Remove CF bridges

.github/workflows/add-to-project.yml

@@ -10,7 +10,7 @@ jobs:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.1
+      - uses: actions/add-to-project@v0.0.3
         with:
           project-url: https://github.com/users/maxgoedjen/projects/1
           github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/nightly.yml

@@ -5,8 +5,8 @@ on:
     - cron: "0 8 * * *"
 jobs:
   build:
-#     runs-on: macOS-latest
-    runs-on: macos-15
+#     runs-on: macOS-latest-xlarge
+    runs-on: macos-13-xlarge
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v4
@@ -20,7 +20,7 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta_5.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_15.2.app
     - name: Update Build Number
       env:
         RUN_ID: ${{ github.run_id }}
@@ -48,7 +48,7 @@ jobs:
             shasum -a 256 Secretive.zip
             shasum -a 256 Archive.zip
     - name: Upload App to Artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v3
       with:
         name: Secretive.zip
         path: Secretive.zip

.github/workflows/release.yml

@@ -6,8 +6,8 @@ on:
       - '*'
 jobs:
   test:
-#     runs-on: macOS-latest
-    runs-on: macos-15
+#     runs-on: macOS-latest-xlarge
+    runs-on: macos-13-xlarge
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v4
@@ -21,7 +21,7 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta_5.app	
+      run: sudo xcrun xcode-select -s /Applications/Xcode_15.2.app
     - name: Test
       run: |
             pushd Sources/Packages
@@ -29,7 +29,7 @@ jobs:
             popd
   build:
 #     runs-on: macOS-latest
-    runs-on: macos-15
+    runs-on: macos-13
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v4
@@ -43,7 +43,7 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta_5.app	
+      run: sudo xcrun xcode-select -s /Applications/Xcode_15.2.app
     - name: Update Build Number
       env:
         TAG_NAME: ${{ github.ref }}
@@ -107,12 +107,12 @@ jobs:
         asset_name: Secretive.zip
         asset_content_type: application/zip
     - name: Upload App to Artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v1
       with:
         name: Secretive.zip
         path: Secretive.zip
     - name: Upload Archive to Artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v1
       with:
         name: Xcode_Archive.zip
         path: Archive.zip

.github/workflows/test.yml

@@ -3,13 +3,13 @@ name: Test
 on: [push, pull_request]
 jobs:
   test:
-#     runs-on: macOS-latest
-    runs-on: macos-15
+#     runs-on: macOS-latest-xlarge
+    runs-on: macos-13-xlarge
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v4
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta_5.app	
+      run: sudo xcrun xcode-select -s /Applications/Xcode_15.2.app
     - name: Test
       run: |
             pushd Sources/Packages

APP_CONFIG.md

@@ -110,15 +110,6 @@ Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
 
 Log out and log in again before launching Gitkraken. Then enable "Use local SSH agent in GitKraken Preferences (Located under Preferences -> SSH)
 
-## Retcon
-
-Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
-
-```
-Host *
-	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
-```
-
 # The app I use isn't listed here!
 
 If you know how to get it set up, please open a PR for this page and add it! Contributions are very welcome.

CONTRIBUTING.md

@@ -20,7 +20,7 @@ If you'd like to contribute a translation, please see [Localizing](LOCALIZING.md
 
 ## Credits
 
-If you make a material contribution to the app, please add yourself to the end of the [credits](https://github.com/maxgoedjen/secretive/blob/main/Sources/Secretive/Credits.rtf).
+If you make a material contribution to the app, please add yourself to the end of the [credits](https://github.com/maxgoedjen/secretive/blob/main/Secretive/Credits.rtf).
 
 ## Collaborator Status
 

Design/Icon.icon/icon.json

@@ -1,59 +0,0 @@
-{
-  "fill" : {
-    "solid" : "srgb:0.00000,0.53333,1.00000,0.00000"
-  },
-  "groups" : [
-    {
-      "blur-material" : 0.5,
-      "layers" : [
-        {
-          "image-name" : "Icon 7.png",
-          "name" : "Signature",
-          "position" : {
-            "scale" : 1,
-            "translation-in-points" : [
-              64.00083178971097,
-              -58.21801551632592
-            ]
-          }
-        },
-        {
-          "image-name" : "Rectangle Copy 10.png",
-          "name" : "Border"
-        },
-        {
-          "fill-specializations" : [
-            {
-              "appearance" : "tinted",
-              "value" : {
-                "solid" : "display-p3:0.00000,0.00000,0.00000,0.50000"
-              }
-            }
-          ],
-          "image-name" : "Rectangle 2 8.png",
-          "name" : "Backing",
-          "opacity-specializations" : [
-            {
-              "appearance" : "tinted",
-              "value" : 1
-            }
-          ]
-        }
-      ],
-      "shadow" : {
-        "kind" : "layer-color",
-        "opacity" : 0.5
-      },
-      "specular" : true,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.5
-      }
-    }
-  ],
-  "supported-platforms" : {
-    "squares" : [
-      "macOS"
-    ]
-  }
-}

Sources/Packages/Package.swift

@@ -1,4 +1,4 @@
-// swift-tools-version:6.2
+// swift-tools-version:5.9
 // The swift-tools-version declares the minimum version of Swift required to build this package.
 
 import PackageDescription
@@ -6,7 +6,7 @@ import PackageDescription
 let package = Package(
     name: "SecretivePackages",
     platforms: [
-        .macOS(.v14)
+        .macOS(.v12)
     ],
     products: [
         .library(
@@ -34,27 +34,27 @@ let package = Package(
         .target(
             name: "SecretKit",
             dependencies: [],
-            swiftSettings: swiftSettings
+            swiftSettings: [.enableExperimentalFeature("StrictConcurrency"), .unsafeFlags(["-warnings-as-errors"])]
         ),
         .testTarget(
             name: "SecretKitTests",
             dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
-            swiftSettings: swiftSettings
+            swiftSettings: [.enableExperimentalFeature("StrictConcurrency"), .unsafeFlags(["-warnings-as-errors"])]
         ),
         .target(
             name: "SecureEnclaveSecretKit",
             dependencies: ["SecretKit"],
-            swiftSettings: swiftSettings
+            swiftSettings: [.enableExperimentalFeature("StrictConcurrency"), .unsafeFlags(["-warnings-as-errors"])]
         ),
         .target(
             name: "SmartCardSecretKit",
             dependencies: ["SecretKit"],
-            swiftSettings: swiftSettings
+            swiftSettings: [.enableExperimentalFeature("StrictConcurrency"), .unsafeFlags(["-warnings-as-errors"])]
         ),
         .target(
             name: "SecretAgentKit",
             dependencies: ["SecretKit", "SecretAgentKitHeaders"],
-            swiftSettings: swiftSettings
+            swiftSettings: [.enableExperimentalFeature("StrictConcurrency"), .unsafeFlags(["-warnings-as-errors"])]
         ),
         .systemLibrary(
             name: "SecretAgentKitHeaders"
@@ -65,8 +65,7 @@ let package = Package(
         ,
         .target(
             name: "Brief",
-            dependencies: [],
-            swiftSettings: swiftSettings
+            dependencies: []
         ),
         .testTarget(
             name: "BriefTests",
@@ -74,10 +73,3 @@ let package = Package(
         ),
     ]
 )
-
-var swiftSettings: [PackageDescription.SwiftSetting] {
-    [
-        .swiftLanguageMode(.v6),
-        .treatAllWarnings(as: .error),
-    ]
-}

Sources/Packages/Sources/Brief/Release.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// A release is a representation of a downloadable update.
-public struct Release: Codable, Sendable {
+public struct Release: Codable {
 
     /// The user-facing name of the release. Typically "Secretive 1.2.3"
     public let name: String

Sources/Packages/Sources/Brief/SemVer.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// A representation of a Semantic Version.
-public struct SemVer: Sendable {
+public struct SemVer {
 
     /// The SemVer broken into an array of integers.
     let versionNumbers: [Int]

Sources/Packages/Sources/Brief/Updater.swift

@@ -1,18 +1,10 @@
 import Foundation
-import Observation
+import Combine
 
 /// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version.
-@Observable public final class Updater: UpdaterProtocol, Sendable {
-
-    private let state = State()
-    @MainActor @Observable public final class State {
-        var update: Release? = nil
-        nonisolated init() {}
-    }
-    public var update: Release? {
-        state.update
-    }
+public final class Updater: ObservableObject, UpdaterProtocol {
 
+    @Published public var update: Release?
     public let testBuild: Bool
 
     /// The current OS version.
@@ -26,43 +18,36 @@ import Observation
     ///   - checkFrequency: The interval at which the Updater should check for updates. Subject to a tolerance of 1 hour.
     ///   - osVersion: The current OS version.
     ///   - currentVersion: The current version of the app that is running.
-    public init(
-        checkOnLaunch: Bool,
-        checkFrequency: TimeInterval = Measurement(value: 24, unit: UnitDuration.hours).converted(to: .seconds).value,
-        osVersion: SemVer = SemVer(ProcessInfo.processInfo.operatingSystemVersion),
-        currentVersion: SemVer = SemVer(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.0.0")
-    ) {
+    public init(checkOnLaunch: Bool, checkFrequency: TimeInterval = Measurement(value: 24, unit: UnitDuration.hours).converted(to: .seconds).value, osVersion: SemVer = SemVer(ProcessInfo.processInfo.operatingSystemVersion), currentVersion: SemVer = SemVer(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.0.0")) {
         self.osVersion = osVersion
         self.currentVersion = currentVersion
         testBuild = currentVersion == SemVer("0.0.0")
         if checkOnLaunch {
             // Don't do a launch check if the user hasn't seen the setup prompt explaining updater yet.
-            Task {
-                await checkForUpdates()
-            }
+            checkForUpdates()
         }
-        Task {
-            while !Task.isCancelled {
-                try? await Task.sleep(for: .seconds(Int(checkFrequency)))
-                await checkForUpdates()
-            }
+        let timer = Timer.scheduledTimer(withTimeInterval: checkFrequency, repeats: true) { _ in
+            self.checkForUpdates()
         }
+        timer.tolerance = 60*60
     }
 
     /// Manually trigger an update check.
-    public func checkForUpdates() async {
-        guard let (data, _) = try? await URLSession.shared.data(from: Constants.updateURL) else { return }
-        guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return }
-        await evaluate(releases: releases)
+    public func checkForUpdates() {
+        URLSession.shared.dataTask(with: Constants.updateURL) { data, _, _ in
+            guard let data = data else { return }
+            guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return }
+            self.evaluate(releases: releases)
+        }.resume()
     }
 
     /// Ignores a specified release. `update` will be nil if the user has ignored the latest available release.
     /// - Parameter release: The release to ignore.
-    public func ignore(release: Release) async {
+    public func ignore(release: Release) {
         guard !release.critical else { return }
         defaults.set(true, forKey: release.name)
-        await MainActor.run {
-            state.update = nil
+        DispatchQueue.main.async {
+            self.update = nil
         }
     }
 
@@ -72,7 +57,7 @@ extension Updater {
 
     /// Evaluates the available downloadable releases, and selects the newest non-prerelease release that the user is able to run.
     /// - Parameter releases: An array of ``Release`` objects.
-    func evaluate(releases: [Release]) async {
+    func evaluate(releases: [Release]) {
         guard let release = releases
                 .sorted()
                 .reversed()
@@ -82,8 +67,8 @@ extension Updater {
         guard !release.prerelease else { return }
         let latestVersion = SemVer(release.name)
         if latestVersion > currentVersion {
-            await MainActor.run {
-                state.update = release
+            DispatchQueue.main.async {
+                self.update = release
             }
         }
     }

Sources/Packages/Sources/Brief/UpdaterProtocol.swift

@@ -1,13 +1,13 @@
 import Foundation
+import Combine
 
 /// A protocol for retreiving the latest available version of an app.
-public protocol UpdaterProtocol: Observable, Sendable {
+public protocol UpdaterProtocol: ObservableObject {
 
     /// The latest update
-    @MainActor var update: Release? { get }
+    var update: Release? { get }
     /// A boolean describing whether or not the current build of the app is a "test" build (ie, a debug build or otherwise special build)
     var testBuild: Bool { get }
 
-    func ignore(release: Release) async
 }
 

Sources/Packages/Sources/SecretAgentKit/Agent.swift

@@ -5,7 +5,7 @@ import SecretKit
 import AppKit
 
 /// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores.
-public final class Agent: Sendable {
+public final class Agent {
 
     private let storeList: SecretStoreList
     private let witness: SigningWitness?
@@ -22,9 +22,7 @@ public final class Agent: Sendable {
         logger.debug("Agent is running")
         self.storeList = storeList
         self.witness = witness
-        Task { @MainActor in
-            await certificateHandler.reloadCertificates(for: storeList.allSecrets)
-        }
+        certificateHandler.reloadCertificates(for: storeList.allSecrets)
     }
     
 }
@@ -37,7 +35,7 @@ extension Agent {
     ///   - writer: A ``FileHandleWriter`` to write the response to.
     /// - Return value: 
     ///   - Boolean if data could be read
-    @discardableResult public func handle(reader: FileHandleReader, writer: FileHandleWriter) async -> Bool {
+    @discardableResult @Sendable public func handle(reader: FileHandleReader, writer: FileHandleWriter) async -> Bool {
         logger.debug("Agent handling new data")
         let data = Data(reader.availableData)
         guard data.count > 4 else { return false}
@@ -56,18 +54,18 @@ extension Agent {
 
     func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) async -> Data {
         // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
-        await reloadSecretsIfNeccessary()
+        reloadSecretsIfNeccessary()
         var response = Data()
         do {
             switch requestType {
             case .requestIdentities:
                 response.append(SSHAgent.ResponseType.agentIdentitiesAnswer.data)
-                response.append(await identities())
+                response.append(identities())
                 logger.debug("Agent returned \(SSHAgent.ResponseType.agentIdentitiesAnswer.debugDescription)")
             case .signRequest:
                 let provenance = requestTracer.provenance(from: reader)
                 response.append(SSHAgent.ResponseType.agentSignResponse.data)
-                response.append(try await sign(data: data, provenance: provenance))
+                response.append(try sign(data: data, provenance: provenance))
                 logger.debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)")
             }
         } catch {
@@ -85,9 +83,9 @@ extension Agent {
 
     /// Lists the identities available for signing operations
     /// - Returns: An OpenSSH formatted Data payload listing the identities available for signing operations.
-    func identities() async -> Data {
-        let secrets = await storeList.allSecrets
-        await certificateHandler.reloadCertificates(for: secrets)
+    func identities() -> Data {
+        let secrets = storeList.allSecrets
+        certificateHandler.reloadCertificates(for: secrets)
         var count = secrets.count
         var keyData = Data()
 
@@ -97,7 +95,7 @@ extension Agent {
             keyData.append(writer.lengthAndData(of: keyBlob))
             keyData.append(writer.lengthAndData(of: curveData))
             
-            if let (certificateData, name) = try? await certificateHandler.keyBlobAndName(for: secret) {
+            if let (certificateData, name) = try? certificateHandler.keyBlobAndName(for: secret) {
                 keyData.append(writer.lengthAndData(of: certificateData))
                 keyData.append(writer.lengthAndData(of: name))
                 count += 1
@@ -114,28 +112,28 @@ extension Agent {
     ///   - data: The data to sign.
     ///   - provenance: A ``SecretKit.SigningRequestProvenance`` object describing the origin of the request.
     /// - Returns: An OpenSSH formatted Data payload containing the signed data response.
-    func sign(data: Data, provenance: SigningRequestProvenance) async throws -> Data {
+    func sign(data: Data, provenance: SigningRequestProvenance) throws -> Data {
         let reader = OpenSSHReader(data: data)
         let payloadHash = reader.readNextChunk()
         let hash: Data
         // Check if hash is actually an openssh certificate and reconstruct the public key if it is
-        if let certificatePublicKey = await certificateHandler.publicKeyHash(from: payloadHash) {
+        if let certificatePublicKey = certificateHandler.publicKeyHash(from: payloadHash) {
             hash = certificatePublicKey
         } else {
             hash = payloadHash
         }
         
-        guard let (store, secret) = await secret(matching: hash) else {
+        guard let (store, secret) = secret(matching: hash) else {
             logger.debug("Agent did not have a key matching \(hash as NSData)")
             throw AgentError.noMatchingKey
         }
 
         if let witness = witness {
-            try await witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
+            try witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
         }
 
         let dataToSign = reader.readNextChunk()
-        let signed = try await store.sign(data: dataToSign, with: secret, for: provenance)
+        let signed = try store.sign(data: dataToSign, with: secret, for: provenance)
         let derSignature = signed
 
         let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
@@ -177,7 +175,7 @@ extension Agent {
         signedData.append(writer.lengthAndData(of: sub))
 
         if let witness = witness {
-            try await witness.witness(accessTo: secret, from: store, by: provenance)
+            try witness.witness(accessTo: secret, from: store, by: provenance)
         }
 
         logger.debug("Agent signed request")
@@ -190,12 +188,11 @@ extension Agent {
 extension Agent {
 
