Add hardware security entitlement.

2026-10-02 12:49:55 +02:00 · 2025-09-26 23:41:11 -07:00
101 changed files with 1684 additions and 5330 deletions
@@ -11,7 +11,7 @@ on:
 jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
-    runs-on: ${{ (matrix.language == 'swift' && 'xcode-27') || 'ubuntu-latest' }}
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-26') || 'ubuntu-latest' }}
    permissions:
      security-events: write
      packages: read
@@ -24,15 +24,20 @@ jobs:
        include:
        - language: actions
          build-mode: none
+        # Disable this until CodeQL supports Xcode 26 builds.
+        # - language: swift
+        #   build-mode: manual
    steps:
    - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v4
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
    - if: matrix.build-mode == 'manual'
+      name: "Select Xcode"
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
    - if: matrix.build-mode == 'manual'
      name: "Build"
      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO
@@ -3,16 +3,15 @@ name: Nightly
 on: 
  schedule: 
    - cron: "0 8 * * *"
+  workflow_dispatch:
  
 jobs:
  build:
-    runs-on: xcode-27
+    runs-on: macos-26
    permissions:
      id-token: write
      contents: write
      attestations: write
-      artifact-metadata: write
-      actions: read
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v5
@@ -25,6 +24,8 @@ jobs:
        APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      run: ./.github/scripts/signing.sh
+    - name: Set Environment
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
    - name: Update Build Number
      env:
        RUN_ID: ${{ github.run_id }}
@@ -35,30 +36,23 @@ jobs:
            sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Config/Config.xcconfig
    - name: Build
      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Move to Artifact Folder
-      run: mkdir Artifact; cp -r Archive.xcarchive/Products/Applications/Secretive.app Artifact
-    - name: Upload App to Artifacts
-      id: upload
-      uses: actions/upload-artifact@v7
-      with:
-        name: Secretive
-        path: Artifact
-    - name: Download Zipped Artifact
-      id: download
-      env: 
-        ZIP_ID: ${{ steps.upload.outputs.artifact-id }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Create ZIP
      run: |
-            curl -L -H "Authorization: Bearer $GITHUB_TOKEN" -L \
-            https://api.github.com/repos/maxgoedjen/secretive/actions/artifacts/$ZIP_ID/zip > Secretive.zip
+            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
    - name: Notarize
      env: 
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
+    - name: Upload App to Artifacts
+      id: upload
+      uses: actions/upload-artifact@v4
+      with:
+        name: Secretive.zip
+        path: Secretive.zip
    - name: Attest
      id: attest
-      uses: actions/attest@v4
+      uses: actions/attest-build-provenance@v2
      with:
        subject-name: "Secretive.zip"
        subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}
@@ -1,63 +0,0 @@
-name: One-Off Build
-
-on: 
-  workflow_dispatch:
-  
-jobs:
-  build:
-    runs-on: xcode-27
-    permissions:
-      id-token: write
-      contents: write
-      attestations: write
-      artifact-metadata: write
-      actions: read
-    timeout-minutes: 10
-    steps:
-    - uses: actions/checkout@v5
-    - name: Setup Signing
-      env: 
-        SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
-        SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
-        HOST_PROFILE_DATA: ${{ secrets.HOST_PROFILE_DATA }}
-        AGENT_PROFILE_DATA: ${{ secrets.AGENT_PROFILE_DATA }}
-        APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
-        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-      run: ./.github/scripts/signing.sh
-    - name: Update Build Number
-      env:
-        RUN_ID: ${{ github.run_id }}
-      run: |
-            DATE=$(date "+%Y-%m-%d")
-            sed -i '' -e "s/GITHUB_CI_VERSION/0.0.0_oneoff-$DATE/g" Sources/Config/Config.xcconfig
-            sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
-            sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Config/Config.xcconfig
-    - name: Build
-      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Move to Artifact Folder
-      run: mkdir Artifact; cp -r Archive.xcarchive/Products/Applications/Secretive.app Artifact
-    - name: Upload App to Artifacts
-      id: upload
-      uses: actions/upload-artifact@v7
-      with:
-        name: Secretive
-        path: Artifact
-    - name: Download Zipped Artifact
-      id: download
-      env: 
-        ZIP_ID: ${{ steps.upload.outputs.artifact-id }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-            curl -L -H "Authorization: Bearer $GITHUB_TOKEN" -L \
-            https://api.github.com/repos/maxgoedjen/secretive/actions/artifacts/$ZIP_ID/zip > Secretive.zip
-    - name: Notarize
-      env: 
-        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
-    - name: Attest
-      id: attest
-      uses: actions/attest@v4
-      with:
-        subject-name: "Secretive.zip"
-        subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}
@@ -8,7 +8,7 @@ jobs:
  test:
    permissions:
        contents: read
-    runs-on: xcode-27
+    runs-on: macos-26
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v5
@@ -21,6 +21,8 @@ jobs:
        APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      run: ./.github/scripts/signing.sh
+    - name: Set Environment
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
    - name: Test
      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme PackageTests test
      # SPM doesn't seem to pick up on the tests currently?
@@ -30,9 +32,7 @@ jobs:
      id-token: write
      contents: write
      attestations: write
-      artifact-metadata: write
-      actions: read
-    runs-on: xcode-27
+    runs-on: macos-26
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v5
@@ -45,6 +45,8 @@ jobs:
        APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      run: ./.github/scripts/signing.sh
+    - name: Set Environment
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
    - name: Update Build Number
      env:
        TAG_NAME: ${{ github.ref }}
@@ -56,40 +58,33 @@ jobs:
            sed -i '' -e "s/GITHUB_BUILD_URL/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Config/Config.xcconfig
    - name: Build
      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Move to Artifact Folder
-      run: mkdir Artifact; cp -r Archive.xcarchive/Products/Applications/Secretive.app Artifact
-    - name: Upload App to Artifacts
-      id: upload
-      uses: actions/upload-artifact@v7
-      with:
-        name: Secretive.zip
-        path: Artifact
-    - name: Download Zipped Artifact
-      id: download
-      env: 
-        ZIP_ID: ${{ steps.upload.outputs.artifact-id }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Create ZIP
      run: |
-            curl -L -H "Authorization: Bearer $GITHUB_TOKEN" -L \
-            https://api.github.com/repos/maxgoedjen/secretive/actions/artifacts/$ZIP_ID/zip > Secretive.zip
+            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
    - name: Notarize
      env: 
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
+    - name: Upload App to Artifacts
+      id: upload
+      uses: actions/upload-artifact@v4
+      with:
+        name: Secretive.zip
+        path: Secretive.zip
    - name: Attest
      id: attest
-      uses: actions/attest@v4
+      uses: actions/attest-build-provenance@v2
      with:
        subject-path: "Secretive.zip"
    - name: Create Release
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        TAG_NAME: ${{ github.ref }}
-        RUN_ID: ${{ github.run_id }}
-        ATTESTATION_ID: ${{ steps.attest.outputs.attestation-id }}
      run: |
            sed -i.tmp "s/RUN_ID/$RUN_ID/g" .github/templates/release.md
            sed -i.tmp "s/ATTESTATION_ID/$ATTESTATION_ID/g" .github/templates/release.md
            gh release create $TAG_NAME -d -F .github/templates/release.md
            gh release upload $TAG_NAME Secretive.zip
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        TAG_NAME: ${{ github.ref }}
+        RUN_ID: ${{ github.run_id }}
+        ATTESTATION_ID: ${{ steps.attest.outputs.attestation-id }}
@@ -5,10 +5,12 @@ jobs:
  test:
    permissions:
        contents: read
-    runs-on: xcode-27
+    runs-on: macos-26
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v5
+    - name: Set Environment
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
    - name: Test Main Packages
      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme PackageTests test
      # SPM doesn't seem to pick up on the tests currently?
@@ -93,7 +93,3 @@ iOSInjectionProject/
 Archive.xcarchive
 .DS_Store
 contents.xcworkspacedata
-
-# Per-User Configs
-
-Sources/Config/OpenSource.xcconfig
@@ -10,10 +10,6 @@ Security is obviously paramount for a project like Secretive. As such, any contr

 Secretive is designed to be easily auditable by people who are considering using it. In keeping with this, Secretive has no third party dependencies, and any contributions which bring in new dependencies will be rejected.

-### AI/LLM Policy
-
-For security and auditing reasons similar to the policy Secretive has on dependencies, any code generated with AI or LLM tools will not be accepted.
-
 ## Code of Conduct

 All contributors must abide by the [Code of Conduct](CODE_OF_CONDUCT.md)
@@ -22,15 +22,6 @@ let package = Package(
        .library(
            name: "SmartCardSecretKit",
            targets: ["SmartCardSecretKit"]),
-        .library(
-            name: "CertificateKit",
-            targets: ["CertificateKit"]),
-        .library(
-            name: "SSHProtocolKit",
-            targets: ["SSHProtocolKit"]),
-        .library(
-            name: "Formatters",
-            targets: ["Formatters"]),
    ],
    dependencies: [
    ],
@@ -62,33 +53,6 @@ let package = Package(
            resources: [localization],
            swiftSettings: swiftSettings
        ),
-        .target(
-            name: "CertificateKit",
-            dependencies: ["SecretKit", "Formatters"],
-            path: "Sources/Packages/Sources/CertificateKit",
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
-        .target(
-            name: "SSHProtocolKit",
-            dependencies: ["SecretKit", "CertificateKit"],
-            path: "Sources/Packages/Sources/SSHProtocolKit",
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
-        .testTarget(
-            name: "SSHProtocolKitTests",
-            dependencies: ["SSHProtocolKit"],
-            path: "Sources/Packages/Tests/SSHProtocolKitTests",
-            swiftSettings: swiftSettings,
-        ),
-        .target(
-            name: "Formatters",
-            dependencies: [],
-            path: "Sources/Packages/Sources/Formatters",
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
    ]
 )

