logger.debug("Agent handling new data")
-        guard data.count > 4 else {
-            throw InvalidDataProvidedError()
-        }
+        let data = Data(reader.availableData)
+        guard data.count > 4 else { return false}
         let requestTypeInt = data[4]
         guard let requestType = SSHAgent.RequestType(rawValue: requestTypeInt) else {
+            writer.write(OpenSSHKeyWriter().lengthAndData(of: SSHAgent.ResponseType.agentFailure.data))
             logger.debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
-            return SSHAgent.ResponseType.agentFailure.data.lengthAndData
+            return true
         }
         logger.debug("Agent handling request of type \(requestType.debugDescription)")
         let subData = Data(data[5...])
-        let response = await handle(requestType: requestType, data: subData, provenance: provenance)
-        return response
+        let response = await handle(requestType: requestType, data: subData, reader: reader)
+        writer.write(response)
+        return true
     }
 
-    private func handle(requestType: SSHAgent.RequestType, data: Data, provenance: SigningRequestProvenance) async -> Data {
+    func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) async -> Data {
         // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
         await reloadSecretsIfNeccessary()
         var response = Data()
@@ -60,9 +60,10 @@ extension Agent {
             switch requestType {
             case .requestIdentities:
                 response.append(SSHAgent.ResponseType.agentIdentitiesAnswer.data)
-                response.append(await identities())
+                response.append(identities())
                 logger.debug("Agent returned \(SSHAgent.ResponseType.agentIdentitiesAnswer.debugDescription)")
             case .signRequest:
+                let provenance = requestTracer.provenance(from: reader)
                 response.append(SSHAgent.ResponseType.agentSignResponse.data)
                 response.append(try await sign(data: data, provenance: provenance))
                 logger.debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)")
@@ -72,7 +73,8 @@ extension Agent {
             response.append(SSHAgent.ResponseType.agentFailure.data)
             logger.debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
         }
-        return response.lengthAndData
+        let full = OpenSSHKeyWriter().lengthAndData(of: response)
+        return full
     }
 
 }
@@ -81,21 +83,21 @@ extension Agent {
 
     /// Lists the identities available for signing operations
     /// - Returns: An OpenSSH formatted Data payload listing the identities available for signing operations.
-    func identities() async -> Data {
-        let secrets = await storeList.allSecrets
-        await certificateHandler.reloadCertificates(for: secrets)
-        var count = 0
+    func identities() -> Data {
+        let secrets = storeList.allSecrets
+        certificateHandler.reloadCertificates(for: secrets)
+        var count = secrets.count
         var keyData = Data()
 
         for secret in secrets {
-            let keyBlob = publicKeyWriter.data(secret: secret)
-            keyData.append(keyBlob.lengthAndData)
-            keyData.append(publicKeyWriter.comment(secret: secret).lengthAndData)
-            count += 1
-
-            if let (certificateData, name) = try? await certificateHandler.keyBlobAndName(for: secret) {
-                keyData.append(certificateData.lengthAndData)
-                keyData.append(name.lengthAndData)
+            let keyBlob = writer.data(secret: secret)
+            let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
+            keyData.append(writer.lengthAndData(of: keyBlob))
+            keyData.append(writer.lengthAndData(of: curveData))
+            
+            if let (certificateData, name) = try? certificateHandler.keyBlobAndName(for: secret) {
+                keyData.append(writer.lengthAndData(of: certificateData))
+                keyData.append(writer.lengthAndData(of: name))
                 count += 1
             }
         }
@@ -114,26 +116,67 @@ extension Agent {
         let reader = OpenSSHReader(data: data)
         let payloadHash = reader.readNextChunk()
         let hash: Data
-
         // Check if hash is actually an openssh certificate and reconstruct the public key if it is
-        if let certificatePublicKey = await certificateHandler.publicKeyHash(from: payloadHash) {
+        if let certificatePublicKey = certificateHandler.publicKeyHash(from: payloadHash) {
             hash = certificatePublicKey
         } else {
             hash = payloadHash
         }
         
-        guard let (secret, store) = await secret(matching: hash) else {
+        guard let (store, secret) = secret(matching: hash) else {
             logger.debug("Agent did not have a key matching \(hash as NSData)")
-            throw NoMatchingKeyError()
+            throw AgentError.noMatchingKey
         }
 
-        try await witness?.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
+        if let witness = witness {
+            try await witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
+        }
 
         let dataToSign = reader.readNextChunk()
-        let rawRepresentation = try await store.sign(data: dataToSign, with: secret, for: provenance)
-        let signedData = signatureWriter.data(secret: secret, signature: rawRepresentation)
+        let signed = try await store.sign(data: dataToSign, with: secret, for: provenance)
+        let derSignature = signed
 
-        try await witness?.witness(accessTo: secret, from: store, by: provenance)
+        let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
+
+        // Convert from DER formatted rep to raw (r||s)
+
+        let rawRepresentation: Data
+        switch (secret.algorithm, secret.keySize) {
+        case (.ellipticCurve, 256):
+            rawRepresentation = try CryptoKit.P256.Signing.ECDSASignature(derRepresentation: derSignature).rawRepresentation
+        case (.ellipticCurve, 384):
+            rawRepresentation = try CryptoKit.P384.Signing.ECDSASignature(derRepresentation: derSignature).rawRepresentation
+        default:
+            throw AgentError.unsupportedKeyType
+        }
+
+
+        let rawLength = rawRepresentation.count/2
+        // Check if we need to pad with 0x00 to prevent certain
+        // ssh servers from thinking r or s is negative
+        let paddingRange: ClosedRange<UInt8> = 0x80...0xFF
+        var r = Data(rawRepresentation[0..<rawLength])
+        if paddingRange ~= r.first! {
+            r.insert(0x00, at: 0)
+        }
+        var s = Data(rawRepresentation[rawLength...])
+        if paddingRange ~= s.first! {
+            s.insert(0x00, at: 0)
+        }
+
+        var signatureChunk = Data()
+        signatureChunk.append(writer.lengthAndData(of: r))
+        signatureChunk.append(writer.lengthAndData(of: s))
+
+        var signedData = Data()
+        var sub = Data()
+        sub.append(writer.lengthAndData(of: curveData))
+        sub.append(writer.lengthAndData(of: signatureChunk))
+        signedData.append(writer.lengthAndData(of: sub))
+
+        if let witness = witness {
+            try await witness.witness(accessTo: secret, from: store, by: provenance)
+        }
 
         logger.debug("Agent signed request")
 
@@ -146,10 +189,9 @@ extension Agent {
 
     /// Gives any store with no loaded secrets a chance to reload.
     func reloadSecretsIfNeccessary() async {
-        for store in await storeList.stores {
-            if await store.secrets.isEmpty {
-                let name = await store.name
-                logger.debug("Store \(name, privacy: .public) has no loaded secrets. Reloading.")
+        for store in storeList.stores {
+            if store.secrets.isEmpty {
+                logger.debug("Store \(store.name, privacy: .public) has no loaded secrets. Reloading.")
                 await store.reloadSecrets()
             }
         }
@@ -158,10 +200,16 @@ extension Agent {
     /// Finds a ``Secret`` matching a specified hash whos signature was requested.
     /// - Parameter hash: The hash to match against.
     /// - Returns: A ``Secret`` and the ``SecretStore`` containing it, if a match is found.
-    func secret(matching hash: Data) async -> (AnySecret, AnySecretStore)? {
-        await storeList.allSecretsWithStores.first {
-            hash == publicKeyWriter.data(secret: $0.0)
-        }
+    func secret(matching hash: Data) -> (AnySecretStore, AnySecret)? {
+        storeList.stores.compactMap { store -> (AnySecretStore, AnySecret)? in
+            let allMatching = store.secrets.filter { secret in
+                hash == writer.data(secret: secret)
+            }
+            if let matching = allMatching.first {
+                return (store, matching)
+            }
+            return nil
+        }.first
     }
 
 }
@@ -169,8 +217,13 @@ extension Agent {
 
 extension Agent {
 
-    struct InvalidDataProvidedError: Error {}
-    struct NoMatchingKeyError: Error {}
+    /// An error involving agent operations..
+    enum AgentError: Error {
+        case unhandledType
+        case noMatchingKey
+        case unsupportedKeyType
+        case notOpenSSHCertificate
+    }
 
 }
 

Sources/Packages/Sources/SecretAgentKit/Sendability.swift

@@ -0,0 +1,11 @@
+import Foundation
+
+struct UncheckedSendable<T>: @unchecked Sendable {
+
+    let value: T
+
+    init(_ value: T) {
+        self.value = value
+    }
+
+}

Sources/Packages/Sources/SecretAgentKit/SocketController.swift

@@ -1,32 +1,23 @@
 import Foundation
 import OSLog
-import SecretKit
 
 /// A controller that manages socket configuration and request dispatching.
-public struct SocketController {
+public final class SocketController {
 
-    /// A stream of Sessions. Each session represents one connection to a class communicating with the socket. Multiple Sessions may be active simultaneously.
-    public let sessions: AsyncStream<Session>
-
-    /// A continuation to create new sessions.
-    private let sessionsContinuation: AsyncStream<Session>.Continuation
-
-    /// The active SocketPort. Must be retained to be kept valid.
-    private let port: SocketPort
-
-    /// The FileHandle for the main socket.
-    private let fileHandle: FileHandle
-    
-    /// Logger for the socket controller.
+    /// The active FileHandle.
+    private var fileHandle: FileHandle?
+    /// The active SocketPort.
+    private var port: SocketPort?
+    /// A handler that will be notified when a new read/write handle is available.
+    /// False if no data could be read
+    public var handler: (@Sendable (FileHandleReader, FileHandleWriter) async -> Bool)?
+    /// Logger.
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "SocketController")
 
-    /// Tracer which determines who originates a socket connection.
-    private let requestTracer = SigningRequestTracer()
 
     /// Initializes a socket controller with a specified path.
     /// - Parameter path: The path to use as a socket.
     public init(path: String) {
-        (sessions, sessionsContinuation) = AsyncStream<Session>.makeStream()
         logger.debug("Socket controller setting up at \(path)")
         if let _ = try? FileManager.default.removeItem(atPath: path) {
             logger.debug("Socket controller removed existing socket")
@@ -34,104 +25,25 @@ public struct SocketController {
         let exists = FileManager.default.fileExists(atPath: path)
         assert(!exists)
         logger.debug("Socket controller path is clear")
-        port = SocketPort(path: path)
-        fileHandle = FileHandle(fileDescriptor: port.socket, closeOnDealloc: true)
-        Task { [fileHandle, sessionsContinuation, logger] in
-            for await notification in NotificationCenter.default.notifications(named: .NSFileHandleConnectionAccepted) {
-                logger.debug("Socket controller accepted connection")
-                guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { continue }
-                let session = Session(fileHandle: new)
-                sessionsContinuation.yield(session)
-                await fileHandle.acceptConnectionInBackgroundAndNotifyOnMainActor()
-            }
-        }
-        fileHandle.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.Mode.common])
+        port = socketPort(at: path)
+        configureSocket(at: path)
         logger.debug("Socket listening at \(path)")
     }
 
-}
-
-extension SocketController {
-    
-    /// A session represents a connection that has been established between the two ends of the socket.
-    public struct Session: Sendable {
-        
-        /// Data received by the socket.
-        public let messages: AsyncStream<Data>
-
-        /// The provenance of the process that established the session.
-        public let provenance: SigningRequestProvenance
-        
-        /// A FileHandle used to communicate with the socket.
-        private let fileHandle: FileHandle
-
-        /// A continuation for issuing new messages.
-        private let messagesContinuation: AsyncStream<Data>.Continuation
-
-        /// A logger for the session.
-        private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "Session")
-        
-        /// Initializes a new Session.
-        /// - Parameter fileHandle: The FileHandle used to communicate with the socket.
-        init(fileHandle: FileHandle) {
-            self.fileHandle = fileHandle
-            provenance = SigningRequestTracer().provenance(from: fileHandle)
-            (messages, messagesContinuation) = AsyncStream.makeStream()
-            Task { [messagesContinuation, logger] in
-                for await _ in NotificationCenter.default.notifications(named: .NSFileHandleDataAvailable, object: fileHandle) {
-                    let data = fileHandle.availableData
-                    guard !data.isEmpty else {
-                        logger.debug("Socket controller received empty data, ending continuation.")
-                        messagesContinuation.finish()
-                        try fileHandle.close()
-                        return
-                    }
-                    messagesContinuation.yield(data)
-                    logger.debug("Socket controller yielded data.")
-                }
-            }
-            Task {
-                await fileHandle.waitForDataInBackgroundAndNotifyOnMainActor()
-            }
-        }
-        
-        /// Writes new data to the socket.
-        /// - Parameter data: The data to write.
-        public func write(_ data: Data) async throws {
-            try fileHandle.write(contentsOf: data)
-            await fileHandle.waitForDataInBackgroundAndNotifyOnMainActor()
-        }
-        
-        /// Closes the socket and cleans up resources.
-        public func close() throws {
-            logger.debug("Session closed.")
-            messagesContinuation.finish()
-            try fileHandle.close()
-        }
-
+    /// Configures the socket and a corresponding FileHandle.
+    /// - Parameter path: The path to use as a socket.
+    func configureSocket(at path: String) {
+        guard let port = port else { return }
+        fileHandle = FileHandle(fileDescriptor: port.socket, closeOnDealloc: true)
+        NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionAccept(notification:)), name: .NSFileHandleConnectionAccepted, object: nil)
+        NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionDataAvailable(notification:)), name: .NSFileHandleDataAvailable, object: nil)
+        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.Mode.common])
     }
 
-}
-
-private extension FileHandle {
-
-    /// Ensures waitForDataInBackgroundAndNotify will be called on the main actor.
-    @MainActor func waitForDataInBackgroundAndNotifyOnMainActor() {
-        waitForDataInBackgroundAndNotify()
-    }
-
-
-    /// Ensures acceptConnectionInBackgroundAndNotify will be called on the main actor.
-    /// - Parameter modes: the runloop modes to use.
-    @MainActor func acceptConnectionInBackgroundAndNotifyOnMainActor(forModes modes: [RunLoop.Mode]? = [RunLoop.Mode.common]) {
-        acceptConnectionInBackgroundAndNotify(forModes: modes)
-    }
-
-}
-
-private extension SocketPort {
-
-    convenience init(path: String) {
+    /// Creates a SocketPort for a path.
+    /// - Parameter path: The path to use as a socket.
+    /// - Returns: A configured SocketPort.
+    func socketPort(at path: String) -> SocketPort {
         var addr = sockaddr_un()
         addr.sun_family = sa_family_t(AF_UNIX)
 
@@ -149,7 +61,51 @@ private extension SocketPort {
             data = Data(bytes: pointer, count: MemoryLayout<sockaddr_un>.size)
         }
 
-        self.init(protocolFamily: AF_UNIX, socketType: SOCK_STREAM, protocol: 0, address: data)!
+        return SocketPort(protocolFamily: AF_UNIX, socketType: SOCK_STREAM, protocol: 0, address: data)!
+    }
+
+    /// Handles a new connection being accepted, invokes the handler, and prepares to accept new connections.
+    /// - Parameter notification: A `Notification` that triggered the call.
+    @objc func handleConnectionAccept(notification: Notification) {
+        logger.debug("Socket controller accepted connection")
+        guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { return }
+        Task { [handler, fileHandle] in
+            _ = await handler?(new, new)
+            await new.waitForDataInBackgroundAndNotifyOnMainActor()
+            await fileHandle?.acceptConnectionInBackgroundAndNotifyOnMainActor()
+        }
+    }
+
+    /// Handles a new connection providing data and invokes the handler callback.
+    /// - Parameter notification: A `Notification` that triggered the call.
+    @objc func handleConnectionDataAvailable(notification: Notification) {
+        logger.debug("Socket controller has new data available")
+        guard let new = notification.object as? FileHandle else { return }
+        logger.debug("Socket controller received new file handle")
+        Task { [handler, logger = UncheckedSendable(logger)] in
+            if((await handler?(new, new)) == true) {
+                logger.value.debug("Socket controller handled data, wait for more data")
+                await new.waitForDataInBackgroundAndNotifyOnMainActor()
+            } else {
+                logger.value.debug("Socket controller called with empty data, socked closed")
+            }
+        }
+    }
+
+}
+
+extension FileHandle {
+    
+    /// Ensures waitForDataInBackgroundAndNotify will be called on the main actor.
+    @MainActor func waitForDataInBackgroundAndNotifyOnMainActor() {
+        waitForDataInBackgroundAndNotify()
+    }
+
+
+    /// Ensures acceptConnectionInBackgroundAndNotify will be called on the main actor.
+    /// - Parameter modes: the runloop modes to use.
+    @MainActor func acceptConnectionInBackgroundAndNotifyOnMainActor(forModes modes: [RunLoop.Mode]? = [RunLoop.Mode.common]) {
+        acceptConnectionInBackgroundAndNotify(forModes: modes)
     }
 
 }

Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md

@@ -22,7 +22,7 @@ SecretKit is a collection of protocols describing secrets and stores.
 
 ### OpenSSH 
 
-- ``OpenSSHPublicKeyWriter``
+- ``OpenSSHKeyWriter``
 - ``OpenSSHReader``
 
 ### Signing Process

Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift

@@ -3,28 +3,34 @@ import Foundation
 /// Type eraser for Secret.
 public struct AnySecret: Secret, @unchecked Sendable {
 
-    public let base: any Secret
+    let base: Any
+    private let hashable: AnyHashable
     private let _id: () -> AnyHashable
     private let _name: () -> String
+    private let _algorithm: () -> Algorithm
+    private let _keySize: () -> Int
+    private let _requiresAuthentication: () -> Bool
     private let _publicKey: () -> Data
-    private let _attributes: () -> Attributes
-    private let _eq: (AnySecret) -> Bool
 
     public init<T>(_ secret: T) where T: Secret {
         if let secret = secret as? AnySecret {
             base = secret.base
+            hashable = secret.hashable
             _id = secret._id
             _name = secret._name
+            _algorithm = secret._algorithm
+            _keySize = secret._keySize
+            _requiresAuthentication = secret._requiresAuthentication
             _publicKey = secret._publicKey
-            _attributes = secret._attributes
-            _eq = secret._eq
         } else {
-            base = secret
+            base = secret as Any
+            self.hashable = secret
             _id = { secret.id as AnyHashable }
             _name = { secret.name }
+            _algorithm = { secret.algorithm }
+            _keySize = { secret.keySize }
+            _requiresAuthentication = { secret.requiresAuthentication }
             _publicKey = { secret.publicKey }
-            _attributes = { secret.attributes }
-            _eq = { secret == $0.base as? T }
         }
     }
 
@@ -36,20 +42,28 @@ public struct AnySecret: Secret, @unchecked Sendable {
         _name()
     }
 
+    public var algorithm: Algorithm {
+        _algorithm()
+    }
+
+    public var keySize: Int {
+        _keySize()
+    }
+
+    public var requiresAuthentication: Bool {
+        _requiresAuthentication()
+    }
+
     public var publicKey: Data {
         _publicKey()
     }
-    
-    public var attributes: Attributes {
-        _attributes()
-    }
 
     public static func == (lhs: AnySecret, rhs: AnySecret) -> Bool {
-        lhs._eq(rhs)
+        lhs.hashable == rhs.hashable
     }
 
     public func hash(into hasher: inout Hasher) {
-        id.hash(into: &hasher)
+        hashable.hash(into: &hasher)
     }
 
 }

Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift

@@ -1,14 +1,16 @@
 import Foundation
+import Combine
 
 /// Type eraser for SecretStore.
-open class AnySecretStore: SecretStore, @unchecked Sendable {
+public class AnySecretStore: SecretStore, @unchecked Sendable {
 
-    let base: any SecretStore
-    private let _isAvailable: @MainActor @Sendable () -> Bool
+    let base: Any
+    private let _isAvailable: @Sendable () -> Bool
     private let _id: @Sendable () -> UUID
-    private let _name: @MainActor @Sendable () -> String
-    private let _secrets: @MainActor @Sendable () -> [AnySecret]
+    private let _name: @Sendable () -> String
+    private let _secrets: @Sendable () -> [AnySecret]
     private let _sign: @Sendable (Data, AnySecret, SigningRequestProvenance) async throws -> Data
+    private let _verify: @Sendable (Data, Data, AnySecret) async throws -> Bool
     private let _existingPersistedAuthenticationContext: @Sendable (AnySecret) async -> PersistedAuthenticationContext?
     private let _persistAuthentication: @Sendable (AnySecret, TimeInterval) async throws -> Void
     private let _reloadSecrets: @Sendable () async -> Void
@@ -20,12 +22,13 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
         _id = { secretStore.id }
         _secrets = { secretStore.secrets.map { AnySecret($0) } }
         _sign = { try await secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
+        _verify = { try await secretStore.verify(signature: $0, for: $1, with: $2.base as! SecretStoreType.SecretType) }
         _existingPersistedAuthenticationContext = { await secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
         _persistAuthentication = { try await secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
         _reloadSecrets = { await secretStore.reloadSecrets() }
     }
 
-    @MainActor public var isAvailable: Bool {
+    public var isAvailable: Bool {
         return _isAvailable()
     }
 
@@ -33,11 +36,11 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
         return _id()
     }
 
-    @MainActor public var name: String {
+    public var name: String {
         return _name()
     }
 
-    @MainActor public var secrets: [AnySecret] {
+    public var secrets: [AnySecret] {
         return _secrets()
     }
 
@@ -45,6 +48,10 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
         try await _sign(data, secret, provenance)
     }
 
+    public func verify(signature: Data, for data: Data, with secret: AnySecret) async throws -> Bool {
+        try await _verify(signature, data, secret)
+    }
+
     public func existingPersistedAuthenticationContext(secret: AnySecret) async -> PersistedAuthenticationContext? {
         await _existingPersistedAuthenticationContext(secret)
     }
@@ -61,34 +68,27 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
 
 public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable, @unchecked Sendable {
 
-    private let _create: @Sendable (String, Attributes) async throws -> AnySecret
+    private let _create: @Sendable (String, Bool) async throws -> Void
     private let _delete: @Sendable (AnySecret) async throws -> Void
-    private let _update: @Sendable (AnySecret, String, Attributes) async throws -> Void
-    private let _supportedKeyTypes: @Sendable () -> [KeyType]
+    private let _update: @Sendable (AnySecret, String) async throws -> Void
 
-    public init<SecretStoreType>(_ secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable {
-        _create = { AnySecret(try await secretStore.create(name: $0, attributes: $1)) }
+    public init<SecretStoreType>(modifiable secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable {
+        _create = { try await secretStore.create(name: $0, requiresAuthentication: $1) }
         _delete = { try await secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) }
-        _update = { try await secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1, attributes: $2) }
-        _supportedKeyTypes = { secretStore.supportedKeyTypes }
+        _update = { try await secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1) }
         super.init(secretStore)
     }
 
-    @discardableResult
-    public func create(name: String, attributes: Attributes) async throws -> SecretType {
-        try await _create(name, attributes)
+    public func create(name: String, requiresAuthentication: Bool) async throws {
+        try await _create(name, requiresAuthentication)
     }
 
     public func delete(secret: AnySecret) async throws {
         try await _delete(secret)
     }
 
-    public func update(secret: AnySecret, name: String, attributes: Attributes) async throws {
-        try await _update(secret, name, attributes)
-    }
-
-    public var supportedKeyTypes: [KeyType] {
-        _supportedKeyTypes()
+    public func update(secret: AnySecret, name: String) async throws {
+        try await _update(secret, name)
     }
 
 }

Sources/Packages/Sources/SecretKit/KeychainTypes.swift

@@ -51,17 +51,19 @@ public extension SecretStore {
     /// Returns the appropriate keychian signature algorithm to use for a given secret.
     /// - Parameters:
     ///   - secret: The secret which will be used for signing.
+    ///   - allowRSA: Whether or not RSA key types should be permited.
     /// - Returns: The appropriate algorithm.
-    func signatureAlgorithm(for secret: SecretType) -> SecKeyAlgorithm? {
-        switch secret.keyType {
-        case .ecdsa256:
-            .ecdsaSignatureMessageX962SHA256
-        case .ecdsa384:
-            .ecdsaSignatureMessageX962SHA384
-        case .rsa2048:
-            .rsaSignatureMessagePKCS1v15SHA512
+    func signatureAlgorithm(for secret: SecretType, allowRSA: Bool = false) -> SecKeyAlgorithm {
+        switch (secret.algorithm, secret.keySize) {
+        case (.ellipticCurve, 256):
+            return .ecdsaSignatureMessageX962SHA256
+        case (.ellipticCurve, 384):
+            return .ecdsaSignatureMessageX962SHA384
+        case (.rsa, 1024), (.rsa, 2048):
+            guard allowRSA else { fatalError() }
+            return .rsaSignatureMessagePKCS1v15SHA512
         default:
-            nil
+            fatalError()
         }
 
     }

Sources/Packages/Sources/SecretKit/OpenSSH/LengthAndData.swift

@@ -1,23 +0,0 @@
-import Foundation
-
-extension Data {
-
-    /// Creates an OpenSSH protocol style data object, which has a length header, followed by the data payload.
-    /// - Returns: OpenSSH data.
-    package var lengthAndData: Data {
-        let rawLength = UInt32(count)
-        var endian = rawLength.bigEndian
-        return Data(bytes: &endian, count: UInt32.bitWidth/8) + self
-    }
-
-}
-
-extension String {
-
-    /// Creates an OpenSSH protocol style data object, which has a length header, followed by the data payload.
-    /// - Returns: OpenSSH data.
-    package var lengthAndData: Data {
-        Data(utf8).lengthAndData
-    }
-
-}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift

@@ -1,13 +1,14 @@
 import Foundation
 import OSLog
+import os
 
 /// Manages storage and lookup for OpenSSH certificates.
-public actor OpenSSHCertificateHandler: Sendable {
+public final class OpenSSHCertificateHandler: Sendable {
 
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: URL.homeDirectory)
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler")
-    private let writer = OpenSSHPublicKeyWriter()
-    private var keyBlobsAndNames: [AnySecret: (Data, Data)] = [:]
+    private let writer = OpenSSHKeyWriter()
+    private let keyBlobsAndNames: OSAllocatedUnfairLock<[AnySecret: (Data, Data)]> = .init(uncheckedState: [:])
 
     /// Initializes an OpenSSHCertificateHandler.
     public init() {
@@ -20,17 +21,28 @@ public actor OpenSSHCertificateHandler: Sendable {
             logger.log("No certificates, short circuiting")
             return
         }
-        keyBlobsAndNames = secrets.reduce(into: [:]) { partialResult, next in
-            partialResult[next] = try? loadKeyblobAndName(for: next)
+        keyBlobsAndNames.withLock {
+            $0 = secrets.reduce(into: [:]) { partialResult, next in
+                partialResult[next] = try? loadKeyblobAndName(for: next)
+            }
         }
     }
 