     /// Gives any store with no loaded secrets a chance to reload.
-    func reloadSecretsIfNeccessary() async {
-        for store in await storeList.stores {
-            if await store.secrets.isEmpty {
-                let name = await store.name
-                logger.debug("Store \(name, privacy: .public) has no loaded secrets. Reloading.")
-                await store.reloadSecrets()
+    func reloadSecretsIfNeccessary() {
+        for store in storeList.stores {
+            if store.secrets.isEmpty {
+                logger.debug("Store \(store.name, privacy: .public) has no loaded secrets. Reloading.")
+                store.reloadSecrets()
             }
         }
     }
@@ -203,16 +200,16 @@ extension Agent {
     /// Finds a ``Secret`` matching a specified hash whos signature was requested.
     /// - Parameter hash: The hash to match against.
     /// - Returns: A ``Secret`` and the ``SecretStore`` containing it, if a match is found.
-    func secret(matching hash: Data) async -> (AnySecretStore, AnySecret)? {
-        for store in await storeList.stores {
-            let allMatching = await store.secrets.filter { secret in
+    func secret(matching hash: Data) -> (AnySecretStore, AnySecret)? {
+        storeList.stores.compactMap { store -> (AnySecretStore, AnySecret)? in
+            let allMatching = store.secrets.filter { secret in
                 hash == writer.data(secret: secret)
             }
             if let matching = allMatching.first {
                 return (store, matching)
             }
-        }
-        return nil
+            return nil
+        }.first
     }
 
 }

Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift

@@ -2,7 +2,7 @@ import Foundation
 import SecretKit
 
 /// A protocol that allows conformers to be notified of access to secrets, and optionally prevent access.
-public protocol SigningWitness: Sendable {
+public protocol SigningWitness {
 
     /// A ridiculously named method that notifies the callee that a signing operation is about to be performed using a secret. The callee may `throw` an `Error` to prevent access from occurring.
     /// - Parameters:
@@ -10,13 +10,13 @@ public protocol SigningWitness: Sendable {
     ///   - store: The `Store` being asked to sign the request..
     ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
     ///   - Note: This method being called does not imply that the requst has been authorized. If a secret requires authentication, authentication will still need to be performed by the user before the request will be performed. If the user declines or fails to authenticate, the request will fail.
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws
+    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws
 
     /// Notifies the callee that a signing operation has been performed for a given secret.
     /// - Parameters:
     ///   - secret: The `Secret` that will was used to sign the request.
     ///   - store: The `Store` that signed the request..
     ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws
 
 }

Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// Type eraser for Secret.
-public struct AnySecret: Secret, @unchecked Sendable {
+public struct AnySecret: Secret {
 
     let base: Any
     private let hashable: AnyHashable

Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift

@@ -2,18 +2,20 @@ import Foundation
 import Combine
 
 /// Type eraser for SecretStore.
-public class AnySecretStore: SecretStore, @unchecked Sendable {
+public class AnySecretStore: SecretStore {
 
-    let base: any Sendable
-    private let _isAvailable: @MainActor @Sendable () -> Bool
-    private let _id: @Sendable () -> UUID
-    private let _name: @MainActor @Sendable () -> String
-    private let _secrets: @MainActor @Sendable () -> [AnySecret]
-    private let _sign: @Sendable (Data, AnySecret, SigningRequestProvenance) async throws -> Data
-    private let _verify: @Sendable (Data, Data, AnySecret) async throws -> Bool
-    private let _existingPersistedAuthenticationContext: @Sendable (AnySecret) async -> PersistedAuthenticationContext?
-    private let _persistAuthentication: @Sendable (AnySecret, TimeInterval) async throws -> Void
-    private let _reloadSecrets: @Sendable () async -> Void
+    let base: Any
+    private let _isAvailable: () -> Bool
+    private let _id: () -> UUID
+    private let _name: () -> String
+    private let _secrets: () -> [AnySecret]
+    private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> Data
+    private let _verify: (Data, Data, AnySecret) throws -> Bool
+    private let _existingPersistedAuthenticationContext: (AnySecret) -> PersistedAuthenticationContext?
+    private let _persistAuthentication: (AnySecret, TimeInterval) throws -> Void
+    private let _reloadSecrets: () -> Void
+
+    private var sink: AnyCancellable?
 
     public init<SecretStoreType>(_ secretStore: SecretStoreType) where SecretStoreType: SecretStore {
         base = secretStore
@@ -21,14 +23,17 @@ public class AnySecretStore: SecretStore, @unchecked Sendable {
         _name = { secretStore.name }
         _id = { secretStore.id }
         _secrets = { secretStore.secrets.map { AnySecret($0) } }
-        _sign = { try await secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
-        _verify = { try await secretStore.verify(signature: $0, for: $1, with: $2.base as! SecretStoreType.SecretType) }
-        _existingPersistedAuthenticationContext = { await secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
-        _persistAuthentication = { try await secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
-        _reloadSecrets = { await secretStore.reloadSecrets() }
+        _sign = { try secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
+        _verify = { try secretStore.verify(signature: $0, for: $1, with: $2.base as! SecretStoreType.SecretType) }
+        _existingPersistedAuthenticationContext = { secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
+        _persistAuthentication = { try secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
+        _reloadSecrets = { secretStore.reloadSecrets() }
+        sink = secretStore.objectWillChange.sink { _ in
+            self.objectWillChange.send()
+        }
     }
 
-    @MainActor public var isAvailable: Bool {
+    public var isAvailable: Bool {
         return _isAvailable()
     }
 
@@ -36,59 +41,59 @@ public class AnySecretStore: SecretStore, @unchecked Sendable {
         return _id()
     }
 
-    @MainActor public var name: String {
+    public var name: String {
         return _name()
     }
 
-    @MainActor public var secrets: [AnySecret] {
+    public var secrets: [AnySecret] {
         return _secrets()
     }
 
-    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) async throws -> Data {
-        try await _sign(data, secret, provenance)
+    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) throws -> Data {
+        try _sign(data, secret, provenance)
     }
 
-    public func verify(signature: Data, for data: Data, with secret: AnySecret) async throws -> Bool {
-        try await _verify(signature, data, secret)
+    public func verify(signature: Data, for data: Data, with secret: AnySecret) throws -> Bool {
+        try _verify(signature, data, secret)
     }
 
-    public func existingPersistedAuthenticationContext(secret: AnySecret) async -> PersistedAuthenticationContext? {
-        await _existingPersistedAuthenticationContext(secret)
+    public func existingPersistedAuthenticationContext(secret: AnySecret) -> PersistedAuthenticationContext? {
+        _existingPersistedAuthenticationContext(secret)
     }
 
-    public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) async throws {
-        try await _persistAuthentication(secret, duration)
+    public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) throws {
+        try _persistAuthentication(secret, duration)
     }
 
-    public func reloadSecrets() async {
-        await _reloadSecrets()
+    public func reloadSecrets() {
+        _reloadSecrets()
     }
 
 }
 
-public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable, @unchecked Sendable {
+public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable {
 
-    private let _create: @Sendable (String, Bool) async throws -> Void
-    private let _delete: @Sendable (AnySecret) async throws -> Void
-    private let _update: @Sendable (AnySecret, String) async throws -> Void
+    private let _create: (String, Bool) throws -> Void
+    private let _delete: (AnySecret) throws -> Void
+    private let _update: (AnySecret, String) throws -> Void
 
     public init<SecretStoreType>(modifiable secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable {
-        _create = { try await secretStore.create(name: $0, requiresAuthentication: $1) }
-        _delete = { try await secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) }
-        _update = { try await secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1) }
+        _create = { try secretStore.create(name: $0, requiresAuthentication: $1) }
+        _delete = { try secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) }
+        _update = { try secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1) }
         super.init(secretStore)
     }
 
-    public func create(name: String, requiresAuthentication: Bool) async throws {
-        try await _create(name, requiresAuthentication)
+    public func create(name: String, requiresAuthentication: Bool) throws {
+        try _create(name, requiresAuthentication)
     }
 
-    public func delete(secret: AnySecret) async throws {
-        try await _delete(secret)
+    public func delete(secret: AnySecret) throws {
+        try _delete(secret)
     }
 
-    public func update(secret: AnySecret, name: String) async throws {
-        try await _update(secret, name)
+    public func update(secret: AnySecret, name: String) throws {
+        try _update(secret, name)
     }
 
 }

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift

@@ -2,7 +2,7 @@ import Foundation
 import OSLog
 
 /// Manages storage and lookup for OpenSSH certificates.
-public actor OpenSSHCertificateHandler: Sendable {
+public final class OpenSSHCertificateHandler {
 
     private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler")
@@ -25,6 +25,14 @@ public actor OpenSSHCertificateHandler: Sendable {
         }
     }
 
+    /// Whether or not the certificate handler has a certifiicate associated with a given secret.
+    /// - Parameter secret: The secret to check for a certificate.
+    /// - Returns: A boolean describing whether or not the certificate handler has a certifiicate associated with a given secret
+    public func hasCertificate<SecretType: Secret>(for secret: SecretType) -> Bool {
+        keyBlobsAndNames[AnySecret(secret)] != nil
+    }
+
+
     /// Reconstructs a public key from a ``Data``, if that ``Data`` contains an OpenSSH certificate hash. Currently only ecdsa certificates are supported
     /// - Parameter certBlock: The openssh certificate to extract the public key from
     /// - Returns: A ``Data`` object containing the public key in OpenSSH wire format if the ``Data`` is an OpenSSH certificate hash, otherwise nil.

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift

@@ -2,7 +2,7 @@ import Foundation
 import CryptoKit
 
 /// Generates OpenSSH representations of Secrets.
-public struct OpenSSHKeyWriter: Sendable {
+public struct OpenSSHKeyWriter {
 
     /// Initializes the writer.
     public init() {

Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift

@@ -2,7 +2,7 @@ import Foundation
 import OSLog
 
 /// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts.
-public final class PublicKeyFileStoreController: Sendable {
+public final class PublicKeyFileStoreController {
 
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController")
     private let directory: String

Sources/Packages/Sources/SecretKit/SecretStoreList.swift

@@ -1,35 +1,34 @@
 import Foundation
-import Observation
+import Combine
 
 /// A "Store Store," which holds a list of type-erased stores.
-@Observable @MainActor public final class SecretStoreList: Sendable {
+public final class SecretStoreList: ObservableObject {
 
     /// The Stores managed by the SecretStoreList.
-    public var stores: [AnySecretStore] = []
+    @Published public var stores: [AnySecretStore] = []
     /// A modifiable store, if one is available.
-    public var modifiableStore: AnySecretStoreModifiable? = nil
+    @Published public var modifiableStore: AnySecretStoreModifiable?
+    private var cancellables: Set<AnyCancellable> = []
 
     /// Initializes a SecretStoreList.
-    public nonisolated init() {
+    public init() {
     }
 
     /// Adds a non-type-erased SecretStore to the list.
     public func add<SecretStoreType: SecretStore>(store: SecretStoreType) {
-        stores.append(AnySecretStore(store))
+        addInternal(store: AnySecretStore(store))
     }
 
     /// Adds a non-type-erased modifiable SecretStore.
     public func add<SecretStoreType: SecretStoreModifiable>(store: SecretStoreType) {
         let modifiable = AnySecretStoreModifiable(modifiable: store)
-        if modifiableStore == nil {
-            modifiableStore = modifiable
-        }
-        stores.append(modifiable)
+        modifiableStore = modifiable
+        addInternal(store: modifiable)
     }
 
     /// A boolean describing whether there are any Stores available.
     public var anyAvailable: Bool {
-        stores.contains(where: \.isAvailable)
+        stores.reduce(false, { $0 || $1.isAvailable })
     }
 
     public var allSecrets: [AnySecret] {
@@ -37,3 +36,14 @@ import Observation
     }
 
 }
+
+extension SecretStoreList {
+
+    private func addInternal(store: AnySecretStore) {
+        stores.append(store)
+        store.objectWillChange.sink {
+            self.objectWillChange.send()
+        }.store(in: &cancellables)
+    }
+
+}

Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// Protocol describing a persisted authentication context. This is an authorization that can be reused for multiple access to a secret that requires authentication for a specific period of time.
-public protocol PersistedAuthenticationContext: Sendable {
+public protocol PersistedAuthenticationContext {
     /// Whether the context remains valid.
     var valid: Bool { get }
     /// The date at which the authorization expires and the context becomes invalid.

Sources/Packages/Sources/SecretKit/Types/Secret.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// The base protocol for describing a Secret
-public protocol Secret: Identifiable, Hashable, Sendable {
+public protocol Secret: Identifiable, Hashable {
 
     /// A user-facing string identifying the Secret.
     var name: String { get }
@@ -17,7 +17,7 @@ public protocol Secret: Identifiable, Hashable, Sendable {
 }
 
 /// The type of algorithm the Secret uses. Currently, only elliptic curve algorithms are supported.
-public enum Algorithm: Hashable, Sendable {
+public enum Algorithm: Hashable {
 
     case ellipticCurve
     case rsa

Sources/Packages/Sources/SecretKit/Types/SecretStore.swift

@@ -2,18 +2,18 @@ import Foundation
 import Combine
 
 /// Manages access to Secrets, and performs signature operations on data using those Secrets.
-public protocol SecretStore: Identifiable, Sendable {
+public protocol SecretStore: ObservableObject, Identifiable {
 
     associatedtype SecretType: Secret
 
     /// A boolean indicating whether or not the store is available.
-    @MainActor var isAvailable: Bool { get }
+    var isAvailable: Bool { get }
     /// A unique identifier for the store.
     var id: UUID { get }
     /// A user-facing name for the store.
-    @MainActor var name: String { get }
+    var name: String { get }
     /// The secrets the store manages.
-    @MainActor var secrets: [SecretType] { get }
+    var secrets: [SecretType] { get }
 
     /// Signs a data payload with a specified Secret.
     /// - Parameters:
@@ -21,7 +21,7 @@ public protocol SecretStore: Identifiable, Sendable {
     ///   - secret: The ``Secret`` to sign with.
     ///   - provenance: A ``SigningRequestProvenance`` describing where the request came from.
     /// - Returns: The signed data.
-    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) async throws -> Data
+    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data
 
     /// Verifies that a signature is valid over a specified payload.
     /// - Parameters:
@@ -29,23 +29,23 @@ public protocol SecretStore: Identifiable, Sendable {
     ///   - data: The data to verify the signature of.
     ///   - secret: The secret whose signature to verify.
     /// - Returns: Whether the signature was verified.
-    func verify(signature: Data, for data: Data, with secret: SecretType) async throws -> Bool
+    func verify(signature: Data, for data: Data, with secret: SecretType) throws -> Bool
 
     /// Checks to see if there is currently a valid persisted authentication for a given secret.
     /// - Parameters:
     ///   - secret: The ``Secret`` to check if there is a persisted authentication for.
     /// - Returns: A persisted authentication context, if a valid one exists.
-    func existingPersistedAuthenticationContext(secret: SecretType) async -> PersistedAuthenticationContext?
+    func existingPersistedAuthenticationContext(secret: SecretType) -> PersistedAuthenticationContext?
 