@@ -1,8 +1,3 @@
 CI_VERSION = GITHUB_CI_VERSION
 CI_BUILD_NUMBER = GITHUB_BUILD_NUMBER
 CI_BUILD_LINK = GITHUB_BUILD_URL
-
-#include? "OpenSource.xcconfig"
-
-SECRETIVE_BASE_BUNDLE_ID = $(SECRETIVE_BASE_BUNDLE_ID_OSS:default=com.maxgoedjen.Secretive)
-SECRETIVE_DEVELOPMENT_TEAM = $(SECRETIVE_DEVELOPMENT_TEAM_OSS:default=Z72PRUAWF6)
@@ -19,30 +19,15 @@ let package = Package(
        .library(
            name: "SmartCardSecretKit",
            targets: ["SmartCardSecretKit"]),
-        .library(
-            name: "CertificateKit",
-            targets: ["CertificateKit"]),
        .library(
            name: "SecretAgentKit",
-            targets: ["SecretAgentKit"]),
-        .library(
-            name: "Formatters",
-            targets: ["Formatters"]),
-        .library(
-            name: "Common",
-            targets: ["Common"]),
-        .library(
-            name: "SharedXPCServices",
-            targets: ["SharedXPCServices"]),
+            targets: ["SecretAgentKit", "XPCWrappers"]),
        .library(
            name: "Brief",
            targets: ["Brief"]),
        .library(
            name: "XPCWrappers",
            targets: ["XPCWrappers"]),
-        .library(
-            name: "SSHProtocolKit",
-            targets: ["SSHProtocolKit"]),
    ],
    dependencies: [
    ],
@@ -55,7 +40,7 @@ let package = Package(
        ),
        .testTarget(
            name: "SecretKitTests",
-            dependencies: ["SecretKit", "SecretAgentKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
+            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
            swiftSettings: swiftSettings,
        ),
        .target(
@@ -70,15 +55,9 @@ let package = Package(
            resources: [localization],
            swiftSettings: swiftSettings,
        ),
-        .target(
-            name: "CertificateKit",
-            dependencies: ["SecretKit", "Formatters"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
        .target(
            name: "SecretAgentKit",
-            dependencies: ["SecretKit", "SSHProtocolKit", "CertificateKit", "Common", "Formatters"],
+            dependencies: ["SecretKit"],
            resources: [localization],
            swiftSettings: swiftSettings,
        ),
@@ -86,38 +65,9 @@ let package = Package(
            name: "SecretAgentKitTests",
            dependencies: ["SecretAgentKit"],
        ),
-        .target(
-            name: "SSHProtocolKit",
-            dependencies: ["SecretKit", "CertificateKit"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
-        .testTarget(
-            name: "SSHProtocolKitTests",
-            dependencies: ["SSHProtocolKit"],
-            swiftSettings: swiftSettings,
-        ),
-        .target(
-            name: "Formatters",
-            dependencies: [],
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
-        .target(
-            name: "Common",
-            dependencies: ["SSHProtocolKit", "SecretKit"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
-        .target(
-            name: "SharedXPCServices",
-            dependencies: ["CertificateKit", "SSHProtocolKit"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
        .target(
            name: "Brief",
-            dependencies: ["XPCWrappers", "SSHProtocolKit"],
+            dependencies: ["XPCWrappers"],
            resources: [localization],
            swiftSettings: swiftSettings,
        ),
@@ -34,12 +34,12 @@ import XPCWrappers
    ) {
        self.osVersion = osVersion
        self.currentVersion = currentVersion
-        _ = Task {
+        Task {
            if checkOnLaunch {
                try await checkForUpdates()
            }
-            while true {
-                try await Task.sleep(for: .seconds(Int(checkFrequency)))
+            while !Task.isCancelled {
+                try? await Task.sleep(for: .seconds(Int(checkFrequency)))
                try await checkForUpdates()
            }
        }
@@ -1,24 +0,0 @@
-import Foundation
-import CryptoKit
-import Formatters
-
-@dynamicMemberLookup
-public struct Certificate: Sendable, Codable, Equatable, Hashable, Identifiable, CustomDebugStringConvertible {
-
-    public var openSSHCertificate: OpenSSHCertificate
-    public let rawData: Data
-
-    public init(openSSHCertificate: OpenSSHCertificate, rawData: Data) {
-        self.openSSHCertificate = openSSHCertificate
-        self.rawData = rawData
-    }
-
-    public var id: String { Insecure.MD5.hash(data: rawData).formatted(.hex(separator: "")) }
-
-    public var debugDescription: String { openSSHCertificate.debugDescription }
-
-    public subscript<T>(dynamicMember keyPath: KeyPath<OpenSSHCertificate, T>) -> T {
-        openSSHCertificate[keyPath: keyPath]
-    }
-
-}
@@ -1,153 +0,0 @@
-import Foundation
-import Observation
-import Security
-import os
-import SecretKit
-
-@Observable @MainActor public final class CertificateStore: Sendable {
-
-    public private(set) var certificates: [Certificate] = []
-
-    /// Initializes a Store.
-    public init() {
-        loadCertificates()
-        Task {
-            for await note in DistributedNotificationCenter.default().notifications(named: .certificateStoreUpdated) {
-                guard Constants.notificationToken != (note.object as? String) else {
-                    // Don't reload if we're the ones triggering this by reloading.
-                    continue
-                }
-                loadCertificates()
-            }
-        }
-    }
-
-    public func reloadCertificates() {
-        let before = certificates
-        certificates.removeAll()
-        loadCertificates()
-        if certificates != before {
-            NotificationCenter.default.post(name: .certificateStoreReloaded, object: self)
-            DistributedNotificationCenter.default().postNotificationName(.certificateStoreUpdated, object: Constants.notificationToken, deliverImmediately: true)
-        }
-    }
-
-    public func save(certificate: Certificate) throws {
-        let attributes = try JSONEncoder().encode(certificate.openSSHCertificate)
-        let keychainAttributes = KeychainDictionary([
-            kSecClass: Constants.keyClass,
-            kSecAttrService: Constants.keyTag,
-            kSecAttrAccount: certificate.id,
-            kSecUseDataProtectionKeychain: true,
-            kSecAttrAccessible: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-            kSecValueData: certificate.rawData,
-            kSecAttrGeneric: attributes
-        ])
-        let status = SecItemAdd(keychainAttributes, nil)
-        if status != errSecSuccess && status != errSecDuplicateItem {
-            throw KeychainError(statusCode: status)
-        }
-        reloadCertificates()
-    }
-
-    public func delete(certificate: Certificate) throws {
-        let deleteAttributes = KeychainDictionary([
-            kSecClass: Constants.keyClass,
-            kSecAttrService: Constants.keyTag,
-            kSecUseDataProtectionKeychain: true,
-            kSecAttrAccount: certificate.id,
-        ])
-        let status = SecItemDelete(deleteAttributes)
-        if status != errSecSuccess {
-            throw KeychainError(statusCode: status)
-        }
-        reloadCertificates()
-    }
-
-    public func update(certificate: Certificate) throws {
-        let updateQuery = KeychainDictionary([
-            kSecClass: Constants.keyClass,
-            kSecAttrAccount: certificate.id,
-        ])
-
-        let cert = try JSONEncoder().encode(certificate.openSSHCertificate)
-        let updatedAttributes = KeychainDictionary([
-            kSecAttrGeneric: cert,
-        ])
-
-        let status = SecItemUpdate(updateQuery, updatedAttributes)
-        if status != errSecSuccess {
-            throw KeychainError(statusCode: status)
-        }
-        reloadCertificates()
-    }
-
-    public func certificates(for secret: any Secret) -> [Certificate] {
-        certificates.filter { $0.openSSHCertificate.publicKey.data == secret.publicKey }
-    }
-
-
-}
-
-extension CertificateStore {
-
-    /// Loads all certificates from the store.
-    private func loadCertificates() {
-        let queryAttributes = KeychainDictionary([
-            kSecClass: Constants.keyClass,
-            kSecAttrService: Constants.keyTag,
-            kSecUseDataProtectionKeychain: true,
-            kSecReturnData: true,
-            kSecMatchLimit: kSecMatchLimitAll,
-            kSecReturnAttributes: true
-            ])
-        var untyped: CFTypeRef?
-        unsafe SecItemCopyMatching(queryAttributes, &untyped)
-        guard let typed = untyped as? [[CFString: Any]] else { return }
-        let decoder = JSONDecoder()
-        let wrapped: [Certificate] = typed.compactMap {
-            do {
-                guard let data = $0[kSecValueData] as? Data,
-                      let attributesData = $0[kSecAttrGeneric] as? Data else {
-                    throw MissingAttributesError()
-                }
-                return Certificate(openSSHCertificate: try decoder.decode(OpenSSHCertificate.self, from: attributesData), rawData: data)
-            } catch {
-                return nil
-            }
-        }
-            .filter {
-                if let validityRange = $0.validityRange {
-                    validityRange.contains(Date())
-                } else {
-                    true
-                }
-            }
-
-        certificates.append(contentsOf: wrapped)
-    }
-
-    
-}
-
-extension CertificateStore {
-
-    enum Constants {
-        static let keyClass = kSecClassGenericPassword as String
-        static let keyTag = Data("com.maxgoedjen.certificatestore.opensshcertificate".utf8)
-        static let notificationToken = UUID().uuidString
-    }
-    
-    struct UnsupportedAlgorithmError: Error {}
-    struct MissingAttributesError: Error {}
-
-}
-
-extension NSNotification.Name {
-
-    // Distributed notification that keys were modified out of process (ie, that the management tool added/removed certificates)
-    public static let certificateStoreUpdated = NSNotification.Name("com.maxgoedjen.Secretive.certificateStore.updated")
-    // Internal notification that certificates were reloaded from the backing store.
-    public static let certificateStoreReloaded = NSNotification.Name("com.maxgoedjen.Secretive.certificateStore.reloaded")
-
-}
@@ -1,82 +0,0 @@
-import Foundation
-import Formatters
-
-public struct OpenSSHCertificate: Sendable, Codable, Equatable, Hashable, CustomDebugStringConvertible {
-
-    public var type: CertificateType
-    public var name: String
-    public var data: Data
-
-    public var publicKey: PublicKey
-    public var principals: [String]
-    public var keyID: String
-    public var serial: UInt64
-    public var validityRange: Range<Date>?
-    public var criticalOptions: [String]
-    public var extensions: [String]
-    public var signingKey: PublicKey
-
-    public init(
-        type: OpenSSHCertificate.CertificateType,
-        name: String,
-        data: Data,
-        publicKey: PublicKey,
-        principals: [String],
-        keyID: String,
-        serial: UInt64,
-        validityRange: Range<Date>? = nil,
-        criticalOptions: [String],
-        extensions: [String],
-        signingKey: PublicKey,
-    ) {
-        self.type = type
-        self.name = name
-        self.data = data
-        self.publicKey = publicKey
-        self.principals = principals
-        self.keyID = keyID
-        self.serial = serial
-        self.validityRange = validityRange
-        self.criticalOptions = criticalOptions
-        self.extensions = extensions
-        self.signingKey = signingKey
-    }
-
-    public var debugDescription: String {
-        "OpenSSH Certificate \(name, default: "Unnamed"): \(data.formatted(.hex()))"
-    }
-
-}
-
-extension OpenSSHCertificate {
-
-    public enum CertificateType: String, Sendable, Codable {
-        case ecdsa256 = "ecdsa-sha2-nistp256-cert-v01@openssh.com"
-        case ecdsa384 = "ecdsa-sha2-nistp384-cert-v01@openssh.com"
-        case nistp521 = "ecdsa-sha2-nistp521-cert-v01@openssh.com"
-
-        public var keyIdentifier: String {
-            rawValue.replacingOccurrences(of: "-cert-v01@openssh.com", with: "")
-        }
-
-    }
-
-}
-
-extension OpenSSHCertificate {
-
-    public struct PublicKey: Hashable, Sendable, Codable {
-
-        public let keyType: String
-        public let curveName: String
-        public let data: Data
-
-        public init(keyType: String, curveName: String, data: Data) {
-            self.keyType = keyType
-            self.curveName = curveName
-            self.data = data
-        }
-
-    }
-
-}
@@ -1,59 +0,0 @@
-import Foundation
-import SSHProtocolKit
-import CertificateKit
-import SecretKit
-
-extension URL {
-
-    public static var agentHomeURL: URL {
-        URL(fileURLWithPath: URL.homeDirectory.path().replacingOccurrences(of: Bundle.hostBundleID, with: Bundle.agentBundleID))
-    }
-
-    public static var socketPath: String {
-        #if DEBUG
-        URL.agentHomeURL.appendingPathComponent("socket-debug.ssh").path()
-        #else
-        URL.agentHomeURL.appendingPathComponent("socket.ssh").path()
-        #endif
-    }
-
-    public static var publicKeyDirectory: URL {
-        agentHomeURL.appending(component: "PublicKeys")
-    }
-
-    public static var certificatesDirectory: URL {
-        agentHomeURL.appending(component: "Certificates")
-    }
-
-    /// The path for a Secret's public key.
-    /// - Parameter secret: The Secret to return the path for.
-    /// - Returns: The path to the Secret's public key.
-    /// - Warning: This method returning a path does not imply that a key has been written to disk already. This method only describes where it will be written to.
-    public static func publicKeyPath<SecretType: Secret>(for secret: SecretType, in directory: URL) -> String {
-        let keyWriter = OpenSSHPublicKeyWriter()
-        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
-        return directory.appending(component: "\(minimalHex).pub").path()
-    }
-
-    /// The path for a certificate.
-    /// - Parameter certificate: The Certificate to return the path for.
-    /// - Returns: The path to the Certificate.
-    /// - Warning: This method returning a path does not imply that a certificate has been written to disk already. This method only describes where it will be written to.
-    public static func certificatePath(for certificateID: String, in directory: URL) -> String {
-        return directory.appending(component: "\(certificateID)-cert.pub").path()
-    }
-
-}
-
-extension String {
-
-    public var normalizedPathAndFolder: (String, String) {
-        // All foundation-based normalization methods replace this with the container directly.
-        let processedPath = replacingOccurrences(of: "~", with: "/Users/\(NSUserName())")
-        let url = URL(filePath: processedPath)
-        let folder = url.deletingLastPathComponent().path()
-        return (processedPath, folder)
-    }
-
-}
-
@@ -1,74 +0,0 @@
-import Foundation
-import CryptoKit
-
-public struct HexDataStyle<SequenceType: Sequence>: Hashable, Codable {
-
-    let separator: String
-
-    public init(separator: String) {
-        self.separator = separator
-    }
-
-}
-
-extension HexDataStyle: FormatStyle where SequenceType.Element == UInt8 {
-
-    public func format(_ value: SequenceType) -> String {
-        value
-            .compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
-            .joined(separator: separator)
-    }
-
-}
-
-extension FormatStyle where Self == HexDataStyle<Data> {
-
-    public static func hex(separator: String = "") -> HexDataStyle<Data> {
-        HexDataStyle(separator: separator)
-    }
-
-}
-
-extension FormatStyle where Self == HexDataStyle<Insecure.MD5Digest> {
-
-    public static func hex(separator: String = ":") -> HexDataStyle<Insecure.MD5Digest> {
-        HexDataStyle(separator: separator)
-    }
-
-}
-
-public struct Base64DataStyle<SequenceType: Sequence>: Hashable, Codable {
-
-    private let stripPadding: Bool
-
-    public init(stripPadding: Bool) {
-        self.stripPadding = stripPadding
-    }
-
-}
-
-extension Base64DataStyle: FormatStyle where SequenceType.Element == UInt8 {
-
-    public func format(_ value: SequenceType) -> String {
-        let base64 = Data(value).base64EncodedString()
-        let paddingRange = base64.index(base64.endIndex, offsetBy: -2)..<base64.endIndex
-        return base64.replacingOccurrences(of: "=", with: "", range: paddingRange)
-    }
-
-}
-
-extension FormatStyle where Self == Base64DataStyle<Data> {
-
-    public static func base64(stripPadding: Bool) -> Base64DataStyle<Data> {
-        Base64DataStyle(stripPadding: stripPadding)
-    }
-
-}
-
-extension FormatStyle where Self == Base64DataStyle<SHA256.Digest> {
-
-    public static func base64(stripPadding: Bool) -> Base64DataStyle<SHA256.Digest> {
-        Base64DataStyle(stripPadding: stripPadding)
-    }
-
-}
@@ -1,30 +0,0 @@
-import Foundation
-import CryptoKit
-import CertificateKit
-import Formatters
-
-/// Generates OpenSSH representations of Certificates.
-public struct OpenSSHCertificateWriter: Sendable {
-
-    /// Initializes the writer.
-    public init() {
-    }
-
-    /// Generates an OpenSSH data payload identifying the certificate.
-    /// - Returns: OpenSSH data payload identifying the certificate.
-    public func data(publicKey: OpenSSHCertificate.PublicKey) -> Data {
-        // https://datatracker.ietf.org/doc/html/rfc5656#section-3.1
-        publicKey.keyType.lengthAndData +
-        publicKey.curveName.lengthAndData +
-        publicKey.data.lengthAndData
-    }
-
-    /// Generates an OpenSSH SHA256 fingerprint string.
-    /// - Returns: OpenSSH SHA256 fingerprint string.
-    public func openSSHSHA256KeyFingerprint(publicKey: OpenSSHCertificate.PublicKey) -> String {
-        // OpenSSL format seems to strip the padding at the end.
-        let cleaned = SHA256.hash(data: data(publicKey: publicKey)).formatted(.base64(stripPadding: true))
-        return "SHA256:\(cleaned)"
-    }
-
-}
@@ -1,95 +0,0 @@
-import Foundation
-import CertificateKit
-
-public protocol OpenSSHCertificateParserProtocol {
-    func parse(data: Data) async throws -> OpenSSHCertificate
-}
-
-public struct OpenSSHCertificateParser: OpenSSHCertificateParserProtocol, Sendable {
-
-    public init() {
-        assert(Bundle.main.bundleURL.pathExtension == "xpc" || ProcessInfo.processInfo.processName == "xctest", "Potentially unsafe parsing code should run in an XPC service")
-    }
-
-    public func parse(data: Data) throws(OpenSSHCertificateError) -> OpenSSHCertificate {
-        let string = String(decoding: data, as: UTF8.self)
-        var elements = string
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-            .components(separatedBy: " ")
-        guard elements.count >= 2 else {
-            throw OpenSSHCertificateError.parsingFailed
-        }
-        let typeString = elements.removeFirst()
-        guard let type = OpenSSHCertificate.CertificateType(rawValue: typeString) else { throw .unsupportedType }
-        let encodedKey = elements.removeFirst()
-        guard let decoded = Data(base64Encoded: encodedKey)  else {
-            throw OpenSSHCertificateError.parsingFailed
-        }
-        let comment = elements.first
-        do {
-            let dataParser = OpenSSHReader(data: decoded)
-            let publicKeyType = try dataParser.readNextChunkAsString() // Theoretically the same as typeString, but
-                .replacingOccurrences(of: "-cert-v01@openssh.com", with: "")
-            _ = try dataParser.readNextChunk() // Nonce
-            let publicKeyCurveName = try dataParser.readNextChunkAsString()
-            let publicKeyData = try dataParser.readNextChunk()
-            let publicKey = OpenSSHCertificate.PublicKey(keyType: publicKeyType, curveName: publicKeyCurveName, data: publicKeyData)
-            let serialNumber = try dataParser.readNextBytes(as: UInt64.self, convertEndianness: true)
-            let role = try dataParser.readNextBytes(as: UInt32.self, convertEndianness: true)
-            _ = role
-            let keyIdentifier = try dataParser.readNextChunkAsString()
-            let principalsReader = try dataParser.readNextChunkAsSubReader()
-            var principals: [String] = []
-            while !principalsReader.done {
-                try principals.append(principalsReader.readNextChunkAsString())
-            }
-            let validAfter = try dataParser.readNextBytes(as: UInt64.self, convertEndianness: true)
-            let validBefore = try dataParser.readNextBytes(as: UInt64.self, convertEndianness: true)
-            let validityRange = Date(timeIntervalSince1970: TimeInterval(validAfter))..<Date(timeIntervalSince1970: TimeInterval(validBefore))
-            let criticalOptionsReader = try dataParser.readNextChunkAsSubReader()
-            var criticalOptions: [String] = []
-            while !criticalOptionsReader.done {
-                let next = try criticalOptionsReader.readNextChunkAsString()
-                if !next.isEmpty {
-                    criticalOptions.append(next)
-                }
-            }
-            let extensionsReader = try dataParser.readNextChunkAsSubReader()
-            var extensions: [String] = []
-            while !extensionsReader.done {
-                let next = try extensionsReader.readNextChunkAsString()
-                if !next.isEmpty {
-                    extensions.append(next)
-                }
-            }
-            _ = try dataParser.readNextChunk() // reserved
-            let signingKeyReader = try dataParser.readNextChunkAsSubReader()
-            let signingKeyType = try signingKeyReader.readNextChunkAsString()
-            let signingKeyCurveName = try signingKeyReader.readNextChunkAsString()
-            let signingKeyData = try signingKeyReader.readNextChunk()
-            let signingKey = OpenSSHCertificate.PublicKey(keyType: signingKeyType, curveName: signingKeyCurveName, data: signingKeyData)
-
-            return OpenSSHCertificate(
-                type: type,
-                name: comment ?? keyIdentifier,
-                data: decoded,
-                publicKey: publicKey,
-                principals: principals,
-                keyID: keyIdentifier,
-                serial: serialNumber,
-                validityRange: validityRange,
-                criticalOptions: criticalOptions,
-                extensions: extensions,
-                signingKey: signingKey,
-            )
-        } catch {
-            throw .parsingFailed
-        }
-    }
-
-}
-
-public enum OpenSSHCertificateError: Error, Codable {
-    case unsupportedType
-    case parsingFailed
-}
@@ -1,70 +0,0 @@
-import Foundation
-
-/// Reads OpenSSH protocol data.
-public final class OpenSSHReader {
-
-    var remaining: Data
-    var done = false
-
-    /// Initialize the reader with an OpenSSH data payload.
-    /// - Parameter data: The data to read.
-    public init(data: Data) {
-        remaining = Data(data)
-        if remaining.count == 0 {
-            done = true
-        }
-    }
-
-    /// Reads the next chunk of data from the playload.
-    /// - Returns: The next chunk of data.
-    public func readNextChunk(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> Data {
-        let length = try readNextBytes(as: UInt32.self, convertEndianness: convertEndianness)
-        guard remaining.count >= length else { throw .beyondBounds }
-        let dataRange = 0..<Int(length)
-        let ret = Data(remaining[dataRange])
-        remaining.removeSubrange(dataRange)
-        if remaining.isEmpty {
-            done = true
-        }
-        return ret
-    }
-
-    public func readNextBytes<T: FixedWidthInteger>(as: T.Type, convertEndianness: Bool = true) throws(OpenSSHReaderError) -> T {
-        let size = MemoryLayout<T>.size
-        guard remaining.count >= size else { throw .beyondBounds }
-        let lengthRange = 0..<size
-        let lengthChunk = remaining[lengthRange]
-        remaining.removeSubrange(lengthRange)
-        if remaining.isEmpty {
-            done = true
-        }
-        let value = unsafe lengthChunk.bytes.unsafeLoad(as: T.self)
-        return convertEndianness ? T(value.bigEndian) : T(value)
-    }
-
-    public func readNextByteAsBool() throws(OpenSSHReaderError) -> Bool {
-        let size = MemoryLayout<Bool>.size
-        guard remaining.count >= size else { throw .beyondBounds }
-        let lengthRange = 0..<size
-        let lengthChunk = remaining[lengthRange]
-        remaining.removeSubrange(lengthRange)
-        if remaining.isEmpty {
-            done = true
-        }
-        return unsafe lengthChunk.bytes.unsafeLoad(as: Bool.self)
-    }
-
-    public func readNextChunkAsString(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> String {
-        try String(decoding: readNextChunk(convertEndianness: convertEndianness), as: UTF8.self)
-    }
-
-    public func readNextChunkAsSubReader(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> OpenSSHReader {
-        OpenSSHReader(data: try readNextChunk(convertEndianness: convertEndianness))
-    }
-
-}
-
-public enum OpenSSHReaderError: Error, Codable {
-    case incorrectFormat
-    case beyondBounds
-}
@@ -1,246 +0,0 @@
-import Foundation
-import OSLog
-import SecretKit
-import CertificateKit
-
-import CryptoKit
-
-public protocol SSHAgentInputParserProtocol {
-
-    func parse(data: Data) async throws -> SSHAgent.Request
-
-}
-
-public struct SSHAgentInputParser: SSHAgentInputParserProtocol {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "InputParser")
-
-    public init() {
-        assert(Bundle.main.bundleURL.pathExtension == "xpc" || ProcessInfo.processInfo.processName == "xctest", "Potentially unsafe parsing code should run in an XPC service")
-    }
-
-    public func parse(data: Data) throws(AgentParsingError) -> SSHAgent.Request {
-        logger.debug("Parsing new data")
-        guard data.count > 4 else {
-            throw .invalidData
-        }
-        let specifiedLength = unsafe (data[0..<4].bytes.unsafeLoad(as: UInt32.self).bigEndian) + 4
-        let rawRequestInt = data[4]
-        let remainingDataRange = 5..<min(Int(specifiedLength), data.count)
-        lazy var body: Data = { Data(data[remainingDataRange]) }()
-        switch rawRequestInt {
-        case SSHAgent.Request.requestIdentities.protocolID:
-            return .requestIdentities
-        case SSHAgent.Request.signRequest(.empty).protocolID:
-            do {
-                return .signRequest(try signatureRequestContext(from: body))
-            } catch {
-                throw .openSSHReader(error)
-            }
-        case SSHAgent.Request.addIdentity.protocolID:
-            return .addIdentity
-        case SSHAgent.Request.removeIdentity.protocolID:
-            return .removeIdentity
-        case SSHAgent.Request.removeAllIdentities.protocolID:
-            return .removeAllIdentities
-        case SSHAgent.Request.addIDConstrained.protocolID:
-            return .addIDConstrained
-        case SSHAgent.Request.addSmartcardKey.protocolID:
-            return .addSmartcardKey
-        case SSHAgent.Request.removeSmartcardKey.protocolID:
-            return .removeSmartcardKey
-        case SSHAgent.Request.lock.protocolID:
-            return .lock
-        case SSHAgent.Request.unlock.protocolID:
-            return .unlock
-        case SSHAgent.Request.addSmartcardKeyConstrained.protocolID:
-            return .addSmartcardKeyConstrained
-        case SSHAgent.Request.protocolExtension(.empty).protocolID:
-            return .protocolExtension(try protocolExtension(from: body))
-        default:
-            return .unknown(rawRequestInt)
-        }
-    }
-
-}
-
-extension SSHAgentInputParser {
-
-    private enum Constants {
-        static let userAuthMagic: UInt8 = 50 // SSH2_MSG_USERAUTH_REQUEST
-        static let sshSigMagic = Data("SSHSIG".utf8)
-    }
-
-    func signatureRequestContext(from data: Data) throws(OpenSSHReaderError) -> SSHAgent.Request.SignatureRequestContext {
-        let reader = OpenSSHReader(data: data)
-        let rawKeyBlob = try reader.readNextChunk()
-        let keyBlob = certificatePublicKeyBlob(from: rawKeyBlob) ?? rawKeyBlob
-        let rawPayload = try reader.readNextChunk()
-        let payload: SSHAgent.Request.SignatureRequestContext.SignaturePayload
-        do {
-            if rawPayload.count > 6 && rawPayload[0..<6] == Constants.sshSigMagic {
-                payload = .init(raw: rawPayload, decoded: .sshSig(try sshSigPayload(from: rawPayload[6...])))
-            } else {
-                payload = .init(raw: rawPayload, decoded: .sshConnection(try sshConnectionPayload(from: rawPayload)))
-            }
-        } catch {
-            payload = .init(raw: rawPayload, decoded: nil)
-        }
-        return SSHAgent.Request.SignatureRequestContext(keyBlob: keyBlob, dataToSign: payload)
-    }
-
-    func sshSigPayload(from data: Data) throws(OpenSSHReaderError) -> SSHAgent.Request.SignatureRequestContext.SignaturePayload.DecodedPayload.SSHSigPayload {
-        // https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.sshsig#L79
-        let payloadReader = OpenSSHReader(data: data)
-        let namespace = try payloadReader.readNextChunkAsString()
-        _ = try payloadReader.readNextChunk() // reserved
-        let hashAlgorithm = try payloadReader.readNextChunkAsString()
-        let hash = try payloadReader.readNextChunk()
-        return .init(
-            namespace: namespace,
-            hashAlgorithm: hashAlgorithm,
-            hash: hash
-        )
-    }
-
-    func sshConnectionPayload(from data: Data) throws(OpenSSHReaderError) -> SSHAgent.Request.SignatureRequestContext.SignaturePayload.DecodedPayload.SSHConnectionPayload {
-        let payloadReader = OpenSSHReader(data: data)
-        _ = try payloadReader.readNextChunk()
-        let magic = try payloadReader.readNextBytes(as: UInt8.self, convertEndianness: false)
-        guard magic == Constants.userAuthMagic else { throw .incorrectFormat }
-        let username = try payloadReader.readNextChunkAsString()
-        _ = try payloadReader.readNextChunkAsString() // "ssh-connection"
-        _ = try payloadReader.readNextChunkAsString() // "publickey-hostbound-v00@openssh.com"
-        let hasSignature = try payloadReader.readNextByteAsBool()
-        let algorithm = try payloadReader.readNextChunkAsString()
-        let publicKeyReader = try payloadReader.readNextChunkAsSubReader()
-        _ = try publicKeyReader.readNextChunk()
-        _ = try publicKeyReader.readNextChunk()
-        let publicKey = try publicKeyReader.readNextChunk()
-        let hostKeyReader = try payloadReader.readNextChunkAsSubReader()
-        _ = try hostKeyReader.readNextChunk()
-        let hostKey = try hostKeyReader.readNextChunk()
-        return .init(
-            username: username,
-            hasSignature: hasSignature,
-            publicKeyAlgorithm: algorithm,
-            publicKey: publicKey,
-            hostKey: hostKey,
-        )
-    }
-
-    func protocolExtension(from data: Data) throws(AgentParsingError) -> SSHAgent.ProtocolExtension {
-        do {
-            let reader = OpenSSHReader(data: data)
-            let nameRaw = try reader.readNextChunkAsString()
-            let nameSplit = nameRaw.split(separator: "@")
-            guard nameSplit.count == 2 else {
-                throw AgentParsingError.invalidData
-            }
-            let (name, domain) = (nameSplit[0], nameSplit[1])
-            switch domain {
-            case SSHAgent.ProtocolExtension.OpenSSHExtension.domain:
-                switch name {
-                case SSHAgent.ProtocolExtension.OpenSSHExtension.sessionBind(.empty).name:
-                    let hostkeyBlob = try reader.readNextChunkAsSubReader()
-                    let hostKeyType = try hostkeyBlob.readNextChunkAsString()
-                    let hostKeyData = try hostkeyBlob.readNextChunk()
-                    let sessionID = try reader.readNextChunk()
-                    let signatureBlob = try reader.readNextChunkAsSubReader()
-                    _ = try signatureBlob.readNextChunk() // key type again
-                    let signature = try signatureBlob.readNextChunk()
-                    let forwarding = try reader.readNextByteAsBool()
-                    switch hostKeyType {
-                    case "ssh-ed25519":
-                        let hostKey = try CryptoKit.Curve25519.Signing.PublicKey(rawRepresentation: hostKeyData)
-                        guard hostKey.isValidSignature(signature, for: sessionID) else {
-                            throw AgentParsingError.incorrectSignature
-                        }
-                    case "ecdsa-sha2-nistp256":
-                        let hostKey = try CryptoKit.P256.Signing.PublicKey(rawRepresentation: hostKeyData)
-                        guard hostKey.isValidSignature(try .init(rawRepresentation: signature), for: sessionID) else {
-                            throw AgentParsingError.incorrectSignature
-                        }
-                    case "ecdsa-sha2-nistp384":
-                        let hostKey = try CryptoKit.P384.Signing.PublicKey(rawRepresentation: hostKeyData)
-                        guard hostKey.isValidSignature(try .init(rawRepresentation: signature), for: sessionID) else {
-                            throw AgentParsingError.incorrectSignature
-                        }
-                    case "ssh-mldsa-65":
-                        if #available(macOS 26.0, *) {
-                            let hostKey = try CryptoKit.MLDSA65.PublicKey(rawRepresentation: hostKeyData)
-                            guard hostKey.isValidSignature(signature, for: sessionID) else {
-                                throw AgentParsingError.incorrectSignature
-                            }
-                        } else {
-                            throw AgentParsingError.unhandledRequest
-                        }
-                    case "ssh-mldsa-87":
-                        if #available(macOS 26.0, *) {
-                            let hostKey = try CryptoKit.MLDSA65.PublicKey(rawRepresentation: hostKeyData)
-                            guard hostKey.isValidSignature(signature, for: sessionID) else {
-                                throw AgentParsingError.incorrectSignature
-                            }
-                        } else {
-                            throw AgentParsingError.unhandledRequest
-                        }
-                    case "ssh-rsa":
-                        throw AgentParsingError.unhandledRequest
-                    default:
-                        throw AgentParsingError.unhandledRequest
-                    }
-                    let context = SSHAgent.ProtocolExtension.OpenSSHExtension.SessionBindContext(
-                        hostKey: hostKeyData,
-                        sessionID: sessionID,
-                        signature: signature,
-                        forwarding: forwarding
-                    )
-                    return .openSSH(.sessionBind(context))
-                default:
-                    return .openSSH(.unknown(String(name)))
-                }
-            default:
-                return .unknown(nameRaw)
-            }
-
-        } catch let error as OpenSSHReaderError {
-            throw .openSSHReader(error)
-        } catch let error as AgentParsingError {
-            throw error
-        } catch {
-            throw .unknownRequest
-        }
-    }
-
-    func certificatePublicKeyBlob(from hash: Data) -> Data? {
-        let reader = OpenSSHReader(data: hash)
-        do {
-            let certType = try reader.readNextChunkAsString()
-            guard let certType = OpenSSHCertificate.CertificateType(rawValue: certType) else { return nil }
-            _ = try reader.readNextChunk() // nonce
-            let curveIdentifier = try reader.readNextChunk()
-            let publicKey = try reader.readNextChunk()
-            let openSSHIdentifier = certType.keyIdentifier
-            return openSSHIdentifier.lengthAndData +
-            curveIdentifier.lengthAndData +
-                publicKey.lengthAndData
-            
-        } catch {
-            return nil
-        }
-    }
-
-}
-
-
-extension SSHAgentInputParser {
-
-    public enum AgentParsingError: Error, Codable {
-        case unknownRequest
-        case unhandledRequest
-        case invalidData
-        case incorrectSignature
-        case openSSHReader(OpenSSHReaderError)
-    }
-
-}
@@ -1,76 +0,0 @@
-import Foundation
-
-// Extensions, as defined in https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.agent
-
-extension SSHAgent {
-
-    public enum ProtocolExtension: CustomDebugStringConvertible, Codable, Sendable {
-        case openSSH(OpenSSHExtension)
-        case unknown(String)
-
-        public var debugDescription: String {
-            switch self {
-            case let .openSSH(protocolExtension):
-                protocolExtension.debugDescription
-            case .unknown(let string):
-                "Unknown (\(string))"
-            }
-        }
-
-        public static var empty: ProtocolExtension {
-            .unknown("empty")
-        }
-
-        private struct ProtocolExtensionParsingError: Error {}
-
-    }
-
-}
-
-extension SSHAgent.ProtocolExtension {
-
-    public enum OpenSSHExtension: CustomDebugStringConvertible, Codable, Sendable {
-        case sessionBind(SessionBindContext)
-        case unknown(String)
-
-        public static var domain: String {
-            "openssh.com"
-        }
-
-        public var name: String {
-            switch self {
-            case .sessionBind:
-                "session-bind"
-            case .unknown(let name):
-                name
-            }
-        }
-
-        public var debugDescription: String {
-            "\(name)@\(OpenSSHExtension.domain)"
-        }
-    }
-
-}
-
-extension SSHAgent.ProtocolExtension.OpenSSHExtension {
-
-    public struct SessionBindContext: Codable, Sendable {
-
-        public let hostKey: Data
-        public let sessionID: Data
-        public let signature: Data
-        public let forwarding: Bool
-
-        public init(hostKey: Data, sessionID: Data, signature: Data, forwarding: Bool) {
-            self.hostKey = hostKey
-            self.sessionID = sessionID
-            self.signature = signature
-            self.forwarding = forwarding
-        }
-
-        public static let empty = SessionBindContext(hostKey: Data(), sessionID: Data(), signature: Data(), forwarding: false)
-
-    }
-
-}
@@ -2,43 +2,36 @@ import Foundation
 import CryptoKit
 import OSLog
 import SecretKit
-import CertificateKit
 import AppKit
-import SSHProtocolKit

