Merge

.github/workflows/codeql.yml

@@ -11,7 +11,7 @@ on:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    runs-on: ${{ (matrix.language == 'swift' && 'xcode-27') || 'ubuntu-latest' }}
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-26') || 'ubuntu-latest' }}
     permissions:
       security-events: write
       packages: read
@@ -24,15 +24,20 @@ jobs:
         include:
         - language: actions
           build-mode: none
+        # Disable this until CodeQL supports Xcode 26 builds.
+        # - language: swift
+        #   build-mode: manual
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v4
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
     - if: matrix.build-mode == 'manual'
+      name: "Select Xcode"
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.2.app
     - if: matrix.build-mode == 'manual'
       name: "Build"
       run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO

.github/workflows/nightly.yml

@@ -6,12 +6,11 @@ on:
   
 jobs:
   build:
-    runs-on: xcode-27
+    runs-on: macos-26
     permissions:
       id-token: write
       contents: write
       attestations: write
-      artifact-metadata: write
       actions: read
     timeout-minutes: 10
     steps:
@@ -25,6 +24,8 @@ jobs:
         APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
+    - name: Set Environment
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.2.app
     - name: Update Build Number
       env:
         RUN_ID: ${{ github.run_id }}
@@ -34,12 +35,12 @@ jobs:
             sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
             sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Config/Config.xcconfig
     - name: Build
-      run: IDEEnableNewPackagePIFBuilder=NO xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
     - name: Move to Artifact Folder
       run: mkdir Artifact; cp -r Archive.xcarchive/Products/Applications/Secretive.app Artifact
     - name: Upload App to Artifacts
       id: upload
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v4
       with:
         name: Secretive
         path: Artifact
@@ -58,7 +59,7 @@ jobs:
       run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
     - name: Attest
       id: attest
-      uses: actions/attest@v4
+      uses: actions/attest-build-provenance@v2
       with:
         subject-name: "Secretive.zip"
         subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}

.github/workflows/oneoff.yml

@@ -5,12 +5,11 @@ on:
   
 jobs:
   build:
-    runs-on: xcode-27
+    runs-on: macos-26
     permissions:
       id-token: write
       contents: write
       attestations: write
-      artifact-metadata: write
       actions: read
     timeout-minutes: 10
     steps:
@@ -24,6 +23,8 @@ jobs:
         APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
+    - name: Set Environment
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.2.app
     - name: Update Build Number
       env:
         RUN_ID: ${{ github.run_id }}
@@ -33,12 +34,12 @@ jobs:
             sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
             sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Config/Config.xcconfig
     - name: Build
-      run: IDEEnableNewPackagePIFBuilder=NO xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
     - name: Move to Artifact Folder
       run: mkdir Artifact; cp -r Archive.xcarchive/Products/Applications/Secretive.app Artifact
     - name: Upload App to Artifacts
       id: upload
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v4
       with:
         name: Secretive
         path: Artifact
@@ -57,7 +58,7 @@ jobs:
       run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
     - name: Attest
       id: attest
-      uses: actions/attest@v4
+      uses: actions/attest-build-provenance@v2
       with:
         subject-name: "Secretive.zip"
         subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}

.github/workflows/release.yml

@@ -8,7 +8,7 @@ jobs:
   test:
     permissions:
         contents: read
-    runs-on: xcode-27
+    runs-on: macos-26
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v5
@@ -21,6 +21,8 @@ jobs:
         APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
+    - name: Set Environment
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.2.app
     - name: Test
       run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme PackageTests test
       # SPM doesn't seem to pick up on the tests currently?
@@ -30,9 +32,8 @@ jobs:
       id-token: write
       contents: write
       attestations: write
-      artifact-metadata: write
       actions: read
-    runs-on: xcode-27
+    runs-on: macos-26
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v5
@@ -45,6 +46,8 @@ jobs:
         APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
+    - name: Set Environment
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.2.app
     - name: Update Build Number
       env:
         TAG_NAME: ${{ github.ref }}
@@ -55,12 +58,12 @@ jobs:
             sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
             sed -i '' -e "s/GITHUB_BUILD_URL/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Config/Config.xcconfig
     - name: Build
-      run: IDEEnableNewPackagePIFBuilder=NO xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
     - name: Move to Artifact Folder
       run: mkdir Artifact; cp -r Archive.xcarchive/Products/Applications/Secretive.app Artifact
     - name: Upload App to Artifacts
       id: upload
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v4
       with:
         name: Secretive.zip
         path: Artifact
@@ -79,7 +82,7 @@ jobs:
       run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
     - name: Attest
       id: attest
-      uses: actions/attest@v4
+      uses: actions/attest-build-provenance@v2
       with:
         subject-path: "Secretive.zip"
     - name: Create Release

.github/workflows/test.yml

@@ -5,10 +5,12 @@ jobs:
   test:
     permissions:
         contents: read
-    runs-on: xcode-27
+    runs-on: macos-26
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v5
+    - name: Set Environment
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.2.app
     - name: Test Main Packages
       run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme PackageTests test
       # SPM doesn't seem to pick up on the tests currently?

.gitignore

@@ -93,7 +93,3 @@ iOSInjectionProject/
 Archive.xcarchive
 .DS_Store
 contents.xcworkspacedata
-
-# Per-User Configs
-
-Sources/Config/OpenSource.xcconfig

CONTRIBUTING.md

@@ -10,10 +10,6 @@ Security is obviously paramount for a project like Secretive. As such, any contr
 
 Secretive is designed to be easily auditable by people who are considering using it. In keeping with this, Secretive has no third party dependencies, and any contributions which bring in new dependencies will be rejected.
 
-### AI/LLM Policy
-
-For security and auditing reasons similar to the policy Secretive has on dependencies, any code generated with AI or LLM tools will not be accepted.
-
 ## Code of Conduct
 
 All contributors must abide by the [Code of Conduct](CODE_OF_CONDUCT.md)

Package.swift

@@ -22,15 +22,6 @@ let package = Package(
         .library(
             name: "SmartCardSecretKit",
             targets: ["SmartCardSecretKit"]),
-        .library(
-            name: "CertificateKit",
-            targets: ["CertificateKit"]),
-        .library(
-            name: "SSHProtocolKit",
-            targets: ["SSHProtocolKit"]),
-        .library(
-            name: "Formatters",
-            targets: ["Formatters"]),
     ],
     dependencies: [
     ],
@@ -62,33 +53,6 @@ let package = Package(
             resources: [localization],
             swiftSettings: swiftSettings
         ),
-        .target(
-            name: "CertificateKit",
-            dependencies: ["SecretKit", "Formatters"],
-            path: "Sources/Packages/Sources/CertificateKit",
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
-        .target(
-            name: "SSHProtocolKit",
-            dependencies: ["SecretKit", "CertificateKit"],
-            path: "Sources/Packages/Sources/SSHProtocolKit",
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
-        .testTarget(
-            name: "SSHProtocolKitTests",
-            dependencies: ["SSHProtocolKit"],
-            path: "Sources/Packages/Tests/SSHProtocolKitTests",
-            swiftSettings: swiftSettings,
-        ),
-        .target(
-            name: "Formatters",
-            dependencies: [],
-            path: "Sources/Packages/Sources/Formatters",
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
     ]
 )
 

Sources/Config/Config.xcconfig

@@ -1,8 +1,3 @@
 CI_VERSION = GITHUB_CI_VERSION
 CI_BUILD_NUMBER = GITHUB_BUILD_NUMBER
 CI_BUILD_LINK = GITHUB_BUILD_URL
-
-#include? "OpenSource.xcconfig"
-
-SECRETIVE_BASE_BUNDLE_ID = $(SECRETIVE_BASE_BUNDLE_ID_OSS:default=com.maxgoedjen.Secretive)
-SECRETIVE_DEVELOPMENT_TEAM = $(SECRETIVE_DEVELOPMENT_TEAM_OSS:default=Z72PRUAWF6)

Sources/Packages/.swiftpm/xcode/xcshareddata/xcschemes/SecretAgentKit.xcscheme

@@ -1,66 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "2700"
-   version = "1.7">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES"
-      buildArchitectures = "Automatic">
-      <BuildActionEntries>
-         <BuildActionEntry
-            buildForTesting = "YES"
-            buildForRunning = "YES"
-            buildForProfiling = "YES"
-            buildForArchiving = "YES"
-            buildForAnalyzing = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "SecretAgentKit"
-               BuildableName = "SecretAgentKit"
-               ReferencedContainer = "container:">
-            </BuildableReference>
-         </BuildActionEntry>
-      </BuildActionEntries>
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      shouldAutocreateTestPlan = "YES">
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES"
-      queueDebuggingEnabled = "No">
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "SecretAgentKit"
-            BuildableName = "SecretAgentKit"
-            ReferencedContainer = "container:">
-         </BuildableReference>
-      </MacroExpansion>
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>

Sources/Packages/Package.swift

@@ -1,4 +1,4 @@
-// swift-tools-version:6.4
+// swift-tools-version:6.2
 // The swift-tools-version declares the minimum version of Swift required to build this package.
 
 import PackageDescription
@@ -7,7 +7,7 @@ let package = Package(
     name: "SecretivePackages",
     defaultLocalization: "en",
     platforms: [
-        .macOS(.v15)
+        .macOS(.v14)
     ],
     products: [
         .library(
@@ -22,21 +22,12 @@ let package = Package(
         .library(
             name: "CertificateKit",
             targets: ["CertificateKit"]),
-        .library(
-            name: "SettingsKit",
-            targets: ["SettingsKit"]),
         .library(
             name: "SecretAgentKit",
             targets: ["SecretAgentKit"]),
-        .library(
-            name: "Formatters",
-            targets: ["Formatters"]),
         .library(
             name: "Common",
             targets: ["Common"]),
-        .library(
-            name: "SharedXPCServices",
-            targets: ["SharedXPCServices"]),
         .library(
             name: "Brief",
             targets: ["Brief"]),
@@ -58,7 +49,7 @@ let package = Package(
         ),
         .testTarget(
             name: "SecretKitTests",
-            dependencies: ["SecretKit", "SecretAgentKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
+            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
             swiftSettings: swiftSettings,
         ),
         .target(
@@ -75,19 +66,13 @@ let package = Package(
         ),
         .target(
             name: "CertificateKit",
-            dependencies: ["SecretKit", "Formatters"],
+            dependencies: ["SecretKit", "SSHProtocolKit"],
             resources: [localization],
-            swiftSettings: swiftSettings,
+//            swiftSettings: swiftSettings,
-        ),
-        .target(
-            name: "SettingsKit",
-            dependencies: [],
-            resources: [localization],
-            swiftSettings: swiftSettings,
         ),
         .target(
             name: "SecretAgentKit",
-            dependencies: ["SecretKit", "SSHProtocolKit", "CertificateKit", "Common", "Formatters"],
+            dependencies: ["SecretKit", "SSHProtocolKit", "CertificateKit"],
             resources: [localization],
             swiftSettings: swiftSettings,
         ),
@@ -97,30 +82,17 @@ let package = Package(
         ),
         .target(
             name: "SSHProtocolKit",
-            dependencies: ["SecretKit", "CertificateKit"],
+            dependencies: ["SecretKit"],
             resources: [localization],
-            swiftSettings: swiftSettings,
+//            swiftSettings: swiftSettings,
         ),
         .testTarget(
             name: "SSHProtocolKitTests",
             dependencies: ["SSHProtocolKit"],
-            swiftSettings: swiftSettings,
-        ),
-        .target(
-            name: "Formatters",
-            dependencies: [],
-            resources: [localization],
-            swiftSettings: swiftSettings,
         ),
         .target(
             name: "Common",
-            dependencies: ["SSHProtocolKit", "SecretKit"],
+            dependencies: [],
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
-        .target(
-            name: "SharedXPCServices",
-            dependencies: ["XPCWrappers", "CertificateKit", "SSHProtocolKit"],
             resources: [localization],
             swiftSettings: swiftSettings,
         ),

Sources/Packages/Sources/Brief/Updater.swift

@@ -34,12 +34,12 @@ import XPCWrappers
     ) {
         self.osVersion = osVersion
         self.currentVersion = currentVersion
-        _ = Task {
+        Task {
             if checkOnLaunch {
                 try await checkForUpdates()
             }
-            while true {
+            while !Task.isCancelled {
-                try await Task.sleep(for: .seconds(Int(checkFrequency)))
+                try? await Task.sleep(for: .seconds(Int(checkFrequency)))
                 try await checkForUpdates()
             }
         }
@@ -75,14 +75,14 @@ extension Updater {
                 .reversed()
                 .filter({ !$0.prerelease })
                 .first(where: { $0.minimumOSVersion <= osVersion }) else { return }
-        guard !userIgnored(release: release) else { return }
+//        guard !userIgnored(release: release) else { return }
-        guard !release.prerelease else { return }
+//        guard !release.prerelease else { return }
-        let latestVersion = SemVer(release.name)
+//        let latestVersion = SemVer(release.name)
-        if latestVersion > currentVersion {
+//        if latestVersion > currentVersion {
             await MainActor.run {
                 state.update = release
             }
-        }
+//        }
     }
 
     /// Checks whether the user has ignored a release.

Sources/Packages/Sources/CertificateKit/Certificate.swift

@@ -1,24 +1,15 @@
 import Foundation
-import CryptoKit
+//import SecretKit
-import Formatters
 
-@dynamicMemberLookup
+//extension SecureEnclave {
-public struct Certificate: Sendable, Codable, Equatable, Hashable, Identifiable, CustomDebugStringConvertible {
 
-    public var openSSHCertificate: OpenSSHCertificate
+public struct Certificate: Sendable, Codable, Equatable, Hashable, Identifiable {
-    public let rawData: Data
 
-    public init(openSSHCertificate: OpenSSHCertificate, rawData: Data) {
+    public var id: Int { hashValue }
-        self.openSSHCertificate = openSSHCertificate
+    public var type: String
-        self.rawData = rawData
+    public let name: String?
-    }
+    public let data: Data
-
-    public var id: String { Insecure.MD5.hash(data: rawData).formatted(.hex(separator: "")) }
-
-    public var debugDescription: String { openSSHCertificate.debugDescription }
-
-    public subscript<T>(dynamicMember keyPath: KeyPath<OpenSSHCertificate, T>) -> T {
-        openSSHCertificate[keyPath: keyPath]
-    }
 
 }
+
+//}

Sources/Packages/Sources/CertificateKit/CertificateMigrator.swift

@@ -0,0 +1,91 @@
+import Foundation
+import Security
+import CryptoTokenKit
+import CryptoKit
+import os
+import SSHProtocolKit
+
+public struct CertificateKitMigrator {
+
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.migration", category: "CertificateKitMigrator")
+    let directory: URL
+
+    /// Initializes a PublicKeyFileStoreController.
+    public init(homeDirectory: URL) {
+        directory = homeDirectory.appending(component: "PublicKeys")
+    }
+
+    @MainActor public func migrate() throws {
+        let fileCerts = try FileManager.default
+            .contentsOfDirectory(atPath: directory.path())
+            .filter { $0.hasSuffix("-cert.pub") }
+        Task {
+            for path in fileCerts {
+                let url = directory.appending(component: path)
+                let data = try! Data(contentsOf: url)
+//                let parser = try! await XPCCertificateParser()
+                let parser = OpenSSHCertificateParser()
+                let cert = try! await parser.parse(data: data)
+                print(cert)
+//                let secret = storeList.allSecrets.first { secret in
+//                    secret.name == cert.name
+//                }
+//                guard let secret = secret ?? storeList.allSecrets.first else { return }
+//                print(cert.data.formatted(.hex()))
+//                certificateStore.saveCertificate(cert.data, for: secret)
+                print(cert)
+            }
+
+        }
+
+//        let privateAttributes = KeychainDictionary([
+//            kSecClass: kSecClassKey,
+//            kSecAttrKeyType: Constants.oldKeyType,
+//            kSecAttrApplicationTag: SecureEnclave.Store.Constants.keyTag,
+//            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+//            kSecReturnRef: true,
+//            kSecMatchLimit: kSecMatchLimitAll,
+//            kSecReturnAttributes: true
+//        ])
+//        var privateUntyped: CFTypeRef?
+//        unsafe SecItemCopyMatching(privateAttributes, &privateUntyped)
+//        guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
+//        let migratedPublicKeys = Set(store.secrets.map(\.publicKey))
+//        var migratedAny = false
+//        for key in privateTyped {
+//            let name = key[kSecAttrLabel] as? String ?? String(localized: .unnamedSecret)
+//            let id = key[kSecAttrApplicationLabel] as! Data
+//            guard !id.contains(Constants.migrationMagicNumber) else {
+//                logger.log("Skipping \(name), already migrated.")
+//                continue
+//            }
+//            let ref = key[kSecValueRef] as! SecKey
+//            let attributes = SecKeyCopyAttributes(ref) as! [CFString: Any]
+//            let tokenObjectID = unsafe attributes[Constants.tokenObjectID] as! Data
+//            let accessControl = attributes[kSecAttrAccessControl] as! SecAccessControl
+//            // Best guess.
+//            let auth: AuthenticationRequirement = String(describing: accessControl)
+//                .contains("DeviceOwnerAuthentication") ? .presenceRequired : .unknown
+//            do {
+//                let parsed = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: tokenObjectID)
+//                let secret = Secret(id: UUID().uuidString, name: name, publicKey: parsed.publicKey.x963Representation, attributes: Attributes(keyType: .init(algorithm: .ecdsa, size: 256), authentication: auth))
+//                guard !migratedPublicKeys.contains(parsed.publicKey.x963Representation) else {
+//                    logger.log("Skipping \(name), public key already present. Marking as migrated.")
+//                    markMigrated(secret: secret, oldID: id)
+//                    continue
+//                }
+//                logger.log("Migrating \(name).")
+//                try store.saveKey(tokenObjectID, name: name, attributes: secret.attributes)
+//                logger.log("Migrated \(name).")
+//                markMigrated(secret: secret, oldID: id)
+//                migratedAny = true
+//            } catch {
+//                logger.error("Failed to migrate \(name): \(error.localizedDescription).")
+//            }
+//        }
+//        if migratedAny {
+//            store.reloadSecrets()
+//        }
+    }
+
+}

Sources/Packages/Sources/CertificateKit/CertificateStore.swift

@@ -1,90 +1,44 @@
 import Foundation
 import Observation
 import Security
-import OSLog
+import os
 import SecretKit
 
-@Observable @MainActor public final class CertificateStore: Sendable {
+@Observable public final class CertificateStore {
 
-    public private(set) var certificates: [Certificate] = []
+    @MainActor private var certificates: [Certificate] = []
 
     /// Initializes a Store.
-    public init() {
+    @MainActor public init() {
         loadCertificates()
         Task {
-            for await note in DistributedNotificationCenter.default().notifications(named: .certificateStoreUpdated) {
+//            for await note in DistributedNotificationCenter.default().notifications(named: .certificateStoreUpdated) {
-                guard Constants.notificationToken != (note.object as? String) else {
+//                guard Constants.notificationToken != (note.object as? String) else {
-                    // Don't reload if we're the ones triggering this by reloading.
+//                    // Don't reload if we're the ones triggering this by reloading.
-                    continue
+//                    continue
-                }
+//                }
-                loadCertificates()
+//                loadCertificates()
-            }
+//            }
         }
     }
 
-    public func reloadCertificates() {
+    @MainActor public func reloadCertificates() {
         let before = certificates
         certificates.removeAll()
         loadCertificates()
         if certificates != before {
-            NotificationCenter.default.post(name: .certificateStoreReloaded, object: self)
+//            NotificationCenter.default.post(name: .certificateStoreReloaded, object: self)
-            DistributedNotificationCenter.default().postNotificationName(.certificateStoreUpdated, object: Constants.notificationToken, deliverImmediately: true)
+//            DistributedNotificationCenter.default().postNotificationName(.certificateStoreUpdated, object: Constants.notificationToken, deliverImmediately: true)
         }
     }
 
-    public func save(certificate: Certificate) throws {
+    @MainActor public func saveCertificate(_ data: Data, for secret: any Secret) {
-        let attributes = try JSONEncoder().encode(certificate.openSSHCertificate)
+        let certificate = SecCertificateCreateWithData(nil, data as CFData)
-        let keychainAttributes = KeychainDictionary([
+        print(certificate as Any)
-            kSecClass: Constants.keyClass,
-            kSecAttrService: Constants.keyTag,
-            kSecAttrAccount: certificate.id,
-            kSecUseDataProtectionKeychain: true,
-            kSecAttrAccessible: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-            kSecValueData: certificate.rawData,
-            kSecAttrGeneric: attributes
-        ])
-        let status = SecItemAdd(keychainAttributes, nil)
-        if status != errSecSuccess && status != errSecDuplicateItem {
-            throw KeychainError(statusCode: status)
-        }
-        reloadCertificates()
     }
 
-    public func delete(certificate: Certificate) throws {
+    @MainActor public func certificates(for secret: any Secret) -> [Certificate] {
-        let deleteAttributes = KeychainDictionary([
+        []
-            kSecClass: Constants.keyClass,
-            kSecAttrService: Constants.keyTag,
-            kSecUseDataProtectionKeychain: true,
-            kSecAttrAccount: certificate.id,
-        ])
-        let status = SecItemDelete(deleteAttributes)
-        if status != errSecSuccess {
-            throw KeychainError(statusCode: status)
-        }
-        reloadCertificates()
-    }
-
-    public func update(certificate: Certificate) throws {
-        let updateQuery = KeychainDictionary([
-            kSecClass: Constants.keyClass,
-            kSecAttrService: Constants.keyTag,
-            kSecAttrAccount: certificate.id,
-        ])
-
-        let cert = try JSONEncoder().encode(certificate.openSSHCertificate)
-        let updatedAttributes = KeychainDictionary([
-            kSecAttrGeneric: cert,
-        ])
-
-        let status = SecItemUpdate(updateQuery, updatedAttributes)
-        if status != errSecSuccess {
-            throw KeychainError(statusCode: status)
-        }
-        reloadCertificates()
-    }
-
-    public func certificates(for secret: any Secret) -> [Certificate] {
-        certificates.filter { $0.openSSHCertificate.publicKey.data == secret.publicKey }
     }
 
 
@@ -93,62 +47,88 @@ import SecretKit
 extension CertificateStore {
 
     /// Loads all certificates from the store.
-    private func loadCertificates() {
+    @MainActor private func loadCertificates() {
-        let queryAttributes = KeychainDictionary([
+//        let queryAttributes = KeychainDictionary([
-            kSecClass: Constants.keyClass,
+//            kSecClass: Constants.keyClass,
-            kSecAttrService: Constants.keyTag,
+//            kSecAttrService: Constants.keyTag,
-            kSecUseDataProtectionKeychain: true,
+//            kSecUseDataProtectionKeychain: true,
-            kSecReturnData: true,
+//            kSecReturnData: true,
-            kSecMatchLimit: kSecMatchLimitAll,
+//            kSecMatchLimit: kSecMatchLimitAll,
-            kSecReturnAttributes: true
+//            kSecReturnAttributes: true
-            ])
+//            ])
-        var untyped: CFTypeRef?
+//        var untyped: CFTypeRef?
-        unsafe SecItemCopyMatching(queryAttributes, &untyped)
+//        unsafe SecItemCopyMatching(queryAttributes, &untyped)
-        guard let typed = untyped as? [[CFString: Any]] else { return }
+//        guard let typed = untyped as? [[CFString: Any]] else { return }
-        let decoder = JSONDecoder()
+//        let wrapped: [SecureEnclave.Certificates] = typed.compactMap {
-        let wrapped: [Certificate] = typed.compactMap {
+//            do {
-            do {
+//                let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_certificate")
-                guard let data = $0[kSecValueData] as? Data,
+//                guard let attributesData = $0[kSecAttrGeneric] as? Data,
-                      let attributesData = $0[kSecAttrGeneric] as? Data else {
+//                let id = $0[kSecAttrAccount] as? String else {
-                    throw MissingAttributesError()
+//                    throw MissingAttributesError()
-                }
+//                }
-                return Certificate(openSSHCertificate: try decoder.decode(OpenSSHCertificate.self, from: attributesData), rawData: data)
+//                let attributes = try JSONDecoder().decode(Attributes.self, from: attributesData)
-            } catch {
+//                let keyData = $0[kSecValueData] as! Data
-                return nil
+//                let publicKey: Data
-            }
+//                switch attributes.keyType {
-        }
+//                case .ecdsa256:
-            .filter {
+//                    let key = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: keyData)
-                if let validityRange = $0.validityRange {
+//                    publicKey = key.publicKey.x963Representation
-                    validityRange.contains(Date())
+//                case .mldsa65:
-                } else {
+//                    guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-                    true
+//                    let key = try CryptoKit.SecureEnclave.MLDSA65.PrivateKey(dataRepresentation: keyData)
-                }
+//                    publicKey = key.publicKey.rawRepresentation
-            }
+//                case .mldsa87:
-
+//                    guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-        certificates.append(contentsOf: wrapped)
+//                    let key = try CryptoKit.SecureEnclave.MLDSA87.PrivateKey(dataRepresentation: keyData)
+//                    publicKey = key.publicKey.rawRepresentation
+//                default:
+//                    throw UnsupportedAlgorithmError()
+//                }
+//                return SecureEnclave.Certificates(id: id, name: name, publicKey: publicKey, attributes: attributes)
+//            } catch {
+//                return nil
+//            }
+//        }
+//        certificates.append(contentsOf: wrapped)
     }
 
+    /// Saves a public key.
+    /// - Parameters:
+    ///   - key: The data representation key to save.
+    ///   - name: A user-facing name for the key.
+    ///   - attributes: Attributes of the key.
+    /// - Note: Despite the name, the "Data" of the key is _not_ actual key material. This is an opaque data representation that the SEP can manipulate.
+//    @discardableResult
+//    func saveKey(_ key: Data, name: String, attributes: Attributes) throws -> String {
+//        let attributes = try JSONEncoder().encode(attributes)
+//        let id = UUID().uuidString
+//        let keychainAttributes = KeychainDictionary([
+//            kSecClass: Constants.keyClass,
+//            kSecAttrService: Constants.keyTag,
+//            kSecUseDataProtectionKeychain: true,
+//            kSecAttrAccessible: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+//            kSecAttrAccount: id,
+//            kSecValueData: key,
+//            kSecAttrLabel: name,
+//            kSecAttrGeneric: attributes
+//        ])
+//        let status = SecItemAdd(keychainAttributes, nil)
+//        if status != errSecSuccess {
+//            throw KeychainError(statusCode: status)
+//        }
+//        return id
+//    }
     
 }
 
 extension CertificateStore {
 
     enum Constants {
-        static let keyClass = kSecClassGenericPassword as String
+        static let keyClass = kSecClassCertificate as String
-        static let keyTag = "com.maxgoedjen.certificatestore.opensshcertificate"
+        static let keyTag = Data("com.maxgoedjen.certificateive.certificate".utf8)
         static let notificationToken = UUID().uuidString
     }
     
     struct UnsupportedAlgorithmError: Error {}
-    struct MissingAttributesError: Error {}
-
-}
-
-extension NSNotification.Name {
-
-    // Distributed notification that keys were modified out of process (ie, that the management tool added/removed certificates)
-    public static let certificateStoreUpdated = NSNotification.Name("com.maxgoedjen.Secretive.certificateStore.updated")
-    // Internal notification that certificates were reloaded from the backing store.
-    public static let certificateStoreReloaded = NSNotification.Name("com.maxgoedjen.Secretive.certificateStore.reloaded")
 
 }

Sources/Packages/Sources/CertificateKit/OpenSSHCertificate.swift

@@ -1,82 +0,0 @@
-import Foundation
-import Formatters
-
-public struct OpenSSHCertificate: Sendable, Codable, Equatable, Hashable, CustomDebugStringConvertible {
-
-    public var type: CertificateType
-    public var name: String
-    public var data: Data
-
-    public var publicKey: PublicKey
-    public var principals: [String]
-    public var keyID: String
-    public var serial: UInt64
-    public var validityRange: Range<Date>?
-    public var criticalOptions: [String]
-    public var extensions: [String]
-    public var signingKey: PublicKey
-
-    public init(
-        type: OpenSSHCertificate.CertificateType,
-        name: String,
-        data: Data,
-        publicKey: PublicKey,
-        principals: [String],
-        keyID: String,
-        serial: UInt64,
-        validityRange: Range<Date>? = nil,
-        criticalOptions: [String],
-        extensions: [String],
-        signingKey: PublicKey,
-    ) {
-        self.type = type
-        self.name = name
-        self.data = data
-        self.publicKey = publicKey
-        self.principals = principals
-        self.keyID = keyID
-        self.serial = serial
-        self.validityRange = validityRange
-        self.criticalOptions = criticalOptions
-        self.extensions = extensions
-        self.signingKey = signingKey
-    }
-
-    public var debugDescription: String {
-        "OpenSSH Certificate \(name, default: "Unnamed"): \(data.formatted(.hex()))"
-    }
-
-}
-
-extension OpenSSHCertificate {
-
-    public enum CertificateType: String, Sendable, Codable {
-        case ecdsa256 = "ecdsa-sha2-nistp256-cert-v01@openssh.com"
-        case ecdsa384 = "ecdsa-sha2-nistp384-cert-v01@openssh.com"
-        case nistp521 = "ecdsa-sha2-nistp521-cert-v01@openssh.com"
-
-        public var keyIdentifier: String {
-            rawValue.replacingOccurrences(of: "-cert-v01@openssh.com", with: "")
-        }
-
-    }
-
-}
-
-extension OpenSSHCertificate {
-
-    public struct PublicKey: Hashable, Sendable, Codable {
-
-        public let keyType: String
-        public let curveName: String
-        public let data: Data
-
-        public init(keyType: String, curveName: String, data: Data) {
-            self.keyType = keyType
-            self.curveName = curveName
-            self.data = data
-        }
-
-    }
-
-}

