Run filehandle listening methods in main actor directly vs jumping (#765)

* .

* Test

* Release

* Release

* Release

* -r

* ls

* Fix yml

* Path

* Path

* Path

* List

* Zip direct

* Zip direct

* Sha

* sha

* Zip direct

* Auth.

* .

* .

* .

* .

* .

* .

.github/scripts/signing.sh

@@ -10,10 +10,13 @@ security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k ci ci.keyc
 
 # Import Profiles
 mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
-
 echo $HOST_PROFILE_DATA | base64 -d -o Host.provisionprofile
 HOST_UUID=`grep UUID -A1 -a Host.provisionprofile | grep -io "[-A-F0-9]\{36\}"`
 cp Host.provisionprofile ~/Library/MobileDevice/Provisioning\ Profiles/$HOST_UUID.provisionprofile
 echo $AGENT_PROFILE_DATA | base64 -d -o Agent.provisionprofile
 AGENT_UUID=`grep UUID -A1 -a Agent.provisionprofile | grep -io "[-A-F0-9]\{36\}"`
-cp Agent.provisionprofile ~/Library/MobileDevice/Provisioning\ Profiles/$AGENT_UUID.provisionprofile
+cp Agent.provisionprofile ~/Library/MobileDevice/Provisioning\ Profiles/$AGENT_UUID.provisionprofile
+
+# Create directories for ASC key
+mkdir ~/.private_keys
+echo -n "$APPLE_API_KEY_DATA" > ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8

.github/templates/release.md

@@ -0,0 +1,16 @@
+Update description
+
+## Features
+
+
+## Fixes
+
+
+## Minimum macOS Version
+
+
+## Build
+https://github.com/maxgoedjen/secretive/actions/runs/RUN_ID
+
+## Attestation
+https://github.com/maxgoedjen/secretive/attestations/ATTESTATION_ID

.github/workflows/codeql.yml

@@ -0,0 +1,47 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '26 15 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-26') || 'ubuntu-latest' }}
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        # Disable this until CodeQL supports Xcode 26 builds.
+        # - language: swift
+        #   build-mode: manual
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+    - if: matrix.build-mode == 'manual'
+      name: "Select Xcode"
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
+    - if: matrix.build-mode == 'manual'
+      name: "Build"
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/nightly.yml

@@ -0,0 +1,66 @@
+name: Nightly
+
+on: 
+  schedule: 
+    - cron: "0 8 * * *"
+  workflow_dispatch:
+  
+jobs:
+  build:
+    runs-on: macos-26
+    permissions:
+      id-token: write
+      contents: write
+      attestations: write
+      actions: read
+    timeout-minutes: 10
+    steps:
+    - uses: actions/checkout@v5
+    - name: Setup Signing
+      env: 
+        SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
+        SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
+        HOST_PROFILE_DATA: ${{ secrets.HOST_PROFILE_DATA }}
+        AGENT_PROFILE_DATA: ${{ secrets.AGENT_PROFILE_DATA }}
+        APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
+        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+      run: ./.github/scripts/signing.sh
+    - name: Set Environment
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
+    - name: Update Build Number
+      env:
+        RUN_ID: ${{ github.run_id }}
+      run: |
+            DATE=$(date "+%Y-%m-%d")
+            sed -i '' -e "s/GITHUB_CI_VERSION/0.0.0_nightly-$DATE/g" Sources/Config/Config.xcconfig
+            sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
+            sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Config/Config.xcconfig
+    - name: Build
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
+    - name: Move to Artifact Folder
+      run: mkdir Artifact; cp -r Archive.xcarchive/Products/Applications/Secretive.app Artifact
+    - name: Upload App to Artifacts
+      id: upload
+      uses: actions/upload-artifact@v4
+      with:
+        name: Secretive
+        path: Artifact
+    - name: Download Zipped Artifact
+      id: download
+      env: 
+        ZIP_ID: ${{ steps.upload.outputs.artifact-id }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+            curl -L -H "Authorization: Bearer $GITHUB_TOKEN" -L \
+            https://api.github.com/repos/maxgoedjen/secretive/actions/artifacts/$ZIP_ID/zip > Secretive.zip
+    - name: Notarize
+      env: 
+        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
+    - name: Attest
+      id: attest
+      uses: actions/attest-build-provenance@v2
+      with:
+        subject-name: "Secretive.zip"
+        subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}

.github/workflows/release.yml

@@ -6,87 +6,93 @@ on:
       - '*'
 jobs:
   test:
-    runs-on: macos-11.0
+    permissions:
+        contents: read
+    runs-on: macos-26
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v5
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
         SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
         HOST_PROFILE_DATA: ${{ secrets.HOST_PROFILE_DATA }}
         AGENT_PROFILE_DATA: ${{ secrets.AGENT_PROFILE_DATA }}
+        APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
+        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_12.2.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
     - name: Test
-      run: xcrun xcodebuild test -project Secretive.xcodeproj -scheme Secretive
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme PackageTests test
+      # SPM doesn't seem to pick up on the tests currently?
+      # run: swift test --build-system swiftbuild --package-path Sources/Packages
   build:
-    runs-on: macos-11.0
+    permissions:
+      id-token: write
+      contents: write
+      attestations: write
+      actions: read
+    runs-on: macos-26
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
-    - name: Create Release
-      id: create_release
-      uses: actions/create-release@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        tag_name: ${{ github.ref }}
-        release_name: ${{ github.ref }}
-        body: "## Build\nhttps://github.com/maxgoedjen/secretive/actions/runs/${{ github.run_id }}"
-        draft: true
-        prerelease: false
+    - uses: actions/checkout@v5
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
         SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
         HOST_PROFILE_DATA: ${{ secrets.HOST_PROFILE_DATA }}
         AGENT_PROFILE_DATA: ${{ secrets.AGENT_PROFILE_DATA }}
+        APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
+        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_12.2.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
     - name: Update Build Number
       env:
         TAG_NAME: ${{ github.ref }}
         RUN_ID: ${{ github.run_id }}
       run: |
             export CLEAN_TAG=$(echo $TAG_NAME | sed -e 's/refs\/tags\/v//')
-            sed -i '' -e "s/GITHUB_CI_VERSION/$CLEAN_TAG/g" Config/Config.xcconfig
-            sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Config/Config.xcconfig
-            sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Secretive/Credits.rtf
+            sed -i '' -e "s/GITHUB_CI_VERSION/$CLEAN_TAG/g" Sources/Config/Config.xcconfig
+            sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
+            sed -i '' -e "s/GITHUB_BUILD_URL/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Config/Config.xcconfig
     - name: Build
-      run: xcrun xcodebuild -project Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Create ZIPs
-      run: |
-            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
-            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Archive.zip
-    - name: Notarize
-      env: 
-        APPLE_USERNAME: ${{ secrets.APPLE_USERNAME }}
-        APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-      run: xcrun altool --notarize-app --primary-bundle-id "com.maxgoedjen.secretive.host" --username $APPLE_USERNAME --password $APPLE_PASSWORD --file Secretive.zip
-    - name: Document SHAs
-      run: |
-            shasum -a 512 Secretive.zip
-            shasum -a 512 Archive.zip
-    - name: Upload App to Release
-      id: upload-release-asset 
-      uses: actions/upload-release-asset@v1.0.1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ steps.create_release.outputs.upload_url }}
-        asset_path: ./Secretive.zip
-        asset_name: Secretive.zip
-        asset_content_type: application/zip
-    - name: Upload Archive to Artifacts
-      uses: actions/upload-artifact@v1
-      with:
-        name: Archive.zip
-        path: Archive.zip
-    - name: Upload Archive to Artifacts
-      uses: actions/upload-artifact@v1
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
+    - name: Move to Artifact Folder
+      run: mkdir Artifact; cp -r Archive.xcarchive/Products/Applications/Secretive.app Artifact
+    - name: Upload App to Artifacts
+      id: upload
+      uses: actions/upload-artifact@v4
       with:
         name: Secretive.zip
-        path: Secretive.zip
+        path: Artifact
+    - name: Download Zipped Artifact
+      id: download
+      env: 
+        ZIP_ID: ${{ steps.upload.outputs.artifact-id }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+            curl -L -H "Authorization: Bearer $GITHUB_TOKEN" -L \
+            https://api.github.com/repos/maxgoedjen/secretive/actions/artifacts/$ZIP_ID/zip > Secretive.zip
+    - name: Notarize
+      env: 
+        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
+    - name: Attest
+      id: attest
+      uses: actions/attest-build-provenance@v2
+      with:
+        subject-path: "Secretive.zip"
+    - name: Create Release
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        TAG_NAME: ${{ github.ref }}
+        RUN_ID: ${{ github.run_id }}
+        ATTESTATION_ID: ${{ steps.attest.outputs.attestation-id }}
+      run: |
+            sed -i.tmp "s/RUN_ID/$RUN_ID/g" .github/templates/release.md
+            sed -i.tmp "s/ATTESTATION_ID/$ATTESTATION_ID/g" .github/templates/release.md
+            gh release create $TAG_NAME -d -F .github/templates/release.md
+            gh release upload $TAG_NAME Secretive.zip