+    /// Whether or not the certificate handler has a certifiicate associated with a given secret.
+    /// - Parameter secret: The secret to check for a certificate.
+    /// - Returns: A boolean describing whether or not the certificate handler has a certifiicate associated with a given secret
+    public func hasCertificate<SecretType: Secret>(for secret: SecretType) -> Bool {
+        keyBlobsAndNames.lockedValue[AnySecret(secret)] != nil
+    }
+
+
     /// Reconstructs a public key from a ``Data``, if that ``Data`` contains an OpenSSH certificate hash. Currently only ecdsa certificates are supported
     /// - Parameter certBlock: The openssh certificate to extract the public key from
     /// - Returns: A ``Data`` object containing the public key in OpenSSH wire format if the ``Data`` is an OpenSSH certificate hash, otherwise nil.
     public func publicKeyHash(from hash: Data) -> Data? {
         let reader = OpenSSHReader(data: hash)
         let certType = String(decoding: reader.readNextChunk(), as: UTF8.self)
+
         switch certType {
         case "ecdsa-sha2-nistp256-cert-v01@openssh.com",
             "ecdsa-sha2-nistp384-cert-v01@openssh.com",
@@ -39,10 +51,10 @@ public actor OpenSSHCertificateHandler: Sendable {
             let curveIdentifier = reader.readNextChunk()
             let publicKey = reader.readNextChunk()
 
-            let openSSHIdentifier = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "")
-            return openSSHIdentifier.lengthAndData +
-            curveIdentifier.lengthAndData +
-            publicKey.lengthAndData
+            let curveType = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "").data(using: .utf8)!
+            return writer.lengthAndData(of: curveType) +
+                   writer.lengthAndData(of: curveIdentifier) +
+                   writer.lengthAndData(of: publicKey)
         default:
             return nil
         }
@@ -52,7 +64,7 @@ public actor OpenSSHCertificateHandler: Sendable {
     /// - Parameter secret: The secret to search for a certificate with
     /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
     public func keyBlobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? {
-        keyBlobsAndNames[AnySecret(secret)]
+        keyBlobsAndNames.lockedValue[AnySecret(secret)]
     }
     
     /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
@@ -77,13 +89,14 @@ public actor OpenSSHCertificateHandler: Sendable {
             throw OpenSSHCertificateError.parsingFailed
         }
 
-        if certElements.count >= 3 {
-            let certName = Data(certElements[2].utf8)
+        if certElements.count >= 3, let certName = certElements[2].data(using: .utf8) {
             return (certDecoded, certName)
+        } else if let certName = secret.name.data(using: .utf8) {
+            logger.info("Certificate for \(secret.name) does not have a name tag, using secret name instead")
+            return (certDecoded, certName)
+        } else {
+            throw OpenSSHCertificateError.parsingFailed
         }
-        let certName = Data(secret.name.utf8)
-        logger.info("Certificate for \(secret.name) does not have a name tag, using secret name instead")
-        return (certDecoded, certName)
     }
 
 }

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift

@@ -0,0 +1,89 @@
+import Foundation
+import CryptoKit
+
+/// Generates OpenSSH representations of Secrets.
+public struct OpenSSHKeyWriter: Sendable {
+
+    /// Initializes the writer.
+    public init() {
+    }
+
+    /// Generates an OpenSSH data payload identifying the secret.
+    /// - Returns: OpenSSH data payload identifying the secret.
+    public func data<SecretType: Secret>(secret: SecretType) -> Data {
+        lengthAndData(of: curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!) +
+            lengthAndData(of: curveIdentifier(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!) +
+            lengthAndData(of: secret.publicKey)
+    }
+
+    /// Generates an OpenSSH string representation of the secret.
+    /// - Returns: OpenSSH string representation of the secret.
+    public func openSSHString<SecretType: Secret>(secret: SecretType, comment: String? = nil) -> String {
+        [curveType(for: secret.algorithm, length: secret.keySize), data(secret: secret).base64EncodedString(), comment]
+            .compactMap { $0 }
+            .joined(separator: " ")
+    }
+
+    /// Generates an OpenSSH SHA256 fingerprint string.
+    /// - Returns: OpenSSH SHA256 fingerprint string.
+    public func openSSHSHA256Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
+        // OpenSSL format seems to strip the padding at the end.
+        let base64 = Data(SHA256.hash(data: data(secret: secret))).base64EncodedString()
+        let paddingRange = base64.index(base64.endIndex, offsetBy: -2)..<base64.endIndex
+        let cleaned = base64.replacingOccurrences(of: "=", with: "", range: paddingRange)
+        return "SHA256:\(cleaned)"
+    }
+
+    /// Generates an OpenSSH MD5 fingerprint string.
+    /// - Returns: OpenSSH MD5 fingerprint string.
+    public func openSSHMD5Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
+        Insecure.MD5.hash(data: data(secret: secret))
+            .compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
+            .joined(separator: ":")
+    }
+
+}
+
+extension OpenSSHKeyWriter {
+
+    /// Creates an OpenSSH protocol style data object, which has a length header, followed by the data payload.
+    /// - Parameter data: The data payload.
+    /// - Returns: OpenSSH data.
+    public func lengthAndData(of data: Data) -> Data {
+        let rawLength = UInt32(data.count)
+        var endian = rawLength.bigEndian
+        return Data(bytes: &endian, count: UInt32.bitWidth/8) + data
+    }
+
+    /// The fully qualified OpenSSH identifier for the algorithm.
+    /// - Parameters:
+    ///   - algorithm: The algorithm to identify.
+    ///   - length: The key length of the algorithm.
+    /// - Returns: The OpenSSH identifier for the algorithm.
+    public func curveType(for algorithm: Algorithm, length: Int) -> String {
+        switch algorithm {
+        case .ellipticCurve:
+            return "ecdsa-sha2-nistp" + String(describing: length)
+        case .rsa:
+            // All RSA keys use the same 512 bit hash function, per
+            // https://security.stackexchange.com/questions/255074/why-are-rsa-sha2-512-and-rsa-sha2-256-supported-but-not-reported-by-ssh-q-key
+            return "rsa-sha2-512"
+        }
+    }
+
+    /// The OpenSSH identifier for an algorithm.
+    /// - Parameters:
+    ///   - algorithm: The algorithm to identify.
+    ///   - length: The key length of the algorithm.
+    /// - Returns: The OpenSSH identifier for the algorithm.
+    private func curveIdentifier(for algorithm: Algorithm, length: Int) -> String {
+        switch algorithm {
+        case .ellipticCurve:
+            return "nistp" + String(describing: length)
+        case .rsa:
+            // All RSA keys use the same 512 bit hash function
+            return "rsa-sha2-512"
+        }
+    }
+
+}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHPublicKeyWriter.swift

@@ -1,114 +0,0 @@
-import Foundation
-import CryptoKit
-
-/// Generates OpenSSH representations of the public key sof secrets.
-public struct OpenSSHPublicKeyWriter: Sendable {
-
-    /// Initializes the writer.
-    public init() {
-    }
-
-    /// Generates an OpenSSH data payload identifying the secret.
-    /// - Returns: OpenSSH data payload identifying the secret.
-    public func data<SecretType: Secret>(secret: SecretType) -> Data {
-        switch secret.keyType.algorithm {
-        case .ecdsa:
-            // https://datatracker.ietf.org/doc/html/rfc5656#section-3.1
-            openSSHIdentifier(for: secret.keyType).lengthAndData +
-            ("nistp" + String(describing: secret.keyType.size)).lengthAndData +
-            secret.publicKey.lengthAndData
-        case .mldsa:
-            // https://www.ietf.org/archive/id/draft-sfluhrer-ssh-mldsa-04.txt
-            openSSHIdentifier(for: secret.keyType).lengthAndData +
-            secret.publicKey.lengthAndData
-        case .rsa:
-            // https://datatracker.ietf.org/doc/html/rfc4253#section-6.6
-            openSSHIdentifier(for: secret.keyType).lengthAndData +
-            rsaPublicKeyBlob(secret: secret)
-        }
-    }
-
-    /// Generates an OpenSSH string representation of the secret.
-    /// - Returns: OpenSSH string representation of the secret.
-    public func openSSHString<SecretType: Secret>(secret: SecretType) -> String {
-        return [openSSHIdentifier(for: secret.keyType), data(secret: secret).base64EncodedString(), comment(secret: secret)]
-            .compactMap { $0 }
-            .joined(separator: " ")
-    }
-
-    /// Generates an OpenSSH SHA256 fingerprint string.
-    /// - Returns: OpenSSH SHA256 fingerprint string.
-    public func openSSHSHA256Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
-        // OpenSSL format seems to strip the padding at the end.
-        let base64 = Data(SHA256.hash(data: data(secret: secret))).base64EncodedString()
-        let paddingRange = base64.index(base64.endIndex, offsetBy: -2)..<base64.endIndex
-        let cleaned = base64.replacingOccurrences(of: "=", with: "", range: paddingRange)
-        return "SHA256:\(cleaned)"
-    }
-
-    /// Generates an OpenSSH MD5 fingerprint string.
-    /// - Returns: OpenSSH MD5 fingerprint string.
-    public func openSSHMD5Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
-        Insecure.MD5.hash(data: data(secret: secret))
-            .compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
-            .joined(separator: ":")
-    }
-
-    public func comment<SecretType: Secret>(secret: SecretType) -> String {
-        if let comment = secret.publicKeyAttribution {
-            return comment
-        } else {
-            let dashedKeyName = secret.name.replacingOccurrences(of: " ", with: "-")
-            let dashedHostName = ["secretive", Host.current().localizedName, "local"]
-                .compactMap { $0 }
-                .joined(separator: ".")
-                .replacingOccurrences(of: " ", with: "-")
-            return "\(dashedKeyName)@\(dashedHostName)"
-        }
-
-    }
-}
-
-extension OpenSSHPublicKeyWriter {
-
-    /// The fully qualified OpenSSH identifier for the algorithm.
-    /// - Parameters:
-    ///   - algorithm: The algorithm to identify.
-    ///   - length: The key length of the algorithm.
-    /// - Returns: The OpenSSH identifier for the algorithm.
-    public func openSSHIdentifier(for keyType: KeyType) -> String {
-        switch keyType {
-        case .ecdsa256:
-            "ecdsa-sha2-nistp256"
-        case .ecdsa384:
-            "ecdsa-sha2-nistp384"
-        case .mldsa65:
-            "ssh-mldsa-65"
-        case .mldsa87:
-            "ssh-mldsa-87"
-        case .rsa2048:
-            "ssh-rsa"
-        default:
-            "unknown"
-        }
-    }
-
-}
-
-extension OpenSSHPublicKeyWriter {
-
-    public func rsaPublicKeyBlob<SecretType: Secret>(secret: SecretType) -> Data {
-        // Cheap way to pull out e and n as defined in https://datatracker.ietf.org/doc/html/rfc4253
-        // Keychain stores it as a thin ASN.1 wrapper with this format:
-        // [4 byte prefix][2 byte prefix][n][2 byte prefix][e]
-        // Rather than parse out the whole ASN.1 blob, we'll cheat and pull values directly since
-        // we only support one key type, and the keychain always gives it in a specific format.
-        guard secret.keyType == .rsa2048 else { fatalError() }
-        let length = secret.keyType.size/8
-        let data = secret.publicKey
-        let n = Data(data[8..<(9+length)])
-        let e = Data(data[(2+9+length)...])
-        return e.lengthAndData + n.lengthAndData
-    }
-
-}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHReader.swift

@@ -17,7 +17,9 @@ public final class OpenSSHReader {
         let lengthRange = 0..<(UInt32.bitWidth/8)
         let lengthChunk = remaining[lengthRange]
         remaining.removeSubrange(lengthRange)
-        let littleEndianLength = lengthChunk.bytes.unsafeLoad(as: UInt32.self)
+        let littleEndianLength = lengthChunk.withUnsafeBytes { pointer in
+            return pointer.load(as: UInt32.self)
+        }
         let length = Int(littleEndianLength.bigEndian)
         let dataRange = 0..<length
         let ret = Data(remaining[dataRange])

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHSignatureWriter.swift

@@ -1,75 +0,0 @@
-import Foundation
-import CryptoKit
-
-/// Generates OpenSSH representations of Secrets.
-public struct OpenSSHSignatureWriter: Sendable {
-
-    /// Initializes the writer.
-    public init() {
-    }
-
-    /// Generates an OpenSSH data payload identifying the secret.
-    /// - Returns: OpenSSH data payload identifying the secret.
-    public func data<SecretType: Secret>(secret: SecretType, signature: Data) -> Data {
-        switch secret.keyType.algorithm {
-        case .ecdsa:
-            // https://datatracker.ietf.org/doc/html/rfc5656#section-3.1
-            ecdsaSignature(signature, keyType: secret.keyType)
-        case .mldsa:
-            // https://datatracker.ietf.org/doc/html/draft-sfluhrer-ssh-mldsa-00#name-public-key-algorithms
-            mldsaSignature(signature, keyType: secret.keyType)
-        case .rsa:
-            // https://datatracker.ietf.org/doc/html/rfc4253#section-6.6
-            rsaSignature(signature)
-        }
-    }
-
-}
-
-
-extension OpenSSHSignatureWriter {
-
-    func ecdsaSignature(_ rawRepresentation: Data, keyType: KeyType) -> Data {
-        let rawLength = rawRepresentation.count/2
-        // Check if we need to pad with 0x00 to prevent certain
-        // ssh servers from thinking r or s is negative
-        let paddingRange: ClosedRange<UInt8> = 0x80...0xFF
-        var r = Data(rawRepresentation[0..<rawLength])
-        if paddingRange ~= r.first! {
-            r.insert(0x00, at: 0)
-        }
-        var s = Data(rawRepresentation[rawLength...])
-        if paddingRange ~= s.first! {
-            s.insert(0x00, at: 0)
-        }
-
-        var signatureChunk = Data()
-        signatureChunk.append(r.lengthAndData)
-        signatureChunk.append(s.lengthAndData)
-        var mutSignedData = Data()
-        var sub = Data()
-        sub.append(OpenSSHPublicKeyWriter().openSSHIdentifier(for: keyType).lengthAndData)
-        sub.append(signatureChunk.lengthAndData)
-        mutSignedData.append(sub.lengthAndData)
-        return mutSignedData
-    }
-
-    func mldsaSignature(_ rawRepresentation: Data, keyType: KeyType) -> Data {
-        var mutSignedData = Data()
-        var sub = Data()
-        sub.append(OpenSSHPublicKeyWriter().openSSHIdentifier(for: keyType).lengthAndData)
-        sub.append(rawRepresentation.lengthAndData)
-        mutSignedData.append(sub.lengthAndData)
-        return mutSignedData
-    }
-
-    func rsaSignature(_ rawRepresentation: Data) -> Data {
-        var mutSignedData = Data()
-        var sub = Data()
-        sub.append("rsa-sha2-512".lengthAndData)
-        sub.append(rawRepresentation.lengthAndData)
-        mutSignedData.append(sub.lengthAndData)
-        return mutSignedData
-    }
-
-}

Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift

@@ -5,12 +5,12 @@ import OSLog
 public final class PublicKeyFileStoreController: Sendable {
 
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController")
-    private let directory: URL
-    private let keyWriter = OpenSSHPublicKeyWriter()
+    private let directory: String
+    private let keyWriter = OpenSSHKeyWriter()
 
     /// Initializes a PublicKeyFileStoreController.
-    public init(homeDirectory: URL) {
-        directory = homeDirectory.appending(component: "PublicKeys")
+    public init(homeDirectory: String) {
+        directory = homeDirectory.appending("/PublicKeys")
     }
 
     /// Writes out the keys specified to disk.
@@ -20,20 +20,19 @@ public final class PublicKeyFileStoreController: Sendable {
         logger.log("Writing public keys to disk")
         if clear {
             let validPaths = Set(secrets.map { publicKeyPath(for: $0) }).union(Set(secrets.map { sshCertificatePath(for: $0) }))
-            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: directory.path())) ?? []
+            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: directory)) ?? []
             let fullPathContents = contentsOfDirectory.map { "\(directory)/\($0)" }
 
             let untracked = Set(fullPathContents)
                 .subtracting(validPaths)
             for path in untracked {
-                // string instead of fileURLWithPath since we're already using fileURL format.
-                try? FileManager.default.removeItem(at: URL(string: path)!)
+                try? FileManager.default.removeItem(at: URL(fileURLWithPath: path))
             }
         }
-        try? FileManager.default.createDirectory(at: directory, withIntermediateDirectories: false, attributes: nil)
+        try? FileManager.default.createDirectory(at: URL(fileURLWithPath: directory), withIntermediateDirectories: false, attributes: nil)
         for secret in secrets {
             let path = publicKeyPath(for: secret)
-            let data = Data(keyWriter.openSSHString(secret: secret).utf8)
+            guard let data = keyWriter.openSSHString(secret: secret).data(using: .utf8) else { continue }
             FileManager.default.createFile(atPath: path, contents: data, attributes: nil)
         }
         logger.log("Finished writing public keys")
@@ -45,14 +44,14 @@ public final class PublicKeyFileStoreController: Sendable {
     /// - Warning: This method returning a path does not imply that a key has been written to disk already. This method only describes where it will be written to.
     public func publicKeyPath<SecretType: Secret>(for secret: SecretType) -> String {
         let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
-        return directory.appending(component: "\(minimalHex).pub").path()
+        return directory.appending("/").appending("\(minimalHex).pub")
     }
 
     /// Short-circuit check to ship enumerating a bunch of paths if there's nothing in the cert directory.
     public var hasAnyCertificates: Bool {
         do {
             return try FileManager.default
-                .contentsOfDirectory(atPath: directory.path())
+                .contentsOfDirectory(atPath: directory)
                 .filter { $0.hasSuffix("-cert.pub") }
                 .isEmpty == false
         } catch {
@@ -66,7 +65,7 @@ public final class PublicKeyFileStoreController: Sendable {
     /// - Warning: This method returning a path does not imply that a key has a SSH certificates. This method only describes where it will be.
     public func sshCertificatePath<SecretType: Secret>(for secret: SecretType) -> String {
         let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
-        return directory.appending(component: "\(minimalHex)-cert.pub").path()
+        return directory.appending("/").appending("\(minimalHex)-cert.pub")
     }
 
 }

Sources/Packages/Sources/SecretKit/SecretStoreList.swift

@@ -1,47 +1,50 @@
 import Foundation
 import Observation
+import os
+import Common
 
 /// A "Store Store," which holds a list of type-erased stores.
-@Observable @MainActor public final class SecretStoreList: Sendable {
+@Observable public final class SecretStoreList: Sendable {
 
     /// The Stores managed by the SecretStoreList.
-    public var stores: [AnySecretStore] = []
+    public var stores: [AnySecretStore] {
+        __stores.lockedValue
+    }
+    private let __stores: OSAllocatedUnfairLock<[AnySecretStore]> = .init(uncheckedState: [])
+    
     /// A modifiable store, if one is available.
-    public var modifiableStore: AnySecretStoreModifiable? = nil
+    public var modifiableStore: AnySecretStoreModifiable? {
+        __modifiableStore.withLock { $0 }
+    }
+    private let __modifiableStore: OSAllocatedUnfairLock<AnySecretStoreModifiable?> = .init(uncheckedState: nil)
 
     /// Initializes a SecretStoreList.
-    public nonisolated init() {
+    public init() {
     }
 
     /// Adds a non-type-erased SecretStore to the list.
     public func add<SecretStoreType: SecretStore>(store: SecretStoreType) {
-        stores.append(AnySecretStore(store))
+        __stores.withLock {
+            $0.append(AnySecretStore(store))
+        }
     }
 
     /// Adds a non-type-erased modifiable SecretStore.
     public func add<SecretStoreType: SecretStoreModifiable>(store: SecretStoreType) {
-        let modifiable = AnySecretStoreModifiable(store)
-        if modifiableStore == nil {
-            modifiableStore = modifiable
+        let modifiable = AnySecretStoreModifiable(modifiable: store)
+        __modifiableStore.lockedValue = modifiable
+        __stores.withLock {
+            $0.append(modifiable)
         }
-        stores.append(modifiable)
     }
 
     /// A boolean describing whether there are any Stores available.
     public var anyAvailable: Bool {
-        stores.contains(where: \.isAvailable)
+        __stores.lockedValue.contains(where: \.isAvailable)
     }
 
     public var allSecrets: [AnySecret] {
-        stores.flatMap(\.secrets)
-    }
-
-    public var allSecretsWithStores: [(AnySecret, AnySecretStore)] {
-        stores.flatMap { store in
-            store.secrets.map { secret in
-                (secret, store)
-            }
-        }
+        __stores.lockedValue.flatMap(\.secrets)
     }
 
 }

Sources/Packages/Sources/SecretKit/Types/CreationOptions.swift

@@ -1,55 +0,0 @@
-import Foundation
-
-public struct Attributes: Sendable, Codable, Hashable {
-    
-    /// The type of key involved.
-    public let keyType: KeyType
-
-    /// The authentication requirements for the key. This is simply a description of the option recorded at creation – modifying it doers not modify the key's authentication requirements.
-    public let authentication: AuthenticationRequirement
-    
-    /// The string appended to the end of the SSH Public Key.
-    /// If nil, a default value will be used.
-    public var publicKeyAttribution: String?
-
-    public init(
-        keyType: KeyType,
-        authentication: AuthenticationRequirement,
-        publicKeyAttribution: String? = nil
-    ) {
-        self.keyType = keyType
-        self.authentication = authentication
-        self.publicKeyAttribution = publicKeyAttribution
-    }
-
-    public struct UnsupportedOptionError: Error {
-        package init() {}
-    }
-    
-}
-
-/// The option specified
-public enum AuthenticationRequirement: String, Hashable, Sendable, Codable, Identifiable {
-
-    /// Authentication is not required for usage.
-    case notRequired
-    
-    /// The user needs to authenticate, using either a biometric option, a connected authorized watch, or password entry..
-    case presenceRequired
-    
-    /// ONLY the current set of biometric data, as matching at time of creation, is accepted.
-    /// - Warning: This is a dangerous option prone to data loss. The user should be warned before configuring this key that if they modify their enrolled biometry INCLUDING by simply adding a new entry (ie, adding another fingeprting), the key will no longer be able to be accessed. This cannot be overridden with a password.
-    case biometryCurrent
-    
-    /// The authentication requirement was not recorded at creation, and is unknown.
-    case unknown
-    
-    /// Whether or not the key is known to require authentication.
-    public var required: Bool {
-        self == .presenceRequired || self == .biometryCurrent
-    }
-
-    public var id: AuthenticationRequirement {
-        self
-    }
-}

Sources/Packages/Sources/SecretKit/Types/Secret.swift

@@ -5,81 +5,43 @@ public protocol Secret: Identifiable, Hashable, Sendable {
 
     /// A user-facing string identifying the Secret.
     var name: String { get }
+    /// The algorithm this secret uses.
+    var algorithm: Algorithm { get }
+    /// The key size for the secret.
+    var keySize: Int { get }
+    /// Whether the secret requires authentication before use.
+    var requiresAuthentication: Bool { get }
     /// The public key data for the secret.
     var publicKey: Data { get }
-    /// The attributes of the key.
-    var attributes: Attributes { get }
 
 }
 
-public extension Secret {
+/// The type of algorithm the Secret uses. Currently, only elliptic curve algorithms are supported.
+public enum Algorithm: Hashable, Sendable {
 
-    /// The algorithm and key size this secret uses.
-    var keyType: KeyType {
-        attributes.keyType
-    }
-
-    /// Whether the secret requires authentication before use.
-    var authenticationRequirement: AuthenticationRequirement {
-        attributes.authentication
-    }
-    /// An attribution string to apply to the generated public key.
-    var publicKeyAttribution: String? {
-        attributes.publicKeyAttribution
-    }
-
-}
-
-/// The type of algorithm the Secret uses.
-public struct KeyType: Hashable, Sendable, Codable, CustomStringConvertible {
-
-    public static let ecdsa256 = KeyType(algorithm: .ecdsa, size: 256)
-    public static let ecdsa384 = KeyType(algorithm: .ecdsa, size: 384)
-    public static let mldsa65 = KeyType(algorithm: .mldsa, size: 65)
-    public static let mldsa87 = KeyType(algorithm: .mldsa, size: 87)
-    public static let rsa2048 = KeyType(algorithm: .rsa, size: 2048)
-
-    public enum Algorithm: Hashable, Sendable, Codable {
-        case ecdsa
-        case mldsa
-        case rsa
-    }
-
-    public var algorithm: Algorithm
-    public var size: Int
-
-    public init(algorithm: Algorithm, size: Int) {
-        self.algorithm = algorithm
-        self.size = size
-    }
+    case ellipticCurve
+    case rsa
 
     /// Initializes the Algorithm with a secAttr representation of an algorithm.
     /// - Parameter secAttr: the secAttr, represented as an NSNumber.
-    public init?(secAttr: NSNumber, size: Int) {
+    public init(secAttr: NSNumber) {
         let secAttrString = secAttr.stringValue as CFString
         switch secAttrString {
         case kSecAttrKeyTypeEC:
-            algorithm = .ecdsa
+            self = .ellipticCurve
         case kSecAttrKeyTypeRSA:
-            algorithm = .rsa
+            self = .rsa
         default:
-            return nil
+            fatalError()
         }
-        self.size = size
     }
     
-    public var secAttrKeyType: CFString? {
-        switch algorithm {
-        case .ecdsa:
-            kSecAttrKeyTypeEC
+    public var secAttrKeyType: CFString {
+        switch self {
+        case .ellipticCurve:
+            return kSecAttrKeyTypeEC
         case .rsa:
-            kSecAttrKeyTypeRSA
-        case .mldsa:
-            nil
+            return kSecAttrKeyTypeRSA
         }
     }
-    
-    public var description: String {
-        "\(algorithm)-\(size)"
-    }
 }

Sources/Packages/Sources/SecretKit/Types/SecretStore.swift

@@ -1,18 +1,19 @@
 import Foundation
+import Combine
 
 /// Manages access to Secrets, and performs signature operations on data using those Secrets.
-public protocol SecretStore<SecretType>: Identifiable, Sendable {
+public protocol SecretStore: Identifiable, Sendable {
 
     associatedtype SecretType: Secret
 
     /// A boolean indicating whether or not the store is available.
-    @MainActor var isAvailable: Bool { get }
+    var isAvailable: Bool { get }
     /// A unique identifier for the store.
     var id: UUID { get }
     /// A user-facing name for the store.
-    @MainActor var name: String { get }
+    var name: String { get }
     /// The secrets the store manages.
-    @MainActor var secrets: [SecretType] { get }
+    var secrets: [SecretType] { get }
 
     /// Signs a data payload with a specified Secret.
     /// - Parameters:
@@ -22,6 +23,14 @@ public protocol SecretStore<SecretType>: Identifiable, Sendable {
     /// - Returns: The signed data.
     func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) async throws -> Data
 
