Clear needs review.

* Update macOS version in GitHub Actions workflow

* Update macOS version in release workflow

* Update macOS version for nightly workflow

* Fix runner OS for Swift in CodeQL workflow

.github/workflows/add-to-project.yml

@@ -1,16 +0,0 @@
-name: Add bugs to bugs project
-
-on:
-  issues:
-    types:
-      - opened
-
-jobs:
-  add-to-project:
-    name: Add issue to project
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/add-to-project@v1.0.1
-        with:
-          project-url: https://github.com/users/maxgoedjen/projects/1
-          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/codeql.yml

@@ -0,0 +1,47 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '26 15 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-26') || 'ubuntu-latest' }}
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        # Disable this until CodeQL supports Xcode 26 builds.
+        # - language: swift
+        #   build-mode: manual
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+    - if: matrix.build-mode == 'manual'
+      name: "Select Xcode"
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
+    - if: matrix.build-mode == 'manual'
+      name: "Build"
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/nightly.yml

@@ -3,10 +3,15 @@ name: Nightly
 on: 
   schedule: 
     - cron: "0 8 * * *"
+  workflow_dispatch:
+  
 jobs:
   build:
-#     runs-on: macOS-latest
+    runs-on: macos-26
-    runs-on: macos-15
+    permissions:
+      id-token: write
+      contents: write
+      attestations: write
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v5
@@ -25,27 +30,29 @@ jobs:
       env:
         RUN_ID: ${{ github.run_id }}
       run: |
-            sed -i '' -e "s/GITHUB_CI_VERSION/0.0.0/g" Sources/Config/Config.xcconfig
+            DATE=$(date "+%Y-%m-%d")
+            sed -i '' -e "s/GITHUB_CI_VERSION/0.0.0_nightly-$DATE/g" Sources/Config/Config.xcconfig
             sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
             sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Secretive/Credits.rtf
     - name: Build
       run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Create ZIPs
+    - name: Create ZIP
       run: |
             ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
-            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Archive.zip
     - name: Notarize
       env: 
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
         APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
       run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
-    - name: Attest
-      id: attest
-      uses: actions/attest-build-provenance@v2
-      with:
-        subject-path: 'Secretive.zip'
     - name: Upload App to Artifacts
+      id: upload
       uses: actions/upload-artifact@v4
       with:
         name: Secretive.zip
         path: Secretive.zip
+    - name: Attest
+      id: attest
+      uses: actions/attest-build-provenance@v2
+      with:
+        subject-name: "Secretive.zip"
+        subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}

.github/workflows/release.yml

@@ -6,8 +6,9 @@ on:
       - '*'
 jobs:
   test:
-#     runs-on: macOS-latest
+    permissions:
-    runs-on: macos-15
+        contents: read
+    runs-on: macos-26
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v5
@@ -23,14 +24,15 @@ jobs:
     - name: Set Environment
       run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
     - name: Test
-      run: swift build --build-system swiftbuild --package-path Sources/Packages
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme PackageTests test
+      # SPM doesn't seem to pick up on the tests currently?
+      # run: swift test --build-system swiftbuild --package-path Sources/Packages
   build:
-#     runs-on: macOS-latest
-    runs-on: macos-15
     permissions:
       id-token: write
       contents: write
       attestations: write
+    runs-on: macos-26
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v5
@@ -56,39 +58,34 @@ jobs:
             sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Secretive/Credits.rtf
     - name: Build
       run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Create ZIPs
+    - name: Create ZIP
       run: |
             ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
-            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Xcode_Archive.zip
     - name: Notarize
       env: 
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
         APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
       run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
+    - name: Upload App to Artifacts
+      id: upload
+      uses: actions/upload-artifact@v4
+      with:
+        name: Secretive.zip
+        path: Secretive.zip
     - name: Attest
       id: attest
       uses: actions/attest-build-provenance@v2
       with:
-        subject-path: 'Secretive.zip, Xcode_Archive.zip'
+        subject-name: "Secretive.zip"
+        subject-digest: ${{ steps.upload.outputs.artifact-digest }}
     - name: Create Release
       run: |
             sed -i.tmp "s/RUN_ID/$RUN_ID/g" .github/templates/release.md
             sed -i.tmp "s/ATTESTATION_ID/$ATTESTATION_ID/g" .github/templates/release.md
             gh release create $TAG_NAME -d -F .github/templates/release.md
             gh release upload Secretive.zip
-            gh release upload Xcode_Archive.zip
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         TAG_NAME: ${{ github.ref }}
         RUN_ID: ${{ github.run_id }}
         ATTESTATION_ID: ${{ steps.attest.outputs.attestation-id }}
-    - name: Upload App to Artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: Secretive.zip
-        path: Secretive.zip
-    - name: Upload Archive to Artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: Xcode_Archive.zip
-        path: Xcode_Archive.zip

.github/workflows/test.yml

@@ -3,12 +3,17 @@ name: Test
 on: [push, pull_request]
 jobs:
   test:
-#     runs-on: macOS-latest
+    permissions:
-    runs-on: macos-15
+        contents: read
+    runs-on: macos-26
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v5
     - name: Set Environment
       run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
-    - name: Test
+    - name: Test Main Packages
-      run: swift build --build-system swiftbuild --package-path Sources/Packages
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme PackageTests test
+      # SPM doesn't seem to pick up on the tests currently?
+      # run: swift test --build-system swiftbuild --package-path Sources/Packages
+    - name: Test SecretKit Packages
+      run: swift test --build-system swiftbuild

APP_CONFIG.md

@@ -1,125 +1,3 @@
-# Setting up Third Party Apps FAQ
+# App Configuration
 
-## Tower
+Instructions for setting up apps and shells has moved to [secretive-config-instructions](https://github.com/maxgoedjen/secretive-config-instructions)!
-
-Tower provides [instructions](https://www.git-tower.com/help/mac/integration/environment).
-
-## GitHub Desktop
-
-Should just work, no configuration needed
-
-## Fork
-
-Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
-
-```
-Host *
-	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
-```
-
-## VS Code
-
-Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
-
-```
-Host *
-	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
-```
-
-## nushell
-
-Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
-
-```
-Host *
-	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
-```
-
-## Cyberduck
-
-Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
-
-```
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>link-ssh-auth-sock</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>/bin/sh</string>
-    <string>-c</string>
-    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
-  </array>
-  <key>RunAtLoad</key>
-  <true/>
-</dict>
-</plist>
-```
-
-Log out and log in again before launching Cyberduck.
-
-## Mountain Duck
-
-Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
-
-```
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>link-ssh-auth-sock</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>/bin/sh</string>
-    <string>-c</string>
-    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
-  </array>
-  <key>RunAtLoad</key>
-  <true/>
-</dict>
-</plist>
-```
-
-Log out and log in again before launching Mountain Duck.
-
-## GitKraken
-
-Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
-
-```
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>link-ssh-auth-sock</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>/bin/sh</string>
-    <string>-c</string>
-    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
-  </array>
-  <key>RunAtLoad</key>
-  <true/>
-</dict>
-</plist>
-```
-
-Log out and log in again before launching Gitkraken. Then enable "Use local SSH agent in GitKraken Preferences (Located under Preferences -> SSH)
-
-## Retcon
-
-Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
-
-```
-Host *
-	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
-```
-
-# The app I use isn't listed here!
-
-If you know how to get it set up, please open a PR for this page and add it! Contributions are very welcome.
-If you're not able to get it working, please file a [GitHub issue](https://github.com/maxgoedjen/secretive/issues/new) for it. No guarantees we'll be able to get it working, but chances are someone else in the community might be able to.

FAQ.md

@@ -6,7 +6,7 @@ The secure enclave doesn't allow import or export of private keys. For any new c
 
 ### Secretive doesn't work with my git client/app
 
-Secretive relies on the `SSH_AUTH_SOCK` environment variable being respected. The `git` and `ssh` command line tools natively respect this, but third party apps may require some configuration to work. A non-exhaustive list of setup steps is provided in the [App Config FAQ](APP_CONFIG.md).
+Secretive relies on the `SSH_AUTH_SOCK` environment variable being respected. The `git` and `ssh` command line tools natively respect this, but third party apps may require some configuration to work. A non-exhaustive list of setup steps is provided in the [secretive-config-instructions](https://github.com/maxgoedjen/secretive-config-instructions) repo.
 
 ### Secretive isn't working for me
 

LOCALIZING.md

@@ -2,36 +2,35 @@
 
 If you speak another language, and would like to help translate Secretive to support that language, we'd love your help!
 
-## Getting Started
+## Crowdin
 
-### Download Xcode
+[Secretive uses Crowdin for localization](https://crowdin.com/project/secretive/). Open the link and select your language to translate!
 
-Download the latest version of Xcode (at minimum, Xcode 15) from [Apple](http://developer.apple.com/download/applications/).
+### Manual Translation
 
-### Clone Secretive
+Crowdin is the easiest way to translate Secretive, but I'm happy to accept Pull Requests directly as well.
-
-Clone Secretive using [these instructions from GitHub](https://docs.github.com/en/repositories/creating-and-managing-repositories/cloning-a-repository).
-
-### Open Secretive
-
-Open [Sources/Secretive.xcodeproj](Sources/Secretive.xcodeproj) in Xcode.
-
-### Translate
-
-Navigate to [Secretive/Localizable](Sources/Secretive/Localizable.xcstrings). 
-
-<img src="/.github/readme/localize_sidebar.png" alt="Screenshot of Xcode navigating to the Localizable file" width="300">
-
-If your language already has an in-progress localization, select it from the list. If it isn't there, hit the "+" button and choose your language from the list.
-
-<img src="/.github/readme/localize_add.png" alt="Screenshot of Xcode adding a new language" width="600">
-
-Start translating! You'll see a list of english phrases, and a space to add a translation of your language.
-
-### Create a Pull Request
-
-Push your changes and open a pull request. 
 
 ### Questions
 
 Please open an issue if you have a question about translating the app. I'm more than happy to clarify any terms that are ambiguous or confusing. Thanks for contributing!
+
+### Thank You
+
+Thanks to all the folks who have contributed localizations so far!
+
+- @mtardy for the French localization
+- @GravityRyu for the Chinese localization
+- @Saeger for the Portuguese (Brazil) localization
+- @moritzsternemann for the German localization
+- @RoboRich00A16 for the Italian localization
+- @akx for the Finnish localization
+- @mog422 for the Korean localization
+- @niw for the Japanese localization
+- @truita for the Catalan localization
+- @Adimac93 for the Polish localization
+- @alongotv for the Russian localization
+
+
+
+
+A special thanks to [Crowdin](https://crowdin.com) for their [generous support of open source projects](https://crowdin.com/page/open-source-project-setup-request).

Package.swift

@@ -1 +0,0 @@
-Sources/Packages/Package.swift

Package.swift

@@ -0,0 +1,69 @@
+// swift-tools-version:6.2
+// The swift-tools-version declares the minimum version of Swift required to build this package.
+
+import PackageDescription
+
+// This is basically the same package as `Sources/Packages/Package.swift`, but thinned slightly.
+// Ideally this would be the same package, but SPM requires it to be at the root of the project,
+// and Xcode does _not_ like that, so they're separate.
+let package = Package(
+    name: "SecretKit",
+    defaultLocalization: "en",
+    platforms: [
+        .macOS(.v14)
+    ],
+    products: [
+        .library(
+            name: "SecretKit",
+            targets: ["SecretKit"]),
+        .library(
+            name: "SecureEnclaveSecretKit",
+            targets: ["SecureEnclaveSecretKit"]),
+        .library(
+            name: "SmartCardSecretKit",
+            targets: ["SmartCardSecretKit"]),
+    ],
+    dependencies: [
+    ],
+    targets: [
+        .target(
+            name: "SecretKit",
+            dependencies: [],
+            path: "Sources/Packages/Sources/SecretKit",
+            resources: [localization],
+            swiftSettings: swiftSettings
+        ),
+        .testTarget(
+            name: "SecretKitTests",
+            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
+            path: "Sources/Packages/Tests/SecretKitTests",
+            swiftSettings: swiftSettings
+        ),
+        .target(
+            name: "SecureEnclaveSecretKit",
+            dependencies: ["SecretKit"],
+            path: "Sources/Packages/Sources/SecureEnclaveSecretKit",
+            resources: [localization],
+            swiftSettings: swiftSettings
+        ),
+        .target(
+            name: "SmartCardSecretKit",
+            dependencies: ["SecretKit"],
+            path: "Sources/Packages/Sources/SmartCardSecretKit",
+            resources: [localization],
+            swiftSettings: swiftSettings
+        ),
+    ]
+)
+
+var localization: Resource {
+    .process("../../Resources/Localizable.xcstrings")
+}
+
+var swiftSettings: [PackageDescription.SwiftSetting] {
+    [
+        .swiftLanguageMode(.v6),
+        // This freaks out Xcode in a dependency context.
+        // .treatAllWarnings(as: .error),
+    ]
+}

README.md

@@ -1,4 +1,4 @@
-# Secretive ![Test](https://github.com/maxgoedjen/secretive/workflows/Test/badge.svg) ![Release](https://github.com/maxgoedjen/secretive/workflows/Release/badge.svg)
+# Secretive [![Test](https://github.com/maxgoedjen/secretive/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/maxgoedjen/secretive/actions/workflows/test.yml) ![Release](https://github.com/maxgoedjen/secretive/workflows/Release/badge.svg)
 
 
 Secretive is an app for storing and managing SSH keys in the Secure Enclave. It is inspired by the [sekey project](https://github.com/sekey/sekey), but rewritten in Swift with no external dependencies and with a handy native management app.
@@ -61,4 +61,4 @@ Because secrets in the Secure Enclave are not exportable, they are not able to b
 
 ## Security
 
-If you discover any vulnerabilities in this project, please notify [max.goedjen@gmail.com](mailto:max.goedjen@gmail.com) with the subject containing "SECRETIVE SECURITY."
+Secretive's security policy is detailed in [SECURITY.md](SECURITY.md). To report security issues, please use [GitHub's private reporting feature.](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability)

SECURITY.md

@@ -1,9 +1,27 @@
 # Security Policy
 
+## Security Principles
+
+Secretive is designed with a few general tenets in mind:
+
+### It's Hard to Leak a Key Secretive Can't Read The Key Material
+
+Secretive only operates on hardware-backed keys. In general terms, this means that it should be _very_ hard for Secretive to have any sort of bug that causes a key to be shared, because Secretive can't access private key data even if it wants to.
+
+### Simplicity and Auditability
+
+Secretive won't expand to have every feature it could possibly have. Part of the goal of the app is that it is possible for consumers to reasonably audit the code, and that often means not implementing features that might be cool, but which would significantly inflate the size of the codebase.
+
+### Dependencies
+
+Both in support of the previous principle and to rule out supply chain attacks, Secretive does not rely on any third party dependencies. 
+
+There are limited exceptions to this, particularly in the build process, but the app itself does not depend on any third party code.
+
 ## Supported Versions
 
 The latest version on the [Releases page](https://github.com/maxgoedjen/secretive/releases) is the only currently supported version.
 
 ## Reporting a Vulnerability
 
-If you discover any vulnerabilities in this project, please notify max.goedjen@gmail.com with the subject containing "SECRETIVE SECURITY."
+To report security issues, please use [GitHub's private reporting feature.](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability)

Sources/Config/Secretive.xctestplan

@@ -13,12 +13,24 @@
   },
   "testTargets" : [
     {
-      "enabled" : false,
-      "parallelizable" : true,
       "target" : {
-        "containerPath" : "container:Secretive.xcodeproj",
+        "containerPath" : "container:Packages",
-        "identifier" : "50617D9323FCE48E0099B055",
+        "identifier" : "BriefTests",
-        "name" : "SecretiveTests"
+        "name" : "BriefTests"
+      }
+    },
+    {
+      "target" : {
+        "containerPath" : "container:Packages",
+        "identifier" : "SecretKitTests",
+        "name" : "SecretKitTests"
+      }
+    },
+    {
+      "target" : {
+        "containerPath" : "container:Packages",
+        "identifier" : "SecretAgentKitTests",
+        "name" : "SecretAgentKitTests"
       }
     }
   ],

Sources/Packages/Package.swift

@@ -21,13 +21,13 @@ let package = Package(
             targets: ["SmartCardSecretKit"]),
         .library(
             name: "SecretAgentKit",
-            targets: ["SecretAgentKit"]),
+            targets: ["SecretAgentKit", "XPCWrappers"]),
-        .library(
-            name: "SecretAgentKitHeaders",
-            targets: ["SecretAgentKitHeaders"]),
         .library(
             name: "Brief",
             targets: ["Brief"]),
+        .library(
+            name: "XPCWrappers",
+            targets: ["XPCWrappers"]),
     ],
     dependencies: [
     ],
@@ -36,58 +36,60 @@ let package = Package(
             name: "SecretKit",
             dependencies: [],
             resources: [localization],
-            swiftSettings: swiftSettings
+            swiftSettings: swiftSettings,
         ),
         .testTarget(
             name: "SecretKitTests",
             dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
-            swiftSettings: swiftSettings
+            swiftSettings: swiftSettings,
         ),
         .target(
             name: "SecureEnclaveSecretKit",
             dependencies: ["SecretKit"],
             resources: [localization],
-            swiftSettings: swiftSettings
+            swiftSettings: swiftSettings,
         ),
         .target(
             name: "SmartCardSecretKit",
             dependencies: ["SecretKit"],
             resources: [localization],
-            swiftSettings: swiftSettings
+            swiftSettings: swiftSettings,
         ),
         .target(
             name: "SecretAgentKit",
-            dependencies: ["SecretKit", "SecretAgentKitHeaders"],
+            dependencies: ["SecretKit"],
             resources: [localization],
-            swiftSettings: swiftSettings
+            swiftSettings: swiftSettings,
-        ),
-        .systemLibrary(
-            name: "SecretAgentKitHeaders"
         ),
         .testTarget(
             name: "SecretAgentKitTests",
-            dependencies: ["SecretAgentKit"])
+            dependencies: ["SecretAgentKit"],
-        ,
+        ),
         .target(
             name: "Brief",
-            dependencies: [],
+            dependencies: ["XPCWrappers"],
             resources: [localization],
-            swiftSettings: swiftSettings
+            swiftSettings: swiftSettings,
         ),
         .testTarget(
             name: "BriefTests",
-            dependencies: ["Brief"]
+            dependencies: ["Brief"],
+        ),
+        .target(
+            name: "XPCWrappers",
+            swiftSettings: swiftSettings,
         ),
     ]
 )
 
 var localization: Resource {
-    .process("../../Localizable.xcstrings")
+    .process("../../Resources/Localizable.xcstrings")
 }
 
 var swiftSettings: [PackageDescription.SwiftSetting] {
     [
         .swiftLanguageMode(.v6),
         .treatAllWarnings(as: .error),
+        .strictMemorySafety()
     ]
 }

Sources/Packages/Sources/Brief/SemVer.swift

@@ -5,12 +5,20 @@ public struct SemVer: Sendable {
 
     /// The SemVer broken into an array of integers.
     let versionNumbers: [Int]
+    public let previewDescription: String?
+
+    public var isTestBuild: Bool {
+        versionNumbers == [0, 0, 0]
+    }
 
     /// Initializes a SemVer from a string representation.
     /// - Parameter version: A string representation of the SemVer, formatted as "major.minor.patch".
     public init(_ version: String) {
         // Betas have the format 1.2.3_beta1
-        let strippedBeta = version.split(separator: "_").first!
+        // Nightlies have the format 0.0.0_nightly-2025-09-03
+        let splitFull = version.split(separator: "_")
+        let strippedBeta = splitFull.first!
+        previewDescription = splitFull.count > 1 ? String(splitFull[1]) : nil
         var split = strippedBeta.split(separator: ".").compactMap { Int($0) }
         while split.count < 3 {
             split.append(0)
@@ -22,6 +30,7 @@ public struct SemVer: Sendable {
     /// - Parameter version: An  `OperatingSystemVersion` representation of the SemVer.
     public init(_ version: OperatingSystemVersion) {
         versionNumbers = [version.majorVersion, version.minorVersion, version.patchVersion]
+        previewDescription = nil
     }
 
 }

Sources/Packages/Sources/Brief/Updater.swift

@@ -1,5 +1,6 @@
 import Foundation
 import Observation
+import XPCWrappers
 
 /// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version.
 @Observable public final class Updater: UpdaterProtocol, Sendable {
@@ -13,12 +14,11 @@ import Observation
         state.update
     }
 
-    public let testBuild: Bool
+    /// The current version of the app that is running.
+    public let currentVersion: SemVer
 
     /// The current OS version.
     private let osVersion: SemVer
-    /// The current version of the app that is running.
-    private let currentVersion: SemVer
 
     /// Initializes an Updater.
     /// - Parameters:
@@ -34,28 +34,25 @@ import Observation
     ) {
         self.osVersion = osVersion
         self.currentVersion = currentVersion
-        testBuild = currentVersion == SemVer("0.0.0")
+        Task {
             if checkOnLaunch {
-            // Don't do a launch check if the user hasn't seen the setup prompt explaining updater yet.
+                try await checkForUpdates()
-            Task {
-                await checkForUpdates()
             }
-        }
-        Task {
             while !Task.isCancelled {
                 try? await Task.sleep(for: .seconds(Int(checkFrequency)))
-                await checkForUpdates()
+                try await checkForUpdates()
             }
         }
     }
 
     /// Manually trigger an update check.
-    public func checkForUpdates() async {
+    public func checkForUpdates() async throws {
-        guard let (data, _) = try? await URLSession.shared.data(from: Constants.updateURL) else { return }
+        let session = try await XPCTypedSession<[Release], Never>(serviceName: "com.maxgoedjen.Secretive.SecretiveUpdater")
-        guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return }
+        await evaluate(releases: try await session.send())
-        await evaluate(releases: releases)
+        session.complete()
     }
 
+
     /// Ignores a specified release. `update` will be nil if the user has ignored the latest available release.
     /// - Parameter release: The release to ignore.
     public func ignore(release: Release) async {
@@ -102,11 +99,3 @@ extension Updater {
     }
 
 }
-
-extension Updater {
-
-    enum Constants {
-        static let updateURL = URL(string: "https://api.github.com/repos/maxgoedjen/secretive/releases")!
-    }
-
-}

Sources/Packages/Sources/Brief/UpdaterProtocol.swift

@@ -5,8 +5,8 @@ public protocol UpdaterProtocol: Observable, Sendable {
 
     /// The latest update
     @MainActor var update: Release? { get }
-    /// A boolean describing whether or not the current build of the app is a "test" build (ie, a debug build or otherwise special build)
+
-    var testBuild: Bool { get }
+    var currentVersion: SemVer { get }
 
     func ignore(release: Release) async
 }

Sources/Packages/Sources/Localization/Stub.swift

@@ -1 +0,0 @@
-

Sources/Packages/Sources/SecretAgentKit/Agent.swift

@@ -9,8 +9,8 @@ public final class Agent: Sendable {
 
     private let storeList: SecretStoreList
     private let witness: SigningWitness?
-    private let writer = OpenSSHKeyWriter()
+    private let publicKeyWriter = OpenSSHPublicKeyWriter()
-    private let requestTracer = SigningRequestTracer()
+    private let signatureWriter = OpenSSHSignatureWriter()
     private let certificateHandler = OpenSSHCertificateHandler()
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "Agent")
 
@@ -31,52 +31,31 @@ public final class Agent: Sendable {
 
 extension Agent {
 
-    /// Handles an incoming request.
+    public func handle(request: SSHAgent.Request, provenance: SigningRequestProvenance) async -> Data {
-    /// - Parameters:
-    ///   - reader: A ``FileHandleReader`` to read the content of the request.
-    ///   - writer: A ``FileHandleWriter`` to write the response to.
-    /// - Return value: 
-    ///   - Boolean if data could be read
-    @discardableResult public func handle(reader: FileHandleReader, writer: FileHandleWriter) async -> Bool {
-        logger.debug("Agent handling new data")
-        let data = Data(reader.availableData)
-        guard data.count > 4 else { return false}
-        let requestTypeInt = data[4]
-        guard let requestType = SSHAgent.RequestType(rawValue: requestTypeInt) else {
-            writer.write(OpenSSHKeyWriter().lengthAndData(of: SSHAgent.ResponseType.agentFailure.data))
-            logger.debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
-            return true
-        }
-        logger.debug("Agent handling request of type \(requestType.debugDescription)")
-        let subData = Data(data[5...])
-        let response = await handle(requestType: requestType, data: subData, reader: reader)
-        writer.write(response)
-        return true
-    }
-
-    func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) async -> Data {
         // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
         await reloadSecretsIfNeccessary()
         var response = Data()
         do {
-            switch requestType {
+            switch request {
             case .requestIdentities:
-                response.append(SSHAgent.ResponseType.agentIdentitiesAnswer.data)
+                response.append(SSHAgent.Response.agentIdentitiesAnswer.data)
                 response.append(await identities())
-                logger.debug("Agent returned \(SSHAgent.ResponseType.agentIdentitiesAnswer.debugDescription)")
+                logger.debug("Agent returned \(SSHAgent.Response.agentIdentitiesAnswer.debugDescription)")
-            case .signRequest:
+            case .signRequest(let context):
-                let provenance = requestTracer.provenance(from: reader)
+                response.append(SSHAgent.Response.agentSignResponse.data)
-                response.append(SSHAgent.ResponseType.agentSignResponse.data)
+                response.append(try await sign(data: context.dataToSign, keyBlob: context.keyBlob, provenance: provenance))
-                response.append(try await sign(data: data, provenance: provenance))
+                logger.debug("Agent returned \(SSHAgent.Response.agentSignResponse.debugDescription)")
-                logger.debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)")
+            case .unknown(let value):
+                logger.error("Agent received unknown request of type \(value).")
+            default:
+                logger.debug("Agent received valid request of type \(request.debugDescription), but not currently supported.")
+                throw UnhandledRequestError()
             }
         } catch {
-            response.removeAll()
+            response = SSHAgent.Response.agentFailure.data
-            response.append(SSHAgent.ResponseType.agentFailure.data)
+            logger.debug("Agent returned \(SSHAgent.Response.agentFailure.debugDescription)")
-            logger.debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
         }
-        let full = OpenSSHKeyWriter().lengthAndData(of: response)
+        return response.lengthAndData
-        return full
     }
 
 }
@@ -88,24 +67,24 @@ extension Agent {
     func identities() async -> Data {
         let secrets = await storeList.allSecrets
         await certificateHandler.reloadCertificates(for: secrets)
-        var count = secrets.count
+        var count = 0
         var keyData = Data()
 
         for secret in secrets {
-            let keyBlob = writer.data(secret: secret)
+            let keyBlob = publicKeyWriter.data(secret: secret)
-            let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
+            keyData.append(keyBlob.lengthAndData)
-            keyData.append(writer.lengthAndData(of: keyBlob))
+            keyData.append(publicKeyWriter.comment(secret: secret).lengthAndData)
-            keyData.append(writer.lengthAndData(of: curveData))
+            count += 1
 
             if let (certificateData, name) = try? await certificateHandler.keyBlobAndName(for: secret) {
-                keyData.append(writer.lengthAndData(of: certificateData))
+                keyData.append(certificateData.lengthAndData)
-                keyData.append(writer.lengthAndData(of: name))
+                keyData.append(name.lengthAndData)
                 count += 1
             }
         }
         logger.log("Agent enumerated \(count) identities")
         var countBigEndian = UInt32(count).bigEndian
-        let countData = Data(bytes: &countBigEndian, count: UInt32.bitWidth/8)
+        let countData = unsafe Data(bytes: &countBigEndian, count: MemoryLayout<UInt32>.size)
         return countData + keyData
     }
 
@@ -114,71 +93,19 @@ extension Agent {
     ///   - data: The data to sign.
     ///   - provenance: A ``SecretKit.SigningRequestProvenance`` object describing the origin of the request.
     /// - Returns: An OpenSSH formatted Data payload containing the signed data response.
-    func sign(data: Data, provenance: SigningRequestProvenance) async throws -> Data {
+    func sign(data: Data, keyBlob: Data, provenance: SigningRequestProvenance) async throws -> Data {
-        let reader = OpenSSHReader(data: data)
+        guard let (secret, store) = await secret(matching: keyBlob) else {
-        let payloadHash = reader.readNextChunk()
+            let keyBlobHex = keyBlob.compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }.joined()
-        let hash: Data
+            logger.debug("Agent did not have a key matching \(keyBlobHex)")
-        // Check if hash is actually an openssh certificate and reconstruct the public key if it is
+            throw NoMatchingKeyError()
-        if let certificatePublicKey = await certificateHandler.publicKeyHash(from: payloadHash) {
-            hash = certificatePublicKey
-        } else {
-            hash = payloadHash
         }
 
-        guard let (store, secret) = await secret(matching: hash) else {
+        try await witness?.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
-            logger.debug("Agent did not have a key matching \(hash as NSData)")
-            throw AgentError.noMatchingKey
-        }
 
-        if let witness = witness {
+        let rawRepresentation = try await store.sign(data: data, with: secret, for: provenance)
-            try await witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
+        let signedData = signatureWriter.data(secret: secret, signature: rawRepresentation)
-        }
 
-        let dataToSign = reader.readNextChunk()
+        try await witness?.witness(accessTo: secret, from: store, by: provenance)
-        let signed = try await store.sign(data: dataToSign, with: secret, for: provenance)
-        let derSignature = signed
-
-        let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
-
-        // Convert from DER formatted rep to raw (r||s)
-
-        let rawRepresentation: Data
-        switch (secret.algorithm, secret.keySize) {
-        case (.ellipticCurve, 256):
-            rawRepresentation = try CryptoKit.P256.Signing.ECDSASignature(derRepresentation: derSignature).rawRepresentation
-        case (.ellipticCurve, 384):
-            rawRepresentation = try CryptoKit.P384.Signing.ECDSASignature(derRepresentation: derSignature).rawRepresentation
-        default:
-            throw AgentError.unsupportedKeyType
-        }
-
-
-        let rawLength = rawRepresentation.count/2
-        // Check if we need to pad with 0x00 to prevent certain
-        // ssh servers from thinking r or s is negative
-        let paddingRange: ClosedRange<UInt8> = 0x80...0xFF
-        var r = Data(rawRepresentation[0..<rawLength])
-        if paddingRange ~= r.first! {
-            r.insert(0x00, at: 0)
-        }
-        var s = Data(rawRepresentation[rawLength...])
-        if paddingRange ~= s.first! {
-            s.insert(0x00, at: 0)
-        }
-
-        var signatureChunk = Data()
-        signatureChunk.append(writer.lengthAndData(of: r))
-        signatureChunk.append(writer.lengthAndData(of: s))
-
-        var signedData = Data()
-        var sub = Data()
-        sub.append(writer.lengthAndData(of: curveData))
-        sub.append(writer.lengthAndData(of: signatureChunk))
-        signedData.append(writer.lengthAndData(of: sub))
-
-        if let witness = witness {
-            try await witness.witness(accessTo: secret, from: store, by: provenance)
-        }
 
         logger.debug("Agent signed request")
 
@@ -203,16 +130,10 @@ extension Agent {
     /// Finds a ``Secret`` matching a specified hash whos signature was requested.
     /// - Parameter hash: The hash to match against.
     /// - Returns: A ``Secret`` and the ``SecretStore`` containing it, if a match is found.
-    func secret(matching hash: Data) async -> (AnySecretStore, AnySecret)? {
+    func secret(matching hash: Data) async -> (AnySecret, AnySecretStore)? {
-        for store in await storeList.stores {
+        await storeList.allSecretsWithStores.first {
-            let allMatching = await store.secrets.filter { secret in
+            hash == publicKeyWriter.data(secret: $0.0)
-                hash == writer.data(secret: secret)
         }
-            if let matching = allMatching.first {
-                return (store, matching)
-            }
-        }
-        return nil
     }
 
 }
@@ -220,21 +141,16 @@ extension Agent {
 
 extension Agent {
 
-    /// An error involving agent operations..
+    struct NoMatchingKeyError: Error {}
-    enum AgentError: Error {
+    struct UnhandledRequestError: Error {}
-        case unhandledType
-        case noMatchingKey
-        case unsupportedKeyType
-        case notOpenSSHCertificate
-    }
 
 }
 
-extension SSHAgent.ResponseType {
+extension SSHAgent.Response {
 
     var data: Data {
         var raw = self.rawValue
-        return  Data(bytes: &raw, count: UInt8.bitWidth/8)
+        return unsafe Data(bytes: &raw, count: MemoryLayout<UInt8>.size)
     }
 
 }

Sources/Packages/Sources/SecretAgentKit/FileHandleProtocols.swift

@@ -1,32 +1,12 @@
 import Foundation
 
-/// Protocol abstraction of the reading aspects of FileHandle.
+extension FileHandle {
-public protocol FileHandleReader: Sendable {
-
-    /// Gets data that is available for reading.
-    var availableData: Data { get }
-    /// A file descriptor of the handle.
-    var fileDescriptor: Int32 { get }
-    /// The  process ID of the process coonnected to the other end of the FileHandle.
-    var pidOfConnectedProcess: Int32 { get }
-
-}
-
-/// Protocol abstraction of the writing aspects of FileHandle.
-public protocol FileHandleWriter: Sendable {
-
-    /// Writes data to the handle.
-    func write(_ data: Data)
-
-}
-
-extension FileHandle: FileHandleReader, FileHandleWriter {
 
     public var pidOfConnectedProcess: Int32 {
-        let pidPointer = UnsafeMutableRawPointer.allocate(byteCount: 4, alignment: 1)
+        let pidPointer = UnsafeMutableRawPointer.allocate(byteCount: MemoryLayout<Int32>.size, alignment: 1)
         var len = socklen_t(MemoryLayout<Int32>.size)
-        getsockopt(fileDescriptor, SOCK_STREAM, LOCAL_PEERPID, pidPointer, &len)
+        unsafe getsockopt(fileDescriptor, SOCK_STREAM, LOCAL_PEERPID, pidPointer, &len)
-        return pidPointer.load(as: Int32.self)
+        return unsafe pidPointer.load(as: Int32.self)
     }
 