Sources/Packages/Sources/Common/MultilineInfoView.swift

@@ -1,262 +0,0 @@
-import SwiftUI
-import UniformTypeIdentifiers
-
-public struct MultilineInfoView<TitleView: View, ItemView: View>: View {
-
-    var titleView: TitleView
-    var items: ItemView
-
-    public init(@ViewBuilder titleView: () -> TitleView, @ContentBuilder items: () -> ItemView) {
-        self.titleView = titleView()
-        self.items = items()
-    }
-
-    public init(title: LocalizedStringResource, subtitle: LocalizedStringResource? = nil, image: Image, items: [String]) where TitleView == FixedTitleView, ItemView == FixedItemsView {
-        self.init {
-            FixedTitleView(title: title, subtitle: subtitle, image: image)
-        } items: {
-            FixedItemsView(items: items)
-        }
-    }
-    public init(title: LocalizedStringResource, subtitle: LocalizedStringResource? = nil, image: Image, @ContentBuilder items: () -> ItemView) where TitleView == FixedTitleView {
-        self.init {
-            FixedTitleView(title: title, subtitle: subtitle, image: image)
-        } items: {
-            items()
-        }
-    }
-
-    public var body: some View {
-        VStack(alignment: .leading, spacing: 0) {
-            titleView
-                .bold()
-            .safeAreaPadding(20)
-            Group(subviews: items) { subviews in
-                ForEach(subviews: subviews) { subview in
-                    Divider()
-                        .ignoresSafeArea()
-                        .opacity(subview.id == subviews.first?.id ? 1 : 0.5)
-                    HoveringSubview {
-                        subview
-                    }
-                }
-            }
-        }
-        ._background(interactionState: .normal)
-        .frame(minWidth: 150, maxWidth: .infinity)
-    }
-
-}
-
-struct HoveringSubview<Content: View>: View {
-
-    @State private var multilineAction: MultilineItemActionKey.Box?
-    private let content: Content
-    @State private var interactionState: InteractionState = .normal
-
-    init(@ViewBuilder _ content: () -> Content) {
-        self.multilineAction = nil
-        self.content = content()
-    }
-
-    var body: some View {
-        HStack {
-            content
-            Spacer()
-            if let image = multilineAction?.image {
-                image
-            }
-        }
-            .safeAreaPadding(20)
-            .onHover { hovering in
-                withAnimation {
-                    guard multilineAction != nil else { return }
-                    interactionState = hovering ? .hovering : .normal
-                }
-            }
-            .gesture(
-                TapGesture()
-                    .onEnded {
-                        multilineAction?.closure()
-                        withAnimation {
-                            interactionState = .normal
-                        }
-                    }
-            )
-            .backgroundStyle(.primary.opacity(interactionState == .hovering ? 0.3 : 0))
-            .onPreferenceChange(MultilineItemActionKey.self) {
-                multilineAction = $0
-            }
-    }
-
-}
-
-
-public struct FixedTitleView: View {
-    let title: LocalizedStringResource
-    let subtitle: LocalizedStringResource?
-    let image: Image
-
-    public init(title: LocalizedStringResource, subtitle: LocalizedStringResource?, image: Image) {
-        self.title = title
-        self.subtitle = subtitle
-        self.image = image
-    }
-
-    public var body: some View {
-        HStack {
-            image
-                .renderingMode(.template)
-                                .imageScale(.large)
-            VStack(alignment: .leading) {
-                Text(title)
-                    .font(.headline)
-                if let subtitle {
-                    Text(subtitle)
-                        .font(.subheadline)
-                }
-            }
-            Spacer()
-        }
-
-    }
-}
-
-public struct FixedItemsView: View {
-
-    let items: [String]
-
-    public var body: some View {
-        ForEach(Array(items.enumerated()), id: \.offset) {
-            Text($0.element)
-        }
-    }
-}
-
-fileprivate enum InteractionState {
-    case normal, hovering
-}
-
-extension View {
-       
-    fileprivate func _background(interactionState: InteractionState, cornerRadius: Double = 15) -> some View {
-        modifier(BackgroundViewModifier(interactionState: interactionState, cornerRadius: cornerRadius))
-    }
-    
-}
-
-fileprivate struct BackgroundViewModifier: ViewModifier {
-    
-    @Environment(\.colorScheme) private var colorScheme
-    @Environment(\.appearsActive) private var appearsActive
-    
-    let interactionState: InteractionState
-    let cornerRadius: Double
-    
-    func body(content: Content) -> some View {
-        if #available(macOS 26.0, *) {
-            content
-                .contentShape(RoundedRectangle(cornerRadius: cornerRadius))
-                .glassEffect(.regular.tint(backgroundColor(interactionState: interactionState)), in: RoundedRectangle(cornerRadius: cornerRadius))
-                .mask(RoundedRectangle(cornerRadius: cornerRadius))
-                .shadow(color: .black.opacity(0.1), radius: 5)
-        } else {
-            content
-                .background(backgroundColor(interactionState: interactionState))
-                .cornerRadius(10)
-        }
-    }
-    
-    func backgroundColor(interactionState: InteractionState) -> Color {
-        guard appearsActive else { return Color.clear }
-        if #available(macOS 26.0, *) {
-            let base: Color
-            if #available(macOS 27.0, *) {
-                base = .clear
-            } else {
-                base = colorScheme == .dark ? Color(white: 0.2) : Color(white: 1)
-            }
-            switch interactionState {
-            case .normal:
-                return base
-            case .hovering:
-                return base.mix(with: .accentColor, by: colorScheme == .dark ? 0.2 : 0.1)
-            }
-        } else {
-            switch interactionState {
-            case .normal:
-                return colorScheme == .dark ? Color(white: 0.2) : Color(white: 0.885)
-            case .hovering:
-                return colorScheme == .dark ? Color(white: 0.275) : Color(white: 0.82)
-            }
-        }
-    }
-    
-    
-}
-
-public struct MultilineItemAction: ViewModifier {
-
-    let image: Image?
-    let action: () -> Void
-
-    public init(image: Image?, action: @escaping () -> Void) {
-        self.image = image
-        self.action = action
-    }
-
-    public func body(content: Content) -> some View {
-        content
-            .preference(key: MultilineItemActionKey.self, value: MultilineItemActionKey.Box(image: image, closure: action))
-    }
-
-}
-
-extension View {
-
-    public func multilineItemAction(image: Image? = nil, action: @escaping () -> Void) -> some View {
-        modifier(MultilineItemAction(image: image, action: action))
-    }
-
-}
-
-public struct MultilineItemActionKey : @MainActor PreferenceKey, ~Sendable {
-
-    public struct Box: Equatable {
-
-        let id: UUID = UUID()
-        let image: Image?
-        let closure: () -> Void
-
-        public static func == (lhs: borrowing MultilineItemActionKey.Box, rhs: borrowing MultilineItemActionKey.Box) -> Bool {
-            lhs.id == rhs.id
-        }
-
-    }
-
-    public typealias Value = Box?
-    @MainActor public static let defaultValue: Box? = nil
-
-    public static func reduce(value: inout Box?, nextValue: () -> Box?) {
-        value = nextValue()
-    }
-
-}
-
-#Preview {
-    MultilineInfoView {
-        Text("Hello")
-    } items: {
-        Text("World")
-            .multilineItemAction(image: Image(systemName: "person.wave")) {
-                print("Hello")
-            }
-        Text("World")
-        Text("World")
-    }
-    .padding()
-}
-#Preview {
-    MultilineInfoView(title: "One", image: Image(systemName: "figure.wave"), items: ["Hello world.", "Hello world."])
-        .padding()
-}

Sources/Packages/Sources/Common/URLs.swift

@@ -1,7 +1,4 @@
 import Foundation
-import SSHProtocolKit
-import CertificateKit
-import SecretKit
 
 extension URL {
 
@@ -17,32 +14,6 @@ extension URL {
         #endif
     }
 
-    public static var publicKeyDirectory: URL {
-        agentHomeURL.appending(component: "PublicKeys")
-    }
-
-    public static var certificatesDirectory: URL {
-        agentHomeURL.appending(component: "Certificates")
-    }
-
-    /// The path for a Secret's public key.
-    /// - Parameter secret: The Secret to return the path for.
-    /// - Returns: The path to the Secret's public key.
-    /// - Warning: This method returning a path does not imply that a key has been written to disk already. This method only describes where it will be written to.
-    public static func publicKeyPath<SecretType: Secret>(for secret: SecretType, in directory: URL) -> String {
-        let keyWriter = OpenSSHPublicKeyWriter()
-        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
-        return directory.appending(component: "\(minimalHex).pub").path()
-    }
-
-    /// The path for a certificate.
-    /// - Parameter certificate: The Certificate to return the path for.
-    /// - Returns: The path to the Certificate.
-    /// - Warning: This method returning a path does not imply that a certificate has been written to disk already. This method only describes where it will be written to.
-    public static func certificatePath(for certificateID: String, in directory: URL) -> String {
-        return directory.appending(component: "\(certificateID)-cert.pub").path()
-    }
-
 }
 
 extension String {
@@ -56,4 +27,3 @@ extension String {
     }
 
 }
-

Sources/Packages/Sources/Formatters/Data+Hex.swift

@@ -1,74 +0,0 @@
-import Foundation
-import CryptoKit
-
-public struct HexDataStyle<SequenceType: Sequence>: Hashable, Codable {
-
-    let separator: String
-
-    public init(separator: String) {
-        self.separator = separator
-    }
-
-}
-
-extension HexDataStyle: FormatStyle where SequenceType.Element == UInt8 {
-
-    public func format(_ value: SequenceType) -> String {
-        value
-            .compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
-            .joined(separator: separator)
-    }
-
-}
-
-extension FormatStyle where Self == HexDataStyle<Data> {
-
-    public static func hex(separator: String = "") -> HexDataStyle<Data> {
-        HexDataStyle(separator: separator)
-    }
-
-}
-
-extension FormatStyle where Self == HexDataStyle<Insecure.MD5Digest> {
-
-    public static func hex(separator: String = ":") -> HexDataStyle<Insecure.MD5Digest> {
-        HexDataStyle(separator: separator)
-    }
-
-}
-
-public struct Base64DataStyle<SequenceType: Sequence>: Hashable, Codable {
-
-    private let stripPadding: Bool
-
-    public init(stripPadding: Bool) {
-        self.stripPadding = stripPadding
-    }
-
-}
-
-extension Base64DataStyle: FormatStyle where SequenceType.Element == UInt8 {
-
-    public func format(_ value: SequenceType) -> String {
-        let base64 = Data(value).base64EncodedString()
-        let paddingRange = base64.index(base64.endIndex, offsetBy: -2)..<base64.endIndex
-        return base64.replacingOccurrences(of: "=", with: "", range: paddingRange)
-    }
-
-}
-
-extension FormatStyle where Self == Base64DataStyle<Data> {
-
-    public static func base64(stripPadding: Bool) -> Base64DataStyle<Data> {
-        Base64DataStyle(stripPadding: stripPadding)
-    }
-
-}
-
-extension FormatStyle where Self == Base64DataStyle<SHA256.Digest> {
-
-    public static func base64(stripPadding: Bool) -> Base64DataStyle<SHA256.Digest> {
-        Base64DataStyle(stripPadding: stripPadding)
-    }
-
-}

Sources/Packages/Sources/SSHProtocolKit/Data+Hex.swift

@@ -0,0 +1,37 @@
+import Foundation
+import CryptoKit
+
+public struct HexDataStyle<SequenceType: Sequence>: Hashable, Codable {
+
+    let separator: String
+
+    public init(separator: String) {
+        self.separator = separator
+    }
+
+}
+
+extension HexDataStyle: FormatStyle where SequenceType.Element == UInt8 {
+
+    public func format(_ value: SequenceType) -> String {
+        value
+            .compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
+            .joined(separator: separator)
+    }
+
+}
+
+extension FormatStyle where Self == HexDataStyle<Data> {
+
+    public static func hex(separator: String = "") -> HexDataStyle<Data> {
+        HexDataStyle(separator: separator)
+    }
+
+}
+extension FormatStyle where Self == HexDataStyle<Insecure.MD5Digest> {
+
+    public static func hex(separator: String = ":") -> HexDataStyle<Insecure.MD5Digest> {
+        HexDataStyle(separator: separator)
+    }
+
+}

Sources/Packages/Sources/SSHProtocolKit/OpenSSHCertficateWriter.swift

@@ -1,30 +0,0 @@
-import Foundation
-import CryptoKit
-import CertificateKit
-import Formatters
-
-/// Generates OpenSSH representations of Certificates.
-public struct OpenSSHCertificateWriter: Sendable {
-
-    /// Initializes the writer.
-    public init() {
-    }
-
-    /// Generates an OpenSSH data payload identifying the certificate.
-    /// - Returns: OpenSSH data payload identifying the certificate.
-    public func data(publicKey: OpenSSHCertificate.PublicKey) -> Data {
-        // https://datatracker.ietf.org/doc/html/rfc5656#section-3.1
-        publicKey.keyType.lengthAndData +
-        publicKey.curveName.lengthAndData +
-        publicKey.data.lengthAndData
-    }
-
-    /// Generates an OpenSSH SHA256 fingerprint string.
-    /// - Returns: OpenSSH SHA256 fingerprint string.
-    public func openSSHSHA256KeyFingerprint(publicKey: OpenSSHCertificate.PublicKey) -> String {
-        // OpenSSL format seems to strip the padding at the end.
-        let cleaned = SHA256.hash(data: data(publicKey: publicKey)).formatted(.base64(stripPadding: true))
-        return "SHA256:\(cleaned)"
-    }
-
-}

Sources/Packages/Sources/SSHProtocolKit/OpenSSHCertificate.swift

@@ -1,5 +1,39 @@
 import Foundation
-import CertificateKit
+import OSLog
+import CryptoKit
+
+public struct OpenSSHCertificate: Sendable, Codable, Equatable, Hashable, Identifiable, CustomDebugStringConvertible {
+
+    public var id: Int { hashValue }
+    public var type: CertificateType
+    public let name: String?
+    public let data: Data
+
+    public var publicKey: Data
+    public var principals: [String]
+    public var keyID: String
+    public var serial: UInt64
+    public var validityRange: Range<Date>?
+
+    public var debugDescription: String {
+        "OpenSSH Certificate \(name, default: "Unnamed"): \(data.formatted(.hex()))"
+    }
+
+}
+
+extension OpenSSHCertificate {
+
+    public enum CertificateType: String, Sendable, Codable {
+        case ecdsa256 = "ecdsa-sha2-nistp256-cert-v01@openssh.com"
+        case ecdsa384 = "ecdsa-sha2-nistp384-cert-v01@openssh.com"
+        case nistp521 = "ecdsa-sha2-nistp521-cert-v01@openssh.com"
+
+        var keyIdentifier: String {
+            rawValue.replacingOccurrences(of: "-cert-v01@openssh.com", with: "")
+        }
+    }
+
+}
 
 public protocol OpenSSHCertificateParserProtocol {
     func parse(data: Data) async throws -> OpenSSHCertificate
@@ -7,8 +41,9 @@ public protocol OpenSSHCertificateParserProtocol {
 
 public struct OpenSSHCertificateParser: OpenSSHCertificateParserProtocol, Sendable {
 
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "OpenSSHCertificateParser")
+
     public init() {
-        assert(Bundle.main.bundleURL.pathExtension == "xpc" || ProcessInfo.processInfo.processName == "xctest", "Potentially unsafe parsing code should run in an XPC service")
     }
 
     public func parse(data: Data) throws(OpenSSHCertificateError) -> OpenSSHCertificate {
@@ -25,18 +60,15 @@ public struct OpenSSHCertificateParser: OpenSSHCertificateParserProtocol, Sendab
         guard let decoded = Data(base64Encoded: encodedKey)  else {
             throw OpenSSHCertificateError.parsingFailed
         }
-        let comment = elements.first
+        let name = elements.first
         do {
             let dataParser = OpenSSHReader(data: decoded)
-            let publicKeyType = try dataParser.readNextChunkAsString() // Theoretically the same as typeString, but
+            _ = try dataParser.readNextChunkAsString() // Redundant key type
-                .replacingOccurrences(of: "-cert-v01@openssh.com", with: "")
             _ = try dataParser.readNextChunk() // Nonce
-            let publicKeyCurveName = try dataParser.readNextChunkAsString()
+            _ = try dataParser.readNextChunkAsString() // curve
-            let publicKeyData = try dataParser.readNextChunk()
+            let publicKey = try dataParser.readNextChunk()
-            let publicKey = OpenSSHCertificate.PublicKey(keyType: publicKeyType, curveName: publicKeyCurveName, data: publicKeyData)
             let serialNumber = try dataParser.readNextBytes(as: UInt64.self, convertEndianness: true)
             let role = try dataParser.readNextBytes(as: UInt32.self, convertEndianness: true)
-            _ = role
             let keyIdentifier = try dataParser.readNextChunkAsString()
             let principalsReader = try dataParser.readNextChunkAsSubReader()
             var principals: [String] = []
@@ -46,41 +78,16 @@ public struct OpenSSHCertificateParser: OpenSSHCertificateParserProtocol, Sendab
             let validAfter = try dataParser.readNextBytes(as: UInt64.self, convertEndianness: true)
             let validBefore = try dataParser.readNextBytes(as: UInt64.self, convertEndianness: true)
             let validityRange = Date(timeIntervalSince1970: TimeInterval(validAfter))..<Date(timeIntervalSince1970: TimeInterval(validBefore))
-            let criticalOptionsReader = try dataParser.readNextChunkAsSubReader()
-            var criticalOptions: [String] = []
-            while !criticalOptionsReader.done {
-                let next = try criticalOptionsReader.readNextChunkAsString()
-                if !next.isEmpty {
-                    criticalOptions.append(next)
-                }
-            }
-            let extensionsReader = try dataParser.readNextChunkAsSubReader()
-            var extensions: [String] = []
-            while !extensionsReader.done {
-                let next = try extensionsReader.readNextChunkAsString()
-                if !next.isEmpty {
-                    extensions.append(next)
-                }
-            }
-            _ = try dataParser.readNextChunk() // reserved
-            let signingKeyReader = try dataParser.readNextChunkAsSubReader()
-            let signingKeyType = try signingKeyReader.readNextChunkAsString()
-            let signingKeyCurveName = try signingKeyReader.readNextChunkAsString()
-            let signingKeyData = try signingKeyReader.readNextChunk()
-            let signingKey = OpenSSHCertificate.PublicKey(keyType: signingKeyType, curveName: signingKeyCurveName, data: signingKeyData)
 
             return OpenSSHCertificate(
                 type: type,
-                name: comment ?? keyIdentifier,
+                name: name,
-                data: decoded,
+                data: data,
                 publicKey: publicKey,
                 principals: principals,
                 keyID: keyIdentifier,
                 serial: serialNumber,
-                validityRange: validityRange,
+                validityRange: validityRange
-                criticalOptions: criticalOptions,
-                extensions: extensions,
-                signingKey: signingKey,
             )
         } catch {
             throw .parsingFailed

Sources/Packages/Sources/SSHProtocolKit/OpenSSHPublicKeyWriter.swift

@@ -19,7 +19,7 @@ public struct OpenSSHPublicKeyWriter: Sendable {
             ("nistp" + String(describing: secret.keyType.size)).lengthAndData +
             secret.publicKey.lengthAndData
         case .mldsa:
-            // https://datatracker.ietf.org/doc/html/draft-sfluhrer-ssh-mldsa-05
+            // https://www.ietf.org/archive/id/draft-sfluhrer-ssh-mldsa-04.txt
             openSSHIdentifier(for: secret.keyType).lengthAndData +
             secret.publicKey.lengthAndData
         case .rsa:
@@ -41,7 +41,9 @@ public struct OpenSSHPublicKeyWriter: Sendable {
     /// - Returns: OpenSSH SHA256 fingerprint string.
     public func openSSHSHA256Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
         // OpenSSL format seems to strip the padding at the end.
-        let cleaned = SHA256.hash(data: data(secret: secret)).formatted(.base64(stripPadding: true))
+        let base64 = Data(SHA256.hash(data: data(secret: secret))).base64EncodedString()
+        let paddingRange = base64.index(base64.endIndex, offsetBy: -2)..<base64.endIndex
+        let cleaned = base64.replacingOccurrences(of: "=", with: "", range: paddingRange)
         return "SHA256:\(cleaned)"
     }
 

Sources/Packages/Sources/SSHProtocolKit/OpenSSHReader.swift

@@ -1,23 +1,20 @@
 import Foundation
 
 /// Reads OpenSSH protocol data.
-public final class OpenSSHReader {
+final class OpenSSHReader {
 
     var remaining: Data
     var done = false
 
     /// Initialize the reader with an OpenSSH data payload.
     /// - Parameter data: The data to read.
-    public init(data: Data) {
+    init(data: Data) {
         remaining = Data(data)
-        if remaining.count == 0 {
-            done = true
-        }
     }
 
     /// Reads the next chunk of data from the playload.
     /// - Returns: The next chunk of data.
-    public func readNextChunk(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> Data {
+    func readNextChunk(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> Data {
         let length = try readNextBytes(as: UInt32.self, convertEndianness: convertEndianness)
         guard remaining.count >= length else { throw .beyondBounds }
         let dataRange = 0..<Int(length)
@@ -29,7 +26,7 @@ public final class OpenSSHReader {
         return ret
     }
 
-    public func readNextBytes<T: FixedWidthInteger>(as: T.Type, convertEndianness: Bool = true) throws(OpenSSHReaderError) -> T {
+    func readNextBytes<T: FixedWidthInteger>(as: T.Type, convertEndianness: Bool = true) throws(OpenSSHReaderError) -> T {
         let size = MemoryLayout<T>.size
         guard remaining.count >= size else { throw .beyondBounds }
         let lengthRange = 0..<size
@@ -42,29 +39,16 @@ public final class OpenSSHReader {
         return convertEndianness ? T(value.bigEndian) : T(value)
     }
 
-    public func readNextByteAsBool() throws(OpenSSHReaderError) -> Bool {
+    func readNextChunkAsString(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> String {
-        let size = MemoryLayout<Bool>.size
-        guard remaining.count >= size else { throw .beyondBounds }
-        let lengthRange = 0..<size
-        let lengthChunk = remaining[lengthRange]
-        remaining.removeSubrange(lengthRange)
-        if remaining.isEmpty {
-            done = true
-        }
-        return unsafe lengthChunk.bytes.unsafeLoad(as: Bool.self)
-    }
-
-    public func readNextChunkAsString(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> String {
         try String(decoding: readNextChunk(convertEndianness: convertEndianness), as: UTF8.self)
     }
 
-    public func readNextChunkAsSubReader(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> OpenSSHReader {
+    func readNextChunkAsSubReader(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> OpenSSHReader {
         OpenSSHReader(data: try readNextChunk(convertEndianness: convertEndianness))
     }
 
 }
 
 public enum OpenSSHReaderError: Error, Codable {
-    case incorrectFormat
     case beyondBounds
 }

Sources/Packages/Sources/SSHProtocolKit/OpenSSHSignatureWriter.swift

@@ -17,7 +17,7 @@ public struct OpenSSHSignatureWriter: Sendable {
             // https://datatracker.ietf.org/doc/html/rfc5656#section-3.1
             ecdsaSignature(signature, keyType: secret.keyType)
         case .mldsa:
-            // https://datatracker.ietf.org/doc/html/draft-sfluhrer-ssh-mldsa-05
+            // https://datatracker.ietf.org/doc/html/draft-sfluhrer-ssh-mldsa-00#name-public-key-algorithms
             mldsaSignature(signature, keyType: secret.keyType)
         case .rsa:
             // https://datatracker.ietf.org/doc/html/rfc4253#section-6.6
@@ -30,28 +30,19 @@ public struct OpenSSHSignatureWriter: Sendable {
 
 extension OpenSSHSignatureWriter {
 
-    /// Converts a fixed-width big-endian integer (e.g. r/s from CryptoKit rawRepresentation) into an SSH mpint.
-    /// Strips unnecessary leading zeros and prefixes `0x00` if needed to keep the value positive.
-    private func mpint(fromFixedWidthPositiveBytes bytes: Data) -> Data {
-        // mpint zero is encoded as a string with zero bytes of data.
-        guard let firstNonZeroIndex = bytes.firstIndex(where: { $0 != 0x00 }) else {
-            return Data()
-        }
-
-        let trimmed = Data(bytes[firstNonZeroIndex...])
-
-        if let first = trimmed.first, first >= 0x80 {
-            var prefixed = Data([0x00])
-            prefixed.append(trimmed)
-            return prefixed
-        }
-        return trimmed
-    }
-
     func ecdsaSignature(_ rawRepresentation: Data, keyType: KeyType) -> Data {
         let rawLength = rawRepresentation.count/2
-        let r = mpint(fromFixedWidthPositiveBytes: Data(rawRepresentation[0..<rawLength]))
+        // Check if we need to pad with 0x00 to prevent certain
-        let s = mpint(fromFixedWidthPositiveBytes: Data(rawRepresentation[rawLength...]))
+        // ssh servers from thinking r or s is negative
+        let paddingRange: ClosedRange<UInt8> = 0x80...0xFF
+        var r = Data(rawRepresentation[0..<rawLength])
+        if paddingRange ~= r.first! {
+            r.insert(0x00, at: 0)
+        }
+        var s = Data(rawRepresentation[rawLength...])
+        if paddingRange ~= s.first! {
+            s.insert(0x00, at: 0)
+        }
 
         var signatureChunk = Data()
         signatureChunk.append(r.lengthAndData)

Sources/Packages/Sources/SSHProtocolKit/PublicKeyStandinFileController.swift

@@ -0,0 +1,74 @@
+import Foundation
+import OSLog
+import SecretKit
+
+/// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts.
+public final class PublicKeyFileStoreController: Sendable {
+
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController")
+    private let directory: URL
+    private let keyWriter = OpenSSHPublicKeyWriter()
+
+    /// Initializes a PublicKeyFileStoreController.
+    public init(homeDirectory: URL) {
+        directory = homeDirectory.appending(component: "PublicKeys")
+    }
+
+    /// Writes out the keys specified to disk.
+    /// - Parameter secrets: The Secrets to generate keys for.
+    /// - Parameter clear: Whether or not any untracked files in the directory should be removed.
+    public func generatePublicKeys(for secrets: [AnySecret], clear: Bool = false) throws {
+        logger.log("Writing public keys to disk")
+        if clear {
+            let validPaths = Set(secrets.map { publicKeyPath(for: $0) })
+                .union(Set(secrets.map { sshCertificatePath(for: $0) }))
+            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: directory.path())) ?? []
+            let fullPathContents = contentsOfDirectory.map { directory.appending(path: $0).path() }
+
+            let untracked = Set(fullPathContents)
+                .subtracting(validPaths)
+            for path in untracked {
+                // string instead of fileURLWithPath since we're already using fileURL format.
+                try? FileManager.default.removeItem(at: URL(string: path)!)
+            }
+        }
+        try? FileManager.default.createDirectory(at: directory, withIntermediateDirectories: false, attributes: nil)
+        for secret in secrets {
+            let path = publicKeyPath(for: secret)
+            let data = Data(keyWriter.openSSHString(secret: secret).utf8)
+            FileManager.default.createFile(atPath: path, contents: data, attributes: nil)
+        }
+        logger.log("Finished writing public keys")
+    }
+
+    /// The path for a Secret's public key.
+    /// - Parameter secret: The Secret to return the path for.
+    /// - Returns: The path to the Secret's public key.
+    /// - Warning: This method returning a path does not imply that a key has been written to disk already. This method only describes where it will be written to.
+    public func publicKeyPath<SecretType: Secret>(for secret: SecretType) -> String {
+        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        return directory.appending(component: "\(minimalHex).pub").path()
+    }
+
+    /// Short-circuit check to ship enumerating a bunch of paths if there's nothing in the cert directory.
+    public var hasAnyCertificates: Bool {
+        do {
+            return try FileManager.default
+                .contentsOfDirectory(atPath: directory.path())
+                .filter { $0.hasSuffix("-cert.pub") }
+                .isEmpty == false
+        } catch {
+            return false
+        }
+    }
+
+    /// The path for a Secret's SSH Certificate public key.
+    /// - Parameter secret: The Secret to return the path for.
+    /// - Returns: The path to the SSH Certificate public key.
+    /// - Warning: This method returning a path does not imply that a key has a SSH certificates. This method only describes where it will be.
+    public func sshCertificatePath<SecretType: Secret>(for secret: SecretType) -> String {
+        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        return directory.appending(component: "\(minimalHex)-cert.pub").path()
+    }
+
+}