.github/workflows/test.yml

@@ -3,11 +3,17 @@ name: Test
 on: [push, pull_request]
 jobs:
   test:
-    runs-on: macos-11.0
+    permissions:
+        contents: read
+    runs-on: macos-26
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v5
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_12.2.app
-    - name: Test
-      run: xcrun xcodebuild test -project Secretive.xcodeproj -scheme Secretive
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
+    - name: Test Main Packages
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme PackageTests test
+      # SPM doesn't seem to pick up on the tests currently?
+      # run: swift test --build-system swiftbuild --package-path Sources/Packages
+    - name: Test SecretKit Packages
+      run: swift test --build-system swiftbuild

.gitignore

@@ -92,3 +92,4 @@ iOSInjectionProject/
 # Build script products
 Archive.xcarchive
 .DS_Store
+contents.xcworkspacedata

APP_CONFIG.md

@@ -1,33 +1,3 @@
-# Setting up Third Party Apps FAQ
+# App Configuration
 
-## Tower
-
-Tower provides [instructions](https://www.git-tower.com/help/mac/integration/environment).
-
-## GitHub Desktop
-
-Should just work, no configuration needed
-
-## Fork
-
-Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
-
-```
-Host *
-	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
-```
-
-## VS Code
-
-Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
-
-```
-Host *
-	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
-```
-
-
-# The app I use isn't listed here!
-
-If you know how to get it set up, please open a PR for this page and add it! Contributions are very welcome.
-If you're not able to get it working, please file a [GitHub issue](https://github.com/maxgoedjen/secretive/issues/new) for it. No guarantees we'll be able to get it working, but chances are someone else in the community might be able to.
+Instructions for setting up apps and shells has moved to [secretive-config-instructions](https://github.com/maxgoedjen/secretive-config-instructions)!

Brief/Brief.h

@@ -1,19 +0,0 @@
-//
-//  Brief.h
-//  Brief
-//
-//  Created by Max Goedjen on 3/21/20.
-//  Copyright © 2020 Max Goedjen. All rights reserved.
-//
-
-#import <Foundation/Foundation.h>
-
-//! Project version number for Brief.
-FOUNDATION_EXPORT double BriefVersionNumber;
-
-//! Project version string for Brief.
-FOUNDATION_EXPORT const unsigned char BriefVersionString[];
-
-// In this header, you should import all the public headers of your framework using statements like #import <Brief/PublicHeader.h>
-
-

Brief/Info.plist

@@ -1,24 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>$(DEVELOPMENT_LANGUAGE)</string>
-	<key>CFBundleExecutable</key>
-	<string>$(EXECUTABLE_NAME)</string>
-	<key>CFBundleIdentifier</key>
-	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
-	<key>CFBundlePackageType</key>
-	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
-	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
-	<key>CFBundleVersion</key>
-	<string>$(CURRENT_PROJECT_VERSION)</string>
-	<key>NSHumanReadableCopyright</key>
-	<string>$(PRODUCT_NAME) is MIT Licensed.</string>
-</dict>
-</plist>

Brief/Updater.swift

@@ -1,145 +0,0 @@
-import Foundation
-import Combine
-
-public protocol UpdaterProtocol: ObservableObject {
-
-    var update: Release? { get }
-
-}
-
-public class Updater: ObservableObject, UpdaterProtocol {
-
-    @Published public var update: Release?
-
-    public init(checkOnLaunch: Bool) {
-        if checkOnLaunch {
-            // Don't do a launch check if the user hasn't seen the setup prompt explaining updater yet.
-            checkForUpdates()
-        }
-        let timer = Timer.scheduledTimer(withTimeInterval: 60*60*24, repeats: true) { _ in
-            self.checkForUpdates()
-        }
-        timer.tolerance = 60*60
-    }
-
-    public func checkForUpdates() {
-        URLSession.shared.dataTask(with: Constants.updateURL) { data, _, _ in
-            guard let data = data else { return }
-            guard let release = try? JSONDecoder().decode(Release.self, from: data) else { return }
-            self.evaluate(release: release)
-        }.resume()
-    }
-
-    public func ignore(release: Release) {
-        guard !release.critical else { return }
-        defaults.set(true, forKey: release.name)
-        DispatchQueue.main.async {
-            self.update = nil
-        }
-    }
-
-}
-
-extension Updater {
-
-    func evaluate(release: Release) {
-        guard !userIgnored(release: release) else { return }
-        guard !release.prerelease else { return }
-        let latestVersion = SemVer(release.name)
-        let currentVersion = SemVer(Bundle.main.infoDictionary!["CFBundleShortVersionString"] as! String)
-        if latestVersion > currentVersion {
-            DispatchQueue.main.async {
-                self.update = release
-            }
-        }
-    }
-
-    func userIgnored(release: Release) -> Bool {
-        guard !release.critical else { return false }
-        return defaults.bool(forKey: release.name)
-    }
-
-    var defaults: UserDefaults {
-        UserDefaults(suiteName: "com.maxgoedjen.Secretive.updater.ignorelist")!
-    }
-}
-
-struct SemVer {
-
-    let versionNumbers: [Int]
-
-    init(_ version: String) {
-        // Betas have the format 1.2.3_beta1
-        let strippedBeta = version.split(separator: "_").first!
-        var split = strippedBeta.split(separator: ".").compactMap { Int($0) }
-        while split.count < 3 {
-            split.append(0)
-        }
-        versionNumbers = split
-    }
-
-}
-
-extension SemVer: Comparable {
-
-    static func < (lhs: SemVer, rhs: SemVer) -> Bool {
-        for (latest, current) in zip(lhs.versionNumbers, rhs.versionNumbers) {
-            if latest < current {
-                return true
-            } else if latest > current {
-                return false
-            }
-        }
-        return false
-    }
-
-
-}
-
-extension Updater {
-
-    enum Constants {
-        static let updateURL = URL(string: "https://api.github.com/repos/maxgoedjen/secretive/releases/latest")!
-    }
-
-}
-
-public struct Release: Codable {
-
-    public let name: String
-    public let prerelease: Bool
-    public let html_url: URL
-    public let body: String
-
-    public init(name: String, prerelease: Bool, html_url: URL, body: String) {
-        self.name = name
-        self.prerelease = prerelease
-        self.html_url = html_url
-        self.body = body
-    }
-
-}
-
-extension Release: Identifiable {
-
-    public var id: String {
-        html_url.absoluteString
-    }
-
-}
-
-extension Release {
-
-    public var critical: Bool {
-        body.contains(Constants.securityContent)
-    }
-
-}
-
-extension Release {
-
-    enum Constants {
-        static let securityContent = "Critical Security Update"
-    }
-
-}

BriefTests/BriefTests.swift

@@ -1,36 +0,0 @@
-import XCTest
-@testable import Brief
-
-class SemVerTests: XCTestCase {
-
-    func testEqual() {
-        let current = SemVer("1.0.2")
-        let old = SemVer("1.0.2")
-        XCTAssert(!(current > old))
-    }
-
-    func testPatchGreaterButMinorLess() {
-        let current = SemVer("1.1.0")
-        let old = SemVer("1.0.2")
-        XCTAssert(current > old)
-    }
-
-    func testMajorSameMinorGreater() {
-        let current = SemVer("1.0.2")
-        let new = SemVer("1.0.3")
-        XCTAssert(current < new)
-    }
-
-    func testMajorGreaterMinorLesser() {
-        let current = SemVer("1.0.2")
-        let new = SemVer("2.0.0")
-        XCTAssert(current < new)
-    }
-
-    func testBeta() {
-        let current = SemVer("1.0.2")
-        let new = SemVer("1.1.0_beta1")
-        XCTAssert(current < new)
-    }
-
-}

BriefTests/Info.plist

@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>$(DEVELOPMENT_LANGUAGE)</string>
-	<key>CFBundleExecutable</key>
-	<string>$(EXECUTABLE_NAME)</string>
-	<key>CFBundleIdentifier</key>
-	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
-	<key>CFBundlePackageType</key>
-	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
-	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
-	<key>CFBundleVersion</key>
-	<string>1</string>
-</dict>
-</plist>

CONTRIBUTING.md

@@ -14,6 +14,18 @@ Secretive is designed to be easily auditable by people who are considering using
 
 All contributors must abide by the [Code of Conduct](CODE_OF_CONDUCT.md)
 
+## Localization
+
+If you'd like to contribute a translation, please see [Localizing](LOCALIZING.md) to get started.
+
+## Credits
+
+If you make a material contribution to the app, please add yourself to the end of the [credits](https://github.com/maxgoedjen/secretive/blob/main/Sources/Secretive/Credits.rtf).
+
+## Collaborator Status
+
+I will not grant collaborator access to any contributors for this repository. This is basically just because collaborators [can accesss the secrets Secretive uses for the signing credentials stored in the repository](https://docs.github.com/en/actions/reference/encrypted-secrets#accessing-your-secrets).
+
 ## Secretive is Opinionated
 
 I'm releasing Secretive as open source so that other people can use it and audit it, feeling comfortable in knowing that the source is available so they can see what it's doing. I have a pretty strong idea of what I'd like this project to look like, and I may respectfully decline contributions that don't line up with that vision. If you'd like to propose a change before implementing, please feel free to [Open an Issue with the proposed tag](https://github.com/maxgoedjen/secretive/issues/new?labels=proposed).