 }

Sources/Packages/Sources/SecretAgentKit/OpenSSHCertificateHandler.swift

@@ -1,12 +1,13 @@
 import Foundation
 import OSLog
+import SecretKit
 
 /// Manages storage and lookup for OpenSSH certificates.
 public actor OpenSSHCertificateHandler: Sendable {
 
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: URL.homeDirectory)
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler")
-    private let writer = OpenSSHKeyWriter()
+    private let writer = OpenSSHPublicKeyWriter()
     private var keyBlobsAndNames: [AnySecret: (Data, Data)] = [:]
 
     /// Initializes an OpenSSHCertificateHandler.
@@ -25,30 +26,6 @@ public actor OpenSSHCertificateHandler: Sendable {
         }
     }
 
-    /// Reconstructs a public key from a ``Data``, if that ``Data`` contains an OpenSSH certificate hash. Currently only ecdsa certificates are supported
-    /// - Parameter certBlock: The openssh certificate to extract the public key from
-    /// - Returns: A ``Data`` object containing the public key in OpenSSH wire format if the ``Data`` is an OpenSSH certificate hash, otherwise nil.
-    public func publicKeyHash(from hash: Data) -> Data? {
-        let reader = OpenSSHReader(data: hash)
-        let certType = String(decoding: reader.readNextChunk(), as: UTF8.self)
-
-        switch certType {
-        case "ecdsa-sha2-nistp256-cert-v01@openssh.com",
-            "ecdsa-sha2-nistp384-cert-v01@openssh.com",
-            "ecdsa-sha2-nistp521-cert-v01@openssh.com":
-            _ = reader.readNextChunk() // nonce
-            let curveIdentifier = reader.readNextChunk()
-            let publicKey = reader.readNextChunk()
-
-            let curveType = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "").data(using: .utf8)!
-            return writer.lengthAndData(of: curveType) +
-                   writer.lengthAndData(of: curveIdentifier) +
-                   writer.lengthAndData(of: publicKey)
-        default:
-            return nil
-        }
-    }
-
     /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
     /// - Parameter secret: The secret to search for a certificate with
     /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
@@ -78,14 +55,13 @@ public actor OpenSSHCertificateHandler: Sendable {
             throw OpenSSHCertificateError.parsingFailed
         }
 
-        if certElements.count >= 3, let certName = certElements[2].data(using: .utf8) {
+        if certElements.count >= 3 {
+            let certName = Data(certElements[2].utf8)
             return (certDecoded, certName)
-        } else if let certName = secret.name.data(using: .utf8) {
+        }
+        let certName = Data(secret.name.utf8)
         logger.info("Certificate for \(secret.name) does not have a name tag, using secret name instead")
         return (certDecoded, certName)
-        } else {
-            throw OpenSSHCertificateError.parsingFailed
-        }
     }
 
 }

Sources/Packages/Sources/SecretAgentKit/OpenSSHReader.swift

@@ -0,0 +1,47 @@
+import Foundation
+
+/// Reads OpenSSH protocol data.
+final class OpenSSHReader {
+
+    var remaining: Data
+
+    /// Initialize the reader with an OpenSSH data payload.
+    /// - Parameter data: The data to read.
+    init(data: Data) {
+        remaining = Data(data)
+    }
+
+    /// Reads the next chunk of data from the playload.
+    /// - Returns: The next chunk of data.
+    func readNextChunk(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> Data {
+        let littleEndianLength = try readNextBytes(as: UInt32.self)
+        let length = convertEndianness ? Int(littleEndianLength.bigEndian) : Int(littleEndianLength)
+        guard remaining.count >= length else { throw .beyondBounds }
+        let dataRange = 0..<length
+        let ret = Data(remaining[dataRange])
+        remaining.removeSubrange(dataRange)
+        return ret
+    }
+
+    func readNextBytes<T>(as: T.Type) throws(OpenSSHReaderError) -> T {
+        let size = MemoryLayout<T>.size
+        guard remaining.count >= size else { throw .beyondBounds }
+        let lengthRange = 0..<size
+        let lengthChunk = remaining[lengthRange]
+        remaining.removeSubrange(lengthRange)
+        return unsafe lengthChunk.bytes.unsafeLoad(as: T.self)
+    }
+
+    func readNextChunkAsString(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> String {
+        try String(decoding: readNextChunk(convertEndianness: convertEndianness), as: UTF8.self)
+    }
+
+    func readNextChunkAsSubReader(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> OpenSSHReader {
+        OpenSSHReader(data: try readNextChunk(convertEndianness: convertEndianness))
+    }
+
+}
+
+public enum OpenSSHReaderError: Error, Codable {
+    case beyondBounds
+}

Sources/Packages/Sources/SecretAgentKit/SSHAgentInputParser.swift

@@ -0,0 +1,109 @@
+import Foundation
+import OSLog
+import SecretKit
+
+public protocol SSHAgentInputParserProtocol {
+
+    func parse(data: Data) async throws -> SSHAgent.Request
+    
+}
+
+public struct SSHAgentInputParser: SSHAgentInputParserProtocol {
+
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "InputParser")
+
+    public init() {
+        
+    }
+
+    public func parse(data: Data) throws(AgentParsingError) -> SSHAgent.Request {
+        logger.debug("Parsing new data")
+        guard data.count > 4 else {
+            throw .invalidData
+        }
+        let specifiedLength = unsafe (data[0..<4].bytes.unsafeLoad(as: UInt32.self).bigEndian) + 4
+        let rawRequestInt = data[4]
+        let remainingDataRange = 5..<min(Int(specifiedLength), data.count)
+        lazy var body: Data = { Data(data[remainingDataRange]) }()
+        switch rawRequestInt {
+        case SSHAgent.Request.requestIdentities.protocolID:
+            return .requestIdentities
+        case SSHAgent.Request.signRequest(.empty).protocolID:
+            do {
+                return .signRequest(try signatureRequestContext(from: body))
+            } catch {
+                throw .openSSHReader(error)
+            }
+        case SSHAgent.Request.addIdentity.protocolID:
+            return .addIdentity
+        case SSHAgent.Request.removeIdentity.protocolID:
+            return .removeIdentity
+        case SSHAgent.Request.removeAllIdentities.protocolID:
+            return .removeAllIdentities
+        case SSHAgent.Request.addIDConstrained.protocolID:
+            return .addIDConstrained
+        case SSHAgent.Request.addSmartcardKey.protocolID:
+            return .addSmartcardKey
+        case SSHAgent.Request.removeSmartcardKey.protocolID:
+            return .removeSmartcardKey
+        case SSHAgent.Request.lock.protocolID:
+            return .lock
+        case SSHAgent.Request.unlock.protocolID:
+            return .unlock
+        case SSHAgent.Request.addSmartcardKeyConstrained.protocolID:
+            return .addSmartcardKeyConstrained
+        case SSHAgent.Request.protocolExtension.protocolID:
+            return .protocolExtension
+        default:
+            return .unknown(rawRequestInt)
+        }
+    }
+
+}
+
+extension SSHAgentInputParser {
+
+    func signatureRequestContext(from data: Data) throws(OpenSSHReaderError) -> SSHAgent.Request.SignatureRequestContext {
+        let reader = OpenSSHReader(data: data)
+        let rawKeyBlob = try reader.readNextChunk()
+        let keyBlob = certificatePublicKeyBlob(from: rawKeyBlob) ?? rawKeyBlob
+        let dataToSign = try reader.readNextChunk()
+        return SSHAgent.Request.SignatureRequestContext(keyBlob: keyBlob, dataToSign: dataToSign)
+    }
+
+    func certificatePublicKeyBlob(from hash: Data) -> Data? {
+        let reader = OpenSSHReader(data: hash)
+        do {
+            let certType = String(decoding: try reader.readNextChunk(), as: UTF8.self)
+            switch certType {
+            case "ecdsa-sha2-nistp256-cert-v01@openssh.com",
+                "ecdsa-sha2-nistp384-cert-v01@openssh.com",
+                "ecdsa-sha2-nistp521-cert-v01@openssh.com":
+                _ = try reader.readNextChunk() // nonce
+                let curveIdentifier = try reader.readNextChunk()
+                let publicKey = try reader.readNextChunk()
+                let openSSHIdentifier = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "")
+                return openSSHIdentifier.lengthAndData +
+                curveIdentifier.lengthAndData +
+                publicKey.lengthAndData
+            default:
+                return nil
+            }
+        } catch {
+            return nil
+        }
+    }
+
+}
+
+
+extension SSHAgentInputParser {
+
+    public enum AgentParsingError: Error, Codable {
+        case unknownRequest
+        case unhandledRequest
+        case invalidData
+        case openSSHReader(OpenSSHReaderError)
+    }
+
+}

Sources/Packages/Sources/SecretAgentKit/SSHAgentProtocol.swift

@@ -6,39 +6,92 @@ public enum SSHAgent {}
 extension SSHAgent {
 
     /// The type of the SSH Agent Request, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
-    public enum RequestType: UInt8, CustomDebugStringConvertible {
+    public enum Request: CustomDebugStringConvertible, Codable, Sendable {
 
-        case requestIdentities = 11
+        case requestIdentities
-        case signRequest = 13
+        case signRequest(SignatureRequestContext)
+        case addIdentity
+        case removeIdentity
+        case removeAllIdentities
+        case addIDConstrained
+        case addSmartcardKey
+        case removeSmartcardKey
+        case lock
+        case unlock
+        case addSmartcardKeyConstrained
+        case protocolExtension
+        case unknown(UInt8)
+
+        public var protocolID: UInt8 {
+            switch self {
+            case .requestIdentities: 11
+            case .signRequest: 13
+            case .addIdentity: 17
+            case .removeIdentity: 18
+            case .removeAllIdentities: 19
+            case .addIDConstrained: 25
+            case .addSmartcardKey: 20
+            case .removeSmartcardKey: 21
+            case .lock: 22
+            case .unlock: 23
+            case .addSmartcardKeyConstrained: 26
+            case .protocolExtension: 27
+            case .unknown(let value): value
+            }
+        }
 
         public var debugDescription: String {
             switch self {
-            case .requestIdentities:
+            case .requestIdentities: "SSH_AGENTC_REQUEST_IDENTITIES"
-                return "RequestIdentities"
+            case .signRequest: "SSH_AGENTC_SIGN_REQUEST"
-            case .signRequest:
+            case .addIdentity: "SSH_AGENTC_ADD_IDENTITY"
-                return "SignRequest"
+            case .removeIdentity: "SSH_AGENTC_REMOVE_IDENTITY"
-            }
+            case .removeAllIdentities: "SSH_AGENTC_REMOVE_ALL_IDENTITIES"
+            case .addIDConstrained: "SSH_AGENTC_ADD_ID_CONSTRAINED"
+            case .addSmartcardKey: "SSH_AGENTC_ADD_SMARTCARD_KEY"
+            case .removeSmartcardKey: "SSH_AGENTC_REMOVE_SMARTCARD_KEY"
+            case .lock: "SSH_AGENTC_LOCK"
+            case .unlock: "SSH_AGENTC_UNLOCK"
+            case .addSmartcardKeyConstrained: "SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED"
+            case .protocolExtension: "SSH_AGENTC_EXTENSION"
+            case .unknown: "UNKNOWN_MESSAGE"
             }
         }
 
+        public struct SignatureRequestContext: Sendable, Codable {
+            public let keyBlob: Data
+            public let dataToSign: Data
+
+            public init(keyBlob: Data, dataToSign: Data) {
+                self.keyBlob = keyBlob
+                self.dataToSign = dataToSign
+            }
+
+            public static var empty: SignatureRequestContext {
+                SignatureRequestContext(keyBlob: Data(), dataToSign: Data())
+            }
+        }
+
+    }
+
     /// The type of the SSH Agent Response, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
-    public enum ResponseType: UInt8, CustomDebugStringConvertible {
+    public enum Response: UInt8, CustomDebugStringConvertible {
         
         case agentFailure = 5
         case agentSuccess = 6
         case agentIdentitiesAnswer = 12
         case agentSignResponse = 14
+        case agentExtensionFailure = 28
+        case agentExtensionResponse = 29
 
         public var debugDescription: String {
             switch self {
-            case .agentFailure:
+            case .agentFailure: "SSH_AGENT_FAILURE"
-                return "AgentFailure"
+            case .agentSuccess: "SSH_AGENT_SUCCESS"
-            case .agentSuccess:
+            case .agentIdentitiesAnswer: "SSH_AGENT_IDENTITIES_ANSWER"
-                return "AgentSuccess"
+            case .agentSignResponse: "SSH_AGENT_SIGN_RESPONSE"
-            case .agentIdentitiesAnswer:
+            case .agentExtensionFailure: "SSH_AGENT_EXTENSION_FAILURE"
-                return "AgentIdentitiesAnswer"
+            case .agentExtensionResponse: "SSH_AGENT_EXTENSION_RESPONSE"
-            case .agentSignResponse:
-                return "AgentSignResponse"
             }
         }
     }

Sources/Packages/Sources/SecretAgentKit/SigningRequestTracer.swift

@@ -2,7 +2,6 @@ import Foundation
 import AppKit
 import Security
 import SecretKit
-import SecretAgentKitHeaders
 
 /// An object responsible for generating ``SecretKit.SigningRequestProvenance`` objects.
 struct SigningRequestTracer {
@@ -10,12 +9,11 @@ struct SigningRequestTracer {
 
 extension SigningRequestTracer {
 
-    /// Generates a ``SecretKit.SigningRequestProvenance`` from a ``FileHandleReader``.
+    /// Generates a ``SecretKit.SigningRequestProvenance`` from a ``FileHandle``.
-    /// - Parameter fileHandleReader: The reader involved in processing the request.
+    /// - Parameter fileHandle: The reader involved in processing the request.
     /// - Returns: A ``SecretKit.SigningRequestProvenance`` describing the origin of the request.
-    func provenance(from fileHandleReader: FileHandleReader) -> SigningRequestProvenance {
+    func provenance(from fileHandle: FileHandle) -> SigningRequestProvenance {
-        let firstInfo = process(from: fileHandleReader.pidOfConnectedProcess)
+        let firstInfo = process(from: fileHandle.pidOfConnectedProcess)
-
         var provenance = SigningRequestProvenance(root: firstInfo)
         while NSRunningApplication(processIdentifier: provenance.origin.pid) == nil && provenance.origin.parentPID != nil {
             provenance.chain.append(process(from: provenance.origin.parentPID!))
@@ -27,11 +25,11 @@ extension SigningRequestTracer {
     /// - Parameter pid: The process ID to look up.
     /// - Returns: a `kinfo_proc` struct describing the process ID.
     func pidAndNameInfo(from pid: Int32) -> kinfo_proc {
-        var len = MemoryLayout<kinfo_proc>.size
+        var len = unsafe MemoryLayout<kinfo_proc>.size
         let infoPointer = UnsafeMutableRawPointer.allocate(byteCount: len, alignment: 1)
         var name: [Int32] = [CTL_KERN, KERN_PROC, KERN_PROC_PID, pid]
-        sysctl(&name, UInt32(name.count), infoPointer, &len, nil, 0)
+        unsafe sysctl(&name, UInt32(name.count), infoPointer, &len, nil, 0)
-        return infoPointer.load(as: kinfo_proc.self)
+        return unsafe infoPointer.load(as: kinfo_proc.self)
     }
 
     /// Generates a ``SecretKit.SigningRequestProvenance.Process`` from a provided process ID.
@@ -39,18 +37,18 @@ extension SigningRequestTracer {
     /// - Returns: A ``SecretKit.SigningRequestProvenance.Process`` describing the process.
     func process(from pid: Int32) -> SigningRequestProvenance.Process {
         var pidAndNameInfo = self.pidAndNameInfo(from: pid)
-        let ppid = pidAndNameInfo.kp_eproc.e_ppid != 0 ? pidAndNameInfo.kp_eproc.e_ppid : nil
+        let ppid = unsafe pidAndNameInfo.kp_eproc.e_ppid != 0 ? pidAndNameInfo.kp_eproc.e_ppid : nil
-        let procName = withUnsafeMutablePointer(to: &pidAndNameInfo.kp_proc.p_comm.0) { pointer in
+        let procName = unsafe withUnsafeMutablePointer(to: &pidAndNameInfo.kp_proc.p_comm.0) { pointer in
-            String(cString: pointer)
+            unsafe String(cString: pointer)
         }
 
         let pathPointer = UnsafeMutablePointer<UInt8>.allocate(capacity: Int(MAXPATHLEN))
-        _ = proc_pidpath(pid, pathPointer, UInt32(MAXPATHLEN))
+        _ = unsafe proc_pidpath(pid, pathPointer, UInt32(MAXPATHLEN))
-        let path = String(cString: pathPointer)
+        let path = unsafe String(cString: pathPointer)
         var secCode: Unmanaged<SecCode>!
         let flags: SecCSFlags = [.considerExpiration, .enforceRevocationChecks]
-        SecCodeCreateWithPID(pid, SecCSFlags(), &secCode)
+        unsafe SecCodeCreateWithPID(pid, SecCSFlags(), &secCode)
-        let valid = SecCodeCheckValidity(secCode.takeRetainedValue(), flags, nil) == errSecSuccess
+        let valid = unsafe SecCodeCheckValidity(secCode.takeRetainedValue(), flags, nil) == errSecSuccess
         return SigningRequestProvenance.Process(pid: pid, processName: procName, appName: appName(for: pid), iconURL: iconURL(for: pid), path: path, validSignature: valid, parentPID: ppid)
     }
 
@@ -81,3 +79,11 @@ extension SigningRequestTracer {
     }
 
 }
+
+// from libproc.h
+@_silgen_name("proc_pidpath")
+@discardableResult func proc_pidpath(_ pid: Int32, _ buffer: UnsafeMutableRawPointer!, _ buffersize: UInt32) -> Int32
+
+//// from SecTask.h
+@_silgen_name("SecCodeCreateWithPID")
+@discardableResult func SecCodeCreateWithPID(_: Int32, _: SecCSFlags, _: UnsafeMutablePointer<Unmanaged<SecCode>?>!) -> OSStatus

Sources/Packages/Sources/SecretAgentKit/SocketController.swift

@@ -1,23 +1,32 @@
 import Foundation
 import OSLog
+import SecretKit
 
 /// A controller that manages socket configuration and request dispatching.
-public final class SocketController {
+public struct SocketController {
 
-    /// The active FileHandle.
+    /// A stream of Sessions. Each session represents one connection to a class communicating with the socket. Multiple Sessions may be active simultaneously.
-    private var fileHandle: FileHandle?
+    public let sessions: AsyncStream<Session>
-    /// The active SocketPort.
+
-    private var port: SocketPort?
+    /// A continuation to create new sessions.
-    /// A handler that will be notified when a new read/write handle is available.
+    private let sessionsContinuation: AsyncStream<Session>.Continuation
-    /// False if no data could be read
+
-    public var handler: (@Sendable (FileHandleReader, FileHandleWriter) async -> Bool)?
+    /// The active SocketPort. Must be retained to be kept valid.
-    /// Logger.
+    private let port: SocketPort
+
+    /// The FileHandle for the main socket.
+    private let fileHandle: FileHandle
+    
+    /// Logger for the socket controller.
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "SocketController")
 
+    /// Tracer which determines who originates a socket connection.
+    private let requestTracer = SigningRequestTracer()
 
     /// Initializes a socket controller with a specified path.
     /// - Parameter path: The path to use as a socket.
     public init(path: String) {
+        (sessions, sessionsContinuation) = AsyncStream<Session>.makeStream()
         logger.debug("Socket controller setting up at \(path)")
         if let _ = try? FileManager.default.removeItem(atPath: path) {
             logger.debug("Socket controller removed existing socket")
@@ -25,76 +34,86 @@ public final class SocketController {
         let exists = FileManager.default.fileExists(atPath: path)
         assert(!exists)
         logger.debug("Socket controller path is clear")
-        port = socketPort(at: path)
+        port = SocketPort(path: path)
-        configureSocket(at: path)
+        fileHandle = FileHandle(fileDescriptor: port.socket, closeOnDealloc: true)
+        Task { [fileHandle, sessionsContinuation, logger] in
+            for await notification in NotificationCenter.default.notifications(named: .NSFileHandleConnectionAccepted) {
+                logger.debug("Socket controller accepted connection")
+                guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { continue }
+                let session = Session(fileHandle: new)
+                sessionsContinuation.yield(session)
+                await fileHandle.acceptConnectionInBackgroundAndNotifyOnMainActor()
+            }
+        }
+        fileHandle.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.Mode.common])
         logger.debug("Socket listening at \(path)")
     }
 
-    /// Configures the socket and a corresponding FileHandle.
-    /// - Parameter path: The path to use as a socket.
-    func configureSocket(at path: String) {
-        guard let port = port else { return }
-        fileHandle = FileHandle(fileDescriptor: port.socket, closeOnDealloc: true)
-        NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionAccept(notification:)), name: .NSFileHandleConnectionAccepted, object: nil)
-        NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionDataAvailable(notification:)), name: .NSFileHandleDataAvailable, object: nil)
-        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.Mode.common])
 }
 
-    /// Creates a SocketPort for a path.
+extension SocketController {
-    /// - Parameter path: The path to use as a socket.
-    /// - Returns: A configured SocketPort.
-    func socketPort(at path: String) -> SocketPort {
-        var addr = sockaddr_un()
-        addr.sun_family = sa_family_t(AF_UNIX)
     
-        var len: Int = 0
+    /// A session represents a connection that has been established between the two ends of the socket.
-        withUnsafeMutablePointer(to: &addr.sun_path.0) { pointer in
+    public struct Session: Sendable {
-            path.withCString { cstring in
+        
-                len = strlen(cstring)
+        /// Data received by the socket.
-                strncpy(pointer, cstring, len)
+        public let messages: AsyncStream<Data>
+
+        /// The provenance of the process that established the session.
+        public let provenance: SigningRequestProvenance
+        
+        /// A FileHandle used to communicate with the socket.
+        private let fileHandle: FileHandle
+
+        /// A continuation for issuing new messages.
+        private let messagesContinuation: AsyncStream<Data>.Continuation
+
+        /// A logger for the session.
+        private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "Session")
+        
+        /// Initializes a new Session.
+        /// - Parameter fileHandle: The FileHandle used to communicate with the socket.
+        init(fileHandle: FileHandle) {
+            self.fileHandle = fileHandle
+            provenance = SigningRequestTracer().provenance(from: fileHandle)
+            (messages, messagesContinuation) = AsyncStream.makeStream()
+            Task { [messagesContinuation, logger] in
+                for await _ in NotificationCenter.default.notifications(named: .NSFileHandleDataAvailable, object: fileHandle) {
+                    let data = fileHandle.availableData
+                    guard !data.isEmpty else {
+                        logger.debug("Socket controller received empty data, ending continuation.")
+                        messagesContinuation.finish()
+                        try fileHandle.close()
+                        return
+                    }
+                    messagesContinuation.yield(data)
+                    logger.debug("Socket controller yielded data.")
                 }
             }
-        addr.sun_len = UInt8(len+2)
+            Task {
-
+                await fileHandle.waitForDataInBackgroundAndNotifyOnMainActor()
-        var data: Data!
-        withUnsafePointer(to: &addr) { pointer in
-            data = Data(bytes: pointer, count: MemoryLayout<sockaddr_un>.size)
-        }
-
-        return SocketPort(protocolFamily: AF_UNIX, socketType: SOCK_STREAM, protocol: 0, address: data)!
-    }
-
-    /// Handles a new connection being accepted, invokes the handler, and prepares to accept new connections.
-    /// - Parameter notification: A `Notification` that triggered the call.
-    @objc func handleConnectionAccept(notification: Notification) {
-        logger.debug("Socket controller accepted connection")
-        guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { return }
-        Task { [handler, fileHandle] in
-            _ = await handler?(new, new)
-            await new.waitForDataInBackgroundAndNotifyOnMainActor()
-            await fileHandle?.acceptConnectionInBackgroundAndNotifyOnMainActor()
             }
         }
         
-    /// Handles a new connection providing data and invokes the handler callback.
+        /// Writes new data to the socket.
-    /// - Parameter notification: A `Notification` that triggered the call.
+        /// - Parameter data: The data to write.
-    @objc func handleConnectionDataAvailable(notification: Notification) {
+        public func write(_ data: Data) async throws {
-        logger.debug("Socket controller has new data available")
+            try fileHandle.write(contentsOf: data)
-        guard let new = notification.object as? FileHandle else { return }
+            await fileHandle.waitForDataInBackgroundAndNotifyOnMainActor()
-        logger.debug("Socket controller received new file handle")
-        Task { [handler, logger = logger] in
-            if((await handler?(new, new)) == true) {
-                logger.debug("Socket controller handled data, wait for more data")
-                await new.waitForDataInBackgroundAndNotifyOnMainActor()
-            } else {
-                logger.debug("Socket controller called with empty data, socked closed")
-            }
         }
+        
+        /// Closes the socket and cleans up resources.
+        public func close() throws {
+            logger.debug("Session closed.")
+            messagesContinuation.finish()
+            try fileHandle.close()
         }
 
     }
 
-extension FileHandle {
+}
+
+private extension FileHandle {
 
     /// Ensures waitForDataInBackgroundAndNotify will be called on the main actor.
     @MainActor func waitForDataInBackgroundAndNotifyOnMainActor() {
@@ -109,3 +128,27 @@ extension FileHandle {
     }
 
 }
+
+private extension SocketPort {
+
+    convenience init(path: String) {
+        var addr = sockaddr_un()
+
+        let length = unsafe withUnsafeMutablePointer(to: &addr.sun_path.0) { pointer in
+            unsafe path.withCString { cstring in
+                let len = unsafe strlen(cstring)
+                unsafe strncpy(pointer, cstring, len)
+                return len
+            }
+        }
+        // This doesn't seem to be _strictly_ neccessary with SocketPort.
+        // but just for good form.
+        addr.sun_family = sa_family_t(AF_UNIX)
+        // This mirrors the SUN_LEN macro format.
+        addr.sun_len = UInt8(MemoryLayout<sockaddr_un>.size - MemoryLayout.size(ofValue: addr.sun_path) + length)
+
+        let data = unsafe Data(bytes: &addr, count: MemoryLayout<sockaddr_un>.size)
+        self.init(protocolFamily: AF_UNIX, socketType: SOCK_STREAM, protocol: 0, address: data)!
+    }
+
+}

Sources/Packages/Sources/SecretAgentKitHeaders/Stub.swift

@@ -1 +0,0 @@
-

Sources/Packages/Sources/SecretAgentKitHeaders/include/SecretAgentKit.h

@@ -1,19 +0,0 @@
-#import <Foundation/Foundation.h>
-#import <Security/Security.h>
-
-
-// Forward declarations
-
-// from libproc.h
-int proc_pidpath(int pid, void * buffer, uint32_t  buffersize);
-
-// from SecTask.h
-OSStatus SecCodeCreateWithPID(int32_t, SecCSFlags, SecCodeRef *);
-
-//! Project version number for SecretAgentKit.
-FOUNDATION_EXPORT double SecretAgentKitVersionNumber;
-
-//! Project version string for SecretAgentKit.
-FOUNDATION_EXPORT const unsigned char SecretAgentKitVersionString[];
-
-

Sources/Packages/Sources/SecretAgentKitHeaders/module.modulemap

@@ -1,4 +0,0 @@
-module SecretAgentKitHeaders [system] {
-    header "include/SecretAgentKit.h"
-    export *
-}

Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md

@@ -22,7 +22,7 @@ SecretKit is a collection of protocols describing secrets and stores.
 
 ### OpenSSH 
 
-- ``OpenSSHKeyWriter``
+- ``OpenSSHPublicKeyWriter``
 - ``OpenSSHReader``
 
 ### Signing Process

Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift

@@ -3,34 +3,28 @@ import Foundation
 /// Type eraser for Secret.
 public struct AnySecret: Secret, @unchecked Sendable {
 
-    let base: Any
+    public let base: any Secret
-    private let hashable: AnyHashable
     private let _id: () -> AnyHashable
     private let _name: () -> String
-    private let _algorithm: () -> Algorithm
-    private let _keySize: () -> Int
-    private let _requiresAuthentication: () -> Bool
     private let _publicKey: () -> Data
+    private let _attributes: () -> Attributes
+    private let _eq: (AnySecret) -> Bool
 
     public init<T>(_ secret: T) where T: Secret {
         if let secret = secret as? AnySecret {
             base = secret.base
-            hashable = secret.hashable
             _id = secret._id
             _name = secret._name
-            _algorithm = secret._algorithm
-            _keySize = secret._keySize
-            _requiresAuthentication = secret._requiresAuthentication
             _publicKey = secret._publicKey
+            _attributes = secret._attributes
+            _eq = secret._eq
         } else {
-            base = secret as Any
+            base = secret
-            self.hashable = secret
             _id = { secret.id as AnyHashable }
             _name = { secret.name }
-            _algorithm = { secret.algorithm }
-            _keySize = { secret.keySize }
-            _requiresAuthentication = { secret.requiresAuthentication }
             _publicKey = { secret.publicKey }
+            _attributes = { secret.attributes }
+            _eq = { secret == $0.base as? T }
         }
     }
 
@@ -42,28 +36,20 @@ public struct AnySecret: Secret, @unchecked Sendable {
         _name()
     }
 
-    public var algorithm: Algorithm {
-        _algorithm()
-    }
-
-    public var keySize: Int {
-        _keySize()
-    }
-
-    public var requiresAuthentication: Bool {
-        _requiresAuthentication()
-    }
-
     public var publicKey: Data {
         _publicKey()
     }
     
+    public var attributes: Attributes {
+        _attributes()
+    }
+
     public static func == (lhs: AnySecret, rhs: AnySecret) -> Bool {
-        lhs.hashable == rhs.hashable
+        lhs._eq(rhs)
     }
 
     public func hash(into hasher: inout Hasher) {
-        hashable.hash(into: &hasher)
+        id.hash(into: &hasher)
     }
 
 }

Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift

@@ -1,10 +1,9 @@
 import Foundation
-import Combine
 
 /// Type eraser for SecretStore.
-public class AnySecretStore: SecretStore, @unchecked Sendable {
+open class AnySecretStore: SecretStore, @unchecked Sendable {
 
-    let base: any Sendable
+    let base: any SecretStore
     private let _isAvailable: @MainActor @Sendable () -> Bool
     private let _id: @Sendable () -> UUID
     private let _name: @MainActor @Sendable () -> String
@@ -62,27 +61,34 @@ public class AnySecretStore: SecretStore, @unchecked Sendable {
 
 public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable, @unchecked Sendable {
 
-    private let _create: @Sendable (String, Bool) async throws -> Void
+    private let _create: @Sendable (String, Attributes) async throws -> AnySecret
     private let _delete: @Sendable (AnySecret) async throws -> Void
-    private let _update: @Sendable (AnySecret, String) async throws -> Void
+    private let _update: @Sendable (AnySecret, String, Attributes) async throws -> Void
+    private let _supportedKeyTypes: @Sendable () -> [KeyType]
 
-    public init<SecretStoreType>(modifiable secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable {
+    public init<SecretStoreType>(_ secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable {
-        _create = { try await secretStore.create(name: $0, requiresAuthentication: $1) }
+        _create = { AnySecret(try await secretStore.create(name: $0, attributes: $1)) }
         _delete = { try await secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) }
-        _update = { try await secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1) }
+        _update = { try await secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1, attributes: $2) }
+        _supportedKeyTypes = { secretStore.supportedKeyTypes }
         super.init(secretStore)
     }
 
-    public func create(name: String, requiresAuthentication: Bool) async throws {
+    @discardableResult
-        try await _create(name, requiresAuthentication)
+    public func create(name: String, attributes: Attributes) async throws -> SecretType {
+        try await _create(name, attributes)
     }
 
     public func delete(secret: AnySecret) async throws {
         try await _delete(secret)
     }
 
-    public func update(secret: AnySecret, name: String) async throws {
+    public func update(secret: AnySecret, name: String, attributes: Attributes) async throws {
-        try await _update(secret, name)
+        try await _update(secret, name, attributes)
+    }
+
+    public var supportedKeyTypes: [KeyType] {
+        _supportedKeyTypes()
     }
 
 }

Sources/Packages/Sources/SecretKit/KeychainTypes.swift

@@ -36,12 +36,12 @@ public struct KeychainError: Error {
 /// A signing-related error.
 public struct SigningError: Error {
     /// The underlying error reported by the API, if one was returned.
-    public let error: SecurityError?
+    public let error: CFError?
 