 /// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores.
 public final class Agent: Sendable {

    private let storeList: SecretStoreList
-    private let certificateStore: CertificateStore
    private let witness: SigningWitness?
    private let publicKeyWriter = OpenSSHPublicKeyWriter()
    private let signatureWriter = OpenSSHSignatureWriter()
+    private let certificateHandler = OpenSSHCertificateHandler()
    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "Agent")

-    @MainActor private var sessionID: SSHAgent.ProtocolExtension.OpenSSHExtension.SessionBindContext?
-
    /// Initializes an agent with a store list and a witness.
    /// - Parameters:
    ///   - storeList: The `SecretStoreList` to make available.
    ///   - witness: A witness to notify of requests.
-    public init(storeList: SecretStoreList, certificateStore: CertificateStore, witness: SigningWitness? = nil) {
+    public init(storeList: SecretStoreList, witness: SigningWitness? = nil) {
        logger.debug("Agent is running")
        self.storeList = storeList
-        self.certificateStore = certificateStore
        self.witness = witness
+        Task { @MainActor in
+            await certificateHandler.reloadCertificates(for: storeList.allSecrets)
+        }
    }
    
 }

 extension Agent {

-    public func handle(
-        request: SSHAgent.Request,
-        provenance: SigningRequestProvenance,
-        hosts: [Data: String]?
-    ) async -> Data {
-        logger.debug("Agent received request of type \(request.debugDescription)")
+    public func handle(request: SSHAgent.Request, provenance: SigningRequestProvenance) async -> Data {
        // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
        await reloadSecretsIfNeccessary()
        var response = Data()
@@ -49,58 +42,11 @@ extension Agent {
                response.append(await identities())
                logger.debug("Agent returned \(SSHAgent.Response.agentIdentitiesAnswer.debugDescription)")
            case .signRequest(let context):
-                let target: SigningRequestTarget?
-                switch context.dataToSign.decoded {
-                case .sshConnection(let payload):
-                    target = .connection(
-                        .init(
-                            username: payload.username,
-                            hasSignature: payload.hasSignature,
-                            publicKeyAlgorithm: payload.publicKeyAlgorithm,
-                            publicKey: payload.publicKey,
-                            hostKey: payload.hostKey,
-                            host: hosts?[payload.hostKey]
-                        )
-                    )
-                    if let boundSession = await sessionID {
-                        guard payload.hostKey == boundSession.hostKey else {
-                            logger.error("Agent received bind request, but host key does not match signature request host key.")
-                            throw BindingFailure()
-                        }
-                    }
-                case .sshSig(let payload):
-                    target = .signature(
-                        .init(
-                            namespace: payload.namespace,
-                            hashAlgorithm: payload.hashAlgorithm,
-                            hash: payload.hash
-                        )
-                    )
-                default:
-                    target = nil
-                }
-                _ = target
                response.append(SSHAgent.Response.agentSignResponse.data)
-                response.append(try await sign(data: context.dataToSign.raw, keyBlob: context.keyBlob, provenance: provenance, target: target))
+                response.append(try await sign(data: context.dataToSign, keyBlob: context.keyBlob, provenance: provenance))
                logger.debug("Agent returned \(SSHAgent.Response.agentSignResponse.debugDescription)")
-            case .protocolExtension(.openSSH(.sessionBind(let bind))):
-                // This is disabled until forward enforcement is handled.
-                _ = bind
-                response = try await MainActor.run {
-                    logger.debug("Agent received bind request but not currently supported.")
-                    throw UnhandledRequestError()
-//                    guard sessionID == nil else {
-//                        logger.error("Agent received bind request, but already bound.")
-//                        throw BindingFailure()
-//                    }
-//                    logger.debug("Agent bound")
-//                    sessionID = bind
-//                    return SSHAgent.Response.agentSuccess.data
-                }
-                logger.debug("Agent returned \(SSHAgent.Response.agentSuccess.debugDescription)")
            case .unknown(let value):
                logger.error("Agent received unknown request of type \(value).")
-                throw UnhandledRequestError()
            default:
                logger.debug("Agent received valid request of type \(request.debugDescription), but not currently supported.")
                throw UnhandledRequestError()
@@ -120,6 +66,7 @@ extension Agent {
    /// - Returns: An OpenSSH formatted Data payload listing the identities available for signing operations.
    func identities() async -> Data {
        let secrets = await storeList.allSecrets
+        await certificateHandler.reloadCertificates(for: secrets)
        var count = 0
        var keyData = Data()

@@ -128,9 +75,10 @@ extension Agent {
            keyData.append(keyBlob.lengthAndData)
            keyData.append(publicKeyWriter.comment(secret: secret).lengthAndData)
            count += 1
-            for certificate in await certificateStore.certificates(for: secret) {
-                keyData.append(certificate.data.lengthAndData)
-                keyData.append(certificate.name.lengthAndData)
+
+            if let (certificateData, name) = try? await certificateHandler.keyBlobAndName(for: secret) {
+                keyData.append(certificateData.lengthAndData)
+                keyData.append(name.lengthAndData)
                count += 1
            }
        }
@@ -145,21 +93,19 @@ extension Agent {
    ///   - data: The data to sign.
    ///   - provenance: A ``SecretKit.SigningRequestProvenance`` object describing the origin of the request.
    /// - Returns: An OpenSSH formatted Data payload containing the signed data response.
-    func sign(data: Data, keyBlob: Data, provenance: SigningRequestProvenance, target: SigningRequestTarget?) async throws -> Data {
+    func sign(data: Data, keyBlob: Data, provenance: SigningRequestProvenance) async throws -> Data {
        guard let (secret, store) = await secret(matching: keyBlob) else {
-            let keyBlobHex = keyBlob.formatted(.hex())
+            let keyBlobHex = keyBlob.compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }.joined()
            logger.debug("Agent did not have a key matching \(keyBlobHex)")
            throw NoMatchingKeyError()
        }

-        try evaluateRestrictions(secret.attributes.restrictions, from: provenance, for: target)
+        try await witness?.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)

-        try await witness?.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance, target: target)
-
-        let rawRepresentation = try await store.sign(data: data, with: secret, for: provenance, target: target)
+        let rawRepresentation = try await store.sign(data: data, with: secret, for: provenance)
        let signedData = signatureWriter.data(secret: secret, signature: rawRepresentation)

-        try await witness?.witness(accessTo: secret, from: store, by: provenance, target: target)
+        try await witness?.witness(accessTo: secret, from: store, by: provenance)

        logger.debug("Agent signed request")

@@ -168,22 +114,6 @@ extension Agent {

 }

-extension Agent {
-
-    func evaluateRestrictions(_ restrictions: Restrictions?, from provenance: SigningRequestProvenance, for target: SigningRequestTarget?) throws(RestrictionError) {
-        guard let restrictions else { return }
-        print(restrictions)
-        throw .connectionsNotPermitted
-    }
-
-    enum RestrictionError: Error {
-        case signingNotPermitted
-        case connectionsNotPermitted
-        case hostNotAllowed(String)
-    }
-
-}
-
 extension Agent {

    /// Gives any store with no loaded secrets a chance to reload.
@@ -213,7 +143,6 @@ extension Agent {

    struct NoMatchingKeyError: Error {}
    struct UnhandledRequestError: Error {}
-    struct BindingFailure: Error {}

 }

@@ -0,0 +1,88 @@
+import Foundation
+import OSLog
+import SecretKit
+
+/// Manages storage and lookup for OpenSSH certificates.
+public actor OpenSSHCertificateHandler: Sendable {
+
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: URL.homeDirectory)
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler")
+    private let writer = OpenSSHPublicKeyWriter()
+    private var keyBlobsAndNames: [AnySecret: (Data, Data)] = [:]
+
+    /// Initializes an OpenSSHCertificateHandler.
+    public init() {
+    }
+
+    /// Reloads any certificates in the PublicKeys folder.
+    /// - Parameter secrets: the secrets to look up corresponding certificates for.
+    public func reloadCertificates(for secrets: [AnySecret]) {
+        guard publicKeyFileStoreController.hasAnyCertificates else {
+            logger.log("No certificates, short circuiting")
+            return
+        }
+        keyBlobsAndNames = secrets.reduce(into: [:]) { partialResult, next in
+            partialResult[next] = try? loadKeyblobAndName(for: next)
+        }
+    }
+
+    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
+    /// - Parameter secret: The secret to search for a certificate with
+    /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
+    public func keyBlobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? {
+        keyBlobsAndNames[AnySecret(secret)]
+    }
+    
+    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
+    /// - Parameter secret: The secret to search for a certificate with
+    /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
+    private func loadKeyblobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? {
+        let certificatePath = publicKeyFileStoreController.sshCertificatePath(for: secret)
+        guard FileManager.default.fileExists(atPath: certificatePath) else {
+            return nil
+        }
+
+        logger.debug("Found certificate for \(secret.name)")
+        let certContent = try String(contentsOfFile:certificatePath, encoding: .utf8)
+        let certElements = certContent.trimmingCharacters(in: .whitespacesAndNewlines).components(separatedBy: " ")
+
+        guard certElements.count >= 2 else {
+            logger.warning("Certificate found for \(secret.name) but failed to load")
+            throw OpenSSHCertificateError.parsingFailed
+        }
+        guard let certDecoded = Data(base64Encoded: certElements[1] as String)  else {
+            logger.warning("Certificate found for \(secret.name) but failed to decode base64 key")
+            throw OpenSSHCertificateError.parsingFailed
+        }
+
+        if certElements.count >= 3 {
+            let certName = Data(certElements[2].utf8)
+            return (certDecoded, certName)
+        }
+        let certName = Data(secret.name.utf8)
+        logger.info("Certificate for \(secret.name) does not have a name tag, using secret name instead")
+        return (certDecoded, certName)
+    }
+
+}
+
+extension OpenSSHCertificateHandler {
+
+    enum OpenSSHCertificateError: LocalizedError {
+        case unsupportedType
+        case parsingFailed
+        case doesNotExist
+
+        public var errorDescription: String? {
+            switch self {
+            case .unsupportedType:
+                return "The key type was unsupported"
+            case .parsingFailed:
+                return "Failed to properly parse the SSH certificate"
+            case .doesNotExist:
+                return "Certificate does not exist"
+            }
+        }
+    }
+
+}
@@ -0,0 +1,47 @@
+import Foundation
+
+/// Reads OpenSSH protocol data.
+final class OpenSSHReader {
+
+    var remaining: Data
+
+    /// Initialize the reader with an OpenSSH data payload.
+    /// - Parameter data: The data to read.
+    init(data: Data) {
+        remaining = Data(data)
+    }
+
+    /// Reads the next chunk of data from the playload.
+    /// - Returns: The next chunk of data.
+    func readNextChunk(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> Data {
+        let littleEndianLength = try readNextBytes(as: UInt32.self)
+        let length = convertEndianness ? Int(littleEndianLength.bigEndian) : Int(littleEndianLength)
+        guard remaining.count >= length else { throw .beyondBounds }
+        let dataRange = 0..<length
+        let ret = Data(remaining[dataRange])
+        remaining.removeSubrange(dataRange)
+        return ret
+    }
+
+    func readNextBytes<T>(as: T.Type) throws(OpenSSHReaderError) -> T {
+        let size = MemoryLayout<T>.size
+        guard remaining.count >= size else { throw .beyondBounds }
+        let lengthRange = 0..<size
+        let lengthChunk = remaining[lengthRange]
+        remaining.removeSubrange(lengthRange)
+        return unsafe lengthChunk.bytes.unsafeLoad(as: T.self)
+    }
+
+    func readNextChunkAsString(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> String {
+        try String(decoding: readNextChunk(convertEndianness: convertEndianness), as: UTF8.self)
+    }
+
+    func readNextChunkAsSubReader(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> OpenSSHReader {
+        OpenSSHReader(data: try readNextChunk(convertEndianness: convertEndianness))
+    }
+
+}
+
+public enum OpenSSHReaderError: Error, Codable {
+    case beyondBounds
+}
@@ -1,83 +0,0 @@
-import Foundation
-import OSLog
-import SecretKit
-import SSHProtocolKit
-import CertificateKit
-import Common
-
-/// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts.
-public final class PublicKeyFileStoreController: Sendable {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController")
-    private let publicKeysURL: URL
-    private let certificatesURL: URL
-    private let keyWriter = OpenSSHPublicKeyWriter()
-
-    /// Initializes a PublicKeyFileStoreController.
-    public init(publicKeysURL: URL, certificatesURL: URL) {
-        self.publicKeysURL = publicKeysURL
-        self.certificatesURL = certificatesURL
-    }
-
-    /// Writes out the keys specified to disk.
-    /// - Parameter secrets: The Secrets to generate keys for.
-    /// - Parameter clear: Whether or not any untracked files in the directory should be removed.
-    public func generatePublicKeys(for secrets: [AnySecret], clear: Bool = false) throws {
-        logger.log("Writing public keys to disk")
-        if clear {
-            let validPaths = Set(secrets.map { URL.publicKeyPath(for: $0, in: publicKeysURL) })
-                .union(Set(secrets.map { legacySSHCertificatePath(for: $0) }))
-            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: publicKeysURL.path())) ?? []
-            let fullPathContents = contentsOfDirectory.map { publicKeysURL.appending(path: $0).path() }
-
-            let untracked = Set(fullPathContents)
-                .subtracting(validPaths)
-            for path in untracked {
-                // string instead of fileURLWithPath since we're already using fileURL format.
-                try? FileManager.default.removeItem(at: URL(string: path)!)
-            }
-        }
-        try? FileManager.default.createDirectory(at: publicKeysURL, withIntermediateDirectories: false, attributes: nil)
-        for secret in secrets {
-            let path = URL.publicKeyPath(for: secret, in: publicKeysURL)
-            let data = Data(keyWriter.openSSHString(secret: secret).utf8)
-            FileManager.default.createFile(atPath: path, contents: data, attributes: nil)
-        }
-        logger.log("Finished writing public keys")
-    }
-
-    /// Writes out the certificates specified to disk.
-    /// - Parameter certificates: The Secrets to generate keys for.
-    /// - Parameter clear: Whether or not any untracked files in the directory should be removed.
-    public func generateCertificates(for certificates: [Certificate], clear: Bool = false) throws {
-        logger.log("Writing certificates to disk")
-        if clear {
-            let validPaths = Set(certificates.map { URL.certificatePath(for: $0.id, in: certificatesURL) })
-            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: certificatesURL.path())) ?? []
-            let fullPathContents = contentsOfDirectory.map { certificatesURL.appending(path: $0).path() }
-
-            let untracked = Set(fullPathContents)
-                .subtracting(validPaths)
-            for path in untracked {
-                // string instead of fileURLWithPath since we're already using fileURL format.
-                try? FileManager.default.removeItem(at: URL(string: path)!)
-            }
-        }
-        try? FileManager.default.createDirectory(at: certificatesURL, withIntermediateDirectories: false, attributes: nil)
-        for certificate in certificates {
-            let path = URL.certificatePath(for: certificate.id, in: certificatesURL)
-            FileManager.default.createFile(atPath: path, contents: certificate.rawData, attributes: nil)
-        }
-        logger.log("Finished writing certificates")
-    }
-
-    /// The path for a Secret's SSH Certificate public key.
-    /// - Parameter secret: The Secret to return the path for.
-    /// - Returns: The path to the SSH Certificate public key.
-    /// - Warning: This method returning a path does not imply that a key has a SSH certificates. This method only describes where it will be.
-    private func legacySSHCertificatePath<SecretType: Secret>(for secret: SecretType) -> String {
-        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
-        return publicKeysURL.appending(component: "\(minimalHex).pub").path()
-    }
-
-}
@@ -0,0 +1,109 @@
+import Foundation
+import OSLog
+import SecretKit
+
+public protocol SSHAgentInputParserProtocol {
+
+    func parse(data: Data) async throws -> SSHAgent.Request
+    
+}
+
+public struct SSHAgentInputParser: SSHAgentInputParserProtocol {
+
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "InputParser")
+
+    public init() {
+        
+    }
+
+    public func parse(data: Data) throws(AgentParsingError) -> SSHAgent.Request {
+        logger.debug("Parsing new data")
+        guard data.count > 4 else {
+            throw .invalidData
+        }
+        let specifiedLength = unsafe (data[0..<4].bytes.unsafeLoad(as: UInt32.self).bigEndian) + 4
+        let rawRequestInt = data[4]
+        let remainingDataRange = 5..<min(Int(specifiedLength), data.count)
+        lazy var body: Data = { Data(data[remainingDataRange]) }()
+        switch rawRequestInt {
+        case SSHAgent.Request.requestIdentities.protocolID:
+            return .requestIdentities
+        case SSHAgent.Request.signRequest(.empty).protocolID:
+            do {
+                return .signRequest(try signatureRequestContext(from: body))
+            } catch {
+                throw .openSSHReader(error)
+            }
+        case SSHAgent.Request.addIdentity.protocolID:
+            return .addIdentity
+        case SSHAgent.Request.removeIdentity.protocolID:
+            return .removeIdentity
+        case SSHAgent.Request.removeAllIdentities.protocolID:
+            return .removeAllIdentities
+        case SSHAgent.Request.addIDConstrained.protocolID:
+            return .addIDConstrained
+        case SSHAgent.Request.addSmartcardKey.protocolID:
+            return .addSmartcardKey
+        case SSHAgent.Request.removeSmartcardKey.protocolID:
+            return .removeSmartcardKey
+        case SSHAgent.Request.lock.protocolID:
+            return .lock
+        case SSHAgent.Request.unlock.protocolID:
+            return .unlock
+        case SSHAgent.Request.addSmartcardKeyConstrained.protocolID:
+            return .addSmartcardKeyConstrained
+        case SSHAgent.Request.protocolExtension.protocolID:
+            return .protocolExtension
+        default:
+            return .unknown(rawRequestInt)
+        }
+    }
+
+}
+
+extension SSHAgentInputParser {
+
+    func signatureRequestContext(from data: Data) throws(OpenSSHReaderError) -> SSHAgent.Request.SignatureRequestContext {
+        let reader = OpenSSHReader(data: data)
+        let rawKeyBlob = try reader.readNextChunk()
+        let keyBlob = certificatePublicKeyBlob(from: rawKeyBlob) ?? rawKeyBlob
+        let dataToSign = try reader.readNextChunk()
+        return SSHAgent.Request.SignatureRequestContext(keyBlob: keyBlob, dataToSign: dataToSign)
+    }
+
+    func certificatePublicKeyBlob(from hash: Data) -> Data? {
+        let reader = OpenSSHReader(data: hash)
+        do {
+            let certType = String(decoding: try reader.readNextChunk(), as: UTF8.self)
+            switch certType {
+            case "ecdsa-sha2-nistp256-cert-v01@openssh.com",
+                "ecdsa-sha2-nistp384-cert-v01@openssh.com",
+                "ecdsa-sha2-nistp521-cert-v01@openssh.com":
+                _ = try reader.readNextChunk() // nonce
+                let curveIdentifier = try reader.readNextChunk()
+                let publicKey = try reader.readNextChunk()
+                let openSSHIdentifier = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "")
+                return openSSHIdentifier.lengthAndData +
+                curveIdentifier.lengthAndData +
+                publicKey.lengthAndData
+            default:
+                return nil
+            }
+        } catch {
+            return nil
+        }
+    }
+
+}
+
+
+extension SSHAgentInputParser {
+
+    public enum AgentParsingError: Error, Codable {
+        case unknownRequest
+        case unhandledRequest
+        case invalidData
+        case openSSHReader(OpenSSHReaderError)
+    }
+
+}
@@ -19,7 +19,7 @@ extension SSHAgent {
        case lock
        case unlock
        case addSmartcardKeyConstrained
-        case protocolExtension(ProtocolExtension)
+        case protocolExtension
        case unknown(UInt8)

        public var protocolID: UInt8 {
@@ -60,82 +60,18 @@ extension SSHAgent {

        public struct SignatureRequestContext: Sendable, Codable {
            public let keyBlob: Data
-            public let dataToSign: SignaturePayload
+            public let dataToSign: Data