Sources/Packages/Sources/SSHProtocolKit/SSHAgentInputParser.swift

@@ -1,9 +1,6 @@
 import Foundation
 import OSLog
 import SecretKit
-import CertificateKit
-
-import CryptoKit
 
 public protocol SSHAgentInputParserProtocol {
 
@@ -16,7 +13,7 @@ public struct SSHAgentInputParser: SSHAgentInputParserProtocol {
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "InputParser")
 
     public init() {
-        assert(Bundle.main.bundleURL.pathExtension == "xpc" || ProcessInfo.processInfo.processName == "xctest", "Potentially unsafe parsing code should run in an XPC service")
+        
     }
 
     public func parse(data: Data) throws(AgentParsingError) -> SSHAgent.Request {
@@ -55,8 +52,8 @@ public struct SSHAgentInputParser: SSHAgentInputParserProtocol {
             return .unlock
         case SSHAgent.Request.addSmartcardKeyConstrained.protocolID:
             return .addSmartcardKeyConstrained
-        case SSHAgent.Request.protocolExtension(.empty).protocolID:
+        case SSHAgent.Request.protocolExtension.protocolID:
-            return .protocolExtension(try protocolExtension(from: body))
+            return .protocolExtension
         default:
             return .unknown(rawRequestInt)
         }
@@ -66,154 +63,12 @@ public struct SSHAgentInputParser: SSHAgentInputParserProtocol {
 
 extension SSHAgentInputParser {
 
-    private enum Constants {
-        static let userAuthMagic: UInt8 = 50 // SSH2_MSG_USERAUTH_REQUEST
-        static let sshSigMagic = Data("SSHSIG".utf8)
-    }
-
     func signatureRequestContext(from data: Data) throws(OpenSSHReaderError) -> SSHAgent.Request.SignatureRequestContext {
         let reader = OpenSSHReader(data: data)
         let rawKeyBlob = try reader.readNextChunk()
         let keyBlob = certificatePublicKeyBlob(from: rawKeyBlob) ?? rawKeyBlob
-        let rawPayload = try reader.readNextChunk()
+        let dataToSign = try reader.readNextChunk()
-        let payload: SSHAgent.Request.SignatureRequestContext.SignaturePayload
+        return SSHAgent.Request.SignatureRequestContext(keyBlob: keyBlob, dataToSign: dataToSign)
-        do {
-            if rawPayload.count > 6 && rawPayload[0..<6] == Constants.sshSigMagic {
-                payload = .init(raw: rawPayload, decoded: .sshSig(try sshSigPayload(from: rawPayload[6...])))
-            } else {
-                payload = .init(raw: rawPayload, decoded: .sshConnection(try sshConnectionPayload(from: rawPayload)))
-            }
-        } catch {
-            payload = .init(raw: rawPayload, decoded: nil)
-        }
-        return SSHAgent.Request.SignatureRequestContext(keyBlob: keyBlob, dataToSign: payload)
-    }
-
-    func sshSigPayload(from data: Data) throws(OpenSSHReaderError) -> SSHAgent.Request.SignatureRequestContext.SignaturePayload.DecodedPayload.SSHSigPayload {
-        // https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.sshsig#L79
-        let payloadReader = OpenSSHReader(data: data)
-        let namespace = try payloadReader.readNextChunkAsString()
-        _ = try payloadReader.readNextChunk() // reserved
-        let hashAlgorithm = try payloadReader.readNextChunkAsString()
-        let hash = try payloadReader.readNextChunk()
-        return .init(
-            namespace: namespace,
-            hashAlgorithm: hashAlgorithm,
-            hash: hash
-        )
-    }
-
-    func sshConnectionPayload(from data: Data) throws(OpenSSHReaderError) -> SSHAgent.Request.SignatureRequestContext.SignaturePayload.DecodedPayload.SSHConnectionPayload {
-        let payloadReader = OpenSSHReader(data: data)
-        _ = try payloadReader.readNextChunk()
-        let magic = try payloadReader.readNextBytes(as: UInt8.self, convertEndianness: false)
-        guard magic == Constants.userAuthMagic else { throw .incorrectFormat }
-        let username = try payloadReader.readNextChunkAsString()
-        _ = try payloadReader.readNextChunkAsString() // "ssh-connection"
-        _ = try payloadReader.readNextChunkAsString() // "publickey-hostbound-v00@openssh.com"
-        let hasSignature = try payloadReader.readNextByteAsBool()
-        let algorithm = try payloadReader.readNextChunkAsString()
-        let publicKeyReader = try payloadReader.readNextChunkAsSubReader()
-        _ = try publicKeyReader.readNextChunk()
-        _ = try publicKeyReader.readNextChunk()
-        let publicKey = try publicKeyReader.readNextChunk()
-        let hostKeyReader = try payloadReader.readNextChunkAsSubReader()
-        _ = try hostKeyReader.readNextChunk()
-        let hostKey = try hostKeyReader.readNextChunk()
-        return .init(
-            username: username,
-            hasSignature: hasSignature,
-            publicKeyAlgorithm: algorithm,
-            publicKey: publicKey,
-            hostKey: hostKey,
-        )
-    }
-
-    func protocolExtension(from data: Data) throws(AgentParsingError) -> SSHAgent.ProtocolExtension {
-        do {
-            let reader = OpenSSHReader(data: data)
-            let nameRaw = try reader.readNextChunkAsString()
-            let nameSplit = nameRaw.split(separator: "@")
-            guard nameSplit.count == 2 else {
-                throw AgentParsingError.invalidData
-            }
-            let (name, domain) = (nameSplit[0], nameSplit[1])
-            switch domain {
-            case SSHAgent.ProtocolExtension.OpenSSHExtension.domain:
-                switch name {
-                case SSHAgent.ProtocolExtension.OpenSSHExtension.sessionBind(.empty).name:
-                    do {
-                        let hostkeyBlob = try reader.readNextChunkAsSubReader()
-                        let hostKeyType = try hostkeyBlob.readNextChunkAsString()
-                        let hostKeyData = try hostkeyBlob.readNextChunk()
-                        let sessionID = try reader.readNextChunk()
-                        let signatureBlob = try reader.readNextChunkAsSubReader()
-                        _ = try signatureBlob.readNextChunk() // key type again
-                        let signature = try signatureBlob.readNextChunk()
-                        let forwarding = try reader.readNextByteAsBool()
-                        switch hostKeyType {
-                        case "ssh-ed25519":
-                            let hostKey = try CryptoKit.Curve25519.Signing.PublicKey(rawRepresentation: hostKeyData)
-                            guard hostKey.isValidSignature(signature, for: sessionID) else {
-                                throw AgentParsingError.incorrectSignature
-                            }
-                        case "ecdsa-sha2-nistp256":
-                            let hostKey = try CryptoKit.P256.Signing.PublicKey(rawRepresentation: hostKeyData)
-                            guard hostKey.isValidSignature(try .init(rawRepresentation: signature), for: sessionID) else {
-                                throw AgentParsingError.incorrectSignature
-                            }
-                        case "ecdsa-sha2-nistp384":
-                            let hostKey = try CryptoKit.P384.Signing.PublicKey(rawRepresentation: hostKeyData)
-                            guard hostKey.isValidSignature(try .init(rawRepresentation: signature), for: sessionID) else {
-                                throw AgentParsingError.incorrectSignature
-                            }
-                        case "ssh-mldsa-65":
-                            if #available(macOS 26.0, *) {
-                                let hostKey = try CryptoKit.MLDSA65.PublicKey(rawRepresentation: hostKeyData)
-                                guard hostKey.isValidSignature(signature, for: sessionID) else {
-                                    throw AgentParsingError.incorrectSignature
-                                }
-                            } else {
-                                throw AgentParsingError.unhandledRequest
-                            }
-                        case "ssh-mldsa-87":
-                            if #available(macOS 26.0, *) {
-                                let hostKey = try CryptoKit.MLDSA65.PublicKey(rawRepresentation: hostKeyData)
-                                guard hostKey.isValidSignature(signature, for: sessionID) else {
-                                    throw AgentParsingError.incorrectSignature
-                                }
-                            } else {
-                                throw AgentParsingError.unhandledRequest
-                            }
-                        case "ssh-rsa":
-                            throw AgentParsingError.unhandledRequest
-                        default:
-                            throw AgentParsingError.unhandledRequest
-                        }
-                        let context = SSHAgent.ProtocolExtension.OpenSSHExtension.SessionBindContext(
-                            hostKey: hostKeyData,
-                            sessionID: sessionID,
-                            signature: signature,
-                            forwarding: forwarding
-                        )
-                        return .openSSH(.sessionBind(context))
-                    } catch {
-                        return .openSSH(.sessionBind(.empty))
-                    }
-                default:
-                    return .openSSH(.unknown(String(name)))
-                }
-            default:
-                return .unknown(nameRaw)
-            }
-
-        } catch let error as OpenSSHReaderError {
-            throw .openSSHReader(error)
-        } catch let error as AgentParsingError {
-            throw error
-        } catch {
-            throw .unknownRequest
-        }
     }
 
     func certificatePublicKeyBlob(from hash: Data) -> Data? {
@@ -243,7 +98,6 @@ extension SSHAgentInputParser {
         case unknownRequest
         case unhandledRequest
         case invalidData
-        case incorrectSignature
         case openSSHReader(OpenSSHReaderError)
     }
 

Sources/Packages/Sources/SSHProtocolKit/SSHAgentProtocol.swift

@@ -19,7 +19,7 @@ extension SSHAgent {
         case lock
         case unlock
         case addSmartcardKeyConstrained
-        case protocolExtension(ProtocolExtension)
+        case protocolExtension
         case unknown(UInt8)
 
         public var protocolID: UInt8 {
@@ -60,82 +60,18 @@ extension SSHAgent {
 
         public struct SignatureRequestContext: Sendable, Codable {
             public let keyBlob: Data
-            public let dataToSign: SignaturePayload
+            public let dataToSign: Data
 
-            public init(keyBlob: Data, dataToSign: SignaturePayload) {
+            public init(keyBlob: Data, dataToSign: Data) {
                 self.keyBlob = keyBlob
                 self.dataToSign = dataToSign
             }
 
             public static var empty: SignatureRequestContext {
-                SignatureRequestContext(keyBlob: Data(), dataToSign: SignaturePayload(raw: Data(), decoded: nil))
+                SignatureRequestContext(keyBlob: Data(), dataToSign: Data())
-            }
-
-            public struct SignaturePayload: Sendable, Codable {
-
-                public let raw: Data
-                public let decoded: DecodedPayload?
-
-                public init(
-                    raw: Data,
-                    decoded: DecodedPayload?
-                ) {
-                    self.raw = raw
-                    self.decoded = decoded
-                }
-
-                public enum DecodedPayload: Sendable, Codable {
-                    case sshConnection(SSHConnectionPayload)
-                    case sshSig(SSHSigPayload)
-
-                    public struct SSHConnectionPayload: Sendable, Codable {
-
-                        public let username: String
-                        public let hasSignature: Bool
-                        public let publicKeyAlgorithm: String
-                        public let publicKey: Data
-                        public let hostKey: Data
-
-                        public init(
-                            username: String,
-                            hasSignature: Bool,
-                            publicKeyAlgorithm: String,
-                            publicKey: Data,
-                            hostKey: Data
-                        ) {
-                            self.username = username
-                            self.hasSignature = hasSignature
-                            self.publicKeyAlgorithm = publicKeyAlgorithm
-                            self.publicKey = publicKey
-                            self.hostKey = hostKey
-                        }
-
-                    }
-
-                    public struct SSHSigPayload: Sendable, Codable {
-
-                        public let namespace: String
-                        public let hashAlgorithm: String
-                        public let hash: Data
-
-                        public init(
-                            namespace: String,
-                            hashAlgorithm: String,
-                            hash: Data,
-                        ) {
-                            self.namespace = namespace
-                            self.hashAlgorithm = hashAlgorithm
-                            self.hash = hash
-                        }
-
-                    }
-                    
-                }
-
             }
         }
 
-
     }
 
     /// The type of the SSH Agent Response, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
@@ -152,8 +88,8 @@ extension SSHAgent {
             switch self {
             case .agentFailure: "SSH_AGENT_FAILURE"
             case .agentSuccess: "SSH_AGENT_SUCCESS"
-            case .agentIdentitiesAnswer: "SSH2_AGENT_IDENTITIES_ANSWER"
+            case .agentIdentitiesAnswer: "SSH_AGENT_IDENTITIES_ANSWER"
-            case .agentSignResponse: "SSH2_AGENT_SIGN_RESPONSE"
+            case .agentSignResponse: "SSH_AGENT_SIGN_RESPONSE"
             case .agentExtensionFailure: "SSH_AGENT_EXTENSION_FAILURE"
             case .agentExtensionResponse: "SSH_AGENT_EXTENSION_RESPONSE"
             }

Sources/Packages/Sources/SSHProtocolKit/SSHProtocolExtensions.swift

@@ -1,76 +0,0 @@
-import Foundation
-
-// Extensions, as defined in https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.agent
-
-extension SSHAgent {
-
-    public enum ProtocolExtension: CustomDebugStringConvertible, Codable, Sendable {
-        case openSSH(OpenSSHExtension)
-        case unknown(String)
-
-        public var debugDescription: String {
-            switch self {
-            case let .openSSH(protocolExtension):
-                protocolExtension.debugDescription
-            case .unknown(let string):
-                "Unknown (\(string))"
-            }
-        }
-
-        public static var empty: ProtocolExtension {
-            .unknown("empty")
-        }
-
-        private struct ProtocolExtensionParsingError: Error {}
-
-    }
-
-}
-
-extension SSHAgent.ProtocolExtension {
-
-    public enum OpenSSHExtension: CustomDebugStringConvertible, Codable, Sendable {
-        case sessionBind(SessionBindContext)
-        case unknown(String)
-
-        public static var domain: String {
-            "openssh.com"
-        }
-
-        public var name: String {
-            switch self {
-            case .sessionBind:
-                "session-bind"
-            case .unknown(let name):
-                name
-            }
-        }
-
-        public var debugDescription: String {
-            "\(name)@\(OpenSSHExtension.domain)"
-        }
-    }
-
-}
-
-extension SSHAgent.ProtocolExtension.OpenSSHExtension {
-
-    public struct SessionBindContext: Codable, Sendable {
-
-        public let hostKey: Data
-        public let sessionID: Data
-        public let signature: Data
-        public let forwarding: Bool
-
-        public init(hostKey: Data, sessionID: Data, signature: Data, forwarding: Bool) {
-            self.hostKey = hostKey
-            self.sessionID = sessionID
-            self.signature = signature
-            self.forwarding = forwarding
-        }
-
-        public static let empty = SessionBindContext(hostKey: Data(), sessionID: Data(), signature: Data(), forwarding: false)
-
-    }
-
-}

Sources/Packages/Sources/SecretAgentKit/Agent.swift

@@ -2,7 +2,6 @@ import Foundation
 import CryptoKit
 import OSLog
 import SecretKit
-import CertificateKit
 import AppKit
 import SSHProtocolKit
 
@@ -10,42 +9,30 @@ import SSHProtocolKit
 public final class Agent: Sendable {
 
     private let storeList: SecretStoreList
-    private let authenticationHandler: AuthenticationHandler
-    private let certificateStore: CertificateStore
     private let witness: SigningWitness?
     private let publicKeyWriter = OpenSSHPublicKeyWriter()
     private let signatureWriter = OpenSSHSignatureWriter()
+//    private let certificateHandler = OpenSSHCertificateHandler()
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "Agent")
 
-    @MainActor private var sessionID: SSHAgent.ProtocolExtension.OpenSSHExtension.SessionBindContext?
-
     /// Initializes an agent with a store list and a witness.
     /// - Parameters:
     ///   - storeList: The `SecretStoreList` to make available.
     ///   - witness: A witness to notify of requests.
-    public init(
+    public init(storeList: SecretStoreList, witness: SigningWitness? = nil) {
-        storeList: SecretStoreList,
-        certificateStore: CertificateStore,
-        authenticationHandler: AuthenticationHandler,
-        witness: SigningWitness? = nil
-    ) {
         logger.debug("Agent is running")
         self.storeList = storeList
-        self.certificateStore = certificateStore
-        self.authenticationHandler = authenticationHandler
         self.witness = witness
+        Task { @MainActor in
+//            await certificateHandler.reloadCertificates(for: storeList.allSecrets)
+        }
     }
     
 }
 
 extension Agent {
 
-    public func handle(
+    public func handle(request: SSHAgent.Request, provenance: SigningRequestProvenance) async -> Data {
-        request: SSHAgent.Request,
-        provenance: SigningRequestProvenance,
-        hosts: [Data: String]?
-    ) async -> Data {
-        logger.debug("Agent received request of type \(request.debugDescription)")
         // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
         await reloadSecretsIfNeccessary()
         var response = Data()
@@ -56,55 +43,9 @@ extension Agent {
                 response.append(await identities())
                 logger.debug("Agent returned \(SSHAgent.Response.agentIdentitiesAnswer.debugDescription)")
             case .signRequest(let context):
-                let target: SigningRequestTarget?
-                switch context.dataToSign.decoded {
-                case .sshConnection(let payload):
-                    target = .connection(
-                        .init(
-                            username: payload.username,
-                            hasSignature: payload.hasSignature,
-                            publicKeyAlgorithm: payload.publicKeyAlgorithm,
-                            publicKey: payload.publicKey,
-                            hostKey: payload.hostKey,
-                            host: hosts?[payload.hostKey]
-                        )
-                    )
-                    if let boundSession = await sessionID {
-                        guard payload.hostKey == boundSession.hostKey else {
-                            logger.error("Agent received bind request, but host key does not match signature request host key.")
-                            throw BindingFailure()
-                        }
-                    }
-                case .sshSig(let payload):
-                    target = .signature(
-                        .init(
-                            namespace: payload.namespace,
-                            hashAlgorithm: payload.hashAlgorithm,
-                            hash: payload.hash
-                        )
-                    )
-                default:
-                    target = nil
-                }
-                _ = target
                 response.append(SSHAgent.Response.agentSignResponse.data)
-                response.append(try await sign(data: context.dataToSign.raw, keyBlob: context.keyBlob, provenance: provenance, target: target))
+                response.append(try await sign(data: context.dataToSign, keyBlob: context.keyBlob, provenance: provenance))
                 logger.debug("Agent returned \(SSHAgent.Response.agentSignResponse.debugDescription)")
-            case .protocolExtension(.openSSH(.sessionBind(let bind))):
-                // This is disabled until forward enforcement is handled.
-                _ = bind
-                response = try await MainActor.run {
-                    logger.debug("Agent received bind request but not currently supported.")
-                    throw UnhandledRequestError()
-//                    guard sessionID == nil else {
-//                        logger.error("Agent received bind request, but already bound.")
-//                        throw BindingFailure()
-//                    }
-//                    logger.debug("Agent bound")
-//                    sessionID = bind
-//                    return SSHAgent.Response.agentSuccess.data
-                }
-                logger.debug("Agent returned \(SSHAgent.Response.agentSuccess.debugDescription)")
             case .unknown(let value):
                 logger.error("Agent received unknown request of type \(value).")
                 throw UnhandledRequestError()
@@ -127,6 +68,7 @@ extension Agent {
     /// - Returns: An OpenSSH formatted Data payload listing the identities available for signing operations.
     func identities() async -> Data {
         let secrets = await storeList.allSecrets
+//        await certificateHandler.reloadCertificates(for: secrets)
         var count = 0
         var keyData = Data()
 
@@ -135,11 +77,12 @@ extension Agent {
             keyData.append(keyBlob.lengthAndData)
             keyData.append(publicKeyWriter.comment(secret: secret).lengthAndData)
             count += 1
-            for certificate in await certificateStore.certificates(for: secret) {
+            
-                keyData.append(certificate.data.lengthAndData)
+//            if let (certificateData, name) = try? await certificateHandler.keyBlobAndName(for: secret) {
-                keyData.append(certificate.name.lengthAndData)
+//                keyData.append(certificateData.lengthAndData)
-                count += 1
+//                keyData.append(name.lengthAndData)
-            }
+//                count += 1
+//            }
         }
         logger.log("Agent enumerated \(count) identities")
         var countBigEndian = UInt32(count).bigEndian
@@ -152,28 +95,22 @@ extension Agent {
     ///   - data: The data to sign.
     ///   - provenance: A ``SecretKit.SigningRequestProvenance`` object describing the origin of the request.
     /// - Returns: An OpenSSH formatted Data payload containing the signed data response.
-    func sign(data: Data, keyBlob: Data, provenance: SigningRequestProvenance, target: SigningRequestTarget?) async throws -> Data {
+    func sign(data: Data, keyBlob: Data, provenance: SigningRequestProvenance) async throws -> Data {
         guard let (secret, store) = await secret(matching: keyBlob) else {
             let keyBlobHex = keyBlob.formatted(.hex())
             logger.debug("Agent did not have a key matching \(keyBlobHex)")
             throw NoMatchingKeyError()
         }
-        logger.debug("Agent offering witness chance to object")
-        do {
-            try await witness?.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance, target: target)
-        } catch {
-            logger.debug("Witness objected")
-            throw error
-        }
-        logger.debug("Witness did not object")
 
-        let request = SignatureRequest(secret: secret, provenance: provenance, target: target)
+        try await witness?.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
-        let newContext = AuthenticationContext(secret: secret, requests: [request])
+
-        let context = try await authenticationHandler.authenticatedContext(for: request, context: newContext)
+        let rawRepresentation = try await store.sign(data: data, with: secret, for: provenance)
-        let result = try await store.sign(data: data, with: secret, for: provenance, target: target, context: context?.laContext)
+        let signedData = signatureWriter.data(secret: secret, signature: rawRepresentation)
-        let signedData = signatureWriter.data(secret: secret, signature: result)
+
-        try await witness?.witness(accessTo: secret, from: store, by: provenance, target: target, offerPersistence: secret.authenticationRequirement.required)
+        try await witness?.witness(accessTo: secret, from: store, by: provenance)
+
         logger.debug("Agent signed request")
+
         return signedData
     }
 
@@ -208,7 +145,6 @@ extension Agent {
 
     struct NoMatchingKeyError: Error {}
     struct UnhandledRequestError: Error {}
-    struct BindingFailure: Error {}
 
 }
 

Sources/Packages/Sources/SecretAgentKit/AuthenticationHandler.swift

@@ -1,218 +0,0 @@
-@unsafe @preconcurrency import LocalAuthentication
-import SecretKit
-import OSLog
-
-/// A context describing a persisted authentication.
-public final class AuthenticationContext: AuthenticationContextProtocol {
-
-    /// The Secret to persist authentication for.
-    public let secret: AnySecret
-    /// The LAContext used to authorize the persistent context.
-    public let laContext: LAContext?
-
-    enum Validity {
-        /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
-        case time(monotonicExpiration: UInt64)
-        case requestIDs(Set<UUID>)
-        case exclusive(UUID)
-    }
-
-    let validity: Validity
-
-    /// Initializes a context.
-    /// - Parameters:
-    ///   - secret: The Secret to persist authentication for.
-    ///   - duration: The duration of the authorization context, in seconds.
-    init<SecretType: Secret>(secret: SecretType, duration: TimeInterval) {
-        self.secret = AnySecret(secret)
-        let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
-        self.validity = .time(monotonicExpiration: clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds))
-        let newContext = LAContext()
-        newContext.touchIDAuthenticationAllowableReuseDuration = duration
-        newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-
-        let formatter = DateComponentsFormatter()
-        formatter.unitsStyle = .spellOut
-        formatter.allowedUnits = [.hour, .minute, .day]
-        let durationString = formatter.string(from: duration)!
-        newContext.localizedReason = String(localized: .authContextPersistForDuration(secretName: secret.name, duration: durationString))
-        laContext = newContext
-    }
-
-    init<SecretType: Secret>(secret: SecretType, requests: Set<SignatureRequest>) {
-        self.secret = AnySecret(secret)
-        if requests.count == 1 {
-            self.validity = .exclusive(requests.first!.id)
-        } else {
-            self.validity = .requestIDs(Set(requests.map(\.id)))
-        }
-        if secret.authenticationRequirement.required {
-            let newContext = LAContext()
-            newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-            let appName = requests.first!.provenance.origin.displayName
-            if requests.count > 1 {
-                newContext.localizedReason = String(localized: .authContextRequestMultiple(appName: appName, secretName: secret.name))
-            } else {
-                newContext.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: appName, secretName: secret.name))
-            }
-            laContext = newContext
-        } else {
-            laContext = nil
-        }
-    }
-
-    /// A boolean describing whether or not the context is still valid.
-    public func valid(for request: SignatureRequest) -> Bool {
-        switch validity {
-        case .time(let monotonicExpiration):
-            clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
-        case .requestIDs(let set):
-            set.contains(request.id)
-        case .exclusive(let id):
-            id == request.id
-        }
-    }
-
-    public func evaluate(requireBiometrics: Bool) async throws -> Bool {
-        guard let laContext else { return false }
-        let policy: LAPolicy = requireBiometrics ? .deviceOwnerAuthenticationWithBiometrics : .deviceOwnerAuthentication
-        return try await laContext.evaluatePolicy(policy, localizedReason: laContext.localizedReason)
-    }
-
-    public func cancel() async {
-        laContext?.invalidate()
-    }
-
-}
-
-@MainActor public protocol AuthenticationHandlerProtocol: Observable {
-    var batchableRequests: [[SignatureRequest]] { get }
-    func setPendingRequestHandler(_ handler: @escaping () async throws -> Void)
-    func authenticatedContext(for request: SignatureRequest, context: any AuthenticationContextProtocol) async throws -> (any AuthenticationContextProtocol)?
-    func persistAuthentication<SecretType: Secret>(secret: SecretType, forDuration duration: TimeInterval) async throws
-    func requestAuthentication(for requests: Set<SignatureRequest>) async throws
-}
-
-@Observable @MainActor public class AuthenticationHandler: AuthenticationHandlerProtocol {
-
-    private var authenticatedContexts: [AnySecret: AuthenticationContext] = [:]
-    private var waitingRequests: Set<SignatureRequest> = []
-    private var activeTask: Task<Bool, any Error>?
-    private var activeContext: (any AuthenticationContextProtocol)?
-
-    private var lastBatchAuthPresentation: Set<SignatureRequest>?
-    private var presentPendingAuth: (() async throws -> Void)?
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "AuthenticationHandler")
-
-    public init() {
-    }
-
-    public func setPendingRequestHandler(_ handler: @escaping () async throws -> Void) {
-        self.presentPendingAuth = handler
-    }
-
-    public func authenticatedContext(for request: SignatureRequest, context: any AuthenticationContextProtocol) async throws -> (any AuthenticationContextProtocol)? {
-        if request.secret.authenticationRequirement.required {
-            // Slow path, will block caller until authenticated (either directly or via a pending requests view).
-            return try await waitForAuthentication(for: request, context: context)
-        } else {
-            // Fast path, no blocking/enqueing required
-            return context
-        }
-    }
-
-    func waitForAuthentication(for request: SignatureRequest, context: any AuthenticationContextProtocol) async throws -> any AuthenticationContextProtocol {
-        logger.log("Entering waitForAuthentication for \(request.id)")
-        if let existing = existingAuthenticationContext(for: request) {
-            logger.log("Short circuiting wait, existing valid context already exists.")
-            return existing
-        }
-        waitingRequests.insert(request)
-        logger.log("Waiting for authentication for \(request.id)")
-        defer {
-            logger.log("Removed hold for \(request.id)")
-            waitingRequests.remove(request)
-        }
-
-        if waitingRequests.count > 1 {
-            return try await waitUntilRequestActedOn(request)
-        }
-
-        // Hold onto the task and context so we can cancel them when prsenting pending.
-        activeContext = context
-        let currentTask = Task<Bool, any Error> {
-            logger.log("Beginning individual auth prompt")
-            let result = (try? await context.evaluate(requireBiometrics: request.secret.authenticationRequirement == .biometryCurrent)) ?? false
-            logger.log("Ended individual auth prompt")
-            return result
-        }
-        activeTask = currentTask
-        let result = try? await activeTask?.value
-        if result == false && activeTask?.isCancelled == false {
-            waitingRequests.remove(request)
-            throw CancellationError()
-        } else if currentTask.isCancelled {
-            return try await waitUntilRequestActedOn(request)
-        }
-        return context
-    }
-
-    func waitUntilRequestActedOn(_ request: SignatureRequest) async throws -> any AuthenticationContextProtocol {
-        logger.log("Auth prompt was cancelled, waiting for explicit auth")
-        // At this point, we essentially just block the task until either the request has been authenticated "externally" via the pending view.
-        while waitingRequests.contains(request) {
-            if waitingRequests != lastBatchAuthPresentation {
-                // If we're about to present a batch, we cancel the individual auth prompt, and show the batch one.
-                logger.log("Multiple pending requests exist, cancelling existing auth prompt")
-                activeTask?.cancel()
-                lastBatchAuthPresentation = waitingRequests
-                logger.log("Requesting pending requests presentation")
-                try await presentPendingAuth?()
-                await activeContext?.cancel()
-                logger.log("Requested pending requests presentation")
-            }
-            if let preauthenticated = existingAuthenticationContext(for: request) {
-                logger.log("Explicit auth context found")
-                return preauthenticated
-            }
-            try await Task.sleep(for: .milliseconds(100))
-        }
-        throw CancellationError()
-
-    }
-
-    public var batchableRequests: [[SignatureRequest]] {
-        waitingRequests.reduce(into: [:]) { partialResult, next in
-            partialResult[next.batchID, default: []].append(next)
-        }
-        .values
-        .map { $0.sorted() }
-    }
-
-    private func existingAuthenticationContext(for request: SignatureRequest) -> (any AuthenticationContextProtocol)? {
-        guard let authenticated = authenticatedContexts[request.secret], authenticated.valid(for: request) else { return nil }
-        return authenticated
-    }
-
-    public func persistAuthentication<SecretType: Secret>(secret: SecretType, forDuration duration: TimeInterval) async throws {
-        let context = AuthenticationContext(secret: secret, duration: duration)
-        let success = try await context.evaluate(requireBiometrics: secret.authenticationRequirement == .biometryCurrent)
-        guard success else { return }
-        authenticatedContexts[AnySecret(secret)] = context
-    }
-
-    public func requestAuthentication(for requests: Set<SignatureRequest>) async throws {
-        activeTask?.cancel()
-        guard let first = requests.first else { return }
-        let context = AuthenticationContext(secret: first.secret, requests: requests)
-        let success = (try? await context.evaluate(requireBiometrics: first.secret.authenticationRequirement == .biometryCurrent)) ?? false
-        guard success else {
-            waitingRequests.subtract(requests)
-            return
-        }
-        // Even single-use ones get stuffed into authenticatedContexts, so that it can unblock the response path.
-        authenticatedContexts[AnySecret(first.secret)] = context
-    }
-
-}
-

Sources/Packages/Sources/SecretAgentKit/OpenSSHCertificateHandler.swift

@@ -0,0 +1,35 @@
+import Foundation
+import OSLog
+import SecretKit
+import SSHProtocolKit
+
+/// Manages storage and lookup for OpenSSH certificates.
+public actor OpenSSHCertificateHandler: Sendable {
+
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: URL.homeDirectory)
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler")
+    private let writer = OpenSSHPublicKeyWriter()
+    private var keyBlobsAndNames: [AnySecret: (Data, Data)] = [:]
+
+    /// Initializes an OpenSSHCertificateHandler.
+    public init() {
+    }
+
+    /// Reloads any certificates in the PublicKeys folder.
+    /// - Parameter secrets: the secrets to look up corresponding certificates for.
+    public func reloadCertificates(for secrets: [AnySecret]) {
+        guard publicKeyFileStoreController.hasAnyCertificates else {
+            logger.log("No certificates, short circuiting")
+            return
+        }
+    }
+
+    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
+    /// - Parameter secret: The secret to search for a certificate with
+    /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
+    public func keyBlobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? {
+        keyBlobsAndNames[AnySecret(secret)]
+    }
+
+}
+