     /// Initializes a SigningError with an optional SecurityError.
     /// - Parameter statusCode: The SecurityError, if one is applicable.
     public init(error: SecurityError?) {
-        self.error = error
+        self.error = unsafe error?.takeRetainedValue()
     }
 
 }
@@ -51,19 +51,17 @@ public extension SecretStore {
     /// Returns the appropriate keychian signature algorithm to use for a given secret.
     /// - Parameters:
     ///   - secret: The secret which will be used for signing.
-    ///   - allowRSA: Whether or not RSA key types should be permited.
     /// - Returns: The appropriate algorithm.
-    func signatureAlgorithm(for secret: SecretType, allowRSA: Bool = false) -> SecKeyAlgorithm {
+    func signatureAlgorithm(for secret: SecretType) -> SecKeyAlgorithm? {
-        switch (secret.algorithm, secret.keySize) {
+        switch secret.keyType {
-        case (.ellipticCurve, 256):
+        case .ecdsa256:
-            return .ecdsaSignatureMessageX962SHA256
+            .ecdsaSignatureMessageX962SHA256
-        case (.ellipticCurve, 384):
+        case .ecdsa384:
-            return .ecdsaSignatureMessageX962SHA384
+            .ecdsaSignatureMessageX962SHA384
-        case (.rsa, 1024), (.rsa, 2048):
+        case .rsa2048:
-            guard allowRSA else { fatalError() }
+            .rsaSignatureMessagePKCS1v15SHA512
-            return .rsaSignatureMessagePKCS1v15SHA512
         default:
-            fatalError()
+            nil
         }
 
     }

Sources/Packages/Sources/SecretKit/OpenSSH/LengthAndData.swift

@@ -0,0 +1,23 @@
+import Foundation
+
+extension Data {
+
+    /// Creates an OpenSSH protocol style data object, which has a length header, followed by the data payload.
+    /// - Returns: OpenSSH data.
+    package var lengthAndData: Data {
+        let rawLength = UInt32(count)
+        var endian = rawLength.bigEndian
+        return unsafe Data(bytes: &endian, count: MemoryLayout<UInt32>.size) + self
+    }
+
+}
+
+extension String {
+
+    /// Creates an OpenSSH protocol style data object, which has a length header, followed by the data payload.
+    /// - Returns: OpenSSH data.
+    package var lengthAndData: Data {
+        Data(utf8).lengthAndData
+    }
+
+}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift

@@ -1,89 +0,0 @@
-import Foundation
-import CryptoKit
-
-/// Generates OpenSSH representations of Secrets.
-public struct OpenSSHKeyWriter: Sendable {
-
-    /// Initializes the writer.
-    public init() {
-    }
-
-    /// Generates an OpenSSH data payload identifying the secret.
-    /// - Returns: OpenSSH data payload identifying the secret.
-    public func data<SecretType: Secret>(secret: SecretType) -> Data {
-        lengthAndData(of: curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!) +
-            lengthAndData(of: curveIdentifier(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!) +
-            lengthAndData(of: secret.publicKey)
-    }
-
-    /// Generates an OpenSSH string representation of the secret.
-    /// - Returns: OpenSSH string representation of the secret.
-    public func openSSHString<SecretType: Secret>(secret: SecretType, comment: String? = nil) -> String {
-        [curveType(for: secret.algorithm, length: secret.keySize), data(secret: secret).base64EncodedString(), comment]
-            .compactMap { $0 }
-            .joined(separator: " ")
-    }
-
-    /// Generates an OpenSSH SHA256 fingerprint string.
-    /// - Returns: OpenSSH SHA256 fingerprint string.
-    public func openSSHSHA256Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
-        // OpenSSL format seems to strip the padding at the end.
-        let base64 = Data(SHA256.hash(data: data(secret: secret))).base64EncodedString()
-        let paddingRange = base64.index(base64.endIndex, offsetBy: -2)..<base64.endIndex
-        let cleaned = base64.replacingOccurrences(of: "=", with: "", range: paddingRange)
-        return "SHA256:\(cleaned)"
-    }
-
-    /// Generates an OpenSSH MD5 fingerprint string.
-    /// - Returns: OpenSSH MD5 fingerprint string.
-    public func openSSHMD5Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
-        Insecure.MD5.hash(data: data(secret: secret))
-            .compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
-            .joined(separator: ":")
-    }
-
-}
-
-extension OpenSSHKeyWriter {
-
-    /// Creates an OpenSSH protocol style data object, which has a length header, followed by the data payload.
-    /// - Parameter data: The data payload.
-    /// - Returns: OpenSSH data.
-    public func lengthAndData(of data: Data) -> Data {
-        let rawLength = UInt32(data.count)
-        var endian = rawLength.bigEndian
-        return Data(bytes: &endian, count: UInt32.bitWidth/8) + data
-    }
-
-    /// The fully qualified OpenSSH identifier for the algorithm.
-    /// - Parameters:
-    ///   - algorithm: The algorithm to identify.
-    ///   - length: The key length of the algorithm.
-    /// - Returns: The OpenSSH identifier for the algorithm.
-    public func curveType(for algorithm: Algorithm, length: Int) -> String {
-        switch algorithm {
-        case .ellipticCurve:
-            return "ecdsa-sha2-nistp" + String(describing: length)
-        case .rsa:
-            // All RSA keys use the same 512 bit hash function, per
-            // https://security.stackexchange.com/questions/255074/why-are-rsa-sha2-512-and-rsa-sha2-256-supported-but-not-reported-by-ssh-q-key
-            return "rsa-sha2-512"
-        }
-    }
-
-    /// The OpenSSH identifier for an algorithm.
-    /// - Parameters:
-    ///   - algorithm: The algorithm to identify.
-    ///   - length: The key length of the algorithm.
-    /// - Returns: The OpenSSH identifier for the algorithm.
-    private func curveIdentifier(for algorithm: Algorithm, length: Int) -> String {
-        switch algorithm {
-        case .ellipticCurve:
-            return "nistp" + String(describing: length)
-        case .rsa:
-            // All RSA keys use the same 512 bit hash function
-            return "rsa-sha2-512"
-        }
-    }
-
-}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHPublicKeyWriter.swift

@@ -0,0 +1,114 @@
+import Foundation
+import CryptoKit
+
+/// Generates OpenSSH representations of the public key sof secrets.
+public struct OpenSSHPublicKeyWriter: Sendable {
+
+    /// Initializes the writer.
+    public init() {
+    }
+
+    /// Generates an OpenSSH data payload identifying the secret.
+    /// - Returns: OpenSSH data payload identifying the secret.
+    public func data<SecretType: Secret>(secret: SecretType) -> Data {
+        switch secret.keyType.algorithm {
+        case .ecdsa:
+            // https://datatracker.ietf.org/doc/html/rfc5656#section-3.1
+            openSSHIdentifier(for: secret.keyType).lengthAndData +
+            ("nistp" + String(describing: secret.keyType.size)).lengthAndData +
+            secret.publicKey.lengthAndData
+        case .mldsa:
+            // https://www.ietf.org/archive/id/draft-sfluhrer-ssh-mldsa-04.txt
+            openSSHIdentifier(for: secret.keyType).lengthAndData +
+            secret.publicKey.lengthAndData
+        case .rsa:
+            // https://datatracker.ietf.org/doc/html/rfc4253#section-6.6
+            openSSHIdentifier(for: secret.keyType).lengthAndData +
+            rsaPublicKeyBlob(secret: secret)
+        }
+    }
+
+    /// Generates an OpenSSH string representation of the secret.
+    /// - Returns: OpenSSH string representation of the secret.
+    public func openSSHString<SecretType: Secret>(secret: SecretType) -> String {
+        return [openSSHIdentifier(for: secret.keyType), data(secret: secret).base64EncodedString(), comment(secret: secret)]
+            .compactMap { $0 }
+            .joined(separator: " ")
+    }
+
+    /// Generates an OpenSSH SHA256 fingerprint string.
+    /// - Returns: OpenSSH SHA256 fingerprint string.
+    public func openSSHSHA256Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
+        // OpenSSL format seems to strip the padding at the end.
+        let base64 = Data(SHA256.hash(data: data(secret: secret))).base64EncodedString()
+        let paddingRange = base64.index(base64.endIndex, offsetBy: -2)..<base64.endIndex
+        let cleaned = base64.replacingOccurrences(of: "=", with: "", range: paddingRange)
+        return "SHA256:\(cleaned)"
+    }
+
+    /// Generates an OpenSSH MD5 fingerprint string.
+    /// - Returns: OpenSSH MD5 fingerprint string.
+    public func openSSHMD5Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
+        Insecure.MD5.hash(data: data(secret: secret))
+            .compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
+            .joined(separator: ":")
+    }
+
+    public func comment<SecretType: Secret>(secret: SecretType) -> String {
+        if let comment = secret.publicKeyAttribution {
+            return comment
+        } else {
+            let dashedKeyName = secret.name.replacingOccurrences(of: " ", with: "-")
+            let dashedHostName = ["secretive", Host.current().localizedName, "local"]
+                .compactMap { $0 }
+                .joined(separator: ".")
+                .replacingOccurrences(of: " ", with: "-")
+            return "\(dashedKeyName)@\(dashedHostName)"
+        }
+
+    }
+}
+
+extension OpenSSHPublicKeyWriter {
+
+    /// The fully qualified OpenSSH identifier for the algorithm.
+    /// - Parameters:
+    ///   - algorithm: The algorithm to identify.
+    ///   - length: The key length of the algorithm.
+    /// - Returns: The OpenSSH identifier for the algorithm.
+    public func openSSHIdentifier(for keyType: KeyType) -> String {
+        switch keyType {
+        case .ecdsa256:
+            "ecdsa-sha2-nistp256"
+        case .ecdsa384:
+            "ecdsa-sha2-nistp384"
+        case .mldsa65:
+            "ssh-mldsa-65"
+        case .mldsa87:
+            "ssh-mldsa-87"
+        case .rsa2048:
+            "ssh-rsa"
+        default:
+            "unknown"
+        }
+    }
+
+}
+
+extension OpenSSHPublicKeyWriter {
+
+    func rsaPublicKeyBlob<SecretType: Secret>(secret: SecretType) -> Data {
+        // Cheap way to pull out e and n as defined in https://datatracker.ietf.org/doc/html/rfc4253
+        // Keychain stores it as a thin ASN.1 wrapper with this format:
+        // [4 byte prefix][2 byte prefix][n][2 byte prefix][e]
+        // Rather than parse out the whole ASN.1 blob, we'll cheat and pull values directly since
+        // we only support one key type, and the keychain always gives it in a specific format.
+        guard secret.keyType == .rsa2048 else { fatalError() }
+        let length = secret.keyType.size/8
+        let data = secret.publicKey
+        let n = Data(data[8..<(9+length)])
+        let e = Data(data[(2+9+length)...])
+        return e.lengthAndData + n.lengthAndData
+    }
+
+}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHReader.swift

@@ -1,30 +0,0 @@
-import Foundation
-
-/// Reads OpenSSH protocol data.
-public final class OpenSSHReader {
-
-    var remaining: Data
-
-    /// Initialize the reader with an OpenSSH data payload.
-    /// - Parameter data: The data to read.
-    public init(data: Data) {
-        remaining = Data(data)
-    }
-
-    /// Reads the next chunk of data from the playload.
-    /// - Returns: The next chunk of data.
-    public func readNextChunk() -> Data {
-        let lengthRange = 0..<(UInt32.bitWidth/8)
-        let lengthChunk = remaining[lengthRange]
-        remaining.removeSubrange(lengthRange)
-        let littleEndianLength = lengthChunk.withUnsafeBytes { pointer in
-            return pointer.load(as: UInt32.self)
-        }
-        let length = Int(littleEndianLength.bigEndian)
-        let dataRange = 0..<length
-        let ret = Data(remaining[dataRange])
-        remaining.removeSubrange(dataRange)
-        return ret
-    }
-
-}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHSignatureWriter.swift

@@ -0,0 +1,75 @@
+import Foundation
+import CryptoKit
+
+/// Generates OpenSSH representations of Secrets.
+public struct OpenSSHSignatureWriter: Sendable {
+
+    /// Initializes the writer.
+    public init() {
+    }
+
+    /// Generates an OpenSSH data payload identifying the secret.
+    /// - Returns: OpenSSH data payload identifying the secret.
+    public func data<SecretType: Secret>(secret: SecretType, signature: Data) -> Data {
+        switch secret.keyType.algorithm {
+        case .ecdsa:
+            // https://datatracker.ietf.org/doc/html/rfc5656#section-3.1
+            ecdsaSignature(signature, keyType: secret.keyType)
+        case .mldsa:
+            // https://datatracker.ietf.org/doc/html/draft-sfluhrer-ssh-mldsa-00#name-public-key-algorithms
+            mldsaSignature(signature, keyType: secret.keyType)
+        case .rsa:
+            // https://datatracker.ietf.org/doc/html/rfc4253#section-6.6
+            rsaSignature(signature)
+        }
+    }
+
+}
+
+
+extension OpenSSHSignatureWriter {
+
+    func ecdsaSignature(_ rawRepresentation: Data, keyType: KeyType) -> Data {
+        let rawLength = rawRepresentation.count/2
+        // Check if we need to pad with 0x00 to prevent certain
+        // ssh servers from thinking r or s is negative
+        let paddingRange: ClosedRange<UInt8> = 0x80...0xFF
+        var r = Data(rawRepresentation[0..<rawLength])
+        if paddingRange ~= r.first! {
+            r.insert(0x00, at: 0)
+        }
+        var s = Data(rawRepresentation[rawLength...])
+        if paddingRange ~= s.first! {
+            s.insert(0x00, at: 0)
+        }
+
+        var signatureChunk = Data()
+        signatureChunk.append(r.lengthAndData)
+        signatureChunk.append(s.lengthAndData)
+        var mutSignedData = Data()
+        var sub = Data()
+        sub.append(OpenSSHPublicKeyWriter().openSSHIdentifier(for: keyType).lengthAndData)
+        sub.append(signatureChunk.lengthAndData)
+        mutSignedData.append(sub.lengthAndData)
+        return mutSignedData
+    }
+
+    func mldsaSignature(_ rawRepresentation: Data, keyType: KeyType) -> Data {
+        var mutSignedData = Data()
+        var sub = Data()
+        sub.append(OpenSSHPublicKeyWriter().openSSHIdentifier(for: keyType).lengthAndData)
+        sub.append(rawRepresentation.lengthAndData)
+        mutSignedData.append(sub.lengthAndData)
+        return mutSignedData
+    }
+
+    func rsaSignature(_ rawRepresentation: Data) -> Data {
+        var mutSignedData = Data()
+        var sub = Data()
+        sub.append("rsa-sha2-512".lengthAndData)
+        sub.append(rawRepresentation.lengthAndData)
+        mutSignedData.append(sub.lengthAndData)
+        return mutSignedData
+    }
+
+}

Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift

@@ -5,12 +5,12 @@ import OSLog
 public final class PublicKeyFileStoreController: Sendable {
 
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController")
-    private let directory: String
+    private let directory: URL
-    private let keyWriter = OpenSSHKeyWriter()
+    private let keyWriter = OpenSSHPublicKeyWriter()
 
     /// Initializes a PublicKeyFileStoreController.
-    public init(homeDirectory: String) {
+    public init(homeDirectory: URL) {
-        directory = homeDirectory.appending("/PublicKeys")
+        directory = homeDirectory.appending(component: "PublicKeys")
     }
 
     /// Writes out the keys specified to disk.
@@ -20,19 +20,20 @@ public final class PublicKeyFileStoreController: Sendable {
         logger.log("Writing public keys to disk")
         if clear {
             let validPaths = Set(secrets.map { publicKeyPath(for: $0) }).union(Set(secrets.map { sshCertificatePath(for: $0) }))
-            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: directory)) ?? []
+            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: directory.path())) ?? []
             let fullPathContents = contentsOfDirectory.map { "\(directory)/\($0)" }
 
             let untracked = Set(fullPathContents)
                 .subtracting(validPaths)
             for path in untracked {
-                try? FileManager.default.removeItem(at: URL(fileURLWithPath: path))
+                // string instead of fileURLWithPath since we're already using fileURL format.
+                try? FileManager.default.removeItem(at: URL(string: path)!)
             }
         }
-        try? FileManager.default.createDirectory(at: URL(fileURLWithPath: directory), withIntermediateDirectories: false, attributes: nil)
+        try? FileManager.default.createDirectory(at: directory, withIntermediateDirectories: false, attributes: nil)
         for secret in secrets {
             let path = publicKeyPath(for: secret)
-            guard let data = keyWriter.openSSHString(secret: secret).data(using: .utf8) else { continue }
+            let data = Data(keyWriter.openSSHString(secret: secret).utf8)
             FileManager.default.createFile(atPath: path, contents: data, attributes: nil)
         }
         logger.log("Finished writing public keys")
@@ -44,14 +45,14 @@ public final class PublicKeyFileStoreController: Sendable {
     /// - Warning: This method returning a path does not imply that a key has been written to disk already. This method only describes where it will be written to.
     public func publicKeyPath<SecretType: Secret>(for secret: SecretType) -> String {
         let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
-        return directory.appending("/").appending("\(minimalHex).pub")
+        return directory.appending(component: "\(minimalHex).pub").path()
     }
 
     /// Short-circuit check to ship enumerating a bunch of paths if there's nothing in the cert directory.
     public var hasAnyCertificates: Bool {
         do {
             return try FileManager.default
-                .contentsOfDirectory(atPath: directory)
+                .contentsOfDirectory(atPath: directory.path())
                 .filter { $0.hasSuffix("-cert.pub") }
                 .isEmpty == false
         } catch {
@@ -65,7 +66,7 @@ public final class PublicKeyFileStoreController: Sendable {
     /// - Warning: This method returning a path does not imply that a key has a SSH certificates. This method only describes where it will be.
     public func sshCertificatePath<SecretType: Secret>(for secret: SecretType) -> String {
         let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
-        return directory.appending("/").appending("\(minimalHex)-cert.pub")
+        return directory.appending(component: "\(minimalHex)-cert.pub").path()
     }
 
 }

Sources/Packages/Sources/SecretKit/SecretStoreList.swift

@@ -20,7 +20,7 @@ import Observation
 
     /// Adds a non-type-erased modifiable SecretStore.
     public func add<SecretStoreType: SecretStoreModifiable>(store: SecretStoreType) {
-        let modifiable = AnySecretStoreModifiable(modifiable: store)
+        let modifiable = AnySecretStoreModifiable(store)
         if modifiableStore == nil {
             modifiableStore = modifiable
         }
@@ -36,4 +36,12 @@ import Observation
         stores.flatMap(\.secrets)
     }
 
+    public var allSecretsWithStores: [(AnySecret, AnySecretStore)] {
+        stores.flatMap { store in
+            store.secrets.map { secret in
+                (secret, store)
+            }
+        }
+    }
+
 }

Sources/Packages/Sources/SecretKit/Types/CreationOptions.swift

@@ -0,0 +1,55 @@
+import Foundation
+
+public struct Attributes: Sendable, Codable, Hashable {
+    
+    /// The type of key involved.
+    public let keyType: KeyType
+
+    /// The authentication requirements for the key. This is simply a description of the option recorded at creation – modifying it doers not modify the key's authentication requirements.
+    public let authentication: AuthenticationRequirement
+    
+    /// The string appended to the end of the SSH Public Key.
+    /// If nil, a default value will be used.
+    public var publicKeyAttribution: String?
+
+    public init(
+        keyType: KeyType,
+        authentication: AuthenticationRequirement,
+        publicKeyAttribution: String? = nil
+    ) {
+        self.keyType = keyType
+        self.authentication = authentication
+        self.publicKeyAttribution = publicKeyAttribution
+    }
+
+    public struct UnsupportedOptionError: Error {
+        package init() {}
+    }
+    
+}
+
+/// The option specified
+public enum AuthenticationRequirement: String, Hashable, Sendable, Codable, Identifiable {
+
+    /// Authentication is not required for usage.
+    case notRequired
+    
+    /// The user needs to authenticate, using either a biometric option, a connected authorized watch, or password entry..
+    case presenceRequired
+    
+    /// ONLY the current set of biometric data, as matching at time of creation, is accepted.
+    /// - Warning: This is a dangerous option prone to data loss. The user should be warned before configuring this key that if they modify their enrolled biometry INCLUDING by simply adding a new entry (ie, adding another fingeprting), the key will no longer be able to be accessed. This cannot be overridden with a password.
+    case biometryCurrent
+    
+    /// The authentication requirement was not recorded at creation, and is unknown.
+    case unknown
+    
+    /// Whether or not the key is known to require authentication.
+    public var required: Bool {
+        self == .presenceRequired || self == .biometryCurrent
+    }
+
+    public var id: AuthenticationRequirement {
+        self
+    }
+}

Sources/Packages/Sources/SecretKit/Types/Secret.swift

@@ -5,43 +5,81 @@ public protocol Secret: Identifiable, Hashable, Sendable {
 
     /// A user-facing string identifying the Secret.
     var name: String { get }
-    /// The algorithm this secret uses.
-    var algorithm: Algorithm { get }
-    /// The key size for the secret.
-    var keySize: Int { get }
-    /// Whether the secret requires authentication before use.
-    var requiresAuthentication: Bool { get }
     /// The public key data for the secret.
     var publicKey: Data { get }
+    /// The attributes of the key.
+    var attributes: Attributes { get }
 
 }
 
-/// The type of algorithm the Secret uses. Currently, only elliptic curve algorithms are supported.
+public extension Secret {
-public enum Algorithm: Hashable, Sendable {
 
-    case ellipticCurve
+    /// The algorithm and key size this secret uses.
+    var keyType: KeyType {
+        attributes.keyType
+    }
+
+    /// Whether the secret requires authentication before use.
+    var authenticationRequirement: AuthenticationRequirement {
+        attributes.authentication
+    }
+    /// An attribution string to apply to the generated public key.
+    var publicKeyAttribution: String? {
+        attributes.publicKeyAttribution
+    }
+
+}
+
+/// The type of algorithm the Secret uses.
+public struct KeyType: Hashable, Sendable, Codable, CustomStringConvertible {
+
+    public static let ecdsa256 = KeyType(algorithm: .ecdsa, size: 256)
+    public static let ecdsa384 = KeyType(algorithm: .ecdsa, size: 384)
+    public static let mldsa65 = KeyType(algorithm: .mldsa, size: 65)
+    public static let mldsa87 = KeyType(algorithm: .mldsa, size: 87)
+    public static let rsa2048 = KeyType(algorithm: .rsa, size: 2048)
+
+    public enum Algorithm: Hashable, Sendable, Codable {
+        case ecdsa
+        case mldsa
         case rsa
+    }
+
+    public var algorithm: Algorithm
+    public var size: Int
+
+    public init(algorithm: Algorithm, size: Int) {
+        self.algorithm = algorithm
+        self.size = size
+    }
 
     /// Initializes the Algorithm with a secAttr representation of an algorithm.
     /// - Parameter secAttr: the secAttr, represented as an NSNumber.
-    public init(secAttr: NSNumber) {
+    public init?(secAttr: NSNumber, size: Int) {
         let secAttrString = secAttr.stringValue as CFString
         switch secAttrString {
         case kSecAttrKeyTypeEC:
-            self = .ellipticCurve
+            algorithm = .ecdsa
         case kSecAttrKeyTypeRSA:
-            self = .rsa
+            algorithm = .rsa
         default:
-            fatalError()
+            return nil
+        }
+        self.size = size
+    }
+    
+    public var secAttrKeyType: CFString? {
+        switch algorithm {
+        case .ecdsa:
+            kSecAttrKeyTypeEC
+        case .rsa:
+            kSecAttrKeyTypeRSA
+        case .mldsa:
+            nil
         }
     }
     
-    public var secAttrKeyType: CFString {
+    public var description: String {
-        switch self {
+        "\(algorithm)-\(size)"
-        case .ellipticCurve:
-            return kSecAttrKeyTypeEC
-        case .rsa:
-            return kSecAttrKeyTypeRSA
-        }
     }
 }

Sources/Packages/Sources/SecretKit/Types/SecretStore.swift

@@ -1,8 +1,7 @@
 import Foundation
-import Combine
 
 /// Manages access to Secrets, and performs signature operations on data using those Secrets.
-public protocol SecretStore: Identifiable, Sendable {
+public protocol SecretStore<SecretType>: Identifiable, Sendable {
 
     associatedtype SecretType: Secret
 
@@ -42,13 +41,14 @@ public protocol SecretStore: Identifiable, Sendable {
 }
 
 /// A SecretStore that the Secretive admin app can modify.
-public protocol SecretStoreModifiable: SecretStore {
+public protocol SecretStoreModifiable<SecretType>: SecretStore {
 
     /// Creates a new ``Secret`` in the store.
     /// - Parameters:
     ///   - name: The user-facing name for the ``Secret``.
-    ///   - requiresAuthentication: A boolean indicating whether or not the user will be required to authenticate before performing signature operations with the secret.
+    ///   - attributes: A struct describing the options for creating the key.'
-    func create(name: String, requiresAuthentication: Bool) async throws
+    @discardableResult
+    func create(name: String, attributes: Attributes) async throws -> SecretType
 
     /// Deletes a Secret in the store.
     /// - Parameters:
@@ -59,7 +59,10 @@ public protocol SecretStoreModifiable: SecretStore {
     /// - Parameters:
     ///   - secret: The ``Secret`` to update.
     ///   - name: The new name for the Secret.
-    func update(secret: SecretType, name: String) async throws
+    ///   - attributes: The new attributes for the secret.
+    func update(secret: SecretType, name: String, attributes: Attributes) async throws
+
+    var supportedKeyTypes: [KeyType] { get }
 
 }
 

Sources/Packages/Sources/SecureEnclaveSecretKit/CryptoKitMigrator.swift

@@ -0,0 +1,103 @@
+import Foundation
+import Security
+import CryptoTokenKit
+import CryptoKit
+import SecretKit
+import os
+
+extension SecureEnclave {
+
+    public struct CryptoKitMigrator {
+
+        private let logger = Logger(subsystem: "com.maxgoedjen.secretive.migration", category: "CryptoKitMigrator")
+
+        public init() {
+        }
+        
+        /// Keys prior to 3.0 were created and stored directly using the keychain as kSecClassKey items. CryptoKit operates a little differently, in that it creates a key on your behalf which you can persist using an opaque data blob to a generic keychain item. Keychain created keys _also_ use this blob under the hood, but it's stored in the "toid" attribute. This migrates the old keys from kSecClassKey to generic items, copying the "toid" to be the main stored data. If the key is migrated successfully, the old key's identifier is renamed to indicate it's been migrated.
+        /// - Note: Migration is non-destructive – users can still see and use their keys in older versions of Secretive.
+        @MainActor public func migrate(to store: Store) throws {
+            let privateAttributes = KeychainDictionary([
+                kSecClass: kSecClassKey,
+                kSecAttrKeyType: Constants.oldKeyType,
+                kSecAttrApplicationTag: SecureEnclave.Store.Constants.keyTag,
+                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+                kSecReturnRef: true,
+                kSecMatchLimit: kSecMatchLimitAll,
+                kSecReturnAttributes: true
+            ])
+            var privateUntyped: CFTypeRef?
+            unsafe SecItemCopyMatching(privateAttributes, &privateUntyped)
+            guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
+            let migratedPublicKeys = Set(store.secrets.map(\.publicKey))
+            var migratedAny = false
+            for key in privateTyped {
+                let name = key[kSecAttrLabel] as? String ?? String(localized: .unnamedSecret)
+                let id = key[kSecAttrApplicationLabel] as! Data
+                guard !id.contains(Constants.migrationMagicNumber) else {
+                    logger.log("Skipping \(name), already migrated.")
+                    continue
+                }
+                let ref = key[kSecValueRef] as! SecKey
+                let attributes = SecKeyCopyAttributes(ref) as! [CFString: Any]
+                let tokenObjectID = unsafe attributes[Constants.tokenObjectID] as! Data
+                let accessControl = attributes[kSecAttrAccessControl] as! SecAccessControl
+                // Best guess.
+                let auth: AuthenticationRequirement = String(describing: accessControl)
+                    .contains("DeviceOwnerAuthentication") ? .presenceRequired : .unknown
+                do {
+                    let parsed = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: tokenObjectID)
+                    let secret = Secret(id: UUID().uuidString, name: name, publicKey: parsed.publicKey.x963Representation, attributes: Attributes(keyType: .init(algorithm: .ecdsa, size: 256), authentication: auth))
+                    guard !migratedPublicKeys.contains(parsed.publicKey.x963Representation) else {
+                        logger.log("Skipping \(name), public key already present. Marking as migrated.")
+                        try markMigrated(secret: secret, oldID: id)
+                        continue
+                    }
+                    logger.log("Migrating \(name).")
+                    try store.saveKey(tokenObjectID, name: name, attributes: secret.attributes)
+                    logger.log("Migrated \(name).")
+                    try markMigrated(secret: secret, oldID: id)
+                    migratedAny = true
+                } catch {
+                    logger.error("Failed to migrate \(name): \(error).")
+                }
+            }
+            if migratedAny {
+                store.reloadSecrets()
+            }
+        }
+
+
+
+        public func markMigrated(secret: Secret, oldID: Data) throws {
+            let updateQuery = KeychainDictionary([
+                kSecClass: kSecClassKey,
+                kSecAttrApplicationLabel: secret.id
+            ])
+
+            let newID = oldID + Constants.migrationMagicNumber
+            let updatedAttributes = KeychainDictionary([
+                kSecAttrApplicationLabel: newID as CFData
+            ])
+
+            let status = SecItemUpdate(updateQuery, updatedAttributes)
+            if status != errSecSuccess {
+                throw KeychainError(statusCode: status)
+            }
+        }
+
+
+    }
+
+}
+
+extension SecureEnclave.CryptoKitMigrator {
+
+    enum Constants {
+        public static let oldKeyType = kSecAttrKeyTypeECSECPrimeRandom as String
+        public static let migrationMagicNumber = Data("_cryptokit_1".utf8)
+        // https://github.com/apple-opensource/Security/blob/5e9101b3bd1fb096bae4f40e79d50426ba1db8e9/OSX/sec/Security/SecItemConstants.c#L111
+        public static nonisolated(unsafe) let tokenObjectID = "toid" as CFString
+    }
+
+}

Sources/Packages/Sources/SecureEnclaveSecretKit/PersistentAuthenticationHandler.swift

@@ -21,7 +21,7 @@ extension SecureEnclave {
         ///   - duration: The duration of the authorization context, in seconds.
         init(secret: Secret, context: LAContext, duration: TimeInterval) {
             self.secret = secret
-            self.context = context
+            unsafe self.context = context
             let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
             self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
         }
@@ -56,11 +56,9 @@ extension SecureEnclave {
             formatter.unitsStyle = .spellOut
             formatter.allowedUnits = [.hour, .minute, .day]
 
-            if let durationString = formatter.string(from: duration) {
+            
+            let durationString = formatter.string(from: duration)!
             newContext.localizedReason = String(localized: .authContextPersistForDuration(secretName: secret.name, duration: durationString))
-            } else {
-                newContext.localizedReason = String(localized: .authContextPersistForDurationUnknown(secretName: secret.name))
-            }
             let success = try await newContext.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: newContext.localizedReason)
             guard success else { return }
             let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveSecret.swift

@@ -1,5 +1,4 @@
 import Foundation
-import Combine
 import SecretKit
 
 extension SecureEnclave {
@@ -7,12 +6,26 @@ extension SecureEnclave {
     /// An implementation of Secret backed by the Secure Enclave.
     public struct Secret: SecretKit.Secret {
 
-        public let id: Data
+        public let id: String
         public let name: String
-        public let algorithm = Algorithm.ellipticCurve
-        public let keySize = 256
-        public let requiresAuthentication: Bool
         public let publicKey: Data
+        public let attributes: Attributes
+
+        init(
+            id: String,
+            name: String,
+            publicKey: Data,
+            attributes: Attributes
+        ) {
+            self.id = id
+            self.name = name
+            self.publicKey = publicKey
+            self.attributes = attributes
+        }
+
+        public static func ==(lhs: Self, rhs: Self) -> Bool {
+            lhs.id == rhs.id
+        }
 
     }
 

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift

@@ -4,10 +4,11 @@ import Security
 import CryptoKit
 import LocalAuthentication
 import SecretKit
+import os
 
 extension SecureEnclave {
 
-    /// An implementation of Store backed by the Secure Enclave.
+    /// An implementation of Store backed by the Secure Enclave using CryptoKit API.
     @Observable public final class Store: SecretStoreModifiable {
 
         @MainActor public var secrets: [Secret] = []
@@ -22,118 +23,69 @@ extension SecureEnclave {
         @MainActor public init() {
             loadSecrets()
             Task {
-                for await _ in DistributedNotificationCenter.default().notifications(named: .secretStoreUpdated) {
+                for await note in DistributedNotificationCenter.default().notifications(named: .secretStoreUpdated) {
-                    await reloadSecretsInternal(notifyAgent: false)
+                    guard Constants.notificationToken != (note.object as? String) else {
+                        // Don't reload if we're the ones triggering this by reloading.
+                        continue
+                    }
+                    reloadSecrets()
                 }
             }
         }
 