+    /// Verifies that a signature is valid over a specified payload.
+    /// - Parameters:
+    ///   - signature: The signature over the data.
+    ///   - data: The data to verify the signature of.
+    ///   - secret: The secret whose signature to verify.
+    /// - Returns: Whether the signature was verified.
+    func verify(signature: Data, for data: Data, with secret: SecretType) async throws -> Bool
+
     /// Checks to see if there is currently a valid persisted authentication for a given secret.
     /// - Parameters:
     ///   - secret: The ``Secret`` to check if there is a persisted authentication for.
@@ -41,14 +50,13 @@ public protocol SecretStore<SecretType>: Identifiable, Sendable {
 }
 
 /// A SecretStore that the Secretive admin app can modify.
-public protocol SecretStoreModifiable<SecretType>: SecretStore {
+public protocol SecretStoreModifiable: SecretStore {
 
     /// Creates a new ``Secret`` in the store.
     /// - Parameters:
     ///   - name: The user-facing name for the ``Secret``.
-    ///   - attributes: A struct describing the options for creating the key.'
-    @discardableResult
-    func create(name: String, attributes: Attributes) async throws -> SecretType
+    ///   - requiresAuthentication: A boolean indicating whether or not the user will be required to authenticate before performing signature operations with the secret.
+    func create(name: String, requiresAuthentication: Bool) async throws
 
     /// Deletes a Secret in the store.
     /// - Parameters:
@@ -59,10 +67,7 @@ public protocol SecretStoreModifiable<SecretType>: SecretStore {
     /// - Parameters:
     ///   - secret: The ``Secret`` to update.
     ///   - name: The new name for the Secret.
-    ///   - attributes: The new attributes for the secret.
-    func update(secret: SecretType, name: String, attributes: Attributes) async throws
-
-    var supportedKeyTypes: [KeyType] { get }
+    func update(secret: SecretType, name: String) async throws
 
 }
 

Sources/Packages/Sources/SecureEnclaveSecretKit/CryptoKitMigrator.swift

@@ -1,103 +0,0 @@
-import Foundation
-import Security
-import CryptoTokenKit
-import CryptoKit
-import SecretKit
-import os
-
-extension SecureEnclave {
-
-    public struct CryptoKitMigrator {
-
-        private let logger = Logger(subsystem: "com.maxgoedjen.secretive.migration", category: "CryptoKitMigrator")
-
-        public init() {
-        }
-        
-        /// Keys prior to 3.0 were created and stored directly using the keychain as kSecClassKey items. CryptoKit operates a little differently, in that it creates a key on your behalf which you can persist using an opaque data blob to a generic keychain item. Keychain created keys _also_ use this blob under the hood, but it's stored in the "toid" attribute. This migrates the old keys from kSecClassKey to generic items, copying the "toid" to be the main stored data. If the key is migrated successfully, the old key's identifier is renamed to indicate it's been migrated.
-        /// - Note: Migration is non-destructive – users can still see and use their keys in older versions of Secretive.
-        @MainActor public func migrate(to store: Store) throws {
-            let privateAttributes = KeychainDictionary([
-                kSecClass: kSecClassKey,
-                kSecAttrKeyType: Constants.oldKeyType,
-                kSecAttrApplicationTag: SecureEnclave.Store.Constants.keyTag,
-                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-                kSecReturnRef: true,
-                kSecMatchLimit: kSecMatchLimitAll,
-                kSecReturnAttributes: true
-            ])
-            var privateUntyped: CFTypeRef?
-            SecItemCopyMatching(privateAttributes, &privateUntyped)
-            guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
-            let migratedPublicKeys = Set(store.secrets.map(\.publicKey))
-            var migratedAny = false
-            for key in privateTyped {
-                let name = key[kSecAttrLabel] as? String ?? String(localized: .unnamedSecret)
-                let id = key[kSecAttrApplicationLabel] as! Data
-                guard !id.contains(Constants.migrationMagicNumber) else {
-                    logger.log("Skipping \(name), already migrated.")
-                    continue
-                }
-                let ref = key[kSecValueRef] as! SecKey
-                let attributes = SecKeyCopyAttributes(ref) as! [CFString: Any]
-                let tokenObjectID = attributes[Constants.tokenObjectID] as! Data
-                let accessControl = attributes[kSecAttrAccessControl] as! SecAccessControl
-                // Best guess.
-                let auth: AuthenticationRequirement = String(describing: accessControl)
-                    .contains("DeviceOwnerAuthentication") ? .presenceRequired : .unknown
-                do {
-                    let parsed = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: tokenObjectID)
-                    let secret = Secret(id: UUID().uuidString, name: name, publicKey: parsed.publicKey.x963Representation, attributes: Attributes(keyType: .init(algorithm: .ecdsa, size: 256), authentication: auth))
-                    guard !migratedPublicKeys.contains(parsed.publicKey.x963Representation) else {
-                        logger.log("Skipping \(name), public key already present. Marking as migrated.")
-                        try markMigrated(secret: secret, oldID: id)
-                        continue
-                    }
-                    logger.log("Migrating \(name).")
-                    try store.saveKey(tokenObjectID, name: name, attributes: secret.attributes)
-                    logger.log("Migrated \(name).")
-                    try markMigrated(secret: secret, oldID: id)
-                    migratedAny = true
-                } catch {
-                    logger.error("Failed to migrate \(name): \(error).")
-                }
-            }
-            if migratedAny {
-                store.reloadSecrets()
-            }
-        }
-
-
-
-        public func markMigrated(secret: Secret, oldID: Data) throws {
-            let updateQuery = KeychainDictionary([
-                kSecClass: kSecClassKey,
-                kSecAttrApplicationLabel: secret.id
-            ])
-
-            let newID = oldID + Constants.migrationMagicNumber
-            let updatedAttributes = KeychainDictionary([
-                kSecAttrApplicationLabel: newID as CFData
-            ])
-
-            let status = SecItemUpdate(updateQuery, updatedAttributes)
-            if status != errSecSuccess {
-                throw KeychainError(statusCode: status)
-            }
-        }
-
-
-    }
-
-}
-
-extension SecureEnclave.CryptoKitMigrator {
-
-    enum Constants {
-        public static let oldKeyType = kSecAttrKeyTypeECSECPrimeRandom as String
-        public static let migrationMagicNumber = Data("_cryptokit_1".utf8)
-        // https://github.com/apple-opensource/Security/blob/5e9101b3bd1fb096bae4f40e79d50426ba1db8e9/OSX/sec/Security/SecItemConstants.c#L111
-        public static nonisolated(unsafe) let tokenObjectID = "toid" as CFString
-    }
-
-}

Sources/Packages/Sources/SecureEnclaveSecretKit/PersistentAuthenticationHandler.swift

@@ -1,72 +0,0 @@
-import LocalAuthentication
-import SecretKit
-
-extension SecureEnclave {
-
-    /// A context describing a persisted authentication.
-    final class PersistentAuthenticationContext: PersistedAuthenticationContext {
-
-        /// The Secret to persist authentication for.
-        let secret: Secret
-        /// The LAContext used to authorize the persistent context.
-        nonisolated(unsafe) let context: LAContext
-        /// An expiration date for the context.
-        /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
-        let monotonicExpiration: UInt64
-
-        /// Initializes a context.
-        /// - Parameters:
-        ///   - secret: The Secret to persist authentication for.
-        ///   - context: The LAContext used to authorize the persistent context.
-        ///   - duration: The duration of the authorization context, in seconds.
-        init(secret: Secret, context: LAContext, duration: TimeInterval) {
-            self.secret = secret
-            self.context = context
-            let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
-            self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
-        }
-
-        /// A boolean describing whether or not the context is still valid.
-        var valid: Bool {
-            clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
-        }
-
-        var expiration: Date {
-            let remainingNanoseconds = monotonicExpiration - clock_gettime_nsec_np(CLOCK_MONOTONIC)
-            let remainingInSeconds = Measurement(value: Double(remainingNanoseconds), unit: UnitDuration.nanoseconds).converted(to: .seconds).value
-            return Date(timeIntervalSinceNow: remainingInSeconds)
-        }
-    }
-
-    actor PersistentAuthenticationHandler: Sendable {
-
-        private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:]
-
-        func existingPersistedAuthenticationContext(secret: Secret) -> PersistentAuthenticationContext? {
-            guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
-            return persisted
-        }
-
-        func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) async throws {
-            let newContext = LAContext()
-            newContext.touchIDAuthenticationAllowableReuseDuration = duration
-            newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-
-            let formatter = DateComponentsFormatter()
-            formatter.unitsStyle = .spellOut
-            formatter.allowedUnits = [.hour, .minute, .day]
-
-            if let durationString = formatter.string(from: duration) {
-                newContext.localizedReason = String(localized: .authContextPersistForDuration(secretName: secret.name, duration: durationString))
-            } else {
-                newContext.localizedReason = String(localized: .authContextPersistForDurationUnknown(secretName: secret.name))
-            }
-            let success = try await newContext.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: newContext.localizedReason)
-            guard success else { return }
-            let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
-            persistedAuthenticationContexts[secret] = context
-        }
-
-    }
-
-}

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveSecret.swift

@@ -1,4 +1,5 @@
 import Foundation
+import Combine
 import SecretKit
 
 extension SecureEnclave {
@@ -6,26 +7,12 @@ extension SecureEnclave {
     /// An implementation of Secret backed by the Secure Enclave.
     public struct Secret: SecretKit.Secret {
 
-        public let id: String
+        public let id: Data
         public let name: String
+        public let algorithm = Algorithm.ellipticCurve
+        public let keySize = 256
+        public let requiresAuthentication: Bool
         public let publicKey: Data
-        public let attributes: Attributes
-
-        init(
-            id: String,
-            name: String,
-            publicKey: Data,
-            attributes: Attributes
-        ) {
-            self.id = id
-            self.name = name
-            self.publicKey = publicKey
-            self.attributes = attributes
-        }
-
-        public static func ==(lhs: Self, rhs: Self) -> Bool {
-            lhs.id == rhs.id
-        }
 
     }
 

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift

@@ -5,288 +5,357 @@ import CryptoKit
 @preconcurrency import LocalAuthentication
 import SecretKit
 import os
+import Common
 
 extension SecureEnclave {
 
-    /// An implementation of Store backed by the Secure Enclave using CryptoKit API.
+    /// An implementation of Store backed by the Secure Enclave.
     @Observable public final class Store: SecretStoreModifiable {
 
-        @MainActor public var secrets: [Secret] = []
         public var isAvailable: Bool {
             CryptoKit.SecureEnclave.isAvailable
         }
         public let id = UUID()
-        public let name = String(localized: .secureEnclave)
-        private let persistentAuthenticationHandler = PersistentAuthenticationHandler()
+        public let name = String(localized: "secure_enclave")
+        public var secrets: [Secret] {
+            _secrets.lockedValue
+        }
+        private let _secrets: OSAllocatedUnfairLock<[Secret]> = .init(uncheckedState: [])
+
+        private let persistedAuthenticationContexts: OSAllocatedUnfairLock<[Secret: PersistentAuthenticationContext]> = .init(uncheckedState: [:])
 
         /// Initializes a Store.
-        @MainActor public init() {
-            loadSecrets()
+        public init() {
             Task {
-                for await note in DistributedNotificationCenter.default().notifications(named: .secretStoreUpdated) {
-                    guard Constants.notificationToken != (note.object as? String) else {
-                        // Don't reload if we're the ones triggering this by reloading.
-                        continue
-                    }
-                    reloadSecrets()
+                for await _ in DistributedNotificationCenter.default().notifications(named: .secretStoreUpdated) {
+                    await reloadSecretsInternal(notifyAgent: false)
                 }
             }
-        }
-
-        // MARK: - Public API
-        
-        // MARK: SecretStore
-        
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
-            var context: LAContext
-            if let existing = await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret) {
-                context = existing.context
-            } else {
-                let newContext = LAContext()
-                newContext.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
-                newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-                context = newContext
-            }
-
-            let queryAttributes = KeychainDictionary([
-                kSecClass: Constants.keyClass,
-                kSecAttrService: Constants.keyTag,
-                kSecUseDataProtectionKeychain: true,
-                kSecAttrAccount: secret.id,
-                kSecReturnAttributes: true,
-                kSecReturnData: true,
-            ])
-            var untyped: CFTypeRef?
-            let status = SecItemCopyMatching(queryAttributes, &untyped)
-            if status != errSecSuccess {
-                throw KeychainError(statusCode: status)
-            }
-            guard let untypedSafe = untyped as? [CFString: Any] else {
-                throw KeychainError(statusCode: errSecSuccess)
-            }
-            guard let attributesData = untypedSafe[kSecAttrGeneric] as? Data,
-                  let keyData = untypedSafe[kSecValueData] as? Data else {
-                throw MissingAttributesError()
-            }
-            let attributes = try JSONDecoder().decode(Attributes.self, from: attributesData)
-
-            switch attributes.keyType {
-            case .ecdsa256:
-                let key = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: keyData, authenticationContext: context)
-                return try key.signature(for: data).rawRepresentation
-            case .mldsa65:
-                guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-                let key = try CryptoKit.SecureEnclave.MLDSA65.PrivateKey(dataRepresentation: keyData, authenticationContext: context)
-                return try key.signature(for: data)
-            case .mldsa87:
-                guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-                let key = try CryptoKit.SecureEnclave.MLDSA87.PrivateKey(dataRepresentation: keyData, authenticationContext: context)
-                return try key.signature(for: data)
-            default:
-                throw UnsupportedAlgorithmError()
-            }
-
-        }
-
-        public func existingPersistedAuthenticationContext(secret: Secret) async -> PersistedAuthenticationContext? {
-            await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret)
-        }
-
-        public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) async throws {
-            try await persistentAuthenticationHandler.persistAuthentication(secret: secret, forDuration: duration)
-        }
-
-        @MainActor public func reloadSecrets() {
-            let before = secrets
-            secrets.removeAll()
             loadSecrets()
-            if secrets != before {
-                NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
-                DistributedNotificationCenter.default().postNotificationName(.secretStoreUpdated, object: Constants.notificationToken, deliverImmediately: true)
-            }
         }
 
-        // MARK: SecretStoreModifiable
-        
-        public func create(name: String, attributes: Attributes) async throws -> Secret {
+        // MARK: Public API
+
+        public func create(name: String, requiresAuthentication: Bool) async throws {
             var accessError: SecurityError?
-            let flags: SecAccessControlCreateFlags = switch attributes.authentication {
-            case .notRequired:
-                [.privateKeyUsage]
-            case .presenceRequired:
-                [.userPresence, .privateKeyUsage]
-            case .biometryCurrent:
-                [.biometryCurrentSet, .privateKeyUsage]
-            case .unknown:
-                fatalError()
+            let flags: SecAccessControlCreateFlags
+            if requiresAuthentication {
+                flags = [.privateKeyUsage, .userPresence]
+            } else {
+                flags = .privateKeyUsage
             }
             let access =
                 SecAccessControlCreateWithFlags(kCFAllocatorDefault,
                                                 kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
                                                 flags,
-                                                &accessError)
+                                                &accessError) as Any
             if let error = accessError {
                 throw error.takeRetainedValue() as Error
             }
-            let dataRep: Data
-            let publicKey: Data
-            switch attributes.keyType {
-            case .ecdsa256:
-                let created = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(accessControl: access!)
-                dataRep = created.dataRepresentation
-                publicKey = created.publicKey.x963Representation
-            case .mldsa65:
-                guard #available(macOS 26.0, *) else { throw Attributes.UnsupportedOptionError() }
-                let created = try CryptoKit.SecureEnclave.MLDSA65.PrivateKey(accessControl: access!)
-                dataRep = created.dataRepresentation
-                publicKey = created.publicKey.rawRepresentation
-            case .mldsa87:
-                guard #available(macOS 26.0, *) else { throw Attributes.UnsupportedOptionError() }
-                let created = try CryptoKit.SecureEnclave.MLDSA87.PrivateKey(accessControl: access!)
-                dataRep = created.dataRepresentation
-                publicKey = created.publicKey.rawRepresentation
-            default:
-                throw Attributes.UnsupportedOptionError()
+
+            let attributes = KeychainDictionary([
+                kSecAttrLabel: name,
+                kSecAttrKeyType: Constants.keyType,
+                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
+                kSecAttrApplicationTag: Constants.keyTag,
+                kSecPrivateKeyAttrs: [
+                    kSecAttrIsPermanent: true,
+                    kSecAttrAccessControl: access
+                ]
+            ])
+
+            var createKeyError: SecurityError?
+            let keypair = SecKeyCreateRandomKey(attributes, &createKeyError)
+            if let error = createKeyError {
+                throw error.takeRetainedValue() as Error
             }
-            let id = try saveKey(dataRep, name: name, attributes: attributes)
-            await reloadSecrets()
-            return Secret(id: id, name: name, publicKey: publicKey, attributes: attributes)
+            guard let keypair = keypair, let publicKey = SecKeyCopyPublicKey(keypair) else {
+                throw KeychainError(statusCode: nil)
+            }
+            try savePublicKey(publicKey, name: name)
+            await reloadSecretsInternal()
         }
 
         public func delete(secret: Secret) async throws {
             let deleteAttributes = KeychainDictionary([
-                kSecClass: Constants.keyClass,
-                kSecAttrService: Constants.keyTag,
-                kSecUseDataProtectionKeychain: true,
-                kSecAttrAccount: secret.id,
+                kSecClass: kSecClassKey,
+                kSecAttrApplicationLabel: secret.id as CFData
             ])
             let status = SecItemDelete(deleteAttributes)
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
             }
-            await reloadSecrets()
+            await reloadSecretsInternal()
         }
 
-        public func update(secret: Secret, name: String, attributes: Attributes) async throws {
+        public func update(secret: Secret, name: String) async throws {
             let updateQuery = KeychainDictionary([
-                kSecClass: Constants.keyClass,
-                kSecAttrAccount: secret.id,
+                kSecClass: kSecClassKey,
+                kSecAttrApplicationLabel: secret.id as CFData
             ])
 
-            let attributes = try JSONEncoder().encode(attributes)
             let updatedAttributes = KeychainDictionary([
                 kSecAttrLabel: name,
-                kSecAttrGeneric: attributes,
             ])
 
             let status = SecItemUpdate(updateQuery, updatedAttributes)
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
             }
-            await reloadSecrets()
+            await reloadSecretsInternal()
         }
         
-        public var supportedKeyTypes: [KeyType] {
-            if #available(macOS 26, *) {
-                [
-                    .ecdsa256,
-                    .mldsa65,
-                    .mldsa87,
-                ]
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
+            var context: LAContext
+            if let existing = persistedAuthenticationContexts.lockedValue[secret], existing.valid {
+                context = existing.context
             } else {
-                [.ecdsa256]
+                let newContext = LAContext()
+                newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+                context = newContext
+            }
+            context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)")
+            let attributes = KeychainDictionary([
+                kSecClass: kSecClassKey,
+                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+                kSecAttrApplicationLabel: secret.id as CFData,
+                kSecAttrKeyType: Constants.keyType,
+                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
+                kSecAttrApplicationTag: Constants.keyTag,
+                kSecUseAuthenticationContext: context,
+                kSecReturnRef: true
+            ])
+            var untyped: CFTypeRef?
+            let status = SecItemCopyMatching(attributes, &untyped)
+            if status != errSecSuccess {
+                throw KeychainError(statusCode: status)
+            }
+            guard let untypedSafe = untyped else {
+                throw KeychainError(statusCode: errSecSuccess)
+            }
+            let key = untypedSafe as! SecKey
+            var signError: SecurityError?
+            
+            guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else {
+                throw SigningError(error: signError)
+            }
+            return signature as Data
+        }
+
+        public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool {
+            let context = LAContext()
+            context.localizedReason = String(localized: "auth_context_request_verify_description_\(secret.name)")
+            context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+            let attributes = KeychainDictionary([
+                kSecClass: kSecClassKey,
+                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+                kSecAttrApplicationLabel: secret.id as CFData,
+                kSecAttrKeyType: Constants.keyType,
+                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
+                kSecAttrApplicationTag: Constants.keyTag,
+                kSecUseAuthenticationContext: context,
+                kSecReturnRef: true
+                ])
+            var verifyError: SecurityError?
+            var untyped: CFTypeRef?
+            let status = SecItemCopyMatching(attributes, &untyped)
+            if status != errSecSuccess {
+                throw KeychainError(statusCode: status)
+            }
+            guard let untypedSafe = untyped else {
+                throw KeychainError(statusCode: errSecSuccess)
+            }
+            let key = untypedSafe as! SecKey
+            let verified = SecKeyVerifySignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, signature as CFData, &verifyError)
+            if !verified, let verifyError {
+                if verifyError.takeUnretainedValue() ~= .verifyError {
+                    return false
+                } else {
+                    throw SigningError(error: verifyError)
+                }
+            }
+            return verified
+        }
+
+        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
+            guard let persisted = persistedAuthenticationContexts.lockedValue[secret], persisted.valid else { return nil }
+            return persisted
+        }
+
+        public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) throws {
+            let newContext = LAContext()
+            newContext.touchIDAuthenticationAllowableReuseDuration = duration
+            newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+
+            let formatter = DateComponentsFormatter()
+            formatter.unitsStyle = .spellOut
+            formatter.allowedUnits = [.hour, .minute, .day]
+
+            if let durationString = formatter.string(from: duration) {
+                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_\(secret.name)_\(durationString)")
+            } else {
+                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_unknown_\(secret.name)")
+            }
+            newContext.evaluatePolicy(LAPolicy.deviceOwnerAuthentication, localizedReason: newContext.localizedReason) { [weak self] success, _ in
+                guard success, let self else { return }
+                let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
+                self.persistedAuthenticationContexts.withLock {
+                    $0[secret] = context
+                }
             }
         }
+
+        public func reloadSecrets() async {
+            await reloadSecretsInternal(notifyAgent: false)
+        }
+
     }
 
 }
 
 extension SecureEnclave.Store {
 
+    /// Reloads all secrets from the store.
+    /// - Parameter notifyAgent: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
+    private func reloadSecretsInternal(notifyAgent: Bool = true) async {
+        let before = secrets
+        _secrets.withLock {
+            $0.removeAll()
+        }
+        loadSecrets()
+        if secrets != before {
+            NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
+            if notifyAgent {
+                DistributedNotificationCenter.default().postNotificationName(.secretStoreUpdated, object: nil, deliverImmediately: true)
+            }
+        }
+    }
+
     /// Loads all secrets from the store.
-    @MainActor private func loadSecrets() {
-        let queryAttributes = KeychainDictionary([
-            kSecClass: Constants.keyClass,
-            kSecAttrService: Constants.keyTag,
-            kSecUseDataProtectionKeychain: true,
-            kSecReturnData: true,
+    private func loadSecrets() {
+        let publicAttributes = KeychainDictionary([
+            kSecClass: kSecClassKey,
+            kSecAttrKeyType: SecureEnclave.Constants.keyType,
+            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
+            kSecAttrKeyClass: kSecAttrKeyClassPublic,
+            kSecReturnRef: true,
             kSecMatchLimit: kSecMatchLimitAll,
             kSecReturnAttributes: true
             ])
-        var untyped: CFTypeRef?
-        SecItemCopyMatching(queryAttributes, &untyped)
-        guard let typed = untyped as? [[CFString: Any]] else { return }
-        let wrapped: [SecureEnclave.Secret] = typed.compactMap {
-            do {
-                let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_secret")
-                guard let attributesData = $0[kSecAttrGeneric] as? Data,
-                let id = $0[kSecAttrAccount] as? String else {
-                    throw MissingAttributesError()
-                }
-                let attributes = try JSONDecoder().decode(Attributes.self, from: attributesData)
-                let keyData = $0[kSecValueData] as! Data
-                let publicKey: Data
-                switch attributes.keyType {
-                case .ecdsa256:
-                    let key = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: keyData)
-                    publicKey = key.publicKey.x963Representation
-                case .mldsa65:
-                    guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-                    let key = try CryptoKit.SecureEnclave.MLDSA65.PrivateKey(dataRepresentation: keyData)
-                    publicKey = key.publicKey.rawRepresentation
-                case .mldsa87:
-                    guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-                    let key = try CryptoKit.SecureEnclave.MLDSA87.PrivateKey(dataRepresentation: keyData)
-                    publicKey = key.publicKey.rawRepresentation
-                default:
-                    throw UnsupportedAlgorithmError()
-                }
-                return SecureEnclave.Secret(id: id, name: name, publicKey: publicKey, attributes: attributes)
-            } catch {
-                return nil
-            }
+        var publicUntyped: CFTypeRef?
+        SecItemCopyMatching(publicAttributes, &publicUntyped)
+        guard let publicTyped = publicUntyped as? [[CFString: Any]] else { return }
+        let privateAttributes = KeychainDictionary([
+            kSecClass: kSecClassKey,
+            kSecAttrKeyType: SecureEnclave.Constants.keyType,
+            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
+            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+            kSecReturnRef: true,
+            kSecMatchLimit: kSecMatchLimitAll,
+            kSecReturnAttributes: true
+            ])
+        var privateUntyped: CFTypeRef?
+        SecItemCopyMatching(privateAttributes, &privateUntyped)
+        guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
+        let privateMapped = privateTyped.reduce(into: [:] as [Data: [CFString: Any]]) { partialResult, next in
+            let id = next[kSecAttrApplicationLabel] as! Data
+            partialResult[id] = next
+        }
+        let authNotRequiredAccessControl: SecAccessControl =
+            SecAccessControlCreateWithFlags(kCFAllocatorDefault,
+                                            kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+                                            [.privateKeyUsage],
+                                            nil)!
+
+        let wrapped: [SecureEnclave.Secret] = publicTyped.map {
+            let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_secret")
+            let id = $0[kSecAttrApplicationLabel] as! Data
+            let publicKeyRef = $0[kSecValueRef] as! SecKey
+            let publicKeyAttributes = SecKeyCopyAttributes(publicKeyRef) as! [CFString: Any]
+            let publicKey = publicKeyAttributes[kSecValueData] as! Data
+            let privateKey = privateMapped[id]
+            let requiresAuth: Bool
+            if let authRequirements = privateKey?[kSecAttrAccessControl] {
+                // Unfortunately we can't inspect the access control object directly, but it does behave predicatable with equality.
+                requiresAuth = authRequirements as! SecAccessControl != authNotRequiredAccessControl
+            } else {
+                requiresAuth = false
+            }
+            return SecureEnclave.Secret(id: id, name: name, requiresAuthentication: requiresAuth, publicKey: publicKey)
+        }
+        _secrets.withLock {
+            $0.append(contentsOf: wrapped)
         }
-        secrets.append(contentsOf: wrapped)
     }
 