     /// Persists user authorization for access to a secret.
     /// - Parameters:
     ///   - secret: The ``Secret`` to persist the authorization for.
     ///   - duration: The duration that the authorization should persist for.
     ///  - Note: This is used for temporarily unlocking access to a secret which would otherwise require authentication every single use. This is useful for situations where the user anticipates several rapid accesses to a authorization-guarded secret.
-    func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) async throws
+    func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) throws
 
     /// Requests that the store reload secrets from any backing store, if neccessary.
-    func reloadSecrets() async
+    func reloadSecrets()
 
 }
 
@@ -56,18 +56,18 @@ public protocol SecretStoreModifiable: SecretStore {
     /// - Parameters:
     ///   - name: The user-facing name for the ``Secret``.
     ///   - requiresAuthentication: A boolean indicating whether or not the user will be required to authenticate before performing signature operations with the secret.
-    func create(name: String, requiresAuthentication: Bool) async throws
+    func create(name: String, requiresAuthentication: Bool) throws
 
     /// Deletes a Secret in the store.
     /// - Parameters:
     ///   - secret: The ``Secret`` to delete.
-    func delete(secret: SecretType) async throws
+    func delete(secret: SecretType) throws
 
     /// Updates the name of a Secret in the store.
     /// - Parameters:
     ///   - secret: The ``Secret`` to update.
     ///   - name: The new name for the Secret.
-    func update(secret: SecretType, name: String) async throws
+    func update(secret: SecretType, name: String) throws
 
 }
 

Sources/Packages/Sources/SecretKit/Types/SigningRequestProvenance.swift

@@ -2,7 +2,7 @@ import Foundation
 import AppKit
 
 /// Describes the chain of applications that requested a signature operation.
-public struct SigningRequestProvenance: Equatable, Sendable {
+public struct SigningRequestProvenance: Equatable {
 
     /// A list of processes involved in the request.
     /// - Note: A chain will typically consist of many elements even for a simple request. For example, running `git fetch` in Terminal.app would generate a request chain of `ssh` -> `git` -> `zsh` -> `login` -> `Terminal.app`
@@ -30,7 +30,7 @@ extension SigningRequestProvenance {
 extension SigningRequestProvenance {
 
     /// Describes a process in a `SigningRequestProvenance` chain.
-    public struct Process: Equatable, Sendable {
+    public struct Process: Equatable {
 
         /// The pid of the process.
         public let pid: Int32

Sources/Packages/Sources/SecureEnclaveSecretKit/PersistentAuthenticationHandler.swift

@@ -1,72 +0,0 @@
-import LocalAuthentication
-import SecretKit
-
-extension SecureEnclave {
-
-    /// A context describing a persisted authentication.
-    final class PersistentAuthenticationContext: PersistedAuthenticationContext {
-
-        /// The Secret to persist authentication for.
-        let secret: Secret
-        /// The LAContext used to authorize the persistent context.
-        nonisolated(unsafe) let context: LAContext
-        /// An expiration date for the context.
-        /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
-        let monotonicExpiration: UInt64
-
-        /// Initializes a context.
-        /// - Parameters:
-        ///   - secret: The Secret to persist authentication for.
-        ///   - context: The LAContext used to authorize the persistent context.
-        ///   - duration: The duration of the authorization context, in seconds.
-        init(secret: Secret, context: LAContext, duration: TimeInterval) {
-            self.secret = secret
-            self.context = context
-            let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
-            self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
-        }
-
-        /// A boolean describing whether or not the context is still valid.
-        var valid: Bool {
-            clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
-        }
-
-        var expiration: Date {
-            let remainingNanoseconds = monotonicExpiration - clock_gettime_nsec_np(CLOCK_MONOTONIC)
-            let remainingInSeconds = Measurement(value: Double(remainingNanoseconds), unit: UnitDuration.nanoseconds).converted(to: .seconds).value
-            return Date(timeIntervalSinceNow: remainingInSeconds)
-        }
-    }
-
-    actor PersistentAuthenticationHandler: Sendable {
-
-        private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:]
-
-        func existingPersistedAuthenticationContext(secret: Secret) -> PersistentAuthenticationContext? {
-            guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
-            return persisted
-        }
-
-        func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) async throws {
-            let newContext = LAContext()
-            newContext.touchIDAuthenticationAllowableReuseDuration = duration
-            newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
-
-            let formatter = DateComponentsFormatter()
-            formatter.unitsStyle = .spellOut
-            formatter.allowedUnits = [.hour, .minute, .day]
-
-            if let durationString = formatter.string(from: duration) {
-                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_\(secret.name)_\(durationString)")
-            } else {
-                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_unknown_\(secret.name)")
-            }
-            let success = try await newContext.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: newContext.localizedReason)
-            guard success else { return }
-            let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
-            persistedAuthenticationContexts[secret] = context
-        }
-
-    }
-
-}

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift

@@ -1,36 +1,38 @@
 import Foundation
-import Observation
+import Combine
 import Security
-import CryptoKit
+import CryptoTokenKit
 import LocalAuthentication
 import SecretKit
 
 extension SecureEnclave {
 
     /// An implementation of Store backed by the Secure Enclave.
-    @Observable public final class Store: SecretStoreModifiable {
+    public final class Store: SecretStoreModifiable {
 
-        @MainActor public var secrets: [Secret] = []
         public var isAvailable: Bool {
-            CryptoKit.SecureEnclave.isAvailable
+            // For some reason, as of build time, CryptoKit.SecureEnclave.isAvailable always returns false
+            // error msg "Received error sending GET UNIQUE DEVICE command"
+            // Verify it with TKTokenWatcher manually.
+            TKTokenWatcher().tokenIDs.contains("com.apple.setoken")
         }
         public let id = UUID()
         public let name = String(localized: "secure_enclave")
-        private let persistentAuthenticationHandler = PersistentAuthenticationHandler()
+        @Published public private(set) var secrets: [Secret] = []
+
+        private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:]
 
         /// Initializes a Store.
-        @MainActor public init() {
-            loadSecrets()
-            Task {
-                for await _ in DistributedNotificationCenter.default().notifications(named: .secretStoreUpdated) {
-                    await reloadSecretsInternal(notifyAgent: false)
-                }
+        public init() {
+            DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { [reload = reloadSecretsInternal(notifyAgent:)] _ in
+                reload(false)
             }
+            loadSecrets()
         }
 
         // MARK: Public API
 
-        public func create(name: String, requiresAuthentication: Bool) async throws {
+        public func create(name: String, requiresAuthentication: Bool) throws {
             var accessError: SecurityError?
             let flags: SecAccessControlCreateFlags
             if requiresAuthentication {
@@ -67,25 +69,25 @@ extension SecureEnclave {
                 throw KeychainError(statusCode: nil)
             }
             try savePublicKey(publicKey, name: name)
-            await reloadSecretsInternal()
+            reloadSecretsInternal()
         }
 
-        public func delete(secret: Secret) async throws {
+        public func delete(secret: Secret) throws {
             let deleteAttributes = KeychainDictionary([
                 kSecClass: kSecClassKey,
-                kSecAttrApplicationLabel: secret.id as CFData
+                kSecAttrApplicationLabel: secret.id
             ])
             let status = SecItemDelete(deleteAttributes)
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
             }
-            await reloadSecretsInternal()
+            reloadSecretsInternal()
         }
 
-        public func update(secret: Secret, name: String) async throws {
+        public func update(secret: Secret, name: String) throws {
             let updateQuery = KeychainDictionary([
                 kSecClass: kSecClassKey,
-                kSecAttrApplicationLabel: secret.id as CFData
+                kSecAttrApplicationLabel: secret.id
             ])
 
             let updatedAttributes = KeychainDictionary([
@@ -96,12 +98,12 @@ extension SecureEnclave {
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
             }
-            await reloadSecretsInternal()
+            reloadSecretsInternal()
         }
         
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
             let context: LAContext
-            if let existing = await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret) {
+            if let existing = persistedAuthenticationContexts[secret], existing.valid {
                 context = existing.context
             } else {
                 let newContext = LAContext()
@@ -112,13 +114,13 @@ extension SecureEnclave {
             let attributes = KeychainDictionary([
                 kSecClass: kSecClassKey,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-                kSecAttrApplicationLabel: secret.id as CFData,
+                kSecAttrApplicationLabel: secret.id,
                 kSecAttrKeyType: Constants.keyType,
                 kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
                 kSecAttrApplicationTag: Constants.keyTag,
                 kSecUseAuthenticationContext: context,
                 kSecReturnRef: true
-            ])
+                ])
             var untyped: CFTypeRef?
             let status = SecItemCopyMatching(attributes, &untyped)
             if status != errSecSuccess {
@@ -143,7 +145,7 @@ extension SecureEnclave {
             let attributes = KeychainDictionary([
                 kSecClass: kSecClassKey,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-                kSecAttrApplicationLabel: secret.id as CFData,
+                kSecAttrApplicationLabel: secret.id,
                 kSecAttrKeyType: Constants.keyType,
                 kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
                 kSecAttrApplicationTag: Constants.keyTag,
@@ -171,16 +173,34 @@ extension SecureEnclave {
             return verified
         }
 
-        public func existingPersistedAuthenticationContext(secret: Secret) async -> PersistedAuthenticationContext? {
-            await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret)
+        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
+            guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
+            return persisted
         }
 
-        public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) async throws {
-            try await persistentAuthenticationHandler.persistAuthentication(secret: secret, forDuration: duration)
+        public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) throws {
+            let newContext = LAContext()
+            newContext.touchIDAuthenticationAllowableReuseDuration = duration
+            newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+
+            let formatter = DateComponentsFormatter()
+            formatter.unitsStyle = .spellOut
+            formatter.allowedUnits = [.hour, .minute, .day]
+
+            if let durationString = formatter.string(from: duration) {
+                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_\(secret.name)_\(durationString)")
+            } else {
+                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_unknown_\(secret.name)")
+            }
+            newContext.evaluatePolicy(LAPolicy.deviceOwnerAuthentication, localizedReason: newContext.localizedReason) { [weak self] success, _ in
+                guard success else { return }
+                let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
+                self?.persistedAuthenticationContexts[secret] = context
+            }
         }
 
-        public func reloadSecrets() async {
-            await reloadSecretsInternal(notifyAgent: false)
+        public func reloadSecrets() {
+            reloadSecretsInternal(notifyAgent: false)
         }
 
     }
@@ -191,7 +211,7 @@ extension SecureEnclave.Store {
 
     /// Reloads all secrets from the store.
     /// - Parameter notifyAgent: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
-    @MainActor private func reloadSecretsInternal(notifyAgent: Bool = true) async {
+    @Sendable private func reloadSecretsInternal(notifyAgent: Bool = true) {
         let before = secrets
         secrets.removeAll()
         loadSecrets()
@@ -204,7 +224,7 @@ extension SecureEnclave.Store {
     }
 
     /// Loads all secrets from the store.
-    @MainActor private func loadSecrets() {
+    private func loadSecrets() {
         let publicAttributes = KeychainDictionary([
             kSecClass: kSecClassKey,
             kSecAttrKeyType: SecureEnclave.Constants.keyType,
@@ -290,3 +310,42 @@ extension SecureEnclave {
     }
 
 }
+
+extension SecureEnclave {
+
+    /// A context describing a persisted authentication.
+    private struct PersistentAuthenticationContext: PersistedAuthenticationContext {
+
+        /// The Secret to persist authentication for.
+        let secret: Secret
+        /// The LAContext used to authorize the persistent context.
+        let context: LAContext
+        /// An expiration date for the context.
+        /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
+        let monotonicExpiration: UInt64
+
+        /// Initializes a context.
+        /// - Parameters:
+        ///   - secret: The Secret to persist authentication for.
+        ///   - context: The LAContext used to authorize the persistent context.
+        ///   - duration: The duration of the authorization context, in seconds.
+        init(secret: Secret, context: LAContext, duration: TimeInterval) {
+            self.secret = secret
+            self.context = context
+            let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
+            self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
+        }
+
+        /// A boolean describing whether or not the context is still valid.
+        var valid: Bool {
+            clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
+        }
+
+        var expiration: Date {
+            let remainingNanoseconds = monotonicExpiration - clock_gettime_nsec_np(CLOCK_MONOTONIC)
+            let remainingInSeconds = Measurement(value: Double(remainingNanoseconds), unit: UnitDuration.nanoseconds).converted(to: .seconds).value
+            return Date(timeIntervalSinceNow: remainingInSeconds)
+        }
+    }
+
+}

Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift

@@ -1,5 +1,5 @@
 import Foundation
-import Observation
+import Combine
 import Security
 import CryptoTokenKit
 import LocalAuthentication
@@ -7,47 +7,34 @@ import SecretKit
 
 extension SmartCard {
 
-    @MainActor @Observable fileprivate final class State {
-        var isAvailable = false
-        var name = String(localized: "smart_card")
-        var secrets: [Secret] = []
-        let watcher = TKTokenWatcher()
-        var tokenID: String? = nil
-        nonisolated init() {}
-    }
-
     /// An implementation of Store backed by a Smart Card.
-    @Observable public final class Store: SecretStore {
-
-        private let state = State()
-        public var isAvailable: Bool {
-            state.isAvailable
-        }
+    public final class Store: SecretStore {
 
+        @Published public var isAvailable: Bool = false
         public let id = UUID()
-        @MainActor public var name: String {
-            state.name
-        }
-        public var secrets: [Secret] {
-            state.secrets
-        }
+        public private(set) var name = String(localized: "smart_card")
+        @Published public private(set) var secrets: [Secret] = []
+        private let watcher = TKTokenWatcher()
+        private var tokenID: String?
 
         /// Initializes a Store.
         public init() {
-            Task { @MainActor in
-                if let tokenID = state.tokenID {
-                    state.isAvailable = true
-                    state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
-                }
-                loadSecrets()
-                state.watcher.setInsertionHandler { id in
-                    // Setting insertion handler will cause it to be called immediately.
-                    // Make a thread jump so we don't hit a recursive lock attempt.
-                    Task {
-                        self.smartcardInserted(for: id)
-                    }
+            tokenID = watcher.nonSecureEnclaveTokens.first
+            watcher.setInsertionHandler { [reload = reloadSecretsInternal] string in
+                guard self.tokenID == nil else { return }
+                guard !string.contains("setoken") else { return }
+
+                self.tokenID = string
+                DispatchQueue.main.async {
+                    reload()
                 }
+                self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
             }
+            if let tokenID = tokenID {
+                self.isAvailable = true
+                self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
+            }
+            loadSecrets()
         }
 
         // MARK: Public API
@@ -60,15 +47,15 @@ extension SmartCard {
             fatalError("Keys must be deleted on the smart card.")
         }
 
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
-            guard let tokenID = await state.tokenID else { fatalError() }
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
+            guard let tokenID = tokenID else { fatalError() }
             let context = LAContext()
             context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)")
             context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
             let attributes = KeychainDictionary([
                 kSecClass: kSecClassKey,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-                kSecAttrApplicationLabel: secret.id as CFData,
+                kSecAttrApplicationLabel: secret.id,
                 kSecAttrTokenID: tokenID,
                 kSecUseAuthenticationContext: context,
                 kSecReturnRef: true
@@ -120,7 +107,7 @@ extension SmartCard {
         }
 
         /// Reloads all secrets from the store.
-        @MainActor public func reloadSecrets() {
+        public func reloadSecrets() {
             reloadSecretsInternal()
         }
 
@@ -130,43 +117,32 @@ extension SmartCard {
 
 extension SmartCard.Store {
 
-    @MainActor private func reloadSecretsInternal() {
-        let before = state.secrets
-        state.isAvailable = state.tokenID != nil
-        state.secrets.removeAll()
-        loadSecrets()
+    @Sendable private func reloadSecretsInternal() {
+        self.isAvailable = self.tokenID != nil
+        let before = self.secrets
+        self.secrets.removeAll()
+        self.loadSecrets()
         if self.secrets != before {
             NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
         }
     }
 
-    /// Resets the token ID and reloads secrets.
-    /// - Parameter tokenID: The ID of the token that was inserted.
-    @MainActor private func smartcardInserted(for tokenID: String? = nil) {
-            guard let string = state.watcher.nonSecureEnclaveTokens.first else { return }
-            guard state.tokenID == nil else { return }
-            guard !string.contains("setoken") else { return }
-            state.tokenID = string
-            state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
-            state.tokenID = string
-    }
-
     /// Resets the token ID and reloads secrets.
     /// - Parameter tokenID: The ID of the token that was removed.
-    @MainActor private func smartcardRemoved(for tokenID: String? = nil) {
-        state.tokenID = nil
+    private func smartcardRemoved(for tokenID: String? = nil) {
+        self.tokenID = nil
         reloadSecrets()
     }
 