Config/Secretive.xctestplan

@@ -1,50 +0,0 @@
-{
-  "configurations" : [
-    {
-      "id" : "5896AE5A-6D5A-48D3-837B-668B646A3273",
-      "name" : "Configuration 1",
-      "options" : {
-
-      }
-    }
-  ],
-  "defaultOptions" : {
-
-  },
-  "testTargets" : [
-    {
-      "parallelizable" : true,
-      "target" : {
-        "containerPath" : "container:Secretive.xcodeproj",
-        "identifier" : "50617DAF23FCE4AB0099B055",
-        "name" : "SecretKitTests"
-      }
-    },
-    {
-      "parallelizable" : true,
-      "target" : {
-        "containerPath" : "container:Secretive.xcodeproj",
-        "identifier" : "5099A073240242BA0062B6F2",
-        "name" : "SecretAgentKitTests"
-      }
-    },
-    {
-      "enabled" : false,
-      "parallelizable" : true,
-      "target" : {
-        "containerPath" : "container:Secretive.xcodeproj",
-        "identifier" : "50617D9323FCE48E0099B055",
-        "name" : "SecretiveTests"
-      }
-    },
-    {
-      "parallelizable" : true,
-      "target" : {
-        "containerPath" : "container:Secretive.xcodeproj",
-        "identifier" : "5091D31E2519D56D0049FD9B",
-        "name" : "BriefTests"
-      }
-    }
-  ],
-  "version" : 1
-}

Design/DESIGN.md

@@ -0,0 +1,3 @@
+# Design
+
+The art assets for the App Icon and GitHub image are located on [Sketch Cloud](https://www.sketch.com/s/574333cd-8ceb-40e1-a6d9-189da3f1e5dd).

FAQ.md

@@ -6,12 +6,16 @@ The secure enclave doesn't allow import or export of private keys. For any new c
 
 ### Secretive doesn't work with my git client/app
 
-Secretive relies on the `SSH_AUTH_SOCK` environment variable being respected. The `git` and `ssh` command line tools natively respect this, but third party apps may require some configuration to work. A non-exhaustive list of setup steps is provided in the [App Config FAQ](APP_CONFIG.md).
+Secretive relies on the `SSH_AUTH_SOCK` environment variable being respected. The `git` and `ssh` command line tools natively respect this, but third party apps may require some configuration to work. A non-exhaustive list of setup steps is provided in the [secretive-config-instructions](https://github.com/maxgoedjen/secretive-config-instructions) repo.
 
 ### Secretive isn't working for me
 
 Please run `ssh -Tv git@github.com` in your terminal and paste the output in a [new GitHub issue](https://github.com/maxgoedjen/secretive/issues/new) with a description of your issue.
 
+### Secretive was working for me, but now it has stopped
+
+Try running the "Setup Secretive" process by clicking on "Help", then "Setup Secretive." If that doesn't work, follow the process above.
+
 ### Secretive prompts me to type my password instead of using my Apple Watch
 
 1) Make sure you have enabled "Use your Apple Watch to unlock apps and your Mac" in System Preferences --> Security & Privacy:
@@ -24,6 +28,18 @@ Please run `ssh -Tv git@github.com` in your terminal and paste the output in a [
 ![Apple Watch Prompt](.github/readme/apple_watch_auth_mac.png)
 ![Apple Watch Prompt](.github/readme/apple_watch_auth_watch.png)
 
+### How do I tell SSH to use a specific key?
+
+Beginning with Secretive 2.2, every secret has an automatically generated public key file representation on disk, and the path to it is listed under "Public Key Path" in Secretive. You can specify that you want to use that key in your `~/.ssh/config`.  [This ServerFault answer](https://serverfault.com/a/295771) has more details on setting that up.
+
+### How can I generate an RSA key?
+
+The Mac's Secure Enclave only supports 256-bit EC keys, so inherently Secretive cannot support generating RSA keys.
+
+### Can I use Secretive for SSH Agent Forwarding?
+
+Yes, you can! Once you've set up Secretive, just add `ForwardAgent yes` to the hosts you want to forward to in your SSH config file. Afterwards, any use of one of your SSH keys on the remote host must be authenticated through Secretive.
+
 ### Why should I trust you?
 
 You shouldn't, for a piece of software like this. Secretive, by design, has an auditable build process. Each build has a fully auditable build log, showing the source it was built from and a SHA of the build product. You can check the SHA of the zip you download against the SHA output in the build log (which is linked in the About window).
@@ -34,7 +50,11 @@ Awesome! Just bear in mind that because an app only has access to the keychain i
 
 ### What's this network request to GitHub?
 
-Secretive checks in with GitHub's releases API to check if there's a new version of Secretive available. You can audit the source code for this feature [here](https://github.com/maxgoedjen/secretive/blob/main/Brief/Updater.swift).
+Secretive checks in with GitHub's releases API to check if there's a new version of Secretive available. You can audit the source code for this feature [here](https://github.com/maxgoedjen/secretive/blob/main/Sources/Packages/Sources/Brief/Updater.swift).
+
+### How do I uninstall Secretive?
+
+Drag Secretive.app to the trash and remove `~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent`. `SecretAgent` may continue running until you quit it or reboot.
 
 ### I have a security issue
 

LOCALIZING.md

@@ -0,0 +1,36 @@
+# Localizing Secretive
+
+If you speak another language, and would like to help translate Secretive to support that language, we'd love your help!
+
+## Crowdin
+
+[Secretive uses Crowdin for localization](https://crowdin.com/project/secretive/). Open the link and select your language to translate!
+
+### Manual Translation
+
+Crowdin is the easiest way to translate Secretive, but I'm happy to accept Pull Requests directly as well.
+
+### Questions
+
+Please open an issue if you have a question about translating the app. I'm more than happy to clarify any terms that are ambiguous or confusing. Thanks for contributing!
+
+### Thank You
+
+Thanks to all the folks who have contributed localizations so far!
+
+- @mtardy for the French localization
+- @GravityRyu for the Chinese localization
+- @Saeger for the Portuguese (Brazil) localization
+- @moritzsternemann for the German localization
+- @RoboRich00A16 for the Italian localization
+- @akx for the Finnish localization
+- @mog422 for the Korean localization
+- @niw for the Japanese localization
+- @truita for the Catalan localization
+- @Adimac93 for the Polish localization
+- @alongotv for the Russian localization
+
+
+
+
+A special thanks to [Crowdin](https://crowdin.com) for their [generous support of open source projects](https://crowdin.com/page/open-source-project-setup-request).

Package.swift

@@ -0,0 +1,69 @@
+// swift-tools-version:6.2
+// The swift-tools-version declares the minimum version of Swift required to build this package.
+
+import PackageDescription
+
+// This is basically the same package as `Sources/Packages/Package.swift`, but thinned slightly.
+// Ideally this would be the same package, but SPM requires it to be at the root of the project,
+// and Xcode does _not_ like that, so they're separate.
+let package = Package(
+    name: "SecretKit",
+    defaultLocalization: "en",
+    platforms: [
+        .macOS(.v14)
+    ],
+    products: [
+        .library(
+            name: "SecretKit",
+            targets: ["SecretKit"]),
+        .library(
+            name: "SecureEnclaveSecretKit",
+            targets: ["SecureEnclaveSecretKit"]),
+        .library(
+            name: "SmartCardSecretKit",
+            targets: ["SmartCardSecretKit"]),
+    ],
+    dependencies: [
+    ],
+    targets: [
+        .target(
+            name: "SecretKit",
+            dependencies: [],
+            path: "Sources/Packages/Sources/SecretKit",
+            resources: [localization],
+            swiftSettings: swiftSettings
+        ),
+        .testTarget(
+            name: "SecretKitTests",
+            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
+            path: "Sources/Packages/Tests/SecretKitTests",
+            swiftSettings: swiftSettings
+        ),
+        .target(
+            name: "SecureEnclaveSecretKit",
+            dependencies: ["SecretKit"],
+            path: "Sources/Packages/Sources/SecureEnclaveSecretKit",
+            resources: [localization],
+            swiftSettings: swiftSettings
+        ),
+        .target(
+            name: "SmartCardSecretKit",
+            dependencies: ["SecretKit"],
+            path: "Sources/Packages/Sources/SmartCardSecretKit",
+            resources: [localization],
+            swiftSettings: swiftSettings
+        ),
+    ]
+)
+
+var localization: Resource {
+    .process("../../Resources/Localizable.xcstrings")
+}
+
+var swiftSettings: [PackageDescription.SwiftSetting] {
+    [
+        .swiftLanguageMode(.v6),
+        // This freaks out Xcode in a dependency context.
+        // .treatAllWarnings(as: .error),
+    ]
+}