-        // MARK: Public API
+        // MARK: - Public API
         
-        public func create(name: String, requiresAuthentication: Bool) async throws {
+        // MARK: SecretStore
-            var accessError: SecurityError?
-            let flags: SecAccessControlCreateFlags
-            if requiresAuthentication {
-                flags = [.privateKeyUsage, .userPresence]
-            } else {
-                flags = .privateKeyUsage
-            }
-            let access =
-                SecAccessControlCreateWithFlags(kCFAllocatorDefault,
-                                                kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-                                                flags,
-                                                &accessError) as Any
-            if let error = accessError {
-                throw error.takeRetainedValue() as Error
-            }
-
-            let attributes = KeychainDictionary([
-                kSecAttrLabel: name,
-                kSecAttrKeyType: Constants.keyType,
-                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
-                kSecAttrApplicationTag: Constants.keyTag,
-                kSecPrivateKeyAttrs: [
-                    kSecAttrIsPermanent: true,
-                    kSecAttrAccessControl: access
-                ]
-            ])
-
-            var createKeyError: SecurityError?
-            let keypair = SecKeyCreateRandomKey(attributes, &createKeyError)
-            if let error = createKeyError {
-                throw error.takeRetainedValue() as Error
-            }
-            guard let keypair = keypair, let publicKey = SecKeyCopyPublicKey(keypair) else {
-                throw KeychainError(statusCode: nil)
-            }
-            try savePublicKey(publicKey, name: name)
-            await reloadSecretsInternal()
-        }
-
-        public func delete(secret: Secret) async throws {
-            let deleteAttributes = KeychainDictionary([
-                kSecClass: kSecClassKey,
-                kSecAttrApplicationLabel: secret.id as CFData
-            ])
-            let status = SecItemDelete(deleteAttributes)
-            if status != errSecSuccess {
-                throw KeychainError(statusCode: status)
-            }
-            await reloadSecretsInternal()
-        }
-
-        public func update(secret: Secret, name: String) async throws {
-            let updateQuery = KeychainDictionary([
-                kSecClass: kSecClassKey,
-                kSecAttrApplicationLabel: secret.id as CFData
-            ])
-
-            let updatedAttributes = KeychainDictionary([
-                kSecAttrLabel: name,
-            ])
-
-            let status = SecItemUpdate(updateQuery, updatedAttributes)
-            if status != errSecSuccess {
-                throw KeychainError(statusCode: status)
-            }
-            await reloadSecretsInternal()
-        }
         
         public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
-            let context: LAContext
+            var context: LAContext
             if let existing = await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret) {
-                context = existing.context
+                context = unsafe existing.context
             } else {
                 let newContext = LAContext()
+                newContext.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
                 newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
                 context = newContext
             }
-            context.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
+
-            let attributes = KeychainDictionary([
+            let queryAttributes = KeychainDictionary([
-                kSecClass: kSecClassKey,
+                kSecClass: Constants.keyClass,
-                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+                kSecAttrService: Constants.keyTag,
-                kSecAttrApplicationLabel: secret.id as CFData,
+                kSecUseDataProtectionKeychain: true,
-                kSecAttrKeyType: Constants.keyType,
+                kSecAttrAccount: secret.id,
-                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
+                kSecReturnAttributes: true,
-                kSecAttrApplicationTag: Constants.keyTag,
+                kSecReturnData: true,
-                kSecUseAuthenticationContext: context,
-                kSecReturnRef: true
             ])
             var untyped: CFTypeRef?
-            let status = SecItemCopyMatching(attributes, &untyped)
+            let status = unsafe SecItemCopyMatching(queryAttributes, &untyped)
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
             }
-            guard let untypedSafe = untyped else {
+            guard let untypedSafe = untyped as? [CFString: Any] else {
                 throw KeychainError(statusCode: errSecSuccess)
             }
-            let key = untypedSafe as! SecKey
+            guard let attributesData = untypedSafe[kSecAttrGeneric] as? Data,
-            var signError: SecurityError?
+                  let keyData = untypedSafe[kSecValueData] as? Data else {
-
+                throw MissingAttributesError()
-            guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else {
-                throw SigningError(error: signError)
             }
-            return signature as Data
+            let attributes = try JSONDecoder().decode(Attributes.self, from: attributesData)
+
+            switch attributes.keyType {
+            case .ecdsa256:
+                let key = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: keyData, authenticationContext: context)
+                return try key.signature(for: data).rawRepresentation
+            case .mldsa65:
+                guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
+                let key = try CryptoKit.SecureEnclave.MLDSA65.PrivateKey(dataRepresentation: keyData, authenticationContext: context)
+                return try key.signature(for: data)
+            case .mldsa87:
+                guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
+                let key = try CryptoKit.SecureEnclave.MLDSA87.PrivateKey(dataRepresentation: keyData, authenticationContext: context)
+                return try key.signature(for: data)
+            default:
+                throw UnsupportedAlgorithmError()
+            }
+
         }
 
         public func existingPersistedAuthenticationContext(secret: Secret) async -> PersistedAuthenticationContext? {
@@ -144,114 +96,197 @@ extension SecureEnclave {
             try await persistentAuthenticationHandler.persistAuthentication(secret: secret, forDuration: duration)
         }
 
-        public func reloadSecrets() async {
+        @MainActor public func reloadSecrets() {
-            await reloadSecretsInternal(notifyAgent: false)
+            let before = secrets
+            secrets.removeAll()
+            loadSecrets()
+            if secrets != before {
+                NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
+                DistributedNotificationCenter.default().postNotificationName(.secretStoreUpdated, object: Constants.notificationToken, deliverImmediately: true)
+            }
         }
 
+        // MARK: SecretStoreModifiable
+        
+        public func create(name: String, attributes: Attributes) async throws -> Secret {
+            var accessError: SecurityError?
+            let flags: SecAccessControlCreateFlags = switch attributes.authentication {
+            case .notRequired:
+                [.privateKeyUsage]
+            case .presenceRequired:
+                [.userPresence, .privateKeyUsage]
+            case .biometryCurrent:
+                [.biometryCurrentSet, .privateKeyUsage]
+            case .unknown:
+                fatalError()
+            }
+            let access =
+            unsafe SecAccessControlCreateWithFlags(kCFAllocatorDefault,
+                                                kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+                                                flags,
+                                                &accessError)
+            if let error = unsafe accessError {
+                throw unsafe error.takeRetainedValue() as Error
+            }
+            let dataRep: Data
+            let publicKey: Data
+            switch attributes.keyType {
+            case .ecdsa256:
+                let created = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(accessControl: access!)
+                dataRep = created.dataRepresentation
+                publicKey = created.publicKey.x963Representation
+            case .mldsa65:
+                guard #available(macOS 26.0, *) else { throw Attributes.UnsupportedOptionError() }
+                let created = try CryptoKit.SecureEnclave.MLDSA65.PrivateKey(accessControl: access!)
+                dataRep = created.dataRepresentation
+                publicKey = created.publicKey.rawRepresentation
+            case .mldsa87:
+                guard #available(macOS 26.0, *) else { throw Attributes.UnsupportedOptionError() }
+                let created = try CryptoKit.SecureEnclave.MLDSA87.PrivateKey(accessControl: access!)
+                dataRep = created.dataRepresentation
+                publicKey = created.publicKey.rawRepresentation
+            default:
+                throw Attributes.UnsupportedOptionError()
+            }
+            let id = try saveKey(dataRep, name: name, attributes: attributes)
+            await reloadSecrets()
+            return Secret(id: id, name: name, publicKey: publicKey, attributes: attributes)
+        }
+
+        public func delete(secret: Secret) async throws {
+            let deleteAttributes = KeychainDictionary([
+                kSecClass: Constants.keyClass,
+                kSecAttrService: Constants.keyTag,
+                kSecUseDataProtectionKeychain: true,
+                kSecAttrAccount: secret.id,
+            ])
+            let status = SecItemDelete(deleteAttributes)
+            if status != errSecSuccess {
+                throw KeychainError(statusCode: status)
+            }
+            await reloadSecrets()
+        }
+
+        public func update(secret: Secret, name: String, attributes: Attributes) async throws {
+            let updateQuery = KeychainDictionary([
+                kSecClass: Constants.keyClass,
+                kSecAttrAccount: secret.id,
+            ])
+
+            let attributes = try JSONEncoder().encode(attributes)
+            let updatedAttributes = KeychainDictionary([
+                kSecAttrLabel: name,
+                kSecAttrGeneric: attributes,
+            ])
+
+            let status = SecItemUpdate(updateQuery, updatedAttributes)
+            if status != errSecSuccess {
+                throw KeychainError(statusCode: status)
+            }
+            await reloadSecrets()
+        }
+        
+        public var supportedKeyTypes: [KeyType] {
+            if #available(macOS 26, *) {
+                [
+                    .ecdsa256,
+                    .mldsa65,
+                    .mldsa87,
+                ]
+            } else {
+                [.ecdsa256]
+            }
+        }
     }
 
 }
 
 extension SecureEnclave.Store {
 
-    /// Reloads all secrets from the store.
-    /// - Parameter notifyAgent: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
-    @MainActor private func reloadSecretsInternal(notifyAgent: Bool = true) async {
-        let before = secrets
-        secrets.removeAll()
-        loadSecrets()
-        if secrets != before {
-            NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
-            if notifyAgent {
-                DistributedNotificationCenter.default().postNotificationName(.secretStoreUpdated, object: nil, deliverImmediately: true)
-            }
-        }
-    }
-
     /// Loads all secrets from the store.
     @MainActor private func loadSecrets() {
-        let publicAttributes = KeychainDictionary([
+        let queryAttributes = KeychainDictionary([
-            kSecClass: kSecClassKey,
+            kSecClass: Constants.keyClass,
-            kSecAttrKeyType: SecureEnclave.Constants.keyType,
+            kSecAttrService: Constants.keyTag,
-            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
+            kSecUseDataProtectionKeychain: true,
-            kSecAttrKeyClass: kSecAttrKeyClassPublic,
+            kSecReturnData: true,
-            kSecReturnRef: true,
             kSecMatchLimit: kSecMatchLimitAll,
             kSecReturnAttributes: true
             ])
-        var publicUntyped: CFTypeRef?
+        var untyped: CFTypeRef?
-        SecItemCopyMatching(publicAttributes, &publicUntyped)
+        unsafe SecItemCopyMatching(queryAttributes, &untyped)
-        guard let publicTyped = publicUntyped as? [[CFString: Any]] else { return }
+        guard let typed = untyped as? [[CFString: Any]] else { return }
-        let privateAttributes = KeychainDictionary([
+        let wrapped: [SecureEnclave.Secret] = typed.compactMap {
-            kSecClass: kSecClassKey,
+            do {
-            kSecAttrKeyType: SecureEnclave.Constants.keyType,
+                let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_secret")
-            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
+                guard let attributesData = $0[kSecAttrGeneric] as? Data,
-            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+                let id = $0[kSecAttrAccount] as? String else {
-            kSecReturnRef: true,
+                    throw MissingAttributesError()
-            kSecMatchLimit: kSecMatchLimitAll,
-            kSecReturnAttributes: true
-            ])
-        var privateUntyped: CFTypeRef?
-        SecItemCopyMatching(privateAttributes, &privateUntyped)
-        guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
-        let privateMapped = privateTyped.reduce(into: [:] as [Data: [CFString: Any]]) { partialResult, next in
-            let id = next[kSecAttrApplicationLabel] as! Data
-            partialResult[id] = next
                 }
-        let authNotRequiredAccessControl: SecAccessControl =
+                let attributes = try JSONDecoder().decode(Attributes.self, from: attributesData)
-            SecAccessControlCreateWithFlags(kCFAllocatorDefault,
+                let keyData = $0[kSecValueData] as! Data
-                                            kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+                let publicKey: Data
-                                            [.privateKeyUsage],
+                switch attributes.keyType {
-                                            nil)!
+                case .ecdsa256:
-
+                    let key = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: keyData)
-        let wrapped: [SecureEnclave.Secret] = publicTyped.map {
+                    publicKey = key.publicKey.x963Representation
-            let name = $0[kSecAttrLabel] as? String ?? String(localized: .unnamedSecret)
+                case .mldsa65:
-            let id = $0[kSecAttrApplicationLabel] as! Data
+                    guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-            let publicKeyRef = $0[kSecValueRef] as! SecKey
+                    let key = try CryptoKit.SecureEnclave.MLDSA65.PrivateKey(dataRepresentation: keyData)
-            let publicKeyAttributes = SecKeyCopyAttributes(publicKeyRef) as! [CFString: Any]
+                    publicKey = key.publicKey.rawRepresentation
-            let publicKey = publicKeyAttributes[kSecValueData] as! Data
+                case .mldsa87:
-            let privateKey = privateMapped[id]
+                    guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-            let requiresAuth: Bool
+                    let key = try CryptoKit.SecureEnclave.MLDSA87.PrivateKey(dataRepresentation: keyData)
-            if let authRequirements = privateKey?[kSecAttrAccessControl] {
+                    publicKey = key.publicKey.rawRepresentation
-                // Unfortunately we can't inspect the access control object directly, but it does behave predicatable with equality.
+                default:
-                requiresAuth = authRequirements as! SecAccessControl != authNotRequiredAccessControl
+                    throw UnsupportedAlgorithmError()
-            } else {
+                }
-                requiresAuth = false
+                return SecureEnclave.Secret(id: id, name: name, publicKey: publicKey, attributes: attributes)
+            } catch {
+                return nil
             }
-            return SecureEnclave.Secret(id: id, name: name, requiresAuthentication: requiresAuth, publicKey: publicKey)
         }
         secrets.append(contentsOf: wrapped)
     }
 
     /// Saves a public key.
     /// - Parameters:
-    ///   - publicKey: The public key to save.
+    ///   - key: The data representation key to save.
     ///   - name: A user-facing name for the key.
-    private func savePublicKey(_ publicKey: SecKey, name: String) throws {
+    ///   - attributes: Attributes of the key.
-        let attributes = KeychainDictionary([
+    /// - Note: Despite the name, the "Data" of the key is _not_ actual key material. This is an opaque data representation that the SEP can manipulate.
-            kSecClass: kSecClassKey,
+    @discardableResult
-            kSecAttrKeyType: SecureEnclave.Constants.keyType,
+    func saveKey(_ key: Data, name: String, attributes: Attributes) throws -> String {
-            kSecAttrKeyClass: kSecAttrKeyClassPublic,
+        let attributes = try JSONEncoder().encode(attributes)
-            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
+        let id = UUID().uuidString
-            kSecValueRef: publicKey,
+        let keychainAttributes = KeychainDictionary([
-            kSecAttrIsPermanent: true,
+            kSecClass: Constants.keyClass,
-            kSecReturnData: true,
+            kSecAttrService: Constants.keyTag,
-            kSecAttrLabel: name
+            kSecUseDataProtectionKeychain: true,
+            kSecAttrAccessible: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+            kSecAttrAccount: id,
+            kSecValueData: key,
+            kSecAttrLabel: name,
+            kSecAttrGeneric: attributes
         ])
-        let status = SecItemAdd(attributes, nil)
+        let status = SecItemAdd(keychainAttributes, nil)
         if status != errSecSuccess {
             throw KeychainError(statusCode: status)
         }
+        return id
     }
     
 }
 
-extension SecureEnclave {
+extension SecureEnclave.Store {
 
     enum Constants {
+        static let keyClass = kSecClassGenericPassword as String
         static let keyTag = Data("com.maxgoedjen.secretive.secureenclave.key".utf8)
-        static let keyType = kSecAttrKeyTypeECSECPrimeRandom as String
+        static let notificationToken = UUID().uuidString
-        static let unauthenticatedThreshold: TimeInterval = 0.05
     }
     
+    struct UnsupportedAlgorithmError: Error {}
+    struct MissingAttributesError: Error {}
+
 }

Sources/Packages/Sources/SmartCardSecretKit/SmartCardSecret.swift

@@ -1,5 +1,4 @@
 import Foundation
-import Combine
 import SecretKit
 
 extension SmartCard {
@@ -9,10 +8,8 @@ extension SmartCard {
 
         public let id: Data
         public let name: String
-        public let algorithm: Algorithm
-        public let keySize: Int
-        public let requiresAuthentication: Bool = false
         public let publicKey: Data
+        public var attributes: Attributes
 
     }
 

Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift

@@ -1,7 +1,7 @@
 import Foundation
 import Observation
 import Security
-import CryptoTokenKit
+@unsafe @preconcurrency import CryptoTokenKit
 import LocalAuthentication
 import SecretKit
 
@@ -23,6 +23,9 @@ extension SmartCard {
         public var isAvailable: Bool {
             state.isAvailable
         }
+        @MainActor public var smartcardTokenID: String? {
+            state.tokenID
+        }
 
         public let id = UUID()
         @MainActor public var name: String {
@@ -34,17 +37,18 @@ extension SmartCard {
 
         /// Initializes a Store.
         public init() {
-            Task { @MainActor in
+            Task {
-                if let tokenID = state.tokenID {
+                await MainActor.run {
+                    if let tokenID = smartcardTokenID {
                         state.isAvailable = true
                         state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
                     }
                     loadSecrets()
-                state.watcher.setInsertionHandler { id in
+                }
-                    // Setting insertion handler will cause it to be called immediately.
+                // Doing this inside a regular mainactor handler casues thread assertions in CryptoTokenKit to blow up when the handler executes.
-                    // Make a thread jump so we don't hit a recursive lock attempt.
+                await state.watcher.setInsertionHandler { id in
                     Task {
-                        self.smartcardInserted(for: id)
+                        await self.smartcardInserted(for: id)
                     }
                 }
             }
@@ -52,14 +56,6 @@ extension SmartCard {
 
         // MARK: Public API
 
-        public func create(name: String) throws {
-            fatalError("Keys must be created on the smart card.")
-        }
-
-        public func delete(secret: Secret) throws {
-            fatalError("Keys must be deleted on the smart card.")
-        }
-
         public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
             guard let tokenID = await state.tokenID else { fatalError() }
             let context = LAContext()
@@ -74,7 +70,7 @@ extension SmartCard {
                 kSecReturnRef: true
             ])
             var untyped: CFTypeRef?
-            let status = SecItemCopyMatching(attributes, &untyped)
+            let status = unsafe SecItemCopyMatching(attributes, &untyped)
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
             }
@@ -83,8 +79,9 @@ extension SmartCard {
             }
             let key = untypedSafe as! SecKey
             var signError: SecurityError?
-            guard let signature = SecKeyCreateSignature(key, signatureAlgorithm(for: secret, allowRSA: true), data as CFData, &signError) else {
+            guard let algorithm = signatureAlgorithm(for: secret) else { throw UnsupportKeyType() }
-                throw SigningError(error: signError)
+            guard let signature = unsafe SecKeyCreateSignature(key, algorithm, data as CFData, &signError) else {
+                throw unsafe SigningError(error: signError)
             }
             return signature as Data
         }
@@ -126,6 +123,7 @@ extension SmartCard.Store {
         state.tokenID = string
         state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
         state.tokenID = string
+        reloadSecretsInternal()
     }
 
     /// Resets the token ID and reloads secrets.
@@ -154,106 +152,27 @@ extension SmartCard.Store {
             kSecReturnAttributes: true
         ])
         var untyped: CFTypeRef?
-        SecItemCopyMatching(attributes, &untyped)
+        unsafe SecItemCopyMatching(attributes, &untyped)
         guard let typed = untyped as? [[CFString: Any]] else { return }
-        let wrapped = typed.map {
+        let wrapped: [SecretType] = typed.compactMap {
             let name = $0[kSecAttrLabel] as? String ?? String(localized: .unnamedSecret)
             let tokenID = $0[kSecAttrApplicationLabel] as! Data
-            let algorithm = Algorithm(secAttr: $0[kSecAttrKeyType] as! NSNumber)
+            let algorithmSecAttr = $0[kSecAttrKeyType] as! NSNumber
             let keySize = $0[kSecAttrKeySizeInBits] as! Int
             let publicKeyRef = $0[kSecValueRef] as! SecKey
             let publicKeySecRef = SecKeyCopyPublicKey(publicKeyRef)!
             let publicKeyAttributes = SecKeyCopyAttributes(publicKeySecRef) as! [CFString: Any]
             let publicKey = publicKeyAttributes[kSecValueData] as! Data
-            return SmartCard.Secret(id: tokenID, name: name, algorithm: algorithm, keySize: keySize, publicKey: publicKey)
+            let attributes = Attributes(keyType: KeyType(secAttr: algorithmSecAttr, size: keySize)!, authentication: .unknown)
+            let secret = SmartCard.Secret(id: tokenID, name: name, publicKey: publicKey, attributes: attributes)
+            guard signatureAlgorithm(for: secret) != nil else { return nil }
+            return secret
         }
         state.secrets.append(contentsOf: wrapped)
     }
 
 }
 
-
-// MARK: Smart Card specific encryption/decryption/verification
-extension SmartCard.Store {
-
-    /// Encrypts a payload with a specified key.
-    /// - Parameters:
-    ///   - data: The payload to encrypt.
-    ///   - secret: The secret to encrypt with.
-    /// - Returns: The encrypted data.
-    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
-    public func encrypt(data: Data, with secret: SecretType) throws -> Data {
-        let context = LAContext()
-        context.localizedReason = String(localized: .authContextRequestEncryptDescription(secretName: secret.name))
-        context.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-        let attributes = KeychainDictionary([
-            kSecAttrKeyType: secret.algorithm.secAttrKeyType,
-            kSecAttrKeySizeInBits: secret.keySize,
-            kSecAttrKeyClass: kSecAttrKeyClassPublic,
-            kSecUseAuthenticationContext: context
-        ])
-        var encryptError: SecurityError?
-        let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &encryptError)
-        guard let untypedSafe = untyped else {
-            throw KeychainError(statusCode: errSecSuccess)
-        }
-        let key = untypedSafe as! SecKey
-        guard let signature = SecKeyCreateEncryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
-            throw SigningError(error: encryptError)
-        }
-        return signature as Data
-    }
-
-    /// Decrypts a payload with a specified key.
-    /// - Parameters:
-    ///   - data: The payload to decrypt.
-    ///   - secret: The secret to decrypt with.
-    /// - Returns: The decrypted data.
-    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
-    public func decrypt(data: Data, with secret: SecretType) async throws -> Data {
-        guard let tokenID = await state.tokenID else { fatalError() }
-        let context = LAContext()
-        context.localizedReason = String(localized: .authContextRequestDecryptDescription(secretName: secret.name))
-        context.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-        let attributes = KeychainDictionary([
-            kSecClass: kSecClassKey,
-            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-            kSecAttrApplicationLabel: secret.id as CFData,
-            kSecAttrTokenID: tokenID,
-            kSecUseAuthenticationContext: context,
-            kSecReturnRef: true
-        ])
-        var untyped: CFTypeRef?
-        let status = SecItemCopyMatching(attributes, &untyped)
-        if status != errSecSuccess {
-            throw KeychainError(statusCode: status)
-        }
-        guard let untypedSafe = untyped else {
-            throw KeychainError(statusCode: errSecSuccess)
-        }
-        let key = untypedSafe as! SecKey
-        var encryptError: SecurityError?
-        guard let signature = SecKeyCreateDecryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
-            throw SigningError(error: encryptError)
-        }
-        return signature as Data
-    }
-
-    private func encryptionAlgorithm(for secret: SecretType) -> SecKeyAlgorithm {
-        switch (secret.algorithm, secret.keySize) {
-        case (.ellipticCurve, 256):
-            return .eciesEncryptionCofactorVariableIVX963SHA256AESGCM
-        case (.ellipticCurve, 384):
-            return .eciesEncryptionCofactorVariableIVX963SHA384AESGCM
-        case (.rsa, 1024), (.rsa, 2048):
-            return .rsaEncryptionOAEPSHA512AESGCM
-        default:
-            fatalError()
-        }
-    }
-
-}
-
 extension TKTokenWatcher {
 
     /// All available tokens, excluding the Secure Enclave.
@@ -262,3 +181,9 @@ extension TKTokenWatcher {
     }
 
 }
+
+extension SmartCard {
+
+    public struct UnsupportKeyType: Error {}
+
+}

Sources/Packages/Sources/XPCWrappers/XPCProtocol.swift

@@ -0,0 +1,14 @@
+import Foundation
+
+@objc protocol _XPCProtocol: Sendable {
+    func process(_ data: Data, with reply: @Sendable @escaping (Data?, Error?) -> Void)
+}
+
+public protocol XPCProtocol<Input, Output>: Sendable {
+
+    associatedtype Input: Codable
+    associatedtype Output: Codable
+
+    func process(_ data: Input) async throws -> Output
+
+}

Sources/Packages/Sources/XPCWrappers/XPCServiceDelegate.swift

@@ -0,0 +1,70 @@
+import Foundation
+
+public final class XPCServiceDelegate: NSObject, NSXPCListenerDelegate {
+
+    private let exportedObject: ErasedXPCProtocol
+
+    public init<XPCProtocolType: XPCProtocol>(exportedObject: XPCProtocolType) {
+        self.exportedObject = ErasedXPCProtocol(exportedObject)
+    }
+
+    public func listener(_ listener: NSXPCListener, shouldAcceptNewConnection newConnection: NSXPCConnection) -> Bool {
+        newConnection.exportedInterface = NSXPCInterface(with: (any _XPCProtocol).self)
+        let exportedObject = exportedObject
+        newConnection.exportedObject = exportedObject
+        newConnection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = Z72PRUAWF6")
+        newConnection.resume()
+        return true
+    }
+}
+
+@objc private final class ErasedXPCProtocol: NSObject, _XPCProtocol {
+
+    let _process: @Sendable (Data, @Sendable @escaping (Data?, (any Error)?) -> Void) -> Void
+
+    public init<XPCProtocolType: XPCProtocol>(_ exportedObject: XPCProtocolType) {
+        _process = { data, reply in
+            Task { [reply] in
+                do {
+                    let decoded = try JSONDecoder().decode(XPCProtocolType.Input.self, from: data)
+                    let result = try await exportedObject.process(decoded)
+                    let encoded = try JSONEncoder().encode(result)
+                    reply(encoded, nil)
+                } catch {
+                    if let error = error as? Codable & Error {
+                        reply(nil, NSError(error))
+                    } else {
+                        reply(nil, error)
+                    }
+                }
+            }
+        }
+    }
+
+    func process(_ data: Data, with reply: @Sendable @escaping (Data?, (any Error)?) -> Void) {
+        _process(data, reply)
+    }
+
+
+}
+
+extension NSError {
+
+    private enum Constants {
+        static let domain = "com.maxgoedjen.secretive.xpcwrappers"
+        static let code = -1
+        static let dataKey = "underlying"
+    }
+
+    @nonobjc convenience init<ErrorType: Codable & Error>(_ error: ErrorType) {
+        let encoded = try? JSONEncoder().encode(error)
+        self.init(domain: Constants.domain, code: Constants.code, userInfo: [Constants.dataKey: encoded as Any])
+    }
+
+    @nonobjc public func underlying<ErrorType: Codable & Error>(as errorType: ErrorType.Type) -> ErrorType? {
+        guard domain == Constants.domain && code == Constants.code, let data = userInfo[Constants.dataKey] as? Data else { return nil }
+        return try? JSONDecoder().decode(ErrorType.self, from: data)
+    }
+
+}
+

Sources/Packages/Sources/XPCWrappers/XPCTypedSession.swift

@@ -0,0 +1,53 @@
+import Foundation
+
+public struct XPCTypedSession<ResponseType: Codable & Sendable, ErrorType: Error & Codable>: ~Copyable {
+
+    private let connection: NSXPCConnection
+    private let proxy: _XPCProtocol
+
+    public init(serviceName: String, warmup: Bool = false) async throws {
+        let connection = NSXPCConnection(serviceName: serviceName)
+        connection.remoteObjectInterface = NSXPCInterface(with: (any _XPCProtocol).self)
+        connection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = Z72PRUAWF6")
+        connection.resume()
+        guard let proxy = connection.remoteObjectProxy as? _XPCProtocol else { fatalError() }
+        self.connection = connection
+        self.proxy = proxy
+        if warmup {
+            _ = try? await send()
+        }
+    }
+
+    public func send(_ message: some Encodable = Data()) async throws -> ResponseType {
+        let encoded = try JSONEncoder().encode(message)
+        return try await withCheckedThrowingContinuation { continuation in
+            proxy.process(encoded) { data, error in
+                do {
+                    if let error {
+                        throw error
+                    }
+                    guard let data else {
+                        throw NoDataError()
+                    }
+                    let decoded = try JSONDecoder().decode(ResponseType.self, from: data)
+                    continuation.resume(returning: decoded)
+                } catch {
+                    if let typed = (error as NSError).underlying(as: ErrorType.self) {
+                        continuation.resume(throwing: typed)
+                    } else {
+                        continuation.resume(throwing: error)
+                    }
+                }
+            }
+        }
+    }
+
+
+    public func complete() {
+        connection.invalidate()
+    }
+
+    public struct NoDataError: Error {}
+
+}
+

Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift

@@ -6,51 +6,54 @@ import CryptoKit
 
 @Suite struct AgentTests {
 
-    let stubWriter = StubFileHandleWriter()
-
     // MARK: Identity Listing
 
-    @Test func emptyStores() async {
+    @Test func emptyStores() async throws {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
         let agent = Agent(storeList: SecretStoreList())
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestIdentities)
-        #expect(stubWriter.data == Constants.Responses.requestIdentitiesEmpty)
+        let response = await agent.handle(request: request, provenance: .test)
+        #expect(response == Constants.Responses.requestIdentitiesEmpty)
     }
 
-    @Test func identitiesList() async {
+    @Test func identitiesList() async throws {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
         let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestIdentities)
-        #expect(stubWriter.data == Constants.Responses.requestIdentitiesMultiple)
+        let response = await agent.handle(request: request, provenance: .test)
+
+        let actual = OpenSSHReader(data: response)
+        let expected = OpenSSHReader(data: Constants.Responses.requestIdentitiesMultiple)
+        print(actual, expected)
+        #expect(response == Constants.Responses.requestIdentitiesMultiple)
     }
 
     // MARK: Signatures
 
-    @Test func noMatchingIdentities() async {
+    @Test func noMatchingIdentities() async throws {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignatureWithNoneMatching)
         let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignatureWithNoneMatching)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+        let response = await agent.handle(request: request, provenance: .test)
+        #expect(response == Constants.Responses.requestFailure)
     }
 
-    @Test func signature() async throws {
+    @Test func ecdsaSignature() async throws {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
+        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...])
+        guard case SSHAgent.Request.signRequest(let context) = request else { return }
-        _ = requestReader.readNextChunk()
-        let dataToSign = requestReader.readNextChunk()
         let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        let response = await agent.handle(request: request, provenance: .test)
-        let outer = OpenSSHReader(data: stubWriter.data[5...])
+        let responseReader = OpenSSHReader(data: response)
-        let payload = outer.readNextChunk()
+        let length = try responseReader.readNextBytes(as: UInt32.self).bigEndian
-        let inner = OpenSSHReader(data: payload)
+        let type = try responseReader.readNextBytes(as: UInt8.self).bigEndian
-        _ = inner.readNextChunk()
+        #expect(length == response.count - MemoryLayout<UInt32>.size)
-        let signedData = inner.readNextChunk()
+        #expect(type == SSHAgent.Response.agentSignResponse.rawValue)
-        let rsData = OpenSSHReader(data: signedData)
+        let outer = OpenSSHReader(data: responseReader.remaining)
-        var r = rsData.readNextChunk()
+        let inner = try outer.readNextChunkAsSubReader()
-        var s = rsData.readNextChunk()
+        _ = try inner.readNextChunk()
+        let rsData = try inner.readNextChunkAsSubReader()
+        var r = try rsData.readNextChunk()
+        var s = try rsData.readNextChunk()
         // This is fine IRL, but it freaks out CryptoKit
         if r[0] == 0 {
             r.removeFirst()
@@ -63,24 +66,22 @@ import CryptoKit
         let signature = try P256.Signing.ECDSASignature(rawRepresentation: rs)
         // Correct signature
         #expect(try P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey)
-            .isValidSignature(signature, for: dataToSign))
+            .isValidSignature(signature, for: context.dataToSign))
     }
 
     // MARK: Witness protocol
 
-    @Test func witnessObjectionStopsRequest() async {
+    @Test func witnessObjectionStopsRequest() async throws {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
         let witness = StubWitness(speakNow: { _,_  in
             return true
         }, witness: { _, _ in })
         let agent = Agent(storeList: list, witness: witness)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        let response = await agent.handle(request: .signRequest(.empty), provenance: .test)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+        #expect(response == Constants.Responses.requestFailure)
     }
 
-    @Test func witnessSignature() async {
+    @Test func witnessSignature() async throws {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
         nonisolated(unsafe) var witnessed = false
         let witness = StubWitness(speakNow: { _, trace  in
@@ -89,12 +90,12 @@ import CryptoKit
             witnessed = true
         })
         let agent = Agent(storeList: list, witness: witness)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
+        _ = await agent.handle(request: request, provenance: .test)
         #expect(witnessed)
     }
 
-    @Test func requestTracing() async {
+    @Test func requestTracing() async throws {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
         nonisolated(unsafe) var speakNowTrace: SigningRequestProvenance?
         nonisolated(unsafe) var witnessTrace: SigningRequestProvenance?
@@ -105,36 +106,40 @@ import CryptoKit
             witnessTrace = trace
         })
         let agent = Agent(storeList: list, witness: witness)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
+        _ = await agent.handle(request: request, provenance: .test)
         #expect(witnessTrace == speakNowTrace)
-        #expect(witnessTrace?.origin.displayName == "Finder")
+        #expect(witnessTrace == .test)
-        #expect(witnessTrace?.origin.validSignature == true)
-        #expect(witnessTrace?.origin.parentPID == 1)
     }
 
     // MARK: Exception Handling
 
-    @Test func signatureException() async {
+    @Test func signatureException() async throws {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let store = await list.stores.first?.base as! Stub.Store
         store.shouldThrow = true
         let agent = Agent(storeList: list)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+        let response = await agent.handle(request: request, provenance: .test)
+        #expect(response == Constants.Responses.requestFailure)
     }
 
     // MARK: Unsupported
 
-    @Test func unhandledAdd() async {
+    @Test func unhandledAdd() async throws {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.addIdentity)
         let agent = Agent(storeList: SecretStoreList())
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        let response = await agent.handle(request: .addIdentity, provenance: .test)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+        #expect(response == Constants.Responses.requestFailure)
     }
 
 }
 
+extension SigningRequestProvenance {
+
+    static let test = SigningRequestProvenance(root: .init(pid: 0, processName: "test", appName: nil, iconURL: nil, path: "/", validSignature: true, parentPID: 0))
+
+}
+
 extension AgentTests {
 