Sources/Packages/Sources/SecretAgentKit/PublicKeyStandinFileController.swift

@@ -1,83 +0,0 @@
-import Foundation
-import OSLog
-import SecretKit
-import SSHProtocolKit
-import CertificateKit
-import Common
-
-/// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts.
-public final class PublicKeyFileStoreController: Sendable {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController")
-    private let publicKeysURL: URL
-    private let certificatesURL: URL
-    private let keyWriter = OpenSSHPublicKeyWriter()
-
-    /// Initializes a PublicKeyFileStoreController.
-    public init(publicKeysURL: URL, certificatesURL: URL) {
-        self.publicKeysURL = publicKeysURL
-        self.certificatesURL = certificatesURL
-    }
-
-    /// Writes out the keys specified to disk.
-    /// - Parameter secrets: The Secrets to generate keys for.
-    /// - Parameter clear: Whether or not any untracked files in the directory should be removed.
-    public func generatePublicKeys(for secrets: [AnySecret], clear: Bool = false) throws {
-        logger.log("Writing public keys to disk")
-        if clear {
-            let validPaths = Set(secrets.map { URL.publicKeyPath(for: $0, in: publicKeysURL) })
-                .union(Set(secrets.map { legacySSHCertificatePath(for: $0) }))
-            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: publicKeysURL.path())) ?? []
-            let fullPathContents = contentsOfDirectory.map { publicKeysURL.appending(path: $0).path() }
-
-            let untracked = Set(fullPathContents)
-                .subtracting(validPaths)
-            for path in untracked {
-                // string instead of fileURLWithPath since we're already using fileURL format.
-                try? FileManager.default.removeItem(at: URL(string: path)!)
-            }
-        }
-        try? FileManager.default.createDirectory(at: publicKeysURL, withIntermediateDirectories: false, attributes: nil)
-        for secret in secrets {
-            let path = URL.publicKeyPath(for: secret, in: publicKeysURL)
-            let data = Data(keyWriter.openSSHString(secret: secret).utf8)
-            FileManager.default.createFile(atPath: path, contents: data, attributes: nil)
-        }
-        logger.log("Finished writing public keys")
-    }
-
-    /// Writes out the certificates specified to disk.
-    /// - Parameter certificates: The Secrets to generate keys for.
-    /// - Parameter clear: Whether or not any untracked files in the directory should be removed.
-    public func generateCertificates(for certificates: [Certificate], clear: Bool = false) throws {
-        logger.log("Writing certificates to disk")
-        if clear {
-            let validPaths = Set(certificates.map { URL.certificatePath(for: $0.id, in: certificatesURL) })
-            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: certificatesURL.path())) ?? []
-            let fullPathContents = contentsOfDirectory.map { certificatesURL.appending(path: $0).path() }
-
-            let untracked = Set(fullPathContents)
-                .subtracting(validPaths)
-            for path in untracked {
-                // string instead of fileURLWithPath since we're already using fileURL format.
-                try? FileManager.default.removeItem(at: URL(string: path)!)
-            }
-        }
-        try? FileManager.default.createDirectory(at: certificatesURL, withIntermediateDirectories: false, attributes: nil)
-        for certificate in certificates {
-            let path = URL.certificatePath(for: certificate.id, in: certificatesURL)
-            FileManager.default.createFile(atPath: path, contents: certificate.rawData, attributes: nil)
-        }
-        logger.log("Finished writing certificates")
-    }
-
-    /// The path for a Secret's SSH Certificate public key.
-    /// - Parameter secret: The Secret to return the path for.
-    /// - Returns: The path to the SSH Certificate public key.
-    /// - Warning: This method returning a path does not imply that a key has a SSH certificates. This method only describes where it will be.
-    private func legacySSHCertificatePath<SecretType: Secret>(for secret: SecretType) -> String {
-        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
-        return publicKeysURL.appending(component: "\(minimalHex).pub").path()
-    }
-
-}

Sources/Packages/Sources/SecretAgentKit/SigningRequestTracer.swift

@@ -44,7 +44,6 @@ extension SigningRequestTracer {
 
         let pathPointer = UnsafeMutablePointer<UInt8>.allocate(capacity: Int(MAXPATHLEN))
         _ = unsafe proc_pidpath(pid, pathPointer, UInt32(MAXPATHLEN))
-
         let path = unsafe String(cString: pathPointer)
         var secCode: Unmanaged<SecCode>!
         let flags: SecCSFlags = [.considerExpiration, .enforceRevocationChecks]
@@ -81,6 +80,10 @@ extension SigningRequestTracer {
 
 }
 
+// from libproc.h
+@_silgen_name("proc_pidpath")
+@discardableResult func proc_pidpath(_ pid: Int32, _ buffer: UnsafeMutableRawPointer!, _ buffersize: UInt32) -> Int32
+
 //// from SecTask.h
 @_silgen_name("SecCodeCreateWithPID")
 @discardableResult func SecCodeCreateWithPID(_: Int32, _: SecCSFlags, _: UnsafeMutablePointer<Unmanaged<SecCode>?>!) -> OSStatus

Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift

@@ -1,6 +1,5 @@
 import Foundation
 import SecretKit
-import SSHProtocolKit
 
 /// A protocol that allows conformers to be notified of access to secrets, and optionally prevent access.
 public protocol SigningWitness: Sendable {
@@ -11,13 +10,13 @@ public protocol SigningWitness: Sendable {
     ///   - store: The `Store` being asked to sign the request..
     ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
     ///   - Note: This method being called does not imply that the requst has been authorized. If a secret requires authentication, authentication will still need to be performed by the user before the request will be performed. If the user declines or fails to authenticate, the request will fail.
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, target: SigningRequestTarget?) async throws
+    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws
 
     /// Notifies the callee that a signing operation has been performed for a given secret.
     /// - Parameters:
     ///   - secret: The `Secret` that will was used to sign the request.
     ///   - store: The `Store` that signed the request..
     ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, target: SigningRequestTarget?, offerPersistence: Bool) async throws
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws
 
 }

Sources/Packages/Sources/SecretAgentKit/SocketController.swift

@@ -39,7 +39,7 @@ public struct SocketController {
         Task { @MainActor [fileHandle, sessionsContinuation, logger] in
             // Create the sequence before triggering the notification to
             // ensure it will not be missed.
-            let connectionAcceptedNotifications = NotificationCenter.default.notifications(named: .NSFileHandleConnectionAccepted, object: fileHandle)
+            let connectionAcceptedNotifications = NotificationCenter.default.notifications(named: .NSFileHandleConnectionAccepted)
 
             fileHandle.acceptConnectionInBackgroundAndNotify()
 
@@ -94,7 +94,7 @@ extension SocketController {
                     guard !data.isEmpty else {
                         logger.debug("Socket controller received empty data, ending continuation.")
                         messagesContinuation.finish()
-                        try? fileHandle.close()
+                        try fileHandle.close()
                         return
                     }
                     messagesContinuation.yield(data)
@@ -126,8 +126,8 @@ private extension SocketPort {
     convenience init(path: String) {
         var addr = sockaddr_un()
 
-        let length = withUnsafeMutablePointer(to: &addr.sun_path.0) { pointer in
+        let length = unsafe withUnsafeMutablePointer(to: &addr.sun_path.0) { pointer in
-            path.withCString { cstring in
+            unsafe path.withCString { cstring in
                 let len = unsafe strlen(cstring)
                 unsafe strncpy(pointer, cstring, len)
                 return len

Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md

@@ -31,7 +31,7 @@ SecretKit is a collection of protocols describing secrets and stores.
 
 ### Authentication Persistence
 
-- ``AuthenticationContextProtocol``
+- ``PersistedAuthenticationContext``
 
 ### Errors
 

Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift

@@ -1,5 +1,4 @@
 import Foundation
-import LocalAuthentication
 
 /// Type eraser for SecretStore.
 open class AnySecretStore: SecretStore, @unchecked Sendable {
@@ -9,7 +8,9 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
     private let _id: @Sendable () -> UUID
     private let _name: @MainActor @Sendable () -> String
     private let _secrets: @MainActor @Sendable () -> [AnySecret]
-    private let _sign: @Sendable (Data, AnySecret, SigningRequestProvenance, SigningRequestTarget?, LAContext?) async throws -> Data
+    private let _sign: @Sendable (Data, AnySecret, SigningRequestProvenance) async throws -> Data
+    private let _existingPersistedAuthenticationContext: @Sendable (AnySecret) async -> PersistedAuthenticationContext?
+    private let _persistAuthentication: @Sendable (AnySecret, TimeInterval) async throws -> Void
     private let _reloadSecrets: @Sendable () async -> Void
 
     public init<SecretStoreType>(_ secretStore: SecretStoreType) where SecretStoreType: SecretStore {
@@ -18,7 +19,9 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
         _name = { secretStore.name }
         _id = { secretStore.id }
         _secrets = { secretStore.secrets.map { AnySecret($0) } }
-        _sign = { try await secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2, target: $3, context: $4) }
+        _sign = { try await secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
+        _existingPersistedAuthenticationContext = { await secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
+        _persistAuthentication = { try await secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
         _reloadSecrets = { await secretStore.reloadSecrets() }
     }
 
@@ -38,8 +41,16 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
         return _secrets()
     }
 
-    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?, context: LAContext?) async throws -> Data {
+    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) async throws -> Data {
-        try await _sign(data, secret, provenance, target, context)
+        try await _sign(data, secret, provenance)
+    }
+
+    public func existingPersistedAuthenticationContext(secret: AnySecret) async -> PersistedAuthenticationContext? {
+        await _existingPersistedAuthenticationContext(secret)
+    }
+
+    public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) async throws {
+        try await _persistAuthentication(secret, duration)
     }
 
     public func reloadSecrets() async {

Sources/Packages/Sources/SecretKit/Types/AuthenticationContext.swift

@@ -1,46 +0,0 @@
-import Foundation
-import LocalAuthentication
-
-/// Protocol describing an authentication context. This is an authorization that can be reused for multiple access to a secret that requires authentication for a specific period of time.
-public protocol AuthenticationContextProtocol: Sendable, Identifiable {
-    var secret: AnySecret { get }
-    func valid(for request: SignatureRequest) -> Bool
-    var laContext: LAContext? { get }
-    func evaluate(requireBiometrics: Bool) async throws -> Bool
-    func cancel() async
-}
-
-public struct SignatureRequest: Identifiable, Hashable, Sendable, Comparable {
-
-    public let id: UUID
-    public let date: Date
-    public let secret: AnySecret
-    public let provenance: SigningRequestProvenance
-    public let target: SigningRequestTarget?
-
-    public init(secret: AnySecret, provenance: SigningRequestProvenance, target: SigningRequestTarget?) {
-        self.id = UUID()
-        self.date = Date()
-        self.secret = secret
-        self.provenance = provenance
-        self.target = target
-    }
-
-    public var batchID: Int {
-        var hasher = Hasher()
-        guard let target else {
-            // Requests without target are not permitted to be batched.
-            id.hash(into: &hasher)
-            return hasher.finalize()
-        }
-        provenance.batchID.hash(into: &hasher)
-        target.batchID.hash(into: &hasher)
-        secret.id.hash(into: &hasher)
-        return hasher.finalize()
-    }
-
-    public static func < (lhs: SignatureRequest, rhs: SignatureRequest) -> Bool {
-        lhs.date < rhs.date
-    }
-
-}

Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift

@@ -0,0 +1,9 @@
+import Foundation
+
+/// Protocol describing a persisted authentication context. This is an authorization that can be reused for multiple access to a secret that requires authentication for a specific period of time.
+public protocol PersistedAuthenticationContext: Sendable {
+    /// Whether the context remains valid.
+    var valid: Bool { get }
+    /// The date at which the authorization expires and the context becomes invalid.
+    var expiration: Date { get }
+}

Sources/Packages/Sources/SecretKit/Types/SecretStore.swift

@@ -1,5 +1,4 @@
 import Foundation
-import LocalAuthentication
 
 /// Manages access to Secrets, and performs signature operations on data using those Secrets.
 public protocol SecretStore<SecretType>: Identifiable, Sendable {
@@ -21,7 +20,20 @@ public protocol SecretStore<SecretType>: Identifiable, Sendable {
     ///   - secret: The ``Secret`` to sign with.
     ///   - provenance: A ``SigningRequestProvenance`` describing where the request came from.
     /// - Returns: The signed data.
-    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance, target: SigningRequestTarget?, context: LAContext?) async throws -> Data
+    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) async throws -> Data
+
+    /// Checks to see if there is currently a valid persisted authentication for a given secret.
+    /// - Parameters:
+    ///   - secret: The ``Secret`` to check if there is a persisted authentication for.
+    /// - Returns: A persisted authentication context, if a valid one exists.
+    func existingPersistedAuthenticationContext(secret: SecretType) async -> PersistedAuthenticationContext?
+
+    /// Persists user authorization for access to a secret.
+    /// - Parameters:
+    ///   - secret: The ``Secret`` to persist the authorization for.
+    ///   - duration: The duration that the authorization should persist for.
+    ///  - Note: This is used for temporarily unlocking access to a secret which would otherwise require authentication every single use. This is useful for situations where the user anticipates several rapid accesses to a authorization-guarded secret.
+    func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) async throws
 
     /// Requests that the store reload secrets from any backing store, if neccessary.
     func reloadSecrets() async

Sources/Packages/Sources/SecretKit/Types/SigningRequestProvenance.swift

@@ -2,23 +2,13 @@ import Foundation
 import AppKit
 
 /// Describes the chain of applications that requested a signature operation.
-public struct SigningRequestProvenance: Hashable, Sendable {
+public struct SigningRequestProvenance: Equatable, Sendable {
 
     /// A list of processes involved in the request.
     /// - Note: A chain will typically consist of many elements even for a simple request. For example, running `git fetch` in Terminal.app would generate a request chain of `ssh` -> `git` -> `zsh` -> `login` -> `Terminal.app`
     public var chain: [Process]
-
+    public init(root: Process) {
-    public var date: Date
-
-    public init(root: Process, date: Date = .now) {
         self.chain = [root]
-        self.date = date
-    }
-
-    public var batchID: Int {
-        var hasher = Hasher()
-        chain.map(\.path).hash(into: &hasher)
-        return hasher.finalize()
     }
 
 }
@@ -40,7 +30,7 @@ extension SigningRequestProvenance {
 extension SigningRequestProvenance {
 
     /// Describes a process in a `SigningRequestProvenance` chain.
-    public struct Process: Hashable, Sendable {
+    public struct Process: Equatable, Sendable {
 
         /// The pid of the process.
         public let pid: Int32

Sources/Packages/Sources/SecretKit/Types/SigningRequestTarget.swift

@@ -1,60 +0,0 @@
-import Foundation
-import AppKit
-
-/// Describes the target of the signature operation.
-public enum SigningRequestTarget: Sendable, Hashable {
-
-    case connection(ConnectionPayload)
-    case signature(SignaturePayload)
-
-    public var batchID: Int {
-        hashValue
-    }
-
-
-    public struct ConnectionPayload: Sendable, Codable, Hashable {
-
-        public let username: String
-        public let hasSignature: Bool
-        public let publicKeyAlgorithm: String
-        public let publicKey: Data
-        public let hostKey: Data
-        public let host: String?
-
-        public init(
-            username: String,
-            hasSignature: Bool,
-            publicKeyAlgorithm: String,
-            publicKey: Data,
-            hostKey: Data,
-            host: String?
-        ) {
-            self.username = username
-            self.hasSignature = hasSignature
-            self.publicKeyAlgorithm = publicKeyAlgorithm
-            self.publicKey = publicKey
-            self.hostKey = hostKey
-            self.host = host
-        }
-
-    }
-
-    public struct SignaturePayload: Sendable, Codable, Hashable {
-
-        public let namespace: String
-        public let hashAlgorithm: String
-        public let hash: Data
-
-        public init(
-            namespace: String,
-            hashAlgorithm: String,
-            hash: Data,
-        ) {
-            self.namespace = namespace
-            self.hashAlgorithm = hashAlgorithm
-            self.hash = hash
-        }
-
-    }
-
-}

Sources/Packages/Sources/SecureEnclaveSecretKit/CryptoKitMigrator.swift

@@ -3,7 +3,7 @@ import Security
 import CryptoTokenKit
 import CryptoKit
 import SecretKit
-import OSLog
+import os
 
 extension SecureEnclave {
 

Sources/Packages/Sources/SecureEnclaveSecretKit/PersistentAuthenticationHandler.swift

@@ -0,0 +1,70 @@
+import LocalAuthentication
+import SecretKit
+
+extension SecureEnclave {
+
+    /// A context describing a persisted authentication.
+    final class PersistentAuthenticationContext: PersistedAuthenticationContext {
+
+        /// The Secret to persist authentication for.
+        let secret: Secret
+        /// The LAContext used to authorize the persistent context.
+        nonisolated(unsafe) let context: LAContext
+        /// An expiration date for the context.
+        /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
+        let monotonicExpiration: UInt64
+
+        /// Initializes a context.
+        /// - Parameters:
+        ///   - secret: The Secret to persist authentication for.
+        ///   - context: The LAContext used to authorize the persistent context.
+        ///   - duration: The duration of the authorization context, in seconds.
+        init(secret: Secret, context: LAContext, duration: TimeInterval) {
+            self.secret = secret
+            unsafe self.context = context
+            let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
+            self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
+        }
+
+        /// A boolean describing whether or not the context is still valid.
+        var valid: Bool {
+            clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
+        }
+
+        var expiration: Date {
+            let remainingNanoseconds = monotonicExpiration - clock_gettime_nsec_np(CLOCK_MONOTONIC)
+            let remainingInSeconds = Measurement(value: Double(remainingNanoseconds), unit: UnitDuration.nanoseconds).converted(to: .seconds).value
+            return Date(timeIntervalSinceNow: remainingInSeconds)
+        }
+    }
+
+    actor PersistentAuthenticationHandler: Sendable {
+
+        private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:]
+
+        func existingPersistedAuthenticationContext(secret: Secret) -> PersistentAuthenticationContext? {
+            guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
+            return persisted
+        }
+
+        func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) async throws {
+            let newContext = LAContext()
+            newContext.touchIDAuthenticationAllowableReuseDuration = duration
+            newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
+
+            let formatter = DateComponentsFormatter()
+            formatter.unitsStyle = .spellOut
+            formatter.allowedUnits = [.hour, .minute, .day]
+
+            
+            let durationString = formatter.string(from: duration)!
+            newContext.localizedReason = String(localized: .authContextPersistForDuration(secretName: secret.name, duration: durationString))
+            let success = try await newContext.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: newContext.localizedReason)
+            guard success else { return }
+            let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
+            persistedAuthenticationContexts[secret] = context
+        }
+
+    }
+
+}

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift

@@ -4,7 +4,7 @@ import Security
 import CryptoKit
 import LocalAuthentication
 import SecretKit
-import OSLog
+import os
 
 extension SecureEnclave {
 
@@ -17,6 +17,7 @@ extension SecureEnclave {
         }
         public let id = UUID()
         public let name = String(localized: .secureEnclave)
+        private let persistentAuthenticationHandler = PersistentAuthenticationHandler()
 
         /// Initializes a Store.
         @MainActor public init() {
@@ -36,7 +37,17 @@ extension SecureEnclave {
         
         // MARK: SecretStore
         
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?, context: LAContext?) async throws -> Data {
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
+            var context: LAContext
+            if let existing = await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret) {
+                context = unsafe existing.context
+            } else {
+                let newContext = LAContext()
+                newContext.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
+                newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
+                context = newContext
+            }
+
             let queryAttributes = KeychainDictionary([
                 kSecClass: Constants.keyClass,
                 kSecAttrService: Constants.keyTag,
@@ -77,6 +88,14 @@ extension SecureEnclave {
 
         }
 
+        public func existingPersistedAuthenticationContext(secret: Secret) async -> PersistedAuthenticationContext? {
+            await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret)
+        }
+
+        public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) async throws {
+            try await persistentAuthenticationHandler.persistAuthentication(secret: secret, forDuration: duration)
+        }
+
         @MainActor public func reloadSecrets() {
             let before = secrets
             secrets.removeAll()
@@ -157,7 +176,6 @@ extension SecureEnclave {
             let attributes = try JSONEncoder().encode(attributes)
             let updatedAttributes = KeychainDictionary([
                 kSecAttrLabel: name,
-                kSecAttrService: Constants.keyTag,
                 kSecAttrGeneric: attributes,
             ])
 
@@ -269,7 +287,7 @@ extension SecureEnclave.Store {
 
     enum Constants {
         static let keyClass = kSecClassGenericPassword as String
-        static let keyTag = "com.maxgoedjen.secretive.secureenclave.key"
+        static let keyTag = Data("com.maxgoedjen.secretive.secureenclave.key".utf8)
         static let notificationToken = UUID().uuidString
     }
     

Sources/Packages/Sources/SettingsKit/SettingKeys.swift

@@ -1,14 +0,0 @@
-import Foundation
-
-struct RequireDestinationInformationSettingsKey: SettingsStore.SettingsKey {
-    static let defaultValue: Bool = true
-}
-
-extension SettingsStore {
-
-    public var requireDestinationInformation: Bool {
-        get { self[RequireDestinationInformationSettingsKey.self] }
-        set { self[RequireDestinationInformationSettingsKey.self] = newValue }
-    }
-
-}

Sources/Packages/Sources/SettingsKit/SettingsStore.swift

@@ -1,114 +0,0 @@
-import Foundation
-import Observation
-import Security
-import OSLog
-
-// Setting store backed by macOS keychain for stronger guarantees around ownership/other-process-modification than UserDefaults offers.
-@Observable @MainActor public final class SettingsStore: Sendable {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.settings", category: "SettingsStore")
-
-    public init() {
-    }
-
-    private var state: [ObjectIdentifier: UUID] = [:]
-
-    subscript<SettingsKeyType: SettingsKey>(_ key: SettingsKeyType.Type) -> SettingsKeyType.Value {
-        get {
-            _ = state[ObjectIdentifier(key)]
-            let queryAttributes = KeychainDictionary([
-                kSecClass: Constants.keyClass,
-                kSecAttrService: Constants.keyTag,
-                kSecAttrAccount: String(describing: SettingsKeyType.self),
-                kSecUseDataProtectionKeychain: true,
-                kSecReturnData: true,
-                kSecReturnAttributes: true,
-                kSecMatchLimit: kSecMatchLimitOne,
-                ])
-            var untyped: CFTypeRef?
-            unsafe SecItemCopyMatching(queryAttributes, &untyped)
-            guard let typed = untyped as? [CFString: Any] else { return SettingsKeyType.defaultValue }
-            let decoder = JSONDecoder()
-            guard let data = typed[kSecValueData] as? Data else { return SettingsKeyType.defaultValue }
-            return (try? decoder.decode(SettingValue<SettingsKeyType.Value>.self, from: data).value) ?? SettingsKeyType.defaultValue
-        }
-        set {
-            do {
-                let data = try JSONEncoder().encode(SettingValue(value: newValue))
-                let keychainAttributes = KeychainDictionary([
-                    kSecClass: Constants.keyClass,
-                    kSecAttrService: Constants.keyTag,
-                    kSecAttrAccount: String(describing: SettingsKeyType.self),
-                    kSecUseDataProtectionKeychain: true,
-                    kSecAttrAccessible: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-                    kSecValueData: data,
-                ])
-                let status = SecItemAdd(keychainAttributes, nil)
-                switch status {
-                case errSecSuccess:
-                    break
-                case errSecDuplicateItem:
-                    let updateQuery = KeychainDictionary([
-                        kSecClass: Constants.keyClass,
-                        kSecAttrService: Constants.keyTag,
-                        kSecAttrAccount: String(describing: SettingsKeyType.self),
-                    ])
-                    let updatedAttributes = KeychainDictionary([
-                        kSecValueData: data,
-                    ])
-                    let status = SecItemUpdate(updateQuery, updatedAttributes)
-                    if status != errSecSuccess {
-                        throw KeychainError(statusCode: status)
-                    }
-                default:
-                    throw KeychainError(statusCode: status)
-                }
-                state[ObjectIdentifier(key)] = UUID()
-            } catch {
-                logger.error("Error updating key: \(String(describing: SettingsKeyType.self), privacy: .public): \(error.localizedDescription.debugDescription, privacy: .public)")
-            }
-        }
-    }
-
-
-}
-
-extension SettingsStore {
-
-    public protocol SettingsKey<Value>: Equatable, Codable, Sendable {
-        associatedtype Value: Codable
-        static var defaultValue: Value { get }
-    }
-
-}
-
-extension SettingsStore {
-
-    struct SettingValue<Value: Codable>: Codable {
-        let value: Value
-    }
-
-}
-
-
-extension SettingsStore {
-
-    fileprivate struct KeychainError: Error {
-        let statusCode: OSStatus?
-    }
-
-}
-
-fileprivate func KeychainDictionary(_ dictionary: [CFString: Any]) -> CFDictionary {
-    dictionary as CFDictionary
-}
-
-
-extension SettingsStore {
-
-    enum Constants {
-        static let keyClass = kSecClassGenericPassword as String
-        static let keyTag = "com.maxgoedjen.settingsStore"
-    }
-
-}

Sources/Packages/Sources/SharedXPCServices/CertificateMigrator.swift

@@ -1,53 +0,0 @@
-import Foundation
-import Security
-import CryptoTokenKit
-import CryptoKit
-import OSLog
-import SSHProtocolKit
-import CertificateKit
-
-public struct CertificateMigrator {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.migration", category: "CertificateKitMigrator")
-    private let publicKeysDirectory: URL
-    private let certificatesDirectory: URL
-    private let certificateStore: CertificateStore
-
-    /// Initializes a PublicKeyFileStoreController.
-    public init(homeDirectory: URL, certificateStore: CertificateStore) {
-        publicKeysDirectory = homeDirectory.appending(component: "PublicKeys")
-        certificatesDirectory = homeDirectory.appending(component: "Certificates")
-        self.certificateStore = certificateStore
-    }
-
-    @MainActor public func migrate() throws {
-        try migrate(directory: publicKeysDirectory)
-        try migrate(directory: certificatesDirectory)
-    }
-
-    @MainActor public func migrate(directory: URL) throws {
-        let fileCerts = try FileManager.default
-            .contentsOfDirectory(atPath: directory.path())
-            .filter { $0.hasSuffix("-cert.pub") }
-        Task {
-            for path in fileCerts {
-                do {
-                    let url = directory.appending(component: path)
-                    let data = try Data(contentsOf: url)
-                    let parser = try await XPCCertificateParser()
-                    let cert = try await parser.parse(data: data)
-                    try certificateStore.save(certificate: Certificate(openSSHCertificate: cert, rawData: data))
-                    do {
-                        try FileManager.default.removeItem(at: url)
-                    } catch {
-                        logger.error("Failed to delete successfully migrated cert: \(path)")
-                    }
-                } catch {
-                    logger.error("Failed to migrate cert: \(path)")
-                }
-            }
-
-        }
-    }
-
-}

Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift

@@ -56,19 +56,19 @@ extension SmartCard {
 
         // MARK: Public API
 
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?, context: LAContext?) async throws -> Data {
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
             guard let tokenID = await state.tokenID else { fatalError() }
-            var rawAttributes: [CFString: Any] = [
+            let context = LAContext()
+            context.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
+            context.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
+            let attributes = KeychainDictionary([
                 kSecClass: kSecClassKey,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate,
                 kSecAttrApplicationLabel: secret.id as CFData,
                 kSecAttrTokenID: tokenID,
+                kSecUseAuthenticationContext: context,
                 kSecReturnRef: true
-            ]
+            ])
-            if let context {
-                rawAttributes[kSecUseAuthenticationContext] = context
-            }
-            let attributes = KeychainDictionary(rawAttributes)
             var untyped: CFTypeRef?
             let status = unsafe SecItemCopyMatching(attributes, &untyped)
             if status != errSecSuccess {
@@ -86,6 +86,13 @@ extension SmartCard {
             return signature as Data
         }
         
+        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
+            nil
+        }
+
+        public func persistAuthentication(secret: Secret, forDuration: TimeInterval) throws {
+        }
+
         /// Reloads all secrets from the store.
         @MainActor public func reloadSecrets() {
             reloadSecretsInternal()
@@ -156,7 +163,7 @@ extension SmartCard.Store {
             let publicKeySecRef = SecKeyCopyPublicKey(publicKeyRef)!
             let publicKeyAttributes = SecKeyCopyAttributes(publicKeySecRef) as! [CFString: Any]
             let publicKey = publicKeyAttributes[kSecValueData] as! Data
-            let attributes = Attributes(keyType: KeyType(secAttr: algorithmSecAttr, size: keySize)!, authentication: .presenceRequired)
+            let attributes = Attributes(keyType: KeyType(secAttr: algorithmSecAttr, size: keySize)!, authentication: .unknown)
             let secret = SmartCard.Secret(id: tokenID, name: name, publicKey: publicKey, attributes: attributes)
             guard signatureAlgorithm(for: secret) != nil else { return nil }
             return secret

Sources/Packages/Sources/XPCWrappers/XPCServiceDelegate.swift

@@ -12,9 +12,7 @@ public final class XPCServiceDelegate: NSObject, NSXPCListenerDelegate {
         newConnection.exportedInterface = NSXPCInterface(with: (any _XPCProtocol).self)
         let exportedObject = exportedObject
         newConnection.exportedObject = exportedObject
-#if !DEBUG
+        newConnection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = Z72PRUAWF6")
-        newConnection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = \"Z72PRUAWF6\"")
-#endif
         newConnection.resume()
         return true
     }