README.md

@@ -1,28 +1,31 @@
-# Secretive ![Test](https://github.com/maxgoedjen/secretive/workflows/Test/badge.svg) ![Release](https://github.com/maxgoedjen/secretive/workflows/Release/badge.svg)
+# Secretive [![Test](https://github.com/maxgoedjen/secretive/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/maxgoedjen/secretive/actions/workflows/test.yml) ![Release](https://github.com/maxgoedjen/secretive/workflows/Release/badge.svg)
 
 
-Secretive is an app for storing and managing SSH keys in the Secure Enclave. It is inspired by the [sekey project](https://github.com/sekey/sekey), but rewritten in Swift with no external dependencies and with a handy native management app.
-
-<img src="/.github/readme/app.png" alt="Screenshot of Secretive" width="600">
+Secretive is an app for protecting and managing SSH keys with the Secure Enclave.
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="/.github/readme/app-dark.png">
+  <source media="(prefers-color-scheme: light)" srcset="/.github/readme/app-light.png">
+  <img src="/.github/readme/app-dark.png" alt="Screenshot of Secretive" width="600">
+</picture>
 
 
 ## Why?
 
 ### Safer Storage
 
-The most common setup for SSH keys is just keeping them on disk, guarded by proper permissions. This is fine in most cases, but it's not super hard for malicious users or malware to copy your private key. If you store your keys in the Secure Enclave, it's impossible to export them, by design.
+The most common setup for SSH keys is just keeping them on disk, guarded by proper permissions. This is fine in most cases, but it's not super hard for malicious users or malware to copy your private key. If you protect your keys with the Secure Enclave, it's impossible to export them, by design.
 
 ### Access Control
 
-If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed.
+If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your keys so that they require Touch ID (or Watch) authentication before they're accessed.
 
-<img src="/.github/readme/touchid.png" alt="Screenshot of Secretive authenticating with Touch ID">
+<img src="/.github/readme/touchid.png" alt="Screenshot of Secretive authenticating with Touch ID" width="400">
 
 ### Notifications
 
 Secretive also notifies you whenever your keys are accessed, so you're never caught off guard.
 
-<img src="/.github/readme/notification.png" alt="Screenshot of Secretive notifying the user">
+<img src="/.github/readme/notification.png" alt="Screenshot of Secretive notifying the user" width="600">
 
 ### Support for Smart Cards Too!
 
@@ -38,7 +41,7 @@ You can download the latest release over on the [Releases Page](https://github.c
 
 #### Using Homebrew
 
-    brew cask install secretive
+    brew install secretive
 
 ### FAQ
 
@@ -46,11 +49,11 @@ There's a [FAQ here](FAQ.md).
 
 ### Auditable Build Process
 
-Builds are produced by GitHub Actions with an auditable build and release generation process. Each build has a "Document SHAs" step, which will output SHA checksums for the build produced by the GitHub Action, so you can verify that the source code for a given build corresponds to any given release.
+Builds are produced by GitHub Actions with an auditable build and release generation process. Starting with Secretive 3.0, builds are attested using [GitHub Artifact Attestation](https://docs.github.com/en/actions/concepts/security/artifact-attestations). Attestations are viewable in the build log for a build, and also on the [main attestation page](https://github.com/maxgoedjen/secretive/attestations).
 
 ### A Note Around Code Signing and Keychains
 
-While Secretive uses the Secure Enclave for key storage, it still relies on Keychain APIs to access them. Keychain restricts reads of keys to the app (and specifically, the bundle ID) that created them. If you build Secretive from source, make sure you are consistent in which bundle ID you use so that the Keychain is able to locate your keys.
+While Secretive uses the Secure Enclave to protect keys, it still relies on Keychain APIs to store and access them. Keychain restricts reads of keys to the app (and specifically, the bundle ID) that created them. If you build Secretive from source, make sure you are consistent in which bundle ID you use so that the Keychain is able to locate your keys.
 
 ### Backups and Transfers to New Machines
 
@@ -58,4 +61,12 @@ Because secrets in the Secure Enclave are not exportable, they are not able to b
 
 ## Security
 
-If you discover any vulnerabilities in this project, please notify [max.goedjen@gmail.com](mailto:max.goedjen@gmail.com) with the subject containing "SECRETIVE SECURITY."
+Secretive's security policy is detailed in [SECURITY.md](SECURITY.md). To report security issues, please use [GitHub's private reporting feature.](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability)
+
+## Acknowledgements
+
+### sekey
+Secretive was inspired by the [sekey project](https://github.com/sekey/sekey).
+
+### Localization
+Secretive is localized to many languages by a generous team of volunteers. To learn more, see [LOCALIZING.md](LOCALIZING.md). Secretive's localization workflow is generously provided by [Crowdin](https://crowdin.com).

SECURITY.md

@@ -1,9 +1,27 @@
 # Security Policy
 
+## Security Principles
+
+Secretive is designed with a few general tenets in mind:
+
+### It's Hard to Leak a Key Secretive Can't Read The Key Material
+
+Secretive only operates on hardware-backed keys. In general terms, this means that it should be _very_ hard for Secretive to have any sort of bug that causes a key to be shared, because Secretive can't access private key data even if it wants to.
+
+### Simplicity and Auditability
+
+Secretive won't expand to have every feature it could possibly have. Part of the goal of the app is that it is possible for consumers to reasonably audit the code, and that often means not implementing features that might be cool, but which would significantly inflate the size of the codebase.
+
+### Dependencies
+
+Both in support of the previous principle and to rule out supply chain attacks, Secretive does not rely on any third party dependencies. 
+
+There are limited exceptions to this, particularly in the build process, but the app itself does not depend on any third party code.
+
 ## Supported Versions
 
 The latest version on the [Releases page](https://github.com/maxgoedjen/secretive/releases) is the only currently supported version.
 
 ## Reporting a Vulnerability
 
-If you discover any vulnerabilities in this project, please notify max.goedjen@gmail.com with the subject containing "SECRETIVE SECURITY."
+To report security issues, please use [GitHub's private reporting feature.](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability)

SecretAgent/AppDelegate.swift

@@ -1,42 +0,0 @@
-import Cocoa
-import OSLog
-import Combine
-import SecretKit
-import SecretAgentKit
-import Brief
-
-@NSApplicationMain
-class AppDelegate: NSObject, NSApplicationDelegate {
-
-    private let storeList: SecretStoreList = {
-        let list = SecretStoreList()
-        list.add(store: SecureEnclave.Store())
-        list.add(store: SmartCard.Store())
-        return list
-    }()
-    private let updater = Updater(checkOnLaunch: false)
-    private let notifier = Notifier()
-    private lazy var agent: Agent = {
-        Agent(storeList: storeList, witness: notifier)
-    }()
-    private lazy var socketController: SocketController = {
-        let path = (NSHomeDirectory() as NSString).appendingPathComponent("socket.ssh") as String
-        return SocketController(path: path)
-    }()
-    private var updateSink: AnyCancellable?
-
-    func applicationDidFinishLaunching(_ aNotification: Notification) {
-        Logger().debug("SecretAgent finished launching")
-        DispatchQueue.main.async {
-            self.socketController.handler = self.agent.handle(reader:writer:)
-        }
-        notifier.prompt()
-        updateSink = updater.$update.sink { update in
-            guard let update = update else { return }
-            self.notifier.notify(update: update, ignore: self.updater.ignore(release:))
-        }
-    }
-
-
-}
-

SecretAgent/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -1,60 +0,0 @@
-{
-  "images" : [
-    {
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "16x16"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "16x16"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "32x32"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "32x32"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "128x128"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "128x128"
-    },
-    {
-      "filename" : "Mac Icon.png",
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "256x256"
-    },
-    {
-      "filename" : "Mac Icon@0.25x.png",
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "256x256"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "512x512"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "512x512"
-    }
-  ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  }
-}