-            public init(keyBlob: Data, dataToSign: SignaturePayload) {
+            public init(keyBlob: Data, dataToSign: Data) {
                self.keyBlob = keyBlob
                self.dataToSign = dataToSign
            }

            public static var empty: SignatureRequestContext {
-                SignatureRequestContext(keyBlob: Data(), dataToSign: SignaturePayload(raw: Data(), decoded: nil))
-            }
-
-            public struct SignaturePayload: Sendable, Codable {
-
-                public let raw: Data
-                public let decoded: DecodedPayload?
-
-                public init(
-                    raw: Data,
-                    decoded: DecodedPayload?
-                ) {
-                    self.raw = raw
-                    self.decoded = decoded
-                }
-
-                public enum DecodedPayload: Sendable, Codable {
-                    case sshConnection(SSHConnectionPayload)
-                    case sshSig(SSHSigPayload)
-
-                    public struct SSHConnectionPayload: Sendable, Codable {
-
-                        public let username: String
-                        public let hasSignature: Bool
-                        public let publicKeyAlgorithm: String
-                        public let publicKey: Data
-                        public let hostKey: Data
-
-                        public init(
-                            username: String,
-                            hasSignature: Bool,
-                            publicKeyAlgorithm: String,
-                            publicKey: Data,
-                            hostKey: Data
-                        ) {
-                            self.username = username
-                            self.hasSignature = hasSignature
-                            self.publicKeyAlgorithm = publicKeyAlgorithm
-                            self.publicKey = publicKey
-                            self.hostKey = hostKey
-                        }
-
-                    }
-
-                    public struct SSHSigPayload: Sendable, Codable {
-
-                        public let namespace: String
-                        public let hashAlgorithm: String
-                        public let hash: Data
-
-                        public init(
-                            namespace: String,
-                            hashAlgorithm: String,
-                            hash: Data,
-                        ) {
-                            self.namespace = namespace
-                            self.hashAlgorithm = hashAlgorithm
-                            self.hash = hash
-                        }
-
-                    }
-                    
-                }
-
+                SignatureRequestContext(keyBlob: Data(), dataToSign: Data())
            }
        }

-
    }

    /// The type of the SSH Agent Response, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
@@ -152,8 +88,8 @@ extension SSHAgent {
            switch self {
            case .agentFailure: "SSH_AGENT_FAILURE"
            case .agentSuccess: "SSH_AGENT_SUCCESS"
-            case .agentIdentitiesAnswer: "SSH2_AGENT_IDENTITIES_ANSWER"
-            case .agentSignResponse: "SSH2_AGENT_SIGN_RESPONSE"
+            case .agentIdentitiesAnswer: "SSH_AGENT_IDENTITIES_ANSWER"
+            case .agentSignResponse: "SSH_AGENT_SIGN_RESPONSE"
            case .agentExtensionFailure: "SSH_AGENT_EXTENSION_FAILURE"
            case .agentExtensionResponse: "SSH_AGENT_EXTENSION_RESPONSE"
            }
@@ -36,7 +36,7 @@ extension SigningRequestTracer {
    /// - Parameter pid: The process ID to look up.
    /// - Returns: A ``SecretKit.SigningRequestProvenance.Process`` describing the process.
    func process(from pid: Int32) -> SigningRequestProvenance.Process {
-        var pidAndNameInfo = unsafe self.pidAndNameInfo(from: pid)
+        var pidAndNameInfo = self.pidAndNameInfo(from: pid)
        let ppid = unsafe pidAndNameInfo.kp_eproc.e_ppid != 0 ? pidAndNameInfo.kp_eproc.e_ppid : nil
        let procName = unsafe withUnsafeMutablePointer(to: &pidAndNameInfo.kp_proc.p_comm.0) { pointer in
            unsafe String(cString: pointer)
@@ -1,6 +1,5 @@
 import Foundation
 import SecretKit
-import SSHProtocolKit

 /// A protocol that allows conformers to be notified of access to secrets, and optionally prevent access.
 public protocol SigningWitness: Sendable {
@@ -11,13 +10,13 @@ public protocol SigningWitness: Sendable {
    ///   - store: The `Store` being asked to sign the request..
    ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
    ///   - Note: This method being called does not imply that the requst has been authorized. If a secret requires authentication, authentication will still need to be performed by the user before the request will be performed. If the user declines or fails to authenticate, the request will fail.
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, target: SigningRequestTarget?) async throws
+    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws

    /// Notifies the callee that a signing operation has been performed for a given secret.
    /// - Parameters:
    ///   - secret: The `Secret` that will was used to sign the request.
    ///   - store: The `Store` that signed the request..
    ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, target: SigningRequestTarget?) async throws
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws

 }
@@ -36,21 +36,16 @@ public struct SocketController {
        logger.debug("Socket controller path is clear")
        port = SocketPort(path: path)
        fileHandle = FileHandle(fileDescriptor: port.socket, closeOnDealloc: true)
-        Task { @MainActor [fileHandle, sessionsContinuation, logger] in
-            // Create the sequence before triggering the notification to
-            // ensure it will not be missed.
-            let connectionAcceptedNotifications = NotificationCenter.default.notifications(named: .NSFileHandleConnectionAccepted)
-
-            fileHandle.acceptConnectionInBackgroundAndNotify()
-
-            for await notification in connectionAcceptedNotifications {
+        Task { [fileHandle, sessionsContinuation, logger] in
+            for await notification in NotificationCenter.default.notifications(named: .NSFileHandleConnectionAccepted) {
                logger.debug("Socket controller accepted connection")
                guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { continue }
                let session = Session(fileHandle: new)
                sessionsContinuation.yield(session)
-                fileHandle.acceptConnectionInBackgroundAndNotify()
+                await fileHandle.acceptConnectionInBackgroundAndNotifyOnMainActor()
            }
        }
+        fileHandle.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.Mode.common])
        logger.debug("Socket listening at \(path)")
    }

@@ -82,32 +77,29 @@ extension SocketController {
            self.fileHandle = fileHandle
            provenance = SigningRequestTracer().provenance(from: fileHandle)
            (messages, messagesContinuation) = AsyncStream.makeStream()
-            Task { @MainActor [messagesContinuation, logger] in
-                // Create the sequence before triggering the notification to
-                // ensure it will not be missed.
-                let dataAvailableNotifications = NotificationCenter.default.notifications(named: .NSFileHandleDataAvailable, object: fileHandle)
-
-                fileHandle.waitForDataInBackgroundAndNotify()
-
-                for await _ in dataAvailableNotifications {
+            Task { [messagesContinuation, logger] in
+                for await _ in NotificationCenter.default.notifications(named: .NSFileHandleDataAvailable, object: fileHandle) {
                    let data = fileHandle.availableData
                    guard !data.isEmpty else {
                        logger.debug("Socket controller received empty data, ending continuation.")
                        messagesContinuation.finish()
-                        try? fileHandle.close()
+                        try fileHandle.close()
                        return
                    }
                    messagesContinuation.yield(data)
                    logger.debug("Socket controller yielded data.")
                }
            }
+            Task {
+                await fileHandle.waitForDataInBackgroundAndNotifyOnMainActor()
+            }
        }
        
        /// Writes new data to the socket.
        /// - Parameter data: The data to write.
-        @MainActor public func write(_ data: Data) throws {
-          try fileHandle.write(contentsOf: data)
-          fileHandle.waitForDataInBackgroundAndNotify()
+        public func write(_ data: Data) async throws {
+            try fileHandle.write(contentsOf: data)
+            await fileHandle.waitForDataInBackgroundAndNotifyOnMainActor()
        }
        
        /// Closes the socket and cleans up resources.
@@ -121,13 +113,29 @@ extension SocketController {

 }

+private extension FileHandle {
+
+    /// Ensures waitForDataInBackgroundAndNotify will be called on the main actor.
+    @MainActor func waitForDataInBackgroundAndNotifyOnMainActor() {
+        waitForDataInBackgroundAndNotify()
+    }
+
+
+    /// Ensures acceptConnectionInBackgroundAndNotify will be called on the main actor.
+    /// - Parameter modes: the runloop modes to use.
+    @MainActor func acceptConnectionInBackgroundAndNotifyOnMainActor(forModes modes: [RunLoop.Mode]? = [RunLoop.Mode.common]) {
+        acceptConnectionInBackgroundAndNotify(forModes: modes)
+    }
+
+}
+
 private extension SocketPort {

    convenience init(path: String) {
        var addr = sockaddr_un()

-        let length = withUnsafeMutablePointer(to: &addr.sun_path.0) { pointer in
-            path.withCString { cstring in
+        let length = unsafe withUnsafeMutablePointer(to: &addr.sun_path.0) { pointer in
+            unsafe path.withCString { cstring in
                let len = unsafe strlen(cstring)
                unsafe strncpy(pointer, cstring, len)
                return len
@@ -1,69 +0,0 @@
-import LocalAuthentication
-
-/// A context describing a persisted authentication.
-package final class PersistentAuthenticationContext<SecretType: Secret>: PersistedAuthenticationContext {
-
-    /// The Secret to persist authentication for.
-    let secret: SecretType
-    /// The LAContext used to authorize the persistent context.
-    package nonisolated(unsafe) let context: LAContext
-    /// An expiration date for the context.
-    /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
-    let monotonicExpiration: UInt64
-
-    /// Initializes a context.
-    /// - Parameters:
-    ///   - secret: The Secret to persist authentication for.
-    ///   - context: The LAContext used to authorize the persistent context.
-    ///   - duration: The duration of the authorization context, in seconds.
-    init(secret: SecretType, context: LAContext, duration: TimeInterval) {
-        self.secret = secret
-        unsafe self.context = context
-        let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
-        self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
-    }
-
-    /// A boolean describing whether or not the context is still valid.
-    package var valid: Bool {
-        clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
-    }
-
-    package var expiration: Date {
-        let remainingNanoseconds = monotonicExpiration - clock_gettime_nsec_np(CLOCK_MONOTONIC)
-        let remainingInSeconds = Measurement(value: Double(remainingNanoseconds), unit: UnitDuration.nanoseconds).converted(to: .seconds).value
-        return Date(timeIntervalSinceNow: remainingInSeconds)
-    }
-}
-
-package actor PersistentAuthenticationHandler<SecretType: Secret>: Sendable {
-
-    private var persistedAuthenticationContexts: [SecretType: PersistentAuthenticationContext<SecretType>] = [:]
-
-    package init() {
-    }
-
-    package func existingPersistedAuthenticationContext(secret: SecretType) -> PersistentAuthenticationContext<SecretType>? {
-        guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
-        return persisted
-    }
-
-    package func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) async throws {
-        let newContext = LAContext()
-        newContext.touchIDAuthenticationAllowableReuseDuration = duration
-        newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-
-        let formatter = DateComponentsFormatter()
-        formatter.unitsStyle = .spellOut
-        formatter.allowedUnits = [.hour, .minute, .day]
-
-
-        let durationString = formatter.string(from: duration)!
-        newContext.localizedReason = String(localized: .authContextPersistForDuration(secretName: secret.name, duration: durationString))
-        let success = try await newContext.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: newContext.localizedReason)
-        guard success else { return }
-        let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
-        persistedAuthenticationContexts[secret] = context
-    }
-
-}
-
@@ -8,7 +8,7 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
    private let _id: @Sendable () -> UUID
    private let _name: @MainActor @Sendable () -> String
    private let _secrets: @MainActor @Sendable () -> [AnySecret]
-    private let _sign: @Sendable (Data, AnySecret, SigningRequestProvenance, SigningRequestTarget?) async throws -> Data
+    private let _sign: @Sendable (Data, AnySecret, SigningRequestProvenance) async throws -> Data
    private let _existingPersistedAuthenticationContext: @Sendable (AnySecret) async -> PersistedAuthenticationContext?
    private let _persistAuthentication: @Sendable (AnySecret, TimeInterval) async throws -> Void
    private let _reloadSecrets: @Sendable () async -> Void
@@ -19,7 +19,7 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
        _name = { secretStore.name }
        _id = { secretStore.id }
        _secrets = { secretStore.secrets.map { AnySecret($0) } }
-        _sign = { try await secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2, target: $3) }
+        _sign = { try await secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
        _existingPersistedAuthenticationContext = { await secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
        _persistAuthentication = { try await secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
        _reloadSecrets = { await secretStore.reloadSecrets() }
@@ -41,8 +41,8 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
        return _secrets()
    }

-    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?) async throws -> Data {
-        try await _sign(data, secret, provenance, target)
+    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) async throws -> Data {
+        try await _sign(data, secret, provenance)
    }

    public func existingPersistedAuthenticationContext(secret: AnySecret) async -> PersistedAuthenticationContext? {
@@ -1,6 +1,5 @@
 import Foundation
 import CryptoKit
-import SecretKit

 /// Generates OpenSSH representations of the public key sof secrets.
 public struct OpenSSHPublicKeyWriter: Sendable {
@@ -19,7 +18,7 @@ public struct OpenSSHPublicKeyWriter: Sendable {
            ("nistp" + String(describing: secret.keyType.size)).lengthAndData +
            secret.publicKey.lengthAndData
        case .mldsa:
-            // https://datatracker.ietf.org/doc/html/draft-sfluhrer-ssh-mldsa-05
+            // https://www.ietf.org/archive/id/draft-sfluhrer-ssh-mldsa-04.txt
            openSSHIdentifier(for: secret.keyType).lengthAndData +
            secret.publicKey.lengthAndData
        case .rsa:
@@ -41,14 +40,18 @@ public struct OpenSSHPublicKeyWriter: Sendable {
    /// - Returns: OpenSSH SHA256 fingerprint string.
    public func openSSHSHA256Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
        // OpenSSL format seems to strip the padding at the end.
-        let cleaned = SHA256.hash(data: data(secret: secret)).formatted(.base64(stripPadding: true))
+        let base64 = Data(SHA256.hash(data: data(secret: secret))).base64EncodedString()
+        let paddingRange = base64.index(base64.endIndex, offsetBy: -2)..<base64.endIndex
+        let cleaned = base64.replacingOccurrences(of: "=", with: "", range: paddingRange)
        return "SHA256:\(cleaned)"
    }

    /// Generates an OpenSSH MD5 fingerprint string.
    /// - Returns: OpenSSH MD5 fingerprint string.
    public func openSSHMD5Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
-        Insecure.MD5.hash(data: data(secret: secret)).formatted(.hex(separator: ":"))
+        Insecure.MD5.hash(data: data(secret: secret))
+            .compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
+            .joined(separator: ":")
    }

    public func comment<SecretType: Secret>(secret: SecretType) -> String {
@@ -1,6 +1,5 @@
 import Foundation
 import CryptoKit
-import SecretKit

 /// Generates OpenSSH representations of Secrets.
 public struct OpenSSHSignatureWriter: Sendable {
@@ -17,7 +16,7 @@ public struct OpenSSHSignatureWriter: Sendable {
            // https://datatracker.ietf.org/doc/html/rfc5656#section-3.1
            ecdsaSignature(signature, keyType: secret.keyType)
        case .mldsa:
-            // https://datatracker.ietf.org/doc/html/draft-sfluhrer-ssh-mldsa-05
+            // https://datatracker.ietf.org/doc/html/draft-sfluhrer-ssh-mldsa-00#name-public-key-algorithms
            mldsaSignature(signature, keyType: secret.keyType)
        case .rsa:
            // https://datatracker.ietf.org/doc/html/rfc4253#section-6.6
@@ -30,28 +29,19 @@ public struct OpenSSHSignatureWriter: Sendable {

 extension OpenSSHSignatureWriter {

-    /// Converts a fixed-width big-endian integer (e.g. r/s from CryptoKit rawRepresentation) into an SSH mpint.
-    /// Strips unnecessary leading zeros and prefixes `0x00` if needed to keep the value positive.
-    private func mpint(fromFixedWidthPositiveBytes bytes: Data) -> Data {
-        // mpint zero is encoded as a string with zero bytes of data.
-        guard let firstNonZeroIndex = bytes.firstIndex(where: { $0 != 0x00 }) else {
-            return Data()
-        }
-
-        let trimmed = Data(bytes[firstNonZeroIndex...])
-
-        if let first = trimmed.first, first >= 0x80 {
-            var prefixed = Data([0x00])
-            prefixed.append(trimmed)
-            return prefixed
-        }
-        return trimmed
-    }
-
    func ecdsaSignature(_ rawRepresentation: Data, keyType: KeyType) -> Data {
        let rawLength = rawRepresentation.count/2
-        let r = mpint(fromFixedWidthPositiveBytes: Data(rawRepresentation[0..<rawLength]))
-        let s = mpint(fromFixedWidthPositiveBytes: Data(rawRepresentation[rawLength...]))
+        // Check if we need to pad with 0x00 to prevent certain
+        // ssh servers from thinking r or s is negative
+        let paddingRange: ClosedRange<UInt8> = 0x80...0xFF
+        var r = Data(rawRepresentation[0..<rawLength])
+        if paddingRange ~= r.first! {
+            r.insert(0x00, at: 0)
+        }
+        var s = Data(rawRepresentation[rawLength...])
+        if paddingRange ~= s.first! {
+            s.insert(0x00, at: 0)
+        }

        var signatureChunk = Data()
        signatureChunk.append(r.lengthAndData)
@@ -0,0 +1,73 @@
+import Foundation
+import OSLog
+
+/// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts.
+public final class PublicKeyFileStoreController: Sendable {
+
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController")
+    private let directory: URL
+    private let keyWriter = OpenSSHPublicKeyWriter()
+
+    /// Initializes a PublicKeyFileStoreController.
+    public init(homeDirectory: URL) {
+        directory = homeDirectory.appending(component: "PublicKeys")
+    }
+
+    /// Writes out the keys specified to disk.
+    /// - Parameter secrets: The Secrets to generate keys for.
+    /// - Parameter clear: Whether or not any untracked files in the directory should be removed.
+    public func generatePublicKeys(for secrets: [AnySecret], clear: Bool = false) throws {
+        logger.log("Writing public keys to disk")
+        if clear {
+            let validPaths = Set(secrets.map { publicKeyPath(for: $0) })
+                .union(Set(secrets.map { sshCertificatePath(for: $0) }))
+            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: directory.path())) ?? []
+            let fullPathContents = contentsOfDirectory.map { directory.appending(path: $0).path() }
+
+            let untracked = Set(fullPathContents)
+                .subtracting(validPaths)
+            for path in untracked {
+                // string instead of fileURLWithPath since we're already using fileURL format.
+                try? FileManager.default.removeItem(at: URL(string: path)!)
+            }
+        }
+        try? FileManager.default.createDirectory(at: directory, withIntermediateDirectories: false, attributes: nil)
+        for secret in secrets {
+            let path = publicKeyPath(for: secret)
+            let data = Data(keyWriter.openSSHString(secret: secret).utf8)
+            FileManager.default.createFile(atPath: path, contents: data, attributes: nil)
+        }
+        logger.log("Finished writing public keys")
+    }
+
+    /// The path for a Secret's public key.
+    /// - Parameter secret: The Secret to return the path for.
+    /// - Returns: The path to the Secret's public key.
+    /// - Warning: This method returning a path does not imply that a key has been written to disk already. This method only describes where it will be written to.
+    public func publicKeyPath<SecretType: Secret>(for secret: SecretType) -> String {
+        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        return directory.appending(component: "\(minimalHex).pub").path()
+    }
+
+    /// Short-circuit check to ship enumerating a bunch of paths if there's nothing in the cert directory.
+    public var hasAnyCertificates: Bool {
+        do {
+            return try FileManager.default
+                .contentsOfDirectory(atPath: directory.path())
+                .filter { $0.hasSuffix("-cert.pub") }
+                .isEmpty == false
+        } catch {
+            return false
+        }
+    }
+
+    /// The path for a Secret's SSH Certificate public key.
+    /// - Parameter secret: The Secret to return the path for.
+    /// - Returns: The path to the SSH Certificate public key.
+    /// - Warning: This method returning a path does not imply that a key has a SSH certificates. This method only describes where it will be.
+    public func sshCertificatePath<SecretType: Secret>(for secret: SecretType) -> String {
+        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        return directory.appending(component: "\(minimalHex)-cert.pub").path()
+    }
+
+}
@@ -7,10 +7,7 @@ public struct Attributes: Sendable, Codable, Hashable {