     /// Loads all secrets from the store.
-    @MainActor private func loadSecrets() {
-        guard let tokenID = state.tokenID  else { return }
+    private func loadSecrets() {
+        guard let tokenID = tokenID else { return }
 
         let fallbackName = String(localized: "smart_card")
-        if let driverName = state.watcher.tokenInfo(forTokenID: tokenID)?.driverName  {
-            state.name = driverName
+        if let driverName = watcher.tokenInfo(forTokenID: tokenID)?.driverName {
+            name = driverName
         } else {
-            state.name = fallbackName
+            name = fallbackName
         }
 
         let attributes = KeychainDictionary([
@@ -190,7 +166,89 @@ extension SmartCard.Store {
             let publicKey = publicKeyAttributes[kSecValueData] as! Data
             return SmartCard.Secret(id: tokenID, name: name, algorithm: algorithm, keySize: keySize, publicKey: publicKey)
         }
-        state.secrets.append(contentsOf: wrapped)
+        secrets.append(contentsOf: wrapped)
+    }
+
+}
+
+
+// MARK: Smart Card specific encryption/decryption/verification
+extension SmartCard.Store {
+
+    /// Encrypts a payload with a specified key.
+    /// - Parameters:
+    ///   - data: The payload to encrypt.
+    ///   - secret: The secret to encrypt with.
+    /// - Returns: The encrypted data.
+    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
+    public func encrypt(data: Data, with secret: SecretType) throws -> Data {
+        let context = LAContext()
+        context.localizedReason = String(localized: "auth_context_request_encrypt_description_\(secret.name)")
+        context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+        let attributes = KeychainDictionary([
+            kSecAttrKeyType: secret.algorithm.secAttrKeyType,
+            kSecAttrKeySizeInBits: secret.keySize,
+            kSecAttrKeyClass: kSecAttrKeyClassPublic,
+            kSecUseAuthenticationContext: context
+        ])
+        var encryptError: SecurityError?
+        let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &encryptError)
+        guard let untypedSafe = untyped else {
+            throw KeychainError(statusCode: errSecSuccess)
+        }
+        let key = untypedSafe as! SecKey
+        guard let signature = SecKeyCreateEncryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
+            throw SigningError(error: encryptError)
+        }
+        return signature as Data
+    }
+
+    /// Decrypts a payload with a specified key.
+    /// - Parameters:
+    ///   - data: The payload to decrypt.
+    ///   - secret: The secret to decrypt with.
+    /// - Returns: The decrypted data.
+    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
+    public func decrypt(data: Data, with secret: SecretType) throws -> Data {
+        guard let tokenID = tokenID else { fatalError() }
+        let context = LAContext()
+        context.localizedReason = String(localized: "auth_context_request_decrypt_description_\(secret.name)")
+        context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+        let attributes = KeychainDictionary([
+            kSecClass: kSecClassKey,
+            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+            kSecAttrApplicationLabel: secret.id,
+            kSecAttrTokenID: tokenID,
+            kSecUseAuthenticationContext: context,
+            kSecReturnRef: true
+        ])
+        var untyped: CFTypeRef?
+        let status = SecItemCopyMatching(attributes, &untyped)
+        if status != errSecSuccess {
+            throw KeychainError(statusCode: status)
+        }
+        guard let untypedSafe = untyped else {
+            throw KeychainError(statusCode: errSecSuccess)
+        }
+        let key = untypedSafe as! SecKey
+        var encryptError: SecurityError?
+        guard let signature = SecKeyCreateDecryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
+            throw SigningError(error: encryptError)
+        }
+        return signature as Data
+    }
+
+    private func encryptionAlgorithm(for secret: SecretType) -> SecKeyAlgorithm {
+        switch (secret.algorithm, secret.keySize) {
+        case (.ellipticCurve, 256):
+            return .eciesEncryptionCofactorVariableIVX963SHA256AESGCM
+        case (.ellipticCurve, 384):
+            return .eciesEncryptionCofactorVariableIVX963SHA384AESGCM
+        case (.rsa, 1024), (.rsa, 2048):
+            return .rsaEncryptionOAEPSHA512AESGCM
+        default:
+            fatalError()
+        }
     }
 
 }

Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift

@@ -1,65 +1,54 @@
-import Testing
-import Foundation
+import XCTest
 @testable import Brief
 
-@Suite struct ReleaseParsingTests {
+class ReleaseParsingTests: XCTestCase {
 
-    @Test
-    func nonCritical() {
+    func testNonCritical() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release")
-        #expect(release.critical == false)
+        XCTAssert(release.critical == false)
     }
 
-    @Test
-    func critical() {
+    func testCritical() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
-        #expect(release.critical == true)
+        XCTAssert(release.critical == true)
     }
 
-    @Test
-    func osMissing() {
+    func testOSMissing() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
-        #expect(release.minimumOSVersion == SemVer("11.0.0"))
+        XCTAssert(release.minimumOSVersion == SemVer("11.0.0"))
     }
 
-    @Test
-    func osPresentWithContentBelow() {
+    func testOSPresentWithContentBelow() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update ##Minimum macOS Version\n1.2.3\nBuild info")
-        #expect(release.minimumOSVersion == SemVer("1.2.3"))
+        XCTAssert(release.minimumOSVersion == SemVer("1.2.3"))
     }
 
-    @Test
-    func osPresentAtEnd() {
+    func testOSPresentAtEnd() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
-        #expect(release.minimumOSVersion == SemVer("1.2.3"))
+        XCTAssert(release.minimumOSVersion == SemVer("1.2.3"))
     }
 
-    @Test
-    func osWithMacOSPrefix() {
+    func testOSWithMacOSPrefix() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: macOS 1.2.3")
-        #expect(release.minimumOSVersion == SemVer("1.2.3"))
+        XCTAssert(release.minimumOSVersion == SemVer("1.2.3"))
     }
 
-    @Test
-    func osGreaterThanMinimum() {
+    func testOSGreaterThanMinimum() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
-        #expect(release.minimumOSVersion < SemVer("11.0.0"))
+        XCTAssert(release.minimumOSVersion < SemVer("11.0.0"))
     }
 
-    @Test
-    func osEqualToMinimum() {
+    func testOSEqualToMinimum() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 11.2.3")
-        #expect(release.minimumOSVersion <= SemVer("11.2.3"))
+        XCTAssert(release.minimumOSVersion <= SemVer("11.2.3"))
     }
 
-    @Test
-    func osLessThanMinimum() {
+    func testOSLessThanMinimum() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
-        #expect(release.minimumOSVersion > SemVer("1.0.0"))
+        XCTAssert(release.minimumOSVersion > SemVer("1.0.0"))
     }
 
-    @Test
-    @MainActor func greatestSelectedIfOldPatchIsPublishedLater() async throws {
+    func testGreatestSelectedIfOldPatchIsPublishedLater() {
         // If 2.x.x series has been published, and a patch for 1.x.x is issued
         // 2.x.x should still be selected if user can run it.
         let updater = Updater(checkOnLaunch: false, osVersion: SemVer("2.2.3"), currentVersion: SemVer("1.0.0"))
@@ -71,13 +60,16 @@ import Foundation
             Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"),
         ]
 
-        await updater.evaluate(releases: releases)
-        try await Task.sleep(nanoseconds: 1)
-        #expect(updater.update == two)
+        let expectation = XCTestExpectation()
+        updater.evaluate(releases: releases)
+        DispatchQueue.main.async {
+            XCTAssert(updater.update == two)
+            expectation.fulfill()
+        }
+        wait(for: [expectation], timeout: 1)
     }
 
-    @Test
-    @MainActor func latestVersionIsRunnable() async throws {
+    func testLatestVersionIsRunnable() {
         // If the 2.x.x series has been published but the user can't run it
         // the last version the user can run should be selected.
         let updater = Updater(checkOnLaunch: false, osVersion: SemVer("1.2.3"), currentVersion: SemVer("1.0.0"))
@@ -88,13 +80,16 @@ import Foundation
             Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available! Minimum macOS Version: 2.2.3"),
             Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"),
         ]
-        await updater.evaluate(releases: releases)
-        try await Task.sleep(nanoseconds: 1)
-        #expect(updater.update == oneOhTwo)
+        let expectation = XCTestExpectation()
+        updater.evaluate(releases: releases)
+        DispatchQueue.main.async {
+            XCTAssert(updater.update == oneOhTwo)
+            expectation.fulfill()
+        }
+        wait(for: [expectation], timeout: 1)
     }
 
-    @Test
-    func sorting() {
+    func testSorting() {
         let two = Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available!")
         let releases = [
             Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release"),
@@ -103,7 +98,7 @@ import Foundation
             Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch!"),
         ]
         let sorted = releases.sorted().reversed().first
-        #expect(sorted == two)
+        XCTAssert(sorted == two)
     }
 
 }

Sources/Packages/Tests/BriefTests/SemVerTests.swift

@@ -1,52 +1,51 @@
-import Testing
-import Foundation
+import XCTest
 @testable import Brief
 
-@Suite struct SemVerTests {
+class SemVerTests: XCTestCase {
 
-    @Test func equal() {
+    func testEqual() {
         let current = SemVer("1.0.2")
         let old = SemVer("1.0.2")
-        #expect(!(current > old))
+        XCTAssert(!(current > old))
     }
 
-    @Test func patchGreaterButMinorLess() {
+    func testPatchGreaterButMinorLess() {
         let current = SemVer("1.1.0")
         let old = SemVer("1.0.2")
-        #expect(current > old)
+        XCTAssert(current > old)
     }
 
-    @Test func majorSameMinorGreater() {
+    func testMajorSameMinorGreater() {
         let current = SemVer("1.0.2")
         let new = SemVer("1.0.3")
-        #expect(current < new)
+        XCTAssert(current < new)
     }
 
-    @Test func majorGreaterMinorLesser() {
+    func testMajorGreaterMinorLesser() {
         let current = SemVer("1.0.2")
         let new = SemVer("2.0.0")
-        #expect(current < new)
+        XCTAssert(current < new)
     }
 
-    @Test func regularParsing() {
+    func testRegularParsing() {
         let current = SemVer("1.0.2")
-        #expect(current.versionNumbers == [1, 0, 2])
+        XCTAssert(current.versionNumbers == [1, 0, 2])
     }
 
-    @Test func noPatch() {
+    func testNoPatch() {
         let current = SemVer("1.1")
-        #expect(current.versionNumbers == [1, 1, 0])
+        XCTAssert(current.versionNumbers == [1, 1, 0])
     }
 
-    @Test func garbage() {
+    func testGarbage() {
         let current = SemVer("Test")
-        #expect(current.versionNumbers == [0, 0, 0])
+        XCTAssert(current.versionNumbers == [0, 0, 0])
     }
 
-    @Test func beta() {
+    func testBeta() {
         let current = SemVer("1.0.2")
         let new = SemVer("1.1.0_beta1")
-        #expect(current < new)
+        XCTAssert(current < new)
     }
 
 }

Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift

@@ -1,46 +1,46 @@
 import Foundation
-import Testing
+import XCTest
 import CryptoKit
 @testable import SecretKit
 @testable import SecretAgentKit
 
-@Suite struct AgentTests {
+class AgentTests: XCTestCase {
 
     let stubWriter = StubFileHandleWriter()
 
     // MARK: Identity Listing
 
-    @Test func emptyStores() async {
+    func testEmptyStores() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
         let agent = Agent(storeList: SecretStoreList())
         await agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestIdentitiesEmpty)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesEmpty)
     }
 
-    @Test func identitiesList() async {
+    func testIdentitiesList() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
         await agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestIdentitiesMultiple)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesMultiple)
     }
 
     // MARK: Signatures
 
-    @Test func noMatchingIdentities() async {
+    func testNoMatchingIdentities() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignatureWithNoneMatching)
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
         await agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+//        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
-    @Test func signature() async throws {
+    func testSignature() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...])
         _ = requestReader.readNextChunk()
         let dataToSign = requestReader.readNextChunk()
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
         await agent.handle(reader: stubReader, writer: stubWriter)
         let outer = OpenSSHReader(data: stubWriter.data[5...])
@@ -62,35 +62,35 @@ import CryptoKit
         rs.append(s)
         let signature = try! P256.Signing.ECDSASignature(rawRepresentation: rs)
         let referenceValid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
-        let store = await list.stores.first!
-        let derVerifies = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidRandomSignature = try await store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidRandomData = try await store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidWrongKey = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret))
-        #expect(referenceValid)
-        #expect(derVerifies)
-        #expect(invalidRandomSignature == false)
-        #expect(invalidRandomData == false)
-        #expect(invalidWrongKey == false)
+        let store = list.stores.first!
+        let derVerifies = try! store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
+        let invalidRandomSignature = try? store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
+        let invalidRandomData = try? store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret))
+        let invalidWrongKey = try? store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret))
+        XCTAssertTrue(referenceValid)
+        XCTAssertTrue(derVerifies)
+        XCTAssert(invalidRandomSignature == false)
+        XCTAssert(invalidRandomData == false)
+        XCTAssert(invalidWrongKey == false)
     }
 
     // MARK: Witness protocol
 
-    @Test func witnessObjectionStopsRequest() async {
+    func testWitnessObjectionStopsRequest() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
         let witness = StubWitness(speakNow: { _,_  in
             return true
         }, witness: { _, _ in })
         let agent = Agent(storeList: list, witness: witness)
         await agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
-    @Test func witnessSignature() async {
+    func testWitnessSignature() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
-        nonisolated(unsafe) var witnessed = false
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
+        var witnessed = false
         let witness = StubWitness(speakNow: { _, trace  in
             return false
         }, witness: { _, trace in
@@ -98,14 +98,14 @@ import CryptoKit
         })
         let agent = Agent(storeList: list, witness: witness)
         await agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(witnessed)
+        XCTAssertTrue(witnessed)
     }
 
-    @Test func requestTracing() async {
+    func testRequestTracing() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
-        nonisolated(unsafe) var speakNowTrace: SigningRequestProvenance?
-        nonisolated(unsafe) var witnessTrace: SigningRequestProvenance?
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
+        var speakNowTrace: SigningRequestProvenance! = nil
+        var witnessTrace: SigningRequestProvenance! = nil
         let witness = StubWitness(speakNow: { _, trace  in
             speakNowTrace = trace
             return false
@@ -114,38 +114,38 @@ import CryptoKit
         })
         let agent = Agent(storeList: list, witness: witness)
         await agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(witnessTrace == speakNowTrace)
-        #expect(witnessTrace?.origin.displayName == "Finder")
-        #expect(witnessTrace?.origin.validSignature == true)
-        #expect(witnessTrace?.origin.parentPID == 1)
+        XCTAssertEqual(witnessTrace, speakNowTrace)
+        XCTAssertEqual(witnessTrace.origin.displayName, "Finder")
+        XCTAssertEqual(witnessTrace.origin.validSignature, true)
+        XCTAssertEqual(witnessTrace.origin.parentPID, 1)
     }
 
     // MARK: Exception Handling
 
-    @Test func signatureException() async {
+    func testSignatureException() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let store = await list.stores.first?.base as! Stub.Store
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+        let store = list.stores.first?.base as! Stub.Store
         store.shouldThrow = true
         let agent = Agent(storeList: list)
         await agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
     // MARK: Unsupported
 
-    @Test func unhandledAdd() async {
+    func testUnhandledAdd() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.addIdentity)
         let agent = Agent(storeList: SecretStoreList())
         await agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
 }
 
 extension AgentTests {
 
-    @MainActor func storeList(with secrets: [Stub.Secret]) async -> SecretStoreList {
+    func storeList(with secrets: [Stub.Secret]) -> SecretStoreList {
         let store = Stub.Store()
         store.secrets.append(contentsOf: secrets)
         let storeList = SecretStoreList()

Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleWriter.swift

@@ -1,7 +1,7 @@
 import Foundation
 import SecretAgentKit
 
-class StubFileHandleWriter: FileHandleWriter, @unchecked Sendable {
+class StubFileHandleWriter: FileHandleWriter {
 
     var data = Data()
 

Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift

@@ -6,7 +6,7 @@ struct Stub {}
 
 extension Stub {
 
-    public final class Store: SecretStore, @unchecked Sendable {
+    public final class Store: SecretStore {
 
         public let isAvailable = true
         public let id = UUID()

Sources/Packages/Tests/SecretAgentKitTests/StubWitness.swift

@@ -3,8 +3,8 @@ import SecretAgentKit
 
 struct StubWitness {
 
-    let speakNow: @Sendable (AnySecret, SigningRequestProvenance) -> Bool
-    let witness: @Sendable (AnySecret, SigningRequestProvenance) -> ()
+    let speakNow: (AnySecret, SigningRequestProvenance) -> Bool
+    let witness: (AnySecret, SigningRequestProvenance) -> ()
 
 }
 

Sources/Packages/Tests/SecretKitTests/AnySecretTests.swift

@@ -1,19 +1,19 @@
 import Foundation
-import Testing
+import XCTest
 @testable import SecretKit
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
-@Suite struct AnySecretTests {
+class AnySecretTests: XCTestCase {
 
-    @Test func eraser() {
+    func testEraser() {
         let secret = SmartCard.Secret(id: UUID().uuidString.data(using: .utf8)!, name: "Name", algorithm: .ellipticCurve, keySize: 256, publicKey: UUID().uuidString.data(using: .utf8)!)
         let erased = AnySecret(secret)
-        #expect(erased.id == secret.id as AnyHashable)
-        #expect(erased.name == secret.name)
-        #expect(erased.algorithm == secret.algorithm)
-        #expect(erased.keySize == secret.keySize)
-        #expect(erased.publicKey == secret.publicKey)
+        XCTAssert(erased.id == secret.id as AnyHashable)
+        XCTAssert(erased.name == secret.name)
+        XCTAssert(erased.algorithm == secret.algorithm)
+        XCTAssert(erased.keySize == secret.keySize)
+        XCTAssert(erased.publicKey == secret.publicKey)
     }
 