SecretAgent/Notifier.swift

@@ -1,105 +0,0 @@
-import Foundation
-import UserNotifications
-import AppKit
-import SecretKit
-import SecretAgentKit
-import Brief
-
-class Notifier {
-
-    private let notificationDelegate = NotificationDelegate()
-
-    init() {
-        let updateAction = UNNotificationAction(identifier: Constants.updateActionIdentitifier, title: "Update", options: [])
-        let ignoreAction = UNNotificationAction(identifier: Constants.ignoreActionIdentitifier, title: "Ignore", options: [])
-        let updateCategory = UNNotificationCategory(identifier: Constants.updateCategoryIdentitifier, actions: [updateAction, ignoreAction], intentIdentifiers: [], options: [])
-        let criticalUpdateCategory = UNNotificationCategory(identifier: Constants.criticalUpdateCategoryIdentitifier, actions: [updateAction], intentIdentifiers: [], options: [])
-        UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory])
-        UNUserNotificationCenter.current().delegate = notificationDelegate
-    }
-
-    func prompt() {
-        let notificationCenter = UNUserNotificationCenter.current()
-        notificationCenter.requestAuthorization(options: .alert) { _, _ in }
-    }
-
-    func notify(accessTo secret: AnySecret, by provenance: SigningRequestProvenance) {
-        let notificationCenter = UNUserNotificationCenter.current()
-        let notificationContent = UNMutableNotificationContent()
-        notificationContent.title = "Signed Request from \(provenance.origin.displayName)"
-        notificationContent.subtitle = "Using secret \"\(secret.name)\""
-        if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) {
-            notificationContent.attachments = [attachment]
-        }
-        let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
-        notificationCenter.add(request, withCompletionHandler: nil)
-    }
-
-    func notify(update: Release, ignore: ((Release) -> Void)?) {
-        notificationDelegate.release = update
-        notificationDelegate.ignore = ignore
-        let notificationCenter = UNUserNotificationCenter.current()
-        let notificationContent = UNMutableNotificationContent()
-        if update.critical {
-            notificationContent.title = "Critical Security Update - \(update.name)"
-        } else {
-            notificationContent.title = "Update Available - \(update.name)"
-        }
-        notificationContent.subtitle = "Click to Update"
-        notificationContent.body = update.body
-        notificationContent.categoryIdentifier = update.critical ? Constants.criticalUpdateCategoryIdentitifier : Constants.updateCategoryIdentitifier
-        let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
-        notificationCenter.add(request, withCompletionHandler: nil)
-    }
-
-}
-
-extension Notifier: SigningWitness {
-
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, by provenance: SigningRequestProvenance) throws {
-    }
-
-    func witness(accessTo secret: AnySecret, by provenance: SigningRequestProvenance) throws {
-        notify(accessTo: secret, by: provenance)
-    }
-
-}
-
-extension Notifier {
-
-    enum Constants {
-        static let updateCategoryIdentitifier  = "com.maxgoedjen.Secretive.SecretAgent.update"
-        static let criticalUpdateCategoryIdentitifier  = "com.maxgoedjen.Secretive.SecretAgent.update.critical"
-        static let updateActionIdentitifier  = "com.maxgoedjen.Secretive.SecretAgent.update.updateaction"
-        static let ignoreActionIdentitifier  = "com.maxgoedjen.Secretive.SecretAgent.update.ignoreaction"
-    }
-
-}
-
-class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate {
-
-    fileprivate var release: Release?
-    fileprivate var ignore: ((Release) -> Void)?
-
-    func userNotificationCenter(_ center: UNUserNotificationCenter, openSettingsFor notification: UNNotification?) {
-
-    }
-
-    func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) {
-        guard let update = release else { return }
-        switch response.actionIdentifier {
-        case Notifier.Constants.updateActionIdentitifier, UNNotificationDefaultActionIdentifier:
-            NSWorkspace.shared.open(update.html_url)
-        case Notifier.Constants.ignoreActionIdentitifier:
-            ignore?(update)
-        default:
-            fatalError()
-        }
-        completionHandler()
-    }
-
-    func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) {
-        completionHandler([.list, .banner])
-    }
-
-}

SecretAgent/Preview Content/Preview Assets.xcassets/Contents.json

@@ -1,6 +0,0 @@
-{
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  }
-}

SecretAgentKit/Agent.swift

@@ -1,181 +0,0 @@
-import Foundation
-import CryptoKit
-import OSLog
-import SecretKit
-import AppKit
-
-public class Agent {
-
-    private let storeList: SecretStoreList
-    private let witness: SigningWitness?
-    private let writer = OpenSSHKeyWriter()
-    private let requestTracer = SigningRequestTracer()
-
-    public init(storeList: SecretStoreList, witness: SigningWitness? = nil) {
-        Logger().debug("Agent is running")
-        self.storeList = storeList
-        self.witness = witness
-    }
-    
-}
-
-extension Agent {
-
-    public func handle(reader: FileHandleReader, writer: FileHandleWriter) {
-        Logger().debug("Agent handling new data")
-        let data = reader.availableData
-        guard !data.isEmpty else { return }
-        let requestTypeInt = data[4]
-        guard let requestType = SSHAgent.RequestType(rawValue: requestTypeInt) else {
-            writer.write(OpenSSHKeyWriter().lengthAndData(of: SSHAgent.ResponseType.agentFailure.data))
-            Logger().debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
-            return
-        }
-        Logger().debug("Agent handling request of type \(requestType.debugDescription)")
-        let subData = Data(data[5...])
-        let response = handle(requestType: requestType, data: subData, reader: reader)
-        writer.write(response)
-    }
-
-    func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) -> Data {
-        var response = Data()
-        do {
-            switch requestType {
-            case .requestIdentities:
-                response.append(SSHAgent.ResponseType.agentIdentitiesAnswer.data)
-                response.append(identities())
-                Logger().debug("Agent returned \(SSHAgent.ResponseType.agentIdentitiesAnswer.debugDescription)")
-            case .signRequest:
-                let provenance = requestTracer.provenance(from: reader)
-                response.append(SSHAgent.ResponseType.agentSignResponse.data)
-                response.append(try sign(data: data, provenance: provenance))
-                Logger().debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)")
-            }
-        } catch {
-            response.removeAll()
-            response.append(SSHAgent.ResponseType.agentFailure.data)
-            Logger().debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
-        }
-        let full = OpenSSHKeyWriter().lengthAndData(of: response)
-        return full
-    }
-
-}
-
-extension Agent {
-
-    func identities() -> Data {
-        let secrets = storeList.stores.flatMap(\.secrets)
-        var count = UInt32(secrets.count).bigEndian
-        let countData = Data(bytes: &count, count: UInt32.bitWidth/8)
-        var keyData = Data()
-        let writer = OpenSSHKeyWriter()
-        for secret in secrets {
-            let keyBlob = writer.data(secret: secret)
-            keyData.append(writer.lengthAndData(of: keyBlob))
-            let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
-            keyData.append(writer.lengthAndData(of: curveData))
-        }
-        Logger().debug("Agent enumerated \(secrets.count) identities")
-        return countData + keyData
-    }
-
-    func sign(data: Data, provenance: SigningRequestProvenance) throws -> Data {
-        let reader = OpenSSHReader(data: data)
-        let hash = reader.readNextChunk()
-        guard let (store, secret) = secret(matching: hash) else {
-            Logger().debug("Agent did not have a key matching \(hash as NSData)")
-            throw AgentError.noMatchingKey
-        }
-
-        if let witness = witness {
-            try witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, by: provenance)
-        }
-
-        let dataToSign = reader.readNextChunk()
-        let derSignature = try store.sign(data: dataToSign, with: secret, for: provenance)
-
-        let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
-
-        // Convert from DER formatted rep to raw (r||s)
-
-        let rawRepresentation: Data
-        switch (secret.algorithm, secret.keySize) {
-        case (.ellipticCurve, 256):
-            rawRepresentation = try CryptoKit.P256.Signing.ECDSASignature(derRepresentation: derSignature).rawRepresentation
-        case (.ellipticCurve, 384):
-            rawRepresentation = try CryptoKit.P384.Signing.ECDSASignature(derRepresentation: derSignature).rawRepresentation
-        default:
-            throw AgentError.unsupportedKeyType
-        }
-
-
-        let rawLength = rawRepresentation.count/2
-        // Check if we need to pad with 0x00 to prevent certain
-        // ssh servers from thinking r or s is negative
-        let paddingRange: ClosedRange<UInt8> = 0x80...0xFF
-        var r = Data(rawRepresentation[0..<rawLength])
-        if paddingRange ~= r.first! {
-            r.insert(0x00, at: 0)
-        }
-        var s = Data(rawRepresentation[rawLength...])
-        if paddingRange ~= s.first! {
-            s.insert(0x00, at: 0)
-        }
-
-        var signatureChunk = Data()
-        signatureChunk.append(writer.lengthAndData(of: r))
-        signatureChunk.append(writer.lengthAndData(of: s))
-
-        var signedData = Data()
-        var sub = Data()
-        sub.append(writer.lengthAndData(of: curveData))
-        sub.append(writer.lengthAndData(of: signatureChunk))
-        signedData.append(writer.lengthAndData(of: sub))
-
-        if let witness = witness {
-            try witness.witness(accessTo: secret, by: provenance)
-        }
-
-        Logger().debug("Agent signed request")
-
-        return signedData
-    }
-
-}
-
-extension Agent {
-
-    func secret(matching hash: Data) -> (AnySecretStore, AnySecret)? {
-        storeList.stores.compactMap { store -> (AnySecretStore, AnySecret)? in
-            let allMatching = store.secrets.filter { secret in
-                hash == writer.data(secret: secret)
-            }
-            if let matching = allMatching.first {
-                return (store, matching)
-            }
-            return nil
-        }.first
-    }
-
-}
-
-
-extension Agent {
-
-    enum AgentError: Error {
-        case unhandledType
-        case noMatchingKey
-        case unsupportedKeyType
-    }
-
-}
-
-extension SSHAgent.ResponseType {
-
-    var data: Data {
-        var raw = self.rawValue
-        return  Data(bytes: &raw, count: UInt8.bitWidth/8)
-    }
-
-}