    /// The authentication requirements for the key. This is simply a description of the option recorded at creation – modifying it doers not modify the key's authentication requirements.
    public let authentication: AuthenticationRequirement
-
-    /// The authentication restrictions for the key.
-    public var restrictions: Restrictions?
-
+    
    /// The string appended to the end of the SSH Public Key.
    /// If nil, a default value will be used.
    public var publicKeyAttribution: String?
@@ -18,12 +15,10 @@ public struct Attributes: Sendable, Codable, Hashable {
    public init(
        keyType: KeyType,
        authentication: AuthenticationRequirement,
-        restrictions: Restrictions?,
        publicKeyAttribution: String? = nil
    ) {
        self.keyType = keyType
        self.authentication = authentication
-        self.restrictions = restrictions
        self.publicKeyAttribution = publicKeyAttribution
    }

@@ -38,17 +33,17 @@ public enum AuthenticationRequirement: String, Hashable, Sendable, Codable, Iden

    /// Authentication is not required for usage.
    case notRequired
-
+    
    /// The user needs to authenticate, using either a biometric option, a connected authorized watch, or password entry..
    case presenceRequired
-
+    
    /// ONLY the current set of biometric data, as matching at time of creation, is accepted.
    /// - Warning: This is a dangerous option prone to data loss. The user should be warned before configuring this key that if they modify their enrolled biometry INCLUDING by simply adding a new entry (ie, adding another fingeprting), the key will no longer be able to be accessed. This cannot be overridden with a password.
    case biometryCurrent
-
+    
    /// The authentication requirement was not recorded at creation, and is unknown.
    case unknown
-
+    
    /// Whether or not the key is known to require authentication.
    public var required: Bool {
        self == .presenceRequired || self == .biometryCurrent
@@ -58,46 +53,3 @@ public enum AuthenticationRequirement: String, Hashable, Sendable, Codable, Iden
        self
    }
 }
-
-/// The restrictions for the key.
-public struct Restrictions: Hashable, Sendable, Codable, Identifiable {
-
-    public enum AllowedDomains: Hashable, Sendable, Codable {
-        case all
-        case specific([String])
-
-        public func hash(into hasher: inout Hasher) {
-            switch self {
-            case .all:
-                break
-            case .specific(let values):
-                values.hash(into: &hasher)
-            }
-        }
-
-    }
-
-    public enum AllowedProvenancePaths: Hashable, Sendable, Codable, Identifiable {
-        case all
-        case specific([String])
-
-        public var id: Int {
-            hashValue
-        }
-        
-    }
-
-    public var allowForwarding: Bool
-    public var allowSigning: Bool
-    public var allowConnections: Bool
-    public var allowedDomains: AllowedDomains
-    public var allowedProvenancePaths: AllowedProvenancePaths
-
-    public var id: Restrictions {
-        self
-    }
-
-//    public static let `default` = Restrictions(allowForwarding: true, allowSigning: true, allowConnections: true, allowedDomains: .all, allowedProvenancePaths: .all)
-    public static let `default` = Restrictions(allowForwarding: true, allowSigning: true, allowConnections: true, allowedDomains: .specific(["example.com"]), allowedProvenancePaths: .all)
-
-}
@@ -20,7 +20,7 @@ public protocol SecretStore<SecretType>: Identifiable, Sendable {
    ///   - secret: The ``Secret`` to sign with.
    ///   - provenance: A ``SigningRequestProvenance`` describing where the request came from.
    /// - Returns: The signed data.
-    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance, target: SigningRequestTarget?) async throws -> Data
+    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) async throws -> Data

    /// Checks to see if there is currently a valid persisted authentication for a given secret.
    /// - Parameters:
@@ -1,55 +0,0 @@
-import Foundation
-import AppKit
-
-/// Describes the target of the signature operation.
-public enum SigningRequestTarget: Sendable {
-
-    case connection(ConnectionPayload)
-    case signature(SignaturePayload)
-
-    public struct ConnectionPayload: Sendable, Codable{
-
-        public let username: String
-        public let hasSignature: Bool
-        public let publicKeyAlgorithm: String
-        public let publicKey: Data
-        public let hostKey: Data
-        public let host: String?
-
-        public init(
-            username: String,
-            hasSignature: Bool,
-            publicKeyAlgorithm: String,
-            publicKey: Data,
-            hostKey: Data,
-            host: String?
-        ) {
-            self.username = username
-            self.hasSignature = hasSignature
-            self.publicKeyAlgorithm = publicKeyAlgorithm
-            self.publicKey = publicKey
-            self.hostKey = hostKey
-            self.host = host
-        }
-
-    }
-
-    public struct SignaturePayload: Sendable, Codable {
-
-        public let namespace: String
-        public let hashAlgorithm: String
-        public let hash: Data
-
-        public init(
-            namespace: String,
-            hashAlgorithm: String,
-            hash: Data,
-        ) {
-            self.namespace = namespace
-            self.hashAlgorithm = hashAlgorithm
-            self.hash = hash
-        }
-
-    }
-
-}
@@ -47,7 +47,7 @@ extension SecureEnclave {
                    .contains("DeviceOwnerAuthentication") ? .presenceRequired : .unknown
                do {
                    let parsed = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: tokenObjectID)
-                    let secret = Secret(id: UUID().uuidString, name: name, publicKey: parsed.publicKey.x963Representation, attributes: Attributes(keyType: .init(algorithm: .ecdsa, size: 256), authentication: auth, restrictions: .default))
+                    let secret = Secret(id: UUID().uuidString, name: name, publicKey: parsed.publicKey.x963Representation, attributes: Attributes(keyType: .init(algorithm: .ecdsa, size: 256), authentication: auth))
                    guard !migratedPublicKeys.contains(parsed.publicKey.x963Representation) else {
                        logger.log("Skipping \(name), public key already present. Marking as migrated.")
                        markMigrated(secret: secret, oldID: id)
@@ -0,0 +1,70 @@
+import LocalAuthentication
+import SecretKit
+
+extension SecureEnclave {
+
+    /// A context describing a persisted authentication.
+    final class PersistentAuthenticationContext: PersistedAuthenticationContext {
+
+        /// The Secret to persist authentication for.
+        let secret: Secret
+        /// The LAContext used to authorize the persistent context.
+        nonisolated(unsafe) let context: LAContext
+        /// An expiration date for the context.
+        /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
+        let monotonicExpiration: UInt64
+
+        /// Initializes a context.
+        /// - Parameters:
+        ///   - secret: The Secret to persist authentication for.
+        ///   - context: The LAContext used to authorize the persistent context.
+        ///   - duration: The duration of the authorization context, in seconds.
+        init(secret: Secret, context: LAContext, duration: TimeInterval) {
+            self.secret = secret
+            unsafe self.context = context
+            let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
+            self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
+        }
+
+        /// A boolean describing whether or not the context is still valid.
+        var valid: Bool {
+            clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
+        }
+
+        var expiration: Date {
+            let remainingNanoseconds = monotonicExpiration - clock_gettime_nsec_np(CLOCK_MONOTONIC)
+            let remainingInSeconds = Measurement(value: Double(remainingNanoseconds), unit: UnitDuration.nanoseconds).converted(to: .seconds).value
+            return Date(timeIntervalSinceNow: remainingInSeconds)
+        }
+    }
+
+    actor PersistentAuthenticationHandler: Sendable {
+
+        private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:]
+
+        func existingPersistedAuthenticationContext(secret: Secret) -> PersistentAuthenticationContext? {
+            guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
+            return persisted
+        }
+
+        func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) async throws {
+            let newContext = LAContext()
+            newContext.touchIDAuthenticationAllowableReuseDuration = duration
+            newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
+
+            let formatter = DateComponentsFormatter()
+            formatter.unitsStyle = .spellOut
+            formatter.allowedUnits = [.hour, .minute, .day]
+
+            
+            let durationString = formatter.string(from: duration)!
+            newContext.localizedReason = String(localized: .authContextPersistForDuration(secretName: secret.name, duration: durationString))
+            let success = try await newContext.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: newContext.localizedReason)
+            guard success else { return }
+            let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
+            persistedAuthenticationContexts[secret] = context
+        }
+
+    }
+
+}
@@ -17,7 +17,7 @@ extension SecureEnclave {
        }
        public let id = UUID()
        public let name = String(localized: .secureEnclave)
-        private let persistentAuthenticationHandler = PersistentAuthenticationHandler<Secret>()
+        private let persistentAuthenticationHandler = PersistentAuthenticationHandler()

        /// Initializes a Store.
        @MainActor public init() {
@@ -37,20 +37,13 @@ extension SecureEnclave {
        
        // MARK: SecretStore
        
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?) async throws -> Data {
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
            var context: LAContext
            if let existing = await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret) {
                context = unsafe existing.context
            } else {
                let newContext = LAContext()
-                switch target {
-                case .connection(let payload) where payload.host != nil:
-                    newContext.localizedReason = String(localized: .authContextRequestSignatureForConnectionDescription(appName: provenance.origin.displayName, targetName: payload.host!, secretName: secret.name))
-                case .signature(let payload):
-                    newContext.localizedReason = String(localized: .authContextRequestSignatureForSignatureDescription(namespace: payload.namespace, appName: provenance.origin.displayName, secretName: secret.name))
-                default:
-                    newContext.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
-                }
+                newContext.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
                newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
                context = newContext
            }
@@ -1,53 +0,0 @@
-import Foundation
-import Security
-import CryptoTokenKit
-import CryptoKit
-import os
-import SSHProtocolKit
-import CertificateKit
-
-public struct CertificateMigrator {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.migration", category: "CertificateKitMigrator")
-    private let publicKeysDirectory: URL
-    private let certificatesDirectory: URL
-    private let certificateStore: CertificateStore
-
-    /// Initializes a PublicKeyFileStoreController.
-    public init(homeDirectory: URL, certificateStore: CertificateStore) {
-        publicKeysDirectory = homeDirectory.appending(component: "PublicKeys")
-        certificatesDirectory = homeDirectory.appending(component: "Certificates")
-        self.certificateStore = certificateStore
-    }
-
-    @MainActor public func migrate() throws {
-        try migrate(directory: publicKeysDirectory)
-        try migrate(directory: certificatesDirectory)
-    }
-
-    @MainActor public func migrate(directory: URL) throws {
-        let fileCerts = try FileManager.default
-            .contentsOfDirectory(atPath: directory.path())
-            .filter { $0.hasSuffix("-cert.pub") }
-        Task {
-            for path in fileCerts {
-                do {
-                    let url = directory.appending(component: path)
-                    let data = try Data(contentsOf: url)
-                    let parser = try await XPCCertificateParser()
-                    let cert = try await parser.parse(data: data)
-                    try certificateStore.save(certificate: Certificate(openSSHCertificate: cert, rawData: data))
-                    do {
-                        try FileManager.default.removeItem(at: url)
-                    } catch {
-                        logger.error("Failed to delete successfully migrated cert: \(path)")
-                    }
-                } catch {
-                    logger.error("Failed to migrate cert: \(path)")
-                }
-            }
-
-        }
-    }
-
-}
@@ -1,29 +0,0 @@
-import Foundation
-import OSLog
-import SSHProtocolKit
-import CertificateKit
-import XPCWrappers
-
-/// Delegates all agent input parsing to an XPC service which wraps OpenSSH
-public final class XPCCertificateParser: OpenSSHCertificateParserProtocol {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "XPCCertificateParser")
-    private let session: XPCTypedSession<OpenSSHCertificate, OpenSSHCertificateError>
-
-    public init() async throws {
-        logger.debug("Creating XPCCertificateParser")
-        session = try await XPCTypedSession(serviceName: "com.maxgoedjen.Secretive.SecretiveCertificateParser", warmup: true)
-        logger.debug("XPCCertificateParser is warmed up.")
-    }
-
-    public func parse(data: Data) async throws -> OpenSSHCertificate {
-        logger.debug("Parsing input")
-        defer { logger.debug("Parsed input") }
-        return try await session.send(data)
-    }
-
-    deinit {
-        session.complete()
-    }
-
-}
@@ -10,7 +10,6 @@ extension SmartCard {
        public let name: String
        public let publicKey: Data
        public var attributes: Attributes
-        public var restrictions: Restrictions?

    }

@@ -34,7 +34,6 @@ extension SmartCard {
        public var secrets: [Secret] {
            state.secrets
        }
-        private let persistentAuthenticationHandler = PersistentAuthenticationHandler<Secret>()

        /// Initializes a Store.
        public init() {
@@ -57,17 +56,11 @@ extension SmartCard {

        // MARK: Public API

-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?) async throws -> Data {
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
            guard let tokenID = await state.tokenID else { fatalError() }
-            var context: LAContext
-            if let existing = await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret) {
-                context = unsafe existing.context
-            } else {
-                let newContext = LAContext()
-                newContext.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
-                newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-                context = newContext
-            }
+            let context = LAContext()
+            context.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
+            context.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
            let attributes = KeychainDictionary([
                kSecClass: kSecClassKey,
                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
@@ -93,12 +86,11 @@ extension SmartCard {
            return signature as Data
        }
        
-        public func existingPersistedAuthenticationContext(secret: Secret) async -> PersistedAuthenticationContext? {
-            await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret)
+        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
+            nil
        }

-        public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) async throws {
-            try await persistentAuthenticationHandler.persistAuthentication(secret: secret, forDuration: duration)
+        public func persistAuthentication(secret: Secret, forDuration: TimeInterval) throws {
        }

        /// Reloads all secrets from the store.
@@ -171,7 +163,7 @@ extension SmartCard.Store {
            let publicKeySecRef = SecKeyCopyPublicKey(publicKeyRef)!
            let publicKeyAttributes = SecKeyCopyAttributes(publicKeySecRef) as! [CFString: Any]
            let publicKey = publicKeyAttributes[kSecValueData] as! Data
-            let attributes = Attributes(keyType: KeyType(secAttr: algorithmSecAttr, size: keySize)!, authentication: .presenceRequired, restrictions: .default)
+            let attributes = Attributes(keyType: KeyType(secAttr: algorithmSecAttr, size: keySize)!, authentication: .unknown)
            let secret = SmartCard.Secret(id: tokenID, name: name, publicKey: publicKey, attributes: attributes)
            guard signatureAlgorithm(for: secret) != nil else { return nil }
            return secret
@@ -12,9 +12,7 @@ public final class XPCServiceDelegate: NSObject, NSXPCListenerDelegate {
        newConnection.exportedInterface = NSXPCInterface(with: (any _XPCProtocol).self)
        let exportedObject = exportedObject
        newConnection.exportedObject = exportedObject
-#if !DEBUG
-        newConnection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = \"Z72PRUAWF6\"")
-#endif
+        newConnection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = Z72PRUAWF6")
        newConnection.resume()
        return true
    }
@@ -8,9 +8,7 @@ public struct XPCTypedSession<ResponseType: Codable & Sendable, ErrorType: Error
    public init(serviceName: String, warmup: Bool = false) async throws {
        let connection = NSXPCConnection(serviceName: serviceName)
        connection.remoteObjectInterface = NSXPCInterface(with: (any _XPCProtocol).self)
-        #if !DEBUG
-        connection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = \"Z72PRUAWF6\"")
-        #endif
+        connection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = Z72PRUAWF6")
        connection.resume()
        guard let proxy = connection.remoteObjectProxy as? _XPCProtocol else { fatalError() }
        self.connection = connection
@@ -1,83 +0,0 @@
-import Foundation
-import Testing
-import SSHProtocolKit
-@testable import SecretKit
-
-@Suite struct OpenSSHSignatureWriterTests {
-
-    private let writer = OpenSSHSignatureWriter()
-
-    @Test func ecdsaMpintStripsUnnecessaryLeadingZeros() throws {
-        let secret = Constants.ecdsa256Secret
-
-        // r has a leading 0x00 followed by 0x01 (< 0x80): the mpint must not keep the leading zero.
-        let rBytes: [UInt8] = [0x00] + (1...31).map { UInt8($0) }
-        let r = Data(rBytes)
-        // s has two leading 0x00 bytes followed by 0x7f (< 0x80): the mpint must not keep the leading zeros.
-        let sBytes: [UInt8] = [0x00, 0x00, 0x7f] + Array(repeating: UInt8(0x01), count: 29)
-        let s = Data(sBytes)
-        let rawRepresentation = r + s
-
-        let response = writer.data(secret: secret, signature: rawRepresentation)
-        let (parsedR, parsedS) = try parseEcdsaSignatureMpints(from: response)
-
-        #expect(parsedR == Data((1...31).map { UInt8($0) }))
-        #expect(parsedS == Data([0x7f] + Array(repeating: UInt8(0x01), count: 29)))
-    }
-
-    @Test func ecdsaMpintPrefixesZeroWhenHighBitSet() throws {
-        let secret = Constants.ecdsa256Secret
-
-        // r starts with 0x80 (high bit set): mpint must be prefixed with 0x00.
-        let r = Data([UInt8(0x80)] + Array(repeating: UInt8(0x01), count: 31))
-        let s = Data([UInt8(0x01)] + Array(repeating: UInt8(0x02), count: 31))
-        let rawRepresentation = r + s
-
-        let response = writer.data(secret: secret, signature: rawRepresentation)
-        let (parsedR, parsedS) = try parseEcdsaSignatureMpints(from: response)
-
-        #expect(parsedR == Data([0x00, 0x80] + Array(repeating: UInt8(0x01), count: 31)))
-        #expect(parsedS == Data([0x01] + Array(repeating: UInt8(0x02), count: 31)))
-    }
-
-}
-
-private extension OpenSSHSignatureWriterTests {
-
-    enum Constants {
-        static let ecdsa256Secret = TestSecret(
-            id: Data(),
-            name: "Test Key (ECDSA 256)",
-            publicKey: Data(repeating: 0x01, count: 65),
-            attributes: Attributes(
-                keyType: KeyType(algorithm: .ecdsa, size: 256),
-                authentication: .notRequired,
-                publicKeyAttribution: "test@example.com"
-            )
-        )
-    }
-
-    enum ParseError: Error {
-        case eof
-        case invalidAlgorithm
-    }
-
-    func parseEcdsaSignatureMpints(from openSSHSignedData: Data) throws -> (r: Data, s: Data) {
-        let reader = OpenSSHReader(data: openSSHSignedData)
-
-        // Prefix
-        _ = try reader.readNextBytes(as: UInt32.self)
-
-        let algorithm = try reader.readNextChunkAsString()
-        guard algorithm == "ecdsa-sha2-nistp256" else {
-            throw ParseError.invalidAlgorithm
-        }
-
-        let sigReader = try reader.readNextChunkAsSubReader()
-        let r = try sigReader.readNextChunk()
-        let s = try sigReader.readNextChunk()
-        return (r, s)
-    }
-
-}
-
@@ -1,11 +0,0 @@
-import Foundation
-import SecretKit
-
-public struct TestSecret: SecretKit.Secret {
-    
-    public let id: Data
-    public let name: String
-    public let publicKey: Data
-    public var attributes: Attributes
-    
-}
@@ -1,27 +1,25 @@
 import Foundation
 import Testing
 import CryptoKit
-import CertificateKit
-@testable import SSHProtocolKit
@testable import SecretKit
@testable import SecretAgentKit

-@Suite @MainActor struct AgentTests {
+@Suite struct AgentTests {

    // MARK: Identity Listing

    @Test func emptyStores() async throws {
-        let agent = Agent(storeList: SecretStoreList(), certificateStore: CertificateStore())
+        let agent = Agent(storeList: SecretStoreList())
        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestIdentities)
-        let response = await agent.handle(request: request, provenance: .test, hosts: nil)
+        let response = await agent.handle(request: request, provenance: .test)
        #expect(response == Constants.Responses.requestIdentitiesEmpty)
    }

    @Test func identitiesList() async throws {
        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let agent = Agent(storeList: list, certificateStore: CertificateStore())
+        let agent = Agent(storeList: list)
        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestIdentities)
-        let response = await agent.handle(request: request, provenance: .test, hosts: nil)
+        let response = await agent.handle(request: request, provenance: .test)

        let actual = OpenSSHReader(data: response)
        let expected = OpenSSHReader(data: Constants.Responses.requestIdentitiesMultiple)
@@ -33,9 +31,9 @@ import CertificateKit

    @Test func noMatchingIdentities() async throws {
        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let agent = Agent(storeList: list, certificateStore: CertificateStore())
+        let agent = Agent(storeList: list)
        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignatureWithNoneMatching)
-        let response = await agent.handle(request: request, provenance: .test, hosts: nil)
+        let response = await agent.handle(request: request, provenance: .test)
        #expect(response == Constants.Responses.requestFailure)
    }

@@ -43,11 +41,11 @@ import CertificateKit
        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
        guard case SSHAgent.Request.signRequest(let context) = request else { return }
        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let agent = Agent(storeList: list, certificateStore: CertificateStore())
-        let response = await agent.handle(request: request, provenance: .test, hosts: nil)
+        let agent = Agent(storeList: list)
+        let response = await agent.handle(request: request, provenance: .test)
        let responseReader = OpenSSHReader(data: response)
-        let length = try responseReader.readNextBytes(as: UInt32.self)
-        let type = try responseReader.readNextBytes(as: UInt8.self)
+        let length = try responseReader.readNextBytes(as: UInt32.self).bigEndian
+        let type = try responseReader.readNextBytes(as: UInt8.self).bigEndian
        #expect(length == response.count - MemoryLayout<UInt32>.size)
        #expect(type == SSHAgent.Response.agentSignResponse.rawValue)
        let outer = OpenSSHReader(data: responseReader.remaining)
@@ -68,7 +66,7 @@ import CertificateKit
        let signature = try P256.Signing.ECDSASignature(rawRepresentation: rs)
        // Correct signature
        #expect(try P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey)
-            .isValidSignature(signature, for: context.dataToSign.raw))
+            .isValidSignature(signature, for: context.dataToSign))
    }

    // MARK: Witness protocol
@@ -78,8 +76,8 @@ import CertificateKit
        let witness = StubWitness(speakNow: { _,_  in
            return true
        }, witness: { _, _ in })
-        let agent = Agent(storeList: list, certificateStore: CertificateStore(), witness: witness)
-        let response = await agent.handle(request: .signRequest(.empty), provenance: .test, hosts: nil)
+        let agent = Agent(storeList: list, witness: witness)
+        let response = await agent.handle(request: .signRequest(.empty), provenance: .test)
        #expect(response == Constants.Responses.requestFailure)
    }