 }

Sources/Packages/Tests/SecretKitTests/OpenSSHReaderTests.swift

@@ -1,19 +1,19 @@
 import Foundation
-import Testing
+import XCTest
 @testable import SecretKit
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
-@Suite struct OpenSSHReaderTests {
+class OpenSSHReaderTests: XCTestCase {
 
-    @Test func signatureRequest() {
+    func testSignatureRequest() {
         let reader = OpenSSHReader(data: Constants.signatureRequest)
         let hash = reader.readNextChunk()
-        #expect(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ=="))
+        XCTAssert(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ=="))
         let dataToSign = reader.readNextChunk()
-        #expect(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU="))
+        XCTAssert(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU="))
         let empty = reader.readNextChunk()
-        #expect(empty.isEmpty)
+        XCTAssert(empty.isEmpty)
     }
 
 }

Sources/Packages/Tests/SecretKitTests/OpenSSHWriterTests.swift

@@ -1,45 +1,45 @@
 import Foundation
-import Testing
+import XCTest
 @testable import SecretKit
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
-@Suite struct OpenSSHWriterTests {
+class OpenSSHWriterTests: XCTestCase {
 
     let writer = OpenSSHKeyWriter()
 
-    @Test func ecdsa256MD5Fingerprint() {
-        #expect(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa256Secret) == "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5")
+    func testECDSA256MD5Fingerprint() {
+        XCTAssertEqual(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa256Secret), "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5")
     }
 
-    @Test func ecdsa256SHA256Fingerprint() {
-        #expect(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa256Secret) == "SHA256:/VQFeGyM8qKA8rB6WGMuZZxZLJln2UgXLk3F0uTF650")
+    func testECDSA256SHA256Fingerprint() {
+        XCTAssertEqual(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa256Secret), "SHA256:/VQFeGyM8qKA8rB6WGMuZZxZLJln2UgXLk3F0uTF650")
     }
 
-    @Test func ecdsa256PublicKey() {
-        #expect(writer.openSSHString(secret:  Constants.ecdsa256Secret) ==
+    func testECDSA256PublicKey() {
+        XCTAssertEqual(writer.openSSHString(secret:  Constants.ecdsa256Secret),
         "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")
     }
 
-    @Test func ecdsa256Hash() {
-    #expect(writer.data(secret: Constants.ecdsa256Secret) == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo="))
+    func testECDSA256Hash() {
+    XCTAssertEqual(writer.data(secret: Constants.ecdsa256Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo="))
     }
 
-    @Test func ecdsa384MD5Fingerprint() {
-        #expect(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa384Secret) == "66:e0:66:d7:41:ed:19:8e:e2:20:df:ce:ac:7e:2b:6e")
+    func testECDSA384MD5Fingerprint() {
+        XCTAssertEqual(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa384Secret), "66:e0:66:d7:41:ed:19:8e:e2:20:df:ce:ac:7e:2b:6e")
     }
 
-    @Test func ecdsa384SHA256Fingerprint() {
-        #expect(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa384Secret) == "SHA256:GJUEymQNL9ymaMRRJCMGY4rWIJHu/Lm8Yhao/PAiz1I")
+    func testECDSA384SHA256Fingerprint() {
+        XCTAssertEqual(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa384Secret), "SHA256:GJUEymQNL9ymaMRRJCMGY4rWIJHu/Lm8Yhao/PAiz1I")
     }
 
-    @Test func ecdsa384PublicKey() {
-        #expect(writer.openSSHString(secret:  Constants.ecdsa384Secret) ==
+    func testECDSA384PublicKey() {
+        XCTAssertEqual(writer.openSSHString(secret:  Constants.ecdsa384Secret),
                        "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")
     }
 
-    @Test func ecdsa384Hash() {
-        #expect(writer.data(secret: Constants.ecdsa384Secret) == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ=="))
+    func testECDSA384Hash() {
+        XCTAssertEqual(writer.data(secret: Constants.ecdsa384Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ=="))
     }
 
 }

Sources/SecretAgent/AppDelegate.swift

@@ -6,18 +6,17 @@ import SecureEnclaveSecretKit
 import SmartCardSecretKit
 import SecretAgentKit
 import Brief
-import Observation
 
-@main
+@NSApplicationMain
 class AppDelegate: NSObject, NSApplicationDelegate {
 
-    @MainActor private let storeList: SecretStoreList = {
+    private let storeList: SecretStoreList = {
         let list = SecretStoreList()
         list.add(store: SecureEnclave.Store())
         list.add(store: SmartCard.Store())
         return list
     }()
-    private let updater = Updater(checkOnLaunch: true)
+    private let updater = Updater(checkOnLaunch: false)
     private let notifier = Notifier()
     private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
     private lazy var agent: Agent = {
@@ -32,26 +31,17 @@ class AppDelegate: NSObject, NSApplicationDelegate {
 
     func applicationDidFinishLaunching(_ aNotification: Notification) {
         logger.debug("SecretAgent finished launching")
-        Task { @MainActor in
-            socketController.handler = { [agent] reader, writer in
-                await agent.handle(reader: reader, writer: writer)
-            }
+        DispatchQueue.main.async {
+            self.socketController.handler = self.agent.handle(reader:writer:)
         }
-        Task {
-            for await _ in NotificationCenter.default.notifications(named: .secretStoreReloaded) {
-                try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
-            }
+        NotificationCenter.default.addObserver(forName: .secretStoreReloaded, object: nil, queue: .main) { [self] _ in
+            try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
         }
         try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
         notifier.prompt()
-        _ = withObservationTracking {
-            updater.update
-        } onChange: { [updater, notifier] in
-            Task {
-                await notifier.notify(update: updater.update!) { release in
-                    await updater.ignore(release: release)
-                }
-            }
+        updateSink = updater.$update.sink { update in
+            guard let update = update else { return }
+            self.notifier.notify(update: update, ignore: self.updater.ignore(release:))
         }
     }
 

Sources/SecretAgent/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -0,0 +1,60 @@
+{
+  "images" : [
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "16x16"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "16x16"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "32x32"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "32x32"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "128x128"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "128x128"
+    },
+    {
+      "filename" : "Mac Icon.png",
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "256x256"
+    },
+    {
+      "filename" : "Mac Icon@0.25x.png",
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "256x256"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "512x512"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "512x512"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

Sources/SecretAgent/Assets.xcassets/Contents.json

@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

Sources/SecretAgent/Notifier.swift

@@ -5,7 +5,7 @@ import SecretKit
 import SecretAgentKit
 import Brief
 
-final class Notifier: Sendable {
+class Notifier {
 
     private let notificationDelegate = NotificationDelegate()
 
@@ -29,13 +29,12 @@ final class Notifier: Sendable {
         formatter.unitsStyle = .spellOut
         formatter.allowedUnits = [.hour, .minute, .day]
 
-        var identifiers: [String: TimeInterval] = [:]
         for duration in rawDurations {
             let seconds = duration.converted(to: .seconds).value
             guard let string = formatter.string(from: seconds)?.capitalized else { continue }
             let identifier = Constants.persistAuthenticationCategoryIdentitifier.appending("\(seconds)")
             let action = UNNotificationAction(identifier: identifier, title: string, options: [])
-            identifiers[identifier] = seconds
+            notificationDelegate.persistOptions[identifier] = seconds
             allPersistenceActions.append(action)
         }
 
@@ -46,11 +45,9 @@ final class Notifier: Sendable {
         UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory, persistAuthenticationCategory])
         UNUserNotificationCenter.current().delegate = notificationDelegate
 
-        Task {
-            await notificationDelegate.state.setPersistenceState(options: identifiers) { secret, store, duration in
-                guard let duration = duration else { return }
-                try? await store.persistAuthentication(secret: secret, forDuration: duration)
-            }
+        notificationDelegate.persistAuthentication = { secret, store, duration in
+            guard let duration = duration else { return }
+            try? store.persistAuthentication(secret: secret, forDuration: duration)
         }
 
     }
@@ -60,8 +57,9 @@ final class Notifier: Sendable {
         notificationCenter.requestAuthorization(options: .alert) { _, _ in }
     }
 
-    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async {
-        await notificationDelegate.state.setPending(secret: secret, store: store)
+    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) {
+        notificationDelegate.pendingPersistableSecrets[secret.id.description] = secret
+        notificationDelegate.pendingPersistableStores[store.id.description] = store
         let notificationCenter = UNUserNotificationCenter.current()
         let notificationContent = UNMutableNotificationContent()
         notificationContent.title = String(localized: "signed_notification_title_\(provenance.origin.displayName)")
@@ -69,18 +67,19 @@ final class Notifier: Sendable {
         notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description
         notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description
         notificationContent.interruptionLevel = .timeSensitive
-        if await store.existingPersistedAuthenticationContext(secret: secret) == nil && secret.requiresAuthentication {
+        if secret.requiresAuthentication && store.existingPersistedAuthenticationContext(secret: secret) == nil {
             notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier
         }
         if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) {
             notificationContent.attachments = [attachment]
         }
         let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
-        try? await notificationCenter.add(request)
+        notificationCenter.add(request, withCompletionHandler: nil)
     }
 
-    func notify(update: Release, ignore: (@Sendable (Release) async -> Void)?) async {
-        await notificationDelegate.state.prepareForNotification(release: update, ignoreAction: ignore)
+    func notify(update: Release, ignore: ((Release) -> Void)?) {
+        notificationDelegate.release = update
+        notificationDelegate.ignore = ignore
         let notificationCenter = UNUserNotificationCenter.current()
         let notificationContent = UNMutableNotificationContent()
         if update.critical {
@@ -93,18 +92,18 @@ final class Notifier: Sendable {
         notificationContent.body = update.body
         notificationContent.categoryIdentifier = update.critical ? Constants.criticalUpdateCategoryIdentitifier : Constants.updateCategoryIdentitifier
         let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
-        try? await notificationCenter.add(request)
+        notificationCenter.add(request, withCompletionHandler: nil)
     }
 
 }
 
 extension Notifier: SigningWitness {
 
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
+    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
     }
 
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
-        await notify(accessTo: secret, from: store, by: provenance)
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
+        notify(accessTo: secret, from: store, by: provenance)
     }
 
 }
@@ -130,91 +129,55 @@ extension Notifier {
 
 }
 
-final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Sendable {
+class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate {
 
-    fileprivate actor State {
-        typealias PersistAction = (@Sendable (AnySecret, AnySecretStore, TimeInterval?) async -> Void)
-        typealias IgnoreAction = (@Sendable (Release) async -> Void)
-        fileprivate var release: Release?
-        fileprivate var ignoreAction: IgnoreAction?
-        fileprivate var persistAction: PersistAction?
-        fileprivate var persistOptions: [String: TimeInterval] = [:]
-        fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:]
-        fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:]
-
-        func setPending(secret: AnySecret, store: AnySecretStore) {
-            pendingPersistableSecrets[secret.id.description] = secret
-            pendingPersistableStores[store.id.description] = store
-        }
-
-        func retrievePending(secretID: String, storeID: String, optionID: String) -> (AnySecret, AnySecretStore, TimeInterval)? {
-            guard let secret = pendingPersistableSecrets[secretID],
-                  let store = pendingPersistableStores[storeID],
-                  let options = persistOptions[optionID] else {
-                return nil
-            }
-            pendingPersistableSecrets.removeValue(forKey: secretID)
-            return (secret, store, options)
-        }
-
-        func setPersistenceState(options: [String: TimeInterval], action: @escaping PersistAction) {
-            self.persistOptions = options
-            self.persistAction = action
-        }
-
-        func prepareForNotification(release: Release, ignoreAction: IgnoreAction?) {
-            self.release = release
-            self.ignoreAction = ignoreAction
-        }
-
-        
-    }
-
-    fileprivate let state = State()
+    fileprivate var release: Release?
+    fileprivate var ignore: ((Release) -> Void)?
+    fileprivate var persistAuthentication: ((AnySecret, AnySecretStore, TimeInterval?) -> Void)?
+    fileprivate var persistOptions: [String: TimeInterval] = [:]
+    fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:]
+    fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:]
 
     func userNotificationCenter(_ center: UNUserNotificationCenter, openSettingsFor notification: UNNotification?) {
 
     }
 
-    func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse) async {
+    func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) {
         let category = response.notification.request.content.categoryIdentifier
         switch category {
         case Notifier.Constants.updateCategoryIdentitifier:
-            await handleUpdateResponse(response: response)
+            handleUpdateResponse(response: response)
         case Notifier.Constants.persistAuthenticationCategoryIdentitifier:
-            await handlePersistAuthenticationResponse(response: response)
+            handlePersistAuthenticationResponse(response: response)
         default:
             break
         }
+
+        completionHandler()
     }
 
-    func handleUpdateResponse(response: UNNotificationResponse) async {
-        let id = response.actionIdentifier
-        guard let update = await state.release else { return }
-        switch id {
+    func handleUpdateResponse(response: UNNotificationResponse) {
+        guard let update = release else { return }
+        switch response.actionIdentifier {
         case Notifier.Constants.updateActionIdentitifier, UNNotificationDefaultActionIdentifier:
             NSWorkspace.shared.open(update.html_url)
         case Notifier.Constants.ignoreActionIdentitifier:
-            await state.ignoreAction?(update)
+            ignore?(update)
         default:
             fatalError()
         }
     }
 
-    func handlePersistAuthenticationResponse(response: UNNotificationResponse) async {
-        guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String,
-              let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String else {
-            return
-        }
-        let optionID = response.actionIdentifier
-        guard let (secret, store, persistOptions) = await state.retrievePending(secretID: secretID, storeID: storeID, optionID: optionID) else { return }
-        await state.persistAction?(secret, store, persistOptions)
+    func handlePersistAuthenticationResponse(response: UNNotificationResponse) {
+        guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String, let secret = pendingPersistableSecrets[secretID],
+              let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String, let store = pendingPersistableStores[storeID]
+        else { return }
+        pendingPersistableSecrets[secretID] = nil
+        persistAuthentication?(secret, store, persistOptions[response.actionIdentifier])
     }
 
-
-    func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification) async -> UNNotificationPresentationOptions {
-        [.list, .banner]
+    func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) {
+        completionHandler([.list, .banner])
     }
 
 }
-

Sources/SecretAgent/SecretAgent.entitlements

@@ -2,6 +2,10 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<key>com.apple.security.network.client</key>
+	<true/>
 	<key>com.apple.security.smartcard</key>
 	<true/>
 	<key>keychain-access-groups</key>

Sources/Secretive.xcodeproj/project.pbxproj

@@ -18,7 +18,6 @@
 		5003EF612780081600DF2006 /* SmartCardSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF602780081600DF2006 /* SmartCardSecretKit */; };
 		5003EF632780081B00DF2006 /* SecureEnclaveSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF622780081B00DF2006 /* SecureEnclaveSecretKit */; };
 		5003EF652780081B00DF2006 /* SmartCardSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF642780081B00DF2006 /* SmartCardSecretKit */; };
-		5008C2402E52792400507AC2 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8623FCE48E0099B055 /* Assets.xcassets */; };
 		500B93C32B478D8400E157DE /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 500B93C22B478D8400E157DE /* Localizable.xcstrings */; };
 		501421622781262300BBAA70 /* Brief in Frameworks */ = {isa = PBXBuildFile; productRef = 501421612781262300BBAA70 /* Brief */; };
 		501421652781268000BBAA70 /* SecretAgent.app in CopyFiles */ = {isa = PBXBuildFile; fileRef = 50A3B78A24026B7500D209EA /* SecretAgent.app */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
@@ -31,6 +30,7 @@
 		50617D8523FCE48E0099B055 /* ContentView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D8423FCE48E0099B055 /* ContentView.swift */; };
 		50617D8723FCE48E0099B055 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8623FCE48E0099B055 /* Assets.xcassets */; };
 		50617D8A23FCE48E0099B055 /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8923FCE48E0099B055 /* Preview Assets.xcassets */; };
+		50617D9923FCE48E0099B055 /* SecretiveTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D9823FCE48E0099B055 /* SecretiveTests.swift */; };
 		50617DD223FCEFA90099B055 /* PreviewStore.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617DD123FCEFA90099B055 /* PreviewStore.swift */; };
 		5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5065E312295517C500E16645 /* ToolbarButtonStyle.swift */; };
 		5066A6C22516F303004B5A36 /* SetupView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C12516F303004B5A36 /* SetupView.swift */; };
@@ -46,6 +46,7 @@
 		508BF2AA25B4F1CB009EFB7E /* InternetAccessPolicy.plist in Resources */ = {isa = PBXBuildFile; fileRef = 508BF29425B4F140009EFB7E /* InternetAccessPolicy.plist */; };
 		5091D2BC25183B830049FD9B /* ApplicationDirectoryController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5091D2BB25183B830049FD9B /* ApplicationDirectoryController.swift */; };
 		5099A02423FD2AAA0062B6F2 /* CreateSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5099A02323FD2AAA0062B6F2 /* CreateSecretView.swift */; };
+		50A3B79124026B7600D209EA /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50A3B79024026B7600D209EA /* Assets.xcassets */; };
 		50A3B79424026B7600D209EA /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50A3B79324026B7600D209EA /* Preview Assets.xcassets */; };
 		50A3B79724026B7600D209EA /* Main.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 50A3B79524026B7600D209EA /* Main.storyboard */; };
 		50B8550D24138C4F009958AC /* DeleteSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50B8550C24138C4F009958AC /* DeleteSecretView.swift */; };
@@ -62,6 +63,13 @@
 			remoteGlobalIDString = 50A3B78924026B7500D209EA;
 			remoteInfo = SecretAgent;
 		};
+		50617D9523FCE48E0099B055 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 50617D7723FCE48D0099B055 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 50617D7E23FCE48D0099B055;
+			remoteInfo = Secretive;
+		};
 /* End PBXContainerItemProxy section */
 