SecretAgentKit/FileHandleProtocols.swift

@@ -1,26 +0,0 @@
-import Foundation
-
-public protocol FileHandleReader {
-
-    var availableData: Data { get }
-    var fileDescriptor: Int32 { get }
-    var pidOfConnectedProcess: Int32 { get }
-
-}
-
-public protocol FileHandleWriter {
-
-    func write(_ data: Data)
-
-}
-
-extension FileHandle: FileHandleReader, FileHandleWriter {
-
-    public var pidOfConnectedProcess: Int32 {
-        let pidPointer = UnsafeMutableRawPointer.allocate(byteCount: 4, alignment: 1)
-        var len = socklen_t(MemoryLayout<Int32>.size)
-        getsockopt(fileDescriptor, SOCK_STREAM, LOCAL_PEERPID, pidPointer, &len)
-        return pidPointer.load(as: Int32.self)
-    }
-
-}

SecretAgentKit/Info.plist

@@ -1,24 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>$(DEVELOPMENT_LANGUAGE)</string>
-	<key>CFBundleExecutable</key>
-	<string>$(EXECUTABLE_NAME)</string>
-	<key>CFBundleIdentifier</key>
-	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
-	<key>CFBundlePackageType</key>
-	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
-	<key>CFBundleShortVersionString</key>
-	<string>$(CI_VERSION)</string>
-	<key>CFBundleVersion</key>
-	<string>$(CURRENT_PROJECT_VERSION)</string>
-	<key>NSHumanReadableCopyright</key>
-	<string>$(PRODUCT_NAME) is MIT Licensed.</string>
-</dict>
-</plist>

SecretAgentKit/SSHAgentProtocol.swift

@@ -1,38 +0,0 @@
-import Foundation
-
-public enum SSHAgent {}
-
-extension SSHAgent {
-
-    public enum RequestType: UInt8, CustomDebugStringConvertible {
-        case requestIdentities = 11
-        case signRequest = 13
-
-        public var debugDescription: String {
-            switch self {
-            case .requestIdentities:
-                return "RequestIdentities"
-            case .signRequest:
-                return "SignRequest"
-            }
-        }
-    }
-
-    public enum ResponseType: UInt8, CustomDebugStringConvertible {
-        case agentFailure = 5
-        case agentIdentitiesAnswer = 12
-        case agentSignResponse = 14
-
-        public var debugDescription: String {
-            switch self {
-            case .agentFailure:
-                return "AgentFailure"
-            case .agentIdentitiesAnswer:
-                return "AgentIdentitiesAnswer"
-            case .agentSignResponse:
-                return "AgentSignResponse"
-            }
-        }
-    }
-    
-}

SecretAgentKit/SecretAgentKit.h

@@ -1,19 +0,0 @@
-#import <Foundation/Foundation.h>
-#import <Security/Security.h>
-
-
-// Forward declarations
-
-// from libproc.h
-int proc_pidpath(int pid, void * buffer, uint32_t  buffersize);
-
-// from SecTask.h
-OSStatus SecCodeCreateWithPID(int32_t, SecCSFlags, SecCodeRef *);
-
-//! Project version number for SecretAgentKit.
-FOUNDATION_EXPORT double SecretAgentKitVersionNumber;
-
-//! Project version string for SecretAgentKit.
-FOUNDATION_EXPORT const unsigned char SecretAgentKitVersionString[];
-
-

SecretAgentKit/SigningRequestTracer.swift

@@ -1,60 +0,0 @@
-import Foundation
-import AppKit
-import Security
-import SecretKit
-
-struct SigningRequestTracer {
-}
-
-extension SigningRequestTracer {
-
-    func provenance(from fileHandleReader: FileHandleReader) -> SigningRequestProvenance {
-        let firstInfo = process(from: fileHandleReader.pidOfConnectedProcess)
-
-        var provenance = SigningRequestProvenance(root: firstInfo)
-        while NSRunningApplication(processIdentifier: provenance.origin.pid) == nil && provenance.origin.parentPID != nil {
-            provenance.chain.append(process(from: provenance.origin.parentPID!))
-        }
-        return provenance
-    }
-
-    func pidAndNameInfo(from pid: Int32) -> kinfo_proc {
-        var len = MemoryLayout<kinfo_proc>.size
-        let infoPointer = UnsafeMutableRawPointer.allocate(byteCount: len, alignment: 1)
-        var name: [Int32] = [CTL_KERN, KERN_PROC, KERN_PROC_PID, pid]
-        sysctl(&name, UInt32(name.count), infoPointer, &len, nil, 0)
-        return infoPointer.load(as: kinfo_proc.self)
-    }
-
-    func process(from pid: Int32) -> SigningRequestProvenance.Process {
-        var pidAndNameInfo = self.pidAndNameInfo(from: pid)
-        let ppid = pidAndNameInfo.kp_eproc.e_ppid != 0 ? pidAndNameInfo.kp_eproc.e_ppid : nil
-        let procName = String(cString: &pidAndNameInfo.kp_proc.p_comm.0)
-        let pathPointer = UnsafeMutablePointer<UInt8>.allocate(capacity: Int(MAXPATHLEN))
-        _ = proc_pidpath(pid, pathPointer, UInt32(MAXPATHLEN))
-        let path = String(cString: pathPointer)
-        var secCode: Unmanaged<SecCode>!
-        let flags: SecCSFlags = [.considerExpiration, .enforceRevocationChecks]
-        SecCodeCreateWithPID(pid, SecCSFlags(), &secCode)
-        let valid = SecCodeCheckValidity(secCode.takeRetainedValue(), flags, nil) == errSecSuccess
-        return SigningRequestProvenance.Process(pid: pid, processName: procName, appName: appName(for: pid), iconURL: iconURL(for: pid), path: path, validSignature: valid, parentPID: ppid)
-    }
-
-    func iconURL(for pid: Int32) -> URL? {
-        do {
-            if let app = NSRunningApplication(processIdentifier: pid), let icon = app.icon?.tiffRepresentation {
-                let temporaryURL = URL(fileURLWithPath: (NSTemporaryDirectory() as NSString).appendingPathComponent("\(UUID().uuidString).png"))
-                let bitmap = NSBitmapImageRep(data: icon)
-                try bitmap?.representation(using: .png, properties: [:])?.write(to: temporaryURL)
-                return temporaryURL
-            }
-        } catch {
-        }
-        return nil
-    }
-
-    func appName(for pid: Int32) -> String? {
-        NSRunningApplication(processIdentifier: pid)?.localizedName
-    }
-
-}

SecretAgentKit/SigningWitness.swift

@@ -1,9 +0,0 @@
-import Foundation
-import SecretKit
-
-public protocol SigningWitness {
-
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, by provenance: SigningRequestProvenance) throws
-    func witness(accessTo secret: AnySecret, by provenance: SigningRequestProvenance) throws
-
-}

SecretAgentKit/SocketController.swift

@@ -1,67 +0,0 @@
-import Foundation
-import OSLog
-
-public class SocketController {
-
-    private var fileHandle: FileHandle?
-    private var port: SocketPort?
-    public var handler: ((FileHandleReader, FileHandleWriter) -> Void)?
-
-    public init(path: String) {
-        Logger().debug("Socket controller setting up at \(path)")
-        if let _ = try? FileManager.default.removeItem(atPath: path) {
-            Logger().debug("Socket controller removed existing socket")
-        }
-        let exists = FileManager.default.fileExists(atPath: path)
-        assert(!exists)
-        Logger().debug("Socket controller path is clear")
-        port = socketPort(at: path)
-        configureSocket(at: path)
-        Logger().debug("Socket listening at \(path)")
-    }
-
-    func configureSocket(at path: String) {
-        guard let port = port else { return }
-        fileHandle = FileHandle(fileDescriptor: port.socket, closeOnDealloc: true)
-        NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionAccept(notification:)), name: .NSFileHandleConnectionAccepted, object: nil)
-        NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionDataAvailable(notification:)), name: .NSFileHandleDataAvailable, object: nil)
-        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
-    }
-
-    func socketPort(at path: String) -> SocketPort {
-        var addr = sockaddr_un()
-        addr.sun_family = sa_family_t(AF_UNIX)
-
-        var len: Int = 0
-        withUnsafeMutablePointer(to: &addr.sun_path.0) { pointer in
-            path.withCString { cstring in
-                len = strlen(cstring)
-                strncpy(pointer, cstring, len)
-            }
-        }
-        addr.sun_len = UInt8(len+2)
-
-        var data: Data!
-        withUnsafePointer(to: &addr) { pointer in
-            data = Data(bytes: pointer, count: MemoryLayout<sockaddr_un>.size)
-        }
-
-        return SocketPort(protocolFamily: AF_UNIX, socketType: SOCK_STREAM, protocol: 0, address: data)!
-    }
-
-    @objc func handleConnectionAccept(notification: Notification) {
-        Logger().debug("Socket controller accepted connection")
-        guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { return }
-        handler?(new, new)
-        new.waitForDataInBackgroundAndNotify()
-        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
-    }
-
-    @objc func handleConnectionDataAvailable(notification: Notification) {
-        Logger().debug("Socket controller has new data available")
-        guard let new = notification.object as? FileHandle else { return }
-        Logger().debug("Socket controller received new file handle")
-        handler?(new, new)
-    }
-
-}