     @MainActor func storeList(with secrets: [Stub.Secret]) async -> SecretStoreList {
@@ -149,14 +154,13 @@ extension AgentTests {
 
         enum Requests {
             static let requestIdentities = Data(base64Encoded: "AAAAAQs=")!
-            static let addIdentity = Data(base64Encoded: "AAAAARE=")!
             static let requestSignatureWithNoneMatching = Data(base64Encoded: "AAABhA0AAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQAAAO8AAAAgbqmrqPUtJ8mmrtaSVexjMYyXWNqjHSnoto7zgv86xvcyAAAAA2dpdAAAAA5zc2gtY29ubmVjdGlvbgAAAAlwdWJsaWNrZXkBAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQAAAAA=")!
             static let requestSignature = Data(base64Encoded: "AAABRA0AAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKzOkUiVJEcACMtAd9X7xalbc0FYZyhbmv2dsWl4IP2GWIi+RcsaHQNw+nAIQ8CKEYmLnl0VLDp5Ef8KMhgIy08AAADPAAAAIBIFsbCZ4/dhBmLNGHm0GKj7EJ4N8k/jXRxlyg+LFIYzMgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAAA==")!
         }
 
         enum Responses {
             static let requestIdentitiesEmpty = Data(base64Encoded: "AAAABQwAAAAA")!
-            static let requestIdentitiesMultiple = Data(base64Encoded: "AAABKwwAAAACAAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBLKSzA5q3jCb3q0JKigvcxfWVGrJ+bklpG0Zc9YzUwrbsh9SipvlSJi+sHQI+O0m88DOpRBAtuAHX60euD/Yv250tovN7/+MEFbXGZ/hLdd0BoFpWbLfJcQj806KJGlcDAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0")!
+            static let requestIdentitiesMultiple = Data(base64Encoded: "AAABLwwAAAACAAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAFWVjZHNhLTI1NkBleGFtcGxlLmNvbQAAAIgAAAATZWNkc2Etc2hhMi1uaXN0cDM4NAAAAAhuaXN0cDM4NAAAAGEEspLMDmreMJverQkqKC9zF9ZUasn5uSWkbRlz1jNTCtuyH1KKm+VImL6wdAj47SbzwM6lEEC24AdfrR64P9i/bnS2i83v/4wQVtcZn+Et13QGgWlZst8lxCPzTookaVwMAAAAFWVjZHNhLTM4NEBleGFtcGxlLmNvbQ==")!
             static let requestFailure = Data(base64Encoded: "AAAAAQU=")!
         }
 

Sources/Packages/Tests/SecretAgentKitTests/OpenSSHReaderTests.swift

@@ -1,18 +1,18 @@
 import Foundation
 import Testing
-@testable import SecretKit
+@testable import SecretAgentKit
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
 @Suite struct OpenSSHReaderTests {
 
-    @Test func signatureRequest() {
+    @Test func signatureRequest() throws {
         let reader = OpenSSHReader(data: Constants.signatureRequest)
-        let hash = reader.readNextChunk()
+        let hash = try reader.readNextChunk()
         #expect(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ=="))
-        let dataToSign = reader.readNextChunk()
+        let dataToSign = try reader.readNextChunk()
         #expect(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU="))
-        let empty = reader.readNextChunk()
+        let empty = try reader.readNextChunk()
         #expect(empty.isEmpty)
     }
 

Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleReader.swift

@@ -1,14 +0,0 @@
-import SecretAgentKit
-import AppKit
-
-struct StubFileHandleReader: FileHandleReader {
-
-    let availableData: Data
-    var fileDescriptor: Int32 {
-        NSWorkspace.shared.runningApplications.filter({ $0.localizedName == "Finder" }).first!.processIdentifier
-    }
-    var pidOfConnectedProcess: Int32 {
-        fileDescriptor
-    }
-
-}

Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleWriter.swift

@@ -1,12 +0,0 @@
-import Foundation
-import SecretAgentKit
-
-class StubFileHandleWriter: FileHandleWriter, @unchecked Sendable {
-
-    var data = Data()
-
-    func write(_ data: Data) {
-        self.data.append(data)
-    }
-
-}

Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift

@@ -45,20 +45,15 @@ extension Stub {
             let privateData = (privateAttributes[kSecValueData] as! Data)
             let secret = Secret(keySize: size, publicKey: publicData, privateKey: privateData)
             print(secret)
-            print("Public Key OpenSSH: \(OpenSSHKeyWriter().openSSHString(secret: secret))")
+            print("Public Key OpenSSH: \(OpenSSHPublicKeyWriter().openSSHString(secret: secret))")
         }
 
         public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
             guard !shouldThrow else {
                 throw NSError(domain: "test", code: 0, userInfo: nil)
             }
-            let privateKey = SecKeyCreateWithData(secret.privateKey as CFData, KeychainDictionary([
+            let privateKey = try CryptoKit.P256.Signing.PrivateKey(x963Representation: secret.privateKey)
-                kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
+            return try privateKey.signature(for: data).rawRepresentation
-                kSecAttrKeySizeInBits: secret.keySize,
-                kSecAttrKeyClass: kSecAttrKeyClassPrivate
-                ])
-                , nil)!
-            return SecKeyCreateSignature(privateKey, signatureAlgorithm(for: secret), data as CFData, nil)! as Data
         }
 
         public func existingPersistedAuthenticationContext(secret: Stub.Secret) -> PersistedAuthenticationContext? {
@@ -79,24 +74,22 @@ extension Stub {
 
     struct Secret: SecretKit.Secret, CustomDebugStringConvertible {
 
-        let id = UUID().uuidString.data(using: .utf8)!
+        let id = Data(UUID().uuidString.utf8)
         let name = UUID().uuidString
-        let algorithm = Algorithm.ellipticCurve
+        let attributes: Attributes
-
-        let keySize: Int
         let publicKey: Data
         let requiresAuthentication = false
         let privateKey: Data
 
         init(keySize: Int, publicKey: Data, privateKey: Data) {
-            self.keySize = keySize
+            self.attributes = Attributes(keyType: .init(algorithm: .ecdsa, size: keySize), authentication: .notRequired, publicKeyAttribution: "ecdsa-\(keySize)@example.com")
             self.publicKey = publicKey
             self.privateKey = privateKey
         }
 
         var debugDescription: String {
             """
-            Key Size \(keySize)
+            Key Size \(attributes.keyType.size)
             Private: \(privateKey.base64EncodedString())
             Public: \(publicKey.base64EncodedString())
             """

Sources/Packages/Tests/SecretKitTests/AnySecretTests.swift

@@ -4,15 +4,16 @@ import Testing
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
+
 @Suite struct AnySecretTests {
 
     @Test func eraser() {
-        let secret = SmartCard.Secret(id: UUID().uuidString.data(using: .utf8)!, name: "Name", algorithm: .ellipticCurve, keySize: 256, publicKey: UUID().uuidString.data(using: .utf8)!)
+        let data = Data(UUID().uuidString.utf8)
+        let secret = SmartCard.Secret(id: data, name: "Name", publicKey: data, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 256), authentication: .notRequired))
         let erased = AnySecret(secret)
         #expect(erased.id == secret.id as AnyHashable)
         #expect(erased.name == secret.name)
-        #expect(erased.algorithm == secret.algorithm)
+        #expect(erased.keyType == secret.keyType)
-        #expect(erased.keySize == secret.keySize)
         #expect(erased.publicKey == secret.publicKey)
     }
 

Sources/Packages/Tests/SecretKitTests/OpenSSHPublicKeyWriterTests.swift

@@ -4,9 +4,9 @@ import Testing
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
-@Suite struct OpenSSHWriterTests {
+@Suite struct OpenSSHPublicKeyWriterTests {
 
-    let writer = OpenSSHKeyWriter()
+    let writer = OpenSSHPublicKeyWriter()
 
     @Test func ecdsa256MD5Fingerprint() {
         #expect(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa256Secret) == "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5")
@@ -18,7 +18,7 @@ import Testing
 
     @Test func ecdsa256PublicKey() {
         #expect(writer.openSSHString(secret:  Constants.ecdsa256Secret) ==
-        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")
+        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo= test@example.com")
     }
 
     @Test func ecdsa256Hash() {
@@ -35,7 +35,7 @@ import Testing
 
     @Test func ecdsa384PublicKey() {
         #expect(writer.openSSHString(secret:  Constants.ecdsa384Secret) ==
-                       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")
+                       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ== test@example.com")
     }
 
     @Test func ecdsa384Hash() {
@@ -44,11 +44,11 @@ import Testing
 
 }
 
-extension OpenSSHWriterTests {
+extension OpenSSHPublicKeyWriterTests {
 
     enum Constants {
-        static let ecdsa256Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 256)", algorithm: .ellipticCurve, keySize: 256, publicKey: Data(base64Encoded: "BOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")!)
+        static let ecdsa256Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 256)", publicKey: Data(base64Encoded: "BOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 256), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
-        static let ecdsa384Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 384)", algorithm: .ellipticCurve, keySize: 384, publicKey: Data(base64Encoded: "BG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")!)
+        static let ecdsa384Secret = SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 384)", publicKey: Data(base64Encoded: "BG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 384), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
 
     }
 

Sources/SecretAgent/AppDelegate.swift

@@ -1,6 +1,5 @@
 import Cocoa
 import OSLog
-import Combine
 import SecretKit
 import SecureEnclaveSecretKit
 import SmartCardSecretKit
@@ -13,13 +12,16 @@ class AppDelegate: NSObject, NSApplicationDelegate {
 
     @MainActor private let storeList: SecretStoreList = {
         let list = SecretStoreList()
-        list.add(store: SecureEnclave.Store())
+        let cryptoKit = SecureEnclave.Store()
+        let migrator = SecureEnclave.CryptoKitMigrator()
+        try? migrator.migrate(to: cryptoKit)
+        list.add(store: cryptoKit)
         list.add(store: SmartCard.Store())
         return list
     }()
     private let updater = Updater(checkOnLaunch: true)
     private let notifier = Notifier()
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: URL.homeDirectory)
     private lazy var agent: Agent = {
         Agent(storeList: storeList, witness: notifier)
     }()
@@ -27,14 +29,24 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         let path = (NSHomeDirectory() as NSString).appendingPathComponent("socket.ssh") as String
         return SocketController(path: path)
     }()
-    private var updateSink: AnyCancellable?
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "AppDelegate")
 
     func applicationDidFinishLaunching(_ aNotification: Notification) {
         logger.debug("SecretAgent finished launching")
-        Task { @MainActor in
+        Task {
-            socketController.handler = { [agent] reader, writer in
+            let inputParser = try await XPCAgentInputParser()
-                await agent.handle(reader: reader, writer: writer)
+            for await session in socketController.sessions {
+                Task {
+                    do {
+                        for await message in session.messages {
+                            let request = try await inputParser.parse(data: message)
+                            let agentResponse = await agent.handle(request: request, provenance: session.provenance)
+                            try await session.write(agentResponse)
+                        }
+                    } catch {
+                        try session.close()
+                    }
+                }
             }
         }
         Task {
@@ -48,6 +60,7 @@ class AppDelegate: NSObject, NSApplicationDelegate {
             updater.update
         } onChange: { [updater, notifier] in
             Task {
+                guard !updater.currentVersion.isTestBuild else { return }
                 await notifier.notify(update: updater.update!) { release in
                     await updater.ignore(release: release)
                 }

Sources/SecretAgent/InternetAccessPolicy.plist

@@ -9,22 +9,7 @@
 	<key>Website</key>
 	<string>https://github.com/maxgoedjen/secretive</string>
 	<key>Connections</key>
-	<array>
+	<array/>
-		<dict>
-			<key>IsIncoming</key>
-			<false/>
-			<key>Host</key>
-			<string>api.github.com</string>
-			<key>NetworkProtocol</key>
-			<string>TCP</string>
-			<key>Port</key>
-			<string>443</string>
-			<key>Purpose</key>
-			<string>Secretive checks GitHub for new versions and security updates.</string>
-			<key>DenyConsequences</key>
-			<string>If you deny these connections, you will not be notified about new versions and critical security updates.</string>
-		</dict>
-	</array>
 	<key>Services</key>
 	<array/>
 </dict>

Sources/SecretAgent/Notifier.swift

@@ -69,7 +69,7 @@ final class Notifier: Sendable {
         notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description
         notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description
         notificationContent.interruptionLevel = .timeSensitive
-        if await store.existingPersistedAuthenticationContext(secret: secret) == nil && secret.requiresAuthentication {
+        if await store.existingPersistedAuthenticationContext(secret: secret) == nil && secret.authenticationRequirement.required {
             notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier
         }
         if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) {

Sources/SecretAgent/XPCInputParser.swift

@@ -0,0 +1,23 @@
+import Foundation
+import SecretAgentKit
+import Brief
+import XPCWrappers
+
+/// Delegates all agent input parsing to an XPC service which wraps OpenSSH
+public final class XPCAgentInputParser: SSHAgentInputParserProtocol {
+
+    private let session: XPCTypedSession<SSHAgent.Request, SSHAgentInputParser.AgentParsingError>
+
+    public init() async throws {
+        session = try await XPCTypedSession(serviceName: "com.maxgoedjen.Secretive.SecretAgentInputParser", warmup: true)
+    }
+
+    public func parse(data: Data) async throws -> SSHAgent.Request {
+        try await session.send(data)
+    }
+
+    deinit {
+        session.complete()
+    }
+
+}

Sources/SecretAgentInputParser/Info.plist

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>XPCService</key>
+	<dict>
+		<key>ServiceType</key>
+		<string>Application</string>
+	</dict>
+</dict>
+</plist>

Sources/SecretAgentInputParser/SecretAgentInputParser.swift

@@ -0,0 +1,17 @@
+import Foundation
+import OSLog
+import XPCWrappers
+import SecretAgentKit
+
+final class SecretAgentInputParser: NSObject, XPCProtocol {
+
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.SecretAgentInputParser", category: "SecretAgentInputParser")
+
+    func process(_ data: Data) async throws -> SSHAgent.Request {
+        let parser = SSHAgentInputParser()
+        let result = try parser.parse(data: data)
+        logger.log("Parser parsed message as type \(result.debugDescription)")
+        return result
+    }
+
+}

Sources/SecretAgentInputParser/main.swift

@@ -0,0 +1,7 @@
+import Foundation
+import XPCWrappers
+
+let delegate = XPCServiceDelegate(exportedObject: SecretAgentInputParser())
+let listener = NSXPCListener.service()
+listener.delegate = delegate
+listener.resume()

Sources/Secretive.xcodeproj/project.pbxproj

@@ -7,7 +7,7 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
-		2C4A9D2F2636FFD3008CC8E2 /* RenameSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2C4A9D2E2636FFD3008CC8E2 /* RenameSecretView.swift */; };
+		2C4A9D2F2636FFD3008CC8E2 /* EditSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2C4A9D2E2636FFD3008CC8E2 /* EditSecretView.swift */; };
 		50020BB024064869003D4025 /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50020BAF24064869003D4025 /* AppDelegate.swift */; };
 		50033AC327813F1700253856 /* BundleIDs.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50033AC227813F1700253856 /* BundleIDs.swift */; };
 		5003EF3B278005E800DF2006 /* SecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF3A278005E800DF2006 /* SecretKit */; };
@@ -25,7 +25,13 @@
 		501421652781268000BBAA70 /* SecretAgent.app in CopyFiles */ = {isa = PBXBuildFile; fileRef = 50A3B78A24026B7500D209EA /* SecretAgent.app */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		50153E20250AFCB200525160 /* UpdateView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50153E1F250AFCB200525160 /* UpdateView.swift */; };
 		50153E22250DECA300525160 /* SecretListItemView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50153E21250DECA300525160 /* SecretListItemView.swift */; };
+		501578132E6C0479004A37D0 /* XPCInputParser.swift in Sources */ = {isa = PBXBuildFile; fileRef = 501578122E6C0479004A37D0 /* XPCInputParser.swift */; };
 		5018F54F24064786002EB505 /* Notifier.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5018F54E24064786002EB505 /* Notifier.swift */; };
+		504788EC2E680DC800B4556F /* URLs.swift in Sources */ = {isa = PBXBuildFile; fileRef = 504788EB2E680DC400B4556F /* URLs.swift */; };
+		504788F22E681F3A00B4556F /* Instructions.swift in Sources */ = {isa = PBXBuildFile; fileRef = 504788F12E681F3A00B4556F /* Instructions.swift */; };
+		504788F42E681F6900B4556F /* ToolConfigurationView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 504788F32E681F6900B4556F /* ToolConfigurationView.swift */; };
+		504788F62E68206F00B4556F /* GettingStartedView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 504788F52E68206F00B4556F /* GettingStartedView.swift */; };
+		504789232E697DD300B4556F /* BoxBackgroundStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 504789222E697DD300B4556F /* BoxBackgroundStyle.swift */; };
 		50571E0324393C2600F76F6C /* JustUpdatedChecker.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50571E0224393C2600F76F6C /* JustUpdatedChecker.swift */; };
 		50571E0524393D1500F76F6C /* LaunchAgentController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50571E0424393D1500F76F6C /* LaunchAgentController.swift */; };
 		50617D8323FCE48E0099B055 /* App.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D8223FCE48E0099B055 /* App.swift */; };
@@ -36,9 +42,19 @@
 		5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5065E312295517C500E16645 /* ToolbarButtonStyle.swift */; };
 		5066A6C22516F303004B5A36 /* SetupView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C12516F303004B5A36 /* SetupView.swift */; };
 		5066A6C82516FE6E004B5A36 /* CopyableView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C72516FE6E004B5A36 /* CopyableView.swift */; };
-		5066A6F7251829B1004B5A36 /* ShellConfigurationController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6F6251829B1004B5A36 /* ShellConfigurationController.swift */; };
 		506772C72424784600034DED /* Credits.rtf in Resources */ = {isa = PBXBuildFile; fileRef = 506772C62424784600034DED /* Credits.rtf */; };
 		506772C92425BB8500034DED /* NoStoresView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 506772C82425BB8500034DED /* NoStoresView.swift */; };
+		50692D1D2E6FDB880043C7BB /* SecretiveUpdater.xpc in Embed XPC Services */ = {isa = PBXBuildFile; fileRef = 50692D122E6FDB880043C7BB /* SecretiveUpdater.xpc */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
+		50692D282E6FDB8D0043C7BB /* main.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50692D242E6FDB8D0043C7BB /* main.swift */; };
+		50692D2D2E6FDC000043C7BB /* XPCWrappers in Frameworks */ = {isa = PBXBuildFile; productRef = 50692D2C2E6FDC000043C7BB /* XPCWrappers */; };
+		50692D2F2E6FDC2B0043C7BB /* SecretiveUpdater.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50692D2E2E6FDC290043C7BB /* SecretiveUpdater.swift */; };
+		50692D312E6FDC390043C7BB /* Brief in Frameworks */ = {isa = PBXBuildFile; productRef = 50692D302E6FDC390043C7BB /* Brief */; };
+		50692E5B2E6FF9D20043C7BB /* SecretAgentInputParser.xpc in Embed XPC Services */ = {isa = PBXBuildFile; fileRef = 50692E502E6FF9D20043C7BB /* SecretAgentInputParser.xpc */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
+		50692E682E6FF9E20043C7BB /* main.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50692E632E6FF9E20043C7BB /* main.swift */; };
+		50692E692E6FF9E20043C7BB /* SecretAgentInputParser.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50692E642E6FF9E20043C7BB /* SecretAgentInputParser.swift */; };
+		50692E6C2E6FFA510043C7BB /* SecretAgentKit in Frameworks */ = {isa = PBXBuildFile; productRef = 50692E6B2E6FFA510043C7BB /* SecretAgentKit */; };
+		50692E6D2E6FFA5F0043C7BB /* SecretiveUpdater.xpc in Embed XPC Services */ = {isa = PBXBuildFile; fileRef = 50692D122E6FDB880043C7BB /* SecretiveUpdater.xpc */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
+		50692E702E6FFA6E0043C7BB /* SecretAgentInputParser.xpc in Embed XPC Services */ = {isa = PBXBuildFile; fileRef = 50692E502E6FF9D20043C7BB /* SecretAgentInputParser.xpc */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		5079BA0F250F29BF00EA86F4 /* StoreListView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5079BA0E250F29BF00EA86F4 /* StoreListView.swift */; };
 		508A58AA241E06B40069DC07 /* PreviewUpdater.swift in Sources */ = {isa = PBXBuildFile; fileRef = 508A58A9241E06B40069DC07 /* PreviewUpdater.swift */; };
 		508A58B3241ED2180069DC07 /* AgentStatusChecker.swift in Sources */ = {isa = PBXBuildFile; fileRef = 508A58B2241ED2180069DC07 /* AgentStatusChecker.swift */; };
@@ -49,9 +65,14 @@
 		5099A02423FD2AAA0062B6F2 /* CreateSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5099A02323FD2AAA0062B6F2 /* CreateSecretView.swift */; };
 		50A3B79424026B7600D209EA /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50A3B79324026B7600D209EA /* Preview Assets.xcassets */; };
 		50A3B79724026B7600D209EA /* Main.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 50A3B79524026B7600D209EA /* Main.storyboard */; };
+		50AE97002E5C1A420018C710 /* IntegrationsView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50AE96FF2E5C1A420018C710 /* IntegrationsView.swift */; };
 		50B8550D24138C4F009958AC /* DeleteSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50B8550C24138C4F009958AC /* DeleteSecretView.swift */; };
 		50BB046B2418AAAE00D6E079 /* EmptyStoreView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */; };
+		50BDCB722E63BAF20072D2E7 /* AgentStatusView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BDCB712E63BAF20072D2E7 /* AgentStatusView.swift */; };
+		50BDCB742E6436CA0072D2E7 /* ErrorStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BDCB732E6436C60072D2E7 /* ErrorStyle.swift */; };
+		50BDCB762E6450950072D2E7 /* ConfigurationItemView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BDCB752E6450950072D2E7 /* ConfigurationItemView.swift */; };
 		50C385A52407A76D00AF2719 /* SecretDetailView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50C385A42407A76D00AF2719 /* SecretDetailView.swift */; };
+		50CF4ABC2E601B0F005588DC /* ActionButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50CF4ABB2E601B0F005588DC /* ActionButtonStyle.swift */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -62,9 +83,68 @@
 			remoteGlobalIDString = 50A3B78924026B7500D209EA;
 			remoteInfo = SecretAgent;
 		};
+		501577D32E6BC5DD004A37D0 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 50617D7723FCE48D0099B055 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 501577BC2E6BC5B4004A37D0;
+			remoteInfo = ReleasesDownloader;
+		};
+		50692D1B2E6FDB880043C7BB /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 50617D7723FCE48D0099B055 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 50692D112E6FDB880043C7BB;
+			remoteInfo = SecretiveUpdater;
+		};
+		50692E592E6FF9D20043C7BB /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 50617D7723FCE48D0099B055 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 50692E4F2E6FF9D20043C7BB;
+			remoteInfo = SecretAgentInputParser;
+		};
+		50692E6E2E6FFA5F0043C7BB /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 50617D7723FCE48D0099B055 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 50692D112E6FDB880043C7BB;
+			remoteInfo = SecretiveUpdater;
+		};
+		50692E712E6FFA6E0043C7BB /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 50617D7723FCE48D0099B055 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 50692E4F2E6FF9D20043C7BB;
+			remoteInfo = SecretAgentInputParser;
+		};
 /* End PBXContainerItemProxy section */
 