 /* Begin PBXCopyFilesBuildPhase section */
@@ -115,6 +123,9 @@
 		50617D8923FCE48E0099B055 /* Preview Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = "Preview Assets.xcassets"; sourceTree = "<group>"; };
 		50617D8E23FCE48E0099B055 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		50617D8F23FCE48E0099B055 /* Secretive.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = Secretive.entitlements; sourceTree = "<group>"; };
+		50617D9423FCE48E0099B055 /* SecretiveTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = SecretiveTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
+		50617D9823FCE48E0099B055 /* SecretiveTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretiveTests.swift; sourceTree = "<group>"; };
+		50617D9A23FCE48E0099B055 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		50617DD123FCEFA90099B055 /* PreviewStore.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PreviewStore.swift; sourceTree = "<group>"; };
 		5065E312295517C500E16645 /* ToolbarButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ToolbarButtonStyle.swift; sourceTree = "<group>"; };
 		5066A6C12516F303004B5A36 /* SetupView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SetupView.swift; sourceTree = "<group>"; };
@@ -133,6 +144,7 @@
 		5091D2BB25183B830049FD9B /* ApplicationDirectoryController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ApplicationDirectoryController.swift; sourceTree = "<group>"; };
 		5099A02323FD2AAA0062B6F2 /* CreateSecretView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = CreateSecretView.swift; sourceTree = "<group>"; };
 		50A3B78A24026B7500D209EA /* SecretAgent.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = SecretAgent.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		50A3B79024026B7600D209EA /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
 		50A3B79324026B7600D209EA /* Preview Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = "Preview Assets.xcassets"; sourceTree = "<group>"; };
 		50A3B79624026B7600D209EA /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; name = Base; path = Base.lproj/Main.storyboard; sourceTree = "<group>"; };
 		50A3B79824026B7600D209EA /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
@@ -154,6 +166,13 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		50617D9123FCE48E0099B055 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		50A3B78724026B7500D209EA /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
@@ -182,6 +201,7 @@
 			children = (
 				5003EF39278005C800DF2006 /* Packages */,
 				50617D8123FCE48E0099B055 /* Secretive */,
+				50617D9723FCE48E0099B055 /* SecretiveTests */,
 				50A3B78B24026B7500D209EA /* SecretAgent */,
 				508A58AF241E144C0069DC07 /* Config */,
 				50617D8023FCE48E0099B055 /* Products */,
@@ -193,6 +213,7 @@
 			isa = PBXGroup;
 			children = (
 				50617D7F23FCE48E0099B055 /* Secretive.app */,
+				50617D9423FCE48E0099B055 /* SecretiveTests.xctest */,
 				50A3B78A24026B7500D209EA /* SecretAgent.app */,
 			);
 			name = Products;
@@ -227,6 +248,15 @@
 			path = "Preview Content";
 			sourceTree = "<group>";
 		};
+		50617D9723FCE48E0099B055 /* SecretiveTests */ = {
+			isa = PBXGroup;
+			children = (
+				50617D9823FCE48E0099B055 /* SecretiveTests.swift */,
+				50617D9A23FCE48E0099B055 /* Info.plist */,
+			);
+			path = SecretiveTests;
+			sourceTree = "<group>";
+		};
 		508A58AF241E144C0069DC07 /* Config */ = {
 			isa = PBXGroup;
 			children = (
@@ -280,6 +310,7 @@
 			children = (
 				50020BAF24064869003D4025 /* AppDelegate.swift */,
 				5018F54E24064786002EB505 /* Notifier.swift */,
+				50A3B79024026B7600D209EA /* Assets.xcassets */,
 				50A3B79524026B7600D209EA /* Main.storyboard */,
 				50A3B79824026B7600D209EA /* Info.plist */,
 				508BF29425B4F140009EFB7E /* InternetAccessPolicy.plist */,
@@ -326,6 +357,24 @@
 			productReference = 50617D7F23FCE48E0099B055 /* Secretive.app */;
 			productType = "com.apple.product-type.application";
 		};
+		50617D9323FCE48E0099B055 /* SecretiveTests */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 50617DA023FCE48E0099B055 /* Build configuration list for PBXNativeTarget "SecretiveTests" */;
+			buildPhases = (
+				50617D9023FCE48E0099B055 /* Sources */,
+				50617D9123FCE48E0099B055 /* Frameworks */,
+				50617D9223FCE48E0099B055 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				50617D9623FCE48E0099B055 /* PBXTargetDependency */,
+			);
+			name = SecretiveTests;
+			productName = SecretiveTests;
+			productReference = 50617D9423FCE48E0099B055 /* SecretiveTests.xctest */;
+			productType = "com.apple.product-type.bundle.unit-test";
+		};
 		50A3B78924026B7500D209EA /* SecretAgent */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = 50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */;
@@ -357,14 +406,17 @@
 		50617D7723FCE48D0099B055 /* Project object */ = {
 			isa = PBXProject;
 			attributes = {
-				BuildIndependentTargetsInParallel = YES;
 				LastSwiftUpdateCheck = 1220;
-				LastUpgradeCheck = 2600;
+				LastUpgradeCheck = 1320;
 				ORGANIZATIONNAME = "Max Goedjen";
 				TargetAttributes = {
 					50617D7E23FCE48D0099B055 = {
 						CreatedOnToolsVersion = 11.3;
 					};
+					50617D9323FCE48E0099B055 = {
+						CreatedOnToolsVersion = 11.3;
+						TestTargetID = 50617D7E23FCE48D0099B055;
+					};
 					50A3B78924026B7500D209EA = {
 						CreatedOnToolsVersion = 11.4;
 					};
@@ -382,10 +434,6 @@
 				de,
 				"pt-BR",
 				fi,
-				ko,
-				ca,
-				ru,
-				pl,
 			);
 			mainGroup = 50617D7623FCE48D0099B055;
 			productRefGroup = 50617D8023FCE48E0099B055 /* Products */;
@@ -393,6 +441,7 @@
 			projectRoot = "";
 			targets = (
 				50617D7E23FCE48D0099B055 /* Secretive */,
+				50617D9323FCE48E0099B055 /* SecretiveTests */,
 				50A3B78924026B7500D209EA /* SecretAgent */,
 			);
 		};
@@ -411,6 +460,13 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		50617D9223FCE48E0099B055 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		50A3B78824026B7500D209EA /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -418,8 +474,8 @@
 				50A3B79724026B7600D209EA /* Main.storyboard in Resources */,
 				50E9CF422B51D596004AB36D /* Localizable.xcstrings in Resources */,
 				50A3B79424026B7600D209EA /* Preview Assets.xcassets in Resources */,
+				50A3B79124026B7600D209EA /* Assets.xcassets in Resources */,
 				508BF2AA25B4F1CB009EFB7E /* InternetAccessPolicy.plist in Resources */,
-				5008C2402E52792400507AC2 /* Assets.xcassets in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -456,6 +512,14 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		50617D9023FCE48E0099B055 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				50617D9923FCE48E0099B055 /* SecretiveTests.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		50A3B78624026B7500D209EA /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -473,6 +537,11 @@
 			target = 50A3B78924026B7500D209EA /* SecretAgent */;
 			targetProxy = 50142166278126B500BBAA70 /* PBXContainerItemProxy */;
 		};
+		50617D9623FCE48E0099B055 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 50617D7E23FCE48D0099B055 /* Secretive */;
+			targetProxy = 50617D9523FCE48E0099B055 /* PBXContainerItemProxy */;
+		};
 /* End PBXTargetDependency section */
 
 /* Begin PBXVariantGroup section */
@@ -492,8 +561,6 @@
 			baseConfigurationReference = 508A58AB241E121B0069DC07 /* Config.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
-				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
@@ -524,11 +591,9 @@
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				COPY_PHASE_STRIP = NO;
-				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
-				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu11;
 				GCC_DYNAMIC_NO_PIC = NO;
 				GCC_NO_COMMON_BLOCKS = YES;
@@ -543,19 +608,18 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
 				OTHER_SWIFT_FLAGS = "";
 				SDKROOT = macosx;
-				STRING_CATALOG_GENERATE_SYMBOLS = YES;
 				STRIP_INSTALLED_PRODUCT = NO;
 				STRIP_SWIFT_SYMBOLS = NO;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
 				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_VERSION = 6.0;
+				SWIFT_STRICT_CONCURRENCY = complete;
 			};
 			name = Debug;
 		};
@@ -564,8 +628,6 @@
 			baseConfigurationReference = 508A58AB241E121B0069DC07 /* Config.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
-				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
@@ -596,11 +658,9 @@
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				COPY_PHASE_STRIP = NO;
-				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu11;
 				GCC_NO_COMMON_BLOCKS = YES;
 				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
@@ -609,78 +669,115 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				MTL_ENABLE_DEBUG_INFO = NO;
 				MTL_FAST_MATH = YES;
 				OTHER_SWIFT_FLAGS = "";
 				SDKROOT = macosx;
-				STRING_CATALOG_GENERATE_SYMBOLS = YES;
 				STRIP_INSTALLED_PRODUCT = NO;
 				STRIP_SWIFT_SYMBOLS = NO;
 				SWIFT_COMPILATION_MODE = wholemodule;
 				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-O";
-				SWIFT_VERSION = 6.0;
+				SWIFT_STRICT_CONCURRENCY = complete;
 			};
 			name = Release;
 		};
 		50617D9E23FCE48E0099B055 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
+				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = Secretive/Secretive.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
 				CURRENT_PROJECT_VERSION = 1;
-				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_ASSET_PATHS = "\"Secretive/Preview Content\"";
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
-				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_USER_SELECTED_FILES = readwrite;
 				INFOPLIST_FILE = Secretive/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MACOSX_DEPLOYMENT_TARGET = 14.0;
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE_SPECIFIER = "";
+				SWIFT_VERSION = 5.0;
 			};
 			name = Debug;
 		};
 		50617D9F23FCE48E0099B055 /* Release */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
+				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = Secretive/Secretive.entitlements;
 				CODE_SIGN_IDENTITY = "Developer ID Application";
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
 				CURRENT_PROJECT_VERSION = 1;
-				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_ASSET_PATHS = "\"Secretive/Preview Content\"";
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
-				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_USER_SELECTED_FILES = readwrite;
 				INFOPLIST_FILE = Secretive/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MACOSX_DEPLOYMENT_TARGET = 14.0;
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE_SPECIFIER = "Secretive - Host";
+				SWIFT_VERSION = 5.0;
+			};
+			name = Release;
+		};
+		50617DA123FCE48E0099B055 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				DEVELOPMENT_TEAM = Z72PRUAWF6;
+				INFOPLIST_FILE = SecretiveTests/Info.plist;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@loader_path/../Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_VERSION = 5.0;
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive";
+			};
+			name = Debug;
+		};
+		50617DA223FCE48E0099B055 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				DEVELOPMENT_TEAM = Z72PRUAWF6;
+				INFOPLIST_FILE = SecretiveTests/Info.plist;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@loader_path/../Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_VERSION = 5.0;
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive";
 			};
 			name = Release;
 		};
@@ -689,8 +786,6 @@
 			baseConfigurationReference = 508A58AB241E121B0069DC07 /* Config.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
-				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
@@ -721,11 +816,9 @@
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				COPY_PHASE_STRIP = NO;
-				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
-				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu11;
 				GCC_DYNAMIC_NO_PIC = NO;
 				GCC_NO_COMMON_BLOCKS = YES;
@@ -740,45 +833,64 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
 				OTHER_SWIFT_FLAGS = "";
 				SDKROOT = macosx;
-				STRING_CATALOG_GENERATE_SYMBOLS = YES;
 				STRIP_INSTALLED_PRODUCT = NO;
 				STRIP_SWIFT_SYMBOLS = NO;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
 				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_VERSION = 6.0;
+				SWIFT_STRICT_CONCURRENCY = complete;
 			};
 			name = Test;
 		};
 		508A5915241EF1A00069DC07 /* Test */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
+				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
 				CURRENT_PROJECT_VERSION = 1;
-				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_ASSET_PATHS = "\"Secretive/Preview Content\"";
-				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = NO;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				ENABLE_PREVIEWS = YES;
-				ENABLE_USER_SELECTED_FILES = readwrite;
 				INFOPLIST_FILE = Secretive/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MACOSX_DEPLOYMENT_TARGET = 14.0;
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
 				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_VERSION = 5.0;
+			};
+			name = Test;
+		};
+		508A5916241EF1A00069DC07 /* Test */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_IDENTITY = "-";
+				CODE_SIGN_STYLE = Manual;
+				COMBINE_HIDPI_IMAGES = YES;
+				INFOPLIST_FILE = SecretiveTests/Info.plist;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@loader_path/../Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				SWIFT_VERSION = 5.0;
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive";
 			};
 			name = Test;
 		};
@@ -788,21 +900,19 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
-				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_ASSET_PATHS = "\"SecretAgent/Preview Content\"";
-				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = SecretAgent/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MACOSX_DEPLOYMENT_TARGET = 14.0;
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_VERSION = 5.0;
 			};
 			name = Test;
 		};
@@ -813,22 +923,20 @@
 				CODE_SIGN_ENTITLEMENTS = SecretAgent/SecretAgent.entitlements;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_ASSET_PATHS = "\"SecretAgent/Preview Content\"";
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
-				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = SecretAgent/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MACOSX_DEPLOYMENT_TARGET = 14.0;
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_VERSION = 5.0;
 			};
 			name = Debug;
 		};
@@ -840,23 +948,21 @@
 				CODE_SIGN_IDENTITY = "Developer ID Application";
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
-				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_ASSET_PATHS = "\"SecretAgent/Preview Content\"";
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
-				ENABLE_APP_SANDBOX = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
-				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = SecretAgent/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MACOSX_DEPLOYMENT_TARGET = 14.0;
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE_SPECIFIER = "Secretive - Secret Agent";
+				SWIFT_VERSION = 5.0;
 			};
 			name = Release;
 		};
@@ -883,6 +989,16 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
+		50617DA023FCE48E0099B055 /* Build configuration list for PBXNativeTarget "SecretiveTests" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				50617DA123FCE48E0099B055 /* Debug */,
+				508A5916241EF1A00069DC07 /* Test */,
+				50617DA223FCE48E0099B055 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
 		50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (

Sources/Secretive.xcodeproj/xcshareddata/xcschemes/SecretAgent.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2600"
+   LastUpgradeVersion = "1320"
    version = "1.7">
    <BuildAction
       parallelizeBuildables = "YES"

Sources/Secretive.xcodeproj/xcshareddata/xcschemes/Secretive.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2600"
+   LastUpgradeVersion = "1320"
    version = "1.7">
    <BuildAction
       parallelizeBuildables = "YES"
@@ -89,7 +89,7 @@
       </BuildableProductRunnable>
    </LaunchAction>
    <ProfileAction
-      buildConfiguration = "Debug"
+      buildConfiguration = "Release"
       shouldUseLaunchSchemeArgsEnv = "YES"
       savedToolIdentifier = ""
       useCustomWorkingDirectory = "NO"

Sources/Secretive/App.swift

@@ -5,42 +5,28 @@ import SecureEnclaveSecretKit
 import SmartCardSecretKit
 import Brief
 