@@ -91,9 +89,9 @@ import CertificateKit
        }, witness: { _, trace in
            witnessed = true
        })
-        let agent = Agent(storeList: list, certificateStore: CertificateStore(), witness: witness)
+        let agent = Agent(storeList: list, witness: witness)
        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        _ = await agent.handle(request: request, provenance: .test, hosts: nil)
+        _ = await agent.handle(request: request, provenance: .test)
        #expect(witnessed)
    }

@@ -107,9 +105,9 @@ import CertificateKit
        }, witness: { _, trace in
            witnessTrace = trace
        })
-        let agent = Agent(storeList: list, certificateStore: CertificateStore(), witness: witness)
+        let agent = Agent(storeList: list, witness: witness)
        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        _ = await agent.handle(request: request, provenance: .test, hosts: nil)
+        _ = await agent.handle(request: request, provenance: .test)
        #expect(witnessTrace == speakNowTrace)
        #expect(witnessTrace == .test)
    }
@@ -118,19 +116,19 @@ import CertificateKit

    @Test func signatureException() async throws {
        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let store = list.stores.first?.base as! Stub.Store
+        let store = await list.stores.first?.base as! Stub.Store
        store.shouldThrow = true
-        let agent = Agent(storeList: list, certificateStore: CertificateStore())
+        let agent = Agent(storeList: list)
        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        let response = await agent.handle(request: request, provenance: .test, hosts: nil)
+        let response = await agent.handle(request: request, provenance: .test)
        #expect(response == Constants.Responses.requestFailure)
    }

    // MARK: Unsupported

    @Test func unhandledAdd() async throws {
-        let agent = Agent(storeList: SecretStoreList(), certificateStore: CertificateStore())
-        let response = await agent.handle(request: .addIdentity, provenance: .test, hosts: nil)
+        let agent = Agent(storeList: SecretStoreList())
+        let response = await agent.handle(request: .addIdentity, provenance: .test)
        #expect(response == Constants.Responses.requestFailure)
    }

@@ -144,7 +142,7 @@ extension SigningRequestProvenance {

 extension AgentTests {

-    func storeList(with secrets: [Stub.Secret]) async -> SecretStoreList {
+    @MainActor func storeList(with secrets: [Stub.Secret]) async -> SecretStoreList {
        let store = Stub.Store()
        store.secrets.append(contentsOf: secrets)
        let storeList = SecretStoreList()
@@ -1,6 +1,8 @@
 import Foundation
 import Testing
-import SSHProtocolKit
+@testable import SecretAgentKit
+@testable import SecureEnclaveSecretKit
+@testable import SmartCardSecretKit

@Suite struct OpenSSHReaderTests {

@@ -1,7 +1,6 @@
 import Foundation
 import SecretKit
 import CryptoKit
-import SSHProtocolKit

 struct Stub {}

@@ -49,7 +48,7 @@ extension Stub {
            print("Public Key OpenSSH: \(OpenSSHPublicKeyWriter().openSSHString(secret: secret))")
        }

-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?) throws -> Data {
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
            guard !shouldThrow else {
                throw NSError(domain: "test", code: 0, userInfo: nil)
            }
@@ -10,14 +10,14 @@ struct StubWitness {

 extension StubWitness: SigningWitness {

-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, target: SigningRequestTarget?) throws {
+func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
        let objection = speakNow(secret, provenance)
        if objection {
            throw TheresMyChance()
        }
    }

-func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, target: SigningRequestTarget?) throws {
+func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
        witness(secret, provenance)
    }

@@ -1,7 +1,8 @@
 import Foundation
 import Testing
@testable import SecretKit
-import SSHProtocolKit
+@testable import SecureEnclaveSecretKit
+@testable import SmartCardSecretKit

@Suite struct OpenSSHPublicKeyWriterTests {

@@ -46,8 +47,8 @@ import SSHProtocolKit
 extension OpenSSHPublicKeyWriterTests {

    enum Constants {
-        static let ecdsa256Secret =  TestSecret(id: Data(), name: "Test Key (ECDSA 256)", publicKey: Data(base64Encoded: "BOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 256), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
-        static let ecdsa384Secret = TestSecret(id: Data(), name: "Test Key (ECDSA 384)", publicKey: Data(base64Encoded: "BG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 384), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
+        static let ecdsa256Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 256)", publicKey: Data(base64Encoded: "BOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 256), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
+        static let ecdsa384Secret = SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 384)", publicKey: Data(base64Encoded: "BG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 384), authentication: .notRequired, publicKeyAttribution: "test@example.com"))

    }

@@ -6,21 +6,7 @@ import SmartCardSecretKit
 import SecretAgentKit
 import Brief
 import Observation
-import SSHProtocolKit
-import CertificateKit
-import Common
-import SwiftUI

-extension EnvironmentValues {
-
-    @MainActor fileprivate static let _certificateStore: CertificateStore = CertificateStore()
-
-    @MainActor var certificateStore: CertificateStore {
-        EnvironmentValues._certificateStore
-    }
-
-
-}
@main
 class AppDelegate: NSObject, NSApplicationDelegate {

@@ -31,18 +17,16 @@ class AppDelegate: NSObject, NSApplicationDelegate {
        try? migrator.migrate(to: cryptoKit)
        list.add(store: cryptoKit)
        list.add(store: SmartCard.Store())
-        let certsMigrator = CertificateMigrator(homeDirectory: URL.homeDirectory, certificateStore: EnvironmentValues._certificateStore)
-        try? certsMigrator.migrate()
        return list
    }()
    private let updater = Updater(checkOnLaunch: true)
    private let notifier = Notifier()
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(publicKeysURL: URL.publicKeyDirectory, certificatesURL: URL.certificatesDirectory)
-    @MainActor private lazy var agent: Agent = {
-        Agent(storeList: storeList, certificateStore: EnvironmentValues._certificateStore, witness: notifier)
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: URL.homeDirectory)
+    private lazy var agent: Agent = {
+        Agent(storeList: storeList, witness: notifier)
    }()
    private lazy var socketController: SocketController = {
-        let path = URL.socketPath as String
+        let path = (NSHomeDirectory() as NSString).appendingPathComponent("socket.ssh") as String
        return SocketController(path: path)
    }()
    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "AppDelegate")
@@ -50,19 +34,17 @@ class AppDelegate: NSObject, NSApplicationDelegate {
    func applicationDidFinishLaunching(_ aNotification: Notification) {
        logger.debug("SecretAgent finished launching")
        Task {
+            let inputParser = try await XPCAgentInputParser()
            for await session in socketController.sessions {
                Task {
                    do {
-                        let inputParser = try await XPCAgentInputParser()
-                        let hostsReader = try? await XPCHostsfileReader()
-                        let hosts = try? await hostsReader?.read()
                        for await message in session.messages {
                            let request = try await inputParser.parse(data: message)
-                            let agentResponse = await agent.handle(request: request, provenance: session.provenance, hosts: hosts)
-                            try session.write(agentResponse)
+                            let agentResponse = await agent.handle(request: request, provenance: session.provenance)
+                            try await session.write(agentResponse)
                        }
                    } catch {
-                        try? session.close()
+                        try session.close()
                    }
                }
            }
@@ -72,13 +54,7 @@ class AppDelegate: NSObject, NSApplicationDelegate {
                try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
            }
        }
-        Task {
-            for await _ in NotificationCenter.default.notifications(named: .certificateStoreReloaded) {
-                try? publicKeyFileStoreController.generateCertificates(for: EnvironmentValues._certificateStore.certificates, clear: true)
-            }
-        }
        try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
-        try? publicKeyFileStoreController.generateCertificates(for: EnvironmentValues._certificateStore.certificates, clear: true)
        notifier.prompt()
        _ = withObservationTracking {
            updater.update
@@ -1,47 +0,0 @@
-import Foundation
-import Security
-import CryptoTokenKit
-import CryptoKit
-import os
-import SSHProtocolKit
-import CertificateKit
-import SharedXPCServices
-
-public struct CertificateMigrator {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.migration", category: "CertificateKitMigrator")
-    private let directory: URL
-    private let certificateStore: CertificateStore
-
-    /// Initializes a PublicKeyFileStoreController.
-    public init(homeDirectory: URL, certificateStore: CertificateStore) {
-        directory = homeDirectory.appending(component: "PublicKeys")
-        self.certificateStore = certificateStore
-    }
-
-    @MainActor public func migrate() throws {
-        let fileCerts = try FileManager.default
-            .contentsOfDirectory(atPath: directory.path())
-            .filter { $0.hasSuffix("-cert.pub") }
-        Task {
-            for path in fileCerts {
-                do {
-                    let url = directory.appending(component: path)
-                    let data = try Data(contentsOf: url)
-                    let parser = try await XPCCertificateParser()
-                    let cert = try await parser.parse(data: data)
-                    try certificateStore.save(certificate: Certificate(openSSHCertificate: cert, rawData: data))
-                    do {
-                        try FileManager.default.removeItem(at: url)
-                    } catch {
-                        logger.error("Failed to delete successfully migrated cert: \(path)")
-                    }
-                } catch {
-                    logger.error("Failed to migrate cert: \(path)")
-                }
-            }
-
-        }
-    }
-
-}
@@ -60,19 +60,12 @@ final class Notifier: Sendable {
        notificationCenter.requestAuthorization(options: .alert) { _, _ in }
    }

-    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, target: SigningRequestTarget?) async {
+    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async {
        await notificationDelegate.state.setPending(secret: secret, store: store)
        let notificationCenter = UNUserNotificationCenter.current()
        let notificationContent = UNMutableNotificationContent()
        notificationContent.title = String(localized: .signedNotificationTitle(appName: provenance.origin.displayName))
-        switch target {
-        case .connection(let payload) where payload.host != nil:
-            notificationContent.subtitle = String(localized: .signedConnectionNotificationDescription(secretName: secret.name, username: payload.username, host: payload.host!))
-        case .signature(let payload):
-            notificationContent.subtitle = String(localized: .signedSignatureNotificationDescription(secretName: secret.name, namespace: payload.namespace))
-        default:
-            notificationContent.subtitle = String(localized: .signedNotificationDescription(secretName: secret.name))
-        }
+        notificationContent.subtitle = String(localized: .signedNotificationDescription(secretName: secret.name))
        notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description
        notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description
        notificationContent.interruptionLevel = .timeSensitive
@@ -107,21 +100,11 @@ final class Notifier: Sendable {

 extension Notifier: SigningWitness {

-    func speakNowOrForeverHoldYourPeace(
-        forAccessTo secret: AnySecret,
-        from store: AnySecretStore,
-        by provenance: SigningRequestProvenance,
-        target: SigningRequestTarget?
-    ) async throws {
+    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
    }

-    func witness(
-        accessTo secret: AnySecret,
-        from store: AnySecretStore,
-        by provenance: SigningRequestProvenance,
-        target: SigningRequestTarget?
-    ) async throws {
-        await notify(accessTo: secret, from: store, by: provenance, target: target)
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
+        await notify(accessTo: secret, from: store, by: provenance)
    }

 }
@@ -12,12 +12,12 @@
 	<true/>
 	<key>com.apple.security.hardened-process.dyld-ro</key>
 	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
-	<string>1</string>
+	<key>com.apple.security.hardened-process.enhanced-security-version</key>
+	<integer>1</integer>
 	<key>com.apple.security.hardened-process.hardened-heap</key>
 	<true/>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
-	<string>2</string>
+	<key>com.apple.security.hardened-process.platform-restrictions</key>
+	<integer>2</integer>
 	<key>com.apple.security.smartcard</key>
 	<true/>
 	<key>keychain-access-groups</key>
@@ -1,36 +0,0 @@
-import Foundation
-import OSLog
-import XPCWrappers
-import OSLog
-
-public final class XPCHostsfileReader {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "XPCHostsfileReader")
-    private let session: XPCTypedSession<[Data: String], HostsfileReaderError>
-
-    public init() async throws {
-        logger.debug("Creating XPCHostsfileReader")
-        session = try await XPCTypedSession(serviceName: "com.maxgoedjen.Secretive.SecretAgentHostsfileReader", warmup: true)
-        logger.debug("XPCHostsfileReader is warmed up.")
-    }
-
-    public func read() async throws -> [Data: String] {
-        logger.debug("Reading hosts file")
-        defer { logger.debug("Read hosts file") }
-        return try await session.send(Data())
-    }
-
-    deinit {
-        session.complete()
-    }
-
-}
-
-extension XPCHostsfileReader {
-
-    public enum HostsfileReaderError: Error, Codable {
-        case fileDoesNotExist
-        case parseError
-    }
-
-}
@@ -1,10 +1,8 @@
 import Foundation
-import OSLog
-import SSHProtocolKit
+import SecretAgentKit
 import Brief
 import XPCWrappers
 import OSLog
-import SSHProtocolKit

 /// Delegates all agent input parsing to an XPC service which wraps OpenSSH
 public final class XPCAgentInputParser: SSHAgentInputParserProtocol {
@@ -1,11 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>XPCService</key>
-	<dict>
-		<key>ServiceType</key>
-		<string>Application</string>
-	</dict>
-</dict>
-</plist>
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>com.apple.security.hardened-process</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations</key>
-	<true/>
-	<key>com.apple.security.hardened-process.dyld-ro</key>
-	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
-	<string>2</string>
-	<key>com.apple.security.hardened-process.hardened-heap</key>
-	<true/>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
-	<string>2</string>
-</dict>
-</plist>
@@ -1,25 +0,0 @@
-import Foundation
-import OSLog
-import XPCWrappers
-import SSHProtocolKit
-
-final class SecretAgentHostsfileReader: NSObject, XPCProtocol {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.SecretAgentHostsfileReader", category: "SecretAgentHostsfileReader")
-
-    func process(_ data: Data) async throws -> [Data: String] {
-        logger.log("Parsing hostsfile")
-        var result: [Data: String] = [:]
-        for try await line in URL(filePath: NSHomeDirectory().appending("/.ssh/known_hosts")).lines {
-            let split = line.split(separator: " ").map(String.init)
-            guard split.count == 3 else { continue }
-            guard let decoded = Data(base64Encoded: split[2]) else { continue }
-            let reader = OpenSSHReader(data: decoded)
-            _ = try reader.readNextChunk()
-            let key = try reader.readNextChunk()
-            result[key] = split[0]
-        }
-        return result
-    }
-
-}
@@ -1,7 +0,0 @@
-import Foundation
-import XPCWrappers
-
-let delegate = XPCServiceDelegate(exportedObject: SecretAgentHostsfileReader())
-let listener = NSXPCListener.service()
-listener.delegate = delegate
-listener.resume()
@@ -12,11 +12,11 @@
 	<true/>
 	<key>com.apple.security.hardened-process.dyld-ro</key>
 	<true/>
+	<key>com.apple.security.hardened-process.enhanced-security-version</key>
+	<integer>1</integer>
 	<key>com.apple.security.hardened-process.hardened-heap</key>
 	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
-	<string>1</string>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
-	<string>2</string>
+	<key>com.apple.security.hardened-process.platform-restrictions</key>
+	<integer>2</integer>
 </dict>
 </plist>
@@ -2,7 +2,6 @@ import Foundation
 import OSLog
 import XPCWrappers
 import SecretAgentKit
-import SSHProtocolKit

 final class SecretAgentInputParser: NSObject, XPCProtocol {

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2640"
+   LastUpgradeVersion = "2600"
   version = "1.7">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -14,8 +14,7 @@
      shouldUseLaunchSchemeArgsEnv = "YES">
      <TestPlans>
         <TestPlanReference
-            reference = "container:Config/Secretive.xctestplan"
-            default = "YES">
+            reference = "container:Config/Secretive.xctestplan">
         </TestPlanReference>
      </TestPlans>
   </TestAction>
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2640"
+   LastUpgradeVersion = "2600"
   version = "1.7">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2640"
+   LastUpgradeVersion = "2600"
   version = "1.7">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -23,7 +23,7 @@
      </BuildActionEntries>
   </BuildAction>
   <TestAction
-      buildConfiguration = "Debug"
+      buildConfiguration = "Test"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
      shouldUseLaunchSchemeArgsEnv = "YES">
@@ -87,9 +87,6 @@
            ReferencedContainer = "container:Secretive.xcodeproj">
         </BuildableReference>
      </BuildableProductRunnable>
-      <MetalAPIValidationSettings
-         isEnabled = "No">
-      </MetalAPIValidationSettings>
   </LaunchAction>
   <ProfileAction
      buildConfiguration = "Debug"
@@ -3,30 +3,26 @@ import SecretKit
 import SecureEnclaveSecretKit
 import SmartCardSecretKit
 import Brief
-import CertificateKit

@main
 struct Secretive: App {
    
-    @Environment(\.agentLaunchController) var agentLaunchController
+    @Environment(\.agentStatusChecker) var agentStatusChecker
    @Environment(\.justUpdatedChecker) var justUpdatedChecker

    @SceneBuilder var body: some Scene {
        WindowGroup {
            ContentView()
                .environment(EnvironmentValues._secretStoreList)
-                .environment(EnvironmentValues._certificateStore)
                .onReceive(NotificationCenter.default.publisher(for: NSApplication.didBecomeActiveNotification)) { _ in
-                    Task {
-                        @AppStorage("defaultsHasRunSetup") var hasRunSetup = false
-                        @AppStorage("explicitlyDisabled") var explicitlyDisabled = false
-                        guard hasRunSetup && !explicitlyDisabled else { return }
-                        agentLaunchController.check()
-                        guard !agentLaunchController.developmentBuild else { return }
-                        if justUpdatedChecker.justUpdatedBuild || !agentLaunchController.running {
-                            // Relaunch the agent, since it'll be running from earlier update still
-                            try? await agentLaunchController.forceLaunch()
-                        }
+                    @AppStorage("defaultsHasRunSetup") var hasRunSetup = false
+                    guard hasRunSetup else { return }
+                    agentStatusChecker.check()
+                    if agentStatusChecker.running && justUpdatedChecker.justUpdatedBuild {
+                        // Relaunch the agent, since it'll be running from earlier update still
+                        reinstallAgent()
+                    } else if !agentStatusChecker.running && !agentStatusChecker.developmentBuild {
+                        forceLaunchAgent()
                    }
                }
        }
@@ -83,6 +79,30 @@ extension Secretive {

 }

+extension Secretive {
+
+    private func reinstallAgent() {
+        Task {
+            _ = await LaunchAgentController().install()
+            try? await Task.sleep(for: .seconds(1))
+            agentStatusChecker.check()
+            if !agentStatusChecker.running {
+                forceLaunchAgent()
+            }
+        }
+    }
+
+    private func forceLaunchAgent() {
+        // We've run setup, we didn't just update, launchd is just not doing it's thing.
+        // Force a launch directly.
+        Task {
+            _ = await LaunchAgentController().forceLaunch()
+            agentStatusChecker.check()
+        }
+    }
+
+}
+
 private enum Constants {
    static let helpURL = URL(string: "https://github.com/maxgoedjen/secretive/blob/main/FAQ.md")!
 }
@@ -94,18 +114,15 @@ extension EnvironmentValues {
    @MainActor fileprivate static let _secretStoreList: SecretStoreList = {
        let list = SecretStoreList()
        let cryptoKit = SecureEnclave.Store()
-        let cryptoKitMigrator = SecureEnclave.CryptoKitMigrator()
-        try? cryptoKitMigrator.migrate(to: cryptoKit)
+        let migrator = SecureEnclave.CryptoKitMigrator()
+        try? migrator.migrate(to: cryptoKit)
        list.add(store: cryptoKit)
        list.add(store: SmartCard.Store())
        return list
    }()

-    @MainActor fileprivate static let _certificateStore: CertificateStore = CertificateStore()
-    
-    private static let _agentLaunchController = AgentLaunchController()
-    @Entry var agentLaunchController: any AgentLaunchControllerProtocol = _agentLaunchController
-
+    private static let _agentStatusChecker = AgentStatusChecker()
+    @Entry var agentStatusChecker: any AgentStatusCheckerProtocol = _agentStatusChecker
    private static let _updater: any UpdaterProtocol = {
        @AppStorage("defaultsHasRunSetup") var hasRunSetup = false
        return Updater(checkOnLaunch: hasRunSetup)
@@ -118,10 +135,6 @@ extension EnvironmentValues {
    @MainActor var secretStoreList: SecretStoreList {
        EnvironmentValues._secretStoreList
    }
-
-    @MainActor var certificateStore: CertificateStore {
-        EnvironmentValues._certificateStore
-    }
 }

 extension FocusedValues {
@@ -2,26 +2,18 @@ import Foundation
 import AppKit
 import SecretKit
 import Observation
-import OSLog
-import ServiceManagement
-import Common

-@MainActor protocol AgentLaunchControllerProtocol: Observable, Sendable {
+@MainActor protocol AgentStatusCheckerProtocol: Observable, Sendable {
    var running: Bool { get }
    var developmentBuild: Bool { get }
    var process: NSRunningApplication? { get }
    func check()
-    func install() async throws
-    func uninstall() async throws
-    func forceLaunch() async throws
 }

-@Observable @MainActor final class AgentLaunchController: AgentLaunchControllerProtocol {
+@Observable @MainActor final class AgentStatusChecker: AgentStatusCheckerProtocol {

    var running: Bool = false
    var process: NSRunningApplication? = nil
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "LaunchAgentController")
-    private let service = SMAppService.loginItem(identifier: Bundle.agentBundleID)

    nonisolated init() {
        Task { @MainActor in
@@ -41,7 +33,7 @@ import Common

    // The process corresponding to this instance of Secretive
    var instanceSecretAgentProcess: NSRunningApplication? {
-        // TODO: CHECK VERSION
+        // FIXME: CHECK VERSION
        let agents = allSecretAgentProcesses
        for agent in agents {
            guard let url = agent.bundleURL else { continue }
@@ -57,47 +49,6 @@ import Common
        Bundle.main.bundleURL.isXcodeURL
    }