Sources/Packages/Sources/XPCWrappers/XPCTypedSession.swift

@@ -8,9 +8,7 @@ public struct XPCTypedSession<ResponseType: Codable & Sendable, ErrorType: Error
     public init(serviceName: String, warmup: Bool = false) async throws {
         let connection = NSXPCConnection(serviceName: serviceName)
         connection.remoteObjectInterface = NSXPCInterface(with: (any _XPCProtocol).self)
-        #if !DEBUG
+        connection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = Z72PRUAWF6")
-        connection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = \"Z72PRUAWF6\"")
-        #endif
         connection.resume()
         guard let proxy = connection.remoteObjectProxy as? _XPCProtocol else { fatalError() }
         self.connection = connection

Sources/Packages/Tests/SSHProtocolKitTests/OpenSSHPublicKeyWriterTests.swift

@@ -1,7 +1,8 @@
 import Foundation
 import Testing
 @testable import SecretKit
-import SSHProtocolKit
+@testable import SecureEnclaveSecretKit
+@testable import SmartCardSecretKit
 
 @Suite struct OpenSSHPublicKeyWriterTests {
 
@@ -46,8 +47,8 @@ import SSHProtocolKit
 extension OpenSSHPublicKeyWriterTests {
 
     enum Constants {
-        static let ecdsa256Secret =  TestSecret(id: Data(), name: "Test Key (ECDSA 256)", publicKey: Data(base64Encoded: "BOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 256), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
+        static let ecdsa256Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 256)", publicKey: Data(base64Encoded: "BOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 256), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
-        static let ecdsa384Secret = TestSecret(id: Data(), name: "Test Key (ECDSA 384)", publicKey: Data(base64Encoded: "BG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 384), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
+        static let ecdsa384Secret = SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 384)", publicKey: Data(base64Encoded: "BG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 384), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
 
     }
 

Sources/Packages/Tests/SSHProtocolKitTests/OpenSSHSignatureWriterTests.swift

@@ -1,83 +0,0 @@
-import Foundation
-import Testing
-import SSHProtocolKit
-@testable import SecretKit
-
-@Suite struct OpenSSHSignatureWriterTests {
-
-    private let writer = OpenSSHSignatureWriter()
-
-    @Test func ecdsaMpintStripsUnnecessaryLeadingZeros() throws {
-        let secret = Constants.ecdsa256Secret
-
-        // r has a leading 0x00 followed by 0x01 (< 0x80): the mpint must not keep the leading zero.
-        let rBytes: [UInt8] = [0x00] + (1...31).map { UInt8($0) }
-        let r = Data(rBytes)
-        // s has two leading 0x00 bytes followed by 0x7f (< 0x80): the mpint must not keep the leading zeros.
-        let sBytes: [UInt8] = [0x00, 0x00, 0x7f] + Array(repeating: UInt8(0x01), count: 29)
-        let s = Data(sBytes)
-        let rawRepresentation = r + s
-
-        let response = writer.data(secret: secret, signature: rawRepresentation)
-        let (parsedR, parsedS) = try parseEcdsaSignatureMpints(from: response)
-
-        #expect(parsedR == Data((1...31).map { UInt8($0) }))
-        #expect(parsedS == Data([0x7f] + Array(repeating: UInt8(0x01), count: 29)))
-    }
-
-    @Test func ecdsaMpintPrefixesZeroWhenHighBitSet() throws {
-        let secret = Constants.ecdsa256Secret
-
-        // r starts with 0x80 (high bit set): mpint must be prefixed with 0x00.
-        let r = Data([UInt8(0x80)] + Array(repeating: UInt8(0x01), count: 31))
-        let s = Data([UInt8(0x01)] + Array(repeating: UInt8(0x02), count: 31))
-        let rawRepresentation = r + s
-
-        let response = writer.data(secret: secret, signature: rawRepresentation)
-        let (parsedR, parsedS) = try parseEcdsaSignatureMpints(from: response)
-
-        #expect(parsedR == Data([0x00, 0x80] + Array(repeating: UInt8(0x01), count: 31)))
-        #expect(parsedS == Data([0x01] + Array(repeating: UInt8(0x02), count: 31)))
-    }
-
-}
-
-private extension OpenSSHSignatureWriterTests {
-
-    enum Constants {
-        static let ecdsa256Secret = TestSecret(
-            id: Data(),
-            name: "Test Key (ECDSA 256)",
-            publicKey: Data(repeating: 0x01, count: 65),
-            attributes: Attributes(
-                keyType: KeyType(algorithm: .ecdsa, size: 256),
-                authentication: .notRequired,
-                publicKeyAttribution: "test@example.com"
-            )
-        )
-    }
-
-    enum ParseError: Error {
-        case eof
-        case invalidAlgorithm
-    }
-
-    func parseEcdsaSignatureMpints(from openSSHSignedData: Data) throws -> (r: Data, s: Data) {
-        let reader = OpenSSHReader(data: openSSHSignedData)
-
-        // Prefix
-        _ = try reader.readNextBytes(as: UInt32.self)
-
-        let algorithm = try reader.readNextChunkAsString()
-        guard algorithm == "ecdsa-sha2-nistp256" else {
-            throw ParseError.invalidAlgorithm
-        }
-
-        let sigReader = try reader.readNextChunkAsSubReader()
-        let r = try sigReader.readNextChunk()
-        let s = try sigReader.readNextChunk()
-        return (r, s)
-    }
-
-}
-

Sources/Packages/Tests/SSHProtocolKitTests/TestSecret.swift

@@ -1,11 +0,0 @@
-import Foundation
-import SecretKit
-
-public struct TestSecret: SecretKit.Secret {
-    
-    public let id: Data
-    public let name: String
-    public let publicKey: Data
-    public var attributes: Attributes
-    
-}

Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift

@@ -1,27 +1,25 @@
 import Foundation
 import Testing
 import CryptoKit
-import CertificateKit
-@testable import SSHProtocolKit
 @testable import SecretKit
 @testable import SecretAgentKit
 
-@Suite @MainActor struct AgentTests {
+@Suite struct AgentTests {
 
     // MARK: Identity Listing
 
     @Test func emptyStores() async throws {
-        let agent = Agent(storeList: SecretStoreList(), certificateStore: CertificateStore(), authenticationHandler: AuthenticationHandler())
+        let agent = Agent(storeList: SecretStoreList())
         let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestIdentities)
-        let response = await agent.handle(request: request, provenance: .test, hosts: nil)
+        let response = await agent.handle(request: request, provenance: .test)
         #expect(response == Constants.Responses.requestIdentitiesEmpty)
     }
 
     @Test func identitiesList() async throws {
         let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let agent = Agent(storeList: list, certificateStore: CertificateStore(), authenticationHandler: AuthenticationHandler())
+        let agent = Agent(storeList: list)
         let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestIdentities)
-        let response = await agent.handle(request: request, provenance: .test, hosts: nil)
+        let response = await agent.handle(request: request, provenance: .test)
 
         let actual = OpenSSHReader(data: response)
         let expected = OpenSSHReader(data: Constants.Responses.requestIdentitiesMultiple)
@@ -33,9 +31,9 @@ import CertificateKit
 
     @Test func noMatchingIdentities() async throws {
         let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let agent = Agent(storeList: list, certificateStore: CertificateStore(), authenticationHandler: AuthenticationHandler())
+        let agent = Agent(storeList: list)
         let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignatureWithNoneMatching)
-        let response = await agent.handle(request: request, provenance: .test, hosts: nil)
+        let response = await agent.handle(request: request, provenance: .test)
         #expect(response == Constants.Responses.requestFailure)
     }
 
@@ -43,11 +41,11 @@ import CertificateKit
         let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
         guard case SSHAgent.Request.signRequest(let context) = request else { return }
         let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let agent = Agent(storeList: list, certificateStore: CertificateStore(), authenticationHandler: AuthenticationHandler())
+        let agent = Agent(storeList: list)
-        let response = await agent.handle(request: request, provenance: .test, hosts: nil)
+        let response = await agent.handle(request: request, provenance: .test)
         let responseReader = OpenSSHReader(data: response)
-        let length = try responseReader.readNextBytes(as: UInt32.self)
+        let length = try responseReader.readNextBytes(as: UInt32.self).bigEndian
-        let type = try responseReader.readNextBytes(as: UInt8.self)
+        let type = try responseReader.readNextBytes(as: UInt8.self).bigEndian
         #expect(length == response.count - MemoryLayout<UInt32>.size)
         #expect(type == SSHAgent.Response.agentSignResponse.rawValue)
         let outer = OpenSSHReader(data: responseReader.remaining)
@@ -68,7 +66,7 @@ import CertificateKit
         let signature = try P256.Signing.ECDSASignature(rawRepresentation: rs)
         // Correct signature
         #expect(try P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey)
-            .isValidSignature(signature, for: context.dataToSign.raw))
+            .isValidSignature(signature, for: context.dataToSign))
     }
 
     // MARK: Witness protocol
@@ -78,8 +76,8 @@ import CertificateKit
         let witness = StubWitness(speakNow: { _,_  in
             return true
         }, witness: { _, _ in })
-        let agent = Agent(storeList: list, certificateStore: CertificateStore(), authenticationHandler: AuthenticationHandler(), witness: witness)
+        let agent = Agent(storeList: list, witness: witness)
-        let response = await agent.handle(request: .signRequest(.empty), provenance: .test, hosts: nil)
+        let response = await agent.handle(request: .signRequest(.empty), provenance: .test)
         #expect(response == Constants.Responses.requestFailure)
     }
 
@@ -91,9 +89,9 @@ import CertificateKit
         }, witness: { _, trace in
             witnessed = true
         })
-        let agent = Agent(storeList: list, certificateStore: CertificateStore(), authenticationHandler: AuthenticationHandler(), witness: witness)
+        let agent = Agent(storeList: list, witness: witness)
         let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        _ = await agent.handle(request: request, provenance: .test, hosts: nil)
+        _ = await agent.handle(request: request, provenance: .test)
         #expect(witnessed)
     }
 
@@ -107,9 +105,9 @@ import CertificateKit
         }, witness: { _, trace in
             witnessTrace = trace
         })
-        let agent = Agent(storeList: list, certificateStore: CertificateStore(), authenticationHandler: AuthenticationHandler(), witness: witness)
+        let agent = Agent(storeList: list, witness: witness)
         let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        _ = await agent.handle(request: request, provenance: .test, hosts: nil)
+        _ = await agent.handle(request: request, provenance: .test)
         #expect(witnessTrace == speakNowTrace)
         #expect(witnessTrace == .test)
     }
@@ -118,20 +116,59 @@ import CertificateKit
 
     @Test func signatureException() async throws {
         let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let store = list.stores.first?.base as! Stub.Store
+        let store = await list.stores.first?.base as! Stub.Store
         store.shouldThrow = true
-        let agent = Agent(storeList: list, certificateStore: CertificateStore(), authenticationHandler: AuthenticationHandler())
+        let agent = Agent(storeList: list)
         let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        let response = await agent.handle(request: request, provenance: .test, hosts: nil)
+        let response = await agent.handle(request: request, provenance: .test)
         #expect(response == Constants.Responses.requestFailure)
     }
 
     // MARK: Unsupported
 
     @Test func unhandledAdd() async throws {
-        let agent = Agent(storeList: SecretStoreList(), certificateStore: CertificateStore(), authenticationHandler: AuthenticationHandler())
+        let agent = Agent(storeList: SecretStoreList())
-        let response = await agent.handle(request: .addIdentity, provenance: .test, hosts: nil)
+        let response = await agent.handle(request: .addIdentity, provenance: .test)
         #expect(response == Constants.Responses.requestFailure)
     }
 
 }
+
+extension SigningRequestProvenance {
+
+    static let test = SigningRequestProvenance(root: .init(pid: 0, processName: "test", appName: nil, iconURL: nil, path: "/", validSignature: true, parentPID: 0))
+
+}
+
+extension AgentTests {
+
+    @MainActor func storeList(with secrets: [Stub.Secret]) async -> SecretStoreList {
+        let store = Stub.Store()
+        store.secrets.append(contentsOf: secrets)
+        let storeList = SecretStoreList()
+        storeList.add(store: store)
+        return storeList
+    }
+
+    enum Constants {
+
+        enum Requests {
+            static let requestIdentities = Data(base64Encoded: "AAAAAQs=")!
+            static let requestSignatureWithNoneMatching = Data(base64Encoded: "AAABhA0AAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQAAAO8AAAAgbqmrqPUtJ8mmrtaSVexjMYyXWNqjHSnoto7zgv86xvcyAAAAA2dpdAAAAA5zc2gtY29ubmVjdGlvbgAAAAlwdWJsaWNrZXkBAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQAAAAA=")!
+            static let requestSignature = Data(base64Encoded: "AAABRA0AAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKzOkUiVJEcACMtAd9X7xalbc0FYZyhbmv2dsWl4IP2GWIi+RcsaHQNw+nAIQ8CKEYmLnl0VLDp5Ef8KMhgIy08AAADPAAAAIBIFsbCZ4/dhBmLNGHm0GKj7EJ4N8k/jXRxlyg+LFIYzMgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAAA==")!
+        }
+
+        enum Responses {
+            static let requestIdentitiesEmpty = Data(base64Encoded: "AAAABQwAAAAA")!
+            static let requestIdentitiesMultiple = Data(base64Encoded: "AAABLwwAAAACAAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAFWVjZHNhLTI1NkBleGFtcGxlLmNvbQAAAIgAAAATZWNkc2Etc2hhMi1uaXN0cDM4NAAAAAhuaXN0cDM4NAAAAGEEspLMDmreMJverQkqKC9zF9ZUasn5uSWkbRlz1jNTCtuyH1KKm+VImL6wdAj47SbzwM6lEEC24AdfrR64P9i/bnS2i83v/4wQVtcZn+Et13QGgWlZst8lxCPzTookaVwMAAAAFWVjZHNhLTM4NEBleGFtcGxlLmNvbQ==")!
+            static let requestFailure = Data(base64Encoded: "AAAAAQU=")!
+        }
+
+        enum Secrets {
+            static let ecdsa256Secret =  Stub.Secret(keySize: 256, publicKey: Data(base64Encoded: "BKzOkUiVJEcACMtAd9X7xalbc0FYZyhbmv2dsWl4IP2GWIi+RcsaHQNw+nAIQ8CKEYmLnl0VLDp5Ef8KMhgIy08=")!, privateKey: Data(base64Encoded: "BKzOkUiVJEcACMtAd9X7xalbc0FYZyhbmv2dsWl4IP2GWIi+RcsaHQNw+nAIQ8CKEYmLnl0VLDp5Ef8KMhgIy09nw780wy/TSfUmzj15iJkV234AaCLNl+H8qFL6qK8VIg==")!)
+            static let ecdsa384Secret =  Stub.Secret(keySize: 384, publicKey: Data(base64Encoded: "BLKSzA5q3jCb3q0JKigvcxfWVGrJ+bklpG0Zc9YzUwrbsh9SipvlSJi+sHQI+O0m88DOpRBAtuAHX60euD/Yv250tovN7/+MEFbXGZ/hLdd0BoFpWbLfJcQj806KJGlcDA==")!, privateKey: Data(base64Encoded: "BLKSzA5q3jCb3q0JKigvcxfWVGrJ+bklpG0Zc9YzUwrbsh9SipvlSJi+sHQI+O0m88DOpRBAtuAHX60euD/Yv250tovN7/+MEFbXGZ/hLdd0BoFpWbLfJcQj806KJGlcDHNapAOzrt9E+9QC4/KYoXS7Uw4pmdAz53uIj02tttiq3c0ZyIQ7XoscWWRqRrz8Kw==")!)
+        }
+
+    }
+
+}

Sources/Packages/Tests/SecretAgentKitTests/AuthenticationHandlerTests.swift

@@ -1,169 +0,0 @@
-import Testing
-import Foundation
-import LocalAuthentication
-import SecretKit
-import SecretAgentKit
-import SSHProtocolKit
-
-public struct TestSecret: Secret {
-
-    public let id = UUID()
-    public let name = "Test"
-    public let publicKey = Data()
-    public var attributes: Attributes
-
-}
-
-@MainActor final class TestContext: @preconcurrency AuthenticationContextProtocol, Sendable {
-
-    let id = UUID()
-    private var testEvaluationResult: Bool
-
-    private(set) var canceled: Bool
-    private(set) var evaluationResult: Bool? = nil
-
-    let approval: ApprovalMode
-    let secret: AnySecret
-    let laContext: LAContext? = nil
-
-    enum ApprovalMode {
-        case manual
-        case duration(Duration)
-    }
-
-    init(authenticationRequirement: AuthenticationRequirement, testEvaluationResult: Bool, approval: ApprovalMode = .manual) {
-        self.canceled = false
-        self.testEvaluationResult = testEvaluationResult
-        self.secret = AnySecret(TestSecret(attributes: .init(keyType: .ecdsa256, authentication: authenticationRequirement)))
-        self.approval = approval
-    }
-
-    nonisolated func valid(for request: SecretKit.SignatureRequest) -> Bool {
-        true
-    }
-
-    func evaluate(requireBiometrics: Bool) async throws -> Bool {
-        if case let .duration(duration) = approval {
-            try await Task.sleep(for: duration)
-        } else {
-            while true {
-                try await Task.sleep(for: .milliseconds(10))
-                guard !canceled else { return false }
-            }
-        }
-        guard !canceled else { return false }
-        evaluationResult = testEvaluationResult
-        return testEvaluationResult
-    }
-    
-    func cancel() async {
-        assert(!canceled)
-        assert(evaluationResult == nil)
-        canceled = true
-    }
-
-
-}
-
-@MainActor @Suite struct AuthenticationHandlerTests {
-
-    let handler = AuthenticationHandler()
-
-    @Test func singleImmediatelyRequests() async throws {
-        var calledPresentPending = false
-        handler.setPendingRequestHandler {
-            calledPresentPending = true
-        }
-        let context = TestContext(authenticationRequirement: .presenceRequired, testEvaluationResult: true, approval: .duration(.zero))
-        _ = try await handler.authenticatedContext(for: .init(secret: .init(context.secret), provenance: .test, target: nil), context: context)
-        #expect(context.evaluationResult == true)
-        #expect(!calledPresentPending)
-    }
-
-    @Test func sequentialRequestsDoNotBlock() async throws {
-        var calledPresentPending = false
-        handler.setPendingRequestHandler {
-            calledPresentPending = true
-        }
-        let context = TestContext(authenticationRequirement: .presenceRequired, testEvaluationResult: true, approval: .duration(.milliseconds(1)))
-        _ = try await handler.authenticatedContext(for: .init(secret: .init(context.secret), provenance: .test, target: nil), context: context)
-        #expect(context.evaluationResult == true)
-        let second = TestContext(authenticationRequirement: .presenceRequired, testEvaluationResult: true, approval: .duration(.milliseconds(1)))
-        _ = try await handler.authenticatedContext(for: .init(secret: .init(second.secret), provenance: .test, target: nil), context: second)
-        #expect(context.evaluationResult == true)
-        #expect(second.evaluationResult == true)
-        #expect(!calledPresentPending)
-    }
-
-    @Test func secondRetractsAndPresentsBatch() async throws {
-        var calledPresentPending = false
-        handler.setPendingRequestHandler {
-            calledPresentPending = true
-        }
-        let contextA = TestContext(authenticationRequirement: .presenceRequired, testEvaluationResult: true)
-        let contextB = TestContext(authenticationRequirement: .presenceRequired, testEvaluationResult: true)
-        Task {
-            _ = try? await handler.authenticatedContext(for: .init(secret: .init(contextA.secret), provenance: .test, target: nil), context: contextA)
-        }
-        Task {
-            _ = try? await handler.authenticatedContext(for: .init(secret: .init(contextB.secret), provenance: .test, target: nil), context: contextB)
-        }
-        #expect(contextA.evaluationResult == nil)
-        #expect(contextB.evaluationResult == nil)
-        await Task.yield()
-        #expect(contextA.canceled)
-        #expect(calledPresentPending)
-    }
-
-    @Test func authRequiredDoesNotBlockNoAuthRequired() async throws {
-        var calledPresentPending = false
-        handler.setPendingRequestHandler {
-            calledPresentPending = true
-        }
-        let contextA = TestContext(authenticationRequirement: .presenceRequired, testEvaluationResult: true, approval: .manual)
-        let contextB = TestContext(authenticationRequirement: .notRequired, testEvaluationResult: true)
-        var unauthenticatedResult = false
-        Task {
-            Task {
-                _ = try? await handler.authenticatedContext(for: .init(secret: .init(contextB.secret), provenance: .test, target: nil), context: contextB)
-                unauthenticatedResult = true
-            }
-            _ = try? await handler.authenticatedContext(for: .init(secret: .init(contextA.secret), provenance: .test, target: nil), context: contextA)
-        }
-        try await Task.sleep(for: .milliseconds(10))
-        #expect(contextA.evaluationResult == nil)
-        #expect(unauthenticatedResult)
-        #expect(!contextA.canceled)
-        #expect(!contextB.canceled)
-        #expect(!calledPresentPending)
-    }
-
-    @Test func batchDoesNotBlockNoAuthRequired() async throws {
-        var calledPresentPending = false
-        handler.setPendingRequestHandler {
-            calledPresentPending = true
-        }
-        let contextA = TestContext(authenticationRequirement: .presenceRequired, testEvaluationResult: true)
-        let contextB = TestContext(authenticationRequirement: .presenceRequired, testEvaluationResult: true)
-        let contextC = TestContext(authenticationRequirement: .notRequired, testEvaluationResult: true)
-        Task {
-            _ = try? await handler.authenticatedContext(for: .init(secret: .init(contextA.secret), provenance: .test, target: nil), context: contextA)
-        }
-        Task {
-            _ = try? await handler.authenticatedContext(for: .init(secret: .init(contextB.secret), provenance: .test, target: nil), context: contextB)
-        }
-        #expect(contextA.evaluationResult == nil)
-        #expect(contextB.evaluationResult == nil)
-        await Task.yield()
-        #expect(contextA.canceled)
-        #expect(calledPresentPending)
-        _ = try? await handler.authenticatedContext(for: .init(secret: .init(contextC.secret), provenance: .test, target: nil), context: contextA)
-        #expect(contextA.evaluationResult == nil)
-        #expect(contextB.evaluationResult == nil)
-    }
-
-    @Test func batching() async throws {
-
-    }
-
-}

Sources/Packages/Tests/SecretAgentKitTests/Fixtures/TestData.swift

@@ -1,41 +0,0 @@
-import SecretKit
-import Foundation
-
-extension SigningRequestProvenance {
-
-    static let test = SigningRequestProvenance(root: .init(pid: 0, processName: "test", appName: nil, iconURL: nil, path: "/", validSignature: true, parentPID: 0))
-
-}
-
-extension AgentTests {
-
-    func storeList(with secrets: [Stub.Secret]) async -> SecretStoreList {
-        let store = Stub.Store()
-        store.secrets.append(contentsOf: secrets)
-        let storeList = SecretStoreList()
-        storeList.add(store: store)
-        return storeList
-    }
-
-    enum Constants {
-
-        enum Requests {
-            static let requestIdentities = Data(base64Encoded: "AAAAAQs=")!
-            static let requestSignatureWithNoneMatching = Data(base64Encoded: "AAABhA0AAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQAAAO8AAAAgbqmrqPUtJ8mmrtaSVexjMYyXWNqjHSnoto7zgv86xvcyAAAAA2dpdAAAAA5zc2gtY29ubmVjdGlvbgAAAAlwdWJsaWNrZXkBAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQAAAAA=")!
-            static let requestSignature = Data(base64Encoded: "AAABRA0AAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKzOkUiVJEcACMtAd9X7xalbc0FYZyhbmv2dsWl4IP2GWIi+RcsaHQNw+nAIQ8CKEYmLnl0VLDp5Ef8KMhgIy08AAADPAAAAIBIFsbCZ4/dhBmLNGHm0GKj7EJ4N8k/jXRxlyg+LFIYzMgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAAA==")!
-        }
-
-        enum Responses {
-            static let requestIdentitiesEmpty = Data(base64Encoded: "AAAABQwAAAAA")!
-            static let requestIdentitiesMultiple = Data(base64Encoded: "AAABLwwAAAACAAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAFWVjZHNhLTI1NkBleGFtcGxlLmNvbQAAAIgAAAATZWNkc2Etc2hhMi1uaXN0cDM4NAAAAAhuaXN0cDM4NAAAAGEEspLMDmreMJverQkqKC9zF9ZUasn5uSWkbRlz1jNTCtuyH1KKm+VImL6wdAj47SbzwM6lEEC24AdfrR64P9i/bnS2i83v/4wQVtcZn+Et13QGgWlZst8lxCPzTookaVwMAAAAFWVjZHNhLTM4NEBleGFtcGxlLmNvbQ==")!
-            static let requestFailure = Data(base64Encoded: "AAAAAQU=")!
-        }
-
-        enum Secrets {
-            static let ecdsa256Secret =  Stub.Secret(keySize: 256, publicKey: Data(base64Encoded: "BKzOkUiVJEcACMtAd9X7xalbc0FYZyhbmv2dsWl4IP2GWIi+RcsaHQNw+nAIQ8CKEYmLnl0VLDp5Ef8KMhgIy08=")!, privateKey: Data(base64Encoded: "BKzOkUiVJEcACMtAd9X7xalbc0FYZyhbmv2dsWl4IP2GWIi+RcsaHQNw+nAIQ8CKEYmLnl0VLDp5Ef8KMhgIy09nw780wy/TSfUmzj15iJkV234AaCLNl+H8qFL6qK8VIg==")!)
-            static let ecdsa384Secret =  Stub.Secret(keySize: 384, publicKey: Data(base64Encoded: "BLKSzA5q3jCb3q0JKigvcxfWVGrJ+bklpG0Zc9YzUwrbsh9SipvlSJi+sHQI+O0m88DOpRBAtuAHX60euD/Yv250tovN7/+MEFbXGZ/hLdd0BoFpWbLfJcQj806KJGlcDA==")!, privateKey: Data(base64Encoded: "BLKSzA5q3jCb3q0JKigvcxfWVGrJ+bklpG0Zc9YzUwrbsh9SipvlSJi+sHQI+O0m88DOpRBAtuAHX60euD/Yv250tovN7/+MEFbXGZ/hLdd0BoFpWbLfJcQj806KJGlcDHNapAOzrt9E+9QC4/KYoXS7Uw4pmdAz53uIj02tttiq3c0ZyIQ7XoscWWRqRrz8Kw==")!)
-        }
-
-    }
-
-}

Sources/Packages/Tests/SecretAgentKitTests/OpenSSHReaderTests.swift

@@ -1,6 +1,8 @@
 import Foundation
 import Testing
-import SSHProtocolKit
+@testable import SecretAgentKit
+@testable import SecureEnclaveSecretKit
+@testable import SmartCardSecretKit
 
 @Suite struct OpenSSHReaderTests {
 

Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift

@@ -1,8 +1,6 @@
 import Foundation
 import SecretKit
 import CryptoKit
-import SSHProtocolKit
-import LocalAuthentication
 
 struct Stub {}
 
@@ -50,7 +48,7 @@ extension Stub {
             print("Public Key OpenSSH: \(OpenSSHPublicKeyWriter().openSSHString(secret: secret))")
         }
 
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?, context: LAContext?) throws -> Data {
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
             guard !shouldThrow else {
                 throw NSError(domain: "test", code: 0, userInfo: nil)
             }
@@ -58,6 +56,13 @@ extension Stub {
             return try privateKey.signature(for: data).rawRepresentation
         }
 
+        public func existingPersistedAuthenticationContext(secret: Stub.Secret) -> PersistedAuthenticationContext? {
+            nil
+        }
+
+        public func persistAuthentication(secret: Stub.Secret, forDuration duration: TimeInterval) throws {
+        }
+
         public func reloadSecrets() {
         }
 

Sources/Packages/Tests/SecretAgentKitTests/StubWitness.swift

@@ -10,14 +10,14 @@ struct StubWitness {
 
 extension StubWitness: SigningWitness {
 
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, target: SigningRequestTarget?) throws {
+func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
         let objection = speakNow(secret, provenance)
         if objection {
             throw TheresMyChance()
         }
     }
 
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, target: SigningRequestTarget?, offerPersistence: Bool) async throws {
+func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
         witness(secret, provenance)
     }
 