-extension EnvironmentValues {
+@main
+struct Secretive: App {
 
-    // This is injected through .environment modifier below instead of @Entry for performance reasons (basially, restrictions around init/mainactor causing delay in loading secrets/"empty screen" blip).
-    @MainActor fileprivate static let _secretStoreList: SecretStoreList = {
+    private let storeList: SecretStoreList = {
         let list = SecretStoreList()
         list.add(store: SecureEnclave.Store())
         list.add(store: SmartCard.Store())
         return list
     }()
-
-    private static let _agentStatusChecker = AgentStatusChecker()
-    @Entry var agentStatusChecker: any AgentStatusCheckerProtocol = _agentStatusChecker
-    private static let _updater: any UpdaterProtocol = {
-        @AppStorage("defaultsHasRunSetup") var hasRunSetup = false
-        return Updater(checkOnLaunch: hasRunSetup)
-    }()
-    @Entry var updater: any UpdaterProtocol = _updater
-
-    @MainActor var secretStoreList: SecretStoreList {
-        EnvironmentValues._secretStoreList
-    }
-}
-
-@main
-struct Secretive: App {
-    
+    private let agentStatusChecker = AgentStatusChecker()
     private let justUpdatedChecker = JustUpdatedChecker()
-    @Environment(\.agentStatusChecker) var agentStatusChecker
+
     @AppStorage("defaultsHasRunSetup") var hasRunSetup = false
     @State private var showingSetup = false
     @State private var showingCreation = false
 
     @SceneBuilder var body: some Scene {
         WindowGroup {
-            ContentView(showingCreation: $showingCreation, runningSetup: $showingSetup, hasRunSetup: $hasRunSetup)
-                .environment(EnvironmentValues._secretStoreList)
+            ContentView<Updater, AgentStatusChecker>(showingCreation: $showingCreation, runningSetup: $showingSetup, hasRunSetup: $hasRunSetup)
+                .environmentObject(storeList)
+                .environmentObject(Updater(checkOnLaunch: hasRunSetup))
+                .environmentObject(agentStatusChecker)
                 .onAppear {
                     if !hasRunSetup {
                         showingSetup = true
@@ -84,12 +70,13 @@ extension Secretive {
 
     private func reinstallAgent() {
         justUpdatedChecker.check()
-        Task {
-            await LaunchAgentController().install()
-            try? await Task.sleep(for: .seconds(1))
-            agentStatusChecker.check()
-            if !agentStatusChecker.running {
-                forceLaunchAgent()
+        LaunchAgentController().install {
+            // Wait a second for launchd to kick in (next runloop isn't enough).
+            DispatchQueue.main.asyncAfter(deadline: .now() + 1) {
+                agentStatusChecker.check()
+                if !agentStatusChecker.running {
+                    forceLaunchAgent()
+                }
             }
         }
     }
@@ -97,8 +84,7 @@ extension Secretive {
     private func forceLaunchAgent() {
         // We've run setup, we didn't just update, launchd is just not doing it's thing.
         // Force a launch directly.
-        Task {
-            _ = await LaunchAgentController().forceLaunch()
+        LaunchAgentController().forceLaunch { _ in
             agentStatusChecker.check()
         }
     }

Sources/Secretive/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -1,61 +1,53 @@
 {
   "images" : [
     {
-      "filename" : "Icon-macOS-ClearDark-16x16@1x.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "16x16"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-16x16@2x.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "16x16"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-32x32@1x.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "32x32"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-32x32@2x.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "32x32"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-128x128@1x.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "128x128"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-128x128@2x.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "128x128"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-256x256@1x.png",
+      "filename" : "Mac Icon.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "256x256"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-256x256@2x.png",
+      "filename" : "Mac Icon@0.25x.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "256x256"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-512x512@1x.png",
       "idiom" : "mac",
       "scale" : "1x",
       "size" : "512x512"
     },
     {
-      "filename" : "Icon-macOS-ClearDark-1024x1024@1x.png",
       "idiom" : "mac",
       "scale" : "2x",
       "size" : "512x512"

Sources/Secretive/Assets.xcassets/Contents.json

@@ -1,6 +1,6 @@
 {
   "info" : {
-    "author" : "xcode",
-    "version" : 1
+    "version" : 1,
+    "author" : "xcode"
   }
 }

Sources/Secretive/Controllers/AgentStatusChecker.swift

@@ -2,22 +2,18 @@ import Foundation
 import Combine
 import AppKit
 import SecretKit
-import Observation
 
-@MainActor protocol AgentStatusCheckerProtocol: Observable, Sendable {
+protocol AgentStatusCheckerProtocol: ObservableObject {
     var running: Bool { get }
     var developmentBuild: Bool { get }
-    func check()
 }
 
-@Observable @MainActor final class AgentStatusChecker: AgentStatusCheckerProtocol {
+class AgentStatusChecker: ObservableObject, AgentStatusCheckerProtocol {
 
-    var running: Bool = false
+    @Published var running: Bool = false
 
-    nonisolated init() {
-        Task { @MainActor in
-            check()
-        }
+    init() {
+        check()
     }
 
     func check() {

Sources/Secretive/Controllers/JustUpdatedChecker.swift

@@ -2,13 +2,13 @@ import Foundation
 import Combine
 import AppKit
 
-protocol JustUpdatedCheckerProtocol: Observable {
+protocol JustUpdatedCheckerProtocol: ObservableObject {
     var justUpdated: Bool { get }
 }
 
-@Observable class JustUpdatedChecker: JustUpdatedCheckerProtocol {
+class JustUpdatedChecker: ObservableObject, JustUpdatedCheckerProtocol {
 
-    var justUpdated: Bool = false
+    @Published var justUpdated: Bool = false
 
     init() {
         check()

Sources/Secretive/Controllers/LaunchAgentController.swift

@@ -8,45 +8,38 @@ struct LaunchAgentController {
     
     private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "LaunchAgentController")
 
-    func install() async {
+    func install(completion: (() -> Void)? = nil) {
         logger.debug("Installing agent")
         _ = setEnabled(false)
         // This is definitely a bit of a "seems to work better" thing but:
         // Seems to more reliably hit if these are on separate runloops, otherwise it seems like it sometimes doesn't kill old
         // and start new?
-        try? await Task.sleep(for: .seconds(1))
-        await MainActor.run {
+        DispatchQueue.main.asyncAfter(deadline: .now() + 0.1) {
             _  = setEnabled(true)
+            completion?()
         }
+
     }
 
-    func forceLaunch() async -> Bool {
+    func forceLaunch(completion: ((Bool) -> Void)?) {
         logger.debug("Agent is not running, attempting to force launch")
         let url = Bundle.main.bundleURL.appendingPathComponent("Contents/Library/LoginItems/SecretAgent.app")
         let config = NSWorkspace.OpenConfiguration()
         config.activates = false
-        do {
-            try await NSWorkspace.shared.openApplication(at: url, configuration: config)
-            logger.debug("Agent force launched")
-            return true
-        } catch {
-            logger.error("Error force launching \(error.localizedDescription)")
-            return false
+        NSWorkspace.shared.openApplication(at: url, configuration: config) { app, error in
+            DispatchQueue.main.async {
+                completion?(error == nil)
+            }
+            if let error = error {
+                logger.error("Error force launching \(error.localizedDescription)")
+            } else {
+                logger.debug("Agent force launched")
+            }
         }
     }
 
     private func setEnabled(_ enabled: Bool) -> Bool {
-        let service = SMAppService.loginItem(identifier: Bundle.main.agentBundleID)
-        do {
-            if enabled {
-                try service.register()
-            } else {
-                try service.unregister()
-            }
-            return true
-        } catch {
-            return false
-        }
+        SMLoginItemSetEnabled(Bundle.main.agentBundleID as CFString, enabled)
     }
 
 }

Sources/Secretive/Preview Content/PreviewAgentStatusChecker.swift

@@ -10,7 +10,4 @@ class PreviewAgentStatusChecker: AgentStatusCheckerProtocol {
         self.running = running
     }
 
-    func check() {
-    }
-
 }

Sources/Secretive/Preview Content/PreviewStore.swift

@@ -20,20 +20,20 @@ extension Preview {
 
 extension Preview {
 
-    @Observable final class Store: SecretStore {
+    class Store: SecretStore, ObservableObject {
 
         let isAvailable = true
         let id = UUID()
         var name: String { "Preview Store" }
-        let secrets: [Secret]
+        @Published var secrets: [Secret] = []
 
         init(secrets: [Secret]) {
-            self.secrets = secrets
+            self.secrets.append(contentsOf: secrets)
         }
 
-        convenience init(numberOfRandomSecrets: Int = 5) {
+        init(numberOfRandomSecrets: Int = 5) {
             let new = (0..<numberOfRandomSecrets).map { Secret(name: String(describing: $0)) }
-            self.init(secrets: new)
+            self.secrets.append(contentsOf: new)
         }
 
         func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
@@ -56,40 +56,8 @@ extension Preview {
 
     }
 
-    final class StoreModifiable: SecretStoreModifiable {
-        
-        let isAvailable = true
-        let id = UUID()
-        var name: String { "Modifiable Preview Store" }
-        let secrets: [Secret]
-
-        init(secrets: [Secret]) {
-            self.secrets = secrets
-        }
-
-        convenience init(numberOfRandomSecrets: Int = 5) {
-            let new = (0..<numberOfRandomSecrets).map { Secret(name: String(describing: $0)) }
-            self.init(secrets: new)
-        }
-
-        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
-            return data
-        }
-
-        func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool {
-            true
-        }
-
-        func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
-            nil
-        }
-
-        func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws {
-        }
-
-        func reloadSecrets() {
-        }
-
+    class StoreModifiable: Store, SecretStoreModifiable {
+        override var name: String { "Modifiable Preview Store" }
 
         func create(name: String, requiresAuthentication: Bool) throws {
         }
@@ -104,7 +72,7 @@ extension Preview {
 
 extension Preview {
 
-    @MainActor static func storeList(stores: [Store] = [], modifiableStores: [StoreModifiable] = []) -> SecretStoreList {
+    static func storeList(stores: [Store] = [], modifiableStores: [StoreModifiable] = []) -> SecretStoreList {
         let list = SecretStoreList()
         for store in stores {
             list.add(store: store)

Sources/Secretive/Preview Content/PreviewUpdater.swift

@@ -1,11 +1,10 @@
 import Foundation
-import Observation
+import Combine
 import Brief
 
-@Observable @MainActor final class PreviewUpdater: UpdaterProtocol {
-
-    var update: Release? = nil
+class PreviewUpdater: UpdaterProtocol {
 
+    let update: Release?
     let testBuild = false
 
     init(update: Update = .none) {
@@ -19,9 +18,6 @@ import Brief
         }
     }
 
-    func ignore(release: Release) async {
-    }
-    
 }
 
 extension PreviewUpdater {

Sources/Secretive/Secretive.entitlements

@@ -2,6 +2,12 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<key>com.apple.security.files.user-selected.read-write</key>
+	<true/>
+	<key>com.apple.security.network.client</key>
+	<true/>
 	<key>com.apple.security.smartcard</key>
 	<true/>
 	<key>keychain-access-groups</key>

Sources/Secretive/Views/ContentView.swift

@@ -4,18 +4,18 @@ import SecureEnclaveSecretKit
 import SmartCardSecretKit
 import Brief
 
-struct ContentView: View {
+struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentStatusCheckerProtocol>: View {
 
     @Binding var showingCreation: Bool
     @Binding var runningSetup: Bool
     @Binding var hasRunSetup: Bool
     @State var showingAgentInfo = false
-    @State var activeSecret: AnySecret?
+    @State var activeSecret: AnySecret.ID?
     @Environment(\.colorScheme) var colorScheme
 
-    @Environment(\.secretStoreList) private var storeList
-    @Environment(\.updater) private var updater: any UpdaterProtocol
-    @Environment(\.agentStatusChecker) private var agentStatusChecker: any AgentStatusCheckerProtocol
+    @EnvironmentObject private var storeList: SecretStoreList
+    @EnvironmentObject private var updater: UpdaterType
+    @EnvironmentObject private var agentStatusChecker: AgentStatusCheckerType
 
     @State private var selectedUpdate: Release?
     @State private var showingAppPathNotice = false
@@ -30,7 +30,7 @@ struct ContentView: View {
         }
         .frame(minWidth: 640, minHeight: 320)
         .toolbar {
-//            toolbarItem(updateNoticeView, id: "update")
+            toolbarItem(updateNoticeView, id: "update")
             toolbarItem(runningOrRunSetupView, id: "setup")
             toolbarItem(appPathNoticeView, id: "appPath")
             toolbarItem(newItemView, id: "new")
@@ -45,14 +45,8 @@ struct ContentView: View {
 extension ContentView {
 
 
-    @ToolbarContentBuilder
-    func toolbarItem(_ view: some View, id: String) -> some ToolbarContent {
-        if #available(macOS 26.0, *) {
-            ToolbarItem(id: id) { view }
-                .sharedBackgroundVisibility(.hidden)
-        } else {
-            ToolbarItem(id: id) { view }
-        }
+    func toolbarItem(_ view: some View, id: String) -> ToolbarItem<String, some View> {
+        ToolbarItem(id: id) { view }
     }
 
     var needsSetup: Bool {
@@ -112,7 +106,7 @@ extension ContentView {
                 if let modifiable = storeList.modifiableStore {
                     CreateSecretView(store: modifiable, showing: $showingCreation)
                         .onDisappear {
-                            guard let newest = modifiable.secrets.last else { return }
+                            guard let newest = modifiable.secrets.last?.id else { return }
                             activeSecret = newest
                         }
                 }
@@ -203,18 +197,34 @@ extension ContentView {
 
 struct ContentView_Previews: PreviewProvider {
 
+    private static let storeList: SecretStoreList = {
+        let list = SecretStoreList()
+        list.add(store: SecureEnclave.Store())
+        list.add(store: SmartCard.Store())
+        return list
+    }()
+    private static let agentStatusChecker = AgentStatusChecker()
+    private static let justUpdatedChecker = JustUpdatedChecker()
+
+    @State var hasRunSetup = false
+    @State private var showingSetup = false
+    @State private var showingCreation = false
+
     static var previews: some View {
         Group {
             // Empty on modifiable and nonmodifiable
-            ContentView(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
-                .environment(Preview.storeList(stores: [Preview.Store(numberOfRandomSecrets: 0)], modifiableStores: [Preview.StoreModifiable(numberOfRandomSecrets: 0)]))
-                .environment(PreviewUpdater())
+            ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
+                .environmentObject(Preview.storeList(stores: [Preview.Store(numberOfRandomSecrets: 0)], modifiableStores: [Preview.StoreModifiable(numberOfRandomSecrets: 0)]))
+                .environmentObject(PreviewUpdater())
+                .environmentObject(agentStatusChecker)
 
             // 5 items on modifiable and nonmodifiable
-            ContentView(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
-                .environment(Preview.storeList(stores: [Preview.Store()], modifiableStores: [Preview.StoreModifiable()]))
-                .environment(PreviewUpdater())
+            ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
+                .environmentObject(Preview.storeList(stores: [Preview.Store()], modifiableStores: [Preview.StoreModifiable()]))
+                .environmentObject(PreviewUpdater())
+                .environmentObject(agentStatusChecker)
         }
+        .environmentObject(agentStatusChecker)
 
     }
 }

Sources/Secretive/Views/CopyableView.swift

@@ -8,8 +8,9 @@ struct CopyableView: View {
     var text: String
 
     @State private var interactionState: InteractionState = .normal
+    @Environment(\.colorScheme) private var colorScheme
 
-    var content: some View {
+    var body: some View {
         VStack(alignment: .leading) {
             HStack {
                 image
@@ -21,7 +22,7 @@ struct CopyableView: View {
                     .foregroundColor(primaryTextColor)
                 Spacer()
                 if interactionState != .normal {
-                    hoverIcon
+                    Text(hoverText)
                         .bold()
                         .textCase(.uppercase)
                         .foregroundColor(secondaryTextColor)
@@ -38,23 +39,17 @@ struct CopyableView: View {
                 .multilineTextAlignment(.leading)
                 .font(.system(.body, design: .monospaced))
         }
-        ._background(interactionState: interactionState)
+        .background(backgroundColor)
         .frame(minWidth: 150, maxWidth: .infinity)
-    }
-
-    var body: some View {
-        content
+        .cornerRadius(10)
         .onHover { hovering in
             withAnimation {
                 interactionState = hovering ? .hovering : .normal
             }
         }
-        .onDrag({
+        .onDrag {
             NSItemProvider(item: NSData(data: text.data(using: .utf8)!), typeIdentifier: UTType.utf8PlainText.identifier)
-        }, preview: {
-            content
-                ._background(interactionState: .dragging)
-        })
+        }
         .onTapGesture {
             copy()
             withAnimation {
@@ -71,23 +66,31 @@ struct CopyableView: View {
         )
     }
 