 /* Begin PBXCopyFilesBuildPhase section */
+		501577C92E6BC5B4004A37D0 /* Embed XPC Services */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = "$(CONTENTS_FOLDER_PATH)/XPCServices";
+			dstSubfolderSpec = 16;
+			files = (
+				50692D1D2E6FDB880043C7BB /* SecretiveUpdater.xpc in Embed XPC Services */,
+				50692E5B2E6FF9D20043C7BB /* SecretAgentInputParser.xpc in Embed XPC Services */,
+			);
+			name = "Embed XPC Services";
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		501577D22E6BC5D4004A37D0 /* Embed XPC Services */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = "$(CONTENTS_FOLDER_PATH)/XPCServices";
+			dstSubfolderSpec = 16;
+			files = (
+				50692E6D2E6FFA5F0043C7BB /* SecretiveUpdater.xpc in Embed XPC Services */,
+				50692E702E6FFA6E0043C7BB /* SecretAgentInputParser.xpc in Embed XPC Services */,
+			);
+			name = "Embed XPC Services";
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		50617DBF23FCE4AB0099B055 /* Embed Frameworks */ = {
 			isa = PBXCopyFilesBuildPhase;
 			buildActionMask = 2147483647;
@@ -98,14 +178,20 @@
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
-		2C4A9D2E2636FFD3008CC8E2 /* RenameSecretView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = RenameSecretView.swift; sourceTree = "<group>"; };
+		2C4A9D2E2636FFD3008CC8E2 /* EditSecretView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = EditSecretView.swift; sourceTree = "<group>"; };
 		50020BAF24064869003D4025 /* AppDelegate.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
 		50033AC227813F1700253856 /* BundleIDs.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BundleIDs.swift; sourceTree = "<group>"; };
 		5003EF39278005C800DF2006 /* Packages */ = {isa = PBXFileReference; lastKnownFileType = wrapper; path = Packages; sourceTree = "<group>"; };
-		5008C23D2E525D8200507AC2 /* Localizable.xcstrings */ = {isa = PBXFileReference; lastKnownFileType = text.json.xcstrings; name = Localizable.xcstrings; path = Packages/Localizable.xcstrings; sourceTree = SOURCE_ROOT; };
+		5008C23D2E525D8200507AC2 /* Localizable.xcstrings */ = {isa = PBXFileReference; lastKnownFileType = text.json.xcstrings; name = Localizable.xcstrings; path = Packages/Resources/Localizable.xcstrings; sourceTree = SOURCE_ROOT; };
 		50153E1F250AFCB200525160 /* UpdateView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = UpdateView.swift; sourceTree = "<group>"; };
 		50153E21250DECA300525160 /* SecretListItemView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretListItemView.swift; sourceTree = "<group>"; };
+		501578122E6C0479004A37D0 /* XPCInputParser.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = XPCInputParser.swift; sourceTree = "<group>"; };
 		5018F54E24064786002EB505 /* Notifier.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Notifier.swift; sourceTree = "<group>"; };
+		504788EB2E680DC400B4556F /* URLs.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = URLs.swift; sourceTree = "<group>"; };
+		504788F12E681F3A00B4556F /* Instructions.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Instructions.swift; sourceTree = "<group>"; };
+		504788F32E681F6900B4556F /* ToolConfigurationView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ToolConfigurationView.swift; sourceTree = "<group>"; };
+		504788F52E68206F00B4556F /* GettingStartedView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = GettingStartedView.swift; sourceTree = "<group>"; };
+		504789222E697DD300B4556F /* BoxBackgroundStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BoxBackgroundStyle.swift; sourceTree = "<group>"; };
 		50571E0224393C2600F76F6C /* JustUpdatedChecker.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = JustUpdatedChecker.swift; sourceTree = "<group>"; };
 		50571E0424393D1500F76F6C /* LaunchAgentController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = LaunchAgentController.swift; sourceTree = "<group>"; };
 		50617D7F23FCE48E0099B055 /* Secretive.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Secretive.app; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -119,9 +205,17 @@
 		5065E312295517C500E16645 /* ToolbarButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ToolbarButtonStyle.swift; sourceTree = "<group>"; };
 		5066A6C12516F303004B5A36 /* SetupView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SetupView.swift; sourceTree = "<group>"; };
 		5066A6C72516FE6E004B5A36 /* CopyableView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = CopyableView.swift; sourceTree = "<group>"; };
-		5066A6F6251829B1004B5A36 /* ShellConfigurationController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ShellConfigurationController.swift; sourceTree = "<group>"; };
 		506772C62424784600034DED /* Credits.rtf */ = {isa = PBXFileReference; lastKnownFileType = text.rtf; path = Credits.rtf; sourceTree = "<group>"; };
 		506772C82425BB8500034DED /* NoStoresView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NoStoresView.swift; sourceTree = "<group>"; };
+		50692BA52E6D5CC90043C7BB /* InternetAccessPolicy.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = InternetAccessPolicy.plist; sourceTree = "<group>"; };
+		50692D122E6FDB880043C7BB /* SecretiveUpdater.xpc */ = {isa = PBXFileReference; explicitFileType = "wrapper.xpc-service"; includeInIndex = 0; path = SecretiveUpdater.xpc; sourceTree = BUILT_PRODUCTS_DIR; };
+		50692D232E6FDB8D0043C7BB /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
+		50692D242E6FDB8D0043C7BB /* main.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = main.swift; sourceTree = "<group>"; };
+		50692D2E2E6FDC290043C7BB /* SecretiveUpdater.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretiveUpdater.swift; sourceTree = "<group>"; };
+		50692E502E6FF9D20043C7BB /* SecretAgentInputParser.xpc */ = {isa = PBXFileReference; explicitFileType = "wrapper.xpc-service"; includeInIndex = 0; path = SecretAgentInputParser.xpc; sourceTree = BUILT_PRODUCTS_DIR; };
+		50692E622E6FF9E20043C7BB /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
+		50692E632E6FF9E20043C7BB /* main.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = main.swift; sourceTree = "<group>"; };
+		50692E642E6FF9E20043C7BB /* SecretAgentInputParser.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretAgentInputParser.swift; sourceTree = "<group>"; };
 		5079BA0E250F29BF00EA86F4 /* StoreListView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = StoreListView.swift; sourceTree = "<group>"; };
 		508A58A9241E06B40069DC07 /* PreviewUpdater.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PreviewUpdater.swift; sourceTree = "<group>"; };
 		508A58AB241E121B0069DC07 /* Config.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Config.xcconfig; sourceTree = "<group>"; };
@@ -137,9 +231,14 @@
 		50A3B79624026B7600D209EA /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; name = Base; path = Base.lproj/Main.storyboard; sourceTree = "<group>"; };
 		50A3B79824026B7600D209EA /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		50A3B79924026B7600D209EA /* SecretAgent.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = SecretAgent.entitlements; sourceTree = "<group>"; };
+		50AE96FF2E5C1A420018C710 /* IntegrationsView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = IntegrationsView.swift; sourceTree = "<group>"; };
 		50B8550C24138C4F009958AC /* DeleteSecretView.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = DeleteSecretView.swift; sourceTree = "<group>"; };
 		50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = EmptyStoreView.swift; sourceTree = "<group>"; };
+		50BDCB712E63BAF20072D2E7 /* AgentStatusView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AgentStatusView.swift; sourceTree = "<group>"; };
+		50BDCB732E6436C60072D2E7 /* ErrorStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ErrorStyle.swift; sourceTree = "<group>"; };
+		50BDCB752E6450950072D2E7 /* ConfigurationItemView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ConfigurationItemView.swift; sourceTree = "<group>"; };
 		50C385A42407A76D00AF2719 /* SecretDetailView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretDetailView.swift; sourceTree = "<group>"; };
+		50CF4ABB2E601B0F005588DC /* ActionButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ActionButtonStyle.swift; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -154,6 +253,23 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		50692D0F2E6FDB880043C7BB /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				50692D2D2E6FDC000043C7BB /* XPCWrappers in Frameworks */,
+				50692D312E6FDC390043C7BB /* Brief in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		50692E4D2E6FF9D20043C7BB /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				50692E6C2E6FFA510043C7BB /* SecretAgentKit in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		50A3B78724026B7500D209EA /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
@@ -177,6 +293,56 @@
 			path = Helpers;
 			sourceTree = "<group>";
 		};
+		504788ED2E681EB200B4556F /* Styles */ = {
+			isa = PBXGroup;
+			children = (
+				50CF4ABB2E601B0F005588DC /* ActionButtonStyle.swift */,
+				50BDCB732E6436C60072D2E7 /* ErrorStyle.swift */,
+				504789222E697DD300B4556F /* BoxBackgroundStyle.swift */,
+				5065E312295517C500E16645 /* ToolbarButtonStyle.swift */,
+			);
+			path = Styles;
+			sourceTree = "<group>";
+		};
+		504788EE2E681EC300B4556F /* Secrets */ = {
+			isa = PBXGroup;
+			children = (
+				5099A02323FD2AAA0062B6F2 /* CreateSecretView.swift */,
+				50B8550C24138C4F009958AC /* DeleteSecretView.swift */,
+				2C4A9D2E2636FFD3008CC8E2 /* EditSecretView.swift */,
+				50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */,
+				506772C82425BB8500034DED /* NoStoresView.swift */,
+				50C385A42407A76D00AF2719 /* SecretDetailView.swift */,
+				50153E21250DECA300525160 /* SecretListItemView.swift */,
+				5079BA0E250F29BF00EA86F4 /* StoreListView.swift */,
+			);
+			path = Secrets;
+			sourceTree = "<group>";
+		};
+		504788EF2E681ED700B4556F /* Configuration */ = {
+			isa = PBXGroup;
+			children = (
+				50BDCB752E6450950072D2E7 /* ConfigurationItemView.swift */,
+				50AE96FF2E5C1A420018C710 /* IntegrationsView.swift */,
+				504788F12E681F3A00B4556F /* Instructions.swift */,
+				504788F32E681F6900B4556F /* ToolConfigurationView.swift */,
+				5066A6C12516F303004B5A36 /* SetupView.swift */,
+				504788F52E68206F00B4556F /* GettingStartedView.swift */,
+			);
+			path = Configuration;
+			sourceTree = "<group>";
+		};
+		504788F02E681F0100B4556F /* Views */ = {
+			isa = PBXGroup;
+			children = (
+				50BDCB712E63BAF20072D2E7 /* AgentStatusView.swift */,
+				50617D8423FCE48E0099B055 /* ContentView.swift */,
+				5066A6C72516FE6E004B5A36 /* CopyableView.swift */,
+				50153E1F250AFCB200525160 /* UpdateView.swift */,
+			);
+			path = Views;
+			sourceTree = "<group>";
+		};
 		50617D7623FCE48D0099B055 = {
 			isa = PBXGroup;
 			children = (
@@ -184,6 +350,8 @@
 				50617D8123FCE48E0099B055 /* Secretive */,
 				50A3B78B24026B7500D209EA /* SecretAgent */,
 				508A58AF241E144C0069DC07 /* Config */,
+				50692D272E6FDB8D0043C7BB /* SecretiveUpdater */,
+				50692E662E6FF9E20043C7BB /* SecretAgentInputParser */,
 				50617D8023FCE48E0099B055 /* Products */,
 				5099A08B240243730062B6F2 /* Frameworks */,
 			);
@@ -194,6 +362,8 @@
 			children = (
 				50617D7F23FCE48E0099B055 /* Secretive.app */,
 				50A3B78A24026B7500D209EA /* SecretAgent.app */,
+				50692D122E6FDB880043C7BB /* SecretiveUpdater.xpc */,
+				50692E502E6FF9D20043C7BB /* SecretAgentInputParser.xpc */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -227,6 +397,27 @@
 			path = "Preview Content";
 			sourceTree = "<group>";
 		};
+		50692D272E6FDB8D0043C7BB /* SecretiveUpdater */ = {
+			isa = PBXGroup;
+			children = (
+				50692D232E6FDB8D0043C7BB /* Info.plist */,
+				50692BA52E6D5CC90043C7BB /* InternetAccessPolicy.plist */,
+				50692D242E6FDB8D0043C7BB /* main.swift */,
+				50692D2E2E6FDC290043C7BB /* SecretiveUpdater.swift */,
+			);
+			path = SecretiveUpdater;
+			sourceTree = "<group>";
+		};
+		50692E662E6FF9E20043C7BB /* SecretAgentInputParser */ = {
+			isa = PBXGroup;
+			children = (
+				50692E622E6FF9E20043C7BB /* Info.plist */,
+				50692E632E6FF9E20043C7BB /* main.swift */,
+				50692E642E6FF9E20043C7BB /* SecretAgentInputParser.swift */,
+			);
+			path = SecretAgentInputParser;
+			sourceTree = "<group>";
+		};
 		508A58AF241E144C0069DC07 /* Config */ = {
 			isa = PBXGroup;
 			children = (
@@ -239,19 +430,10 @@
 		508A58B0241ED1C40069DC07 /* Views */ = {
 			isa = PBXGroup;
 			children = (
-				50617D8423FCE48E0099B055 /* ContentView.swift */,
+				504788EF2E681ED700B4556F /* Configuration */,
-				5065E312295517C500E16645 /* ToolbarButtonStyle.swift */,
+				504788EE2E681EC300B4556F /* Secrets */,
-				5079BA0E250F29BF00EA86F4 /* StoreListView.swift */,
+				504788ED2E681EB200B4556F /* Styles */,
-				50153E21250DECA300525160 /* SecretListItemView.swift */,
+				504788F02E681F0100B4556F /* Views */,
-				50C385A42407A76D00AF2719 /* SecretDetailView.swift */,
-				5099A02323FD2AAA0062B6F2 /* CreateSecretView.swift */,
-				50B8550C24138C4F009958AC /* DeleteSecretView.swift */,
-				2C4A9D2E2636FFD3008CC8E2 /* RenameSecretView.swift */,
-				50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */,
-				506772C82425BB8500034DED /* NoStoresView.swift */,
-				50153E1F250AFCB200525160 /* UpdateView.swift */,
-				5066A6C12516F303004B5A36 /* SetupView.swift */,
-				5066A6C72516FE6E004B5A36 /* CopyableView.swift */,
 			);
 			path = Views;
 			sourceTree = "<group>";
@@ -259,11 +441,11 @@
 		508A58B1241ED1EA0069DC07 /* Controllers */ = {
 			isa = PBXGroup;
 			children = (
+				504788EB2E680DC400B4556F /* URLs.swift */,
 				508A58B2241ED2180069DC07 /* AgentStatusChecker.swift */,
 				5091D2BB25183B830049FD9B /* ApplicationDirectoryController.swift */,
 				50571E0224393C2600F76F6C /* JustUpdatedChecker.swift */,
 				50571E0424393D1500F76F6C /* LaunchAgentController.swift */,
-				5066A6F6251829B1004B5A36 /* ShellConfigurationController.swift */,
 			);
 			path = Controllers;
 			sourceTree = "<group>";
@@ -280,6 +462,7 @@
 			children = (
 				50020BAF24064869003D4025 /* AppDelegate.swift */,
 				5018F54E24064786002EB505 /* Notifier.swift */,
+				501578122E6C0479004A37D0 /* XPCInputParser.swift */,
 				50A3B79524026B7600D209EA /* Main.storyboard */,
 				50A3B79824026B7600D209EA /* Info.plist */,
 				508BF29425B4F140009EFB7E /* InternetAccessPolicy.plist */,
@@ -309,11 +492,14 @@
 				50617D7D23FCE48D0099B055 /* Resources */,
 				50617DBF23FCE4AB0099B055 /* Embed Frameworks */,
 				50C385AF240E438B00AF2719 /* CopyFiles */,
+				501577C92E6BC5B4004A37D0 /* Embed XPC Services */,
 			);
 			buildRules = (
 			);
 			dependencies = (
 				50142167278126B500BBAA70 /* PBXTargetDependency */,
+				50692D1C2E6FDB880043C7BB /* PBXTargetDependency */,
+				50692E5A2E6FF9D20043C7BB /* PBXTargetDependency */,
 			);
 			name = Secretive;
 			packageProductDependencies = (
@@ -326,6 +512,47 @@
 			productReference = 50617D7F23FCE48E0099B055 /* Secretive.app */;
 			productType = "com.apple.product-type.application";
 		};
+		50692D112E6FDB880043C7BB /* SecretiveUpdater */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 50692D1F2E6FDB880043C7BB /* Build configuration list for PBXNativeTarget "SecretiveUpdater" */;
+			buildPhases = (
+				50692D0E2E6FDB880043C7BB /* Sources */,
+				50692D0F2E6FDB880043C7BB /* Frameworks */,
+				50692D102E6FDB880043C7BB /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = SecretiveUpdater;
+			packageProductDependencies = (
+				50692D2C2E6FDC000043C7BB /* XPCWrappers */,
+				50692D302E6FDC390043C7BB /* Brief */,
+			);
+			productName = SecretiveUpdater;
+			productReference = 50692D122E6FDB880043C7BB /* SecretiveUpdater.xpc */;
+			productType = "com.apple.product-type.xpc-service";
+		};
+		50692E4F2E6FF9D20043C7BB /* SecretAgentInputParser */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 50692E5D2E6FF9D20043C7BB /* Build configuration list for PBXNativeTarget "SecretAgentInputParser" */;
+			buildPhases = (
+				50692E4C2E6FF9D20043C7BB /* Sources */,
+				50692E4D2E6FF9D20043C7BB /* Frameworks */,
+				50692E4E2E6FF9D20043C7BB /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = SecretAgentInputParser;
+			packageProductDependencies = (
+				50692E6B2E6FFA510043C7BB /* SecretAgentKit */,
+			);
+			productName = SecretAgentInputParser;
+			productReference = 50692E502E6FF9D20043C7BB /* SecretAgentInputParser.xpc */;
+			productType = "com.apple.product-type.xpc-service";
+		};
 		50A3B78924026B7500D209EA /* SecretAgent */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = 50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */;
@@ -334,10 +561,14 @@
 				50A3B78724026B7500D209EA /* Frameworks */,
 				50A3B78824026B7500D209EA /* Resources */,
 				50A5C18E240E4B4B00E2996C /* Embed Frameworks */,
+				501577D22E6BC5D4004A37D0 /* Embed XPC Services */,
 			);
 			buildRules = (
 			);
 			dependencies = (
+				501577D42E6BC5DD004A37D0 /* PBXTargetDependency */,
+				50692E6F2E6FFA5F0043C7BB /* PBXTargetDependency */,
+				50692E722E6FFA6E0043C7BB /* PBXTargetDependency */,
 			);
 			name = SecretAgent;
 			packageProductDependencies = (
@@ -358,13 +589,19 @@
 			isa = PBXProject;
 			attributes = {
 				BuildIndependentTargetsInParallel = YES;
-				LastSwiftUpdateCheck = 1220;
+				LastSwiftUpdateCheck = 2600;
 				LastUpgradeCheck = 2600;
 				ORGANIZATIONNAME = "Max Goedjen";
 				TargetAttributes = {
 					50617D7E23FCE48D0099B055 = {
 						CreatedOnToolsVersion = 11.3;
 					};
+					50692D112E6FDB880043C7BB = {
+						CreatedOnToolsVersion = 26.0;
+					};
+					50692E4F2E6FF9D20043C7BB = {
+						CreatedOnToolsVersion = 26.0;
+					};
 					50A3B78924026B7500D209EA = {
 						CreatedOnToolsVersion = 11.4;
 					};
@@ -394,6 +631,8 @@
 			targets = (
 				50617D7E23FCE48D0099B055 /* Secretive */,
 				50A3B78924026B7500D209EA /* SecretAgent */,
+				50692D112E6FDB880043C7BB /* SecretiveUpdater */,
+				50692E4F2E6FF9D20043C7BB /* SecretAgentInputParser */,
 			);
 		};
 /* End PBXProject section */
@@ -411,6 +650,20 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		50692D102E6FDB880043C7BB /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		50692E4E2E6FF9D20043C7BB /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		50A3B78824026B7500D209EA /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -430,25 +683,34 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				2C4A9D2F2636FFD3008CC8E2 /* RenameSecretView.swift in Sources */,
+				504788F22E681F3A00B4556F /* Instructions.swift in Sources */,
+				50BDCB742E6436CA0072D2E7 /* ErrorStyle.swift in Sources */,
+				2C4A9D2F2636FFD3008CC8E2 /* EditSecretView.swift in Sources */,
 				5091D2BC25183B830049FD9B /* ApplicationDirectoryController.swift in Sources */,
+				504788EC2E680DC800B4556F /* URLs.swift in Sources */,
+				504789232E697DD300B4556F /* BoxBackgroundStyle.swift in Sources */,
 				5066A6C22516F303004B5A36 /* SetupView.swift in Sources */,
 				5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */,
 				50617D8523FCE48E0099B055 /* ContentView.swift in Sources */,
+				504788F62E68206F00B4556F /* GettingStartedView.swift in Sources */,
+				50CF4ABC2E601B0F005588DC /* ActionButtonStyle.swift in Sources */,
 				50571E0324393C2600F76F6C /* JustUpdatedChecker.swift in Sources */,
 				5079BA0F250F29BF00EA86F4 /* StoreListView.swift in Sources */,
 				50617DD223FCEFA90099B055 /* PreviewStore.swift in Sources */,
-				5066A6F7251829B1004B5A36 /* ShellConfigurationController.swift in Sources */,
 				50033AC327813F1700253856 /* BundleIDs.swift in Sources */,
+				50BDCB722E63BAF20072D2E7 /* AgentStatusView.swift in Sources */,
 				508A58B3241ED2180069DC07 /* AgentStatusChecker.swift in Sources */,
 				50C385A52407A76D00AF2719 /* SecretDetailView.swift in Sources */,
 				5099A02423FD2AAA0062B6F2 /* CreateSecretView.swift in Sources */,
+				50AE97002E5C1A420018C710 /* IntegrationsView.swift in Sources */,
 				50153E20250AFCB200525160 /* UpdateView.swift in Sources */,
 				50571E0524393D1500F76F6C /* LaunchAgentController.swift in Sources */,
 				5066A6C82516FE6E004B5A36 /* CopyableView.swift in Sources */,
 				50B8550D24138C4F009958AC /* DeleteSecretView.swift in Sources */,
 				50BB046B2418AAAE00D6E079 /* EmptyStoreView.swift in Sources */,
+				50BDCB762E6450950072D2E7 /* ConfigurationItemView.swift in Sources */,
 				50617D8323FCE48E0099B055 /* App.swift in Sources */,
+				504788F42E681F6900B4556F /* ToolConfigurationView.swift in Sources */,
 				506772C92425BB8500034DED /* NoStoresView.swift in Sources */,
 				50153E22250DECA300525160 /* SecretListItemView.swift in Sources */,
 				508A58B5241ED48F0069DC07 /* PreviewAgentStatusChecker.swift in Sources */,
@@ -456,12 +718,31 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		50692D0E2E6FDB880043C7BB /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				50692D2F2E6FDC2B0043C7BB /* SecretiveUpdater.swift in Sources */,
+				50692D282E6FDB8D0043C7BB /* main.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		50692E4C2E6FF9D20043C7BB /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				50692E682E6FF9E20043C7BB /* main.swift in Sources */,
+				50692E692E6FF9E20043C7BB /* SecretAgentInputParser.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		50A3B78624026B7500D209EA /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 				50020BB024064869003D4025 /* AppDelegate.swift in Sources */,
 				5018F54F24064786002EB505 /* Notifier.swift in Sources */,
+				501578132E6C0479004A37D0 /* XPCInputParser.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -473,6 +754,30 @@
 			target = 50A3B78924026B7500D209EA /* SecretAgent */;
 			targetProxy = 50142166278126B500BBAA70 /* PBXContainerItemProxy */;
 		};
+		501577D42E6BC5DD004A37D0 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			targetProxy = 501577D32E6BC5DD004A37D0 /* PBXContainerItemProxy */;
+		};
+		50692D1C2E6FDB880043C7BB /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 50692D112E6FDB880043C7BB /* SecretiveUpdater */;
+			targetProxy = 50692D1B2E6FDB880043C7BB /* PBXContainerItemProxy */;
+		};
+		50692E5A2E6FF9D20043C7BB /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 50692E4F2E6FF9D20043C7BB /* SecretAgentInputParser */;
+			targetProxy = 50692E592E6FF9D20043C7BB /* PBXContainerItemProxy */;
+		};
+		50692E6F2E6FFA5F0043C7BB /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 50692D112E6FDB880043C7BB /* SecretiveUpdater */;
+			targetProxy = 50692E6E2E6FFA5F0043C7BB /* PBXContainerItemProxy */;
+		};
+		50692E722E6FFA6E0043C7BB /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 50692E4F2E6FF9D20043C7BB /* SecretAgentInputParser */;
+			targetProxy = 50692E712E6FFA6E0043C7BB /* PBXContainerItemProxy */;
+		};
 /* End PBXTargetDependency section */
 
 /* Begin PBXVariantGroup section */
@@ -557,6 +862,8 @@
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
 				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
+				SWIFT_STRICT_MEMORY_SAFETY = YES;
+				SWIFT_TREAT_WARNINGS_AS_ERRORS = YES;
 				SWIFT_VERSION = 6.0;
 			};
 			name = Debug;
@@ -624,6 +931,8 @@
 				SWIFT_COMPILATION_MODE = wholemodule;
 				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-O";
+				SWIFT_STRICT_MEMORY_SAFETY = YES;
+				SWIFT_TREAT_WARNINGS_AS_ERRORS = YES;
 				SWIFT_VERSION = 6.0;
 			};
 			name = Release;
@@ -643,10 +952,18 @@
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_ENHANCED_SECURITY = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
+				ENABLE_OUTGOING_NETWORK_CONNECTIONS = NO;
 				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_USER_SELECTED_FILES = readwrite;
+				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
+				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
+				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
+				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
+				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
+				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
+				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
+				ENABLE_RESOURCE_ACCESS_USB = NO;
 				INFOPLIST_FILE = Secretive/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -675,10 +992,18 @@
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_ENHANCED_SECURITY = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
+				ENABLE_OUTGOING_NETWORK_CONNECTIONS = NO;
 				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_USER_SELECTED_FILES = readwrite;
+				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
+				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
+				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
+				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
+				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
+				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
+				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
+				ENABLE_RESOURCE_ACCESS_USB = NO;
 				INFOPLIST_FILE = Secretive/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -692,6 +1017,225 @@
 			};
 			name = Release;
 		};
+		50692D202E6FDB880043C7BB /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CODE_SIGN_IDENTITY = "Apple Development";
+				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = Z72PRUAWF6;
+				ENABLE_APP_SANDBOX = YES;
+				ENABLE_HARDENED_RUNTIME = YES;
+				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
+				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
+				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
+				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
+				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
+				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
+				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
+				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
+				ENABLE_RESOURCE_ACCESS_USB = NO;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = SecretiveUpdater/Info.plist;
+				INFOPLIST_KEY_CFBundleDisplayName = SecretiveUpdater;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025 Max Goedjen. All rights reserved.";
+				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
+				MACOSX_DEPLOYMENT_TARGET = 26.0;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretiveUpdater;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				REGISTER_APP_GROUPS = YES;
+				SKIP_INSTALL = YES;
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
+				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "DEBUG $(inherited)";
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+			};
+			name = Debug;
+		};
+		50692D212E6FDB880043C7BB /* Test */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				CURRENT_PROJECT_VERSION = 1;
+				ENABLE_APP_SANDBOX = YES;
+				ENABLE_HARDENED_RUNTIME = YES;
+				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
+				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
+				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
+				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
+				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
+				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
+				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
+				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
+				ENABLE_RESOURCE_ACCESS_USB = NO;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = SecretiveUpdater/Info.plist;
+				INFOPLIST_KEY_CFBundleDisplayName = SecretiveUpdater;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025 Max Goedjen. All rights reserved.";
+				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
+				MACOSX_DEPLOYMENT_TARGET = 26.0;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretiveUpdater;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				REGISTER_APP_GROUPS = YES;
+				SKIP_INSTALL = YES;
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+			};
+			name = Test;
+		};
+		50692D222E6FDB880043C7BB /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CODE_SIGN_IDENTITY = "Developer ID Application";
+				CODE_SIGN_STYLE = Manual;
+				COMBINE_HIDPI_IMAGES = YES;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = "";
+				"DEVELOPMENT_TEAM[sdk=macosx*]" = Z72PRUAWF6;
+				ENABLE_APP_SANDBOX = YES;
+				ENABLE_HARDENED_RUNTIME = YES;
+				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
+				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
+				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
+				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
+				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
+				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
+				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
+				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
+				ENABLE_RESOURCE_ACCESS_USB = NO;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = SecretiveUpdater/Info.plist;
+				INFOPLIST_KEY_CFBundleDisplayName = SecretiveUpdater;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025 Max Goedjen. All rights reserved.";
+				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
+				MACOSX_DEPLOYMENT_TARGET = 26.0;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretiveUpdater;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				REGISTER_APP_GROUPS = YES;
+				SKIP_INSTALL = YES;
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+			};
+			name = Release;
+		};
+		50692E5E2E6FF9D20043C7BB /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CODE_SIGN_IDENTITY = "Apple Development";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = Z72PRUAWF6;
+				ENABLE_APP_SANDBOX = YES;
+				ENABLE_HARDENED_RUNTIME = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = SecretAgentInputParser/Info.plist;
+				INFOPLIST_KEY_CFBundleDisplayName = SecretAgentInputParser;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025 Max Goedjen. All rights reserved.";
+				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
+				MACOSX_DEPLOYMENT_TARGET = 26.0;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgentInputParser;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				REGISTER_APP_GROUPS = YES;
+				SKIP_INSTALL = YES;
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
+				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "DEBUG $(inherited)";
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+			};
+			name = Debug;
+		};
+		50692E5F2E6FF9D20043C7BB /* Test */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				CURRENT_PROJECT_VERSION = 1;
+				ENABLE_APP_SANDBOX = YES;
+				ENABLE_HARDENED_RUNTIME = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = SecretAgentInputParser/Info.plist;
+				INFOPLIST_KEY_CFBundleDisplayName = SecretAgentInputParser;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025 Max Goedjen. All rights reserved.";
+				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
+				MACOSX_DEPLOYMENT_TARGET = 26.0;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgentInputParser;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				REGISTER_APP_GROUPS = YES;
+				SKIP_INSTALL = YES;
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+			};
+			name = Test;
+		};
+		50692E602E6FF9D20043C7BB /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CODE_SIGN_IDENTITY = "Developer ID Application";
+				CODE_SIGN_STYLE = Manual;
+				COMBINE_HIDPI_IMAGES = YES;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = "";
+				"DEVELOPMENT_TEAM[sdk=macosx*]" = Z72PRUAWF6;
+				ENABLE_APP_SANDBOX = YES;
+				ENABLE_HARDENED_RUNTIME = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = SecretAgentInputParser/Info.plist;
+				INFOPLIST_KEY_CFBundleDisplayName = SecretAgentInputParser;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright © 2025 Max Goedjen. All rights reserved.";
+				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
+				MACOSX_DEPLOYMENT_TARGET = 26.0;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgentInputParser;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				REGISTER_APP_GROUPS = YES;
+				SKIP_INSTALL = YES;
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+			};
+			name = Release;
+		};
 		508A5914241EF1A00069DC07 /* Test */ = {
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = 508A58AB241E121B0069DC07 /* Config.xcconfig */;
@@ -762,6 +1306,8 @@
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
 				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
+				SWIFT_STRICT_MEMORY_SAFETY = YES;
+				SWIFT_TREAT_WARNINGS_AS_ERRORS = YES;
 				SWIFT_VERSION = 6.0;
 			};
 			name = Test;
@@ -779,10 +1325,18 @@
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_ENHANCED_SECURITY = YES;
 				ENABLE_HARDENED_RUNTIME = NO;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
+				ENABLE_OUTGOING_NETWORK_CONNECTIONS = NO;
 				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_USER_SELECTED_FILES = readwrite;
+				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
+				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
+				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
+				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
+				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
+				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
+				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
+				ENABLE_RESOURCE_ACCESS_USB = NO;
 				INFOPLIST_FILE = Secretive/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -805,8 +1359,17 @@
 				DEVELOPMENT_ASSET_PATHS = "\"SecretAgent/Preview Content\"";
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
+				ENABLE_OUTGOING_NETWORK_CONNECTIONS = NO;
 				ENABLE_PREVIEWS = YES;
+				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
+				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
+				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
+				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
+				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
+				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
+				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
+				ENABLE_RESOURCE_ACCESS_USB = NO;
 				INFOPLIST_FILE = SecretAgent/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -831,8 +1394,17 @@
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
+				ENABLE_OUTGOING_NETWORK_CONNECTIONS = NO;
 				ENABLE_PREVIEWS = YES;
+				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
+				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
+				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
+				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
+				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
+				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
+				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
+				ENABLE_RESOURCE_ACCESS_USB = NO;
 				INFOPLIST_FILE = SecretAgent/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -858,8 +1430,17 @@
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
 				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_INCOMING_NETWORK_CONNECTIONS = NO;
+				ENABLE_OUTGOING_NETWORK_CONNECTIONS = NO;
 				ENABLE_PREVIEWS = YES;
+				ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO;
+				ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO;
+				ENABLE_RESOURCE_ACCESS_CALENDARS = NO;
+				ENABLE_RESOURCE_ACCESS_CAMERA = NO;
+				ENABLE_RESOURCE_ACCESS_CONTACTS = NO;
+				ENABLE_RESOURCE_ACCESS_LOCATION = NO;
+				ENABLE_RESOURCE_ACCESS_PRINTING = NO;
+				ENABLE_RESOURCE_ACCESS_USB = NO;
 				INFOPLIST_FILE = SecretAgent/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -896,6 +1477,26 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
+		50692D1F2E6FDB880043C7BB /* Build configuration list for PBXNativeTarget "SecretiveUpdater" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				50692D202E6FDB880043C7BB /* Debug */,
+				50692D212E6FDB880043C7BB /* Test */,
+				50692D222E6FDB880043C7BB /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		50692E5D2E6FF9D20043C7BB /* Build configuration list for PBXNativeTarget "SecretAgentInputParser" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				50692E5E2E6FF9D20043C7BB /* Debug */,
+				50692E5F2E6FF9D20043C7BB /* Test */,
+				50692E602E6FF9D20043C7BB /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
 		50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
@@ -945,6 +1546,18 @@
 			isa = XCSwiftPackageProductDependency;
 			productName = Brief;
 		};
+		50692D2C2E6FDC000043C7BB /* XPCWrappers */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = XPCWrappers;
+		};
+		50692D302E6FDC390043C7BB /* Brief */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = Brief;
+		};
+		50692E6B2E6FFA510043C7BB /* SecretAgentKit */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = SecretAgentKit;
+		};
 /* End XCSwiftPackageProductDependency section */
 	};
 	rootObject = 50617D7723FCE48D0099B055 /* Project object */;

Sources/Secretive.xcodeproj/xcshareddata/xcschemes/PackageTests.xcscheme

@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "2600"
+   version = "1.7">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES"
+      buildArchitectures = "Automatic">
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <TestPlans>
+         <TestPlanReference
+            reference = "container:Config/Secretive.xctestplan">
+         </TestPlanReference>
+      </TestPlans>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Sources/Secretive/App.swift

@@ -1,4 +1,3 @@
-import Cocoa
 import SwiftUI
 import SecretKit
 import SecureEnclaveSecretKit
@@ -10,7 +9,10 @@ extension EnvironmentValues {
     // This is injected through .environment modifier below instead of @Entry for performance reasons (basially, restrictions around init/mainactor causing delay in loading secrets/"empty screen" blip).
     @MainActor fileprivate static let _secretStoreList: SecretStoreList = {
         let list = SecretStoreList()
-        list.add(store: SecureEnclave.Store())
+        let cryptoKit = SecureEnclave.Store()
+        let migrator = SecureEnclave.CryptoKitMigrator()
+        try? migrator.migrate(to: cryptoKit)
+        list.add(store: cryptoKit)
         list.add(store: SmartCard.Store())
         return list
     }()
@@ -23,6 +25,9 @@ extension EnvironmentValues {
     }()
     @Entry var updater: any UpdaterProtocol = _updater
 
+    private static let _justUpdatedChecker = JustUpdatedChecker()
+    @Entry var justUpdatedChecker: any JustUpdatedCheckerProtocol = _justUpdatedChecker
+
     @MainActor var secretStoreList: SecretStoreList {
         EnvironmentValues._secretStoreList
     }
@@ -31,10 +36,11 @@ extension EnvironmentValues {
 @main
 struct Secretive: App {
     
-    private let justUpdatedChecker = JustUpdatedChecker()
     @Environment(\.agentStatusChecker) var agentStatusChecker
+    @Environment(\.justUpdatedChecker) var justUpdatedChecker
     @AppStorage("defaultsHasRunSetup") var hasRunSetup = false
     @State private var showingSetup = false
+    @State private var showingIntegrations = false
     @State private var showingCreation = false
 
     @SceneBuilder var body: some Scene {
@@ -49,15 +55,23 @@ struct Secretive: App {
                 .onReceive(NotificationCenter.default.publisher(for: NSApplication.didBecomeActiveNotification)) { _ in
                     guard hasRunSetup else { return }
                     agentStatusChecker.check()
-                    if agentStatusChecker.running && justUpdatedChecker.justUpdated {
+                    if agentStatusChecker.running && justUpdatedChecker.justUpdatedBuild {
                         // Relaunch the agent, since it'll be running from earlier update still
                         reinstallAgent()
                     } else if !agentStatusChecker.running && !agentStatusChecker.developmentBuild {
                         forceLaunchAgent()
                     }
                 }
+                .sheet(isPresented: $showingIntegrations) {
+                    IntegrationsView()
+                }
         }
         .commands {
+            CommandGroup(before: CommandGroupPlacement.appSettings) {
+                Button(.integrationsMenuBarTitle, systemImage: "app.connected.to.app.below.fill") {
+                    showingIntegrations = true
+                }
+            }
             CommandGroup(after: CommandGroupPlacement.newItem) {
                 Button(.appMenuNewSecretButton) {
                     showingCreation = true
@@ -69,11 +83,6 @@ struct Secretive: App {
                     NSWorkspace.shared.open(Constants.helpURL)
                 }
             }
-            CommandGroup(after: .help) {
-                Button(.appMenuSetupButton) {
-                    showingSetup = true
-                }
-            }
             SidebarCommands()
         }
     }
@@ -83,9 +92,8 @@ struct Secretive: App {
 extension Secretive {
 
     private func reinstallAgent() {
-        justUpdatedChecker.check()
         Task {
-            await LaunchAgentController().install()
+            _ = await LaunchAgentController().install()
             try? await Task.sleep(for: .seconds(1))
             agentStatusChecker.check()
             if !agentStatusChecker.running {

Sources/Secretive/Controllers/AgentStatusChecker.swift

@@ -1,5 +1,4 @@
 import Foundation
-import Combine
 import AppKit
 import SecretKit
 import Observation
@@ -7,12 +6,14 @@ import Observation
 @MainActor protocol AgentStatusCheckerProtocol: Observable, Sendable {
     var running: Bool { get }
     var developmentBuild: Bool { get }
+    var process: NSRunningApplication? { get }
     func check()
 }
 
 @Observable @MainActor final class AgentStatusChecker: AgentStatusCheckerProtocol {
 
     var running: Bool = false
+    var process: NSRunningApplication? = nil
 
     nonisolated init() {
         Task { @MainActor in
@@ -21,32 +22,39 @@ import Observation
     }
 
     func check() {
-        running = instanceSecretAgentProcess != nil
+        process = instanceSecretAgentProcess
+        running = process != nil
     }
 
     // All processes, including ones from older versions, etc
-    var secretAgentProcesses: [NSRunningApplication] {
+    var allSecretAgentProcesses: [NSRunningApplication] {
-        NSRunningApplication.runningApplications(withBundleIdentifier: Bundle.main.agentBundleID)
+        NSRunningApplication.runningApplications(withBundleIdentifier: Bundle.agentBundleID)
     }
 
     // The process corresponding to this instance of Secretive
     var instanceSecretAgentProcess: NSRunningApplication? {
-        let agents = secretAgentProcesses
+        // FIXME: CHECK VERSION
+        let agents = allSecretAgentProcesses
         for agent in agents {
             guard let url = agent.bundleURL else { continue }
-            if url.absoluteString.hasPrefix(Bundle.main.bundleURL.absoluteString) {
+            if url.absoluteString.hasPrefix(Bundle.main.bundleURL.absoluteString) || (url.isXcodeURL && developmentBuild) {
                 return agent
             }
         }
         return nil
     }
 
-
     // Whether Secretive is being run in an Xcode environment.
     var developmentBuild: Bool {
-        Bundle.main.bundleURL.absoluteString.contains("/Library/Developer/Xcode")
+        Bundle.main.bundleURL.isXcodeURL
     }
 
 }
 
+extension URL {
 
+    var isXcodeURL: Bool {
+        absoluteString.contains("/Library/Developer/Xcode")
+    }
+
+}

Sources/Secretive/Controllers/JustUpdatedChecker.swift

@@ -1,24 +1,33 @@
 import Foundation
-import Combine
 import AppKit
 
-protocol JustUpdatedCheckerProtocol: Observable {
+@MainActor protocol JustUpdatedCheckerProtocol: Observable {
-    var justUpdated: Bool { get }
+    var justUpdatedBuild: Bool { get }
+    var justUpdatedOS: Bool { get }
 }
 
-@Observable class JustUpdatedChecker: JustUpdatedCheckerProtocol {
+@Observable @MainActor class JustUpdatedChecker: JustUpdatedCheckerProtocol {
 
-    var justUpdated: Bool = false
+    var justUpdatedBuild: Bool = false
+    var justUpdatedOS: Bool = false
 
-    init() {
+    nonisolated init() {
+        Task { @MainActor in
             check()
         }
+    }
 
-    func check() {
+    private func check() {
-        let lastBuild = UserDefaults.standard.object(forKey: Constants.previousVersionUserDefaultsKey) as? String ?? "None"
+        let lastBuild = UserDefaults.standard.object(forKey: Constants.previousVersionUserDefaultsKey) as? String
+        let lastOS = UserDefaults.standard.object(forKey: Constants.previousOSVersionUserDefaultsKey) as? String
         let currentBuild = Bundle.main.infoDictionary!["CFBundleShortVersionString"] as! String
+        let osRaw = ProcessInfo.processInfo.operatingSystemVersion
+        let currentOS = "\(osRaw.majorVersion).\(osRaw.minorVersion).\(osRaw.patchVersion)"
         UserDefaults.standard.set(currentBuild, forKey: Constants.previousVersionUserDefaultsKey)
-        justUpdated = lastBuild != currentBuild
+        UserDefaults.standard.set(currentOS, forKey: Constants.previousOSVersionUserDefaultsKey)
+        justUpdatedBuild = lastBuild != currentBuild
+        // To prevent this showing on first lauch for every user, only show if lastBuild is non-nil.
+        justUpdatedOS = lastBuild != nil && lastOS != currentOS
     }
 
 
@@ -29,6 +38,7 @@ extension JustUpdatedChecker {
 
     enum Constants {
         static let previousVersionUserDefaultsKey = "com.maxgoedjen.Secretive.lastBuild"
+        static let previousOSVersionUserDefaultsKey = "com.maxgoedjen.Secretive.lastOS"
     }
 
 }

Sources/Secretive/Controllers/LaunchAgentController.swift

@@ -8,16 +8,28 @@ struct LaunchAgentController {
     
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "LaunchAgentController")
 