     /// Saves a public key.
     /// - Parameters:
-    ///   - key: The data representation key to save.
+    ///   - publicKey: The public key to save.
     ///   - name: A user-facing name for the key.
-    ///   - attributes: Attributes of the key.
-    /// - Note: Despite the name, the "Data" of the key is _not_ actual key material. This is an opaque data representation that the SEP can manipulate.
-    @discardableResult
-    func saveKey(_ key: Data, name: String, attributes: Attributes) throws -> String {
-        let attributes = try JSONEncoder().encode(attributes)
-        let id = UUID().uuidString
-        let keychainAttributes = KeychainDictionary([
-            kSecClass: Constants.keyClass,
-            kSecAttrService: Constants.keyTag,
-            kSecUseDataProtectionKeychain: true,
-            kSecAttrAccessible: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-            kSecAttrAccount: id,
-            kSecValueData: key,
-            kSecAttrLabel: name,
-            kSecAttrGeneric: attributes
-        ])
-        let status = SecItemAdd(keychainAttributes, nil)
+    private func savePublicKey(_ publicKey: SecKey, name: String) throws {
+        let attributes = KeychainDictionary([
+            kSecClass: kSecClassKey,
+            kSecAttrKeyType: SecureEnclave.Constants.keyType,
+            kSecAttrKeyClass: kSecAttrKeyClassPublic,
+            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
+            kSecValueRef: publicKey,
+            kSecAttrIsPermanent: true,
+            kSecReturnData: true,
+            kSecAttrLabel: name
+            ])
+        let status = SecItemAdd(attributes, nil)
         if status != errSecSuccess {
             throw KeychainError(statusCode: status)
         }
-        return id
     }
-    
+
 }
 
-extension SecureEnclave.Store {
+extension SecureEnclave {
 
     enum Constants {
-        static let keyClass = kSecClassGenericPassword as String
         static let keyTag = Data("com.maxgoedjen.secretive.secureenclave.key".utf8)
-        static let notificationToken = UUID().uuidString
+        static let keyType = kSecAttrKeyTypeECSECPrimeRandom as String
+        static let unauthenticatedThreshold: TimeInterval = 0.05
+    }
+
+}
+
+extension SecureEnclave {
+
+    /// A context describing a persisted authentication.
+    private final class PersistentAuthenticationContext: PersistedAuthenticationContext {
+
+        /// The Secret to persist authentication for.
+        let secret: Secret
+        /// The LAContext used to authorize the persistent context.
+        nonisolated(unsafe) let context: LAContext
+        /// An expiration date for the context.
+        /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
+        let monotonicExpiration: UInt64
+
+        /// Initializes a context.
+        /// - Parameters:
+        ///   - secret: The Secret to persist authentication for.
+        ///   - context: The LAContext used to authorize the persistent context.
+        ///   - duration: The duration of the authorization context, in seconds.
+        init(secret: Secret, context: LAContext, duration: TimeInterval) {
+            self.secret = secret
+            self.context = context
+            let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
+            self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
+        }
+
+        /// A boolean describing whether or not the context is still valid.
+        var valid: Bool {
+            clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
+        }
+
+        var expiration: Date {
+            let remainingNanoseconds = monotonicExpiration - clock_gettime_nsec_np(CLOCK_MONOTONIC)
+            let remainingInSeconds = Measurement(value: Double(remainingNanoseconds), unit: UnitDuration.nanoseconds).converted(to: .seconds).value
+            return Date(timeIntervalSinceNow: remainingInSeconds)
+        }
     }
-    
-    struct UnsupportedAlgorithmError: Error {}
-    struct MissingAttributesError: Error {}
 
 }

Sources/Packages/Sources/SmartCardSecretKit/SmartCardSecret.swift

@@ -1,4 +1,5 @@
 import Foundation
+import Combine
 import SecretKit
 
 extension SmartCard {
@@ -8,8 +9,10 @@ extension SmartCard {
 
         public let id: Data
         public let name: String
+        public let algorithm: Algorithm
+        public let keySize: Int
+        public let requiresAuthentication: Bool = false
         public let publicKey: Data
-        public var attributes: Attributes
 
     }
 

Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift

@@ -1,66 +1,70 @@
 import Foundation
+import os
 import Observation
 import Security
-@preconcurrency import CryptoTokenKit
+import CryptoTokenKit
 import LocalAuthentication
 import SecretKit
 
 extension SmartCard {
     
-    @MainActor @Observable fileprivate final class State {
+    private struct State {
         var isAvailable = false
-        var name = String(localized: .smartCard)
+        var name = String(localized: "smart_card")
         var secrets: [Secret] = []
         let watcher = TKTokenWatcher()
         var tokenID: String? = nil
-        nonisolated init() {}
     }
 
     /// An implementation of Store backed by a Smart Card.
     @Observable public final class Store: SecretStore {
 
-        private let state = State()
+        private let state: OSAllocatedUnfairLock<State> = .init(uncheckedState: .init())
         public var isAvailable: Bool {
-            state.isAvailable
-        }
-        @MainActor public var smartcardTokenID: String? {
-            state.tokenID
+            state.withLock { $0.isAvailable }
         }
 
         public let id = UUID()
-        @MainActor public var name: String {
-            state.name
+        public var name: String {
+            state.withLock { $0.name }
         }
         public var secrets: [Secret] {
-            state.secrets
+            state.withLock { $0.secrets }
         }
 
         /// Initializes a Store.
         public init() {
-            Task {
-                await MainActor.run {
-                    if let tokenID = smartcardTokenID {
-                        state.isAvailable = true
-                        state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
-                    }
-                    loadSecrets()
+            state.withLock { state in
+                if let tokenID = state.tokenID {
+                    state.isAvailable = true
+                    state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
                 }
-                // Doing this inside a regular mainactor handler casues thread assertions in CryptoTokenKit to blow up when the handler executes.
-                await state.watcher.setInsertionHandler { id in
+                state.watcher.setInsertionHandler { id in
+                    // Setting insertion handler will cause it to be called immediately.
+                    // Make a thread jump so we don't hit a recursive lock attempt.
                     Task {
-                        await self.smartcardInserted(for: id)
+                        self.smartcardInserted(for: id)
                     }
                 }
             }
+            loadSecrets()
         }
 
         // MARK: Public API
 
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
-            guard let tokenID = await state.tokenID else { fatalError() }
+        public func create(name: String) throws {
+            fatalError("Keys must be created on the smart card.")
+        }
+
+        public func delete(secret: Secret) throws {
+            fatalError("Keys must be deleted on the smart card.")
+        }
+
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
+            guard let tokenID = state.withLock({ $0.tokenID }) else { fatalError() }
             let context = LAContext()
-            context.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
-            context.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
+            context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)")
+            context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
             let attributes = KeychainDictionary([
                 kSecClass: kSecClassKey,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate,
@@ -79,13 +83,35 @@ extension SmartCard {
             }
             let key = untypedSafe as! SecKey
             var signError: SecurityError?
-            guard let algorithm = signatureAlgorithm(for: secret) else { throw UnsupportKeyType() }
-            guard let signature = SecKeyCreateSignature(key, algorithm, data as CFData, &signError) else {
+            guard let signature = SecKeyCreateSignature(key, signatureAlgorithm(for: secret, allowRSA: true), data as CFData, &signError) else {
                 throw SigningError(error: signError)
             }
             return signature as Data
         }
         
+        public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool {
+            let attributes = KeychainDictionary([
+                kSecAttrKeyType: secret.algorithm.secAttrKeyType,
+                kSecAttrKeySizeInBits: secret.keySize,
+                kSecAttrKeyClass: kSecAttrKeyClassPublic
+            ])
+            var verifyError: SecurityError?
+            let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &verifyError)
+            guard let untypedSafe = untyped else {
+                throw KeychainError(statusCode: errSecSuccess)
+            }
+            let key = untypedSafe as! SecKey
+            let verified = SecKeyVerifySignature(key, signatureAlgorithm(for: secret, allowRSA: true), data as CFData, signature as CFData, &verifyError)
+            if !verified, let verifyError {
+                if verifyError.takeUnretainedValue() ~= .verifyError {
+                    return false
+                } else {
+                    throw SigningError(error: verifyError)
+                }
+            }
+            return verified
+        }
+
         public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
             nil
         }
@@ -94,7 +120,7 @@ extension SmartCard {
         }
 
         /// Reloads all secrets from the store.
-        @MainActor public func reloadSecrets() {
+        public func reloadSecrets() {
             reloadSecretsInternal()
         }
 
@@ -104,11 +130,14 @@ extension SmartCard {
 
 extension SmartCard.Store {
 
-    @MainActor private func reloadSecretsInternal() {
-        let before = state.secrets
-        state.isAvailable = state.tokenID != nil
-        state.secrets.removeAll()
-        loadSecrets()
+    private func reloadSecretsInternal() {
+        let before = state.withLock {
+            $0.isAvailable = $0.tokenID != nil
+            let before = $0.secrets
+            $0.secrets.removeAll()
+            return before
+        }
+        self.loadSecrets()
         if self.secrets != before {
             NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
         }
@@ -116,32 +145,37 @@ extension SmartCard.Store {
 
     /// Resets the token ID and reloads secrets.
     /// - Parameter tokenID: The ID of the token that was inserted.
-    @MainActor private func smartcardInserted(for tokenID: String? = nil) {
-        guard let string = state.watcher.nonSecureEnclaveTokens.first else { return }
-        guard state.tokenID == nil else { return }
-        guard !string.contains("setoken") else { return }
-        state.tokenID = string
-        state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
-        state.tokenID = string
-        reloadSecretsInternal()
+    private func smartcardInserted(for tokenID: String? = nil) {
+        state.withLock { state in
+            guard let string = state.watcher.nonSecureEnclaveTokens.first else { return }
+            guard state.tokenID == nil else { return }
+            guard !string.contains("setoken") else { return }
+            state.tokenID = string
+            state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
+            state.tokenID = string
+        }
     }
 
     /// Resets the token ID and reloads secrets.
     /// - Parameter tokenID: The ID of the token that was removed.
-    @MainActor private func smartcardRemoved(for tokenID: String? = nil) {
-        state.tokenID = nil
+    private func smartcardRemoved(for tokenID: String? = nil) {
+        state.withLock {
+            $0.tokenID = nil
+        }
         reloadSecrets()
     }
 
     /// Loads all secrets from the store.
-    @MainActor private func loadSecrets() {
-        guard let tokenID = state.tokenID  else { return }
+    private func loadSecrets() {
+        guard let tokenID = state.withLock({ $0.tokenID }) else { return }
 
-        let fallbackName = String(localized: .smartCard)
-        if let driverName = state.watcher.tokenInfo(forTokenID: tokenID)?.driverName  {
-            state.name = driverName
-        } else {
-            state.name = fallbackName
+        let fallbackName = String(localized: "smart_card")
+        state.withLock {
+            if let driverName = $0.watcher.tokenInfo(forTokenID: tokenID)?.driverName  {
+                $0.name = driverName
+            } else {
+                $0.name = fallbackName
+            }
         }
 
         let attributes = KeychainDictionary([
@@ -154,21 +188,102 @@ extension SmartCard.Store {
         var untyped: CFTypeRef?
         SecItemCopyMatching(attributes, &untyped)
         guard let typed = untyped as? [[CFString: Any]] else { return }
-        let wrapped: [SecretType] = typed.compactMap {
-            let name = $0[kSecAttrLabel] as? String ?? String(localized: .unnamedSecret)
+        let wrapped = typed.map {
+            let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_secret")
             let tokenID = $0[kSecAttrApplicationLabel] as! Data
-            let algorithmSecAttr = $0[kSecAttrKeyType] as! NSNumber
+            let algorithm = Algorithm(secAttr: $0[kSecAttrKeyType] as! NSNumber)
             let keySize = $0[kSecAttrKeySizeInBits] as! Int
             let publicKeyRef = $0[kSecValueRef] as! SecKey
             let publicKeySecRef = SecKeyCopyPublicKey(publicKeyRef)!
             let publicKeyAttributes = SecKeyCopyAttributes(publicKeySecRef) as! [CFString: Any]
             let publicKey = publicKeyAttributes[kSecValueData] as! Data
-            let attributes = Attributes(keyType: KeyType(secAttr: algorithmSecAttr, size: keySize)!, authentication: .unknown)
-            let secret = SmartCard.Secret(id: tokenID, name: name, publicKey: publicKey, attributes: attributes)
-            guard signatureAlgorithm(for: secret) != nil else { return nil }
-            return secret
+            return SmartCard.Secret(id: tokenID, name: name, algorithm: algorithm, keySize: keySize, publicKey: publicKey)
+        }
+        state.withLock {
+            $0.secrets.append(contentsOf: wrapped)
+        }
+    }
+
+}
+
+
+// MARK: Smart Card specific encryption/decryption/verification
+extension SmartCard.Store {
+
+    /// Encrypts a payload with a specified key.
+    /// - Parameters:
+    ///   - data: The payload to encrypt.
+    ///   - secret: The secret to encrypt with.
+    /// - Returns: The encrypted data.
+    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
+    public func encrypt(data: Data, with secret: SecretType) throws -> Data {
+        let context = LAContext()
+        context.localizedReason = String(localized: "auth_context_request_encrypt_description_\(secret.name)")
+        context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+        let attributes = KeychainDictionary([
+            kSecAttrKeyType: secret.algorithm.secAttrKeyType,
+            kSecAttrKeySizeInBits: secret.keySize,
+            kSecAttrKeyClass: kSecAttrKeyClassPublic,
+            kSecUseAuthenticationContext: context
+        ])
+        var encryptError: SecurityError?
+        let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &encryptError)
+        guard let untypedSafe = untyped else {
+            throw KeychainError(statusCode: errSecSuccess)
+        }
+        let key = untypedSafe as! SecKey
+        guard let signature = SecKeyCreateEncryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
+            throw SigningError(error: encryptError)
+        }
+        return signature as Data
+    }
+
+    /// Decrypts a payload with a specified key.
+    /// - Parameters:
+    ///   - data: The payload to decrypt.
+    ///   - secret: The secret to decrypt with.
+    /// - Returns: The decrypted data.
+    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
+    public func decrypt(data: Data, with secret: SecretType) throws -> Data {
+        guard let tokenID = state.withLock({ $0.tokenID }) else { fatalError() }
+        let context = LAContext()
+        context.localizedReason = String(localized: "auth_context_request_decrypt_description_\(secret.name)")
+        context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+        let attributes = KeychainDictionary([
+            kSecClass: kSecClassKey,
+            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+            kSecAttrApplicationLabel: secret.id as CFData,
+            kSecAttrTokenID: tokenID,
+            kSecUseAuthenticationContext: context,
+            kSecReturnRef: true
+        ])
+        var untyped: CFTypeRef?
+        let status = SecItemCopyMatching(attributes, &untyped)
+        if status != errSecSuccess {
+            throw KeychainError(statusCode: status)
+        }
+        guard let untypedSafe = untyped else {
+            throw KeychainError(statusCode: errSecSuccess)
+        }
+        let key = untypedSafe as! SecKey
+        var encryptError: SecurityError?
+        guard let signature = SecKeyCreateDecryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
+            throw SigningError(error: encryptError)
+        }
+        return signature as Data
+    }
+
+    private func encryptionAlgorithm(for secret: SecretType) -> SecKeyAlgorithm {
+        switch (secret.algorithm, secret.keySize) {
+        case (.ellipticCurve, 256):
+            return .eciesEncryptionCofactorVariableIVX963SHA256AESGCM
+        case (.ellipticCurve, 384):
+            return .eciesEncryptionCofactorVariableIVX963SHA384AESGCM
+        case (.rsa, 1024), (.rsa, 2048):
+            return .rsaEncryptionOAEPSHA512AESGCM
+        default:
+            fatalError()
         }
-        state.secrets.append(contentsOf: wrapped)
     }
 
 }
@@ -181,9 +296,3 @@ extension TKTokenWatcher {
     }
 
 }
-
-extension SmartCard {
-
-    public struct UnsupportKeyType: Error {}
-
-}

Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift

@@ -59,7 +59,7 @@ import Foundation
     }
 
     @Test
-    @MainActor func greatestSelectedIfOldPatchIsPublishedLater() async throws {
+    func greatestSelectedIfOldPatchIsPublishedLater() async throws {
         // If 2.x.x series has been published, and a patch for 1.x.x is issued
         // 2.x.x should still be selected if user can run it.
         let updater = Updater(checkOnLaunch: false, osVersion: SemVer("2.2.3"), currentVersion: SemVer("1.0.0"))
@@ -77,7 +77,7 @@ import Foundation
     }
 
     @Test
-    @MainActor func latestVersionIsRunnable() async throws {
+    func latestVersionIsRunnable() async throws {
         // If the 2.x.x series has been published but the user can't run it
         // the last version the user can run should be selected.
         let updater = Updater(checkOnLaunch: false, osVersion: SemVer("1.2.3"), currentVersion: SemVer("1.0.0"))

Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift

@@ -1,140 +1,154 @@
 import Foundation
+import os
 import Testing
 import CryptoKit
 @testable import SecretKit
 @testable import SecretAgentKit
+import Common
 
 @Suite struct AgentTests {
 
+    let stubWriter = StubFileHandleWriter()
+
     // MARK: Identity Listing
 
-
-//    let testProvenance = SigningRequestProvenance(root: .init(pid: 0, processName: "Test", appName: "Test", iconURL: nil, path: /, validSignature: true, parentPID: nil))
-
-    @Test func emptyStores() async throws {
+    @Test func emptyStores() async {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
         let agent = Agent(storeList: SecretStoreList())
-        let response = try await agent.handle(data: Constants.Requests.requestIdentities, provenance: .test)
-        #expect(response == Constants.Responses.requestIdentitiesEmpty)
+        await agent.handle(reader: stubReader, writer: stubWriter)
+        #expect(stubWriter.data == Constants.Responses.requestIdentitiesEmpty)
     }
 
-    @Test func identitiesList() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+    @Test func identitiesList() async {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        let response = try await agent.handle(data: Constants.Requests.requestIdentities, provenance: .test)
-        #expect(response == Constants.Responses.requestIdentitiesMultiple)
+        await agent.handle(reader: stubReader, writer: stubWriter)
+        #expect(stubWriter.data == Constants.Responses.requestIdentitiesMultiple)
     }
 
     // MARK: Signatures
 
-    @Test func noMatchingIdentities() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+    @Test func noMatchingIdentities() async {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignatureWithNoneMatching)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        let response = try await agent.handle(data: Constants.Requests.requestSignatureWithNoneMatching, provenance: .test)
-        #expect(response == Constants.Responses.requestFailure)
+        await agent.handle(reader: stubReader, writer: stubWriter)
+        #expect(stubWriter.data == Constants.Responses.requestFailure)
     }
 
-//    @Test func ecdsaSignature() async throws {
-//        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
-//        let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...])
-//        _ = requestReader.readNextChunk()
-//        let dataToSign = requestReader.readNextChunk()
-//        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-//        let agent = Agent(storeList: list)
-//        await agent.handle(reader: stubReader, writer: stubWriter)
-//        let outer = OpenSSHReader(data: stubWriter.data[5...])
-//        let payload = outer.readNextChunk()
-//        let inner = OpenSSHReader(data: payload)
-//        _ = inner.readNextChunk()
-//        let signedData = inner.readNextChunk()
-//        let rsData = OpenSSHReader(data: signedData)
-//        var r = rsData.readNextChunk()
-//        var s = rsData.readNextChunk()
-//        // This is fine IRL, but it freaks out CryptoKit
-//        if r[0] == 0 {
-//            r.removeFirst()
-//        }
-//        if s[0] == 0 {
-//            s.removeFirst()
-//        }
-//        var rs = r
-//        rs.append(s)
-//        let signature = try P256.Signing.ECDSASignature(rawRepresentation: rs)
-//        // Correct signature
-//        #expect(try P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey)
-//            .isValidSignature(signature, for: dataToSign))
-//    }
+    @Test func signature() async throws {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
+        let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...])
+        _ = requestReader.readNextChunk()
+        let dataToSign = requestReader.readNextChunk()
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+        let agent = Agent(storeList: list)
+        await agent.handle(reader: stubReader, writer: stubWriter)
+        let outer = OpenSSHReader(data: stubWriter.data[5...])
+        let payload = outer.readNextChunk()
+        let inner = OpenSSHReader(data: payload)
+        _ = inner.readNextChunk()
+        let signedData = inner.readNextChunk()
+        let rsData = OpenSSHReader(data: signedData)
+        var r = rsData.readNextChunk()
+        var s = rsData.readNextChunk()
+        // This is fine IRL, but it freaks out CryptoKit
+        if r[0] == 0 {
+            r.removeFirst()
+        }
+        if s[0] == 0 {
+            s.removeFirst()
+        }
+        var rs = r
+        rs.append(s)
+        let signature = try! P256.Signing.ECDSASignature(rawRepresentation: rs)
+        let referenceValid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
+        let store = list.stores.first!
+        let derVerifies = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
+        let invalidRandomSignature = try await store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
+        let invalidRandomData = try await store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret))
+        let invalidWrongKey = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret))
+        #expect(referenceValid)
+        #expect(derVerifies)
+        #expect(invalidRandomSignature == false)
+        #expect(invalidRandomData == false)
+        #expect(invalidWrongKey == false)
+    }
 
     // MARK: Witness protocol
 
-    @Test func witnessObjectionStopsRequest() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
+    @Test func witnessObjectionStopsRequest() async {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
         let witness = StubWitness(speakNow: { _,_  in
             return true
         }, witness: { _, _ in })
         let agent = Agent(storeList: list, witness: witness)
-        let response = try await agent.handle(data: Constants.Requests.requestSignature, provenance: .test)
-        #expect(response == Constants.Responses.requestFailure)
+        await agent.handle(reader: stubReader, writer: stubWriter)
+        #expect(stubWriter.data == Constants.Responses.requestFailure)
     }
 
-    @Test func witnessSignature() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
-        nonisolated(unsafe) var witnessed = false
+    @Test func witnessSignature() async {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
+        let witnessed: OSAllocatedUnfairLock<Bool> = .init(uncheckedState: false)
         let witness = StubWitness(speakNow: { _, trace  in
             return false
         }, witness: { _, trace in
-            witnessed = true
+            witnessed.lockedValue = true
         })
         let agent = Agent(storeList: list, witness: witness)
-        _ = try await agent.handle(data: Constants.Requests.requestSignature, provenance: .test)
-        #expect(witnessed)
+        await agent.handle(reader: stubReader, writer: stubWriter)
+        let value = witnessed.lockedValue
+        #expect(value)
     }
 
-    @Test func requestTracing() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
-        nonisolated(unsafe) var speakNowTrace: SigningRequestProvenance?
-        nonisolated(unsafe) var witnessTrace: SigningRequestProvenance?
+    @Test func requestTracing() async {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
+        let speakNowTrace: OSAllocatedUnfairLock<SigningRequestProvenance?> = .init(uncheckedState: nil)
+        let witnessTrace: OSAllocatedUnfairLock<SigningRequestProvenance?> = .init(uncheckedState: nil)
         let witness = StubWitness(speakNow: { _, trace  in
-            speakNowTrace = trace
+            speakNowTrace.lockedValue = trace
             return false
         }, witness: { _, trace in
-            witnessTrace = trace
+            witnessTrace.lockedValue = trace
         })
         let agent = Agent(storeList: list, witness: witness)
-        _ = try await agent.handle(data: Constants.Requests.requestSignature, provenance: .test)
-        #expect(witnessTrace == speakNowTrace)
-        #expect(witnessTrace == .test)
+        await agent.handle(reader: stubReader, writer: stubWriter)
+        #expect(witnessTrace.lockedValue == speakNowTrace.lockedValue)
+        #expect(witnessTrace.lockedValue?.origin.displayName == "Finder")
+        #expect(witnessTrace.lockedValue?.origin.validSignature == true)
+        #expect(witnessTrace.lockedValue?.origin.parentPID == 1)
     }
 
     // MARK: Exception Handling
 
-    @Test func signatureException() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let store = await list.stores.first?.base as! Stub.Store
+    @Test func signatureException() async {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+        let store = list.stores.first?.base as! Stub.Store
         store.shouldThrow = true
         let agent = Agent(storeList: list)
-        let response = try await agent.handle(data: Constants.Requests.requestSignature, provenance: .test)
-        #expect(response == Constants.Responses.requestFailure)
+        await agent.handle(reader: stubReader, writer: stubWriter)
+        #expect(stubWriter.data == Constants.Responses.requestFailure)
     }
 
     // MARK: Unsupported
 
-    @Test func unhandledAdd() async throws {
+    @Test func unhandledAdd() async {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.addIdentity)
         let agent = Agent(storeList: SecretStoreList())
-        let response = try await agent.handle(data: Constants.Requests.addIdentity, provenance: .test)
-        #expect(response == Constants.Responses.requestFailure)
+        await agent.handle(reader: stubReader, writer: stubWriter)
+        #expect(stubWriter.data == Constants.Responses.requestFailure)
     }
 
 }
 
-extension SigningRequestProvenance {
-
-    static let test = SigningRequestProvenance(root: .init(pid: 0, processName: "test", appName: nil, iconURL: nil, path: "/", validSignature: true, parentPID: 0))
-
-}
-
 extension AgentTests {
 
-    @MainActor func storeList(with secrets: [Stub.Secret]) async -> SecretStoreList {
+    func storeList(with secrets: [Stub.Secret]) -> SecretStoreList {
         let store = Stub.Store()
         store.secrets.append(contentsOf: secrets)
         let storeList = SecretStoreList()

Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleReader.swift

@@ -0,0 +1,14 @@
+import SecretAgentKit
+import AppKit
+
+struct StubFileHandleReader: FileHandleReader {
+
+    let availableData: Data
+    var fileDescriptor: Int32 {
+        NSWorkspace.shared.runningApplications.filter({ $0.localizedName == "Finder" }).first!.processIdentifier
+    }
+    var pidOfConnectedProcess: Int32 {
+        fileDescriptor
+    }
+
+}

Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleWriter.swift

@@ -0,0 +1,12 @@
+import Foundation
+import SecretAgentKit
+
+class StubFileHandleWriter: FileHandleWriter, @unchecked Sendable {
+
+    var data = Data()
+
+    func write(_ data: Data) {
+        self.data.append(data)
+    }
+
+}

Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift

@@ -45,15 +45,43 @@ extension Stub {
             let privateData = (privateAttributes[kSecValueData] as! Data)
             let secret = Secret(keySize: size, publicKey: publicData, privateKey: privateData)
             print(secret)
-            print("Public Key OpenSSH: \(OpenSSHPublicKeyWriter().openSSHString(secret: secret))")
+            print("Public Key OpenSSH: \(OpenSSHKeyWriter().openSSHString(secret: secret))")
         }
 
         public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
             guard !shouldThrow else {
                 throw NSError(domain: "test", code: 0, userInfo: nil)
             }
-            let privateKey = try CryptoKit.P256.Signing.PrivateKey(x963Representation: secret.privateKey)
-            return try privateKey.signature(for: data).rawRepresentation
+            let privateKey = SecKeyCreateWithData(secret.privateKey as CFData, KeychainDictionary([
+                kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
+                kSecAttrKeySizeInBits: secret.keySize,
+                kSecAttrKeyClass: kSecAttrKeyClassPrivate
+                ])
+                , nil)!
+            return SecKeyCreateSignature(privateKey, signatureAlgorithm(for: secret), data as CFData, nil)! as Data
+        }
+
+        public func verify(signature: Data, for data: Data, with secret: Stub.Secret) throws -> Bool {
+            let attributes = KeychainDictionary([
+                kSecAttrKeyType: secret.algorithm.secAttrKeyType,
+                kSecAttrKeySizeInBits: secret.keySize,
+                kSecAttrKeyClass: kSecAttrKeyClassPublic
+            ])
+            var verifyError: Unmanaged<CFError>?
+            let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &verifyError)
+            guard let untypedSafe = untyped else {
+                throw NSError(domain: "test", code: 0, userInfo: nil)
+            }
+            let key = untypedSafe as! SecKey
+            let verified = SecKeyVerifySignature(key, signatureAlgorithm(for: secret), data as CFData, signature as CFData, &verifyError)
+            if let verifyError {
+                if verifyError.takeUnretainedValue() ~= .verifyError {
+                    return false
+                } else {
+                    throw NSError(domain: "test", code: 0, userInfo: nil)
+                }
+            }
+            return verified
         }
 
         public func existingPersistedAuthenticationContext(secret: Stub.Secret) -> PersistedAuthenticationContext? {
@@ -74,22 +102,24 @@ extension Stub {
 
     struct Secret: SecretKit.Secret, CustomDebugStringConvertible {
 
-        let id = Data(UUID().uuidString.utf8)
+        let id = UUID().uuidString.data(using: .utf8)!
         let name = UUID().uuidString
-        let attributes: Attributes
+        let algorithm = Algorithm.ellipticCurve
+
+        let keySize: Int
         let publicKey: Data
         let requiresAuthentication = false
         let privateKey: Data
 
         init(keySize: Int, publicKey: Data, privateKey: Data) {
-            self.attributes = Attributes(keyType: .init(algorithm: .ecdsa, size: keySize), authentication: .notRequired)
+            self.keySize = keySize
             self.publicKey = publicKey
             self.privateKey = privateKey
         }
 
         var debugDescription: String {
             """
-            Key Size \(attributes.keyType.size)
+            Key Size \(keySize)
             Private: \(privateKey.base64EncodedString())
             Public: \(publicKey.base64EncodedString())
             """

Sources/Packages/Tests/SecretKitTests/AnySecretTests.swift

@@ -4,16 +4,15 @@ import Testing
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
-
 @Suite struct AnySecretTests {
 
     @Test func eraser() {
-        let data = Data(UUID().uuidString.utf8)
-        let secret = SmartCard.Secret(id: data, name: "Name", publicKey: data, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 256), authentication: .notRequired))
+        let secret = SmartCard.Secret(id: UUID().uuidString.data(using: .utf8)!, name: "Name", algorithm: .ellipticCurve, keySize: 256, publicKey: UUID().uuidString.data(using: .utf8)!)
         let erased = AnySecret(secret)
         #expect(erased.id == secret.id as AnyHashable)
         #expect(erased.name == secret.name)
-        #expect(erased.keyType == secret.keyType)
+        #expect(erased.algorithm == secret.algorithm)
+        #expect(erased.keySize == secret.keySize)
         #expect(erased.publicKey == secret.publicKey)
     }
 

Sources/Packages/Tests/SecretKitTests/OpenSSHWriterTests.swift

@@ -4,9 +4,9 @@ import Testing
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
-@Suite struct OpenSSHPublicKeyWriterTests {
+@Suite struct OpenSSHWriterTests {
 
-    let writer = OpenSSHPublicKeyWriter()
+    let writer = OpenSSHKeyWriter()
 
     @Test func ecdsa256MD5Fingerprint() {
         #expect(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa256Secret) == "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5")
@@ -18,7 +18,7 @@ import Testing
 
     @Test func ecdsa256PublicKey() {
         #expect(writer.openSSHString(secret:  Constants.ecdsa256Secret) ==
-        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo= test@example.com")
+        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")
     }
 
     @Test func ecdsa256Hash() {
@@ -35,7 +35,7 @@ import Testing
 
     @Test func ecdsa384PublicKey() {
         #expect(writer.openSSHString(secret:  Constants.ecdsa384Secret) ==
-                       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ== test@example.com")
+                       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")
     }
 
     @Test func ecdsa384Hash() {
@@ -44,11 +44,11 @@ import Testing
 
 }
 
-extension OpenSSHPublicKeyWriterTests {
+extension OpenSSHWriterTests {
 
     enum Constants {
-        static let ecdsa256Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 256)", publicKey: Data(base64Encoded: "BOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 256), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
-        static let ecdsa384Secret = SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 384)", publicKey: Data(base64Encoded: "BG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 384), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
+        static let ecdsa256Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 256)", algorithm: .ellipticCurve, keySize: 256, publicKey: Data(base64Encoded: "BOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")!)
+        static let ecdsa384Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 384)", algorithm: .ellipticCurve, keySize: 384, publicKey: Data(base64Encoded: "BG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")!)
 
     }
 

Sources/SecretAgent/AppDelegate.swift

@@ -1,5 +1,6 @@
 import Cocoa
 import OSLog
+import Combine
 import SecretKit
 import SecureEnclaveSecretKit
 import SmartCardSecretKit
@@ -10,18 +11,15 @@ import Observation
 @main
 class AppDelegate: NSObject, NSApplicationDelegate {
 
-    @MainActor private let storeList: SecretStoreList = {
+    private let storeList: SecretStoreList = {
         let list = SecretStoreList()
-        let cryptoKit = SecureEnclave.Store()
-        let migrator = SecureEnclave.CryptoKitMigrator()
-        try? migrator.migrate(to: cryptoKit)
-        list.add(store: cryptoKit)
+        list.add(store: SecureEnclave.Store())
         list.add(store: SmartCard.Store())
         return list
     }()
-    private let updater = Updater(checkOnLaunch: true)
+    private let updater = Updater(checkOnLaunch: false)
     private let notifier = Notifier()
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: URL.homeDirectory)
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
     private lazy var agent: Agent = {
         Agent(storeList: storeList, witness: notifier)
     }()
@@ -29,22 +27,14 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         let path = (NSHomeDirectory() as NSString).appendingPathComponent("socket.ssh") as String
         return SocketController(path: path)
     }()
+    private var updateSink: AnyCancellable?
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "AppDelegate")
 
     func applicationDidFinishLaunching(_ aNotification: Notification) {
         logger.debug("SecretAgent finished launching")
-        Task {
-            for await session in socketController.sessions {
-                Task {
-                    do {
-                        for await message in session.messages {
-                            let agentResponse = try await agent.handle(data: message, provenance: session.provenance)
-                            try await session.write(agentResponse)
-                        }
-                    } catch {
-                        try session.close()
-                    }
-                }
+        Task { @MainActor in
+            socketController.handler = { [agent] reader, writer in
+                await agent.handle(reader: reader, writer: writer)
             }
         }
         Task {
@@ -57,14 +47,13 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         _ = withObservationTracking {
             updater.update
         } onChange: { [updater, notifier] in
-            Task {
-                guard !updater.testBuild else { return }
-                await notifier.notify(update: updater.update!) { release in
+            notifier.notify(update: updater.update!) { release in
+                Task {
                     await updater.ignore(release: release)
                 }
             }
         }
     }
-
+    
 }
 

Sources/SecretAgent/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -0,0 +1,60 @@
+{
+  "images" : [
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "16x16"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "16x16"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "32x32"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "32x32"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "128x128"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "128x128"
+    },
+    {
+      "filename" : "Mac Icon.png",
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "256x256"
+    },
+    {
+      "filename" : "Mac Icon@0.25x.png",
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "256x256"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "512x512"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "512x512"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

Sources/SecretAgent/Assets.xcassets/Contents.json

@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

Sources/SecretAgent/Notifier.swift

@@ -4,14 +4,15 @@ import AppKit
 import SecretKit
 import SecretAgentKit
 import Brief
+import os
 
 final class Notifier: Sendable {
 
     private let notificationDelegate = NotificationDelegate()
 
     init() {
-        let updateAction = UNNotificationAction(identifier: Constants.updateActionIdentitifier, title: String(localized: .updateNotificationUpdateButton), options: [])
-        let ignoreAction = UNNotificationAction(identifier: Constants.ignoreActionIdentitifier, title: String(localized: .updateNotificationIgnoreButton), options: [])
+        let updateAction = UNNotificationAction(identifier: Constants.updateActionIdentitifier, title: String(localized: "update_notification_update_button"), options: [])
+        let ignoreAction = UNNotificationAction(identifier: Constants.ignoreActionIdentitifier, title: String(localized: "update_notification_ignore_button"), options: [])
         let updateCategory = UNNotificationCategory(identifier: Constants.updateCategoryIdentitifier, actions: [updateAction, ignoreAction], intentIdentifiers: [], options: [])
         let criticalUpdateCategory = UNNotificationCategory(identifier: Constants.criticalUpdateCategoryIdentitifier, actions: [updateAction], intentIdentifiers: [], options: [])
 
@@ -22,32 +23,33 @@ final class Notifier: Sendable {
             Measurement(value: 24, unit: UnitDuration.hours)
         ]
 
-        let doNotPersistAction = UNNotificationAction(identifier: Constants.doNotPersistActionIdentitifier, title: String(localized: .persistAuthenticationDeclineButton), options: [])
+        let doNotPersistAction = UNNotificationAction(identifier: Constants.doNotPersistActionIdentitifier, title: String(localized: "persist_authentication_decline_button"), options: [])
         var allPersistenceActions = [doNotPersistAction]
 
         let formatter = DateComponentsFormatter()
         formatter.unitsStyle = .spellOut
         formatter.allowedUnits = [.hour, .minute, .day]
 
-        var identifiers: [String: TimeInterval] = [:]
         for duration in rawDurations {
             let seconds = duration.converted(to: .seconds).value
             guard let string = formatter.string(from: seconds)?.capitalized else { continue }
             let identifier = Constants.persistAuthenticationCategoryIdentitifier.appending("\(seconds)")
             let action = UNNotificationAction(identifier: identifier, title: string, options: [])
-            identifiers[identifier] = seconds
+            notificationDelegate.state.withLock { state in
+                state.persistOptions[identifier] = seconds
+            }
             allPersistenceActions.append(action)
         }
 
         let persistAuthenticationCategory = UNNotificationCategory(identifier: Constants.persistAuthenticationCategoryIdentitifier, actions: allPersistenceActions, intentIdentifiers: [], options: [])
         if persistAuthenticationCategory.responds(to: Selector(("actionsMenuTitle"))) {
-            persistAuthenticationCategory.setValue(String(localized: .persistAuthenticationAcceptButton), forKey: "_actionsMenuTitle")
+            persistAuthenticationCategory.setValue(String(localized: "persist_authentication_accept_button"), forKey: "_actionsMenuTitle")
         }
         UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory, persistAuthenticationCategory])
         UNUserNotificationCenter.current().delegate = notificationDelegate
 
-        Task {
-            await notificationDelegate.state.setPersistenceState(options: identifiers) { secret, store, duration in
+        notificationDelegate.state.withLock { state in
+            state.persistAuthentication = { secret, store, duration in
                 guard let duration = duration else { return }
                 try? await store.persistAuthentication(secret: secret, forDuration: duration)
             }
@@ -61,15 +63,18 @@ final class Notifier: Sendable {
     }
 
     func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async {
-        await notificationDelegate.state.setPending(secret: secret, store: store)
+        notificationDelegate.state.withLock { state in
+            state.pendingPersistableSecrets[secret.id.description] = secret
+            state.pendingPersistableStores[store.id.description] = store
+        }
         let notificationCenter = UNUserNotificationCenter.current()
         let notificationContent = UNMutableNotificationContent()
-        notificationContent.title = String(localized: .signedNotificationTitle(appName: provenance.origin.displayName))
-        notificationContent.subtitle = String(localized: .signedNotificationDescription(secretName: secret.name))
+        notificationContent.title = String(localized: "signed_notification_title_\(provenance.origin.displayName)")
+        notificationContent.subtitle = String(localized: "signed_notification_description_\(secret.name)")
         notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description
         notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description
         notificationContent.interruptionLevel = .timeSensitive
-        if await store.existingPersistedAuthenticationContext(secret: secret) == nil && secret.authenticationRequirement.required {
+        if await store.existingPersistedAuthenticationContext(secret: secret) == nil && secret.requiresAuthentication {
             notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier
         }
         if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) {
@@ -79,21 +84,24 @@ final class Notifier: Sendable {
         try? await notificationCenter.add(request)
     }
 
-    func notify(update: Release, ignore: (@Sendable (Release) async -> Void)?) async {
-        await notificationDelegate.state.prepareForNotification(release: update, ignoreAction: ignore)
+    func notify(update: Release, ignore: (@Sendable (Release) -> Void)?) {
+        notificationDelegate.state.withLock { [update] state in
+            state.release = update
+            state.ignore = ignore
+        }
         let notificationCenter = UNUserNotificationCenter.current()
         let notificationContent = UNMutableNotificationContent()
         if update.critical {
             notificationContent.interruptionLevel = .critical
-            notificationContent.title = String(localized: .updateNotificationUpdateCriticalTitle(updateName: update.name))
+            notificationContent.title = String(localized: "update_notification_update_critical_title_\(update.name)")
         } else {
-            notificationContent.title = String(localized: .updateNotificationUpdateNormalTitle(updateName: update.name))
+            notificationContent.title = String(localized: "update_notification_update_normal_title_\(update.name)")
         }
-        notificationContent.subtitle = String(localized: .updateNotificationUpdateDescription)
+        notificationContent.subtitle = String(localized: "update_notification_update_description")
         notificationContent.body = update.body
         notificationContent.categoryIdentifier = update.critical ? Constants.criticalUpdateCategoryIdentitifier : Constants.updateCategoryIdentitifier
         let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
-        try? await notificationCenter.add(request)
+        notificationCenter.add(request, withCompletionHandler: nil)
     }
 
 }
@@ -132,55 +140,28 @@ extension Notifier {
 
 final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Sendable {
 
-    fileprivate actor State {
-        typealias PersistAction = (@Sendable (AnySecret, AnySecretStore, TimeInterval?) async -> Void)
-        typealias IgnoreAction = (@Sendable (Release) async -> Void)
+    struct State {
+        typealias PersistAuthentication = (@Sendable (AnySecret, AnySecretStore, TimeInterval?) async -> Void)
+        typealias Ignore = ((Release) -> Void)
         fileprivate var release: Release?
-        fileprivate var ignoreAction: IgnoreAction?
-        fileprivate var persistAction: PersistAction?
+        fileprivate var ignore: Ignore?
+        fileprivate var persistAuthentication: PersistAuthentication?
         fileprivate var persistOptions: [String: TimeInterval] = [:]
         fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:]
         fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:]
-
-        func setPending(secret: AnySecret, store: AnySecretStore) {
-            pendingPersistableSecrets[secret.id.description] = secret
-            pendingPersistableStores[store.id.description] = store
-        }
-
-        func retrievePending(secretID: String, storeID: String, optionID: String) -> (AnySecret, AnySecretStore, TimeInterval)? {
-            guard let secret = pendingPersistableSecrets[secretID],
-                  let store = pendingPersistableStores[storeID],
-                  let options = persistOptions[optionID] else {
-                return nil
-            }
-            pendingPersistableSecrets.removeValue(forKey: secretID)
-            return (secret, store, options)
-        }
-
-        func setPersistenceState(options: [String: TimeInterval], action: @escaping PersistAction) {
-            self.persistOptions = options
-            self.persistAction = action
-        }
-
-        func prepareForNotification(release: Release, ignoreAction: IgnoreAction?) {
-            self.release = release
-            self.ignoreAction = ignoreAction
-        }
-
-        
     }
-
-    fileprivate let state = State()
-
+    
+    fileprivate let state: OSAllocatedUnfairLock<State> = .init(uncheckedState: .init())
+    
     func userNotificationCenter(_ center: UNUserNotificationCenter, openSettingsFor notification: UNNotification?) {
 
     }
-
+    
     func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse) async {
         let category = response.notification.request.content.categoryIdentifier
         switch category {
         case Notifier.Constants.updateCategoryIdentitifier:
-            await handleUpdateResponse(response: response)
+            handleUpdateResponse(response: response)
         case Notifier.Constants.persistAuthenticationCategoryIdentitifier:
             await handlePersistAuthenticationResponse(response: response)
         default:
@@ -188,16 +169,18 @@ final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Se
         }
     }
 
-    func handleUpdateResponse(response: UNNotificationResponse) async {
+    func handleUpdateResponse(response: UNNotificationResponse) {
         let id = response.actionIdentifier
-        guard let update = await state.release else { return }
-        switch id {
-        case Notifier.Constants.updateActionIdentitifier, UNNotificationDefaultActionIdentifier:
-            NSWorkspace.shared.open(update.html_url)
-        case Notifier.Constants.ignoreActionIdentitifier:
-            await state.ignoreAction?(update)
-        default:
-            fatalError()
+        state.withLock { state in
+            guard let update = state.release else { return }
+            switch id {
+            case Notifier.Constants.updateActionIdentitifier, UNNotificationDefaultActionIdentifier:
+                NSWorkspace.shared.open(update.html_url)
+            case Notifier.Constants.ignoreActionIdentitifier:
+                state.ignore?(update)
+            default:
+                fatalError()
+            }
         }
     }
 
@@ -206,15 +189,22 @@ final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Se
               let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String else {
             return
         }
-        let optionID = response.actionIdentifier
-        guard let (secret, store, persistOptions) = await state.retrievePending(secretID: secretID, storeID: storeID, optionID: optionID) else { return }
-        await state.persistAction?(secret, store, persistOptions)
+        let id = response.actionIdentifier
+              
+        let (secret, store, persistOptions, callback): (AnySecret?, AnySecretStore?, TimeInterval?, State.PersistAuthentication?) = state.withLock { state in
+            guard let secret = state.pendingPersistableSecrets[secretID],
+                let store = state.pendingPersistableStores[storeID]
+            else { return (nil, nil, nil, nil) }
+            state.pendingPersistableSecrets[secretID] = nil
+            return (secret, store, state.persistOptions[id], state.persistAuthentication)
+        }
+        guard let secret, let store, let persistOptions else { return }
+        await callback?(secret, store, persistOptions)
     }
 
-
+    
     func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification) async -> UNNotificationPresentationOptions {
         [.list, .banner]
     }
 