-    @ViewBuilder
-    var hoverIcon: some View {
+    var hoverText: LocalizedStringKey {
         switch interactionState {
         case .hovering:
-            Image(systemName: "document.on.document")
-                .accessibilityLabel(String(localized: "copyable_click_to_copy_button"))
+            return "copyable_click_to_copy_button"
         case .clicking:
-            Image(systemName: "checkmark.circle.fill")
-                .accessibilityLabel(String(localized: "copyable_copied"))
-        case .normal, .dragging:
-            EmptyView()
+            return "copyable_copied"
+        case .normal:
+            fatalError()
+        }
+    }
+
+    var backgroundColor: Color {
+        switch interactionState {
+        case .normal:
+            return colorScheme == .dark ? Color(white: 0.2) : Color(white: 0.885)
+        case .hovering:
+            return colorScheme == .dark ? Color(white: 0.275) : Color(white: 0.82)
+        case .clicking:
+            return .accentColor
         }
     }
 
     var primaryTextColor: Color {
         switch interactionState {
-        case .normal, .hovering, .dragging:
+        case .normal, .hovering:
             return Color(.textColor)
         case .clicking:
             return .white
@@ -96,7 +99,7 @@ struct CopyableView: View {
 
     var secondaryTextColor: Color {
         switch interactionState {
-        case .normal, .hovering, .dragging:
+        case .normal, .hovering:
             return Color(.secondaryLabelColor)
         case .clicking:
             return .white
@@ -108,59 +111,12 @@ struct CopyableView: View {
         NSPasteboard.general.setString(text, forType: .string)
     }
 
-}
-
-fileprivate enum InteractionState {
-    case normal, hovering, clicking, dragging
-}
-
-extension View {
-       
-    fileprivate func _background(interactionState: InteractionState) -> some View {
-        modifier(BackgroundViewModifier(interactionState: interactionState))
+    private enum InteractionState {
+        case normal, hovering, clicking
     }
 
 }
 
-fileprivate struct BackgroundViewModifier: ViewModifier {
-    
-    @Environment(\.colorScheme) private var colorScheme
-    
-    let interactionState: InteractionState
-
-    func body(content: Content) -> some View {
-        if interactionState == .dragging {
-            content
-                .background(backgroundColor(interactionState: interactionState), in: RoundedRectangle(cornerRadius: 15))
-        } else {
-            if #available(macOS 26.0, *) {
-                content
-                // Very thin opacity lets user hover anywhere over the view, glassEffect doesn't allow.
-                    .background(.white.opacity(0.01), in: RoundedRectangle(cornerRadius: 15))
-                    .glassEffect(.regular.tint(backgroundColor(interactionState: interactionState)), in: RoundedRectangle(cornerRadius: 15))
-                
-            } else {
-                content
-                    .background(backgroundColor(interactionState: interactionState))
-                    .cornerRadius(10)
-            }
-        }
-    }
-    
-    func backgroundColor(interactionState: InteractionState) -> Color {
-        switch interactionState {
-        case .normal:
-            return colorScheme == .dark ? Color(white: 0.2) : Color(white: 0.885)
-        case .hovering, .dragging:
-            return colorScheme == .dark ? Color(white: 0.275) : Color(white: 0.82)
-        case .clicking:
-            return .accentColor
-        }
-    }
-
-    
-}
-
 #if DEBUG
 
 struct CopyableView_Previews: PreviewProvider {

Sources/Secretive/Views/CreateSecretView.swift

@@ -3,7 +3,7 @@ import SecretKit
 
 struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
 
-    @State var store: StoreType
+    @ObservedObject var store: StoreType
     @Binding var showing: Bool
 
     @State private var name = ""
@@ -45,10 +45,8 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
     }
 
     func save() {
-        Task {
-            try! await store.create(name: name, requiresAuthentication: requiresAuthentication)
-            showing = false
-        }
+        try! store.create(name: name, requiresAuthentication: requiresAuthentication)
+        showing = false
     }
 
 }
@@ -95,14 +93,14 @@ struct ThumbnailPickerView<ValueType: Hashable>: View {
 
 extension ThumbnailPickerView {
 
-    struct Item<InnerValueType: Hashable>: Identifiable {
+    struct Item<ValueType: Hashable>: Identifiable {
         let id = UUID()
-        let value: InnerValueType
+        let value: ValueType
         let name: LocalizedStringKey
         let description: LocalizedStringKey
         let thumbnail: AnyView
 
-        init<ViewType: View>(value: InnerValueType, name: LocalizedStringKey, description: LocalizedStringKey, thumbnail: ViewType) {
+        init<ViewType: View>(value: ValueType, name: LocalizedStringKey, description: LocalizedStringKey, thumbnail: ViewType) {
             self.value = value
             self.name = name
             self.description = description
@@ -112,10 +110,10 @@ extension ThumbnailPickerView {
 
 }
 
-@MainActor @Observable class SystemBackground {
+@MainActor class SystemBackground: ObservableObject {
 
     static let shared = SystemBackground()
-    var image: NSImage?
+    @Published var image: NSImage?
 
     private init() {
         if let mainScreen = NSScreen.main, let imageURL = NSWorkspace.shared.desktopImageURL(for: mainScreen) {

Sources/Secretive/Views/DeleteSecretView.swift

@@ -3,7 +3,7 @@ import SecretKit
 
 struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
 
-    @State var store: StoreType
+    @ObservedObject var store: StoreType
     let secret: StoreType.SecretType
     var dismissalBlock: (Bool) -> ()
 
@@ -49,10 +49,8 @@ struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
     }
     
     func delete() {
-        Task {
-            try! await store.delete(secret: secret)
-            dismissalBlock(true)
-        }
+        try! store.delete(secret: secret)
+        dismissalBlock(true)
     }
 
 }

Sources/Secretive/Views/EmptyStoreView.swift

@@ -3,17 +3,31 @@ import SecretKit
 
 struct EmptyStoreView: View {
 
-    @State var store: AnySecretStore?
+    @ObservedObject var store: AnySecretStore
+    @Binding var activeSecret: AnySecret.ID?
 
     var body: some View {
         if store is AnySecretStoreModifiable {
-            EmptyStoreModifiableView()
+            NavigationLink(destination: EmptyStoreModifiableView(), tag: Constants.emptyStoreModifiableTag, selection: $activeSecret) {
+                Text("empty_store_modifiable_title")
+            }
         } else {
-            EmptyStoreImmutableView()
+            NavigationLink(destination: EmptyStoreImmutableView(), tag: Constants.emptyStoreTag, selection: $activeSecret) {
+                Text("empty_store_nonmodifiable_title")
+            }
         }
     }
 }
 
+extension EmptyStoreView {
+    
+    enum Constants {
+        static let emptyStoreModifiableTag: AnyHashable = "emptyStoreModifiableTag"
+        static let emptyStoreTag: AnyHashable = "emptyStoreTag"
+    }
+
+}
+
 struct EmptyStoreImmutableView: View {
     
     var body: some View {

Sources/Secretive/Views/RenameSecretView.swift

@@ -3,7 +3,7 @@ import SecretKit
 
 struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
 
-    @State var store: StoreType
+    @ObservedObject var store: StoreType
     let secret: StoreType.SecretType
     var dismissalBlock: (_ renamed: Bool) -> ()
 
@@ -44,9 +44,7 @@ struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
     }
 
     func rename() {
-        Task {
-            try? await store.update(secret: secret, name: newName)
-            dismissalBlock(true)
-        }
+        try? store.update(secret: secret, name: newName)
+        dismissalBlock(true)
     }
 }

Sources/Secretive/Views/SecretDetailView.swift

@@ -3,7 +3,7 @@ import SecretKit
 
 struct SecretDetailView<SecretType: Secret>: View {
     
-    let secret: SecretType
+    @State var secret: SecretType
 
     private let keyWriter = OpenSSHKeyWriter()
     private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory().replacingOccurrences(of: Bundle.main.hostBundleID, with: Bundle.main.agentBundleID))

Sources/Secretive/Views/SecretListItemView.swift

@@ -3,8 +3,9 @@ import SecretKit
 
 struct SecretListItemView: View {
 
-    @State var store: AnySecretStore
+    @ObservedObject var store: AnySecretStore
     var secret: AnySecret
+    @Binding var activeSecret: AnySecret.ID?
 
     @State var isDeleting: Bool = false
     @State var isRenaming: Bool = false
@@ -12,20 +13,13 @@ struct SecretListItemView: View {
     var deletedSecret: (AnySecret) -> Void
     var renamedSecret: (AnySecret) -> Void
 
-    private var showingPopup: Binding<Bool> {
-        Binding(
-            get: { isDeleting || isRenaming },
-            set: {
-                if $0 == false {
-                    isDeleting = false
-                    isRenaming = false
-                }
-            }
-        )
-    }
-    
     var body: some View {
-        NavigationLink(value: secret) {
+        let showingPopupWrapped = Binding(
+            get: { isDeleting || isRenaming },
+            set: { if $0 == false { isDeleting = false; isRenaming = false } }
+        )
+
+        return NavigationLink(destination: SecretDetailView(secret: secret), tag: secret.id, selection: $activeSecret) {
             if secret.requiresAuthentication {
                 HStack {
                     Text(secret.name)
@@ -46,7 +40,7 @@ struct SecretListItemView: View {
                 }
             }
         }
-        .popover(isPresented: showingPopup) {
+        .popover(isPresented: showingPopupWrapped) {
             if let modifiable = store as? AnySecretStoreModifiable {
                 if isDeleting {
                     DeleteSecretView(store: modifiable, secret: secret) { deleted in

Sources/Secretive/Views/SetupView.swift

@@ -55,7 +55,7 @@ struct StepView: View {
                 .foregroundColor(.green)
                 .frame(width: max(0, ((width - (Constants.padding * 2)) / Double(numberOfSteps - 1)) * Double(currentStep) - (Constants.circleWidth / 2)), height: 5)
             HStack {
-                ForEach(Array(0..<numberOfSteps), id: \.self) { index in
+                ForEach(0..<numberOfSteps) { index in
                     ZStack {
                         if currentStep > index {
                             Circle()
@@ -156,10 +156,8 @@ struct SecretAgentSetupView: View {
     }
 
     func install() {
-        Task {
-            await LaunchAgentController().install()
-            buttonAction()
-        }
+        LaunchAgentController().install()
+        buttonAction()
     }
 
 }

Sources/Secretive/Views/StoreListView.swift

@@ -4,60 +4,60 @@ import SecretKit
 
 struct StoreListView: View {
 
-    @Binding var activeSecret: AnySecret?
+    @Binding var activeSecret: AnySecret.ID?
     
-    @Environment(\.secretStoreList) private var storeList
+    @EnvironmentObject private var storeList: SecretStoreList
 
     private func secretDeleted(secret: AnySecret) {
         activeSecret = nextDefaultSecret
     }
 
     private func secretRenamed(secret: AnySecret) {
-        activeSecret = secret
+        activeSecret = secret.id
     }
 
     var body: some View {
-        NavigationSplitView {
+        NavigationView {
             List(selection: $activeSecret) {
                 ForEach(storeList.stores) { store in
                     if store.isAvailable {
                         Section(header: Text(store.name)) {
-                            ForEach(store.secrets) { secret in
-                                SecretListItemView(
-                                    store: store,
-                                    secret: secret,
-                                    deletedSecret: secretDeleted,
-                                    renamedSecret: secretRenamed
-                                )
+                            if store.secrets.isEmpty {
+                                EmptyStoreView(store: store, activeSecret: $activeSecret)
+                            } else {
+                                ForEach(store.secrets) { secret in
+                                    SecretListItemView(
+                                        store: store,
+                                        secret: secret,
+                                        activeSecret: $activeSecret,
+                                        deletedSecret: self.secretDeleted,
+                                        renamedSecret: self.secretRenamed
+                                    )
+                                }
                             }
                         }
                     }
                 }
             }
-        } detail: {
-            if let activeSecret {
-                SecretDetailView(secret: activeSecret)
-            } else if let nextDefaultSecret {
-                // This just means onAppear hasn't executed yet.
-                // Do this to avoid a blip.
-                SecretDetailView(secret: nextDefaultSecret)
-            } else {
-                EmptyStoreView(store: storeList.modifiableStore ?? storeList.stores.first)
+            .listStyle(SidebarListStyle())
+            .onAppear {
+                activeSecret = nextDefaultSecret
             }
+            .frame(minWidth: 100, idealWidth: 240)
         }
-        .navigationSplitViewStyle(.balanced)
-        .onAppear {
-            activeSecret = nextDefaultSecret
-        }
-        .frame(minWidth: 100, idealWidth: 240)
-
     }
 }
 
 extension StoreListView {
 
-    private var nextDefaultSecret: AnySecret? {
-        return storeList.stores.first(where: { !$0.secrets.isEmpty })?.secrets.first
+    var nextDefaultSecret: AnyHashable? {
+        let fallback: AnyHashable
+        if storeList.modifiableStore?.isAvailable ?? false {
+            fallback = EmptyStoreView.Constants.emptyStoreModifiableTag
+        } else {
+            fallback = EmptyStoreView.Constants.emptyStoreTag
+        }
+        return storeList.stores.compactMap(\.secrets.first).first?.id ?? fallback
     }
     
 }

Sources/Secretive/Views/ToolbarButtonStyle.swift

@@ -17,41 +17,21 @@ struct ToolbarButtonStyle: ButtonStyle {
         self.darkColor = darkColor
     }
 
-    @available(macOS 26.0, *)
-    private var glassTint: Color {
-        if !hovering {
-            colorScheme == .light ? lightColor : darkColor
-        } else {
-            colorScheme == .light ? lightColor.exposureAdjust(1) : darkColor.exposureAdjust(1)
-        }
-    }
-
     func makeBody(configuration: Configuration) -> some View {
-        if #available(macOS 26.0, *) {
-            configuration
-                .label
-                .foregroundColor(.white)
-                .padding(EdgeInsets(top: 6, leading: 8, bottom: 6, trailing: 8))
-                .glassEffect(.regular.tint(glassTint), in: .capsule)
-                .onHover { hovering in
+        configuration.label
+            .padding(EdgeInsets(top: 6, leading: 8, bottom: 6, trailing: 8))
+            .background(colorScheme == .light ? lightColor : darkColor)
+            .foregroundColor(.white)
+            .clipShape(RoundedRectangle(cornerRadius: 5))
+            .overlay(
+                RoundedRectangle(cornerRadius: 5)
+                    .stroke(colorScheme == .light ? .black.opacity(0.15) : .white.opacity(0.15), lineWidth: 1)
+                    .background(hovering ? (colorScheme == .light ? .black.opacity(0.1) : .white.opacity(0.05)) : Color.clear)
+            )
+            .onHover { hovering in
+                withAnimation {
                     self.hovering = hovering
                 }
-        } else {
-            configuration
-                .label
-                .background(colorScheme == .light ? lightColor : darkColor)
-                .foregroundColor(.white)
-                .clipShape(RoundedRectangle(cornerRadius: 5))
-                .overlay(
-                    RoundedRectangle(cornerRadius: 5)
-                        .stroke(colorScheme == .light ? .black.opacity(0.15) : .white.opacity(0.15), lineWidth: 1)
-                        .background(hovering ? (colorScheme == .light ? .black.opacity(0.1) : .white.opacity(0.05)) : Color.clear)
-                )
-                .onHover { hovering in
-                    withAnimation {
-                        self.hovering = hovering
-                    }
-                }
-        }
+            }
     }
 }

Sources/Secretive/Views/UpdateView.swift

@@ -1,9 +1,9 @@
 import SwiftUI
 import Brief
 
-struct UpdateDetailView: View {
+struct UpdateDetailView<UpdaterType: Updater>: View {
 
-    @Environment(\.updater) var updater: any UpdaterProtocol
+    @EnvironmentObject var updater: UpdaterType
 
     let update: Release
 
@@ -18,9 +18,7 @@ struct UpdateDetailView: View {
             HStack {
                 if !update.critical {
                     Button("update_ignore_button") {
-                        Task {
-                            await updater.ignore(release: update)
-                        }
+                        updater.ignore(release: update)
                     }
                     Spacer()
                 }

Sources/SecretiveTests/Info.plist

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleVersion</key>
+	<string>1</string>
+</dict>
+</plist>

Sources/SecretiveTests/SecretiveTests.swift

@@ -0,0 +1,20 @@
+import XCTest
+@testable import Secretive
+
+class SecretiveTests: XCTestCase {
+
+    override func setUp() {
+        // Put setup code here. This method is called before the invocation of each test method in the class.
+    }
+
+    override func tearDown() {
+        // Put teardown code here. This method is called after the invocation of each test method in the class.
+    }
+
+    func testExample() {
+        // This is an example of a functional test case.
+        // Use XCTAssert and related functions to verify your tests produce the correct results.
+    }
+
+
+}