-    func install() async throws {
-        logger.debug("Installing agent")
-        try? await service.unregister()
-        // This is definitely a bit of a "seems to work better" thing but:
-        // Seems to more reliably hit if these are on separate runloops, otherwise it seems like it sometimes doesn't kill old
-        // and start new?
-        try await Task.sleep(for: .seconds(1))
-        try service.register()
-        try await Task.sleep(for: .seconds(1))
-        check()
-    }
-
-    func uninstall() async throws {
-        logger.debug("Uninstalling agent")
-        try await Task.sleep(for: .seconds(1))
-        try await service.unregister()
-        try await Task.sleep(for: .seconds(1))
-        check()
-    }
-
-    func forceLaunch() async throws {
-        logger.debug("Agent is not running, attempting to force launch by reinstalling")
-        try await install()
-        if running {
-            logger.debug("Agent successfully force launched by reinstalling")
-            return
-        }
-        logger.debug("Agent is not running, attempting to force launch by launching directly")
-        let url = Bundle.main.bundleURL.appendingPathComponent("Contents/Library/LoginItems/SecretAgent.app")
-        let config = NSWorkspace.OpenConfiguration()
-        config.activates = false
-        do {
-            try await NSWorkspace.shared.openApplication(at: url, configuration: config)
-            logger.debug("Agent force launched")
-            try await Task.sleep(for: .seconds(1))
-        } catch {
-            logger.error("Error force launching \(error.localizedDescription)")
-        }
-        check()
-    }
-
 }

 extension URL {
@@ -0,0 +1,65 @@
+import Foundation
+import ServiceManagement
+import AppKit
+import OSLog
+import SecretKit
+
+struct LaunchAgentController {
+    
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "LaunchAgentController")
+
+    func install() async -> Bool {
+        logger.debug("Installing agent")
+        _ = setEnabled(false)
+        // This is definitely a bit of a "seems to work better" thing but:
+        // Seems to more reliably hit if these are on separate runloops, otherwise it seems like it sometimes doesn't kill old
+        // and start new?
+        try? await Task.sleep(for: .seconds(1))
+        let result = await MainActor.run {
+            setEnabled(true)
+        }
+        try? await Task.sleep(for: .seconds(1))
+        return result
+    }
+
+    func uninstall() async -> Bool {
+        logger.debug("Uninstalling agent")
+        try? await Task.sleep(for: .seconds(1))
+        let result = await MainActor.run {
+            setEnabled(false)
+        }
+        try? await Task.sleep(for: .seconds(1))
+        return result
+    }
+
+    func forceLaunch() async -> Bool {
+        logger.debug("Agent is not running, attempting to force launch")
+        let url = Bundle.main.bundleURL.appendingPathComponent("Contents/Library/LoginItems/SecretAgent.app")
+        let config = NSWorkspace.OpenConfiguration()
+        config.activates = false
+        do {
+            try await NSWorkspace.shared.openApplication(at: url, configuration: config)
+            logger.debug("Agent force launched")
+            try? await Task.sleep(for: .seconds(1))
+            return true
+        } catch {
+            logger.error("Error force launching \(error.localizedDescription)")
+            return false
+        }
+    }
+
+    private func setEnabled(_ enabled: Bool) -> Bool {
+        let service = SMAppService.loginItem(identifier: Bundle.agentBundleID)
+        do {
+            if enabled {
+                try service.register()
+            } else {
+                try service.unregister()
+            }
+            return true
+        } catch {
+            return false
+        }
+    }
+
+}
@@ -0,0 +1,25 @@
+import Foundation
+
+extension URL {
+
+    static var agentHomeURL: URL {
+        URL(fileURLWithPath: URL.homeDirectory.path().replacingOccurrences(of: Bundle.hostBundleID, with: Bundle.agentBundleID))
+    }
+
+    static var socketPath: String {
+        URL.agentHomeURL.appendingPathComponent("socket.ssh").path()
+    }
+
+}
+
+extension String {
+
+    var normalizedPathAndFolder: (String, String) {
+        // All foundation-based normalization methods replace this with the container directly.
+        let processedPath = replacingOccurrences(of: "~", with: "/Users/\(NSUserName())")
+        let url = URL(filePath: processedPath)
+        let folder = url.deletingLastPathComponent().path()
+        return (processedPath, folder)
+    }
+
+}
@@ -1,7 +1,7 @@
 import Foundation
 import AppKit

-class PreviewAgentLaunchController: AgentLaunchControllerProtocol {
+class PreviewAgentStatusChecker: AgentStatusCheckerProtocol {

    let running: Bool
    let process: NSRunningApplication?
@@ -15,13 +15,4 @@ class PreviewAgentLaunchController: AgentLaunchControllerProtocol {
    func check() {
    }

-    func install() async throws {
-    }
-
-    func uninstall() async throws {
-    }
-
-    func forceLaunch() async throws {
-    }
-
 }
@@ -14,7 +14,6 @@ extension Preview {
            Attributes(
                keyType: .init(algorithm: .ecdsa, size: 256),
                authentication: .presenceRequired,
-                restrictions: .default
            )
        }
    }
@@ -39,7 +38,7 @@ extension Preview {
            self.init(secrets: new)
        }

-        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?) throws -> Data {
+        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
            return data
        }

@@ -83,7 +82,7 @@ extension Preview {
            self.init(secrets: new)
        }

-        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance, target: SigningRequestTarget?) throws -> Data {
+        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
            return data
        }

@@ -12,14 +12,14 @@
 	<true/>
 	<key>com.apple.security.hardened-process.dyld-ro</key>
 	<true/>
+	<key>com.apple.security.hardened-process.enhanced-security-version</key>
+	<integer>1</integer>
 	<key>com.apple.security.hardened-process.hardened-heap</key>
 	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
-	<string>1</string>
+	<key>com.apple.security.hardened-process.platform-restrictions</key>
+	<integer>2</integer>
 	<key>com.apple.security.smartcard</key>
 	<true/>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
-	<string>2</string>
 	<key>keychain-access-groups</key>
 	<array>
 		<string>$(AppIdentifierPrefix)com.maxgoedjen.Secretive</string>
@@ -3,7 +3,6 @@ import SwiftUI
 struct SetupView: View {

    @Environment(\.dismiss) private var dismiss
-    @Environment(\.agentLaunchController) private var agentLaunchController
    @Binding var setupComplete: Bool

    @State var showingIntegrations = false
@@ -32,7 +31,7 @@ struct SetupView: View {
                    ) {
                        installed = true
                        Task {
-                            try? await agentLaunchController.install()
+                            await LaunchAgentController().install()
                        }
                    }
                }
@@ -1,7 +1,5 @@
 import SwiftUI
 import SecretKit
-import SSHProtocolKit
-import Common

 struct ToolConfigurationView: View {

@@ -12,7 +10,6 @@ struct ToolConfigurationView: View {

    @State var creating = false
    @State var selectedSecret: AnySecret?
-    @State var email = ""

    init(selectedInstruction: ConfigurationFileInstructions) {
        self.selectedInstruction = selectedInstruction
@@ -51,12 +48,6 @@ struct ToolConfigurationView: View {
                                    .tag(secret)
                            }
                        }
-                        TextField(text: $email, prompt: Text(.integrationsConfigureUsingEmailPlaceholder)) {
-                            Text(.integrationsConfigureUsingEmailTitle)
-                            Text(.integrationsConfigureUsingEmailSubtitle)
-                                .font(.subheadline)
-                                .foregroundStyle(.secondary)
-                        }
                    } header: {
                        Text(.integrationsConfigureUsingSecretHeader)
                    }
@@ -69,7 +60,7 @@ struct ToolConfigurationView: View {
                Section {
                    ConfigurationItemView(title: .integrationsPathTitle, value: stepGroup.path, action: .revealInFinder(stepGroup.path))
                    ForEach(stepGroup.steps, id: \.self.key) { step in
-                        ConfigurationItemView(title: .integrationsAddThisTitle, action: .copy(placeholdersReplaced(text: String(localized: step)))) {
+                        ConfigurationItemView(title: .integrationsAddThisTitle, action: .copy(String(localized: step))) {
                            HStack {
                                Text(placeholdersReplaced(text: String(localized: step)))
                                    .padding(8)
@@ -111,11 +102,10 @@ struct ToolConfigurationView: View {
    func placeholdersReplaced(text: String) -> String {
        guard let selectedSecret else { return text }
        let writer = OpenSSHPublicKeyWriter()
-        let gitAllowedSignersString = [email.isEmpty ? String(localized: .integrationsConfigureUsingEmailPlaceholder) : email, writer.openSSHString(secret: selectedSecret)]
-            .joined(separator: " ")
+        let fileController = PublicKeyFileStoreController(homeDirectory: URL.agentHomeURL)
        return text
-            .replacingOccurrences(of: Instructions.Constants.publicKeyPlaceholder, with: gitAllowedSignersString)
-            .replacingOccurrences(of: Instructions.Constants.publicKeyPathPlaceholder, with: URL.publicKeyPath(for: selectedSecret, in: URL.publicKeyDirectory))
+            .replacingOccurrences(of: Instructions.Constants.publicKeyPlaceholder, with: writer.openSSHString(secret: selectedSecret))
+            .replacingOccurrences(of: Instructions.Constants.publicKeyPathPlaceholder, with: fileController.publicKeyPath(for: selectedSecret))
    }

 }
@@ -1,93 +0,0 @@
-import SwiftUI
-import SecretKit
-import Common
-import CertificateKit
-import SSHProtocolKit
-import CryptoKit
-struct CertificateDetailView: View {
-
-    let certificate: Certificate
-
-    var body: some View {
-        ScrollView {
-            Form {
-                Section {
-                    CopyableView(
-                        title: .certificateDetailKeyIdLabel,
-                        image: Image(systemName: "person.text.rectangle"),
-                        text: certificate.keyID
-                    )
-                    Spacer()
-                        .frame(height: 20)
-                    CopyableView(
-                        title: .certificateDetailSerialLabel,
-                        image: Image(systemName: "number.circle"),
-                        text: certificate.serial.formatted()
-                    )
-                    Spacer()
-                        .frame(height: 20)
-                    CopyableView(
-                        title: .secretDetailSha256FingerprintLabel,
-                        image: Image(systemName: "touchid"),
-                        text: OpenSSHCertificateWriter().openSSHSHA256KeyFingerprint(publicKey: certificate.publicKey)
-                    )
-                    Spacer()
-                        .frame(height: 20)
-                    CopyableView(
-                        title: .secretDetailSha256FingerprintLabel,
-                        image: Image(systemName: "touchid"),
-                        text: OpenSSHCertificateWriter().openSSHSHA256KeyFingerprint(publicKey: certificate.signingKey)
-                    )
-                    Spacer()
-                        .frame(height: 20)
-                    CopyableView(
-                        title: .certificateDetailPathLabel,
-                        image: Image(systemName: "checkmark.seal.text.page"),
-                        text: URL.certificatePath(for: certificate.id, in: URL.certificatesDirectory),
-                        showRevealInFinder: true
-                    )
-                    if let validityRange = certificate.validityRange {
-                        let epoch = Date(timeIntervalSince1970: 0)
-                        let end = Date(timeIntervalSince1970: TimeInterval(UInt64.max))
-                        switch (validityRange.lowerBound, validityRange.upperBound) {
-                        case (epoch, end):
-                            EmptyView()
-                        case (epoch, let otherEnd):
-                            Spacer()
-                                .frame(height: 20)
-                            MultilineInfoView(title: .certificateDetailValidUntilLabel, image: Image(systemName: "calendar.badge.clock"), items: [otherEnd.formatted()])
-                        case (let otherStart, end):
-                            Spacer()
-                                .frame(height: 20)
-                            MultilineInfoView(title: .certificateDetailValidAfterLabel, image: Image(systemName: "calendar.badge.clock"), items: [otherStart.formatted()])
-                        default:
-                            Spacer()
-                                .frame(height: 20)
-                            MultilineInfoView(title: .certificateDetailValidityRangeLabel, image: Image(systemName: "calendar.badge.clock"), items: [validityRange.formatted()])
-                        }
-                    }
-                    if !certificate.principals.isEmpty {
-                        Spacer()
-                            .frame(height: 20)
-                        MultilineInfoView(title: .certificateDetailPrincipalsLabel, image: Image(systemName: "person.2"), items: certificate.principals)
-                    }
-                    if !certificate.criticalOptions.isEmpty {
-                        Spacer()
-                            .frame(height: 20)
-                        MultilineInfoView(title: .certificateDetailCriticalOptionsLabel, image: Image(systemName: "person.2"), items: certificate.criticalOptions)
-                    }
-                    if !certificate.extensions.isEmpty {
-                        Spacer()
-                            .frame(height: 20)
-                        MultilineInfoView(title: .certificateDetailExtensionsLabel, image: Image(systemName: "person.2"), items: certificate.extensions)
-                    }
-                    Spacer()
-                }
-            }
-            .padding()
-        }
-        .frame(minHeight: 200, maxHeight: .infinity)
-    }
-
-
-}
@@ -1,42 +0,0 @@
-import SwiftUI
-import CertificateKit
-import SSHProtocolKit
-
-struct CertificateListItemView: View {
-
-    @Environment(\.certificateStore) private var store
-
-    var certificate: Certificate
-
-    @State var isDeleting: Bool = false
-    @State var isRenaming: Bool = false
-
-    var deletedCertificate: (Certificate) -> Void
-    var renamedCertificate: (Certificate) -> Void
-
-    var body: some View {
-        NavigationLink(value: certificate) {
-            Text(certificate.name)
-        }
-        .sheet(isPresented: $isRenaming, onDismiss: {
-            renamedCertificate(certificate)
-        }, content: {
-            EditCertificateView(store: store, certificate: certificate)
-        })
-        .showingDeleteConfirmation(isPresented: $isDeleting, certificate, store) { deleted in
-            if deleted {
-                deletedCertificate(certificate)
-            }
-        }
-        .contextMenu {
-                Button(action: { isRenaming = true }) {
-                    Image(systemName: "pencil")
-                    Text(.secretListEditButton)
-                }
-                Button(action: { isDeleting = true }) {
-                    Image(systemName: "trash")
-                    Text(.secretListDeleteButton)
-                }
-        }
-    }
-}
@@ -10,9 +10,8 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
    @State private var name = ""
    @State private var keyAttribution = ""
    @State private var authenticationRequirement: AuthenticationRequirement = .presenceRequired
-    @State private var restrictions: Restrictions = .default
    @State private var keyType: KeyType?
-    @State var advanced = true // FIXME: Set back
+    @State var advanced = false
    @State var errorText: String?

    private var authenticationOptions: [AuthenticationRequirement] {
@@ -73,7 +72,6 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
                    }
                }
                if advanced {
-                    SecretRestrictionsView(restrictions: $restrictions)
                    Section {
                        VStack {
                            Picker(.createSecretKeyTypeLabel, selection: $keyType) {
@@ -109,8 +107,6 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
                                .font(.subheadline)
                                .foregroundStyle(.secondary)
                        }
-                    } header: {
-                        Text("Key Properties")
                    }
                }
                if let errorText {
@@ -150,7 +146,6 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
                    attributes: .init(
                        keyType: keyType!,
                        authentication: authenticationRequirement,
-                        restrictions: restrictions,
                        publicKeyAttribution: attribution
                    )
                )
@@ -163,52 +158,7 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
    }

 }
-struct SecretRestrictionsView: View {

-    @Binding var restrictions: Restrictions
-
-    struct IdentifiedString: Identifiable {
-        let value: String
-        var id: String { value }
-    }
-
-    var body: some View {
-        Section {
-            Toggle("Allow Forwarding", isOn: $restrictions.allowForwarding)
-            Toggle("Allow Signing Operations", isOn: $restrictions.allowSigning)
-            Toggle("Allow Connection Operations", isOn: $restrictions.allowConnections)
-            Picker(selection: $restrictions.allowedDomains) {
-                Text("All")
-                    .tag(Restrictions.AllowedDomains.all)
-                Text("Specific")
-                    .tag(Restrictions.AllowedDomains.specific([]))
-            } label: {
-                Text("Allowed Domains")
-            }
-        } header: {
-            Text("Restrictions")
-        }
-        if restrictions.allowedDomains != .all {
-            Section {
-                switch restrictions.allowedDomains {
-                case .all:
-                    EmptyView()
-                case .specific(let array):
-                    if restrictions.allowedDomains != .all {
-                        ForEach((array + [""]).map({IdentifiedString(value: $0)})) {
-                            TextField("", text: .constant($0.value), prompt: Text("example.com"))
-                                .labelsHidden()
-                        }
-                    }
-                }
-            } header: {
-                Text("Allowed Domains")
-            }
-        }
-    }
-}
-
-#Preview {
-    CreateSecretView(store: Preview.StoreModifiable()) { _ in }
-        .frame(height: 1000)
-}
+//#Preview {
+//    CreateSecretView(store: Preview.StoreModifiable()) { _ in }
+//}
@@ -1,52 +0,0 @@
-import SwiftUI
-import CertificateKit
-import SSHProtocolKit
-
-extension View {
-
-    func showingDeleteConfirmation(isPresented: Binding<Bool>, _ certificate: Certificate,  _ store: CertificateStore, dismissalBlock: @escaping (Bool) -> ()) -> some View {
-        modifier(DeleteCertificateConfirmationModifier(isPresented: isPresented, certificate: certificate, store: store, dismissalBlock: dismissalBlock))
-    }
-
-}
-
-struct DeleteCertificateConfirmationModifier: ViewModifier {
-
-    var isPresented: Binding<Bool>
-    var certificate: Certificate
-    var store: CertificateStore
-    var dismissalBlock: (Bool) -> ()
-    @State var confirmedSecretName = ""
-    @State private var errorText: String?
-
-    func body(content: Content) -> some View {
-        content
-            .confirmationDialog(
-                String(localized: .deleteConfirmationTitle(name: certificate.name)),
-                isPresented: isPresented,
-                titleVisibility: .visible,
-                actions: {
-                    Button(.deleteConfirmationDeleteButton, action: delete)
-                    Button(.deleteConfirmationCancelButton, role: .cancel) {
-                        dismissalBlock(false)
-                    }
-                },
-            )
-            .dialogIcon(Image(systemName: "lock.trianglebadge.exclamationmark.fill"))
-            .onExitCommand {
-                dismissalBlock(false)
-            }
-    }
-
-    func delete() {
-        Task {
-            do {
-                try store.delete(certificate: certificate)
-                dismissalBlock(true)
-            } catch {
-                errorText = error.localizedDescription
-            }
-        }
-    }
-
-}
@@ -21,7 +21,7 @@ struct DeleteSecretConfirmationModifier: ViewModifier {
    func body(content: Content) -> some View {
        content
            .confirmationDialog(
-                .deleteConfirmationTitle(name: secret.name),
+                .deleteConfirmationTitle(secretName: secret.name),
                isPresented: isPresented,
                titleVisibility: .visible,
                actions: {
@@ -1,60 +0,0 @@
-import SwiftUI
-import SSHProtocolKit
-import CertificateKit
-
-struct EditCertificateView: View {
-
-    let store: CertificateStore
-    let certificate: Certificate
-
-    @State private var name: String
-    @State var errorText: String?
-
-    @Environment(\.dismiss) var dismiss
-
-    init(store: CertificateStore, certificate: Certificate) {
-        self.store = store
-        self.certificate = certificate
-        name = certificate.name
-    }
-
-    var body: some View {
-        VStack(alignment: .trailing) {
-            Form {
-                Section {
-                    TextField(String(localized: .renameCertificateLabel), text: $name, prompt: Text(.renameCertificateNamePlaceholder))
-                } footer: {
-                    if let errorText {
-                        Text(verbatim: errorText)
-                            .errorStyle()
-                    }
-                }
-            }
-            HStack {
-                Button(.editCancelButton) {
-                    dismiss()
-                }
-                .keyboardShortcut(.cancelAction)
-                Button(.editSaveButton, action: rename)
-                    .disabled(name.isEmpty)
-                    .keyboardShortcut(.return)
-                    .primaryButton()
-            }
-            .padding()
-        }
-        .formStyle(.grouped)
-    }
-
-    func rename() {
-        Task {
-            do {
-                var updated = certificate
-                updated.openSSHCertificate.name = name
-                try store.update(certificate: updated)
-                dismiss()
-            } catch {
-                errorText = error.localizedDescription
-            }
-        }
-    }
-}
@@ -1,57 +1,27 @@
 import SwiftUI
 import SecretKit
-import Common
-import CertificateKit
-import SSHProtocolKit

 struct SecretDetailView<SecretType: Secret>: View {
    
    let secret: SecretType
-    let certificates: [Certificate]
-    let navigateToCertificate: ((Certificate) -> Void)?

    private let keyWriter = OpenSSHPublicKeyWriter()
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: URL.agentHomeURL)

    var body: some View {
        ScrollView {
            Form {
                Section {
-                    CopyableView(
-                        title: .secretDetailSha256FingerprintLabel,
-                        image: Image(systemName: "touchid"),
-                        text: keyWriter.openSSHSHA256Fingerprint(secret: secret)
-                    )
+                    CopyableView(title: .secretDetailSha256FingerprintLabel, image: Image(systemName: "touchid"), text: keyWriter.openSSHSHA256Fingerprint(secret: secret))
                    Spacer()
                        .frame(height: 20)
-                    CopyableView(
-                        title: .secretDetailMd5FingerprintLabel,
-                        image: Image(systemName: "touchid"),
-                        text: keyWriter.openSSHMD5Fingerprint(secret: secret)
-                    )
+                    CopyableView(title: .secretDetailMd5FingerprintLabel, image: Image(systemName: "touchid"), text: keyWriter.openSSHMD5Fingerprint(secret: secret))
                    Spacer()
                        .frame(height: 20)
-                    CopyableView(
-                        title: .secretDetailPublicKeyPathLabel,
-                        image: Image(systemName: "lock.doc"),
-                        text: URL.publicKeyPath(for: secret, in: URL.publicKeyDirectory),
-                        showRevealInFinder: true
-                    )
-                    if !certificates.isEmpty {
-                        Spacer()
-                            .frame(height: 20)
-                        MultilineInfoView(
-                            title: .secretDetailCertificatePathLabel,
-                            image: Image(
-                                systemName: "checkmark.seal.text.page"
-                            ),
-                            items: certificates.map({ certificate in
-                                MultilineInfoView.Item(
-                                    text: certificate.name,
-                                    action: (Image(systemName: "chevron.forward"), { navigateToCertificate?(certificate) })
-                                )
-                            })
-                        )
-                    }
+                    CopyableView(title: .secretDetailPublicKeyLabel, image: Image(systemName: "key"), text: keyString)
+                    Spacer()
+                        .frame(height: 20)
+                    CopyableView(title: .secretDetailPublicKeyPathLabel, image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.publicKeyPath(for: secret), showRevealInFinder: true)
                    Spacer()
                }
            }
@@ -61,6 +31,10 @@ struct SecretDetailView<SecretType: Secret>: View {
    }


+    var keyString: String {
+        keyWriter.openSSHString(secret: secret)
+    }
+
 }

 //#Preview {
@@ -24,18 +24,6 @@ struct SecretListItemView: View {
                Text(secret.name)
            }
        }
-        .sheet(isPresented: $isRenaming, onDismiss: {
-            renamedSecret(secret)
-        }, content: {
-            if let modifiable = store as? AnySecretStoreModifiable {
-                EditSecretView(store: modifiable, secret: secret)
-            }
-        })
-        .showingDeleteConfirmation(isPresented: $isDeleting, secret, store as? AnySecretStoreModifiable) { deleted in
-            if deleted {
-                deletedSecret(secret)
-            }
-        }
        .contextMenu {
            if store is AnySecretStoreModifiable {
                Button(action: { isRenaming = true }) {
@@ -48,5 +36,17 @@ struct SecretListItemView: View {
                }
            }
        }
+        .showingDeleteConfirmation(isPresented: $isDeleting, secret, store as? AnySecretStoreModifiable) { deleted in
+            if deleted {
+                deletedSecret(secret)
+            }
+        }
+        .sheet(isPresented: $isRenaming, onDismiss: {
+            renamedSecret(secret)
+        }, content: {
+            if let modifiable = store as? AnySecretStoreModifiable {
+                EditSecretView(store: modifiable, secret: secret)
+            }
+        })
    }
 }
@@ -1,33 +1,25 @@
 import SwiftUI
 import SecretKit
-import SSHProtocolKit
-import CertificateKit

 struct StoreListView: View {

-    enum StoreListSelection: Hashable {
-        case secret(AnySecret)
-        case certificate(Certificate)
-    }
-
-    @Binding var selection: StoreListSelection?
+    @Binding var activeSecret: AnySecret?