 }
-

Sources/Secretive.xcodeproj/project.pbxproj

@@ -7,7 +7,7 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
-		2C4A9D2F2636FFD3008CC8E2 /* EditSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2C4A9D2E2636FFD3008CC8E2 /* EditSecretView.swift */; };
+		2C4A9D2F2636FFD3008CC8E2 /* RenameSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2C4A9D2E2636FFD3008CC8E2 /* RenameSecretView.swift */; };
 		50020BB024064869003D4025 /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50020BAF24064869003D4025 /* AppDelegate.swift */; };
 		50033AC327813F1700253856 /* BundleIDs.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50033AC227813F1700253856 /* BundleIDs.swift */; };
 		5003EF3B278005E800DF2006 /* SecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF3A278005E800DF2006 /* SecretKit */; };
@@ -18,18 +18,12 @@
 		5003EF612780081600DF2006 /* SmartCardSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF602780081600DF2006 /* SmartCardSecretKit */; };
 		5003EF632780081B00DF2006 /* SecureEnclaveSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF622780081B00DF2006 /* SecureEnclaveSecretKit */; };
 		5003EF652780081B00DF2006 /* SmartCardSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF642780081B00DF2006 /* SmartCardSecretKit */; };
-		5008C23E2E525D8900507AC2 /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 5008C23D2E525D8200507AC2 /* Localizable.xcstrings */; };
-		5008C2402E52792400507AC2 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8623FCE48E0099B055 /* Assets.xcassets */; };
-		5008C2412E52D18700507AC2 /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 5008C23D2E525D8200507AC2 /* Localizable.xcstrings */; };
+		500B93C32B478D8400E157DE /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 500B93C22B478D8400E157DE /* Localizable.xcstrings */; };
 		501421622781262300BBAA70 /* Brief in Frameworks */ = {isa = PBXBuildFile; productRef = 501421612781262300BBAA70 /* Brief */; };
 		501421652781268000BBAA70 /* SecretAgent.app in CopyFiles */ = {isa = PBXBuildFile; fileRef = 50A3B78A24026B7500D209EA /* SecretAgent.app */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		50153E20250AFCB200525160 /* UpdateView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50153E1F250AFCB200525160 /* UpdateView.swift */; };
 		50153E22250DECA300525160 /* SecretListItemView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50153E21250DECA300525160 /* SecretListItemView.swift */; };
 		5018F54F24064786002EB505 /* Notifier.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5018F54E24064786002EB505 /* Notifier.swift */; };
-		504788EC2E680DC800B4556F /* URLs.swift in Sources */ = {isa = PBXBuildFile; fileRef = 504788EB2E680DC400B4556F /* URLs.swift */; };
-		504788F22E681F3A00B4556F /* Instructions.swift in Sources */ = {isa = PBXBuildFile; fileRef = 504788F12E681F3A00B4556F /* Instructions.swift */; };
-		504788F42E681F6900B4556F /* ToolConfigurationView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 504788F32E681F6900B4556F /* ToolConfigurationView.swift */; };
-		504788F62E68206F00B4556F /* GettingStartedView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 504788F52E68206F00B4556F /* GettingStartedView.swift */; };
 		50571E0324393C2600F76F6C /* JustUpdatedChecker.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50571E0224393C2600F76F6C /* JustUpdatedChecker.swift */; };
 		50571E0524393D1500F76F6C /* LaunchAgentController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50571E0424393D1500F76F6C /* LaunchAgentController.swift */; };
 		50617D8323FCE48E0099B055 /* App.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D8223FCE48E0099B055 /* App.swift */; };
@@ -40,6 +34,7 @@
 		5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5065E312295517C500E16645 /* ToolbarButtonStyle.swift */; };
 		5066A6C22516F303004B5A36 /* SetupView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C12516F303004B5A36 /* SetupView.swift */; };
 		5066A6C82516FE6E004B5A36 /* CopyableView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C72516FE6E004B5A36 /* CopyableView.swift */; };
+		5066A6F7251829B1004B5A36 /* ShellConfigurationController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6F6251829B1004B5A36 /* ShellConfigurationController.swift */; };
 		506772C72424784600034DED /* Credits.rtf in Resources */ = {isa = PBXBuildFile; fileRef = 506772C62424784600034DED /* Credits.rtf */; };
 		506772C92425BB8500034DED /* NoStoresView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 506772C82425BB8500034DED /* NoStoresView.swift */; };
 		5079BA0F250F29BF00EA86F4 /* StoreListView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5079BA0E250F29BF00EA86F4 /* StoreListView.swift */; };
@@ -50,16 +45,13 @@
 		508BF2AA25B4F1CB009EFB7E /* InternetAccessPolicy.plist in Resources */ = {isa = PBXBuildFile; fileRef = 508BF29425B4F140009EFB7E /* InternetAccessPolicy.plist */; };
 		5091D2BC25183B830049FD9B /* ApplicationDirectoryController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5091D2BB25183B830049FD9B /* ApplicationDirectoryController.swift */; };
 		5099A02423FD2AAA0062B6F2 /* CreateSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5099A02323FD2AAA0062B6F2 /* CreateSecretView.swift */; };
+		50A3B79124026B7600D209EA /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50A3B79024026B7600D209EA /* Assets.xcassets */; };
 		50A3B79424026B7600D209EA /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50A3B79324026B7600D209EA /* Preview Assets.xcassets */; };
 		50A3B79724026B7600D209EA /* Main.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 50A3B79524026B7600D209EA /* Main.storyboard */; };
-		50AE97002E5C1A420018C710 /* IntegrationsView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50AE96FF2E5C1A420018C710 /* IntegrationsView.swift */; };
 		50B8550D24138C4F009958AC /* DeleteSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50B8550C24138C4F009958AC /* DeleteSecretView.swift */; };
 		50BB046B2418AAAE00D6E079 /* EmptyStoreView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */; };
-		50BDCB722E63BAF20072D2E7 /* AgentStatusView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BDCB712E63BAF20072D2E7 /* AgentStatusView.swift */; };
-		50BDCB742E6436CA0072D2E7 /* ErrorStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BDCB732E6436C60072D2E7 /* ErrorStyle.swift */; };
-		50BDCB762E6450950072D2E7 /* ConfigurationItemView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BDCB752E6450950072D2E7 /* ConfigurationItemView.swift */; };
 		50C385A52407A76D00AF2719 /* SecretDetailView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50C385A42407A76D00AF2719 /* SecretDetailView.swift */; };
-		50CF4ABC2E601B0F005588DC /* ActionButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50CF4ABB2E601B0F005588DC /* ActionButtonStyle.swift */; };
+		50E9CF422B51D596004AB36D /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 500B93C22B478D8400E157DE /* Localizable.xcstrings */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -106,18 +98,14 @@
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
-		2C4A9D2E2636FFD3008CC8E2 /* EditSecretView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = EditSecretView.swift; sourceTree = "<group>"; };
+		2C4A9D2E2636FFD3008CC8E2 /* RenameSecretView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = RenameSecretView.swift; sourceTree = "<group>"; };
 		50020BAF24064869003D4025 /* AppDelegate.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
 		50033AC227813F1700253856 /* BundleIDs.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BundleIDs.swift; sourceTree = "<group>"; };
 		5003EF39278005C800DF2006 /* Packages */ = {isa = PBXFileReference; lastKnownFileType = wrapper; path = Packages; sourceTree = "<group>"; };
-		5008C23D2E525D8200507AC2 /* Localizable.xcstrings */ = {isa = PBXFileReference; lastKnownFileType = text.json.xcstrings; name = Localizable.xcstrings; path = Packages/Resources/Localizable.xcstrings; sourceTree = SOURCE_ROOT; };
+		500B93C22B478D8400E157DE /* Localizable.xcstrings */ = {isa = PBXFileReference; lastKnownFileType = text.json.xcstrings; path = Localizable.xcstrings; sourceTree = "<group>"; };
 		50153E1F250AFCB200525160 /* UpdateView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = UpdateView.swift; sourceTree = "<group>"; };
 		50153E21250DECA300525160 /* SecretListItemView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretListItemView.swift; sourceTree = "<group>"; };
 		5018F54E24064786002EB505 /* Notifier.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Notifier.swift; sourceTree = "<group>"; };
-		504788EB2E680DC400B4556F /* URLs.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = URLs.swift; sourceTree = "<group>"; };
-		504788F12E681F3A00B4556F /* Instructions.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Instructions.swift; sourceTree = "<group>"; };
-		504788F32E681F6900B4556F /* ToolConfigurationView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ToolConfigurationView.swift; sourceTree = "<group>"; };
-		504788F52E68206F00B4556F /* GettingStartedView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = GettingStartedView.swift; sourceTree = "<group>"; };
 		50571E0224393C2600F76F6C /* JustUpdatedChecker.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = JustUpdatedChecker.swift; sourceTree = "<group>"; };
 		50571E0424393D1500F76F6C /* LaunchAgentController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = LaunchAgentController.swift; sourceTree = "<group>"; };
 		50617D7F23FCE48E0099B055 /* Secretive.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Secretive.app; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -131,6 +119,7 @@
 		5065E312295517C500E16645 /* ToolbarButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ToolbarButtonStyle.swift; sourceTree = "<group>"; };
 		5066A6C12516F303004B5A36 /* SetupView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SetupView.swift; sourceTree = "<group>"; };
 		5066A6C72516FE6E004B5A36 /* CopyableView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = CopyableView.swift; sourceTree = "<group>"; };
+		5066A6F6251829B1004B5A36 /* ShellConfigurationController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ShellConfigurationController.swift; sourceTree = "<group>"; };
 		506772C62424784600034DED /* Credits.rtf */ = {isa = PBXFileReference; lastKnownFileType = text.rtf; path = Credits.rtf; sourceTree = "<group>"; };
 		506772C82425BB8500034DED /* NoStoresView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NoStoresView.swift; sourceTree = "<group>"; };
 		5079BA0E250F29BF00EA86F4 /* StoreListView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = StoreListView.swift; sourceTree = "<group>"; };
@@ -144,18 +133,14 @@
 		5091D2BB25183B830049FD9B /* ApplicationDirectoryController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ApplicationDirectoryController.swift; sourceTree = "<group>"; };
 		5099A02323FD2AAA0062B6F2 /* CreateSecretView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = CreateSecretView.swift; sourceTree = "<group>"; };
 		50A3B78A24026B7500D209EA /* SecretAgent.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = SecretAgent.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		50A3B79024026B7600D209EA /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
 		50A3B79324026B7600D209EA /* Preview Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = "Preview Assets.xcassets"; sourceTree = "<group>"; };
 		50A3B79624026B7600D209EA /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; name = Base; path = Base.lproj/Main.storyboard; sourceTree = "<group>"; };
 		50A3B79824026B7600D209EA /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		50A3B79924026B7600D209EA /* SecretAgent.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = SecretAgent.entitlements; sourceTree = "<group>"; };
-		50AE96FF2E5C1A420018C710 /* IntegrationsView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = IntegrationsView.swift; sourceTree = "<group>"; };
 		50B8550C24138C4F009958AC /* DeleteSecretView.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = DeleteSecretView.swift; sourceTree = "<group>"; };
 		50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = EmptyStoreView.swift; sourceTree = "<group>"; };
-		50BDCB712E63BAF20072D2E7 /* AgentStatusView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AgentStatusView.swift; sourceTree = "<group>"; };
-		50BDCB732E6436C60072D2E7 /* ErrorStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ErrorStyle.swift; sourceTree = "<group>"; };
-		50BDCB752E6450950072D2E7 /* ConfigurationItemView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ConfigurationItemView.swift; sourceTree = "<group>"; };
 		50C385A42407A76D00AF2719 /* SecretDetailView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretDetailView.swift; sourceTree = "<group>"; };
-		50CF4ABB2E601B0F005588DC /* ActionButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ActionButtonStyle.swift; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -193,55 +178,6 @@
 			path = Helpers;
 			sourceTree = "<group>";
 		};
-		504788ED2E681EB200B4556F /* Styles */ = {
-			isa = PBXGroup;
-			children = (
-				50CF4ABB2E601B0F005588DC /* ActionButtonStyle.swift */,
-				50BDCB732E6436C60072D2E7 /* ErrorStyle.swift */,
-				5065E312295517C500E16645 /* ToolbarButtonStyle.swift */,
-			);
-			path = Styles;
-			sourceTree = "<group>";
-		};
-		504788EE2E681EC300B4556F /* Secrets */ = {
-			isa = PBXGroup;
-			children = (
-				5099A02323FD2AAA0062B6F2 /* CreateSecretView.swift */,
-				50B8550C24138C4F009958AC /* DeleteSecretView.swift */,
-				2C4A9D2E2636FFD3008CC8E2 /* EditSecretView.swift */,
-				50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */,
-				506772C82425BB8500034DED /* NoStoresView.swift */,
-				50C385A42407A76D00AF2719 /* SecretDetailView.swift */,
-				50153E21250DECA300525160 /* SecretListItemView.swift */,
-				5079BA0E250F29BF00EA86F4 /* StoreListView.swift */,
-			);
-			path = Secrets;
-			sourceTree = "<group>";
-		};
-		504788EF2E681ED700B4556F /* Configuration */ = {
-			isa = PBXGroup;
-			children = (
-				50BDCB752E6450950072D2E7 /* ConfigurationItemView.swift */,
-				50AE96FF2E5C1A420018C710 /* IntegrationsView.swift */,
-				504788F12E681F3A00B4556F /* Instructions.swift */,
-				504788F32E681F6900B4556F /* ToolConfigurationView.swift */,
-				5066A6C12516F303004B5A36 /* SetupView.swift */,
-				504788F52E68206F00B4556F /* GettingStartedView.swift */,
-			);
-			path = Configuration;
-			sourceTree = "<group>";
-		};
-		504788F02E681F0100B4556F /* Views */ = {
-			isa = PBXGroup;
-			children = (
-				50BDCB712E63BAF20072D2E7 /* AgentStatusView.swift */,
-				50617D8423FCE48E0099B055 /* ContentView.swift */,
-				5066A6C72516FE6E004B5A36 /* CopyableView.swift */,
-				50153E1F250AFCB200525160 /* UpdateView.swift */,
-			);
-			path = Views;
-			sourceTree = "<group>";
-		};
 		50617D7623FCE48D0099B055 = {
 			isa = PBXGroup;
 			children = (
@@ -275,7 +211,7 @@
 				508BF28D25B4F005009EFB7E /* InternetAccessPolicy.plist */,
 				50617D8F23FCE48E0099B055 /* Secretive.entitlements */,
 				506772C62424784600034DED /* Credits.rtf */,
-				5008C23D2E525D8200507AC2 /* Localizable.xcstrings */,
+				500B93C22B478D8400E157DE /* Localizable.xcstrings */,
 				50617D8823FCE48E0099B055 /* Preview Content */,
 			);
 			path = Secretive;
@@ -304,10 +240,19 @@
 		508A58B0241ED1C40069DC07 /* Views */ = {
 			isa = PBXGroup;
 			children = (
-				504788EF2E681ED700B4556F /* Configuration */,
-				504788EE2E681EC300B4556F /* Secrets */,
-				504788ED2E681EB200B4556F /* Styles */,
-				504788F02E681F0100B4556F /* Views */,
+				50617D8423FCE48E0099B055 /* ContentView.swift */,
+				5065E312295517C500E16645 /* ToolbarButtonStyle.swift */,
+				5079BA0E250F29BF00EA86F4 /* StoreListView.swift */,
+				50153E21250DECA300525160 /* SecretListItemView.swift */,
+				50C385A42407A76D00AF2719 /* SecretDetailView.swift */,
+				5099A02323FD2AAA0062B6F2 /* CreateSecretView.swift */,
+				50B8550C24138C4F009958AC /* DeleteSecretView.swift */,
+				2C4A9D2E2636FFD3008CC8E2 /* RenameSecretView.swift */,
+				50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */,
+				506772C82425BB8500034DED /* NoStoresView.swift */,
+				50153E1F250AFCB200525160 /* UpdateView.swift */,
+				5066A6C12516F303004B5A36 /* SetupView.swift */,
+				5066A6C72516FE6E004B5A36 /* CopyableView.swift */,
 			);
 			path = Views;
 			sourceTree = "<group>";
@@ -315,11 +260,11 @@
 		508A58B1241ED1EA0069DC07 /* Controllers */ = {
 			isa = PBXGroup;
 			children = (
-				504788EB2E680DC400B4556F /* URLs.swift */,
 				508A58B2241ED2180069DC07 /* AgentStatusChecker.swift */,
 				5091D2BB25183B830049FD9B /* ApplicationDirectoryController.swift */,
 				50571E0224393C2600F76F6C /* JustUpdatedChecker.swift */,
 				50571E0424393D1500F76F6C /* LaunchAgentController.swift */,
+				5066A6F6251829B1004B5A36 /* ShellConfigurationController.swift */,
 			);
 			path = Controllers;
 			sourceTree = "<group>";
@@ -336,6 +281,7 @@
 			children = (
 				50020BAF24064869003D4025 /* AppDelegate.swift */,
 				5018F54E24064786002EB505 /* Notifier.swift */,
+				50A3B79024026B7600D209EA /* Assets.xcassets */,
 				50A3B79524026B7600D209EA /* Main.storyboard */,
 				50A3B79824026B7600D209EA /* Info.plist */,
 				508BF29425B4F140009EFB7E /* InternetAccessPolicy.plist */,
@@ -440,8 +386,6 @@
 				fi,
 				ko,
 				ca,
-				ru,
-				pl,
 			);
 			mainGroup = 50617D7623FCE48D0099B055;
 			productRefGroup = 50617D8023FCE48E0099B055 /* Products */;
@@ -460,7 +404,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				50617D8A23FCE48E0099B055 /* Preview Assets.xcassets in Resources */,
-				5008C23E2E525D8900507AC2 /* Localizable.xcstrings in Resources */,
+				500B93C32B478D8400E157DE /* Localizable.xcstrings in Resources */,
 				50617D8723FCE48E0099B055 /* Assets.xcassets in Resources */,
 				506772C72424784600034DED /* Credits.rtf in Resources */,
 				508BF28E25B4F005009EFB7E /* InternetAccessPolicy.plist in Resources */,
@@ -472,10 +416,10 @@
 			buildActionMask = 2147483647;
 			files = (
 				50A3B79724026B7600D209EA /* Main.storyboard in Resources */,
-				5008C2412E52D18700507AC2 /* Localizable.xcstrings in Resources */,
+				50E9CF422B51D596004AB36D /* Localizable.xcstrings in Resources */,
 				50A3B79424026B7600D209EA /* Preview Assets.xcassets in Resources */,
+				50A3B79124026B7600D209EA /* Assets.xcassets in Resources */,
 				508BF2AA25B4F1CB009EFB7E /* InternetAccessPolicy.plist in Resources */,
-				5008C2402E52792400507AC2 /* Assets.xcassets in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -486,33 +430,25 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				504788F22E681F3A00B4556F /* Instructions.swift in Sources */,
-				50BDCB742E6436CA0072D2E7 /* ErrorStyle.swift in Sources */,
-				2C4A9D2F2636FFD3008CC8E2 /* EditSecretView.swift in Sources */,
+				2C4A9D2F2636FFD3008CC8E2 /* RenameSecretView.swift in Sources */,
 				5091D2BC25183B830049FD9B /* ApplicationDirectoryController.swift in Sources */,
-				504788EC2E680DC800B4556F /* URLs.swift in Sources */,
 				5066A6C22516F303004B5A36 /* SetupView.swift in Sources */,
 				5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */,
 				50617D8523FCE48E0099B055 /* ContentView.swift in Sources */,
-				504788F62E68206F00B4556F /* GettingStartedView.swift in Sources */,
-				50CF4ABC2E601B0F005588DC /* ActionButtonStyle.swift in Sources */,
 				50571E0324393C2600F76F6C /* JustUpdatedChecker.swift in Sources */,
 				5079BA0F250F29BF00EA86F4 /* StoreListView.swift in Sources */,
 				50617DD223FCEFA90099B055 /* PreviewStore.swift in Sources */,
+				5066A6F7251829B1004B5A36 /* ShellConfigurationController.swift in Sources */,
 				50033AC327813F1700253856 /* BundleIDs.swift in Sources */,
-				50BDCB722E63BAF20072D2E7 /* AgentStatusView.swift in Sources */,
 				508A58B3241ED2180069DC07 /* AgentStatusChecker.swift in Sources */,
 				50C385A52407A76D00AF2719 /* SecretDetailView.swift in Sources */,
 				5099A02423FD2AAA0062B6F2 /* CreateSecretView.swift in Sources */,
-				50AE97002E5C1A420018C710 /* IntegrationsView.swift in Sources */,
 				50153E20250AFCB200525160 /* UpdateView.swift in Sources */,
 				50571E0524393D1500F76F6C /* LaunchAgentController.swift in Sources */,
 				5066A6C82516FE6E004B5A36 /* CopyableView.swift in Sources */,
 				50B8550D24138C4F009958AC /* DeleteSecretView.swift in Sources */,
 				50BB046B2418AAAE00D6E079 /* EmptyStoreView.swift in Sources */,
-				50BDCB762E6450950072D2E7 /* ConfigurationItemView.swift in Sources */,
 				50617D8323FCE48E0099B055 /* App.swift in Sources */,
-				504788F42E681F6900B4556F /* ToolConfigurationView.swift in Sources */,
 				506772C92425BB8500034DED /* NoStoresView.swift in Sources */,
 				50153E22250DECA300525160 /* SecretListItemView.swift in Sources */,
 				508A58B5241ED48F0069DC07 /* PreviewAgentStatusChecker.swift in Sources */,
@@ -590,8 +526,6 @@
 				COPY_PHASE_STRIP = NO;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_ENHANCED_SECURITY = YES;
-				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -664,9 +598,7 @@
 				COPY_PHASE_STRIP = NO;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				ENABLE_ENHANCED_SECURITY = YES;
 				ENABLE_NS_ASSERTIONS = NO;
-				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu11;
@@ -705,20 +637,10 @@
 				DEVELOPMENT_ASSET_PATHS = "\"Secretive/Preview Content\"";
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
 				ENABLE_APP_SANDBOX = YES;
-				ENABLE_ENHANCED_SECURITY = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
 				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
-				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
-				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
-				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
-				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
-				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
-				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
-				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
-				ENABLE_RESOURCE_ACCESS_USB = NO;
+				ENABLE_USER_SELECTED_FILES = readwrite;
 				INFOPLIST_FILE = Secretive/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -745,20 +667,10 @@
 				DEVELOPMENT_ASSET_PATHS = "\"Secretive/Preview Content\"";
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
 				ENABLE_APP_SANDBOX = YES;
-				ENABLE_ENHANCED_SECURITY = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
 				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
-				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
-				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
-				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
-				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
-				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
-				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
-				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
-				ENABLE_RESOURCE_ACCESS_USB = NO;
+				ENABLE_USER_SELECTED_FILES = readwrite;
 				INFOPLIST_FILE = Secretive/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -811,8 +723,6 @@
 				COPY_PHASE_STRIP = NO;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_ENHANCED_SECURITY = YES;
-				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -850,27 +760,16 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_ENTITLEMENTS = Secretive/Secretive.entitlements;
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
 				CURRENT_PROJECT_VERSION = 1;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_ASSET_PATHS = "\"Secretive/Preview Content\"";
 				ENABLE_APP_SANDBOX = YES;
-				ENABLE_ENHANCED_SECURITY = YES;
 				ENABLE_HARDENED_RUNTIME = NO;
-				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
 				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
-				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
-				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
-				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
-				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
-				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
-				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
-				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
-				ENABLE_RESOURCE_ACCESS_USB = NO;
+				ENABLE_USER_SELECTED_FILES = readwrite;
 				INFOPLIST_FILE = Secretive/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -893,17 +792,8 @@
 				DEVELOPMENT_ASSET_PATHS = "\"SecretAgent/Preview Content\"";
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
 				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
-				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
-				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
-				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
-				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
-				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
-				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
-				ENABLE_RESOURCE_ACCESS_USB = NO;
 				INFOPLIST_FILE = SecretAgent/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -928,17 +818,8 @@
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
 				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
-				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
-				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
-				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
-				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
-				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
-				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
-				ENABLE_RESOURCE_ACCESS_USB = NO;
 				INFOPLIST_FILE = SecretAgent/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -964,17 +845,8 @@
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
 				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
-				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
-				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
-				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
-				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
-				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
-				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
-				ENABLE_RESOURCE_ACCESS_USB = NO;
 				INFOPLIST_FILE = SecretAgent/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",

Sources/Secretive.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings

@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>iOSPackagesShouldBuildARM64e</key>
-	<true/>
-</dict>
-</plist>

Sources/Secretive/App.swift

@@ -1,3 +1,4 @@
+import Cocoa
 import SwiftUI
 import SecretKit
 import SecureEnclaveSecretKit
@@ -5,45 +6,38 @@ import SmartCardSecretKit
 import Brief
 
 extension EnvironmentValues {
-
-    // This is injected through .environment modifier below instead of @Entry for performance reasons (basially, restrictions around init/mainactor causing delay in loading secrets/"empty screen" blip).
-    @MainActor fileprivate static let _secretStoreList: SecretStoreList = {
+    @Entry var secretStoreList: SecretStoreList = {
         let list = SecretStoreList()
-        let cryptoKit = SecureEnclave.Store()
-        let migrator = SecureEnclave.CryptoKitMigrator()
-        try? migrator.migrate(to: cryptoKit)
-        list.add(store: cryptoKit)
+        list.add(store: SecureEnclave.Store())
         list.add(store: SmartCard.Store())
         return list
     }()
-
-    private static let _agentStatusChecker = AgentStatusChecker()
-    @Entry var agentStatusChecker: any AgentStatusCheckerProtocol = _agentStatusChecker
-    private static let _updater: any UpdaterProtocol = {
-        @AppStorage("defaultsHasRunSetup") var hasRunSetup = false
-        return Updater(checkOnLaunch: hasRunSetup)
-    }()
-    @Entry var updater: any UpdaterProtocol = _updater
-
-    @MainActor var secretStoreList: SecretStoreList {
-        EnvironmentValues._secretStoreList
-    }
+    @Entry var agentStatusChecker: any AgentStatusCheckerProtocol = AgentStatusChecker()
+    @Entry var updater: any UpdaterProtocol = Updater(checkOnLaunch: false)
 }
 
 @main
 struct Secretive: App {
     
+    private let storeList: SecretStoreList = {
+        let list = SecretStoreList()
+        list.add(store: SecureEnclave.Store())
+        list.add(store: SmartCard.Store())
+        return list
+    }()
+    private let agentStatusChecker = AgentStatusChecker()
     private let justUpdatedChecker = JustUpdatedChecker()
-    @Environment(\.agentStatusChecker) var agentStatusChecker
+
     @AppStorage("defaultsHasRunSetup") var hasRunSetup = false
     @State private var showingSetup = false
-    @State private var showingIntegrations = false
     @State private var showingCreation = false
 
     @SceneBuilder var body: some Scene {
         WindowGroup {
             ContentView(showingCreation: $showingCreation, runningSetup: $showingSetup, hasRunSetup: $hasRunSetup)
-                .environment(EnvironmentValues._secretStoreList)
+                .environment(storeList)
+                .environment(Updater(checkOnLaunch: hasRunSetup))
+                .environment(agentStatusChecker)
                 .onAppear {
                     if !hasRunSetup {
                         showingSetup = true
@@ -59,27 +53,24 @@ struct Secretive: App {
                         forceLaunchAgent()
                     }
                 }
-                .sheet(isPresented: $showingIntegrations) {
-                    IntegrationsView()
-                }
         }
         .commands {
-            CommandGroup(before: CommandGroupPlacement.appSettings) {
-                Button(.integrationsMenuBarTitle, systemImage: "app.connected.to.app.below.fill") {
-                    showingIntegrations = true
-                }
-            }
             CommandGroup(after: CommandGroupPlacement.newItem) {
-                Button(.appMenuNewSecretButton) {
+                Button("app_menu_new_secret_button") {
                     showingCreation = true
                 }
                 .keyboardShortcut(KeyboardShortcut(KeyEquivalent("N"), modifiers: [.command, .shift]))
             }
             CommandGroup(replacing: .help) {
-                Button(.appMenuHelpButton) {
+                Button("app_menu_help_button") {
                     NSWorkspace.shared.open(Constants.helpURL)
                 }
             }
+            CommandGroup(after: .help) {
+                Button("app_menu_setup_button") {
+                    showingSetup = true
+                }
+            }
             SidebarCommands()
         }
     }
@@ -91,7 +82,7 @@ extension Secretive {
     private func reinstallAgent() {
         justUpdatedChecker.check()
         Task {
-            _ = await LaunchAgentController().install()
+            await LaunchAgentController().install()
             try? await Task.sleep(for: .seconds(1))
             agentStatusChecker.check()
             if !agentStatusChecker.running {

Sources/Secretive/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -1,61 +1,53 @@
 {
   "images" : [
     {
-      "filename" : "Icon-macOS-ClearDark-16x16@1x.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "16x16"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-16x16@2x.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "16x16"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-32x32@1x.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "32x32"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-32x32@2x.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "32x32"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-128x128@1x.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "128x128"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-128x128@2x.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "128x128"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-256x256@1x.png",
+      "filename" : "Mac Icon.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "256x256"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-256x256@2x.png",
+      "filename" : "Mac Icon@0.25x.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "256x256"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-512x512@1x.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "512x512"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-1024x1024@1x.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "512x512"

Sources/Secretive/Assets.xcassets/Contents.json

@@ -1,6 +1,6 @@
 {
   "info" : {
-    "author" : "xcode",
-    "version" : 1
+    "version" : 1,
+    "author" : "xcode"
   }
-}
+}

Sources/Secretive/Controllers/AgentStatusChecker.swift

@@ -1,60 +1,49 @@
 import Foundation
+import Combine
 import AppKit
 import SecretKit
 import Observation
 
-@MainActor protocol AgentStatusCheckerProtocol: Observable, Sendable {
+protocol AgentStatusCheckerProtocol: Observable {
     var running: Bool { get }
     var developmentBuild: Bool { get }
-    var process: NSRunningApplication? { get }
-    func check()
 }
 
-@Observable @MainActor final class AgentStatusChecker: AgentStatusCheckerProtocol {
+@Observable class AgentStatusChecker: AgentStatusCheckerProtocol {
 
     var running: Bool = false
-    var process: NSRunningApplication? = nil
 
-    nonisolated init() {
-        Task { @MainActor in
-            check()
-        }
+    init() {
+        check()
     }
 
     func check() {
-        process = instanceSecretAgentProcess
-        running = process != nil
+        running = instanceSecretAgentProcess != nil
     }
 
     // All processes, including ones from older versions, etc
-    var allSecretAgentProcesses: [NSRunningApplication] {
-        NSRunningApplication.runningApplications(withBundleIdentifier: Bundle.agentBundleID)
+    var secretAgentProcesses: [NSRunningApplication] {
+        NSRunningApplication.runningApplications(withBundleIdentifier: Bundle.main.agentBundleID)
     }
 
     // The process corresponding to this instance of Secretive
     var instanceSecretAgentProcess: NSRunningApplication? {
-        // FIXME: CHECK VERSION
-        let agents = allSecretAgentProcesses
+        let agents = secretAgentProcesses
         for agent in agents {
             guard let url = agent.bundleURL else { continue }
-            if url.absoluteString.hasPrefix(Bundle.main.bundleURL.absoluteString) || (url.isXcodeURL && developmentBuild) {
+            if url.absoluteString.hasPrefix(Bundle.main.bundleURL.absoluteString) {
                 return agent
             }
         }
         return nil
     }
 
+
     // Whether Secretive is being run in an Xcode environment.
     var developmentBuild: Bool {
-        Bundle.main.bundleURL.isXcodeURL
+        Bundle.main.bundleURL.absoluteString.contains("/Library/Developer/Xcode")
     }
 
 }
 
-extension URL {
 
-    var isXcodeURL: Bool {
-        absoluteString.contains("/Library/Developer/Xcode")
-    }
-
-}

Sources/Secretive/Controllers/JustUpdatedChecker.swift

@@ -1,13 +1,14 @@
 import Foundation
+import Combine
 import AppKit
 
-protocol JustUpdatedCheckerProtocol: Observable {
+protocol JustUpdatedCheckerProtocol: ObservableObject {
     var justUpdated: Bool { get }
 }
 
-@Observable class JustUpdatedChecker: JustUpdatedCheckerProtocol {
+class JustUpdatedChecker: ObservableObject, JustUpdatedCheckerProtocol {
 
-    var justUpdated: Bool = false
+    @Published var justUpdated: Bool = false
 
     init() {
         check()

Sources/Secretive/Controllers/LaunchAgentController.swift

@@ -8,28 +8,16 @@ struct LaunchAgentController {
     
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "LaunchAgentController")
 
-    func install() async -> Bool {
+    func install() async {
         logger.debug("Installing agent")
         _ = setEnabled(false)
         // This is definitely a bit of a "seems to work better" thing but:
         // Seems to more reliably hit if these are on separate runloops, otherwise it seems like it sometimes doesn't kill old
         // and start new?
         try? await Task.sleep(for: .seconds(1))
-        let result = await MainActor.run {
-            setEnabled(true)
+        await MainActor.run {
+            _  = setEnabled(true)
         }
-        try? await Task.sleep(for: .seconds(1))
-        return result
-    }
-
-    func uninstall() async -> Bool {
-        logger.debug("Uninstalling agent")
-        try? await Task.sleep(for: .seconds(1))
-        let result = await MainActor.run {
-            setEnabled(false)
-        }
-        try? await Task.sleep(for: .seconds(1))
-        return result
     }
 
     func forceLaunch() async -> Bool {
@@ -40,7 +28,6 @@ struct LaunchAgentController {
         do {
             try await NSWorkspace.shared.openApplication(at: url, configuration: config)
             logger.debug("Agent force launched")
-            try? await Task.sleep(for: .seconds(1))
             return true
         } catch {
             logger.error("Error force launching \(error.localizedDescription)")
@@ -49,7 +36,7 @@ struct LaunchAgentController {
     }
 
     private func setEnabled(_ enabled: Bool) -> Bool {
-        let service = SMAppService.loginItem(identifier: Bundle.agentBundleID)
+        let service = SMAppService.loginItem(identifier: Bundle.main.agentBundleID)
         do {
             if enabled {
                 try service.register()