Sources/SecretAgent/App.swift

@@ -1,119 +0,0 @@
-import Cocoa
-import OSLog
-import SecretKit
-import SecureEnclaveSecretKit
-import SmartCardSecretKit
-import SecretAgentKit
-import Brief
-import Observation
-import Common
-import SwiftUI
-import CertificateKit
-
-@main
-struct SecretAgent: App {
-
-    @MainActor private let storeList: SecretStoreList = {
-        let list = SecretStoreList()
-        let cryptoKit = SecureEnclave.Store()
-        let migrator = SecureEnclave.CryptoKitMigrator()
-        try? migrator.migrate(to: cryptoKit)
-        list.add(store: cryptoKit)
-        list.add(store: SmartCard.Store())
-        return list
-    }()
-    @MainActor private let certificateStore: CertificateStore = CertificateStore()
-
-    private let updater = Updater(checkOnLaunch: true)
-    private let notifier = Notifier()
-    private let authenticationHandler = AuthenticationHandler()
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(publicKeysURL: URL.publicKeyDirectory, certificatesURL: URL.certificatesDirectory)
-
-    @Environment(\.openWindow) var openWindow
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "App")
-    @SceneBuilder var body: some Scene {
-        MenuBarExtra(isInserted: .constant(false)) {
-            EmptyView()
-        } label: {
-            Image(systemName: "lock")
-                .task {
-                    await notifier.registerPersistenceHandler {
-                        try await authenticationHandler.persistAuthentication(secret: $0, forDuration: $1)
-                    }
-                }
-                .task {
-                    let socketController = SocketController(path: URL.socketPath)
-                    let agent = Agent(
-                        storeList: storeList,
-                        certificateStore: certificateStore,
-                        authenticationHandler: authenticationHandler,
-                        witness: notifier
-                    )
-                    for await session in socketController.sessions {
-                        Task {
-                            do {
-                                let inputParser = try await XPCAgentInputParser()
-                                let hosts = try? await XPCHostsfileReader().read()
-                                for await message in session.messages {
-                                    let request = try await inputParser.parse(data: message)
-                                    let agentResponse = await agent.handle(request: request, provenance: session.provenance, hosts: hosts)
-                                    try session.write(agentResponse)
-                                }
-                            } catch {
-                                try? session.close()
-                            }
-                        }
-                    }
-                }
-                .task {
-                    try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
-                    for await _ in NotificationCenter.default.notifications(named: .secretStoreReloaded) {
-                        try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
-                    }
-                }
-                .task {
-                    let certsMigrator = CertificateMigrator(homeDirectory: URL.homeDirectory, certificateStore: certificateStore)
-                    try? certsMigrator.migrate()
-                    try? publicKeyFileStoreController.generateCertificates(for: certificateStore.certificates, clear: true)
-                    for await _ in NotificationCenter.default.notifications(named: .certificateStoreReloaded) {
-                        try? publicKeyFileStoreController.generateCertificates(for: certificateStore.certificates, clear: true)
-                    }
-                }
-                .task {
-                    authenticationHandler.setPendingRequestHandler { @MainActor in
-                        openWindow(value: PendingRequestsViewIdentifier())
-                    }
-
-                }
-                .task {
-                    notifier.prompt()
-                    _ = withObservationTracking {
-                        updater.update
-                    } onChange: { [updater, notifier] in
-                        Task {
-                            guard !updater.currentVersion.isTestBuild else { return }
-                            await notifier.notify(update: updater.update!) { release in
-                                await updater.ignore(release: release)
-                            }
-                        }
-                    }
-                }
-        }
-        WindowGroup(for: PendingRequestsViewIdentifier.self) { _ in
-            pendingView
-        }
-        .windowStyle(.hiddenTitleBar)
-        .windowResizability(.contentSize)
-    }
-
-    @ViewBuilder
-    var pendingView: some View {
-        if !authenticationHandler.batchableRequests.isEmpty {
-            PendingRequestsView(authenticationHandler: authenticationHandler)
-        }
-    }
-
-}
-
-struct PendingRequestsViewIdentifier: Codable, Hashable {}

Sources/SecretAgent/AppDelegate.swift

@@ -9,18 +9,7 @@ import Observation
 import SSHProtocolKit
 import CertificateKit
 import Common
-import SwiftUI
 
-extension EnvironmentValues {
-
-    @MainActor fileprivate static let _certificateStore: CertificateStore = CertificateStore()
-
-    @MainActor var certificateStore: CertificateStore {
-        EnvironmentValues._certificateStore
-    }
-
-
-}
 @main
 class AppDelegate: NSObject, NSApplicationDelegate {
 
@@ -29,17 +18,17 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         let cryptoKit = SecureEnclave.Store()
         let migrator = SecureEnclave.CryptoKitMigrator()
         try? migrator.migrate(to: cryptoKit)
+        let certsMigrator = CertificateKitMigrator(homeDirectory: URL.homeDirectory)
+        try? certsMigrator.migrate()
         list.add(store: cryptoKit)
         list.add(store: SmartCard.Store())
-        let certsMigrator = CertificateMigrator(homeDirectory: URL.homeDirectory, certificateStore: EnvironmentValues._certificateStore)
-        try? certsMigrator.migrate()
         return list
     }()
     private let updater = Updater(checkOnLaunch: true)
     private let notifier = Notifier()
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(publicKeysURL: URL.publicKeyDirectory, certificatesURL: URL.certificatesDirectory)
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: URL.homeDirectory)
-    @MainActor private lazy var agent: Agent = {
+    private lazy var agent: Agent = {
-        Agent(storeList: storeList, certificateStore: EnvironmentValues._certificateStore, witness: notifier)
+        Agent(storeList: storeList, witness: notifier)
     }()
     private lazy var socketController: SocketController = {
         let path = URL.socketPath as String
@@ -50,19 +39,17 @@ class AppDelegate: NSObject, NSApplicationDelegate {
     func applicationDidFinishLaunching(_ aNotification: Notification) {
         logger.debug("SecretAgent finished launching")
         Task {
+            let inputParser = try await XPCAgentInputParser()
             for await session in socketController.sessions {
                 Task {
                     do {
-                        let inputParser = try await XPCAgentInputParser()
-                        let hostsReader = try? await XPCHostsfileReader()
-                        let hosts = try? await hostsReader?.read()
                         for await message in session.messages {
                             let request = try await inputParser.parse(data: message)
-                            let agentResponse = await agent.handle(request: request, provenance: session.provenance, hosts: hosts)
+                            let agentResponse = await agent.handle(request: request, provenance: session.provenance)
                             try session.write(agentResponse)
                         }
                     } catch {
-                        try? session.close()
+                        try session.close()
                     }
                 }
             }
@@ -72,13 +59,7 @@ class AppDelegate: NSObject, NSApplicationDelegate {
                 try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
             }
         }
-        Task {
-            for await _ in NotificationCenter.default.notifications(named: .certificateStoreReloaded) {
-                try? publicKeyFileStoreController.generateCertificates(for: EnvironmentValues._certificateStore.certificates, clear: true)
-            }
-        }
         try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
-        try? publicKeyFileStoreController.generateCertificates(for: EnvironmentValues._certificateStore.certificates, clear: true)
         notifier.prompt()
         _ = withObservationTracking {
             updater.update

Sources/SecretAgent/CertificateMigrator.swift

@@ -1,47 +0,0 @@
-import Foundation
-import Security
-import CryptoTokenKit
-import CryptoKit
-import OSLog
-import SSHProtocolKit
-import CertificateKit
-import SharedXPCServices
-
-public struct CertificateMigrator {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.migration", category: "CertificateKitMigrator")
-    private let directory: URL
-    private let certificateStore: CertificateStore
-
-    /// Initializes a PublicKeyFileStoreController.
-    public init(homeDirectory: URL, certificateStore: CertificateStore) {
-        directory = homeDirectory.appending(component: "PublicKeys")
-        self.certificateStore = certificateStore
-    }
-
-    @MainActor public func migrate() throws {
-        let fileCerts = try FileManager.default
-            .contentsOfDirectory(atPath: directory.path())
-            .filter { $0.hasSuffix("-cert.pub") }
-        Task {
-            for path in fileCerts {
-                do {
-                    let url = directory.appending(component: path)
-                    let data = try Data(contentsOf: url)
-                    let parser = try await XPCCertificateParser()
-                    let cert = try await parser.parse(data: data)
-                    try certificateStore.save(certificate: Certificate(openSSHCertificate: cert, rawData: data))
-                    do {
-                        try FileManager.default.removeItem(at: url)
-                    } catch {
-                        logger.error("Failed to delete successfully migrated cert: \(path)")
-                    }
-                } catch {
-                    logger.error("Failed to migrate cert: \(path)")
-                }
-            }
-
-        }
-    }
-
-}

Sources/SecretAgent/Notifier.swift

@@ -5,8 +5,6 @@ import SecretKit
 import SecretAgentKit
 import Brief
 
-typealias PersistAction = (@Sendable (AnySecret, TimeInterval) async throws -> Void)
-
 final class Notifier: Sendable {
 
     private let notificationDelegate = NotificationDelegate()
@@ -17,12 +15,6 @@ final class Notifier: Sendable {
         let updateCategory = UNNotificationCategory(identifier: Constants.updateCategoryIdentitifier, actions: [updateAction, ignoreAction], intentIdentifiers: [], options: [])
         let criticalUpdateCategory = UNNotificationCategory(identifier: Constants.criticalUpdateCategoryIdentitifier, actions: [updateAction], intentIdentifiers: [], options: [])
 
-        UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory])
-        UNUserNotificationCenter.current().delegate = notificationDelegate
-
-    }
-
-    func registerPersistenceHandler(action: @escaping PersistAction) async {
         let rawDurations = [
             Measurement(value: 1, unit: UnitDuration.minutes),
             Measurement(value: 5, unit: UnitDuration.minutes),
@@ -32,9 +24,11 @@ final class Notifier: Sendable {
 
         let doNotPersistAction = UNNotificationAction(identifier: Constants.doNotPersistActionIdentitifier, title: String(localized: .persistAuthenticationDeclineButton), options: [])
         var allPersistenceActions = [doNotPersistAction]
+
         let formatter = DateComponentsFormatter()
         formatter.unitsStyle = .spellOut
         formatter.allowedUnits = [.hour, .minute, .day]
+
         var identifiers: [String: TimeInterval] = [:]
         for duration in rawDurations {
             let seconds = duration.converted(to: .seconds).value
@@ -49,11 +43,16 @@ final class Notifier: Sendable {
         if persistAuthenticationCategory.responds(to: Selector(("actionsMenuTitle"))) {
             persistAuthenticationCategory.setValue(String(localized: .persistAuthenticationAcceptButton), forKey: "_actionsMenuTitle")
         }
-        var categories = await UNUserNotificationCenter.current().notificationCategories()
+        UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory, persistAuthenticationCategory])
-        categories.insert(persistAuthenticationCategory)
+        UNUserNotificationCenter.current().delegate = notificationDelegate
-        UNUserNotificationCenter.current().setNotificationCategories(categories)
+
+        Task {
+            await notificationDelegate.state.setPersistenceState(options: identifiers) { secret, store, duration in
+                guard let duration = duration else { return }
+                try? await store.persistAuthentication(secret: secret, forDuration: duration)
+            }
+        }
 
-        await notificationDelegate.state.setPersistenceState(options: identifiers, action: action)
     }
 
     func prompt() {
@@ -61,23 +60,16 @@ final class Notifier: Sendable {
         notificationCenter.requestAuthorization(options: .alert) { _, _ in }
     }
 
-    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, target: SigningRequestTarget?, offerPersistence: Bool) async {
+    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async {
         await notificationDelegate.state.setPending(secret: secret, store: store)
         let notificationCenter = UNUserNotificationCenter.current()
         let notificationContent = UNMutableNotificationContent()
         notificationContent.title = String(localized: .signedNotificationTitle(appName: provenance.origin.displayName))
-        switch target {
-        case .connection(let payload) where payload.host != nil:
-            notificationContent.subtitle = String(localized: .signedConnectionNotificationDescription(secretName: secret.name, username: payload.username, host: payload.host!))
-        case .signature(let payload):
-            notificationContent.subtitle = String(localized: .signedSignatureNotificationDescription(secretName: secret.name, namespace: payload.namespace))
-        default:
         notificationContent.subtitle = String(localized: .signedNotificationDescription(secretName: secret.name))
-        }
         notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description
         notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description
         notificationContent.interruptionLevel = .timeSensitive
-        if offerPersistence {
+        if await store.existingPersistedAuthenticationContext(secret: secret) == nil && secret.authenticationRequirement.required {
             notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier
         }
         if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) {
@@ -108,16 +100,11 @@ final class Notifier: Sendable {
 
 extension Notifier: SigningWitness {
 
-    func speakNowOrForeverHoldYourPeace(
+    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
-        forAccessTo secret: AnySecret,
-        from store: AnySecretStore,
-        by provenance: SigningRequestProvenance,
-        target: SigningRequestTarget?
-    ) async throws {
     }
 
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, target: SigningRequestTarget?, offerPersistence: Bool) async throws {
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
-        await notify(accessTo: secret, from: store, by: provenance, target: target, offerPersistence: offerPersistence)
+        await notify(accessTo: secret, from: store, by: provenance)
     }
 
 }
@@ -146,24 +133,28 @@ extension Notifier {
 final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Sendable {
 
     fileprivate actor State {
+        typealias PersistAction = (@Sendable (AnySecret, AnySecretStore, TimeInterval?) async -> Void)
         typealias IgnoreAction = (@Sendable (Release) async -> Void)
         fileprivate var release: Release?
         fileprivate var ignoreAction: IgnoreAction?
         fileprivate var persistAction: PersistAction?
         fileprivate var persistOptions: [String: TimeInterval] = [:]
+        fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:]
         fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:]
 
         func setPending(secret: AnySecret, store: AnySecretStore) {
             pendingPersistableSecrets[secret.id.description] = secret
+            pendingPersistableStores[store.id.description] = store
         }
 
-        func retrievePending(secretID: String, optionID: String) -> (AnySecret, TimeInterval)? {
+        func retrievePending(secretID: String, storeID: String, optionID: String) -> (AnySecret, AnySecretStore, TimeInterval)? {
             guard let secret = pendingPersistableSecrets[secretID],
+                  let store = pendingPersistableStores[storeID],
                   let options = persistOptions[optionID] else {
                 return nil
             }
             pendingPersistableSecrets.removeValue(forKey: secretID)
-            return (secret, options)
+            return (secret, store, options)
         }
 
         func setPersistenceState(options: [String: TimeInterval], action: @escaping PersistAction) {
@@ -211,12 +202,13 @@ final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Se
     }
 
     func handlePersistAuthenticationResponse(response: UNNotificationResponse) async {
-        guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String else {
+        guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String,
+              let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String else {
             return
         }
         let optionID = response.actionIdentifier
-        guard let (secret, persistOptions) = await state.retrievePending(secretID: secretID, optionID: optionID) else { return }
+        guard let (secret, store, persistOptions) = await state.retrievePending(secretID: secretID, storeID: storeID, optionID: optionID) else { return }
-        try? await state.persistAction?(secret, persistOptions)
+        await state.persistAction?(secret, store, persistOptions)
     }
 
 

Sources/SecretAgent/PendingRequestsView.swift

@@ -1,202 +0,0 @@
-import SwiftUI
-import SecretKit
-import SecretAgentKit
-import SmartCardSecretKit
-import Common
-
-struct PendingRequestsView: View {
-
-    private let authenticationHandler: any AuthenticationHandlerProtocol
-    @Environment(\.dismissWindow) var dismiss
-
-    init(authenticationHandler: some AuthenticationHandlerProtocol) {
-        self.authenticationHandler = authenticationHandler
-    }
-
-    var body: some View {
-        ScrollView {
-            Text(.pendingRequestDescription)
-            ForEach(Array(authenticationHandler.batchableRequests.enumerated()), id: \.offset) { group in
-                MultilineInfoView {
-                    if let first = group.element.first {
-                        HStack {
-                            HStack {
-                                Image(nsImage: .init(byReferencing: first.provenance.origin.iconURL!))
-                                    .resizable()
-                                    .aspectRatio(contentMode: .fit)
-                                    .frame(width: 50)
-                                VStack(alignment: .leading) {
-                                    Text(first.provenance.origin.displayName)
-                                        .font(.subheadline)
-                                    Text(first.secret.name)
-                                        .font(.headline)
-                                    switch first.target {
-                                    case .connection(let payload):
-                                        if let host = payload.host {
-                                            Text(.authContextConnectingToUsernameAndHost(username: payload.username, host: host))
-                                                .font(.caption2)
-                                        } else {
-                                            Text(.authContextConnectingToUnknownHost)
-                                                .font(.caption2)
-                                        }
-                                    case .signature(let payload):
-                                        Text(.authContextSigningForNamespace(namespace: payload.namespace))
-                                            .font(.caption2)
-                                    default:
-                                        EmptyView()
-                                    }
-                                }
-                            }
-                            Spacer()
-                            VStack {
-                                Button(.pendingRequestsReviewBatchButton) {
-                                    Task {
-                                        try? await authenticationHandler.requestAuthentication(for: Set(group.element))
-                                        if authenticationHandler.batchableRequests.isEmpty {
-                                            dismiss()
-                                        }
-                                    }
-                                }
-                                .buttonBorderShape(.capsule)
-                                .primaryButton()
-                            }
-                        }
-                    }
-                } items: {
-                    ForEach(Array(group.element.enumerated()), id: \.offset) { pending in
-                        HStack {
-                            Text(pending.element.provenance.date.formatted())
-                            Spacer()
-                            Button(.pendingRequestsReviewSingleButton) {
-                                Task {
-                                    try? await authenticationHandler.requestAuthentication(for: [pending.element])
-                                    if authenticationHandler.batchableRequests.isEmpty {
-                                        dismiss()
-                                    }
-                                }
-                            }
-                            .buttonBorderShape(.capsule)
-                            .normalButton()
-                        }
-                    }
-
-                }
-            }
-        }
-        .safeAreaPadding(20)
-    }
-
-}
-
-private struct TestHandler: AuthenticationHandlerProtocol {
-
-    var batchableRequests: [[SignatureRequest]] = []
-
-    func requestAuthentication(for requests: Set<SignatureRequest>) async throws {
-
-    }
-
-    func persistAuthentication<SecretType>(secret: SecretType, forDuration duration: TimeInterval) async throws where SecretType : Secret {
-
-    }
-
-    func setPendingRequestHandler(_ handler: @escaping () async throws -> Void) {
-
-    }
-    
-    func authenticatedContext(for request: SignatureRequest, context: any AuthenticationContextProtocol) async throws -> (any AuthenticationContextProtocol)? {
-        nil
-    }
-
-}
-
-
-    #Preview {
-        if #available(macOS 26.0, *) {
-            ScrollView {
-                MultilineInfoView {
-                    HStack {
-                        HStack {
-                            Image("ghostty")
-                                .resizable()
-                                .aspectRatio(contentMode: .fit)
-                                .frame(width: 50)
-                            VStack(alignment: .leading) {
-                                Text("Ghostty")
-                                    .font(.subheadline)
-                                Text("GitHub")
-                                    .font(.headline)
-                                Text("Authenticating git@github.com")
-                                    .font(.caption2)
-                            }
-                        }
-                        Spacer()
-                        VStack {
-                            Button("Review as Batch") {
-
-                            }
-                            .buttonBorderShape(.capsule)
-                            .buttonStyle(.glassProminent)
-                        }
-                    }
-                } items: {
-                    ForEach(0..<2) { _ in
-                        HStack {
-                            Text("4:05 PM")
-                            Spacer()
-                            Button("Review") {
-
-                            }
-                            .buttonBorderShape(.capsule)
-                            .buttonStyle(.glass)
-                        }
-                    }
-
-                }
-                MultilineInfoView {
-                    HStack {
-                        HStack {
-                            Image("ghostty")
-                                .resizable()
-                                .aspectRatio(contentMode: .fit)
-                                .frame(width: 50)
-                            VStack(alignment: .leading) {
-                                Text("Ghostty")
-                                    .font(.subheadline)
-                                Text("Git Signing")
-                                    .font(.headline)
-                                Text("Git Signature")
-                                    .font(.caption2)
-                            }
-                        }
-                        Spacer()
-                        VStack {
-                            Button("Review as Batch") {
-
-                            }
-                            .buttonBorderShape(.capsule)
-                            .buttonStyle(.glassProminent)
-                        }
-                    }
-                } items: {
-                    ForEach(0..<2) { _ in
-                        HStack {
-                            Text("4:05 PM")
-                            Spacer()
-                            Button("Review") {
-
-                            }
-                            .buttonBorderShape(.capsule)
-                            .buttonStyle(.glass)
-                        }
-                    }
-
-                }
-
-            }
-            .padding()
-            .formStyle(.grouped)
-            .frame(minHeight: 700)
-        }
-
-    }

Sources/SecretAgent/SecretAgent.entitlements

@@ -4,20 +4,14 @@
 <dict>
 	<key>com.apple.security.hardened-process</key>
 	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.enable-pure-data</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.no-tagged-receive</key>
-	<true/>
 	<key>com.apple.security.hardened-process.dyld-ro</key>
 	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
+	<key>com.apple.security.hardened-process.enhanced-security-version</key>
-	<string>2</string>
+	<integer>1</integer>
 	<key>com.apple.security.hardened-process.hardened-heap</key>
 	<true/>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
+	<key>com.apple.security.hardened-process.platform-restrictions</key>
-	<string>2</string>
+	<integer>2</integer>
 	<key>com.apple.security.smartcard</key>
 	<true/>
 	<key>keychain-access-groups</key>

Sources/SecretAgent/XPCHostsfileReader.swift

@@ -1,36 +0,0 @@
-import Foundation
-import OSLog
-import XPCWrappers
-import OSLog
-
-public final class XPCHostsfileReader {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "XPCHostsfileReader")
-    private let session: XPCTypedSession<[Data: String], HostsfileReaderError>
-
-    public init() async throws {
-        logger.debug("Creating XPCHostsfileReader")
-        session = try await XPCTypedSession(serviceName: "com.maxgoedjen.Secretive.SecretAgentHostsfileReader", warmup: true)
-        logger.debug("XPCHostsfileReader is warmed up.")
-    }
-
-    public func read() async throws -> [Data: String] {
-        logger.debug("Reading hosts file")
-        defer { logger.debug("Read hosts file") }
-        return try await session.send(Data())
-    }
-
-    deinit {
-        session.complete()
-    }
-
-}
-
-extension XPCHostsfileReader {
-
-    public enum HostsfileReaderError: Error, Codable {
-        case fileDoesNotExist
-        case parseError
-    }
-
-}

Sources/SecretAgent/XPCInputParser.swift

@@ -3,8 +3,6 @@ import OSLog
 import SSHProtocolKit
 import Brief
 import XPCWrappers
-import OSLog
-import SSHProtocolKit
 
 /// Delegates all agent input parsing to an XPC service which wraps OpenSSH
 public final class XPCAgentInputParser: SSHAgentInputParserProtocol {

Sources/SecretAgentHostsfileReader/Info.plist

@@ -1,11 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>XPCService</key>
-	<dict>
-		<key>ServiceType</key>
-		<string>Application</string>
-	</dict>
-</dict>
-</plist>

Sources/SecretAgentHostsfileReader/SecretAgentHostsfileReader.entitlements

@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>com.apple.security.hardened-process</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.enable-pure-data</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.no-tagged-receive</key>
-	<true/>
-	<key>com.apple.security.hardened-process.dyld-ro</key>
-	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
-	<string>2</string>
-	<key>com.apple.security.hardened-process.hardened-heap</key>
-	<true/>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
-	<string>2</string>
-</dict>
-</plist>

Sources/SecretAgentHostsfileReader/SecretAgentHostsfileReader.swift

@@ -1,25 +0,0 @@
-import Foundation
-import OSLog
-import XPCWrappers
-import SSHProtocolKit
-
-final class SecretAgentHostsfileReader: NSObject, XPCProtocol {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.SecretAgentHostsfileReader", category: "SecretAgentHostsfileReader")
-
-    func process(_ data: Data) async throws -> [Data: String] {
-        logger.log("Parsing hostsfile")
-        var result: [Data: String] = [:]
-        for try await line in URL(filePath: NSHomeDirectory().appending("/.ssh/known_hosts")).lines {
-            let split = line.split(separator: " ").map(String.init)
-            guard split.count == 3 else { continue }
-            guard let decoded = Data(base64Encoded: split[2]) else { continue }
-            let reader = OpenSSHReader(data: decoded)
-            _ = try reader.readNextChunk()
-            let key = try reader.readNextChunk()
-            result[key] = split[0]
-        }
-        return result
-    }
-
-}

Sources/SecretAgentHostsfileReader/main.swift

@@ -1,7 +0,0 @@
-import Foundation
-import XPCWrappers
-
-let delegate = XPCServiceDelegate(exportedObject: SecretAgentHostsfileReader())
-let listener = NSXPCListener.service()
-listener.delegate = delegate
-listener.resume()

Sources/SecretAgentInputParser/SecretAgentInputParser.entitlements

@@ -12,11 +12,11 @@
 	<true/>
 	<key>com.apple.security.hardened-process.dyld-ro</key>
 	<true/>
+	<key>com.apple.security.hardened-process.enhanced-security-version</key>
+	<integer>1</integer>
 	<key>com.apple.security.hardened-process.hardened-heap</key>
 	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
+	<key>com.apple.security.hardened-process.platform-restrictions</key>
-	<string>2</string>
+	<integer>2</integer>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
-	<string>2</string>
 </dict>
 </plist>

Sources/SecretAgentInputParser/SecretAgentInputParser.swift

@@ -1,7 +1,6 @@
 import Foundation
 import OSLog
 import XPCWrappers
-import SecretAgentKit
 import SSHProtocolKit
 