SecretAgentKitTests/AgentTests.swift

@@ -1,169 +0,0 @@
-import Foundation
-import XCTest
-import CryptoKit
-@testable import SecretKit
-@testable import SecretAgentKit
-
-class AgentTests: XCTestCase {
-
-    let stubWriter = StubFileHandleWriter()
-
-    // MARK: Identity Listing
-
-    func testEmptyStores() {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
-        let agent = Agent(storeList: SecretStoreList())
-        agent.handle(reader: stubReader, writer: stubWriter)
-        XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesEmpty)
-    }
-
-    func testIdentitiesList() {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
-        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let agent = Agent(storeList: list)
-        agent.handle(reader: stubReader, writer: stubWriter)
-        XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesMultiple)
-    }
-
-    // MARK: Signatures
-
-    func testNoMatchingIdentities() {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignatureWithNoneMatching)
-        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let agent = Agent(storeList: list)
-        agent.handle(reader: stubReader, writer: stubWriter)
-//        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
-    }
-
-    func testSignature() {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
-        let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...])
-        _ = requestReader.readNextChunk()
-        let dataToSign = requestReader.readNextChunk()
-        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let agent = Agent(storeList: list)
-        agent.handle(reader: stubReader, writer: stubWriter)
-        let outer = OpenSSHReader(data: stubWriter.data[5...])
-        let payload = outer.readNextChunk()
-        let inner = OpenSSHReader(data: payload)
-        _ = inner.readNextChunk()
-        let signedData = inner.readNextChunk()
-        let rsData = OpenSSHReader(data: signedData)
-        var r = rsData.readNextChunk()
-        var s = rsData.readNextChunk()
-        // This is fine IRL, but it freaks out CryptoKit
-        if r[0] == 0 {
-            r.removeFirst()
-        }
-        if s[0] == 0 {
-            s.removeFirst()
-        }
-        var rs = r
-        rs.append(s)
-        let signature = try! P256.Signing.ECDSASignature(rawRepresentation: rs)
-        let valid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
-        XCTAssertTrue(valid)
-    }
-
-    // MARK: Witness protocol
-
-    func testWitnessObjectionStopsRequest() {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
-        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
-        let witness = StubWitness(speakNow: { _,_  in
-            return true
-        }, witness: { _, _ in })
-        let agent = Agent(storeList: list, witness: witness)
-        agent.handle(reader: stubReader, writer: stubWriter)
-        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
-    }
-
-    func testWitnessSignature() {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
-        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
-        var witnessed = false
-        let witness = StubWitness(speakNow: { _, trace  in
-            return false
-        }, witness: { _, trace in
-            witnessed = true
-        })
-        let agent = Agent(storeList: list, witness: witness)
-        agent.handle(reader: stubReader, writer: stubWriter)
-        XCTAssertTrue(witnessed)
-    }
-
-    func testRequestTracing() {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
-        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
-        var speakNowTrace: SigningRequestProvenance! = nil
-        var witnessTrace: SigningRequestProvenance! = nil
-        let witness = StubWitness(speakNow: { _, trace  in
-            speakNowTrace = trace
-            return false
-        }, witness: { _, trace in
-            witnessTrace = trace
-        })
-        let agent = Agent(storeList: list, witness: witness)
-        agent.handle(reader: stubReader, writer: stubWriter)
-        XCTAssertEqual(witnessTrace, speakNowTrace)
-        XCTAssertEqual(witnessTrace.origin.displayName, "Finder")
-        XCTAssertEqual(witnessTrace.origin.validSignature, true)
-        XCTAssertEqual(witnessTrace.origin.parentPID, 1)
-    }
-
-    // MARK: Exception Handling
-
-    func testSignatureException() {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
-        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let store = list.stores.first?.base as! Stub.Store
-        store.shouldThrow = true
-        let agent = Agent(storeList: list)
-        agent.handle(reader: stubReader, writer: stubWriter)
-        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
-    }
-
-    // MARK: Unsupported
-
-    func testUnhandledAdd() {
-        let stubReader = StubFileHandleReader(availableData: Constants.Requests.addIdentity)
-        let agent = Agent(storeList: SecretStoreList())
-        agent.handle(reader: stubReader, writer: stubWriter)
-        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
-    }
-
-}
-
-extension AgentTests {
-
-    func storeList(with secrets: [Stub.Secret]) -> SecretStoreList {
-        let store = Stub.Store()
-        store.secrets.append(contentsOf: secrets)
-        let storeList = SecretStoreList()
-        storeList.add(store: store)
-        return storeList
-    }
-
-    enum Constants {
-
-        enum Requests {
-            static let requestIdentities = Data(base64Encoded: "AAAAAQs=")!
-            static let addIdentity = Data(base64Encoded: "AAAAARE=")!
-            static let requestSignatureWithNoneMatching = Data(base64Encoded: "AAABhA0AAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQAAAO8AAAAgbqmrqPUtJ8mmrtaSVexjMYyXWNqjHSnoto7zgv86xvcyAAAAA2dpdAAAAA5zc2gtY29ubmVjdGlvbgAAAAlwdWJsaWNrZXkBAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQAAAAA=")!
-            static let requestSignature = Data(base64Encoded: "AAABRA0AAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKzOkUiVJEcACMtAd9X7xalbc0FYZyhbmv2dsWl4IP2GWIi+RcsaHQNw+nAIQ8CKEYmLnl0VLDp5Ef8KMhgIy08AAADPAAAAIBIFsbCZ4/dhBmLNGHm0GKj7EJ4N8k/jXRxlyg+LFIYzMgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAAA==")!
-        }
-
-        enum Responses {
-            static let requestIdentitiesEmpty = Data(base64Encoded: "AAAABQwAAAAA")!
-            static let requestIdentitiesMultiple = Data(base64Encoded: "AAABKwwAAAACAAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBLKSzA5q3jCb3q0JKigvcxfWVGrJ+bklpG0Zc9YzUwrbsh9SipvlSJi+sHQI+O0m88DOpRBAtuAHX60euD/Yv250tovN7/+MEFbXGZ/hLdd0BoFpWbLfJcQj806KJGlcDAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0")!
-            static let requestFailure = Data(base64Encoded: "AAAAAQU=")!
-        }
-
-        enum Secrets {
-            static let ecdsa256Secret =  Stub.Secret(keySize: 256, publicKey: Data(base64Encoded: "BKzOkUiVJEcACMtAd9X7xalbc0FYZyhbmv2dsWl4IP2GWIi+RcsaHQNw+nAIQ8CKEYmLnl0VLDp5Ef8KMhgIy08=")!, privateKey: Data(base64Encoded: "BKzOkUiVJEcACMtAd9X7xalbc0FYZyhbmv2dsWl4IP2GWIi+RcsaHQNw+nAIQ8CKEYmLnl0VLDp5Ef8KMhgIy09nw780wy/TSfUmzj15iJkV234AaCLNl+H8qFL6qK8VIg==")!)
-            static let ecdsa384Secret =  Stub.Secret(keySize: 384, publicKey: Data(base64Encoded: "BLKSzA5q3jCb3q0JKigvcxfWVGrJ+bklpG0Zc9YzUwrbsh9SipvlSJi+sHQI+O0m88DOpRBAtuAHX60euD/Yv250tovN7/+MEFbXGZ/hLdd0BoFpWbLfJcQj806KJGlcDA==")!, privateKey: Data(base64Encoded: "BLKSzA5q3jCb3q0JKigvcxfWVGrJ+bklpG0Zc9YzUwrbsh9SipvlSJi+sHQI+O0m88DOpRBAtuAHX60euD/Yv250tovN7/+MEFbXGZ/hLdd0BoFpWbLfJcQj806KJGlcDHNapAOzrt9E+9QC4/KYoXS7Uw4pmdAz53uIj02tttiq3c0ZyIQ7XoscWWRqRrz8Kw==")!)
-        }
-
-    }
-
-}

SecretAgentKitTests/Info.plist

@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>$(DEVELOPMENT_LANGUAGE)</string>
-	<key>CFBundleExecutable</key>
-	<string>$(EXECUTABLE_NAME)</string>
-	<key>CFBundleIdentifier</key>
-	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
-	<key>CFBundlePackageType</key>
-	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
-	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
-	<key>CFBundleVersion</key>
-	<string>1</string>
-</dict>
-</plist>

SecretAgentKitTests/StubFileHandleReader.swift

@@ -1,14 +0,0 @@
-import SecretAgentKit
-import AppKit
-
-struct StubFileHandleReader: FileHandleReader {
-
-    let availableData: Data
-    var fileDescriptor: Int32 {
-        NSWorkspace.shared.runningApplications.filter({ $0.localizedName == "Finder" }).first!.processIdentifier
-    }
-    var pidOfConnectedProcess: Int32 {
-        fileDescriptor
-    }
-
-}

SecretAgentKitTests/StubFileHandleWriter.swift

@@ -1,11 +0,0 @@
-import SecretAgentKit
-
-class StubFileHandleWriter: FileHandleWriter {
-
-    var data = Data()
-
-    func write(_ data: Data) {
-        self.data.append(data)
-    }
-
-}