Sources/Secretive/Controllers/ShellConfigurationController.swift

@@ -0,0 +1,63 @@
+import Foundation
+import Cocoa
+import SecretKit
+
+struct ShellConfigurationController {
+    
+    let socketPath = (NSHomeDirectory().replacingOccurrences(of: Bundle.main.hostBundleID, with: Bundle.main.agentBundleID) as NSString).appendingPathComponent("socket.ssh") as String
+    
+    var shellInstructions: [ShellConfigInstruction] {
+        [
+            ShellConfigInstruction(shell: "global",
+                                   shellConfigDirectory: "~/.ssh/",
+                                   shellConfigFilename: "config",
+                                   text: "Host *\n\tIdentityAgent \(socketPath)"),
+            ShellConfigInstruction(shell: "zsh",
+                                   shellConfigDirectory: "~/",
+                                   shellConfigFilename: ".zshrc",
+                                   text: "export SSH_AUTH_SOCK=\(socketPath)"),
+            ShellConfigInstruction(shell: "bash",
+                                   shellConfigDirectory: "~/",
+                                   shellConfigFilename: ".bashrc",
+                                   text: "export SSH_AUTH_SOCK=\(socketPath)"),
+            ShellConfigInstruction(shell: "fish",
+                                   shellConfigDirectory: "~/.config/fish",
+                                   shellConfigFilename: "config.fish",
+                                   text: "set -x SSH_AUTH_SOCK \(socketPath)"),
+        ]
+        
+    }
+    
+    
+    @MainActor func addToShell(shellInstructions: ShellConfigInstruction) -> Bool {
+        let openPanel = NSOpenPanel()
+        // This is sync, so no need to strongly retain
+        let delegate = Delegate(name: shellInstructions.shellConfigFilename)
+        openPanel.delegate = delegate
+        openPanel.message = "Select \(shellInstructions.shellConfigFilename) to let Secretive configure your shell automatically."
+        openPanel.prompt = "Add to \(shellInstructions.shellConfigFilename)"
+        openPanel.canChooseFiles = true
+        openPanel.canChooseDirectories = false
+        openPanel.showsHiddenFiles = true
+        openPanel.directoryURL = URL(fileURLWithPath: shellInstructions.shellConfigDirectory)
+        openPanel.nameFieldStringValue = shellInstructions.shellConfigFilename
+        openPanel.allowedContentTypes = [.symbolicLink, .data, .plainText]
+        openPanel.runModal()
+        guard let fileURL = openPanel.urls.first else { return false }
+        let handle: FileHandle
+        do {
+            handle = try FileHandle(forUpdating: fileURL)
+            guard let existing = try handle.readToEnd(),
+                  let existingString = String(data: existing, encoding: .utf8) else { return false }
+            guard !existingString.contains(shellInstructions.text) else {
+                return true
+            }
+            try handle.seekToEnd()
+        } catch {
+            return false
+        }
+        handle.write("\n# Secretive Config\n\(shellInstructions.text)\n".data(using: .utf8)!)
+        return true
+    }
+    
+}

Sources/Secretive/Controllers/URLs.swift

@@ -1,12 +0,0 @@
-import Foundation
-
-extension URL {
-
-    static var agentHomeURL: URL {
-        URL(fileURLWithPath: URL.homeDirectory.path().replacingOccurrences(of: Bundle.hostBundleID, with: Bundle.agentBundleID))
-    }
-
-    static var socketPath: String {
-        URL.agentHomeURL.appendingPathComponent("socket.ssh").path()
-    }
-}

Sources/Secretive/Helpers/BundleIDs.swift

@@ -1,11 +1,7 @@
 import Foundation
 
-extension Bundle {
-    public static var agentBundleID: String {
-        Bundle.main.bundleIdentifier!.replacingOccurrences(of: "Host", with: "SecretAgent")
-    }
 
-    public static var hostBundleID: String {
-        Bundle.main.bundleIdentifier!.replacingOccurrences(of: "SecretAgent", with: "Host")
-    }
+extension Bundle {
+    public var agentBundleID: String {(self.bundleIdentifier?.replacingOccurrences(of: "Host", with: "SecretAgent"))!}
+    public var hostBundleID: String {(self.bundleIdentifier?.replacingOccurrences(of: "SecretAgent", with: "Host"))!}
 }

Sources/Secretive/Preview Content/PreviewAgentStatusChecker.swift

@@ -1,18 +1,13 @@
 import Foundation
-import AppKit
+import Combine
 
 class PreviewAgentStatusChecker: AgentStatusCheckerProtocol {
 
     let running: Bool
-    let process: NSRunningApplication?
     let developmentBuild = false
 
-    init(running: Bool = true, process: NSRunningApplication? = nil) {
+    init(running: Bool = true) {
         self.running = running
-        self.process = process
-    }
-
-    func check() {
     }
 
 }

Sources/Secretive/Preview Content/PreviewStore.swift

@@ -9,20 +9,18 @@ extension Preview {
 
         let id = UUID().uuidString
         let name: String
-        let publicKey = Data(UUID().uuidString.utf8)
-        var attributes: Attributes {
-            Attributes(
-                keyType: .init(algorithm: .ecdsa, size: 256),
-                authentication: .presenceRequired,
-            )
-        }
+        let algorithm = Algorithm.ellipticCurve
+        let keySize = 256
+        let requiresAuthentication: Bool = false
+        let publicKey = UUID().uuidString.data(using: .utf8)!
+
     }
 
 }
 
 extension Preview {
 
-    @Observable final class Store: SecretStore {
+    final class Store: SecretStore, ObservableObject {
 
         let isAvailable = true
         let id = UUID()
@@ -42,6 +40,10 @@ extension Preview {
             return data
         }
 
+        func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool {
+            true
+        }
+
         func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
             nil
         }
@@ -60,18 +62,7 @@ extension Preview {
         let id = UUID()
         var name: String { "Modifiable Preview Store" }
         let secrets: [Secret]
-        var supportedKeyTypes: [KeyType] {
-            if #available(macOS 26, *) {
-                [
-                    .ecdsa256,
-                    .mldsa65,
-                    .mldsa87,
-                ]
-            } else {
-                [.ecdsa256]
-            }
-        }
-        
+
         init(secrets: [Secret]) {
             self.secrets = secrets
         }
@@ -85,6 +76,10 @@ extension Preview {
             return data
         }
 
+        func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool {
+            true
+        }
+
         func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
             nil
         }
@@ -96,21 +91,20 @@ extension Preview {
         }
 
 
-        func create(name: String, attributes: Attributes) throws -> Secret {
-            fatalError()
+        func create(name: String, requiresAuthentication: Bool) throws {
         }
 
         func delete(secret: Preview.Secret) throws {
         }
 
-        func update(secret: Preview.Secret, name: String, attributes: Attributes) throws {
+        func update(secret: Preview.Secret, name: String) throws {
         }
     }
 }
 
 extension Preview {
 
-    @MainActor static func storeList(stores: [Store] = [], modifiableStores: [StoreModifiable] = []) -> SecretStoreList {
+    static func storeList(stores: [Store] = [], modifiableStores: [StoreModifiable] = []) -> SecretStoreList {
         let list = SecretStoreList()
         for store in stores {
             list.add(store: store)

Sources/Secretive/Preview Content/PreviewUpdater.swift

@@ -1,27 +1,28 @@
 import Foundation
+import os
 import Observation
 import Brief
 
-@Observable @MainActor final class PreviewUpdater: UpdaterProtocol {
+@Observable class PreviewUpdater: UpdaterProtocol {
 
-    var update: Release? = nil
+    var update: Release? {
+        _update.lockedValue
+    }
+    let _update: OSAllocatedUnfairLock<Release?> = .init(uncheckedState: nil)
 
     let testBuild = false
 
     init(update: Update = .none) {
         switch update {
         case .none:
-            self.update = nil
+            _update.lockedValue = nil
         case .advisory:
-            self.update = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Some regular update")
+            _update.lockedValue = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Some regular update")
         case .critical:
-            self.update = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
+            _update.lockedValue = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
         }
     }
 
-    func ignore(release: Release) async {
-    }
-    
 }
 
 extension PreviewUpdater {

Sources/Secretive/Secretive.entitlements

@@ -2,16 +2,6 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>com.apple.security.hardened-process</key>
-	<true/>
-	<key>com.apple.security.hardened-process.dyld-ro</key>
-	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version</key>
-	<integer>1</integer>
-	<key>com.apple.security.hardened-process.hardened-heap</key>
-	<true/>
-	<key>com.apple.security.hardened-process.platform-restrictions</key>
-	<integer>2</integer>
 	<key>com.apple.security.smartcard</key>
 	<true/>
 	<key>keychain-access-groups</key>

Sources/Secretive/Views/Configuration/ConfigurationItemView.swift

@@ -1,59 +0,0 @@
-import SwiftUI
-
-struct ConfigurationItemView<Content: View>: View {
-
-    enum Action: Hashable {
-        case copy(String)
-        case revealInFinder(String)
-    }
-
-    let title: LocalizedStringResource
-    let content: Content
-    let action: Action?
-
-    init(title: LocalizedStringResource, value: String, action: Action? = nil) where Content == Text {
-        self.title = title
-        self.content = Text(value)
-            .font(.subheadline)
-            .foregroundStyle(.secondary)
-        self.action = action
-    }
-
-    init(title: LocalizedStringResource, action: Action? = nil, content: () -> Content) {
-        self.title = title
-        self.content = content()
-        self.action = action
-    }
-
-    var body: some View {
-        VStack(alignment: .leading) {
-            HStack {
-                Text(title)
-                Spacer()
-                switch action {
-                case .copy(let string):
-                    Button(.copyableClickToCopyButton, systemImage: "document.on.document") {
-                        NSPasteboard.general.declareTypes([.string], owner: nil)
-                        NSPasteboard.general.setString(string, forType: .string)
-                    }
-                    .labelStyle(.iconOnly)
-                    .buttonStyle(.borderless)
-                case .revealInFinder(let rawPath):
-                    Button(.revealInFinderButton, systemImage: "folder") {
-                        // All foundation-based normalization methods replace this with the container directly.
-                        let processedPath = rawPath.replacingOccurrences(of: "~", with: "/Users/\(NSUserName())")
-                        let url = URL(filePath: processedPath)
-                        let folder = url.deletingLastPathComponent().path()
-                        NSWorkspace.shared.selectFile(processedPath, inFileViewerRootedAtPath: folder)
-                    }
-                    .labelStyle(.iconOnly)
-                    .buttonStyle(.borderless)
-                case nil:
-                    EmptyView()
-                }
-            }
-            content
-        }
-    }
-}
-

Sources/Secretive/Views/Configuration/GettingStartedView.swift

@@ -1,49 +0,0 @@
-import SwiftUI
-
-struct GettingStartedView: View {
-
-    private let instructions = Instructions()
-
-    @Binding var selectedInstruction: ConfigurationFileInstructions?
-
-    init(selectedInstruction: Binding<ConfigurationFileInstructions?>) {
-        _selectedInstruction = selectedInstruction
-    }
-
-    var body: some View {
-        Form {
-            Section(.integrationsGettingStartedTitle) {
-                Text(.integrationsGettingStartedTitleDescription)
-            }
-            Section {
-                Group {
-                    Text(.integrationsGettingStartedSuggestionSsh)
-                        .onTapGesture {
-                            self.selectedInstruction = instructions.ssh
-                        }
-                    VStack(alignment: .leading, spacing: 5) {
-                        Text(.integrationsGettingStartedSuggestionShell)
-                        Text(.integrationsGettingStartedSuggestionShellDefault(shellName: String(localized: instructions.defaultShell.tool)))
-                            .font(.caption2)
-                    }
-                    .onTapGesture {
-                        self.selectedInstruction = instructions.defaultShell
-                    }
-                    Text(.integrationsGettingStartedSuggestionGit)
-                        .onTapGesture {
-                            self.selectedInstruction = instructions.git
-                        }
-                }
-                .foregroundStyle(.link)
-
-            } header: {
-                Text(.integrationsGettingStartedWhatShouldIConfigureTitle)
-            }
-            footer: {
-                Text(.integrationsGettingStartedMultipleConfig)
-            }
-        }
-        .formStyle(.grouped)
-    }
-
-}

Sources/Secretive/Views/Configuration/Instructions.swift

@@ -1,179 +0,0 @@
-import Foundation
-
-struct Instructions {
-
-    enum Constants {
-        static let publicKeyPathPlaceholder = "_PUBLIC_KEY_PATH_PLACEHOLDER_"
-        static let publicKeyPlaceholder = "_PUBLIC_KEY_PLACEHOLDER_"
-    }
-
-    var defaultShell: ConfigurationFileInstructions {
-        zsh
-    }
-
-    var gettingStarted: ConfigurationFileInstructions = ConfigurationFileInstructions(.integrationsGettingStartedRowTitle, id: .gettingStarted)
-
-    var ssh: ConfigurationFileInstructions {
-        ConfigurationFileInstructions(
-            tool: LocalizedStringResource.integrationsToolNameSsh,
-            configPath: "~/.ssh/config",
-            configText: "Host *\n\tIdentityAgent \(URL.socketPath)",
-            website: URL(string: "https://man.openbsd.org/ssh_config.5")!,
-            note: .integrationsSshSpecificKeyNote,
-        )
-    }
-
-    var git: ConfigurationFileInstructions {
-        ConfigurationFileInstructions(
-            tool: .integrationsToolNameGitSigning,
-            steps: [
-                .init(path: "~/.gitconfig", steps: [
-                    .integrationsGitStepGitconfigDescription(publicKeyPathPlaceholder: Constants.publicKeyPathPlaceholder)
-                ],
-                      note: .integrationsGitStepGitconfigSectionNote
-                ),
-                .init(
-                    path: "~/.gitallowedsigners",
-                    steps: [
-                        LocalizedStringResource(stringLiteral: Constants.publicKeyPlaceholder)
-                    ],
-                    note: .integrationsGitStepGitallowedsignersDescription
-                ),
-            ],
-            website:  URL(string: "https://git-scm.com/docs/git-config")!,
-        )
-    }
-
-    var zsh: ConfigurationFileInstructions {
-        ConfigurationFileInstructions(
-            tool: .integrationsToolNameZsh,
-            configPath: "~/.zshrc",
-            configText: "export SSH_AUTH_SOCK=\(URL.socketPath)"
-        )
-    }
-
-    var instructions: [ConfigurationGroup] {
-        [
-            ConfigurationGroup(name: .integrationsGettingStartedSectionTitle, instructions: [
-                gettingStarted
-            ]),
-            ConfigurationGroup(
-                name: .integrationsSystemSectionTitle,
-                instructions: [
-                    ssh,
-                    git,
-                ]
-            ),
-            ConfigurationGroup(name: .integrationsShellSectionTitle, instructions: [
-                zsh,
-                ConfigurationFileInstructions(
-                    tool: .integrationsToolNameBash,
-                    configPath: "~/.bashrc",
-                    configText: "export SSH_AUTH_SOCK=\(URL.socketPath)"
-                ),
-                ConfigurationFileInstructions(
-                    tool: .integrationsToolNameFish,
-                    configPath: "~/.config/fish/config.fish",
-                    configText: "set -x SSH_AUTH_SOCK \(URL.socketPath)"
-                ),
-                ConfigurationFileInstructions(.integrationsOtherShellRowTitle, id: .otherShell),
-            ]),
-            ConfigurationGroup(name: .integrationsOtherSectionTitle, instructions: [
-                ConfigurationFileInstructions(.integrationsAppsRowTitle, id: .otherApp),
-            ]),
-        ]
-    }
-
-}
-
-struct ConfigurationGroup: Identifiable {
-    let id = UUID()
-    var name: LocalizedStringResource
-    var instructions: [ConfigurationFileInstructions] = []
-}
-
-struct ConfigurationFileInstructions: Hashable, Identifiable {
-
-    struct StepGroup: Hashable, Identifiable {
-        let path: String
-        let steps: [LocalizedStringResource]
-        let note: LocalizedStringResource?
-        var id: String { path }
-
-        init(path: String, steps: [LocalizedStringResource], note: LocalizedStringResource? = nil) {
-            self.path = path
-            self.steps = steps
-            self.note = note
-        }
-
-        func hash(into hasher: inout Hasher) {
-            id.hash(into: &hasher)
-        }
-    }
-
-    var id: ID
-    var tool: LocalizedStringResource
-    var steps: [StepGroup]
-    var requiresSecret: Bool
-    var website: URL?
-
-    init(
-        tool: LocalizedStringResource,
-        configPath: String,
-        configText: LocalizedStringResource,
-        requiresSecret: Bool = false,
-        website: URL? = nil,
-        note: LocalizedStringResource? = nil
-    ) {
-        self.id = .tool(String(localized: tool))
-        self.tool = tool
-        self.steps = [StepGroup(path: configPath, steps: [configText], note: note)]
-        self.requiresSecret = requiresSecret
-        self.website = website
-    }
-
-    init(
-        tool: LocalizedStringResource,
-        steps: [StepGroup],
-        requiresSecret: Bool = false,
-        website: URL? = nil
-    ) {
-        self.id = .tool(String(localized: tool))
-        self.tool = tool
-        self.steps = steps
-        self.requiresSecret = true
-        self.website = website
-    }
-
-    init(_ name: LocalizedStringResource, id: ID) {
-        self.id = id
-        tool = name
-        steps = []
-        requiresSecret = false
-    }
-
-    func hash(into hasher: inout Hasher) {
-        id.hash(into: &hasher)
-    }
-
-    enum ID: Identifiable, Hashable {
-        case gettingStarted
-        case tool(String)
-        case otherShell
-        case otherApp
-
-        var id: String {
-            switch self {
-            case .gettingStarted:
-                "getting_started"
-            case .tool(let name):
-                name
-            case .otherShell:
-                "other_shell"
-            case .otherApp:
-                "other_app"
-            }
-        }
-    }
-
-}

Sources/Secretive/Views/Configuration/IntegrationsView.swift

@@ -1,115 +0,0 @@
-import SwiftUI
-
-struct IntegrationsView: View {
-
-    @Environment(\.dismiss) private var dismiss
-
-    @State private var selectedInstruction: ConfigurationFileInstructions?
-    private let instructions = Instructions()
-
-    var body: some View {
-        NavigationSplitView {
-            List(selection: $selectedInstruction) {
-                ForEach(instructions.instructions) { group in
-                    Section(group.name) {
-                        ForEach(group.instructions) { instruction in
-                            Text(instruction.tool)
-                                .padding(.vertical, 8)
-                                .tag(instruction)
-                        }
-                    }
-                }
-            }
-        } detail: {
-                IntegrationsDetailView(selectedInstruction: $selectedInstruction)
-                .fauxToolbar {
-                    Button(.setupDoneButton) {
-                        dismiss()
-                    }
-                    .normalButton()
-                }
-        }
-        .onAppear {
-            selectedInstruction = instructions.gettingStarted
-        }
-        .frame(minHeight: 500)
-    }
-
-}
-
-extension View {
-
-    func fauxToolbar<Content: View>(content: () -> Content) -> some View {
-        modifier(FauxToolbarModifier(toolbarContent: content()))
-    }
-
-}
-
-struct FauxToolbarModifier<ToolbarContent: View>: ViewModifier {
-
-    var toolbarContent: ToolbarContent
-
-    func body(content: Content) -> some View {
-        VStack(alignment: .leading, spacing: 0) {
-            content
-            Divider()
-            HStack {
-                Spacer()
-                toolbarContent
-                .padding(.top, 8)
-                .padding(.trailing, 16)
-                .padding(.bottom, 16)
-            }
-        }
-
-    }
-
-}
-
-struct IntegrationsDetailView: View {
-
-    @Binding private var selectedInstruction: ConfigurationFileInstructions?
-
-    init(selectedInstruction: Binding<ConfigurationFileInstructions?>) {
-        _selectedInstruction = selectedInstruction
-    }
-
-    var body: some View {
-        if let selectedInstruction {
-            switch selectedInstruction.id {
-            case .gettingStarted:
-                GettingStartedView(selectedInstruction: $selectedInstruction)
-                case .tool:
-                    ToolConfigurationView(selectedInstruction: selectedInstruction)
-                case .otherShell:
-                    Form {
-                        Section {
-                            Link(.integrationsViewOtherGithubLink, destination: URL(string: "https://github.com/maxgoedjen/secretive-config-instructions/tree/main/shells")!)
-                        } header: {
-                            Text(.integrationsCommunityShellListDescription)
-                                .font(.body)
-                        }
-                    }
-                    .formStyle(.grouped)
-
-                case .otherApp:
-                    Form {
-                        Section {
-                            Link(.integrationsViewOtherGithubLink, destination: URL(string: "https://github.com/maxgoedjen/secretive-config-instructions/tree/main/apps")!)
-                        } header: {
-                            Text(.integrationsCommunityAppsListDescription)
-                                .font(.body)
-                        }
-                    }
-                    .formStyle(.grouped)
-                }
-        }
-
-    }
-
-}
-
-#Preview {
-    IntegrationsView()
-        .frame(height: 500)
-}

Sources/Secretive/Views/Configuration/SetupView.swift

@@ -1,187 +0,0 @@
-import SwiftUI
-
-struct SetupView: View {
-
-    @Environment(\.dismiss) private var dismiss
-    @Binding var setupComplete: Bool
-
-    @State var showingIntegrations = false
-    @State var buttonWidth: CGFloat?
-
-    @State var installed = false
-    @State var updates = false
-    @State var integrations = false
-    var allDone: Bool {
-        installed && updates && integrations
-    }
-
-    var body: some View {
-        VStack {
-            VStack(alignment: .leading, spacing: 0) {
-                StepView(
-                    title: .setupAgentTitle,
-                    description: .setupAgentDescription,
-                    systemImage: "lock.laptopcomputer",
-                ) {
-                    setupButton(
-                        .setupAgentInstallButton,
-                        complete: installed,
-                        width: buttonWidth
-                    ) {
-                        installed = true
-                        Task {
-                            await LaunchAgentController().install()
-                        }
-                    }
-                }
-                Divider()
-                StepView(
-                    title: .setupUpdatesTitle,
-                    description: .setupUpdatesDescription,
-                    systemImage: "network.badge.shield.half.filled",
-                ) {
-                    setupButton(
-                        .setupUpdatesOkButton,
-                        complete: updates,
-                        width: buttonWidth
-                    ) {
-                        updates = true
-                    }
-                }
-                Divider()
-                StepView(
-                    title: .setupIntegrationsTitle,
-                    description: .setupIntegrationsDescription,
-                    systemImage: "firewall",
-                ) {
-                    setupButton(
-                        .setupIntegrationsButton,
-                        complete: integrations,
-                        width: buttonWidth
-                    ) {
-                        showingIntegrations = true
-                    }
-                }
-            }
-            .onPreferenceChange(setupButton.WidthKey.self) { width in
-                buttonWidth = width
-            }
-            .background(.white.opacity(0.1), in: RoundedRectangle(cornerRadius: 10))
-            .frame(minWidth: 600, maxWidth: .infinity)
-            HStack {
-                Spacer()
-                Button(.setupDoneButton) {
-                    setupComplete = true
-                    dismiss()
-                }
-                .disabled(!allDone)
-                .primaryButton()
-            }
-        }
-        .interactiveDismissDisabled()
-        .padding()
-        .sheet(isPresented: $showingIntegrations, onDismiss: {
-            integrations = true
-        }, content: {
-            IntegrationsView()
-        })
-    }
-}
-
-struct setupButton: View {
-
-    struct WidthKey: @MainActor PreferenceKey {
-        @MainActor static var defaultValue: CGFloat? = nil
-        static func reduce(value: inout CGFloat?, nextValue: () -> CGFloat?) {
-            if let next = nextValue(), next > (value ?? -1) {
-                value = next
-            }
-        }
-
-    }
-
-    let label: LocalizedStringResource
-    let complete: Bool
-    let action: () -> Void
-    let width: CGFloat?
-    @State var currentWidth: CGFloat?
-
-    init(_ label: LocalizedStringResource, complete: Bool, width: CGFloat? = nil, action: @escaping () -> Void) {
-        self.label = label
-        self.complete = complete
-        self.action = action
-        self.width = width
-    }
-    
-    var body: some View {
-        Button(action: action) {
-            HStack(spacing: 6) {
-                if complete {
-                    Text(.setupStepCompleteButton)
-                    Image(systemName: "checkmark.circle.fill")
-                } else {
-                    Text(label)
-                }
-            }
-            .frame(width: width)
-            .padding(.vertical, 2)
-            .onGeometryChange(for: CGFloat.self) { proxy in
-                proxy.size.width
-            } action: { newValue in
-                currentWidth = newValue
-            }
-        }
-        .preference(key: WidthKey.self, value: currentWidth)
-        .primaryButton()
-        .disabled(complete)
-        .tint(complete ? .green : nil)
-    }
-        
-}
-
-struct StepView<Content: View>: View {
-    
-    let title: LocalizedStringResource
-    let icon: Image
-    let description: LocalizedStringResource
-    let actions: Content
-    
-    init(title: LocalizedStringResource, description: LocalizedStringResource, systemImage: String, actions: () -> Content) {
-        self.title = title
-        self.icon = Image(systemName: systemImage)
-        self.description = description
-        self.actions = actions()
-    }
-    
-    var body: some View {
-        HStack(spacing: 0) {
-            icon
-                .resizable()
-                .aspectRatio(contentMode: .fit)
-                .frame(width: 24)
-            Spacer()
-                .frame(width: 20)
-            VStack(alignment: .leading, spacing: 4) {
-                Text(title)
-                    .bold()
-                Text(description)
-            }
-            Spacer(minLength: 20)
-            actions
-        }
-        .padding(20)
-    }
-    
-}
-
-extension SetupView {
-
-    enum Constants {
-        static let updaterFAQURL = URL(string: "https://github.com/maxgoedjen/secretive/blob/main/FAQ.md#whats-this-network-request-to-github")!
-    }
-
-}
-
-#Preview {
-    SetupView(setupComplete: .constant(false))
-}

Sources/Secretive/Views/Configuration/ToolConfigurationView.swift

@@ -1,110 +0,0 @@
-import SwiftUI
-import SecretKit
-
-struct ToolConfigurationView: View {
-
-    private let instructions = Instructions()
-    let selectedInstruction: ConfigurationFileInstructions
-    
-    @Environment(\.secretStoreList) private var secretStoreList
-
-    @State var creating = false
-    @State var selectedSecret: AnySecret?
-
-    init(selectedInstruction: ConfigurationFileInstructions) {
-        self.selectedInstruction = selectedInstruction
-    }
-
-    var body: some View {
-        Form {
-            if selectedInstruction.requiresSecret {
-                if secretStoreList.allSecrets.isEmpty {
-                    Section {
-                        Text(.integrationsConfigureUsingSecretEmptyCreate)
-                        if let store = secretStoreList.modifiableStore {
-                            HStack {
-                                Spacer()
-                                Button(.createSecretTitle) {
-                                    creating = true
-                                }
-                                .sheet(isPresented: $creating) {
-                                    CreateSecretView(store: store) { created in
-                                        selectedSecret = created
-                                    }
-                                }
-                            }
-                        }
-                    }
-                } else {
-                    Section {
-                        Picker(.integrationsConfigureUsingSecretSecretTitle, selection: $selectedSecret) {
-                            if selectedSecret == nil {
-                                Text(.integrationsConfigureUsingSecretNoSecret)
-                                    .tag(nil as (AnySecret?))
-                            }
-                            ForEach(secretStoreList.allSecrets) { secret in
-                                Text(secret.name)
-                                    .tag(secret)
-                            }
-                        }
-                    } header: {
-                        Text(.integrationsConfigureUsingSecretHeader)
-                    }
-                    .onAppear {
-                        selectedSecret = secretStoreList.allSecrets.first
-                    }
-                }
-            }
-            ForEach(selectedInstruction.steps) { stepGroup in
-                Section {
-                    ConfigurationItemView(title: .integrationsPathTitle, value: stepGroup.path, action: .revealInFinder(stepGroup.path))
-                    ForEach(stepGroup.steps, id: \.self.key) { step in
-                        ConfigurationItemView(title: .integrationsAddThisTitle, action: .copy(String(localized: step))) {
-                            HStack {
-                                Text(placeholdersReplaced(text: String(localized: step)))
-                                    .padding(8)
-                                    .font(.system(.subheadline, design: .monospaced))
-                                Spacer()
-                            }
-                            .frame(maxWidth: .infinity)
-                            .background {
-                                RoundedRectangle(cornerRadius: 6)
-                                    .fill(.black.opacity(0.05))
-                                    .stroke(.separator, lineWidth: 1)
-                            }
-                        }
-                    }
-                } footer: {
-                    if let note = stepGroup.note {
-                        Text(note)
-                            .font(.caption)
-                    }
-                }
-            }
-            if let url = selectedInstruction.website {
-                Section {
-                    Link(destination: url) {
-                        VStack(alignment: .leading, spacing: 5) {
-                            Text(.integrationsWebLink)
-                                .font(.headline)
-                            Text(url.absoluteString)
-                                .font(.caption2)
-                        }
-                    }
-                }
-            }
-        }
-        .formStyle(.grouped)
-
-    }
-
-    func placeholdersReplaced(text: String) -> String {
-        guard let selectedSecret else { return text }
-        let writer = OpenSSHPublicKeyWriter()
-        let fileController = PublicKeyFileStoreController(homeDirectory: URL.agentHomeURL)
-        return text
-            .replacingOccurrences(of: Instructions.Constants.publicKeyPlaceholder, with: writer.openSSHString(secret: selectedSecret))
-            .replacingOccurrences(of: Instructions.Constants.publicKeyPathPlaceholder, with: fileController.publicKeyPath(for: selectedSecret))
-    }
-
-}