-    func install() async {
+    func install() async -> Bool {
         logger.debug("Installing agent")
         _ = setEnabled(false)
         // This is definitely a bit of a "seems to work better" thing but:
         // Seems to more reliably hit if these are on separate runloops, otherwise it seems like it sometimes doesn't kill old
         // and start new?
         try? await Task.sleep(for: .seconds(1))
-        await MainActor.run {
+        let result = await MainActor.run {
-            _  = setEnabled(true)
+            setEnabled(true)
         }
+        try? await Task.sleep(for: .seconds(1))
+        return result
+    }
+
+    func uninstall() async -> Bool {
+        logger.debug("Uninstalling agent")
+        try? await Task.sleep(for: .seconds(1))
+        let result = await MainActor.run {
+            setEnabled(false)
+        }
+        try? await Task.sleep(for: .seconds(1))
+        return result
     }
 
     func forceLaunch() async -> Bool {
@@ -28,6 +40,7 @@ struct LaunchAgentController {
         do {
             try await NSWorkspace.shared.openApplication(at: url, configuration: config)
             logger.debug("Agent force launched")
+            try? await Task.sleep(for: .seconds(1))
             return true
         } catch {
             logger.error("Error force launching \(error.localizedDescription)")
@@ -36,7 +49,7 @@ struct LaunchAgentController {
     }
 
     private func setEnabled(_ enabled: Bool) -> Bool {
-        let service = SMAppService.loginItem(identifier: Bundle.main.agentBundleID)
+        let service = SMAppService.loginItem(identifier: Bundle.agentBundleID)
         do {
             if enabled {
                 try service.register()

Sources/Secretive/Controllers/ShellConfigurationController.swift

@@ -1,63 +0,0 @@
-import Foundation
-import Cocoa
-import SecretKit
-
-struct ShellConfigurationController {
-    
-    let socketPath = (NSHomeDirectory().replacingOccurrences(of: Bundle.main.hostBundleID, with: Bundle.main.agentBundleID) as NSString).appendingPathComponent("socket.ssh") as String
-    
-    var shellInstructions: [ShellConfigInstruction] {
-        [
-            ShellConfigInstruction(shell: "global",
-                                   shellConfigDirectory: "~/.ssh/",
-                                   shellConfigFilename: "config",
-                                   text: "Host *\n\tIdentityAgent \(socketPath)"),
-            ShellConfigInstruction(shell: "zsh",
-                                   shellConfigDirectory: "~/",
-                                   shellConfigFilename: ".zshrc",
-                                   text: "export SSH_AUTH_SOCK=\(socketPath)"),
-            ShellConfigInstruction(shell: "bash",
-                                   shellConfigDirectory: "~/",
-                                   shellConfigFilename: ".bashrc",
-                                   text: "export SSH_AUTH_SOCK=\(socketPath)"),
-            ShellConfigInstruction(shell: "fish",
-                                   shellConfigDirectory: "~/.config/fish",
-                                   shellConfigFilename: "config.fish",
-                                   text: "set -x SSH_AUTH_SOCK \(socketPath)"),
-        ]
-        
-    }
-    
-    
-    @MainActor func addToShell(shellInstructions: ShellConfigInstruction) -> Bool {
-        let openPanel = NSOpenPanel()
-        // This is sync, so no need to strongly retain
-        let delegate = Delegate(name: shellInstructions.shellConfigFilename)
-        openPanel.delegate = delegate
-        openPanel.message = "Select \(shellInstructions.shellConfigFilename) to let Secretive configure your shell automatically."
-        openPanel.prompt = "Add to \(shellInstructions.shellConfigFilename)"
-        openPanel.canChooseFiles = true
-        openPanel.canChooseDirectories = false
-        openPanel.showsHiddenFiles = true
-        openPanel.directoryURL = URL(fileURLWithPath: shellInstructions.shellConfigDirectory)
-        openPanel.nameFieldStringValue = shellInstructions.shellConfigFilename
-        openPanel.allowedContentTypes = [.symbolicLink, .data, .plainText]
-        openPanel.runModal()
-        guard let fileURL = openPanel.urls.first else { return false }
-        let handle: FileHandle
-        do {
-            handle = try FileHandle(forUpdating: fileURL)
-            guard let existing = try handle.readToEnd(),
-                  let existingString = String(data: existing, encoding: .utf8) else { return false }
-            guard !existingString.contains(shellInstructions.text) else {
-                return true
-            }
-            try handle.seekToEnd()
-        } catch {
-            return false
-        }
-        handle.write("\n# Secretive Config\n\(shellInstructions.text)\n".data(using: .utf8)!)
-        return true
-    }
-    
-}

Sources/Secretive/Controllers/URLs.swift

@@ -0,0 +1,25 @@
+import Foundation
+
+extension URL {
+
+    static var agentHomeURL: URL {
+        URL(fileURLWithPath: URL.homeDirectory.path().replacingOccurrences(of: Bundle.hostBundleID, with: Bundle.agentBundleID))
+    }
+
+    static var socketPath: String {
+        URL.agentHomeURL.appendingPathComponent("socket.ssh").path()
+    }
+
+}
+
+extension String {
+
+    var normalizedPathAndFolder: (String, String) {
+        // All foundation-based normalization methods replace this with the container directly.
+        let processedPath = replacingOccurrences(of: "~", with: "/Users/\(NSUserName())")
+        let url = URL(filePath: processedPath)
+        let folder = url.deletingLastPathComponent().path()
+        return (processedPath, folder)
+    }
+
+}

Sources/Secretive/Helpers/BundleIDs.swift

@@ -1,7 +1,11 @@
 import Foundation
 
-
 extension Bundle {
-    public var agentBundleID: String {(self.bundleIdentifier?.replacingOccurrences(of: "Host", with: "SecretAgent"))!}
+    public static var agentBundleID: String {
-    public var hostBundleID: String {(self.bundleIdentifier?.replacingOccurrences(of: "SecretAgent", with: "Host"))!}
+        Bundle.main.bundleIdentifier!.replacingOccurrences(of: "Host", with: "SecretAgent")
+    }
+
+    public static var hostBundleID: String {
+        Bundle.main.bundleIdentifier!.replacingOccurrences(of: "SecretAgent", with: "Host")
+    }
 }

Sources/Secretive/InternetAccessPolicy.plist

@@ -9,22 +9,7 @@
 	<key>Website</key>
 	<string>https://github.com/maxgoedjen/secretive</string>
 	<key>Connections</key>
-	<array>
+	<array/>
-		<dict>
-			<key>IsIncoming</key>
-			<false/>
-			<key>Host</key>
-			<string>api.github.com</string>
-			<key>NetworkProtocol</key>
-			<string>TCP</string>
-			<key>Port</key>
-			<string>443</string>
-			<key>Purpose</key>
-			<string>Secretive checks GitHub for new versions and security updates.</string>
-			<key>DenyConsequences</key>
-			<string>If you deny these connections, you will not be notified about new versions and critical security updates.</string>
-		</dict>
-	</array>
 	<key>Services</key>
 	<array/>
 </dict>

Sources/Secretive/Preview Content/PreviewAgentStatusChecker.swift

@@ -1,13 +1,15 @@
 import Foundation
-import Combine
+import AppKit
 
 class PreviewAgentStatusChecker: AgentStatusCheckerProtocol {
 
     let running: Bool
+    let process: NSRunningApplication?
     let developmentBuild = false
 
-    init(running: Bool = true) {
+    init(running: Bool = true, process: NSRunningApplication? = nil) {
         self.running = running
+        self.process = process
     }
 
     func check() {

Sources/Secretive/Preview Content/PreviewStore.swift

@@ -9,11 +9,13 @@ extension Preview {
 
         let id = UUID().uuidString
         let name: String
-        let algorithm = Algorithm.ellipticCurve
+        let publicKey = Data(UUID().uuidString.utf8)
-        let keySize = 256
+        var attributes: Attributes {
-        let requiresAuthentication: Bool = false
+            Attributes(
-        let publicKey = UUID().uuidString.data(using: .utf8)!
+                keyType: .init(algorithm: .ecdsa, size: 256),
-
+                authentication: .presenceRequired,
+            )
+        }
     }
 
 }
@@ -58,6 +60,17 @@ extension Preview {
         let id = UUID()
         var name: String { "Modifiable Preview Store" }
         let secrets: [Secret]
+        var supportedKeyTypes: [KeyType] {
+            if #available(macOS 26, *) {
+                [
+                    .ecdsa256,
+                    .mldsa65,
+                    .mldsa87,
+                ]
+            } else {
+                [.ecdsa256]
+            }
+        }
         
         init(secrets: [Secret]) {
             self.secrets = secrets
@@ -83,13 +96,14 @@ extension Preview {
         }
 
 
-        func create(name: String, requiresAuthentication: Bool) throws {
+        func create(name: String, attributes: Attributes) throws -> Secret {
+            fatalError()
         }
 
         func delete(secret: Preview.Secret) throws {
         }
 
-        func update(secret: Preview.Secret, name: String) throws {
+        func update(secret: Preview.Secret, name: String, attributes: Attributes) throws {
         }
     }
 }

Sources/Secretive/Preview Content/PreviewUpdater.swift

@@ -6,7 +6,7 @@ import Brief
 
     var update: Release? = nil
 
-    let testBuild = false
+    let currentVersion = SemVer("0.0.0_preview")
 
     init(update: Update = .none) {
         switch update {

Sources/Secretive/Views/Configuration/ConfigurationItemView.swift

@@ -0,0 +1,56 @@
+import SwiftUI
+
+struct ConfigurationItemView<Content: View>: View {
+
+    enum Action: Hashable {
+        case copy(String)
+        case revealInFinder(String)
+    }
+
+    let title: LocalizedStringResource
+    let content: Content
+    let action: Action?
+
+    init(title: LocalizedStringResource, value: String, action: Action? = nil) where Content == Text {
+        self.title = title
+        self.content = Text(value)
+            .font(.subheadline)
+            .foregroundStyle(.secondary)
+        self.action = action
+    }
+
+    init(title: LocalizedStringResource, action: Action? = nil, content: () -> Content) {
+        self.title = title
+        self.content = content()
+        self.action = action
+    }
+
+    var body: some View {
+        VStack(alignment: .leading) {
+            HStack {
+                Text(title)
+                Spacer()
+                switch action {
+                case .copy(let string):
+                    Button(.copyableClickToCopyButton, systemImage: "document.on.document") {
+                        NSPasteboard.general.declareTypes([.string], owner: nil)
+                        NSPasteboard.general.setString(string, forType: .string)
+                    }
+                    .labelStyle(.iconOnly)
+                    .buttonStyle(.borderless)
+                case .revealInFinder(let rawPath):
+                    Button(.revealInFinderButton, systemImage: "folder") {
+                        let (processedPath, folder) = rawPath.normalizedPathAndFolder
+                        NSWorkspace.shared.selectFile(processedPath, inFileViewerRootedAtPath: folder)
+                    }
+                    .labelStyle(.iconOnly)
+                    .buttonStyle(.borderless)
+                case nil:
+                    EmptyView()
+                }
+            }
+            content
+        }
+    }
+}
+

Sources/Secretive/Views/Configuration/GettingStartedView.swift

@@ -0,0 +1,49 @@
+import SwiftUI
+
+struct GettingStartedView: View {
+
+    private let instructions = Instructions()
+
+    @Binding var selectedInstruction: ConfigurationFileInstructions?
+
+    init(selectedInstruction: Binding<ConfigurationFileInstructions?>) {
+        _selectedInstruction = selectedInstruction
+    }
+
+    var body: some View {
+        Form {
+            Section(.integrationsGettingStartedTitle) {
+                Text(.integrationsGettingStartedTitleDescription)
+            }
+            Section {
+                Group {
+                    Text(.integrationsGettingStartedSuggestionSsh)
+                        .onTapGesture {
+                            self.selectedInstruction = instructions.ssh
+                        }
+                    VStack(alignment: .leading, spacing: 5) {
+                        Text(.integrationsGettingStartedSuggestionShell)
+                        Text(.integrationsGettingStartedSuggestionShellDefault(shellName: String(localized: instructions.defaultShell.tool)))
+                            .font(.caption2)
+                    }
+                    .onTapGesture {
+                        self.selectedInstruction = instructions.defaultShell
+                    }
+                    Text(.integrationsGettingStartedSuggestionGit)
+                        .onTapGesture {
+                            self.selectedInstruction = instructions.git
+                        }
+                }
+                .foregroundStyle(.link)
+
+            } header: {
+                Text(.integrationsGettingStartedWhatShouldIConfigureTitle)
+            }
+            footer: {
+                Text(.integrationsGettingStartedMultipleConfig)
+            }
+        }
+        .formStyle(.grouped)
+    }
+
+}

Sources/Secretive/Views/Configuration/Instructions.swift

@@ -0,0 +1,179 @@
+import Foundation
+
+struct Instructions {
+
+    enum Constants {
+        static let publicKeyPathPlaceholder = "_PUBLIC_KEY_PATH_PLACEHOLDER_"
+        static let publicKeyPlaceholder = "_PUBLIC_KEY_PLACEHOLDER_"
+    }
+
+    var defaultShell: ConfigurationFileInstructions {
+        zsh
+    }
+
+    var gettingStarted: ConfigurationFileInstructions = ConfigurationFileInstructions(.integrationsGettingStartedRowTitle, id: .gettingStarted)
+
+    var ssh: ConfigurationFileInstructions {
+        ConfigurationFileInstructions(
+            tool: LocalizedStringResource.integrationsToolNameSsh,
+            configPath: "~/.ssh/config",
+            configText: "Host *\n\tIdentityAgent \(URL.socketPath)",
+            website: URL(string: "https://man.openbsd.org/ssh_config.5")!,
+            note: .integrationsSshSpecificKeyNote,
+        )
+    }
+
+    var git: ConfigurationFileInstructions {
+        ConfigurationFileInstructions(
+            tool: .integrationsToolNameGitSigning,
+            steps: [
+                .init(path: "~/.gitconfig", steps: [
+                    .integrationsGitStepGitconfigDescription(publicKeyPathPlaceholder: Constants.publicKeyPathPlaceholder)
+                ],
+                      note: .integrationsGitStepGitconfigSectionNote
+                ),
+                .init(
+                    path: "~/.gitallowedsigners",
+                    steps: [
+                        LocalizedStringResource(stringLiteral: Constants.publicKeyPlaceholder)
+                    ],
+                    note: .integrationsGitStepGitallowedsignersDescription
+                ),
+            ],
+            website:  URL(string: "https://git-scm.com/docs/git-config")!,
+        )
+    }
+
+    var zsh: ConfigurationFileInstructions {
+        ConfigurationFileInstructions(
+            tool: .integrationsToolNameZsh,
+            configPath: "~/.zshrc",
+            configText: "export SSH_AUTH_SOCK=\(URL.socketPath)"
+        )
+    }
+
+    var instructions: [ConfigurationGroup] {
+        [
+            ConfigurationGroup(name: .integrationsGettingStartedSectionTitle, instructions: [
+                gettingStarted
+            ]),
+            ConfigurationGroup(
+                name: .integrationsSystemSectionTitle,
+                instructions: [
+                    ssh,
+                    git,
+                ]
+            ),
+            ConfigurationGroup(name: .integrationsShellSectionTitle, instructions: [
+                zsh,
+                ConfigurationFileInstructions(
+                    tool: .integrationsToolNameBash,
+                    configPath: "~/.bashrc",
+                    configText: "export SSH_AUTH_SOCK=\(URL.socketPath)"
+                ),
+                ConfigurationFileInstructions(
+                    tool: .integrationsToolNameFish,
+                    configPath: "~/.config/fish/config.fish",
+                    configText: "set -x SSH_AUTH_SOCK \(URL.socketPath)"
+                ),
+                ConfigurationFileInstructions(.integrationsOtherShellRowTitle, id: .otherShell),
+            ]),
+            ConfigurationGroup(name: .integrationsOtherSectionTitle, instructions: [
+                ConfigurationFileInstructions(.integrationsAppsRowTitle, id: .otherApp),
+            ]),
+        ]
+    }
+
+}
+
+struct ConfigurationGroup: Identifiable {
+    let id = UUID()
+    var name: LocalizedStringResource
+    var instructions: [ConfigurationFileInstructions] = []
+}
+
+struct ConfigurationFileInstructions: Hashable, Identifiable {
+
+    struct StepGroup: Hashable, Identifiable {
+        let path: String
+        let steps: [LocalizedStringResource]
+        let note: LocalizedStringResource?
+        var id: String { path }
+
+        init(path: String, steps: [LocalizedStringResource], note: LocalizedStringResource? = nil) {
+            self.path = path
+            self.steps = steps
+            self.note = note
+        }
+
+        func hash(into hasher: inout Hasher) {
+            id.hash(into: &hasher)
+        }
+    }
+
+    var id: ID
+    var tool: LocalizedStringResource
+    var steps: [StepGroup]
+    var requiresSecret: Bool
+    var website: URL?
+
+    init(
+        tool: LocalizedStringResource,
+        configPath: String,
+        configText: LocalizedStringResource,
+        requiresSecret: Bool = false,
+        website: URL? = nil,
+        note: LocalizedStringResource? = nil
+    ) {
+        self.id = .tool(String(localized: tool))
+        self.tool = tool
+        self.steps = [StepGroup(path: configPath, steps: [configText], note: note)]
+        self.requiresSecret = requiresSecret
+        self.website = website
+    }
+
+    init(
+        tool: LocalizedStringResource,
+        steps: [StepGroup],
+        requiresSecret: Bool = false,
+        website: URL? = nil
+    ) {
+        self.id = .tool(String(localized: tool))
+        self.tool = tool
+        self.steps = steps
+        self.requiresSecret = true
+        self.website = website
+    }
+
+    init(_ name: LocalizedStringResource, id: ID) {
+        self.id = id
+        tool = name
+        steps = []
+        requiresSecret = false
+    }
+
+    func hash(into hasher: inout Hasher) {
+        id.hash(into: &hasher)
+    }
+
+    enum ID: Identifiable, Hashable {
+        case gettingStarted
+        case tool(String)
+        case otherShell
+        case otherApp
+
+        var id: String {
+            switch self {
+            case .gettingStarted:
+                "getting_started"
+            case .tool(let name):
+                name
+            case .otherShell:
+                "other_shell"
+            case .otherApp:
+                "other_app"
+            }
+        }
+    }
+
+}

Sources/Secretive/Views/Configuration/IntegrationsView.swift

@@ -0,0 +1,115 @@
+import SwiftUI
+
+struct IntegrationsView: View {
+
+    @Environment(\.dismiss) private var dismiss
+
+    @State private var selectedInstruction: ConfigurationFileInstructions?
+    private let instructions = Instructions()
+
+    var body: some View {
+        NavigationSplitView {
+            List(selection: $selectedInstruction) {
+                ForEach(instructions.instructions) { group in
+                    Section(group.name) {
+                        ForEach(group.instructions) { instruction in
+                            Text(instruction.tool)
+                                .padding(.vertical, 8)
+                                .tag(instruction)
+                        }
+                    }
+                }
+            }
+        } detail: {
+                IntegrationsDetailView(selectedInstruction: $selectedInstruction)
+                .fauxToolbar {
+                    Button(.setupDoneButton) {
+                        dismiss()
+                    }
+                    .normalButton()
+                }
+        }
+        .onAppear {
+            selectedInstruction = instructions.gettingStarted
+        }
+        .frame(minHeight: 500)
+    }
+
+}
+
+extension View {
+
+    func fauxToolbar<Content: View>(content: () -> Content) -> some View {
+        modifier(FauxToolbarModifier(toolbarContent: content()))
+    }
+
+}
+
+struct FauxToolbarModifier<ToolbarContent: View>: ViewModifier {
+
+    var toolbarContent: ToolbarContent
+
+    func body(content: Content) -> some View {
+        VStack(alignment: .leading, spacing: 0) {
+            content
+            Divider()
+            HStack {
+                Spacer()
+                toolbarContent
+                .padding(.top, 8)
+                .padding(.trailing, 16)
+                .padding(.bottom, 16)
+            }
+        }
+
+    }
+
+}
+
+struct IntegrationsDetailView: View {
+
+    @Binding private var selectedInstruction: ConfigurationFileInstructions?
+
+    init(selectedInstruction: Binding<ConfigurationFileInstructions?>) {
+        _selectedInstruction = selectedInstruction
+    }
+
+    var body: some View {
+        if let selectedInstruction {
+            switch selectedInstruction.id {
+            case .gettingStarted:
+                GettingStartedView(selectedInstruction: $selectedInstruction)
+                case .tool:
+                    ToolConfigurationView(selectedInstruction: selectedInstruction)
+                case .otherShell:
+                    Form {
+                        Section {
+                            Link(.integrationsViewOtherGithubLink, destination: URL(string: "https://github.com/maxgoedjen/secretive-config-instructions/tree/main/shells")!)
+                        } header: {
+                            Text(.integrationsCommunityShellListDescription)
+                                .font(.body)
+                        }
+                    }
+                    .formStyle(.grouped)
+
+                case .otherApp:
+                    Form {
+                        Section {
+                            Link(.integrationsViewOtherGithubLink, destination: URL(string: "https://github.com/maxgoedjen/secretive-config-instructions/tree/main/apps")!)
+                        } header: {
+                            Text(.integrationsCommunityAppsListDescription)
+                                .font(.body)
+                        }
+                    }
+                    .formStyle(.grouped)
+                }
+        }
+
+    }
+
+}
+
+#Preview {
+    IntegrationsView()
+        .frame(height: 500)
+}

Sources/Secretive/Views/Configuration/SetupView.swift

@@ -0,0 +1,201 @@
+import SwiftUI
+
+struct SetupView: View {
+
+    @Environment(\.dismiss) private var dismiss
+    @Binding var setupComplete: Bool
+
+    @State var showingIntegrations = false
+    @State var buttonWidth: CGFloat?
+
+    @State var installed = false
+    @State var updates = false
+    @State var integrations = false
+    var allDone: Bool {
+        installed && updates && integrations
+    }
+
+    var body: some View {
+        VStack {
+            VStack(alignment: .leading, spacing: 0) {
+                StepView(
+                    title: .setupAgentTitle,
+                    description: .setupAgentDescription,
+                    detail: .setupAgentActivityMonitorDescription,
+                    systemImage: "lock.laptopcomputer",
+                ) {
+                    SetupButton(
+                        .setupAgentInstallButton,
+                        complete: installed,
+                        width: buttonWidth
+                    ) {
+                        installed = true
+                        Task {
+                            await LaunchAgentController().install()
+                        }
+                    }
+                }
+                Divider()
+                StepView(
+                    title: .setupUpdatesTitle,
+                    description: .setupUpdatesDescription,
+                    systemImage: "network.badge.shield.half.filled",
+                ) {
+                    SetupButton(
+                        .setupUpdatesOkButton,
+                        complete: updates,
+                        width: buttonWidth
+                    ) {
+                        updates = true
+                    }
+                }
+                Divider()
+                StepView(
+                    title: .setupIntegrationsTitle,
+                    description: .setupIntegrationsDescription,
+                    systemImage: "firewall",
+                ) {
+                    SetupButton(
+                        .setupIntegrationsButton,
+                        complete: integrations,
+                        width: buttonWidth
+                    ) {
+                        showingIntegrations = true
+                    }
+                }
+            }
+            .onPreferenceChange(SetupButton.WidthKey.self) { width in
+                buttonWidth = width
+            }
+            .background(.white.opacity(0.1), in: RoundedRectangle(cornerRadius: 10))
+            .frame(minWidth: 600, maxWidth: .infinity)
+            HStack {
+                Spacer()
+                Button(.setupDoneButton) {
+                    setupComplete = true
+                    dismiss()
+                }
+                .disabled(!allDone)
+                .primaryButton()
+            }
+        }
+        .interactiveDismissDisabled()
+        .padding()
+        .sheet(isPresented: $showingIntegrations, onDismiss: {
+            integrations = true
+        }, content: {
+            IntegrationsView()
+        })
+    }
+}
+
+struct SetupButton: View {
+
+    struct WidthKey: @MainActor PreferenceKey {
+        @MainActor static var defaultValue: CGFloat? = nil
+        static func reduce(value: inout CGFloat?, nextValue: () -> CGFloat?) {
+            if let next = nextValue(), next > (value ?? -1) {
+                value = next
+            }
+        }
+
+    }
+
+    let label: LocalizedStringResource
+    let complete: Bool
+    let action: () -> Void
+    let width: CGFloat?
+    @State var currentWidth: CGFloat?
+
+    init(_ label: LocalizedStringResource, complete: Bool, width: CGFloat? = nil, action: @escaping () -> Void) {
+        self.label = label
+        self.complete = complete
+        self.action = action
+        self.width = width
+    }
+    
+    var body: some View {
+        Button(action: action) {
+            HStack(spacing: 6) {
+                if complete {
+                    Text(.setupStepCompleteButton)
+                    Image(systemName: "checkmark.circle.fill")
+                } else {
+                    Text(label)
+                }
+            }
+            .frame(width: width)
+            .padding(.vertical, 2)
+            .onGeometryChange(for: CGFloat.self) { proxy in
+                proxy.size.width
+            } action: { newValue in
+                currentWidth = newValue
+            }
+        }
+        .preference(key: WidthKey.self, value: currentWidth)
+        .primaryButton()
+        .disabled(complete)
+        .tint(complete ? .green : nil)
+    }
+        
+}
+
+struct StepView<Content: View>: View {
+    
+    let title: LocalizedStringResource
+    let icon: Image
+    let description: LocalizedStringResource
+    let detail: LocalizedStringResource?
+    let actions: Content
+    
+    init(
+        title: LocalizedStringResource,
+        description: LocalizedStringResource,
+        detail: LocalizedStringResource? = nil,
+        systemImage: String,
+        actions: () -> Content
+    ) {
+        self.title = title
+        self.icon = Image(systemName: systemImage)
+        self.description = description
+        self.detail = detail
+        self.actions = actions()
+    }
+    
+    var body: some View {
+        HStack(spacing: 0) {
+            icon
+                .resizable()
+                .aspectRatio(contentMode: .fit)
+                .frame(width: 24)
+            Spacer()
+                .frame(width: 20)
+            VStack(alignment: .leading, spacing: 4) {
+                Text(title)
+                    .bold()
+                Text(description)
+                if let detail {
+                    Text(detail)
+                        .font(.callout)
+                        .italic()
+                }
+            }
+            Spacer(minLength: 20)
+            actions
+        }
+        .padding(20)
+    }
+    
+}
+
+extension SetupView {
+
+    enum Constants {
+        static let updaterFAQURL = URL(string: "https://github.com/maxgoedjen/secretive/blob/main/FAQ.md#whats-this-network-request-to-github")!
+    }
+
+}
+
+#Preview {
+    SetupView(setupComplete: .constant(false))
+}

Sources/Secretive/Views/Configuration/ToolConfigurationView.swift

@@ -0,0 +1,110 @@
+import SwiftUI
+import SecretKit
+
+struct ToolConfigurationView: View {
+
+    private let instructions = Instructions()
+    let selectedInstruction: ConfigurationFileInstructions
+    
+    @Environment(\.secretStoreList) private var secretStoreList
+
+    @State var creating = false
+    @State var selectedSecret: AnySecret?
+
+    init(selectedInstruction: ConfigurationFileInstructions) {
+        self.selectedInstruction = selectedInstruction
+    }
+
+    var body: some View {
+        Form {
+            if selectedInstruction.requiresSecret {
+                if secretStoreList.allSecrets.isEmpty {
+                    Section {
+                        Text(.integrationsConfigureUsingSecretEmptyCreate)
+                        if let store = secretStoreList.modifiableStore {
+                            HStack {
+                                Spacer()
+                                Button(.createSecretTitle) {
+                                    creating = true
+                                }
+                                .sheet(isPresented: $creating) {
+                                    CreateSecretView(store: store) { created in
+                                        selectedSecret = created
+                                    }
+                                }
+                            }
+                        }
+                    }
+                } else {
+                    Section {
+                        Picker(.integrationsConfigureUsingSecretSecretTitle, selection: $selectedSecret) {
+                            if selectedSecret == nil {
+                                Text(.integrationsConfigureUsingSecretNoSecret)
+                                    .tag(nil as (AnySecret?))
+                            }
+                            ForEach(secretStoreList.allSecrets) { secret in
+                                Text(secret.name)
+                                    .tag(secret)
+                            }
+                        }
+                    } header: {
+                        Text(.integrationsConfigureUsingSecretHeader)
+                    }
+                    .onAppear {
+                        selectedSecret = secretStoreList.allSecrets.first
+                    }
+                }
+            }
+            ForEach(selectedInstruction.steps) { stepGroup in
+                Section {
+                    ConfigurationItemView(title: .integrationsPathTitle, value: stepGroup.path, action: .revealInFinder(stepGroup.path))
+                    ForEach(stepGroup.steps, id: \.self.key) { step in
+                        ConfigurationItemView(title: .integrationsAddThisTitle, action: .copy(String(localized: step))) {
+                            HStack {
+                                Text(placeholdersReplaced(text: String(localized: step)))
+                                    .padding(8)
+                                    .font(.system(.subheadline, design: .monospaced))
+                                Spacer()
+                            }
+                            .frame(maxWidth: .infinity)
+                            .background {
+                                RoundedRectangle(cornerRadius: 6)
+                                    .fill(.black.opacity(0.05))
+                                    .stroke(.separator, lineWidth: 1)
+                            }
+                        }
+                    }
+                } footer: {
+                    if let note = stepGroup.note {
+                        Text(note)
+                            .font(.caption)
+                    }
+                }
+            }
+            if let url = selectedInstruction.website {
+                Section {
+                    Link(destination: url) {
+                        VStack(alignment: .leading, spacing: 5) {
+                            Text(.integrationsWebLink)
+                                .font(.headline)
+                            Text(url.absoluteString)
+                                .font(.caption2)
+                        }
+                    }
+                }
+            }
+        }
+        .formStyle(.grouped)
+
+    }
+
+    func placeholdersReplaced(text: String) -> String {
+        guard let selectedSecret else { return text }
+        let writer = OpenSSHPublicKeyWriter()
+        let fileController = PublicKeyFileStoreController(homeDirectory: URL.agentHomeURL)
+        return text
+            .replacingOccurrences(of: Instructions.Constants.publicKeyPlaceholder, with: writer.openSSHString(secret: selectedSecret))
+            .replacingOccurrences(of: Instructions.Constants.publicKeyPathPlaceholder, with: fileController.publicKeyPath(for: selectedSecret))
+    }
+
+}