 final class SecretAgentInputParser: NSObject, XPCProtocol {

Sources/Secretive.xcodeproj/project.xcproj

@@ -1,770 +0,0 @@
-{
-  "organization": "Max Goedjen",
-  "default-configuration": "Release",
-  "configurations": [
-    { "name": "Debug", "file": "Config/Config.xcconfig" },
-    { "name": "Release", "file": "Config/Config.xcconfig" },
-    { "name": "Test", "file": "Config/Config.xcconfig" },
-  ],
-  "localizations": {
-    "development": "en",
-    "supported": [
-      "ca",
-      "de",
-      "fi",
-      "fr",
-      "it",
-      "ko",
-      "pl",
-      "pt-BR",
-      "ru",
-    ],
-  },
-  "files": [
-    { "path": "Packages" },
-    {
-      "kind": "group",
-      "path": "Secretive",
-      "children": [
-        { "path": "App.swift", "target-membership": [ "Secretive/compile-sources" ] },
-        {
-          "kind": "group",
-          "path": "Views",
-          "children": [
-            {
-              "kind": "group",
-              "path": "Configuration",
-              "children": [
-                { "path": "ConfigurationItemView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "IntegrationsView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "Instructions.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "ToolConfigurationView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "SetupView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "GettingStartedView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-              ],
-            }, {
-              "kind": "group",
-              "path": "Secrets",
-              "children": [
-                { "path": "CreateSecretView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "DeleteSecretView.swift", "encoding": "utf8", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "EditSecretView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "DeleteCertificateView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "EditCertificateView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "EmptyStoreView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "NoStoresView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "SecretDetailView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "CertificateDetailView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "SecretListItemView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "CertificateListItemView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "StoreListView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "SettingsView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-              ],
-            }, {
-              "kind": "group",
-              "path": "Modifiers",
-              "children": [
-                { "path": "ErrorStyle.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "BoxBackgroundStyle.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "ToolbarButtonStyle.swift", "target-membership": [ "Secretive/compile-sources" ] },
-              ],
-            }, {
-              "kind": "group",
-              "path": "Views",
-              "children": [
-                { "path": "AboutView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "AgentStatusView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "ContentView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "CopyableView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-                { "path": "UpdateView.swift", "target-membership": [ "Secretive/compile-sources" ] },
-              ],
-            },
-          ],
-        }, {
-          "kind": "group",
-          "path": "Controllers",
-          "children": [
-            { "path": "AgentStatusChecker.swift", "target-membership": [ "Secretive/compile-sources" ] },
-            { "path": "ApplicationDirectoryController.swift", "target-membership": [ "Secretive/compile-sources" ] },
-            { "path": "JustUpdatedChecker.swift", "target-membership": [ "Secretive/compile-sources" ] },
-          ],
-        },
-        { "path": "Info.plist" },
-        { "path": "InternetAccessPolicy.plist", "encoding": "utf8", "target-membership": [ "Secretive/resources" ] },
-        {
-          "path": "AppIcon.icon",
-          "target-membership": [
-            "Secretive/resources",
-            "SecretAgent/resources",
-          ],
-        },
-        { "path": "Secretive.entitlements" },
-        {
-          "path": "<PROJECT>/Packages/Resources/Localizable.xcstrings",
-          "target-membership": [
-            "Secretive/resources",
-            "SecretAgent/resources",
-          ],
-        }, {
-          "kind": "group",
-          "path": "Preview Content",
-          "children": [
-            { "path": "Preview Assets.xcassets", "target-membership": [ "Secretive/resources" ] },
-            { "path": "PreviewStore.swift", "target-membership": [ "Secretive/compile-sources" ] },
-            { "path": "PreviewUpdater.swift", "target-membership": [ "Secretive/compile-sources" ] },
-            { "path": "PreviewAgentStatusChecker.swift", "target-membership": [ "Secretive/compile-sources" ] },
-          ],
-        },
-      ],
-    }, {
-      "kind": "group",
-      "path": "SecretAgent",
-      "children": [
-        { "path": "App.swift", "encoding": "utf8", "target-membership": [ "SecretAgent/compile-sources" ] },
-        { "path": "Notifier.swift", "target-membership": [ "SecretAgent/compile-sources" ] },
-        { "path": "XPCInputParser.swift", "target-membership": [ "SecretAgent/compile-sources" ] },
-        { "path": "PendingRequestsView.swift", "target-membership": [ "SecretAgent/compile-sources" ] },
-        { "path": "XPCHostsfileReader.swift", "target-membership": [ "SecretAgent/compile-sources" ] },
-        { "path": "CertificateMigrator.swift", "target-membership": [ "SecretAgent/compile-sources" ] },
-        {
-          "kind": "variant-group",
-          "name": "Main.storyboard",
-          "target-membership": [
-            "SecretAgent/resources",
-          ],
-          "children": [
-            {
-              "path": "en.lproj/Main.storyboard",
-            },
-          ],
-        },
-        { "path": "Info.plist" },
-        { "path": "<PROJECT>/SecretAgent/InternetAccessPolicy.plist", "target-membership": [ "SecretAgent/resources" ] },
-        { "path": "SecretAgent.entitlements" },
-        {
-          "kind": "group",
-          "path": "Preview Content",
-          "children": [
-            { "path": "Preview Assets.xcassets", "target-membership": [ "SecretAgent/resources" ] },
-          ],
-        },
-      ],
-    }, {
-      "kind": "group",
-      "path": "Config",
-      "children": [
-        { "path": "Secretive.xctestplan" },
-        { "path": "Config.xcconfig" },
-        { "path": "OpenSource.xcconfig" },
-      ],
-    }, {
-      "kind": "group",
-      "path": "SecretiveUpdater",
-      "children": [
-        { "path": "SecretiveUpdater.entitlements" },
-        { "path": "Info.plist" },
-        { "path": "InternetAccessPolicy.plist", "target-membership": [ "SecretiveUpdater/resources" ] },
-        { "path": "main.swift", "target-membership": [ "SecretiveUpdater/compile-sources" ] },
-        { "path": "SecretiveUpdater.swift", "target-membership": [ "SecretiveUpdater/compile-sources" ] },
-      ],
-    }, {
-      "kind": "group",
-      "path": "SecretAgentInputParser",
-      "children": [
-        { "path": "SecretAgentInputParser.entitlements" },
-        { "path": "Info.plist" },
-        { "path": "main.swift", "target-membership": [ "SecretAgentInputParser/compile-sources" ] },
-        { "path": "SecretAgentInputParser.swift", "target-membership": [ "SecretAgentInputParser/compile-sources" ] },
-      ],
-    }, {
-      "kind": "group",
-      "path": "SecretiveCertificateParser",
-      "children": [
-        { "path": "Info.plist" },
-        { "path": "main.swift", "target-membership": [ "SecretiveCertificateParser/compile-sources" ] },
-        { "path": "SecretiveCertificateParser.entitlements" },
-        { "path": "SecretiveCertificateParser.swift", "target-membership": [ "SecretiveCertificateParser/compile-sources" ] },
-      ],
-    }, {
-      "kind": "group",
-      "path": "SecretAgentHostsfileReader",
-      "children": [
-        { "path": "SecretAgentHostsfileReader.entitlements" },
-        { "path": "Info.plist" },
-        { "path": "main.swift", "target-membership": [ "SecretAgentHostsfileReader/compile-sources" ] },
-        { "path": "SecretAgentHostsfileReader.swift", "target-membership": [ "SecretAgentHostsfileReader/compile-sources" ] },
-      ],
-    }, {
-      "kind": "group",
-      "name": "Products",
-      "children": [
-        { "path": "<PRODUCTS>/Secretive.app", "id": "50617D7F23FCE48E0099B055", "type": "wrapper.application", "index": false },
-        { "path": "<PRODUCTS>/SecretAgent.app", "id": "50A3B78A24026B7500D209EA", "type": "wrapper.application", "index": false, "target-membership": [ { "build-phase": "Secretive/copy/Copy Files", "header-preservation": "remove-on-copy" } ] },
-        {
-          "path": "<PRODUCTS>/SecretiveUpdater.xpc",
-          "id": "50692D122E6FDB880043C7BB",
-          "type": "wrapper.xpc-service",
-          "index": false,
-          "target-membership": [
-            { "build-phase": "Secretive/copy/Embed XPC Services", "header-preservation": "remove-on-copy" },
-            { "build-phase": "SecretAgent/copy/Embed XPC Services", "header-preservation": "remove-on-copy" },
-          ],
-        }, {
-          "path": "<PRODUCTS>/SecretAgentInputParser.xpc",
-          "id": "50692E502E6FF9D20043C7BB",
-          "type": "wrapper.xpc-service",
-          "index": false,
-          "target-membership": [
-            { "build-phase": "Secretive/copy/Embed XPC Services", "header-preservation": "remove-on-copy" },
-            { "build-phase": "SecretAgent/copy/Embed XPC Services", "header-preservation": "remove-on-copy" },
-          ],
-        }, {
-          "path": "<PRODUCTS>/SecretiveCertificateParser.xpc",
-          "id": "50E205142FAAB81C00402380",
-          "type": "wrapper.xpc-service",
-          "index": false,
-          "target-membership": [
-            { "build-phase": "Secretive/copy/Embed XPC Services", "header-preservation": "remove-on-copy" },
-            { "build-phase": "SecretAgent/copy/Embed XPC Services", "header-preservation": "remove-on-copy" },
-          ],
-        },
-        { "path": "<PRODUCTS>/SecretAgentHostsfileReader.xpc", "id": "5054028D3034B5E3000C3356", "type": "wrapper.xpc-service", "index": false, "target-membership": [ { "build-phase": "SecretAgent/copy/Embed XPC Services", "header-preservation": "remove-on-copy" } ] },
-      ],
-    },
-    { "kind": "group", "name": "Frameworks" },
-  ],
-  "targets": [
-    {
-      "name": "Secretive",
-      "id": "50617D7E23FCE48D0099B055",
-      "product": "Products/Secretive.app",
-      "product-type": "application",
-      "dependencies": [
-        "SecretAgent",
-        "SecretiveUpdater",
-        "SecretAgentInputParser",
-        "SecretiveCertificateParser",
-      ],
-      "build-phases": [
-        "compile-sources",
-        "frameworks",
-        "resources",
-        {
-          "kind": "copy",
-          "name": "Embed Frameworks",
-          "bundle-base-path": "frameworks-directory",
-        }, {
-          "kind": "copy",
-          "name": "Copy Files",
-          "bundle-base-path": "root",
-          "relative-path": "Contents/Library/LoginItems",
-        }, {
-          "kind": "copy",
-          "name": "Embed XPC Services",
-          "bundle-base-path": "build-products-directory",
-          "relative-path": "$(CONTENTS_FOLDER_PATH)/XPCServices",
-        },
-      ],
-      "package-product-members": [
-        {
-          "product-name": "Brief",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "CertificateKit",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "Common",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "Formatters",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "SecretKit",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "SecureEnclaveSecretKit",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "SettingsKit",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "SharedXPCServices",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "SmartCardSecretKit",
-          "build-phase": { "build-phase": "frameworks" },
-        },
-      ],
-      "build-settings": {
-        "ASSETCATALOG_COMPILER_APPICON_NAME": "AppIcon",
-        "CODE_SIGN_ENTITLEMENTS": "Secretive/Secretive.entitlements",
-        "CODE_SIGN_IDENTITY[config=Debug]": "Apple Development",
-        "CODE_SIGN_IDENTITY[config=Release]": "Developer ID Application",
-        "CODE_SIGN_STYLE[config=Debug]": "Automatic",
-        "CODE_SIGN_STYLE[config=Release]": "Manual",
-        "CODE_SIGN_STYLE[config=Test]": "Manual",
-        "COMBINE_HIDPI_IMAGES": "YES",
-        "CURRENT_PROJECT_VERSION": "1",
-        "DEAD_CODE_STRIPPING": "YES",
-        "DEVELOPMENT_ASSET_PATHS": "\"Secretive/Preview Content\"",
-        "DEVELOPMENT_TEAM[config=Debug]": "$(SECRETIVE_DEVELOPMENT_TEAM)",
-        "DEVELOPMENT_TEAM[config=Release]": "$(SECRETIVE_DEVELOPMENT_TEAM)",
-        "ENABLE_APP_SANDBOX": "YES",
-        "ENABLE_HARDENED_RUNTIME[config=Debug]": "YES",
-        "ENABLE_HARDENED_RUNTIME[config=Release]": "YES",
-        "ENABLE_HARDENED_RUNTIME[config=Test]": "NO",
-        "ENABLE_INCOMING_NETWORK_CONNECTIONS": "NO",
-        "ENABLE_OUTGOING_NETWORK_CONNECTIONS": "NO",
-        "ENABLE_PREVIEWS": "YES",
-        "ENABLE_RESOURCE_ACCESS_AUDIO_INPUT": "NO",
-        "ENABLE_RESOURCE_ACCESS_BLUETOOTH": "NO",
-        "ENABLE_RESOURCE_ACCESS_CALENDARS": "NO",
-        "ENABLE_RESOURCE_ACCESS_CAMERA": "NO",
-        "ENABLE_RESOURCE_ACCESS_CONTACTS": "NO",
-        "ENABLE_RESOURCE_ACCESS_LOCATION": "NO",
-        "ENABLE_RESOURCE_ACCESS_PRINTING": "NO",
-        "ENABLE_RESOURCE_ACCESS_USB": "NO",
-        "INFOPLIST_FILE": "Secretive/Info.plist",
-        "LD_RUNPATH_SEARCH_PATHS": [
-          "$(inherited)",
-          "@executable_path/../Frameworks",
-        ],
-        "MARKETING_VERSION": "1",
-        "PRODUCT_BUNDLE_IDENTIFIER": "$(SECRETIVE_BASE_BUNDLE_ID).Host",
-        "PRODUCT_NAME": "$(TARGET_NAME)",
-        "PROVISIONING_PROFILE_SPECIFIER[config=Debug]": "",
-        "PROVISIONING_PROFILE_SPECIFIER[config=Release]": "Secretive - Host",
-      },
-    }, {
-      "name": "SecretAgent",
-      "id": "50A3B78924026B7500D209EA",
-      "product": "Products/SecretAgent.app",
-      "product-type": "application",
-      "dependencies": [
-        "SecretiveUpdater",
-        "SecretAgentInputParser",
-        "SecretiveCertificateParser",
-        "SecretAgentHostsfileReader",
-      ],
-      "build-phases": [
-        "compile-sources",
-        "frameworks",
-        "resources",
-        {
-          "kind": "copy",
-          "name": "Embed Frameworks",
-          "bundle-base-path": "frameworks-directory",
-        }, {
-          "kind": "copy",
-          "name": "Embed XPC Services",
-          "bundle-base-path": "build-products-directory",
-          "relative-path": "$(CONTENTS_FOLDER_PATH)/XPCServices",
-        },
-      ],
-      "package-product-members": [
-        {
-          "product-name": "Brief",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "Common",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "SecretAgentKit",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "SecretKit",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "SecureEnclaveSecretKit",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "SharedXPCServices",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "SmartCardSecretKit",
-          "build-phase": { "build-phase": "frameworks" },
-        },
-      ],
-      "build-settings": {
-        "ASSETCATALOG_COMPILER_APPICON_NAME": "AppIcon",
-        "AUTOMATION_APPLE_EVENTS": "NO",
-        "CODE_SIGN_ENTITLEMENTS": "SecretAgent/SecretAgent.entitlements",
-        "CODE_SIGN_IDENTITY[config=Release]": "Developer ID Application",
-        "CODE_SIGN_STYLE[config=Debug]": "Automatic",
-        "CODE_SIGN_STYLE[config=Release]": "Manual",
-        "CODE_SIGN_STYLE[config=Test]": "Manual",
-        "COMBINE_HIDPI_IMAGES": "YES",
-        "DEAD_CODE_STRIPPING": "YES",
-        "DEVELOPMENT_ASSET_PATHS": "\"SecretAgent/Preview Content\"",
-        "DEVELOPMENT_TEAM[config=Debug]": "$(SECRETIVE_DEVELOPMENT_TEAM)",
-        "DEVELOPMENT_TEAM[config=Release]": "$(SECRETIVE_DEVELOPMENT_TEAM)",
-        "ENABLE_APP_SANDBOX": "YES",
-        "ENABLE_HARDENED_RUNTIME": "YES",
-        "ENABLE_INCOMING_NETWORK_CONNECTIONS": "NO",
-        "ENABLE_OUTGOING_NETWORK_CONNECTIONS": "NO",
-        "ENABLE_PREVIEWS": "YES",
-        "ENABLE_RESOURCE_ACCESS_AUDIO_INPUT": "NO",
-        "ENABLE_RESOURCE_ACCESS_BLUETOOTH": "NO",
-        "ENABLE_RESOURCE_ACCESS_CALENDARS": "NO",
-        "ENABLE_RESOURCE_ACCESS_CAMERA": "NO",
-        "ENABLE_RESOURCE_ACCESS_CONTACTS": "NO",
-        "ENABLE_RESOURCE_ACCESS_LOCATION": "NO",
-        "ENABLE_RESOURCE_ACCESS_PHOTO_LIBRARY": "NO",
-        "ENABLE_RESOURCE_ACCESS_PRINTING": "NO",
-        "ENABLE_RESOURCE_ACCESS_USB": "NO",
-        "INFOPLIST_FILE": "SecretAgent/Info.plist",
-        "LD_RUNPATH_SEARCH_PATHS": [
-          "$(inherited)",
-          "@executable_path/../Frameworks",
-        ],
-        "MARKETING_VERSION": "1",
-        "PRODUCT_BUNDLE_IDENTIFIER": "$(SECRETIVE_BASE_BUNDLE_ID).SecretAgent",
-        "PRODUCT_NAME": "$(TARGET_NAME)",
-        "PROVISIONING_PROFILE_SPECIFIER[config=Release]": "Secretive - Secret Agent",
-        "RUNTIME_EXCEPTION_ALLOW_DYLD_ENVIRONMENT_VARIABLES": "NO",
-        "RUNTIME_EXCEPTION_ALLOW_JIT": "NO",
-        "RUNTIME_EXCEPTION_ALLOW_UNSIGNED_EXECUTABLE_MEMORY": "NO",
-        "RUNTIME_EXCEPTION_DEBUGGING_TOOL": "NO",
-        "RUNTIME_EXCEPTION_DISABLE_EXECUTABLE_PAGE_PROTECTION": "NO",
-        "RUNTIME_EXCEPTION_DISABLE_LIBRARY_VALIDATION": "NO",
-      },
-    }, {
-      "name": "SecretiveUpdater",
-      "id": "50692D112E6FDB880043C7BB",
-      "product": "Products/SecretiveUpdater.xpc",
-      "product-type": "xpc-service",
-      "dependencies": [
-        { "kind": "package", "product-name": "Brief" },
-        { "kind": "package", "product-name": "Formatters" },
-        { "kind": "package", "product-name": "XPCWrappers" },
-      ],
-      "build-phases": [
-        "compile-sources",
-        "frameworks",
-        "resources",
-      ],
-      "package-product-members": [
-        {
-          "product-name": "Brief",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "Formatters",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "XPCWrappers",
-          "build-phase": { "build-phase": "frameworks" },
-        },
-      ],
-      "build-settings": {
-        "CLANG_CXX_LANGUAGE_STANDARD": "gnu++20",
-        "CODE_SIGN_ENTITLEMENTS": "SecretiveUpdater/SecretiveUpdater.entitlements",
-        "CODE_SIGN_IDENTITY[config=Debug]": "Apple Development",
-        "CODE_SIGN_IDENTITY[config=Debug][sdk=macosx*]": "Apple Development",
-        "CODE_SIGN_IDENTITY[config=Release]": "Developer ID Application",
-        "CODE_SIGN_STYLE[config=Debug]": "Automatic",
-        "CODE_SIGN_STYLE[config=Release]": "Manual",
-        "CODE_SIGN_STYLE[config=Test]": "Automatic",
-        "COMBINE_HIDPI_IMAGES": "YES",
-        "CURRENT_PROJECT_VERSION": "1",
-        "DEVELOPMENT_TEAM[config=Debug]": "$(SECRETIVE_DEVELOPMENT_TEAM)",
-        "DEVELOPMENT_TEAM[config=Release]": "",
-        "DEVELOPMENT_TEAM[config=Release][sdk=macosx*]": "$(SECRETIVE_DEVELOPMENT_TEAM)",
-        "ENABLE_APP_SANDBOX": "YES",
-        "ENABLE_HARDENED_RUNTIME": "YES",
-        "ENABLE_INCOMING_NETWORK_CONNECTIONS": "NO",
-        "ENABLE_OUTGOING_NETWORK_CONNECTIONS": "YES",
-        "ENABLE_RESOURCE_ACCESS_AUDIO_INPUT": "NO",
-        "ENABLE_RESOURCE_ACCESS_BLUETOOTH": "NO",
-        "ENABLE_RESOURCE_ACCESS_CALENDARS": "NO",
-        "ENABLE_RESOURCE_ACCESS_CAMERA": "NO",
-        "ENABLE_RESOURCE_ACCESS_CONTACTS": "NO",
-        "ENABLE_RESOURCE_ACCESS_LOCATION": "NO",
-        "ENABLE_RESOURCE_ACCESS_PRINTING": "NO",
-        "ENABLE_RESOURCE_ACCESS_USB": "NO",
-        "GCC_C_LANGUAGE_STANDARD": "gnu17",
-        "GENERATE_INFOPLIST_FILE": "YES",
-        "INFOPLIST_FILE": "SecretiveUpdater/Info.plist",
-        "INFOPLIST_KEY_CFBundleDisplayName": "SecretiveUpdater",
-        "INFOPLIST_KEY_NSHumanReadableCopyright": "Copyright © 2025 Max Goedjen. All rights reserved.",
-        "LOCALIZATION_PREFERS_STRING_CATALOGS": "YES",
-        "MARKETING_VERSION": "1.0",
-        "PRODUCT_BUNDLE_IDENTIFIER": "$(SECRETIVE_BASE_BUNDLE_ID).SecretiveUpdater",
-        "PRODUCT_NAME": "$(TARGET_NAME)",
-        "PROVISIONING_PROFILE_SPECIFIER[config=Release]": "",
-        "REGISTER_APP_GROUPS": "YES",
-        "SKIP_INSTALL": "YES",
-        "STRING_CATALOG_GENERATE_SYMBOLS": "YES",
-        "SWIFT_ACTIVE_COMPILATION_CONDITIONS[config=Debug]": "DEBUG $(inherited)",
-        "SWIFT_APPROACHABLE_CONCURRENCY": "YES",
-        "SWIFT_EMIT_LOC_STRINGS": "YES",
-        "SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY": "YES",
-        "SWIFT_VERSION": "5.0",
-      },
-    }, {
-      "name": "SecretiveCertificateParser",
-      "id": "50E205132FAAB81C00402380",
-      "product": "Products/SecretiveCertificateParser.xpc",
-      "product-type": "xpc-service",
-      "dependencies": [
-        { "kind": "package", "product-name": "Formatters" },
-        { "kind": "package", "product-name": "SSHProtocolKit" },
-        { "kind": "package", "product-name": "XPCWrappers" },
-      ],
-      "build-phases": [
-        "compile-sources",
-        "frameworks",
-        "resources",
-      ],
-      "package-product-members": [
-        {
-          "product-name": "Formatters",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "SSHProtocolKit",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "XPCWrappers",
-          "build-phase": { "build-phase": "frameworks" },
-        },
-      ],
-      "build-settings": {
-        "CLANG_CXX_LANGUAGE_STANDARD": "gnu++20",
-        "CODE_SIGN_ENTITLEMENTS": "SecretiveCertificateParser/SecretiveCertificateParser.entitlements",
-        "CODE_SIGN_IDENTITY[config=Debug]": "Apple Development",
-        "CODE_SIGN_IDENTITY[config=Release]": "Developer ID Application",
-        "CODE_SIGN_STYLE[config=Debug]": "Automatic",
-        "CODE_SIGN_STYLE[config=Release]": "Manual",
-        "CODE_SIGN_STYLE[config=Test]": "Automatic",
-        "COMBINE_HIDPI_IMAGES": "YES",
-        "CURRENT_PROJECT_VERSION": "1",
-        "DEVELOPMENT_TEAM[config=Debug]": "$(SECRETIVE_DEVELOPMENT_TEAM)",
-        "DEVELOPMENT_TEAM[config=Release]": "",
-        "DEVELOPMENT_TEAM[config=Release][sdk=macosx*]": "Z72PRUAWF6",
-        "ENABLE_APP_SANDBOX": "YES",
-        "ENABLE_HARDENED_RUNTIME": "YES",
-        "GCC_C_LANGUAGE_STANDARD": "gnu17",
-        "GENERATE_INFOPLIST_FILE": "YES",
-        "INFOPLIST_FILE": "SecretiveCertificateParser/Info.plist",
-        "INFOPLIST_KEY_CFBundleDisplayName": "SecretiveCertificateParser",
-        "INFOPLIST_KEY_NSHumanReadableCopyright": "Copyright © 2026 Max Goedjen. All rights reserved.",
-        "LOCALIZATION_PREFERS_STRING_CATALOGS": "YES",
-        "MARKETING_VERSION": "1.0",
-        "PRODUCT_BUNDLE_IDENTIFIER": "$(SECRETIVE_BASE_BUNDLE_ID).SecretiveCertificateParser",
-        "PRODUCT_NAME": "$(TARGET_NAME)",
-        "PROVISIONING_PROFILE_SPECIFIER[config=Release]": "",
-        "REGISTER_APP_GROUPS": "YES",
-        "SKIP_INSTALL": "YES",
-        "STRING_CATALOG_GENERATE_SYMBOLS": "YES",
-        "SWIFT_ACTIVE_COMPILATION_CONDITIONS[config=Debug]": "DEBUG $(inherited)",
-        "SWIFT_APPROACHABLE_CONCURRENCY": "YES",
-        "SWIFT_EMIT_LOC_STRINGS": "YES",
-        "SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY": "YES",
-        "SWIFT_VERSION": "5.0",
-      },
-    }, {
-      "name": "SecretAgentInputParser",
-      "id": "50692E4F2E6FF9D20043C7BB",
-      "product": "Products/SecretAgentInputParser.xpc",
-      "product-type": "xpc-service",
-      "dependencies": [
-        { "kind": "package", "product-name": "SecretAgentKit" },
-        { "kind": "package", "product-name": "XPCWrappers" },
-      ],
-      "build-phases": [
-        "compile-sources",
-        "frameworks",
-        "resources",
-      ],
-      "package-product-members": [
-        {
-          "product-name": "SecretAgentKit",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "XPCWrappers",
-          "build-phase": { "build-phase": "frameworks" },
-        },
-      ],
-      "build-settings": {
-        "CLANG_CXX_LANGUAGE_STANDARD": "gnu++20",
-        "CODE_SIGN_ENTITLEMENTS": "SecretAgentInputParser/SecretAgentInputParser.entitlements",
-        "CODE_SIGN_IDENTITY[config=Debug]": "Apple Development",
-        "CODE_SIGN_IDENTITY[config=Release]": "Developer ID Application",
-        "CODE_SIGN_STYLE[config=Debug]": "Automatic",
-        "CODE_SIGN_STYLE[config=Release]": "Manual",
-        "CODE_SIGN_STYLE[config=Test]": "Automatic",
-        "COMBINE_HIDPI_IMAGES": "YES",
-        "CURRENT_PROJECT_VERSION": "1",
-        "DEVELOPMENT_TEAM[config=Debug]": "$(SECRETIVE_DEVELOPMENT_TEAM)",
-        "DEVELOPMENT_TEAM[config=Release]": "",
-        "DEVELOPMENT_TEAM[config=Release][sdk=macosx*]": "$(SECRETIVE_DEVELOPMENT_TEAM)",
-        "ENABLE_APP_SANDBOX": "YES",
-        "ENABLE_HARDENED_RUNTIME": "YES",
-        "GCC_C_LANGUAGE_STANDARD": "gnu17",
-        "GENERATE_INFOPLIST_FILE": "YES",
-        "INFOPLIST_FILE": "SecretAgentInputParser/Info.plist",
-        "INFOPLIST_KEY_CFBundleDisplayName": "SecretAgentInputParser",
-        "INFOPLIST_KEY_NSHumanReadableCopyright": "Copyright © 2025 Max Goedjen. All rights reserved.",
-        "LOCALIZATION_PREFERS_STRING_CATALOGS": "YES",
-        "MARKETING_VERSION": "1.0",
-        "PRODUCT_BUNDLE_IDENTIFIER": "$(SECRETIVE_BASE_BUNDLE_ID).SecretAgentInputParser",
-        "PRODUCT_NAME": "$(TARGET_NAME)",
-        "PROVISIONING_PROFILE_SPECIFIER[config=Release]": "",
-        "REGISTER_APP_GROUPS": "YES",
-        "SKIP_INSTALL": "YES",
-        "STRING_CATALOG_GENERATE_SYMBOLS": "YES",
-        "SWIFT_ACTIVE_COMPILATION_CONDITIONS[config=Debug]": "DEBUG $(inherited)",
-        "SWIFT_APPROACHABLE_CONCURRENCY": "YES",
-        "SWIFT_EMIT_LOC_STRINGS": "YES",
-        "SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY": "YES",
-        "SWIFT_VERSION": "5.0",
-      },
-    }, {
-      "name": "SecretAgentHostsfileReader",
-      "id": "5054028C3034B5E3000C3356",
-      "product": "Products/SecretAgentHostsfileReader.xpc",
-      "product-type": "xpc-service",
-      "dependencies": [
-        { "kind": "package", "product-name": "SSHProtocolKit" },
-        { "kind": "package", "product-name": "XPCWrappers" },
-      ],
-      "build-phases": [
-        "compile-sources",
-        "frameworks",
-        "resources",
-      ],
-      "package-product-members": [
-        {
-          "product-name": "SSHProtocolKit",
-          "build-phase": { "build-phase": "frameworks" },
-        }, {
-          "product-name": "XPCWrappers",
-          "build-phase": { "build-phase": "frameworks" },
-        },
-      ],
-      "build-settings": {
-        "CLANG_CXX_LANGUAGE_STANDARD": "gnu++20",
-        "CODE_SIGN_ENTITLEMENTS": "SecretAgentHostsfileReader/SecretAgentHostsfileReader.entitlements",
-        "CODE_SIGN_IDENTITY[config=Debug]": "Apple Development",
-        "CODE_SIGN_IDENTITY[config=Release]": "Developer ID Application",
-        "CODE_SIGN_STYLE[config=Debug]": "Automatic",
-        "CODE_SIGN_STYLE[config=Release]": "Manual",
-        "CODE_SIGN_STYLE[config=Test]": "Automatic",
-        "COMBINE_HIDPI_IMAGES": "YES",
-        "CURRENT_PROJECT_VERSION": "1",
-        "DEVELOPMENT_TEAM[config=Debug]": "$(SECRETIVE_DEVELOPMENT_TEAM)",
-        "DEVELOPMENT_TEAM[config=Release]": "",
-        "DEVELOPMENT_TEAM[config=Release][sdk=macosx*]": "Z72PRUAWF6",
-        "ENABLE_APP_SANDBOX": "NO",
-        "ENABLE_HARDENED_RUNTIME": "YES",
-        "GCC_C_LANGUAGE_STANDARD": "gnu17",
-        "GENERATE_INFOPLIST_FILE": "YES",
-        "INFOPLIST_FILE": "SecretAgentHostsfileReader/Info.plist",
-        "INFOPLIST_KEY_CFBundleDisplayName": "SecretAgentHostsfileReader",
-        "INFOPLIST_KEY_NSHumanReadableCopyright": "Copyright © 2026 Max Goedjen. All rights reserved.",
-        "LOCALIZATION_PREFERS_STRING_CATALOGS": "YES",
-        "MARKETING_VERSION": "1.0",
-        "PRODUCT_BUNDLE_IDENTIFIER": "$(SECRETIVE_BASE_BUNDLE_ID).SecretAgentHostsfileReader",
-        "PRODUCT_NAME": "$(TARGET_NAME)",
-        "PROVISIONING_PROFILE_SPECIFIER[config=Release]": "",
-        "REGISTER_APP_GROUPS": "YES",
-        "SKIP_INSTALL": "YES",
-        "STRING_CATALOG_GENERATE_SYMBOLS": "YES",
-        "SWIFT_ACTIVE_COMPILATION_CONDITIONS[config=Debug]": "DEBUG $(inherited)",
-        "SWIFT_APPROACHABLE_CONCURRENCY": "YES",
-        "SWIFT_EMIT_LOC_STRINGS": "YES",
-        "SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY": "YES",
-        "SWIFT_VERSION": "5.0",
-      },
-    },
-  ],
-  "build-settings": {
-    "ALWAYS_SEARCH_USER_PATHS": "NO",
-    "ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS": "YES",
-    "CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED": "YES",
-    "CLANG_ANALYZER_NONNULL": "YES",
-    "CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION": "YES_AGGRESSIVE",
-    "CLANG_CXX_LANGUAGE_STANDARD": "gnu++14",
-    "CLANG_CXX_LIBRARY": "libc++",
-    "CLANG_ENABLE_MODULES": "YES",
-    "CLANG_ENABLE_OBJC_ARC": "YES",
-    "CLANG_ENABLE_OBJC_WEAK": "YES",
-    "CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING": "YES",
-    "CLANG_WARN_BOOL_CONVERSION": "YES",
-    "CLANG_WARN_COMMA": "YES",
-    "CLANG_WARN_CONSTANT_CONVERSION": "YES",
-    "CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS": "YES",
-    "CLANG_WARN_DIRECT_OBJC_ISA_USAGE": "YES_ERROR",
-    "CLANG_WARN_DOCUMENTATION_COMMENTS": "YES",
-    "CLANG_WARN_EMPTY_BODY": "YES",
-    "CLANG_WARN_ENUM_CONVERSION": "YES",
-    "CLANG_WARN_INFINITE_RECURSION": "YES",
-    "CLANG_WARN_INT_CONVERSION": "YES",
-    "CLANG_WARN_NON_LITERAL_NULL_CONVERSION": "YES",
-    "CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF": "YES",
-    "CLANG_WARN_OBJC_LITERAL_CONVERSION": "YES",
-    "CLANG_WARN_OBJC_ROOT_CLASS": "YES_ERROR",
-    "CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER": "YES",
-    "CLANG_WARN_RANGE_LOOP_ANALYSIS": "YES",
-    "CLANG_WARN_STRICT_PROTOTYPES": "YES",
-    "CLANG_WARN_SUSPICIOUS_MOVE": "YES",
-    "CLANG_WARN_UNGUARDED_AVAILABILITY": "YES_AGGRESSIVE",
-    "CLANG_WARN_UNREACHABLE_CODE": "YES",
-    "CLANG_WARN__DUPLICATE_METHOD_MATCH": "YES",
-    "COPY_PHASE_STRIP": "NO",
-    "DEAD_CODE_STRIPPING": "YES",
-    "DEBUG_INFORMATION_FORMAT[config=Debug]": "dwarf",
-    "DEBUG_INFORMATION_FORMAT[config=Release]": "dwarf-with-dsym",
-    "DEBUG_INFORMATION_FORMAT[config=Test]": "dwarf",
-    "ENABLE_ENHANCED_SECURITY": "YES",
-    "ENABLE_NS_ASSERTIONS[config=Release]": "NO",
-    "ENABLE_POINTER_AUTHENTICATION": "YES",
-    "ENABLE_STRICT_OBJC_MSGSEND": "YES",
-    "ENABLE_TESTABILITY[config=Debug]": "YES",
-    "ENABLE_TESTABILITY[config=Test]": "YES",
-    "ENABLE_USER_SCRIPT_SANDBOXING": "YES",
-    "GCC_C_LANGUAGE_STANDARD": "gnu11",
-    "GCC_DYNAMIC_NO_PIC[config=Debug]": "NO",
-    "GCC_DYNAMIC_NO_PIC[config=Test]": "NO",
-    "GCC_NO_COMMON_BLOCKS": "YES",
-    "GCC_OPTIMIZATION_LEVEL[config=Debug]": "0",
-    "GCC_OPTIMIZATION_LEVEL[config=Test]": "0",
-    "GCC_PREPROCESSOR_DEFINITIONS[config=Debug]": [
-      "DEBUG=1",
-      "$(inherited)",
-    ],
-    "GCC_PREPROCESSOR_DEFINITIONS[config=Test]": [
-      "DEBUG=1",
-      "$(inherited)",
-    ],
-    "GCC_WARN_64_TO_32_BIT_CONVERSION": "YES",
-    "GCC_WARN_ABOUT_RETURN_TYPE": "YES_ERROR",
-    "GCC_WARN_UNDECLARED_SELECTOR": "YES",
-    "GCC_WARN_UNINITIALIZED_AUTOS": "YES_AGGRESSIVE",
-    "GCC_WARN_UNUSED_FUNCTION": "YES",
-    "GCC_WARN_UNUSED_VARIABLE": "YES",
-    "MACOSX_DEPLOYMENT_TARGET": "15.0",
-    "MTL_ENABLE_DEBUG_INFO[config=Debug]": "INCLUDE_SOURCE",
-    "MTL_ENABLE_DEBUG_INFO[config=Release]": "NO",
-    "MTL_ENABLE_DEBUG_INFO[config=Test]": "INCLUDE_SOURCE",
-    "MTL_FAST_MATH": "YES",
-    "ONLY_ACTIVE_ARCH[config=Debug]": "YES",
-    "ONLY_ACTIVE_ARCH[config=Test]": "YES",
-    "OTHER_SWIFT_FLAGS": "",
-    "SDKROOT": "macosx",
-    "STRING_CATALOG_GENERATE_SYMBOLS": "YES",
-    "STRIP_INSTALLED_PRODUCT": "NO",
-    "STRIP_SWIFT_SYMBOLS": "NO",
-    "SWIFT_ACTIVE_COMPILATION_CONDITIONS[config=Debug]": "DEBUG",
-    "SWIFT_ACTIVE_COMPILATION_CONDITIONS[config=Test]": "DEBUG",
-    "SWIFT_COMPILATION_MODE[config=Release]": "wholemodule",
-    "SWIFT_EMIT_LOC_STRINGS": "YES",
-    "SWIFT_OPTIMIZATION_LEVEL[config=Debug]": "-Onone",
-    "SWIFT_OPTIMIZATION_LEVEL[config=Release]": "-O",
-    "SWIFT_OPTIMIZATION_LEVEL[config=Test]": "-Onone",
-    "SWIFT_STRICT_MEMORY_SAFETY": "YES",
-    "SWIFT_TREAT_WARNINGS_AS_ERRORS": "YES",
-    "SWIFT_VERSION": "6.0",
-  },
-  "last-upgrade": "27.0",
-  "last-swift-update": "27.0",
-}