Sources/Secretive/Views/ContentView.swift

@@ -13,7 +13,7 @@ struct ContentView: View {
     @State var activeSecret: AnySecret?
     @Environment(\.colorScheme) var colorScheme
 
-    @Environment(\.secretStoreList) private var storeList
+    @Environment(\.secretStoreList) private var storeList: SecretStoreList
     @Environment(\.updater) private var updater: any UpdaterProtocol
     @Environment(\.agentStatusChecker) private var agentStatusChecker: any AgentStatusCheckerProtocol
 
@@ -36,7 +36,7 @@ struct ContentView: View {
             toolbarItem(newItemView, id: "new")
         }
         .sheet(isPresented: $runningSetup) {
-            SetupView(setupComplete: $hasRunSetup)
+            SetupView(visible: $runningSetup, setupComplete: $hasRunSetup)
         }
     }
 
@@ -45,18 +45,12 @@ struct ContentView: View {
 extension ContentView {
 
 
-    @ToolbarContentBuilder
-    func toolbarItem(_ view: some View, id: String) -> some ToolbarContent {
-        if #available(macOS 26.0, *) {
-            ToolbarItem(id: id) { view }
-                .sharedBackgroundVisibility(.hidden)
-        } else {
-            ToolbarItem(id: id) { view }
-        }
+    func toolbarItem(_ view: some View, id: String) -> ToolbarItem<String, some View> {
+        ToolbarItem(id: id) { view }
     }
-    
+
     var needsSetup: Bool {
-        runningSetup || !hasRunSetup
+        (runningSetup || !hasRunSetup || !agentStatusChecker.running) && !agentStatusChecker.developmentBuild
     }
 
     /// Item either showing a "everything's good, here's more info" or "something's wrong, re-run setup" message
@@ -66,19 +60,19 @@ extension ContentView {
         if needsSetup {
             setupNoticeView
         } else {
-            agentStatusToolbarView
+            runningNoticeView
         }
     }
 
-    var updateNoticeContent: (LocalizedStringResource, Color)? {
+    var updateNoticeContent: (LocalizedStringKey, Color)? {
         guard let update = updater.update else { return nil }
         if update.critical {
-            return (.updateCriticalNoticeTitle, .red)
+            return ("update_critical_notice_title", .red)
         } else {
             if updater.testBuild {
-                return (.updateTestNoticeTitle, .blue)
+                return ("update_test_notice_title", .blue)
             } else {
-                return (.updateNormalNoticeTitle, .orange)
+                return ("update_normal_notice_title", .orange)
             }
         }
     }
@@ -94,7 +88,7 @@ extension ContentView {
                     .foregroundColor(.white)
             })
             .buttonStyle(ToolbarButtonStyle(color: color))
-            .sheet(item: $selectedUpdate) { update in
+            .popover(item: $selectedUpdate, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) { update in
                 UpdateDetailView(update: update)
             }
         }
@@ -103,17 +97,18 @@ extension ContentView {
     @ViewBuilder
     var newItemView: some View {
         if storeList.modifiableStore?.isAvailable ?? false {
-            Button(.appMenuNewSecretButton, systemImage: "plus") {
+            Button(action: {
                 showingCreation = true
-            }
-            .menuButton()
+            }, label: {
+                Image(systemName: "plus")
+            })
             .sheet(isPresented: $showingCreation) {
                 if let modifiable = storeList.modifiableStore {
-                    CreateSecretView(store: modifiable) { created in
-                        if let created {
-                            activeSecret = created
+                    CreateSecretView(store: modifiable, showing: $showingCreation)
+                        .onDisappear {
+                            guard let newest = modifiable.secrets.last else { return }
+                            activeSecret = newest
                         }
-                    }
                 }
             }
         }
@@ -124,44 +119,43 @@ extension ContentView {
         Button(action: {
             runningSetup = true
         }, label: {
-            if !hasRunSetup {
-                Text(.agentSetupNoticeTitle)
-                    .font(.headline)
+            Group {
+                if hasRunSetup && !agentStatusChecker.running {
+                    Text("agent_not_running_notice_title")
+                } else {
+                    Text("agent_setup_notice_title")
+                }
             }
+            .font(.headline)
+            .foregroundColor(.white)
         })
         .buttonStyle(ToolbarButtonStyle(color: .orange))
     }
 
     @ViewBuilder
-    var agentStatusToolbarView: some View {
+    var runningNoticeView: some View {
         Button(action: {
             showingAgentInfo = true
         }, label: {
             HStack {
-                if agentStatusChecker.running {
-                    Text(.agentRunningNoticeTitle)
-                        .font(.headline)
-                        .foregroundColor(colorScheme == .light ? Color(white: 0.3) : .white)
-                    Circle()
-                        .frame(width: 10, height: 10)
-                        .foregroundColor(Color.green)
-                } else {
-                    Text(.agentNotRunningNoticeTitle)
-                        .font(.headline)
-                    Circle()
-                        .frame(width: 10, height: 10)
-                        .foregroundColor(Color.red)
-                }
+                Text("agent_running_notice_title")
+                    .font(.headline)
+                    .foregroundColor(colorScheme == .light ? Color(white: 0.3) : .white)
+                Circle()
+                    .frame(width: 10, height: 10)
+                    .foregroundColor(Color.green)
             }
         })
-        .buttonStyle(
-            ToolbarButtonStyle(
-                lightColor: agentStatusChecker.running ? .black.opacity(0.05) : .red.opacity(0.75),
-                darkColor: agentStatusChecker.running ? .white.opacity(0.05) : .red.opacity(0.5),
-            )
-        )
+        .buttonStyle(ToolbarButtonStyle(lightColor: .black.opacity(0.05), darkColor: .white.opacity(0.05)))
         .popover(isPresented: $showingAgentInfo, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) {
-            AgentStatusView()
+            VStack {
+                Text("agent_running_notice_detail_title")
+                    .font(.title)
+                    .padding(5)
+                Text("agent_running_notice_detail_description")
+                    .frame(width: 300)
+            }
+            .padding()
         }
     }
 
@@ -172,7 +166,7 @@ extension ContentView {
                 showingAppPathNotice = true
             }, label: {
                 Group {
-                    Text(.appNotInApplicationsNoticeTitle)
+                    Text("app_not_in_applications_notice_title")
                 }
                 .font(.headline)
                 .foregroundColor(.white)
@@ -184,7 +178,7 @@ extension ContentView {
                         .resizable()
                         .aspectRatio(contentMode: .fit)
                         .frame(width: 64)
-                    Text(.appNotInApplicationsNoticeDetailDescription)
+                    Text("app_not_in_applications_notice_detail_description")
                         .frame(maxWidth: 300)
                 }
                 .padding()
@@ -193,22 +187,31 @@ extension ContentView {
     }
 
     var attachmentAnchor: PopoverAttachmentAnchor {
+        // Ideally .point(.bottom), but broken on Sonoma (FB12726503)
         .rect(.bounds)
     }
 
 }
 
+#if DEBUG
+
+struct ContentView_Previews: PreviewProvider {
+
+    static var previews: some View {
+        Group {
+            // Empty on modifiable and nonmodifiable
+            ContentView(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
+                .environment(Preview.storeList(stores: [Preview.Store(numberOfRandomSecrets: 0)], modifiableStores: [Preview.StoreModifiable(numberOfRandomSecrets: 0)]))
+                .environment(PreviewUpdater())
+
+            // 5 items on modifiable and nonmodifiable
+            ContentView(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
+                .environment(Preview.storeList(stores: [Preview.Store()], modifiableStores: [Preview.StoreModifiable()]))
+                .environment(PreviewUpdater())
+        }
+
+    }
+}
+
+#endif
 
-//#Preview {
-//    // Empty on modifiable and nonmodifiable
-//    ContentView(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
-//        .environment(Preview.storeList(stores: [Preview.Store(numberOfRandomSecrets: 0)], modifiableStores: [Preview.StoreModifiable(numberOfRandomSecrets: 0)]))
-//        .environment(PreviewUpdater())
-//}
-//
-//#Preview {
-//    // 5 items on modifiable and nonmodifiable
-//    ContentView(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
-//        .environment(Preview.storeList(stores: [Preview.Store()], modifiableStores: [Preview.StoreModifiable()]))
-//        .environment(PreviewUpdater())
-//}

Sources/Secretive/Views/CopyableView.swift

@@ -3,13 +3,14 @@ import UniformTypeIdentifiers
 
 struct CopyableView: View {
 
-    var title: LocalizedStringResource
+    var title: LocalizedStringKey
     var image: Image
     var text: String
 
     @State private var interactionState: InteractionState = .normal
-    
-    var content: some View {
+    @Environment(\.colorScheme) private var colorScheme
+
+    var body: some View {
         VStack(alignment: .leading) {
             HStack {
                 image
@@ -21,7 +22,7 @@ struct CopyableView: View {
                     .foregroundColor(primaryTextColor)
                 Spacer()
                 if interactionState != .normal {
-                    hoverIcon
+                    Text(hoverText)
                         .bold()
                         .textCase(.uppercase)
                         .foregroundColor(secondaryTextColor)
@@ -38,23 +39,17 @@ struct CopyableView: View {
                 .multilineTextAlignment(.leading)
                 .font(.system(.body, design: .monospaced))
         }
-        ._background(interactionState: interactionState)
+        .background(backgroundColor)
         .frame(minWidth: 150, maxWidth: .infinity)
-    }
-
-    var body: some View {
-        content
+        .cornerRadius(10)
         .onHover { hovering in
             withAnimation {
                 interactionState = hovering ? .hovering : .normal
             }
         }
-        .onDrag({
+        .onDrag {
             NSItemProvider(item: NSData(data: text.data(using: .utf8)!), typeIdentifier: UTType.utf8PlainText.identifier)
-        }, preview: {
-            content
-                ._background(interactionState: .dragging)
-        })
+        }
         .onTapGesture {
             copy()
             withAnimation {
@@ -71,23 +66,31 @@ struct CopyableView: View {
         )
     }
 
-    @ViewBuilder
-    var hoverIcon: some View {
+    var hoverText: LocalizedStringKey {
         switch interactionState {
         case .hovering:
-            Image(systemName: "document.on.document")
-                .accessibilityLabel(String(localized: .copyableClickToCopyButton))
+            return "copyable_click_to_copy_button"
         case .clicking:
-            Image(systemName: "checkmark.circle.fill")
-                .accessibilityLabel(String(localized: .copyableCopied))
-        case .normal, .dragging:
-            EmptyView()
+            return "copyable_copied"
+        case .normal:
+            fatalError()
+        }
+    }
+
+    var backgroundColor: Color {
+        switch interactionState {
+        case .normal:
+            return colorScheme == .dark ? Color(white: 0.2) : Color(white: 0.885)
+        case .hovering:
+            return colorScheme == .dark ? Color(white: 0.275) : Color(white: 0.82)
+        case .clicking:
+            return .accentColor
         }
     }
 
     var primaryTextColor: Color {
         switch interactionState {
-        case .normal, .hovering, .dragging:
+        case .normal, .hovering:
             return Color(.textColor)
         case .clicking:
             return .white
@@ -96,7 +99,7 @@ struct CopyableView: View {
 
     var secondaryTextColor: Color {
         switch interactionState {
-        case .normal, .hovering, .dragging:
+        case .normal, .hovering:
             return Color(.secondaryLabelColor)
         case .clicking:
             return .white
@@ -108,67 +111,23 @@ struct CopyableView: View {
         NSPasteboard.general.setString(text, forType: .string)
     }
 
-}
-
-fileprivate enum InteractionState {
-    case normal, hovering, clicking, dragging
-}
-
-extension View {
-       
-    fileprivate func _background(interactionState: InteractionState) -> some View {
-        modifier(BackgroundViewModifier(interactionState: interactionState))
+    private enum InteractionState {
+        case normal, hovering, clicking
     }
-    
+
 }
 
-fileprivate struct BackgroundViewModifier: ViewModifier {
-    
-    @Environment(\.colorScheme) private var colorScheme
-    @Environment(\.appearsActive) private var appearsActive
+#if DEBUG
 
-    let interactionState: InteractionState
-
-    func body(content: Content) -> some View {
-        if interactionState == .dragging {
-            content
-                .background(backgroundColor(interactionState: interactionState), in: RoundedRectangle(cornerRadius: 15))
-        } else {
-            if #available(macOS 26.0, *) {
-                content
-                // Very thin opacity lets user hover anywhere over the view, glassEffect doesn't allow.
-                    .background(.white.opacity(0.01), in: RoundedRectangle(cornerRadius: 15))
-                    .glassEffect(.regular.tint(backgroundColor(interactionState: interactionState)), in: RoundedRectangle(cornerRadius: 15))
-                
-            } else {
-                content
-                    .background(backgroundColor(interactionState: interactionState))
-                    .cornerRadius(10)
-            }
+struct CopyableView_Previews: PreviewProvider {
+    static var previews: some View {
+        Group {
+            CopyableView(title: "secret_detail_sha256_fingerprint_label", image: Image(systemName: "figure.wave"), text: "Hello world.")
+                .padding()
+            CopyableView(title: "secret_detail_sha256_fingerprint_label", image: Image(systemName: "figure.wave"), text: "Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. ")
+                .padding()
         }
     }
-    
-    func backgroundColor(interactionState: InteractionState) -> Color {
-        guard appearsActive else { return Color.clear }
-        switch interactionState {
-        case .normal:
-            return colorScheme == .dark ? Color(white: 0.2) : Color(white: 0.885)
-        case .hovering, .dragging:
-            return colorScheme == .dark ? Color(white: 0.275) : Color(white: 0.82)
-        case .clicking:
-            return .accentColor
-        }
-    }
-
-    
 }
 
-#Preview {
-    CopyableView(title: .secretDetailSha256FingerprintLabel, image: Image(systemName: "figure.wave"), text: "Hello world.")
-        .padding()
-}
-
-#Preview {
-    CopyableView(title: .secretDetailSha256FingerprintLabel, image: Image(systemName: "figure.wave"), text: "Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. ")
-        .padding()
-}
+#endif

Sources/Secretive/Views/CreateSecretView.swift

@@ -0,0 +1,250 @@
+import SwiftUI
+import SecretKit
+
+struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
+
+    @State var store: StoreType
+    @Binding var showing: Bool
+
+    @State private var name = ""
+    @State private var requiresAuthentication = true
+
+    var body: some View {
+        VStack {
+            HStack {
+                VStack {
+                    HStack {
+                        Text("create_secret_title")
+                            .font(.largeTitle)
+                        Spacer()
+                    }
+                    HStack {
+                        Text("create_secret_name_label")
+                        TextField("create_secret_name_placeholder", text: $name)
+                            .focusable()
+                    }
+                    ThumbnailPickerView(items: [
+                        ThumbnailPickerView.Item(value: true, name: "create_secret_require_authentication_title", description: "create_secret_require_authentication_description", thumbnail: AuthenticationView()),
+                        ThumbnailPickerView.Item(value: false, name: "create_secret_notify_title",
+                                                 description: "create_secret_notify_description",
+                                                 thumbnail: NotificationView())
+                    ], selection: $requiresAuthentication)
+                }
+            }
+            HStack {
+                Spacer()
+                Button("create_secret_cancel_button") {
+                    showing = false
+                }
+                .keyboardShortcut(.cancelAction)
+                Button("create_secret_create_button", action: save)
+                    .disabled(name.isEmpty)
+                    .keyboardShortcut(.defaultAction)
+            }
+        }.padding()
+    }
+
+    func save() {
+        Task {
+            try! await store.create(name: name, requiresAuthentication: requiresAuthentication)
+            showing = false
+        }
+    }
+
+}
+
+struct ThumbnailPickerView<ValueType: Hashable>: View {
+
+    private let items: [Item<ValueType>]
+    @Binding var selection: ValueType
+
+    init(items: [ThumbnailPickerView<ValueType>.Item<ValueType>], selection: Binding<ValueType>) {
+        self.items = items
+        _selection = selection
+    }
+
+    var body: some View {
+        HStack(alignment: .top) {
+            ForEach(items) { item in
+                VStack(alignment: .leading, spacing: 15) {
+                    item.thumbnail
+                        .frame(height: 200)
+                        .overlay(RoundedRectangle(cornerRadius: 10)
+                            .stroke(lineWidth: item.value == selection ? 15 : 0))
+                        .clipShape(RoundedRectangle(cornerRadius: 10, style: .continuous))
+                        .foregroundColor(.accentColor)
+                    VStack(alignment: .leading, spacing: 5) {
+                        Text(item.name)
+                            .bold()
+                        Text(item.description)
+                            .fixedSize(horizontal: false, vertical: true)
+                    }
+                }
+                .frame(width: 250)
+                .onTapGesture {
+                    withAnimation(.spring()) {
+                        selection = item.value
+                    }
+                }
+            }
+            .padding(5)
+        }
+    }
+
+}
+
+extension ThumbnailPickerView {
+
+    struct Item<InnerValueType: Hashable>: Identifiable {
+        let id = UUID()
+        let value: InnerValueType
+        let name: LocalizedStringKey
+        let description: LocalizedStringKey
+        let thumbnail: AnyView
+
+        init<ViewType: View>(value: InnerValueType, name: LocalizedStringKey, description: LocalizedStringKey, thumbnail: ViewType) {
+            self.value = value
+            self.name = name
+            self.description = description
+            self.thumbnail = AnyView(thumbnail)
+        }
+    }
+
+}
+
+@MainActor class SystemBackground: ObservableObject {
+
+    static let shared = SystemBackground()
+    @Published var image: NSImage?
+
+    private init() {
+        if let mainScreen = NSScreen.main, let imageURL = NSWorkspace.shared.desktopImageURL(for: mainScreen) {
+            image = NSImage(contentsOf: imageURL)
+        } else {
+            image = nil
+        }
+    }
+
+}
+
+struct SystemBackgroundView: View {
+
+    let anchor: UnitPoint
+
+    var body: some View {
+        if let image = SystemBackground.shared.image {
+            Image(nsImage: image)
+                .resizable()
+                .scaleEffect(3, anchor: anchor)
+                .clipped()
+                .allowsHitTesting(false)
+        } else {
+            Rectangle()
+                .foregroundColor(Color(.systemPurple))
+        }
+    }
+}
+
+struct AuthenticationView: View {
+
+    var body: some View {
+        ZStack {
+            SystemBackgroundView(anchor: .center)
+            GeometryReader { geometry in
+                VStack {
+                    Image(systemName: "touchid")
+                        .resizable()
+                        .aspectRatio(contentMode: .fit)
+                        .foregroundColor(Color(.systemRed))
+                    Text(verbatim: "Touch ID Prompt")
+                        .font(.headline)
+                        .foregroundColor(.primary)
+                        .redacted(reason: .placeholder)
+                    VStack {
+                        Text(verbatim: "Touch ID Detail prompt.Detail two.")
+                            .font(.caption2)
+                            .foregroundColor(.primary)
+                        Text(verbatim: "Touch ID Detail prompt.Detail two.")
+                            .font(.caption2)
+                            .foregroundColor(.primary)
+                    }
+                    .redacted(reason: .placeholder)
+                    RoundedRectangle(cornerRadius: 5)
+                        .frame(width: geometry.size.width, height: 20, alignment: .center)
+                        .foregroundColor(.accentColor)
+                    RoundedRectangle(cornerRadius: 5)
+                        .frame(width: geometry.size.width, height: 20, alignment: .center)
+                        .foregroundColor(Color(.unemphasizedSelectedContentBackgroundColor))
+                }
+            }
+            .padding()
+            .frame(width: 150)
+            .background(
+                RoundedRectangle(cornerRadius: 15)
+                    .foregroundStyle(.ultraThickMaterial)
+            )
+            .padding()
+
+        }
+    }
+
+}
+
+struct NotificationView: View {
+
+    var body: some View {
+        ZStack {
+            SystemBackgroundView(anchor: .topTrailing)
+            VStack {
+                Rectangle()
+                    .background(Color.clear)
+                    .foregroundStyle(.thinMaterial)
+                    .frame(height: 35)
+                VStack {
+                    HStack {
+                        Spacer()
+                        HStack {
+                            Image(nsImage: NSApplication.shared.applicationIconImage)
+                                .resizable()
+                                .frame(width: 64, height: 64)
+                                .foregroundColor(.primary)
+                            VStack(alignment: .leading) {
+                                Text(verbatim: "Secretive")
+                                    .font(.title)
+                                    .foregroundColor(.primary)
+                                Text(verbatim: "Secretive wants to sign")
+                                    .font(.body)
+                                    .foregroundColor(.primary)
+                            }
+                        }.padding()
+                            .redacted(reason: .placeholder)
+                            .background(
+                                RoundedRectangle(cornerRadius: 15)
+                                    .foregroundStyle(.ultraThickMaterial)
+                            )
+                    }
+                    Spacer()
+                }
+                .padding()
+            }
+        }
+    }
+
+}
+
+#if DEBUG
+
+struct CreateSecretView_Previews: PreviewProvider {
+
+    static var previews: some View {
+        Group {
+            CreateSecretView(store: Preview.StoreModifiable(), showing: .constant(true))
+                AuthenticationView().environment(\.colorScheme, .dark)
+                AuthenticationView().environment(\.colorScheme, .light)
+                NotificationView().environment(\.colorScheme, .dark)
+                NotificationView().environment(\.colorScheme, .light)
+        }
+    }
+}
+
+#endif

Sources/Secretive/Views/DeleteSecretView.swift

@@ -0,0 +1,58 @@
+import SwiftUI
+import SecretKit
+
+struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
+
+    @State var store: StoreType
+    let secret: StoreType.SecretType
+    var dismissalBlock: (Bool) -> ()
+
+    @State private var confirm = ""
+
+    var body: some View {
+        VStack {
+            HStack {
+                Image(nsImage: NSApplication.shared.applicationIconImage)
+                    .resizable()
+                    .frame(width: 64, height: 64)
+                    .padding()
+                VStack {
+                    HStack {
+                        Text("delete_confirmation_title_\(secret.name)").bold()
+                        Spacer()
+                    }
+                    HStack {
+                        Text("delete_confirmation_description_\(secret.name)_\(secret.name)")
+                        Spacer()
+                    }
+                    HStack {
+                        Text("delete_confirmation_confirm_name_label")
+                        TextField(secret.name, text: $confirm)
+                    }
+                }
+            }
+            HStack {
+                Spacer()
+                Button("delete_confirmation_delete_button", action: delete)
+                    .disabled(confirm != secret.name)
+                Button("delete_confirmation_cancel_button") {
+                    dismissalBlock(false)
+                }
+                .keyboardShortcut(.cancelAction)
+            }
+        }
+        .padding()
+        .frame(minWidth: 400)
+        .onExitCommand {
+            dismissalBlock(false)
+        }
+    }
+    
+    func delete() {
+        Task {
+            try! await store.delete(secret: secret)
+            dismissalBlock(true)
+        }
+    }
+
+}

Sources/Secretive/Views/EmptyStoreView.swift

@@ -18,9 +18,9 @@ struct EmptyStoreImmutableView: View {
     
     var body: some View {
         VStack {
-            Text(.emptyStoreNonmodifiableTitle).bold()
-            Text(.emptyStoreNonmodifiableDescription)
-            Text(.emptyStoreNonmodifiableSupportedKeyTypes)
+            Text("empty_store_nonmodifiable_title").bold()
+            Text("empty_store_nonmodifiable_description")
+            Text("empty_store_nonmodifiable_supported_key_types")
         }.frame(maxWidth: .infinity, maxHeight: .infinity)
     }
     
@@ -49,18 +49,23 @@ struct EmptyStoreModifiableView: View {
                         path.addLine(to: CGPoint(x: g.size.width - 3, y: 0))
                     }.fill()
                 }.frame(height: (windowGeometry.size.height/2) - 20).padding()
-                Text(.emptyStoreModifiableClickHereTitle).bold()
-                Text(.emptyStoreModifiableClickHereDescription)
+                Text("empty_store_modifiable_click_here_title").bold()
+                Text("empty_store_modifiable_click_here_description")
                 Spacer()
             }.frame(maxWidth: .infinity, maxHeight: .infinity)
         }
     }
 }
 
+#if DEBUG
 
-#Preview {
-    EmptyStoreImmutableView()
-}
-#Preview {
-    EmptyStoreModifiableView()
+struct EmptyStoreModifiableView_Previews: PreviewProvider {
+    static var previews: some View {
+        Group {
+            EmptyStoreImmutableView()
+            EmptyStoreModifiableView()
+        }
+    }
 }
+
+#endif

Sources/Secretive/Views/NoStoresView.swift

@@ -0,0 +1,24 @@
+import SwiftUI
+
+struct NoStoresView: View {
+
+    var body: some View {
+        VStack {
+            Text("no_secure_storage_title")
+                .bold()
+            Text("no_secure_storage_description")
+            Link("no_secure_storage_yubico_link", destination: URL(string: "https://www.yubico.com/products/compare-yubikey-5-series/")!)
+        }.padding()
+    }
+    
+}
+
+#if DEBUG
+
+struct NoStoresView_Previews: PreviewProvider {
+    static var previews: some View {
+        NoStoresView()
+    }
+}
+
+#endif