Sources/Secretive/Views/CreateSecretView.swift

@@ -1,250 +0,0 @@
-import SwiftUI
-import SecretKit
-
-struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
-
-    @State var store: StoreType
-    @Binding var showing: Bool
-
-    @State private var name = ""
-    @State private var requiresAuthentication = true
-
-    var body: some View {
-        VStack {
-            HStack {
-                VStack {
-                    HStack {
-                        Text(.createSecretTitle)
-                            .font(.largeTitle)
-                        Spacer()
-                    }
-                    HStack {
-                        Text(.createSecretNameLabel)
-                        TextField(String(localized: .createSecretNamePlaceholder), text: $name)
-                            .focusable()
-                    }
-                    ThumbnailPickerView(items: [
-                        ThumbnailPickerView.Item(value: true, name: .createSecretRequireAuthenticationTitle, description: .createSecretRequireAuthenticationDescription, thumbnail: AuthenticationView()),
-                        ThumbnailPickerView.Item(value: false, name: .createSecretNotifyTitle,
-                                                 description: .createSecretNotifyDescription,
-                                                 thumbnail: NotificationView())
-                    ], selection: $requiresAuthentication)
-                }
-            }
-            HStack {
-                Spacer()
-                Button(.createSecretCancelButton) {
-                    showing = false
-                }
-                .keyboardShortcut(.cancelAction)
-                Button(.createSecretCreateButton, action: save)
-                    .disabled(name.isEmpty)
-                    .keyboardShortcut(.defaultAction)
-            }
-        }.padding()
-    }
-
-    func save() {
-        Task {
-            try! await store.create(name: name, requiresAuthentication: requiresAuthentication)
-            showing = false
-        }
-    }
-
-}
-
-struct ThumbnailPickerView<ValueType: Hashable>: View {
-
-    private let items: [Item<ValueType>]
-    @Binding var selection: ValueType
-
-    init(items: [ThumbnailPickerView<ValueType>.Item<ValueType>], selection: Binding<ValueType>) {
-        self.items = items
-        _selection = selection
-    }
-
-    var body: some View {
-        HStack(alignment: .top) {
-            ForEach(items) { item in
-                VStack(alignment: .leading, spacing: 15) {
-                    item.thumbnail
-                        .frame(height: 200)
-                        .overlay(RoundedRectangle(cornerRadius: 10)
-                            .stroke(lineWidth: item.value == selection ? 15 : 0))
-                        .clipShape(RoundedRectangle(cornerRadius: 10, style: .continuous))
-                        .foregroundColor(.accentColor)
-                    VStack(alignment: .leading, spacing: 5) {
-                        Text(item.name)
-                            .bold()
-                        Text(item.description)
-                            .fixedSize(horizontal: false, vertical: true)
-                    }
-                }
-                .frame(width: 250)
-                .onTapGesture {
-                    withAnimation(.spring()) {
-                        selection = item.value
-                    }
-                }
-            }
-            .padding(5)
-        }
-    }
-
-}
-
-extension ThumbnailPickerView {
-
-    struct Item<InnerValueType: Hashable>: Identifiable {
-        let id = UUID()
-        let value: InnerValueType
-        let name: LocalizedStringResource
-        let description: LocalizedStringResource
-        let thumbnail: AnyView
-
-        init<ViewType: View>(value: InnerValueType, name: LocalizedStringResource, description: LocalizedStringResource, thumbnail: ViewType) {
-            self.value = value
-            self.name = name
-            self.description = description
-            self.thumbnail = AnyView(thumbnail)
-        }
-    }
-
-}
-
-@MainActor @Observable class SystemBackground {
-
-    static let shared = SystemBackground()
-    var image: NSImage?
-
-    private init() {
-        if let mainScreen = NSScreen.main, let imageURL = NSWorkspace.shared.desktopImageURL(for: mainScreen) {
-            image = NSImage(contentsOf: imageURL)
-        } else {
-            image = nil
-        }
-    }
-
-}
-
-struct SystemBackgroundView: View {
-
-    let anchor: UnitPoint
-
-    var body: some View {
-        if let image = SystemBackground.shared.image {
-            Image(nsImage: image)
-                .resizable()
-                .scaleEffect(3, anchor: anchor)
-                .clipped()
-                .allowsHitTesting(false)
-        } else {
-            Rectangle()
-                .foregroundColor(Color(.systemPurple))
-        }
-    }
-}
-
-struct AuthenticationView: View {
-
-    var body: some View {
-        ZStack {
-            SystemBackgroundView(anchor: .center)
-            GeometryReader { geometry in
-                VStack {
-                    Image(systemName: "touchid")
-                        .resizable()
-                        .aspectRatio(contentMode: .fit)
-                        .foregroundColor(Color(.systemRed))
-                    Text(verbatim: "Touch ID Prompt")
-                        .font(.headline)
-                        .foregroundColor(.primary)
-                        .redacted(reason: .placeholder)
-                    VStack {
-                        Text(verbatim: "Touch ID Detail prompt.Detail two.")
-                            .font(.caption2)
-                            .foregroundColor(.primary)
-                        Text(verbatim: "Touch ID Detail prompt.Detail two.")
-                            .font(.caption2)
-                            .foregroundColor(.primary)
-                    }
-                    .redacted(reason: .placeholder)
-                    RoundedRectangle(cornerRadius: 5)
-                        .frame(width: geometry.size.width, height: 20, alignment: .center)
-                        .foregroundColor(.accentColor)
-                    RoundedRectangle(cornerRadius: 5)
-                        .frame(width: geometry.size.width, height: 20, alignment: .center)
-                        .foregroundColor(Color(.unemphasizedSelectedContentBackgroundColor))
-                }
-            }
-            .padding()
-            .frame(width: 150)
-            .background(
-                RoundedRectangle(cornerRadius: 15)
-                    .foregroundStyle(.ultraThickMaterial)
-            )
-            .padding()
-
-        }
-    }
-
-}
-
-struct NotificationView: View {
-
-    var body: some View {
-        ZStack {
-            SystemBackgroundView(anchor: .topTrailing)
-            VStack {
-                Rectangle()
-                    .background(Color.clear)
-                    .foregroundStyle(.thinMaterial)
-                    .frame(height: 35)
-                VStack {
-                    HStack {
-                        Spacer()
-                        HStack {
-                            Image(nsImage: NSApplication.shared.applicationIconImage)
-                                .resizable()
-                                .frame(width: 64, height: 64)
-                                .foregroundColor(.primary)
-                            VStack(alignment: .leading) {
-                                Text(verbatim: "Secretive")
-                                    .font(.title)
-                                    .foregroundColor(.primary)
-                                Text(verbatim: "Secretive wants to sign")
-                                    .font(.body)
-                                    .foregroundColor(.primary)
-                            }
-                        }.padding()
-                            .redacted(reason: .placeholder)
-                            .background(
-                                RoundedRectangle(cornerRadius: 15)
-                                    .foregroundStyle(.ultraThickMaterial)
-                            )
-                    }
-                    Spacer()
-                }
-                .padding()
-            }
-        }
-    }
-
-}
-
-#if DEBUG
-
-struct CreateSecretView_Previews: PreviewProvider {
-
-    static var previews: some View {
-        Group {
-            CreateSecretView(store: Preview.StoreModifiable(), showing: .constant(true))
-                AuthenticationView().environment(\.colorScheme, .dark)
-                AuthenticationView().environment(\.colorScheme, .light)
-                NotificationView().environment(\.colorScheme, .dark)
-                NotificationView().environment(\.colorScheme, .light)
-        }
-    }
-}
-
-#endif

Sources/Secretive/Views/DeleteSecretView.swift

@@ -1,58 +0,0 @@
-import SwiftUI
-import SecretKit
-
-struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
-
-    @State var store: StoreType
-    let secret: StoreType.SecretType
-    var dismissalBlock: (Bool) -> ()
-
-    @State private var confirm = ""
-
-    var body: some View {
-        VStack {
-            HStack {
-                Image(nsImage: NSApplication.shared.applicationIconImage)
-                    .resizable()
-                    .frame(width: 64, height: 64)
-                    .padding()
-                VStack {
-                    HStack {
-                        Text(.deleteConfirmationTitle(secretName: secret.name)).bold()
-                        Spacer()
-                    }
-                    HStack {
-                        Text(.deleteConfirmationDescription(secretName: secret.name, confirmSecretName: secret.name))
-                        Spacer()
-                    }
-                    HStack {
-                        Text(.deleteConfirmationConfirmNameLabel)
-                        TextField(secret.name, text: $confirm)
-                    }
-                }
-            }
-            HStack {
-                Spacer()
-                Button(.deleteConfirmationDeleteButton, action: delete)
-                    .disabled(confirm != secret.name)
-                Button(.deleteConfirmationCancelButton) {
-                    dismissalBlock(false)
-                }
-                .keyboardShortcut(.cancelAction)
-            }
-        }
-        .padding()
-        .frame(minWidth: 400)
-        .onExitCommand {
-            dismissalBlock(false)
-        }
-    }
-    
-    func delete() {
-        Task {
-            try! await store.delete(secret: secret)
-            dismissalBlock(true)
-        }
-    }
-
-}

Sources/Secretive/Views/RenameSecretView.swift

@@ -1,52 +0,0 @@
-import SwiftUI
-import SecretKit
-
-struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
-
-    @State var store: StoreType
-    let secret: StoreType.SecretType
-    var dismissalBlock: (_ renamed: Bool) -> ()
-
-    @State private var newName = ""
-
-    var body: some View {
-        VStack {
-            HStack {
-                Image(nsImage: NSApplication.shared.applicationIconImage)
-                    .resizable()
-                    .frame(width: 64, height: 64)
-                    .padding()
-                VStack {
-                    HStack {
-                        Text(.renameTitle(secretName: secret.name))
-                        Spacer()
-                    }
-                    HStack {
-                        TextField(secret.name, text: $newName).focusable()
-                    }
-                }
-            }
-            HStack {
-                Spacer()
-                Button(.renameRenameButton, action: rename)
-                    .disabled(newName.count == 0)
-                    .keyboardShortcut(.return)
-                Button(.renameCancelButton) {
-                    dismissalBlock(false)
-                }.keyboardShortcut(.cancelAction)
-            }
-        }
-        .padding()
-        .frame(minWidth: 400)
-        .onExitCommand {
-            dismissalBlock(false)
-        }
-    }
-
-    func rename() {
-        Task {
-            try? await store.update(secret: secret, name: newName)
-            dismissalBlock(true)
-        }
-    }
-}

Sources/Secretive/Views/SecretListItemView.swift

@@ -1,69 +0,0 @@
-import SwiftUI
-import SecretKit
-
-struct SecretListItemView: View {
-    
-    @State var store: AnySecretStore
-    var secret: AnySecret
-    
-    @State var isDeleting: Bool = false
-    @State var isRenaming: Bool = false
-    
-    var deletedSecret: (AnySecret) -> Void
-    var renamedSecret: (AnySecret) -> Void
-    
-    private var showingPopup: Binding<Bool> {
-        Binding(
-            get: { isDeleting || isRenaming },
-            set: {
-                if $0 == false {
-                    isDeleting = false
-                    isRenaming = false
-                }
-            }
-        )
-    }
-    
-    var body: some View {
-        NavigationLink(value: secret) {
-            if secret.requiresAuthentication {
-                HStack {
-                    Text(secret.name)
-                    Spacer()
-                    Image(systemName: "lock")
-                }
-            } else {
-                Text(secret.name)
-            }
-        }
-        .contextMenu {
-            if store is AnySecretStoreModifiable {
-                Button(action: { isRenaming = true }) {
-                    Text(.secretListRenameButton)
-                }
-                Button(action: { isDeleting = true }) {
-                    Text(.secretListDeleteButton)
-                }
-            }
-        }
-        .popover(isPresented: showingPopup) {
-            if let modifiable = store as? AnySecretStoreModifiable {
-                if isDeleting {
-                    DeleteSecretView(store: modifiable, secret: secret) { deleted in
-                        isDeleting = false
-                        if deleted {
-                            deletedSecret(secret)
-                        }
-                    }
-                } else if isRenaming {
-                    RenameSecretView(store: modifiable, secret: secret) { renamed in
-                        isRenaming = false
-                        if renamed {
-                            renamedSecret(secret)
-                        }
-                    }
-                }
-            }
-        }
-    }
-}

Sources/Secretive/Views/Secrets/CreateSecretView.swift

@@ -0,0 +1,151 @@
+import SwiftUI
+import SecretKit
+
+struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
+
+    @State var store: StoreType
+    @Environment(\.dismiss) private var dismiss
+    var createdSecret: (AnySecret?) -> Void
+
+    @State private var name = ""
+    @State private var keyAttribution = ""
+    @State private var authenticationRequirement: AuthenticationRequirement = .presenceRequired
+    @State private var keyType: KeyType?
+    @State var advanced = false
+    @State var errorText: String?
+
+    private var authenticationOptions: [AuthenticationRequirement] {
+        if advanced || authenticationRequirement == .biometryCurrent {
+            [.presenceRequired, .notRequired, .biometryCurrent]
+        } else {
+            [.presenceRequired, .notRequired]
+        }
+    }
+
+    var body: some View {
+        VStack(alignment: .trailing) {
+            Form {
+                Section {
+                    TextField(String(localized: .createSecretNameLabel), text: $name, prompt: Text(.createSecretNamePlaceholder))
+                    VStack(alignment: .leading, spacing: 10) {
+                        Picker(.createSecretProtectionLevelTitle, selection: $authenticationRequirement) {
+                            ForEach(authenticationOptions) { option in
+                                HStack {
+                                    switch option {
+                                    case .notRequired:
+                                        Image(systemName: "bell")
+                                        Text(.createSecretNotifyTitle)
+                                    case .presenceRequired:
+                                        Image(systemName: "lock")
+                                        Text(.createSecretRequireAuthenticationTitle)
+                                    case .biometryCurrent:
+                                        Image(systemName: "lock.trianglebadge.exclamationmark.fill")
+                                        Text(.createSecretRequireAuthenticationBiometricCurrentTitle)
+                                    case .unknown:
+                                        EmptyView()
+                                    }
+                                }
+                                .tag(option)
+                            }
+                        }
+                        Group {
+                            switch  authenticationRequirement {
+                            case .notRequired:
+                                Text(.createSecretNotifyDescription)
+                            case .presenceRequired:
+                                Text(.createSecretRequireAuthenticationDescription)
+                            case .biometryCurrent:
+                                Text(.createSecretRequireAuthenticationBiometricCurrentDescription)
+                            case .unknown:
+                                EmptyView()
+                            }
+                        }
+                        .font(.subheadline)
+                        .foregroundStyle(.secondary)
+                        if authenticationRequirement == .biometryCurrent {
+                            Text(.createSecretBiometryCurrentWarning)
+                                .padding(.horizontal, 10)
+                                .padding(.vertical, 3)
+                                .boxBackground(color: .red)
+                        }
+
+                    }
+                }
+                if advanced {
+                    Section {
+                        VStack {
+                            Picker(.createSecretKeyTypeLabel, selection: $keyType) {
+                                ForEach(store.supportedKeyTypes, id: \.self) { option in
+                                    Text(String(describing: option))
+                                        .tag(option)
+                                        .font(.caption)
+                                }
+                            }
+                            if keyType?.algorithm == .mldsa {
+                                Text(.createSecretMldsaWarning)
+                                    .padding(.horizontal, 10)
+                                    .padding(.vertical, 3)
+                                    .boxBackground(color: .orange)
+                            }
+                        }
+                        VStack(alignment: .leading) {
+                            TextField(.createSecretKeyAttributionLabel, text: $keyAttribution, prompt: Text(verbatim: "test@example.com"))
+                            Text(.createSecretKeyAttributionDescription)
+                                .font(.subheadline)
+                                .foregroundStyle(.secondary)
+                        }
+                    }
+                }
+                if let errorText {
+                    Section {
+                    } footer: {
+                        Text(verbatim: errorText)
+                            .errorStyle()
+                    }
+                }
+            }
+            HStack {
+                Toggle(.createSecretAdvancedLabel, isOn: $advanced)
+                    .toggleStyle(.button)
+                Spacer()
+                Button(.createSecretCancelButton, role: .cancel) {
+                    dismiss()
+                }
+                Button(.createSecretCreateButton, action: save)
+                    .keyboardShortcut(.return)
+                    .primaryButton()
+                    .disabled(name.isEmpty)
+            }
+            .padding()
+        }
+        .onAppear {
+            keyType = store.supportedKeyTypes.first
+        }
+        .formStyle(.grouped)
+    }
+
+    func save() {
+        let attribution = keyAttribution.isEmpty ? nil : keyAttribution
+        Task {
+            do {
+                let new = try await store.create(
+                    name: name,
+                    attributes: .init(
+                        keyType: keyType!,
+                        authentication: authenticationRequirement,
+                        publicKeyAttribution: attribution
+                    )
+                )
+                createdSecret(AnySecret(new))
+                dismiss()
+            } catch {
+                errorText = error.localizedDescription
+            }
+        }
+    }
+
+}
+
+//#Preview {
+//    CreateSecretView(store: Preview.StoreModifiable()) { _ in }
+//}

Sources/Secretive/Views/Secrets/DeleteSecretView.swift

@@ -0,0 +1,60 @@
+import SwiftUI
+import SecretKit
+
+extension View {
+
+    func showingDeleteConfirmation(isPresented: Binding<Bool>, _ secret: AnySecret,  _ store: AnySecretStoreModifiable?, dismissalBlock: @escaping (Bool) -> ()) -> some View {
+        modifier(DeleteSecretConfirmationModifier(isPresented: isPresented, secret: secret, store: store, dismissalBlock: dismissalBlock))
+    }
+
+}
+
+struct DeleteSecretConfirmationModifier: ViewModifier {
+
+    var isPresented: Binding<Bool>
+    var secret: AnySecret
+    var store: AnySecretStoreModifiable?
+    var dismissalBlock: (Bool) -> ()
+    @State var confirmedSecretName = ""
+    @State private var errorText: String?
+
+    func body(content: Content) -> some View {
+        content
+            .confirmationDialog(
+                .deleteConfirmationTitle(secretName: secret.name),
+                isPresented: isPresented,
+                titleVisibility: .visible,
+                actions: {
+                    TextField(secret.name, text: $confirmedSecretName)
+                    if let errorText {
+                        Text(verbatim: errorText)
+                            .errorStyle()
+                    }
+                    Button(.deleteConfirmationDeleteButton, action: delete)
+                        .disabled(confirmedSecretName != secret.name)
+                    Button(.deleteConfirmationCancelButton, role: .cancel) {
+                        dismissalBlock(false)
+                    }
+                },
+                message: {
+                    Text(.deleteConfirmationDescription(secretName: secret.name, confirmSecretName: secret.name))
+                }
+            )
+            .dialogIcon(Image(systemName: "lock.trianglebadge.exclamationmark.fill"))
+            .onExitCommand {
+                dismissalBlock(false)
+            }
+    }
+
+    func delete() {
+        Task {
+            do {
+                try await store!.delete(secret: secret)
+                dismissalBlock(true)
+            } catch {
+                errorText = error.localizedDescription
+            }
+        }
+    }
+
+}

Sources/Secretive/Views/Secrets/EditSecretView.swift

@@ -0,0 +1,67 @@
+import SwiftUI
+import SecretKit
+
+struct EditSecretView<StoreType: SecretStoreModifiable>: View {
+
+    let store: StoreType
+    let secret: StoreType.SecretType
+
+    @State private var name: String
+    @State private var publicKeyAttribution: String
+    @State var errorText: String?
+
+    @Environment(\.dismiss) var dismiss
+
+    init(store: StoreType, secret: StoreType.SecretType) {
+        self.store = store
+        self.secret = secret
+        name = secret.name
+        publicKeyAttribution = secret.publicKeyAttribution ?? ""
+    }
+
+    var body: some View {
+        VStack(alignment: .trailing) {
+            Form {
+                Section {
+                    TextField(String(localized: .createSecretNameLabel), text: $name, prompt: Text(.createSecretNamePlaceholder))
+                    VStack(alignment: .leading) {
+                        TextField(.createSecretKeyAttributionLabel, text: $publicKeyAttribution, prompt: Text(verbatim: "test@example.com"))
+                        Text(.createSecretKeyAttributionDescription)
+                            .font(.subheadline)
+                            .foregroundStyle(.secondary)
+                    }
+                } footer: {
+                    if let errorText {
+                        Text(verbatim: errorText)
+                            .errorStyle()
+                    }
+                }
+            }
+            HStack {
+                Button(.editCancelButton) {
+                    dismiss()
+                }
+                .keyboardShortcut(.cancelAction)
+                Button(.editSaveButton, action: rename)
+                    .disabled(name.isEmpty)
+                    .keyboardShortcut(.return)
+                    .primaryButton()
+            }
+            .padding()
+        }
+        .formStyle(.grouped)
+    }
+
+    func rename() {
+        var attributes = secret.attributes
+        attributes.publicKeyAttribution = publicKeyAttribution.isEmpty ? nil : publicKeyAttribution
+        Task {
+            do {
+                try await store.update(secret: secret, name: name, attributes: attributes)
+                dismiss()
+            } catch {
+                errorText = error.localizedDescription
+            }
+        }
+    }
+}

Sources/Secretive/Views/Secrets/EmptyStoreView.swift

@@ -28,6 +28,8 @@ struct EmptyStoreImmutableView: View {
 
 struct EmptyStoreModifiableView: View {
 
+    @Environment(\.justUpdatedChecker) var justUpdatedChecker
+
     var body: some View {
         GeometryReader { windowGeometry in
             VStack {
@@ -51,21 +53,35 @@ struct EmptyStoreModifiableView: View {
                 }.frame(height: (windowGeometry.size.height/2) - 20).padding()
                 Text(.emptyStoreModifiableClickHereTitle).bold()
                 Text(.emptyStoreModifiableClickHereDescription)
+                if justUpdatedChecker.justUpdatedOS {
+                    Spacer()
+                        .frame(height: 20)
+                    VStack(spacing: 10) {
+                        Text(.emptyStoreModifiableEmptyOsWarningTitle)
+                            .font(.title2)
+                            .bold()
+                        Text(.emptyStoreModifiableEmptyOsWarningDescription)
+                            .fixedSize(horizontal: false, vertical: true)
+                            .bold()
+                    }
+                    .padding()
+                    .boxBackground(color: .orange)
+                    .padding()
+                }
                 Spacer()
             }.frame(maxWidth: .infinity, maxHeight: .infinity)
         }
     }
 }
 
-#if DEBUG
 
-struct EmptyStoreModifiableView_Previews: PreviewProvider {
+#Preview {
-    static var previews: some View {
-        Group {
     EmptyStoreImmutableView()
+}
+#Preview {
+    EmptyStoreImmutableView()
+//        .environment(\.justUpdatedChecker, <#T##value: V##V#>)
+}
+#Preview {
     EmptyStoreModifiableView()
 }
-    }
-}
-
-#endif

Sources/Secretive/Views/Secrets/NoStoresView.swift

@@ -13,12 +13,7 @@ struct NoStoresView: View {
     
 }
 
-#if DEBUG
+#Preview {
-
-struct NoStoresView_Previews: PreviewProvider {
-    static var previews: some View {
     NoStoresView()
 }
-}
 
-#endif

Sources/Secretive/Views/Secrets/SecretDetailView.swift

@@ -5,8 +5,8 @@ struct SecretDetailView<SecretType: Secret>: View {
     
     let secret: SecretType
 
-    private let keyWriter = OpenSSHKeyWriter()
+    private let keyWriter = OpenSSHPublicKeyWriter()
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory().replacingOccurrences(of: Bundle.main.hostBundleID, with: Bundle.main.agentBundleID))
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: URL.agentHomeURL)
 
     var body: some View {
         ScrollView {
@@ -21,7 +21,7 @@ struct SecretDetailView<SecretType: Secret>: View {
                     CopyableView(title: .secretDetailPublicKeyLabel, image: Image(systemName: "key"), text: keyString)
                     Spacer()
                         .frame(height: 20)
-                    CopyableView(title: .secretDetailPublicKeyPathLabel, image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.publicKeyPath(for: secret))
+                    CopyableView(title: .secretDetailPublicKeyPathLabel, image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.publicKeyPath(for: secret), showRevealInFinder: true)
                     Spacer()
                 }
             }
@@ -30,29 +30,13 @@ struct SecretDetailView<SecretType: Secret>: View {
         .frame(minHeight: 200, maxHeight: .infinity)
     }
 
-    var dashedKeyName: String {
-             secret.name.replacingOccurrences(of: " ", with: "-")
-    }
-    
-    var dashedHostName: String {
-        ["secretive", Host.current().localizedName, "local"]
-            .compactMap { $0 }
-            .joined(separator: ".")
-            .replacingOccurrences(of: " ", with: "-")
-    }
 
     var keyString: String {
-        keyWriter.openSSHString(secret: secret, comment: "\(dashedKeyName)@\(dashedHostName)")
+        keyWriter.openSSHString(secret: secret)
     }
 
 }
 
-#if DEBUG
+//#Preview {
-
+//    SecretDetailView(secret: Preview.Secret(name: "Demonstration Secret"))
-struct SecretDetailView_Previews: PreviewProvider {
+//}
-    static var previews: some View {
-        SecretDetailView(secret: Preview.Store(numberOfRandomSecrets: 1).secrets[0])
-    }
-}
-
-#endif

Sources/Secretive/Views/Secrets/SecretListItemView.swift

@@ -0,0 +1,52 @@
+import SwiftUI
+import SecretKit
+
+struct SecretListItemView: View {
+    
+    @State var store: AnySecretStore
+    var secret: AnySecret
+    
+    @State var isDeleting: Bool = false
+    @State var isRenaming: Bool = false
+    
+    var deletedSecret: (AnySecret) -> Void
+    var renamedSecret: (AnySecret) -> Void
+    
+    var body: some View {
+        NavigationLink(value: secret) {
+            if secret.authenticationRequirement.required {
+                HStack {
+                    Text(secret.name)
+                    Spacer()
+                    Image(systemName: "lock")
+                }
+            } else {
+                Text(secret.name)
+            }
+        }
+        .contextMenu {
+            if store is AnySecretStoreModifiable {
+                Button(action: { isRenaming = true }) {
+                    Image(systemName: "pencil")
+                    Text(.secretListEditButton)
+                }
+                Button(action: { isDeleting = true }) {
+                    Image(systemName: "trash")
+                    Text(.secretListDeleteButton)
+                }
+            }
+        }
+        .showingDeleteConfirmation(isPresented: $isDeleting, secret, store as? AnySecretStoreModifiable) { deleted in
+            if deleted {
+                deletedSecret(secret)
+            }
+        }
+        .sheet(isPresented: $isRenaming, onDismiss: {
+            renamedSecret(secret)
+        }, content: {
+            if let modifiable = store as? AnySecretStoreModifiable {
+                EditSecretView(store: modifiable, secret: secret)
+            }
+        })
+    }
+}

Sources/Secretive/Views/Secrets/StoreListView.swift

@@ -1,5 +1,4 @@
 import SwiftUI
-import Combine
 import SecretKit
 
 struct StoreListView: View {
@@ -13,7 +12,9 @@ struct StoreListView: View {
     }
 
     private func secretRenamed(secret: AnySecret) {
-        activeSecret = secret
+        // Pull new version from store, so we get all updated attributes
+        activeSecret = nil
+        activeSecret = storeList.allSecrets.first(where: { $0.id == secret.id })
     }
 
     var body: some View {
@@ -27,7 +28,7 @@ struct StoreListView: View {
                                     store: store,
                                     secret: secret,
                                     deletedSecret: secretDeleted,
-                                    renamedSecret: secretRenamed
+                                    renamedSecret: secretRenamed,
                                 )
                             }
                         }
@@ -42,7 +43,11 @@ struct StoreListView: View {
                 // Do this to avoid a blip.
                 SecretDetailView(secret: nextDefaultSecret)
             } else {
-                EmptyStoreView(store: storeList.modifiableStore ?? storeList.stores.first)
+                if let modifiable = storeList.modifiableStore, modifiable.isAvailable {
+                    EmptyStoreView(store: modifiable)
+                } else {
+                    EmptyStoreView(store: storeList.stores.first(where: \.isAvailable))
+                }
             }
         }
         .navigationSplitViewStyle(.balanced)
@@ -57,7 +62,7 @@ struct StoreListView: View {
 extension StoreListView {
 
     private var nextDefaultSecret: AnySecret? {
-        return storeList.stores.first(where: { !$0.secrets.isEmpty })?.secrets.first
+        return storeList.allSecrets.first
     }
     
 }

Sources/Secretive/Views/SetupView.swift

@@ -1,297 +0,0 @@
-import SwiftUI
-
-struct SetupView: View {
-
-    @State var stepIndex = 0
-    @Binding var visible: Bool
-    @Binding var setupComplete: Bool
-
-    var body: some View {
-        GeometryReader { proxy in
-            VStack {
-                StepView(numberOfSteps: 3, currentStep: stepIndex, width: proxy.size.width)
-                GeometryReader { _ in
-                    HStack(spacing: 0) {
-                        SecretAgentSetupView(buttonAction: advance)
-                            .frame(width: proxy.size.width)
-                        SSHAgentSetupView(buttonAction: advance)
-                            .frame(width: proxy.size.width)
-                        UpdaterExplainerView {
-                            visible = false
-                            setupComplete = true
-                        }
-                        .frame(width: proxy.size.width)
-                    }
-                    .offset(x: -proxy.size.width * Double(stepIndex), y: 0)
-                }
-            }
-        }
-        .frame(minWidth: 500, idealWidth: 500, minHeight: 500, idealHeight: 500)
-    }
-
-
-    func advance() {
-        withAnimation(.spring()) {
-            stepIndex += 1
-        }
-    }
-
-}
-
-struct StepView: View {
-
-    let numberOfSteps: Int
-    let currentStep: Int
-
-    // Ideally we'd have a geometry reader inside this view doing this for us, but that crashes on 11.0b7
-    let width: Double
-
-    var body: some View {
-        ZStack(alignment: .leading) {
-            Rectangle()
-                .foregroundColor(.blue)
-                .frame(height: 5)
-            Rectangle()
-                .foregroundColor(.green)
-                .frame(width: max(0, ((width - (Constants.padding * 2)) / Double(numberOfSteps - 1)) * Double(currentStep) - (Constants.circleWidth / 2)), height: 5)
-            HStack {
-                ForEach(Array(0..<numberOfSteps), id: \.self) { index in
-                    ZStack {
-                        if currentStep > index {
-                            Circle()
-                                .foregroundColor(.green)
-                                .frame(width: Constants.circleWidth, height: Constants.circleWidth)
-                            Text(.setupStepCompleteSymbol)
-                                .foregroundColor(.white)
-                                .bold()
-                        } else {
-                            Circle()
-                                .foregroundColor(.blue)
-                                .frame(width: Constants.circleWidth, height: Constants.circleWidth)
-                            if currentStep == index {
-                                Circle()
-                                    .strokeBorder(Color.white, lineWidth: 3)
-                                    .frame(width: Constants.circleWidth, height: Constants.circleWidth)
-                            }
-                            Text(String(describing: index + 1))
-                                .foregroundColor(.white)
-                                .bold()
-                        }
-                    }
-                    if index < numberOfSteps - 1 {
-                        Spacer(minLength: 30)
-                    }
-                }
-            }
-        }.padding(Constants.padding)
-    }
-
-}
-
-extension StepView {
-
-    enum Constants {
-
-        static let padding: Double = 15
-        static let circleWidth: Double = 30
-
-    }
-
-}
-
-struct SetupStepView<Content> : View where Content : View {
-
-    let title: LocalizedStringResource
-    let image: Image
-    let bodyText: LocalizedStringResource
-    let buttonTitle: LocalizedStringResource
-    let buttonAction: () -> Void
-    let content: Content
-
-    init(title: LocalizedStringResource, image: Image, bodyText: LocalizedStringResource, buttonTitle: LocalizedStringResource, buttonAction: @escaping () -> Void = {}, @ViewBuilder content: () -> Content) {
-        self.title = title
-        self.image = image
-        self.bodyText = bodyText
-        self.buttonTitle = buttonTitle
-        self.buttonAction = buttonAction
-        self.content = content()
-    }
-
-    var body: some View {
-        VStack {
-            Text(title)
-                .font(.title)
-            Spacer()
-            image
-                .resizable()
-                .aspectRatio(contentMode: .fit)
-                .frame(width: 64)
-            Spacer()
-            Text(bodyText)
-                .multilineTextAlignment(.center)
-            Spacer()
-            content
-            Spacer()
-            Button(buttonTitle) {
-                buttonAction()
-            }
-        }.padding()
-    }
-
-}
-
-struct SecretAgentSetupView: View {
-
-    let buttonAction: () -> Void
-
-    var body: some View {
-        SetupStepView(title: .setupAgentTitle,
-                      image: Image(nsImage: NSApplication.shared.applicationIconImage),
-                      bodyText: .setupAgentDescription,
-                      buttonTitle: .setupAgentInstallButton,
-                      buttonAction: install) {
-            Text(.setupAgentActivityMonitorDescription)
-                .multilineTextAlignment(.center)
-        }
-    }
-
-    func install() {
-        Task {
-            await LaunchAgentController().install()
-            buttonAction()
-        }
-    }
-
-}
-
-struct SSHAgentSetupView: View {
-
-    let buttonAction: () -> Void
-
-    private static let controller = ShellConfigurationController()
-    @State private var selectedShellInstruction: ShellConfigInstruction = controller.shellInstructions.first!
-
-    var body: some View {
-        SetupStepView(title: .setupSshTitle,
-                      image: Image(systemName: "terminal"),
-                      bodyText: .setupSshDescription,
-                      buttonTitle: .setupSshAddedManuallyButton,
-                      buttonAction: buttonAction) {
-        Link(.setupThirdPartyFaqLink, destination: URL(string: "https://github.com/maxgoedjen/secretive/blob/main/APP_CONFIG.md")!)
-            Picker(selection: $selectedShellInstruction, label: EmptyView()) {
-                ForEach(SSHAgentSetupView.controller.shellInstructions) { instruction in
-                    Text(instruction.shell)
-                        .tag(instruction)
-                        .padding()
-                }
-            }.pickerStyle(SegmentedPickerStyle())
-            CopyableView(title: .setupSshAddToConfigButton(configPath: selectedShellInstruction.shellConfigPath), image: Image(systemName: "greaterthan.square"), text: selectedShellInstruction.text)
-            Button(.setupSshAddForMeButton) {
-                let controller = ShellConfigurationController()
-                if controller.addToShell(shellInstructions: selectedShellInstruction) {
-                    buttonAction()
-                }
-            }
-        }
-    }
-
-}
-
-class Delegate: NSObject, NSOpenSavePanelDelegate {
-
-    private let name: String
-
-    init(name: String) {
-        self.name = name
-    }
-
-    func panel(_ sender: Any, shouldEnable url: URL) -> Bool {
-        return url.lastPathComponent == name
-    }
-
-}
-
-struct UpdaterExplainerView: View {
-
-    let buttonAction: () -> Void
-
-    var body: some View {
-        SetupStepView(title: .setupUpdatesTitle,
-                      image: Image(systemName: "dot.radiowaves.left.and.right"),
-                      bodyText: .setupUpdatesDescription,
-                      buttonTitle: .setupUpdatesOk,
-                      buttonAction: buttonAction) {
-            Link(.setupUpdatesReadmore, destination: SetupView.Constants.updaterFAQURL)
-        }
-    }
-
-}
-
-extension SetupView {
-
-    enum Constants {
-        static let updaterFAQURL = URL(string: "https://github.com/maxgoedjen/secretive/blob/main/FAQ.md#whats-this-network-request-to-github")!
-    }
-
-}
-
-struct ShellConfigInstruction: Identifiable, Hashable {
-
-    var shell: String
-    var shellConfigDirectory: String
-    var shellConfigFilename: String
-    var text: String
-
-    var id: String {
-        shell
-    }
-
-    var shellConfigPath: String {
-        return (shellConfigDirectory as NSString).appendingPathComponent(shellConfigFilename)
-    }
-
-}
-
-#if DEBUG
-
-struct SetupView_Previews: PreviewProvider {
-
-    static var previews: some View {
-        Group {
-            SetupView(visible: .constant(true), setupComplete: .constant(false))
-        }
-    }
-
-}
-
-struct SecretAgentSetupView_Previews: PreviewProvider {
-
-    static var previews: some View {
-        Group {
-            SecretAgentSetupView(buttonAction: {})
-        }
-    }
-
-}
-
-struct SSHAgentSetupView_Previews: PreviewProvider {
-
-    static var previews: some View {
-        Group {
-            SSHAgentSetupView(buttonAction: {})
-        }
-    }
-
-}
-
-struct UpdaterExplainerView_Previews: PreviewProvider {
-
-    static var previews: some View {
-        Group {
-            UpdaterExplainerView(buttonAction: {})
-        }
-    }
-    
-}
-
-#endif