Sources/Secretive.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings

@@ -4,7 +4,5 @@
 <dict>
 	<key>iOSPackagesShouldBuildARM64e</key>
 	<true/>
-		<key>macOSPackagesShouldBuildARM64e</key>
-		<true />
 </dict>
 </plist>

Sources/Secretive.xcodeproj/xcshareddata/xcschemes/PackageTests.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2640"
+   LastUpgradeVersion = "2600"
    version = "1.7">
    <BuildAction
       parallelizeBuildables = "YES"
@@ -14,8 +14,7 @@
       shouldUseLaunchSchemeArgsEnv = "YES">
       <TestPlans>
          <TestPlanReference
-            reference = "container:Config/Secretive.xctestplan"
+            reference = "container:Config/Secretive.xctestplan">
-            default = "YES">
          </TestPlanReference>
       </TestPlans>
    </TestAction>

Sources/Secretive.xcodeproj/xcshareddata/xcschemes/SecretAgent.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2640"
+   LastUpgradeVersion = "2600"
    version = "1.7">
    <BuildAction
       parallelizeBuildables = "YES"

Sources/Secretive.xcodeproj/xcshareddata/xcschemes/Secretive.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2640"
+   LastUpgradeVersion = "2600"
    version = "1.7">
    <BuildAction
       parallelizeBuildables = "YES"
@@ -87,9 +87,6 @@
             ReferencedContainer = "container:Secretive.xcodeproj">
          </BuildableReference>
       </BuildableProductRunnable>
-      <MetalAPIValidationSettings
-         isEnabled = "No">
-      </MetalAPIValidationSettings>
    </LaunchAction>
    <ProfileAction
       buildConfiguration = "Debug"

Sources/Secretive/App.swift

@@ -4,7 +4,6 @@ import SecureEnclaveSecretKit
 import SmartCardSecretKit
 import Brief
 import CertificateKit
-import SettingsKit
 
 @main
 struct Secretive: App {
@@ -17,7 +16,6 @@ struct Secretive: App {
             ContentView()
                 .environment(EnvironmentValues._secretStoreList)
                 .environment(EnvironmentValues._certificateStore)
-                .environment(EnvironmentValues._settingsStore)
                 .onReceive(NotificationCenter.default.publisher(for: NSApplication.didBecomeActiveNotification)) { _ in
                     Task {
                         @AppStorage("defaultsHasRunSetup") var hasRunSetup = false
@@ -27,7 +25,7 @@ struct Secretive: App {
                         guard !agentLaunchController.developmentBuild else { return }
                         if justUpdatedChecker.justUpdatedBuild || !agentLaunchController.running {
                             // Relaunch the agent, since it'll be running from earlier update still
-                            try? await agentLaunchController.forceLaunch()
+                            try await agentLaunchController.forceLaunch()
                         }
                     }
                 }
@@ -44,9 +42,6 @@ struct Secretive: App {
         }
         .windowStyle(.hiddenTitleBar)
         .windowResizability(.contentSize)
-        Settings {
-            SettingsView()
-        }
     }
 
 }
@@ -106,8 +101,7 @@ extension EnvironmentValues {
         return list
     }()
 
-    @MainActor fileprivate static let _certificateStore = CertificateStore()
+    @MainActor fileprivate static let _certificateStore: CertificateStore = CertificateStore()
-    @MainActor fileprivate static let _settingsStore = SettingsStore()
     
     private static let _agentLaunchController = AgentLaunchController()
     @Entry var agentLaunchController: any AgentLaunchControllerProtocol = _agentLaunchController
@@ -128,10 +122,6 @@ extension EnvironmentValues {
     @MainActor var certificateStore: CertificateStore {
         EnvironmentValues._certificateStore
     }
-
-    @MainActor var settingsStore: SettingsStore {
-        EnvironmentValues._settingsStore
-    }
 }
 
 extension FocusedValues {

Sources/Secretive/Controllers/XPCCertificateParser.swift

@@ -1,7 +1,7 @@
 import Foundation
 import OSLog
 import SSHProtocolKit
-import CertificateKit
+import Brief
 import XPCWrappers
 
 /// Delegates all agent input parsing to an XPC service which wraps OpenSSH

Sources/Secretive/Preview Content/PreviewStore.swift

@@ -1,6 +1,5 @@
 import Foundation
 import SecretKit
-import LocalAuthentication
 
 enum Preview {}
 
@@ -39,10 +38,17 @@ extension Preview {
             self.init(secrets: new)
         }
 
-        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?, context: LAContext?) async throws -> Data {
+        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
             return data
         }
 
+        func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
+            nil
+        }
+
+        func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws {
+        }
+
         func reloadSecrets() {
         }
 
@@ -76,10 +82,16 @@ extension Preview {
             self.init(secrets: new)
         }
 
-        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?, context: LAContext?) async throws -> Data {
+        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
             return data
         }
 
+        func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
+            nil
+        }
+
+        func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws {
+        }
 
         func reloadSecrets() {
         }

Sources/Secretive/Secretive.entitlements

@@ -4,22 +4,16 @@
 <dict>
 	<key>com.apple.security.hardened-process</key>
 	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.enable-pure-data</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.no-tagged-receive</key>
-	<true/>
 	<key>com.apple.security.hardened-process.dyld-ro</key>
 	<true/>
+	<key>com.apple.security.hardened-process.enhanced-security-version</key>
+	<integer>1</integer>
 	<key>com.apple.security.hardened-process.hardened-heap</key>
 	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
+	<key>com.apple.security.hardened-process.platform-restrictions</key>
-	<string>2</string>
+	<integer>2</integer>
 	<key>com.apple.security.smartcard</key>
 	<true/>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
-	<string>2</string>
 	<key>keychain-access-groups</key>
 	<array>
 		<string>$(AppIdentifierPrefix)com.maxgoedjen.Secretive</string>

Sources/Secretive/Views/Configuration/IntegrationsView.swift

@@ -28,8 +28,8 @@ struct IntegrationsView: View {
                 dismiss()
             }
         }
-        .toolbarBackgroundVisibility(.hidden, for: .automatic)
+        .hiddenToolbar()
-        .containerBackground(.thinMaterial, for: .window)
+        .windowBackgroundStyle(.thinMaterial)
         .onAppear {
             selectedInstruction = instructions.gettingStarted
         }

Sources/Secretive/Views/Configuration/ToolConfigurationView.swift

@@ -1,7 +1,6 @@
 import SwiftUI
 import SecretKit
 import SSHProtocolKit
-import Common
 
 struct ToolConfigurationView: View {
 
@@ -113,9 +112,10 @@ struct ToolConfigurationView: View {
         let writer = OpenSSHPublicKeyWriter()
         let gitAllowedSignersString = [email.isEmpty ? String(localized: .integrationsConfigureUsingEmailPlaceholder) : email, writer.openSSHString(secret: selectedSecret)]
             .joined(separator: " ")
+        let fileController = PublicKeyFileStoreController(homeDirectory: URL.agentHomeURL)
         return text
             .replacingOccurrences(of: Instructions.Constants.publicKeyPlaceholder, with: gitAllowedSignersString)
-            .replacingOccurrences(of: Instructions.Constants.publicKeyPathPlaceholder, with: URL.publicKeyPath(for: selectedSecret, in: URL.publicKeyDirectory))
+            .replacingOccurrences(of: Instructions.Constants.publicKeyPathPlaceholder, with: fileController.publicKeyPath(for: selectedSecret))
     }
 
 }

Sources/Secretive/Views/Modifiers/ActionButtonStyle.swift

@@ -1,11 +1,11 @@
 import SwiftUI
 
-public struct PrimaryButtonModifier: ViewModifier {
+struct PrimaryButtonModifier: ViewModifier {
 
     @Environment(\.colorScheme) var colorScheme
     @Environment(\.isEnabled) var isEnabled
 
-    public func body(content: Content) -> some View {
+    func body(content: Content) -> some View {
         // Tinted glass prominent is really hard to read on 26.0.
         if #available(macOS 26.0, *), colorScheme == .dark, isEnabled {
             content.buttonStyle(.glassProminent)
@@ -18,15 +18,15 @@ public struct PrimaryButtonModifier: ViewModifier {
 
 extension View {
 
-    public func primaryButton() -> some View {
+    func primaryButton() -> some View {
         modifier(PrimaryButtonModifier())
     }
 
 }
 
-public struct ToolbarCircleButtonModifier: ViewModifier {
+struct ToolbarCircleButtonModifier: ViewModifier {
 
-    public func body(content: Content) -> some View {
+    func body(content: Content) -> some View {
         if #available(macOS 26.0, *) {
             content
                 .glassEffect(.regular.tint(.white.opacity(0.1)), in: .circle)
@@ -40,15 +40,15 @@ public struct ToolbarCircleButtonModifier: ViewModifier {
 
 extension View {
 
-    public func toolbarCircleButton() -> some View {
+    func toolbarCircleButton() -> some View {
         modifier(ToolbarCircleButtonModifier())
     }
 
 }
 
-public struct NormalButtonModifier: ViewModifier {
+struct NormalButtonModifier: ViewModifier {
 
-    public func body(content: Content) -> some View {
+    func body(content: Content) -> some View {
         if #available(macOS 26.0, *) {
             content.buttonStyle(.glass)
         } else {
@@ -60,17 +60,17 @@ public struct NormalButtonModifier: ViewModifier {
 
 extension View {
 
-    public func normalButton() -> some View {
+    func normalButton() -> some View {
         modifier(NormalButtonModifier())
     }
 
 }
 
-public struct DangerButtonModifier: ViewModifier {
+struct DangerButtonModifier: ViewModifier {
 
     @Environment(\.colorScheme) var colorScheme
 
-    public func body(content: Content) -> some View {
+    func body(content: Content) -> some View {
         // Tinted glass prominent is really hard to read on 26.0.
         if #available(macOS 26.0, *), colorScheme == .dark {
             content.buttonStyle(.glassProminent)
@@ -87,7 +87,7 @@ public struct DangerButtonModifier: ViewModifier {
 
 extension View {
 
-    public func danger() -> some View {
+    func danger() -> some View {
         modifier(DangerButtonModifier())
     }
 

Sources/Secretive/Views/Modifiers/WindowBackgroundStyle.swift

@@ -0,0 +1,47 @@
+import SwiftUI
+
+struct WindowBackgroundStyleModifier: ViewModifier {
+
+    let shapeStyle: any ShapeStyle
+
+    func body(content: Content) -> some View {
+        if #available(macOS 15.0, *) {
+            content
+                .containerBackground(
+                    shapeStyle, for: .window
+                )
+        } else {
+            content
+        }
+    }
+
+}
+
+extension View {
+
+    func windowBackgroundStyle(_ style: some ShapeStyle) -> some View {
+        modifier(WindowBackgroundStyleModifier(shapeStyle: style))
+    }
+
+}
+
+struct HiddenToolbarModifier: ViewModifier {
+
+    func body(content: Content) -> some View {
+        if #available(macOS 15.0, *) {
+            content
+                .toolbarBackgroundVisibility(.hidden, for: .automatic)
+        } else {
+            content
+        }
+    }
+
+}
+
+extension View {
+
+    func hiddenToolbar() -> some View {
+        modifier(HiddenToolbarModifier())
+    }
+
+}

Sources/Secretive/Views/Secrets/CertificateDetailView.swift

@@ -1,93 +0,0 @@
-import SwiftUI
-import SecretKit
-import Common
-import CertificateKit
-import SSHProtocolKit
-import CryptoKit
-struct CertificateDetailView: View {
-
-    let certificate: Certificate
-
-    var body: some View {
-        ScrollView {
-            Form {
-                Section {
-                    CopyableView(
-                        title: .certificateDetailKeyIdLabel,
-                        image: Image(systemName: "person.text.rectangle"),
-                        text: certificate.keyID
-                    )
-                    Spacer()
-                        .frame(height: 20)
-                    CopyableView(
-                        title: .certificateDetailSerialLabel,
-                        image: Image(systemName: "number.circle"),
-                        text: certificate.serial.formatted()
-                    )
-                    Spacer()
-                        .frame(height: 20)
-                    CopyableView(
-                        title: .secretDetailSha256FingerprintLabel,
-                        image: Image(systemName: "touchid"),
-                        text: OpenSSHCertificateWriter().openSSHSHA256KeyFingerprint(publicKey: certificate.publicKey)
-                    )
-                    Spacer()
-                        .frame(height: 20)
-                    CopyableView(
-                        title: .secretDetailSha256FingerprintLabel,
-                        image: Image(systemName: "touchid"),
-                        text: OpenSSHCertificateWriter().openSSHSHA256KeyFingerprint(publicKey: certificate.signingKey)
-                    )
-                    Spacer()
-                        .frame(height: 20)
-                    CopyableView(
-                        title: .certificateDetailPathLabel,
-                        image: Image(systemName: "checkmark.seal.text.page"),
-                        text: URL.certificatePath(for: certificate.id, in: URL.certificatesDirectory),
-                        showRevealInFinder: true
-                    )
-                    if let validityRange = certificate.validityRange {
-                        let epoch = Date(timeIntervalSince1970: 0)
-                        let end = Date(timeIntervalSince1970: TimeInterval(UInt64.max))
-                        switch (validityRange.lowerBound, validityRange.upperBound) {
-                        case (epoch, end):
-                            EmptyView()
-                        case (epoch, let otherEnd):
-                            Spacer()
-                                .frame(height: 20)
-                            MultilineInfoView(title: .certificateDetailValidUntilLabel, image: Image(systemName: "calendar.badge.clock"), items: [otherEnd.formatted()])
-                        case (let otherStart, end):
-                            Spacer()
-                                .frame(height: 20)
-                            MultilineInfoView(title: .certificateDetailValidAfterLabel, image: Image(systemName: "calendar.badge.clock"), items: [otherStart.formatted()])
-                        default:
-                            Spacer()
-                                .frame(height: 20)
-                            MultilineInfoView(title: .certificateDetailValidityRangeLabel, image: Image(systemName: "calendar.badge.clock"), items: [validityRange.formatted()])
-                        }
-                    }
-                    if !certificate.principals.isEmpty {
-                        Spacer()
-                            .frame(height: 20)
-                        MultilineInfoView(title: .certificateDetailPrincipalsLabel, image: Image(systemName: "person.2"), items: certificate.principals)
-                    }
-                    if !certificate.criticalOptions.isEmpty {
-                        Spacer()
-                            .frame(height: 20)
-                        MultilineInfoView(title: .certificateDetailCriticalOptionsLabel, image: Image(systemName: "person.2"), items: certificate.criticalOptions)
-                    }
-                    if !certificate.extensions.isEmpty {
-                        Spacer()
-                            .frame(height: 20)
-                        MultilineInfoView(title: .certificateDetailExtensionsLabel, image: Image(systemName: "person.2"), items: certificate.extensions)
-                    }
-                    Spacer()
-                }
-            }
-            .padding()
-        }
-        .frame(minHeight: 200, maxHeight: .infinity)
-    }
-
-
-}

Sources/Secretive/Views/Secrets/CertificateListItemView.swift

@@ -1,42 +0,0 @@
-import SwiftUI
-import CertificateKit
-import SSHProtocolKit
-
-struct CertificateListItemView: View {
-
-    @Environment(\.certificateStore) private var store
-
-    var certificate: Certificate
-
-    @State var isDeleting: Bool = false
-    @State var isRenaming: Bool = false
-
-    var deletedCertificate: (Certificate) -> Void
-    var renamedCertificate: (Certificate) -> Void
-
-    var body: some View {
-        NavigationLink(value: certificate) {
-            Text(certificate.name)
-        }
-        .sheet(isPresented: $isRenaming, onDismiss: {
-            renamedCertificate(certificate)
-        }, content: {
-            EditCertificateView(store: store, certificate: certificate)
-        })
-        .showingDeleteConfirmation(isPresented: $isDeleting, certificate, store) { deleted in
-            if deleted {
-                deletedCertificate(certificate)
-            }
-        }
-        .contextMenu {
-                Button(action: { isRenaming = true }) {
-                    Image(systemName: "pencil")
-                    Text(.secretListEditButton)
-                }
-                Button(action: { isDeleting = true }) {
-                    Image(systemName: "trash")
-                    Text(.secretListDeleteButton)
-                }
-        }
-    }
-}

Sources/Secretive/Views/Secrets/DeleteCertificateView.swift

@@ -1,52 +0,0 @@
-import SwiftUI
-import CertificateKit
-import SSHProtocolKit
-
-extension View {
-
-    func showingDeleteConfirmation(isPresented: Binding<Bool>, _ certificate: Certificate,  _ store: CertificateStore, dismissalBlock: @escaping (Bool) -> ()) -> some View {
-        modifier(DeleteCertificateConfirmationModifier(isPresented: isPresented, certificate: certificate, store: store, dismissalBlock: dismissalBlock))
-    }
-
-}
-
-struct DeleteCertificateConfirmationModifier: ViewModifier {
-
-    var isPresented: Binding<Bool>
-    var certificate: Certificate
-    var store: CertificateStore
-    var dismissalBlock: (Bool) -> ()
-    @State var confirmedSecretName = ""
-    @State private var errorText: String?
-
-    func body(content: Content) -> some View {
-        content
-            .confirmationDialog(
-                String(localized: .deleteConfirmationTitle(name: certificate.name)),
-                isPresented: isPresented,
-                titleVisibility: .visible,
-                actions: {
-                    Button(.deleteConfirmationDeleteButton, action: delete)
-                    Button(.deleteConfirmationCancelButton, role: .cancel) {
-                        dismissalBlock(false)
-                    }
-                },
-            )
-            .dialogIcon(Image(systemName: "lock.trianglebadge.exclamationmark.fill"))
-            .onExitCommand {
-                dismissalBlock(false)
-            }
-    }
-
-    func delete() {
-        Task {
-            do {
-                try store.delete(certificate: certificate)
-                dismissalBlock(true)
-            } catch {
-                errorText = error.localizedDescription
-            }
-        }
-    }
-
-}

Sources/Secretive/Views/Secrets/DeleteSecretView.swift

@@ -21,7 +21,7 @@ struct DeleteSecretConfirmationModifier: ViewModifier {
     func body(content: Content) -> some View {
         content
             .confirmationDialog(
-                .deleteConfirmationTitle(name: secret.name),
+                .deleteConfirmationTitle(secretName: secret.name),
                 isPresented: isPresented,
                 titleVisibility: .visible,
                 actions: {

Sources/Secretive/Views/Secrets/EditCertificateView.swift

@@ -1,60 +0,0 @@
-import SwiftUI
-import SSHProtocolKit
-import CertificateKit
-
-struct EditCertificateView: View {
-
-    let store: CertificateStore
-    let certificate: Certificate
-
-    @State private var name: String
-    @State var errorText: String?
-
-    @Environment(\.dismiss) var dismiss
-
-    init(store: CertificateStore, certificate: Certificate) {
-        self.store = store
-        self.certificate = certificate
-        name = certificate.name
-    }
-
-    var body: some View {
-        VStack(alignment: .trailing) {
-            Form {
-                Section {
-                    TextField(String(localized: .renameCertificateLabel), text: $name, prompt: Text(.renameCertificateNamePlaceholder))
-                } footer: {
-                    if let errorText {
-                        Text(verbatim: errorText)
-                            .errorStyle()
-                    }
-                }
-            }
-            HStack {
-                Button(.editCancelButton) {
-                    dismiss()
-                }
-                .keyboardShortcut(.cancelAction)
-                Button(.editSaveButton, action: rename)
-                    .disabled(name.isEmpty)
-                    .keyboardShortcut(.return)
-                    .primaryButton()
-            }
-            .padding()
-        }
-        .formStyle(.grouped)
-    }
-
-    func rename() {
-        Task {
-            do {
-                var updated = certificate
-                updated.openSSHCertificate.name = name
-                try store.update(certificate: updated)
-                dismiss()
-            } catch {
-                errorText = error.localizedDescription
-            }
-        }
-    }
-}

Sources/Secretive/Views/Secrets/SecretDetailView.swift

@@ -1,60 +1,28 @@
 import SwiftUI
 import SecretKit
-import Common
-import CertificateKit
 import SSHProtocolKit
 
 struct SecretDetailView<SecretType: Secret>: View {
     
     let secret: SecretType
-    let certificates: [Certificate]
-    let navigateToCertificate: ((Certificate) -> Void)?
 
     private let keyWriter = OpenSSHPublicKeyWriter()
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: URL.agentHomeURL)
 
     var body: some View {
         ScrollView {
             Form {
                 Section {
-                    CopyableView(
+                    CopyableView(title: .secretDetailSha256FingerprintLabel, image: Image(systemName: "touchid"), text: keyWriter.openSSHSHA256Fingerprint(secret: secret))
-                        title: .secretDetailSha256FingerprintLabel,
-                        image: Image(systemName: "touchid"),
-                        text: keyWriter.openSSHSHA256Fingerprint(secret: secret)
-                    )
                     Spacer()
                         .frame(height: 20)
-                    CopyableView(
+                    CopyableView(title: .secretDetailMd5FingerprintLabel, image: Image(systemName: "touchid"), text: keyWriter.openSSHMD5Fingerprint(secret: secret))
-                        title: .secretDetailMd5FingerprintLabel,
-                        image: Image(systemName: "touchid"),
-                        text: keyWriter.openSSHMD5Fingerprint(secret: secret)
-                    )
                     Spacer()
                         .frame(height: 20)
-                    CopyableView(
+                    CopyableView(title: .secretDetailPublicKeyLabel, image: Image(systemName: "key"), text: keyString)
-                        title: .secretDetailPublicKeyLabel,
-                        image: Image(systemName: "key"),
-                        text: keyWriter.openSSHString(secret: secret)
-                    )
                     Spacer()
                         .frame(height: 20)
-                    CopyableView(
+                    CopyableView(title: .secretDetailPublicKeyPathLabel, image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.publicKeyPath(for: secret), showRevealInFinder: true)
-                        title: .secretDetailPublicKeyPathLabel,
-                        image: Image(systemName: "lock.doc"),
-                        text: URL.publicKeyPath(for: secret, in: URL.publicKeyDirectory),
-                        showRevealInFinder: true
-                    )
-                    if !certificates.isEmpty {
-                        Spacer()
-                            .frame(height: 20)
-                        MultilineInfoView(title: .secretDetailCertificatePathLabel, image: Image(systemName: "checkmark.seal.text.page")) {
-                            ForEach(certificates) { certificate in
-                                Text(certificate.name)
-                                    .multilineItemAction(image: Image(systemName: "chevron.forward")) {
-                                        navigateToCertificate?(certificate)
-                                    }
-                            }
-                        }
-                    }
                     Spacer()
                 }
             }
@@ -64,6 +32,10 @@ struct SecretDetailView<SecretType: Secret>: View {
     }
 
 
+    var keyString: String {
+        keyWriter.openSSHString(secret: secret)
+    }
+
 }
 
 //#Preview {

Sources/Secretive/Views/Secrets/SettingsView.swift

@@ -1,14 +0,0 @@
-import SwiftUI
-import SettingsKit
-
-struct SettingsView: View {
-
-    @Environment(\.settingsStore) var settingsStore
-
-    var body: some View {
-        Form {
-        }
-        .padding()
-        .frame(minWidth: 480, minHeight: 320)
-    }
-}

Sources/Secretive/Views/Secrets/StoreListView.swift

@@ -1,33 +1,25 @@
 import SwiftUI
 import SecretKit
-import SSHProtocolKit
-import CertificateKit
 
 struct StoreListView: View {
 
-    enum StoreListSelection: Hashable {
+    @Binding var activeSecret: AnySecret?
-        case secret(AnySecret)
-        case certificate(Certificate)
-    }
-
-    @Binding var selection: StoreListSelection?
 
     @Environment(\.secretStoreList) private var storeList
-    @Environment(\.certificateStore) private var certificateStore
 
     private func secretDeleted(secret: AnySecret) {
-        selection = nextDefaultSecret.map(StoreListSelection.secret)
+        activeSecret = nextDefaultSecret
     }
 
     private func secretRenamed(secret: AnySecret) {
         // Pull new version from store, so we get all updated attributes
-        selection = nil
+        activeSecret = nil
-        selection = storeList.allSecrets.first(where: { $0.id == secret.id }).map(StoreListSelection.secret)
+        activeSecret = storeList.allSecrets.first(where: { $0.id == secret.id })
     }
 
     var body: some View {
         NavigationSplitView {
-            List(selection: $selection) {
+            List(selection: $activeSecret) {
                 ForEach(storeList.stores) { store in
                     if store.isAvailable {
                         Section(header: Text(store.name)) {
@@ -38,39 +30,18 @@ struct StoreListView: View {
                                     deletedSecret: secretDeleted,
                                     renamedSecret: secretRenamed,
                                 )
-                                .tag(StoreListSelection.secret(secret))
                             }
                         }
                     }
                 }
-                if !certificateStore.certificates.isEmpty {
-                    Section(.certificatesSectionTitle) {
-                        ForEach(certificateStore.certificates) { certificate in
-                            CertificateListItemView(
-                                certificate: certificate,
-                                deletedCertificate: { _ in },
-                                renamedCertificate: { _ in }
-                            )
-                            .tag(StoreListSelection.certificate(certificate))
-                        }
-                    }
-                }
             }
         } detail: {
-            switch selection {
+            if let activeSecret {
-            case .secret(let secret):
+                SecretDetailView(secret: activeSecret)
-                SecretDetailView(secret: secret, certificates: certificateStore.certificates(for: secret)) {
+            } else if let nextDefaultSecret {
-                    selection = .certificate($0)
-                }
-            case .certificate(let certificate):
-                CertificateDetailView(certificate: certificate)
-            case nil:
-                if let nextDefaultSecret {
                 // This just means onAppear hasn't executed yet.
                 // Do this to avoid a blip.
-                    SecretDetailView(secret: nextDefaultSecret, certificates: certificateStore.certificates(for: nextDefaultSecret)) {
+                SecretDetailView(secret: nextDefaultSecret)
-                        selection = .certificate($0)
-                    }
             } else {
                 if let modifiable = storeList.modifiableStore, modifiable.isAvailable {
                     EmptyStoreView(store: modifiable)
@@ -79,10 +50,9 @@ struct StoreListView: View {
                 }
             }
         }
-        }
         .navigationSplitViewStyle(.balanced)
         .onAppear {
-            selection = nextDefaultSecret.map(StoreListSelection.secret)
+            activeSecret = nextDefaultSecret
         }
         .frame(minWidth: 100, idealWidth: 240)
 

Sources/Secretive/Views/Views/AboutView.swift

@@ -2,10 +2,14 @@ import SwiftUI
 
 struct AboutView: View {
     var body: some View {
+        if #available(macOS 15.0, *) {
             AboutViewContent()
                 .containerBackground(
                     .thinMaterial, for: .window
                 )
+        } else {
+            AboutViewContent()
+        }
     }
 }
 

Sources/Secretive/Views/Views/AgentStatusView.swift

@@ -101,7 +101,7 @@ struct AgentNotRunningView: View {
                                 guard !loading else { return }
                                 loading = true
                                 Task {
-                                    try? await agentLaunchController.forceLaunch()
+                                    try await agentLaunchController.forceLaunch()
                                     loading = false
 
                                     if !agentLaunchController.running {