    @Environment(\.secretStoreList) private var storeList
-    @Environment(\.certificateStore) private var certificateStore

    private func secretDeleted(secret: AnySecret) {
-        selection = nextDefaultSecret.map(StoreListSelection.secret)
+        activeSecret = nextDefaultSecret
    }

    private func secretRenamed(secret: AnySecret) {
        // Pull new version from store, so we get all updated attributes
-        selection = nil
-        selection = storeList.allSecrets.first(where: { $0.id == secret.id }).map(StoreListSelection.secret)
+        activeSecret = nil
+        activeSecret = storeList.allSecrets.first(where: { $0.id == secret.id })
    }

    var body: some View {
        NavigationSplitView {
-            List(selection: $selection) {
+            List(selection: $activeSecret) {
                ForEach(storeList.stores) { store in
                    if store.isAvailable {
                        Section(header: Text(store.name)) {
@@ -38,51 +30,29 @@ struct StoreListView: View {
                                    deletedSecret: secretDeleted,
                                    renamedSecret: secretRenamed,
                                )
-                                .tag(StoreListSelection.secret(secret))
                            }
                        }
                    }
                }
-                if !certificateStore.certificates.isEmpty {
-                    Section("Certificates") {
-                        ForEach(certificateStore.certificates) { certificate in
-                            CertificateListItemView(
-                                certificate: certificate,
-                                deletedCertificate: { _ in },
-                                renamedCertificate: { _ in }
-                            )
-                            .tag(StoreListSelection.certificate(certificate))
-                        }
-                    }
-                }
            }
        } detail: {
-            switch selection {
-            case .secret(let secret):
-                SecretDetailView(secret: secret, certificates: certificateStore.certificates(for: secret)) {
-                    selection = .certificate($0)
-                }
-            case .certificate(let certificate):
-                CertificateDetailView(certificate: certificate)
-            case nil:
-                if let nextDefaultSecret {
-                    // This just means onAppear hasn't executed yet.
-                    // Do this to avoid a blip.
-                    SecretDetailView(secret: nextDefaultSecret, certificates: certificateStore.certificates(for: nextDefaultSecret)) {
-                        selection = .certificate($0)
-                    }
+            if let activeSecret {
+                SecretDetailView(secret: activeSecret)
+            } else if let nextDefaultSecret {
+                // This just means onAppear hasn't executed yet.
+                // Do this to avoid a blip.
+                SecretDetailView(secret: nextDefaultSecret)
+            } else {
+                if let modifiable = storeList.modifiableStore, modifiable.isAvailable {
+                    EmptyStoreView(store: modifiable)
                } else {
-                    if let modifiable = storeList.modifiableStore, modifiable.isAvailable {
-                        EmptyStoreView(store: modifiable)
-                    } else {
-                        EmptyStoreView(store: storeList.stores.first(where: \.isAvailable))
-                    }
+                    EmptyStoreView(store: storeList.stores.first(where: \.isAvailable))
                }
            }
        }
        .navigationSplitViewStyle(.balanced)
        .onAppear {
-            selection = nextDefaultSecret.map(StoreListSelection.secret)
+            activeSecret = nextDefaultSecret
        }
        .frame(minWidth: 100, idealWidth: 240)

@@ -2,10 +2,10 @@ import SwiftUI

 struct AgentStatusView: View {

-    @Environment(\.agentLaunchController) private var agentLaunchController: any AgentLaunchControllerProtocol
+    @Environment(\.agentStatusChecker) private var agentStatusChecker: any AgentStatusCheckerProtocol

    var body: some View {
-        if agentLaunchController.running {
+        if agentStatusChecker.running {
            AgentRunningView()
        } else {
            AgentNotRunningView()
@@ -14,13 +14,12 @@ struct AgentStatusView: View {
 }
 struct AgentRunningView: View {

-    @Environment(\.agentLaunchController) private var agentLaunchController: any AgentLaunchControllerProtocol
-    @AppStorage("explicitlyDisabled") var explicitlyDisabled = false
+    @Environment(\.agentStatusChecker) private var agentStatusChecker: any AgentStatusCheckerProtocol

    var body: some View {
        Form {
            Section {
-                if let process = agentLaunchController.process {
+                if let process = agentStatusChecker.process {
                    ConfigurationItemView(
                        title: .agentDetailsLocationTitle,
                        value: process.bundleURL!.path(),
@@ -54,14 +53,19 @@ struct AgentRunningView: View {
                        Menu(.agentDetailsRestartAgentButton) {
                            Button(.agentDetailsDisableAgentButton) {
                                Task {
-                                    explicitlyDisabled = true
-                                    try? await agentLaunchController
+                                    _ = await LaunchAgentController()
                                        .uninstall()
+                                    agentStatusChecker.check()
                                }
                            }
                        } primaryAction: {
                            Task {
-                                try? await agentLaunchController.forceLaunch()
+                                let controller = LaunchAgentController()
+                                let installed = await controller.install()
+                                if !installed {
+                                    _ = await controller.forceLaunch()
+                                }
+                                agentStatusChecker.check()
                            }
                        }
                    }
@@ -78,10 +82,9 @@ struct AgentRunningView: View {

 struct AgentNotRunningView: View {

-    @Environment(\.agentLaunchController) private var agentLaunchController
+    @Environment(\.agentStatusChecker) private var agentStatusChecker: any AgentStatusCheckerProtocol
    @State var triedRestart = false
    @State var loading = false
-    @AppStorage("explicitlyDisabled") var explicitlyDisabled = false

    var body: some View {
        Form {
@@ -97,14 +100,18 @@ struct AgentNotRunningView: View {
                        if !triedRestart {
                            Spacer()
                            Button {
-                                explicitlyDisabled = false
                                guard !loading else { return }
                                loading = true
                                Task {
-                                    try? await agentLaunchController.forceLaunch()
+                                    let controller = LaunchAgentController()
+                                    let installed = await controller.install()
+                                    if !installed {
+                                        _ = await controller.forceLaunch()
+                                    }
+                                    agentStatusChecker.check()
                                    loading = false

-                                    if !agentLaunchController.running {
+                                    if !agentStatusChecker.running {
                                        triedRestart = true
                                    }
                                }
@@ -138,9 +145,9 @@ struct AgentNotRunningView: View {

 //#Preview {
 //    AgentStatusView()
-//        .environment(\.agentLaunchController, PreviewAgentLaunchController(running: false))
+//        .environment(\.agentStatusChecker, PreviewAgentStatusChecker(running: false))
 //}
 //#Preview {
 //    AgentStatusView()
-//        .environment(\.agentLaunchController, PreviewAgentLaunchController(running: true, process: .current))
+//        .environment(\.agentStatusChecker, PreviewAgentStatusChecker(running: true, process: .current))
 //}
@@ -3,22 +3,18 @@ import SecretKit
 import SecureEnclaveSecretKit
 import SmartCardSecretKit
 import Brief
-import SSHProtocolKit
-import SharedXPCServices
-import CertificateKit

 struct ContentView: View {

-    @State var selection: StoreListView.StoreListSelection?
+    @State var activeSecret: AnySecret?

    @State private var selectedUpdate: Release?

    @Environment(\.colorScheme) private var colorScheme
    @Environment(\.openWindow) private var openWindow
    @Environment(\.secretStoreList) private var storeList
-    @Environment(\.certificateStore) private var certificateStore
    @Environment(\.updater) private var updater
-    @Environment(\.agentLaunchController) private var agentLaunchController
+    @Environment(\.agentStatusChecker) private var agentStatusChecker

    @AppStorage("defaultsHasRunSetup") private var hasRunSetup = false
    @State private var showingCreation = false
@@ -29,7 +25,7 @@ struct ContentView: View {
    var body: some View {
        VStack {
            if storeList.anyAvailable {
-                StoreListView(selection: $selection)
+                StoreListView(activeSecret: $activeSecret)
            } else {
                NoStoresView()
            }
@@ -46,22 +42,6 @@ struct ContentView: View {
                runningSetup = true
            }
        }
-        .dropDestination(for: URL.self) { items, location in
-                guard let url = items.first, url.pathExtension == "pub" else { return false }
-            Task {
-                do {
-                    let data = try Data(contentsOf: url)
-                    let parser = try await XPCCertificateParser()
-                    let cert = try await parser.parse(data: data)
-                    let wrapped = Certificate(openSSHCertificate: cert, rawData: data)
-                    try certificateStore.save(certificate: wrapped)
-                    selection = .certificate(wrapped)
-                } catch {
-
-                }
-            }
-            return true
-        } isTargeted: { _ in }
        .focusedSceneValue(\.showCreateSecret,  .init(isEnabled: !runningSetup) {
            showingCreation = true
        })
@@ -69,7 +49,7 @@ struct ContentView: View {
            if let modifiable = storeList.modifiableStore {
                CreateSecretView(store: modifiable) { created in
                    if let created {
-                        selection = .secret(created)
+                        activeSecret = created
                    }
                }
            }
@@ -147,7 +127,7 @@ extension ContentView {
            showingAgentInfo = true
        }, label: {
            HStack {
-                if agentLaunchController.running {
+                if agentStatusChecker.running {
                    Text(.agentRunningNoticeTitle)
                        .font(.headline)
                        .foregroundColor(colorScheme == .light ? Color(white: 0.3) : .white)
@@ -165,8 +145,8 @@ extension ContentView {
        })
        .buttonStyle(
            ToolbarStatusButtonStyle(
-                lightColor: agentLaunchController.running ? .black.opacity(0.05) : .red.opacity(0.75),
-                darkColor: agentLaunchController.running ? .white.opacity(0.05) : .red.opacity(0.5),
+                lightColor: agentStatusChecker.running ? .black.opacity(0.05) : .red.opacity(0.75),
+                darkColor: agentStatusChecker.running ? .white.opacity(0.05) : .red.opacity(0.5),
            )
        )
        .popover(isPresented: $showingAgentInfo, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) {
@@ -4,13 +4,12 @@ import UniformTypeIdentifiers
 struct CopyableView: View {

    var title: LocalizedStringResource
-    var subtitle: String?
    var image: Image
    var text: String
    var showRevealInFinder = false

    @State private var interactionState: InteractionState = .normal
-
+    
    var content: some View {
        VStack(alignment: .leading, spacing: 15) {
            HStack {
@@ -18,16 +17,9 @@ struct CopyableView: View {
                    .renderingMode(.template)
                    .imageScale(.large)
                    .foregroundColor(primaryTextColor)
-                VStack(alignment: .leading) {
-                    Text(title)
-                        .font(.headline)
-                        .foregroundColor(primaryTextColor)
-                    if let subtitle {
-                        Text(subtitle)
-                            .font(.system(.subheadline, design: .monospaced))
-                            .foregroundColor(secondaryTextColor)
-                    }
-                }
+                Text(title)
+                    .font(.headline)
+                    .foregroundColor(primaryTextColor)
                Spacer()
                if interactionState != .normal {
                    HStack {
@@ -163,7 +155,8 @@ fileprivate struct BackgroundViewModifier: ViewModifier {
        } else {
            if #available(macOS 26.0, *) {
                content
-                    .contentShape(RoundedRectangle(cornerRadius: 15))
+                // Very thin opacity lets user hover anywhere over the view, glassEffect doesn't allow.
+                    .background(.white.opacity(0.01), in: RoundedRectangle(cornerRadius: 15))
                    .glassEffect(.regular.tint(backgroundColor(interactionState: interactionState)), in: RoundedRectangle(cornerRadius: 15))
                    .mask(RoundedRectangle(cornerRadius: 15))
                    .shadow(color: .black.opacity(0.1), radius: 5)
@@ -178,12 +171,7 @@ fileprivate struct BackgroundViewModifier: ViewModifier {
    func backgroundColor(interactionState: InteractionState) -> Color {
        guard appearsActive else { return Color.clear }
        if #available(macOS 26.0, *) {
-            let base: Color
-            if #available(macOS 27.0, *) {
-                base = .clear
-            } else {
-                base = colorScheme == .dark ? Color(white: 0.2) : Color(white: 1)
-            }
+            let base = colorScheme == .dark ? Color(white: 0.2) : Color(white: 1)
            switch interactionState {
            case .normal:
                return base
@@ -1,170 +0,0 @@
-import SwiftUI
-import UniformTypeIdentifiers
-
-struct MultilineInfoView: View {
-
-    struct Item {
-        let text: String
-        let action: (Image, () -> Void)?
-    }
-
-    var title: LocalizedStringResource
-    var image: Image
-    var items: [Item]
-
-    init(title: LocalizedStringResource, image: Image, items: [Item]) {
-        self.title = title
-        self.image = image
-        self.items = items
-    }
-
-    init(title: LocalizedStringResource, image: Image, items: [String]) {
-        self.title = title
-        self.image = image
-        self.items = items.map({ Item(text: $0, action: nil) })
-    }
-
-    @State private var interactionState: InteractionState = .normal
-    @State private var interactionStateIndex: Int?
-
-    var body: some View {
-        VStack(alignment: .leading, spacing: 0) {
-            HStack {
-                image
-                    .renderingMode(.template)
-                    .imageScale(.large)
-                    .foregroundColor(primaryTextColor)
-                Text(title)
-                    .font(.headline)
-                    .foregroundColor(primaryTextColor)
-                Spacer()
-            }
-            .safeAreaPadding(20)
-            ForEach(Array(items.enumerated()), id: \.offset) { item in
-                Divider()
-                    .ignoresSafeArea()
-                    .opacity(item.offset == 0 ? 1 : 0.75)
-                HStack {
-                    Text(item.element.text)
-                    Spacer()
-                    if let (image, _) = item.element.action {
-                        image
-                            .foregroundStyle(.secondary)
-                    }
-                }
-                .safeAreaPadding(20)
-                .onHover { hovering in
-                    withAnimation {
-                        guard item.element.action != nil else { return }
-                        interactionState = hovering ? .hovering : .normal
-                        interactionStateIndex = item.offset
-                    }
-                }
-                .gesture(
-                    TapGesture()
-                        .onEnded {
-                            item.element.action?.1()
-                            withAnimation {
-                                interactionState = .normal
-                                interactionStateIndex = nil
-                            }
-                        }
-                )
-
-            }
-        }
-        ._background(interactionState: .normal)
-        .frame(minWidth: 150, maxWidth: .infinity)
-    }
-
-    var primaryTextColor: Color {
-        switch interactionState {
-        case .normal, .hovering:
-            return Color(.textColor)
-        }
-    }
-
-    var secondaryTextColor: Color {
-        switch interactionState {
-        case .normal, .hovering:
-            return Color(.secondaryLabelColor)
-        }
-    }
-
-}
-
-fileprivate enum InteractionState {
-    case normal, hovering
-}
-
-extension View {
-       
-    fileprivate func _background(interactionState: InteractionState, cornerRadius: Double = 15) -> some View {
-        modifier(BackgroundViewModifier(interactionState: interactionState, cornerRadius: cornerRadius))
-    }
-    
-}
-
-fileprivate struct BackgroundViewModifier: ViewModifier {
-    
-    @Environment(\.colorScheme) private var colorScheme
-    @Environment(\.appearsActive) private var appearsActive
-    
-    let interactionState: InteractionState
-    let cornerRadius: Double
-    
-    func body(content: Content) -> some View {
-        if #available(macOS 26.0, *) {
-            content
-                .contentShape(RoundedRectangle(cornerRadius: cornerRadius))
-                .glassEffect(.regular.tint(backgroundColor(interactionState: interactionState)), in: RoundedRectangle(cornerRadius: cornerRadius))
-                .mask(RoundedRectangle(cornerRadius: cornerRadius))
-                .shadow(color: .black.opacity(0.1), radius: 5)
-        } else {
-            content
-                .background(backgroundColor(interactionState: interactionState))
-                .cornerRadius(10)
-        }
-    }
-    
-    func backgroundColor(interactionState: InteractionState) -> Color {
-        guard appearsActive else { return Color.clear }
-        if #available(macOS 26.0, *) {
-            let base: Color
-            if #available(macOS 27.0, *) {
-                base = .clear
-            } else {
-                base = colorScheme == .dark ? Color(white: 0.2) : Color(white: 1)
-            }
-            switch interactionState {
-            case .normal:
-                return base
-            case .hovering:
-                return base.mix(with: .accentColor, by: colorScheme == .dark ? 0.2 : 0.1)
-            }
-        } else {
-            switch interactionState {
-            case .normal:
-                return colorScheme == .dark ? Color(white: 0.2) : Color(white: 0.885)
-            case .hovering:
-                return colorScheme == .dark ? Color(white: 0.275) : Color(white: 0.82)
-            }
-        }
-    }
-    
-    
-}
-
-#Preview {
-    MultilineInfoView(title: "Multiple", image: Image(systemName: "figure.wave"), items: [
-        MultilineInfoView.Item(text: "hello", action: (Image(systemName: "chevron.forward"), {})),
-        MultilineInfoView.Item(text: "World", action: (Image(systemName: "chevron.forward"), {})),
-    ])
-    .padding()
-}
-
-
-#Preview {
-    MultilineInfoView(title: "One", image: Image(systemName: "figure.wave"), items: ["Hello world."])
-        .padding()
-}
@@ -1,11 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>XPCService</key>
-	<dict>
-		<key>ServiceType</key>
-		<string>Application</string>
-	</dict>
-</dict>
-</plist>
@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>com.apple.security.hardened-process</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.enable-pure-data</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.no-tagged-receive</key>
-	<true/>
-	<key>com.apple.security.hardened-process.dyld-ro</key>
-	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
-	<string>2</string>
-	<key>com.apple.security.hardened-process.hardened-heap</key>
-	<true/>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
-	<string>2</string>
-</dict>
-</plist>
@@ -1,18 +0,0 @@
-import Foundation
-import OSLog
-import XPCWrappers
-import SSHProtocolKit
-import CertificateKit
-
-final class SecretiveCertificateParser: NSObject, XPCProtocol {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.SecretiveCertificateParser", category: "SecretiveCertificateParser")
-
-    func process(_ data: Data) async throws -> OpenSSHCertificate {
-        let parser = OpenSSHCertificateParser()
-        let result = try parser.parse(data: data)
-        logger.log("Parser parsed certificate")
-        return result
-    }
-
-}
@@ -1,7 +0,0 @@
-import Foundation
-import XPCWrappers
-
-let delegate = XPCServiceDelegate(exportedObject: SecretiveCertificateParser())
-let listener = NSXPCListener.service()
-listener.delegate = delegate
-listener.resume()
@@ -12,11 +12,11 @@
 	<true/>
 	<key>com.apple.security.hardened-process.dyld-ro</key>
 	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
-	<string>1</string>
+	<key>com.apple.security.hardened-process.enhanced-security-version</key>
+	<integer>1</integer>
 	<key>com.apple.security.hardened-process.hardened-heap</key>
 	<true/>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
-	<string>2</string>
+	<key>com.apple.security.hardened-process.platform-restrictions</key>
+	<integer>2</integer>
 </dict>
 </plist>
--- a/Show More
+++ b/Show More