SecretAgentKitTests/StubWitness.swift

@@ -1,32 +0,0 @@
-import SecretKit
-import SecretAgentKit
-
-struct StubWitness {
-
-    let speakNow: (AnySecret, SigningRequestProvenance) -> Bool
-    let witness: (AnySecret, SigningRequestProvenance) -> ()
-
-}
-
-extension StubWitness: SigningWitness {
-
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, by provenance: SigningRequestProvenance) throws {
-        let objection = speakNow(secret, provenance)
-        if objection {
-            throw TheresMyChance()
-        }
-    }
-
-    func witness(accessTo secret: AnySecret, by provenance: SigningRequestProvenance) throws {
-        witness(secret, provenance)
-    }
-
-}
-
-extension StubWitness {
-
-    struct TheresMyChance: Error {
-
-    }
-
-}

SecretKit/Common/Erasers/AnySecretStore.swift

@@ -1,67 +0,0 @@
-import Foundation
-import Combine
-
-public class AnySecretStore: SecretStore {
-
-    let base: Any
-    private let _isAvailable: () -> Bool
-    private let _id: () -> UUID
-    private let _name: () -> String
-    private let _secrets: () -> [AnySecret]
-    private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> Data
-    private var sink: AnyCancellable?
-
-    public init<SecretStoreType>(_ secretStore: SecretStoreType) where SecretStoreType: SecretStore {
-        base = secretStore
-        _isAvailable = { secretStore.isAvailable }
-        _name = { secretStore.name }
-        _id = { secretStore.id }
-        _secrets = { secretStore.secrets.map { AnySecret($0) } }
-        _sign = { try secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
-        sink = secretStore.objectWillChange.sink { _ in
-            self.objectWillChange.send()
-        }
-    }
-
-    public var isAvailable: Bool {
-        return _isAvailable()
-    }
-
-    public var id: UUID {
-        return _id()
-    }
-
-    public var name: String {
-        return _name()
-    }
-
-    public var secrets: [AnySecret] {
-        return _secrets()
-    }
-
-    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) throws -> Data {
-        try _sign(data, secret, provenance)
-    }
-
-}
-
-public class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable {
-
-    private let _create: (String, Bool) throws -> Void
-    private let _delete: (AnySecret) throws -> Void
-
-    public init<SecretStoreType>(modifiable secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable {
-        _create = { try secretStore.create(name: $0, requiresAuthentication: $1) }
-        _delete = { try secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) }
-        super.init(secretStore)
-    }
-
-    public func create(name: String, requiresAuthentication: Bool) throws {
-        try _create(name, requiresAuthentication)
-    }
-
-    public func delete(secret: AnySecret) throws {
-        try _delete(secret)
-    }
-
-}

SecretKit/Common/OpenSSH/OpenSSHKeyWriter.swift

@@ -1,49 +0,0 @@
-import Foundation
-import CryptoKit
-
-// For the moment, only supports ecdsa-sha2-nistp256 and ecdsa-sha2-nistp386 keys
-public struct OpenSSHKeyWriter {
-
-    public init() {
-    }
-
-    public func data<SecretType: Secret>(secret: SecretType) -> Data {
-        lengthAndData(of: curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!) +
-            lengthAndData(of: curveIdentifier(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!) +
-            lengthAndData(of: secret.publicKey)
-    }
-
-    public func openSSHString<SecretType: Secret>(secret: SecretType) -> String {
-        "\(curveType(for: secret.algorithm, length: secret.keySize)) \(data(secret: secret).base64EncodedString())"
-    }
-
-    public func openSSHFingerprint<SecretType: Secret>(secret: SecretType) -> String {
-        Insecure.MD5.hash(data: data(secret: secret))
-            .compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
-            .joined(separator: ":")
-    }
-
-}
-
-extension OpenSSHKeyWriter {
-
-    public func lengthAndData(of data: Data) -> Data {
-        let rawLength = UInt32(data.count)
-        var endian = rawLength.bigEndian
-        return Data(bytes: &endian, count: UInt32.bitWidth/8) + data
-    }
-
-    public func curveIdentifier(for algorithm: Algorithm, length: Int) -> String {
-        switch algorithm {
-        case .ellipticCurve:
-            return "nistp" + String(describing: length)
-        }
-    }
-
-    public func curveType(for algorithm: Algorithm, length: Int) -> String {
-        switch algorithm {
-        case .ellipticCurve:
-            return "ecdsa-sha2-nistp" + String(describing: length)
-        }
-    }
-}

SecretKit/Common/OpenSSH/OpenSSHReader.swift

@@ -1,25 +0,0 @@
-import Foundation
-
-public class OpenSSHReader {
-
-    var remaining: Data
-
-    public init(data: Data) {
-        remaining = Data(data)
-    }
-
-    public func readNextChunk() -> Data {
-        let lengthRange = 0..<(UInt32.bitWidth/8)
-        let lengthChunk = remaining[lengthRange]
-        remaining.removeSubrange(lengthRange)
-        let littleEndianLength = lengthChunk.withUnsafeBytes { pointer in
-            return pointer.load(as: UInt32.self)
-        }
-        let length = Int(littleEndianLength.bigEndian)
-        let dataRange = 0..<length
-        let ret = Data(remaining[dataRange])
-        remaining.removeSubrange(dataRange)
-        return ret
-    }
-
-}

SecretKit/Common/SecretStoreList.swift

@@ -1,39 +0,0 @@
-import Foundation
-import Combine
-
-public class SecretStoreList: ObservableObject {
-
-    @Published public var stores: [AnySecretStore] = []
-    @Published public var modifiableStore: AnySecretStoreModifiable?
-    private var sinks: [AnyCancellable] = []
-
-    public init() {
-    }
-
-    public func add<SecretStoreType: SecretStore>(store: SecretStoreType) {
-        addInternal(store: AnySecretStore(store))
-    }
-
-    public func add<SecretStoreType: SecretStoreModifiable>(store: SecretStoreType) {
-        let modifiable = AnySecretStoreModifiable(modifiable: store)
-        modifiableStore = modifiable
-        addInternal(store: modifiable)
-    }
-
-    public var anyAvailable: Bool {
-        stores.reduce(false, { $0 || $1.isAvailable })
-    }
-
-}
-
-extension SecretStoreList {
-
-    private func addInternal(store: AnySecretStore) {
-        stores.append(store)
-        let sink = store.objectWillChange.sink {
-            self.objectWillChange.send()
-        }
-        sinks.append(sink)
-    }
-
-}

SecretKit/Common/Types/Secret.swift

@@ -1,21 +0,0 @@
-public protocol Secret: Identifiable, Hashable {
-
-    var name: String { get }
-    var algorithm: Algorithm { get }
-    var keySize: Int { get }
-    var publicKey: Data { get }
-
-}
-
-public enum Algorithm: Hashable {
-    case ellipticCurve
-    public init(secAttr: NSNumber) {
-        let secAttrString = secAttr.stringValue as CFString
-        switch secAttrString {
-        case kSecAttrKeyTypeEC:
-            self = .ellipticCurve
-        default:
-            fatalError()
-        }
-    }
-}

SecretKit/Common/Types/SecretStore.swift

@@ -1,27 +0,0 @@
-import Combine
-
-public protocol SecretStore: ObservableObject, Identifiable {
-
-    associatedtype SecretType: Secret
-
-    var isAvailable: Bool { get }
-    var id: UUID { get }
-    var name: String { get }
-    var secrets: [SecretType] { get }
-
-    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data
-
-}
-
-public protocol SecretStoreModifiable: SecretStore {
-
-    func create(name: String, requiresAuthentication: Bool) throws
-    func delete(secret: SecretType) throws
-
-}
-
-extension NSNotification.Name {
-
-    static let secretStoreUpdated = NSNotification.Name("com.maxgoedjen.Secretive.secretStore.updated")
-
-}

SecretKit/Common/Types/SigningRequestProvenance.swift

@@ -1,53 +0,0 @@
-import Foundation
-import AppKit
-
-public struct SigningRequestProvenance: Equatable {
-
-    public var chain: [Process]
-    public init(root: Process) {
-        self.chain = [root]
-    }
-
-}
-
-extension SigningRequestProvenance {
-
-    public var origin: Process {
-        chain.last!
-    }
-
-    public var intact: Bool {
-        chain.allSatisfy { $0.validSignature }
-    }
-
-}
-
-extension SigningRequestProvenance {
-
-    public struct Process: Equatable {
-
-        public let pid: Int32
-        public let processName: String
-        public let appName: String?
-        public let iconURL: URL?
-        public let path: String
-        public let validSignature: Bool
-        public let parentPID: Int32?
-
-        public init(pid: Int32, processName: String, appName: String?, iconURL: URL?, path: String, validSignature: Bool, parentPID: Int32?) {
-            self.pid = pid
-            self.processName = processName
-            self.appName = appName
-            self.iconURL = iconURL
-            self.path = path
-            self.validSignature = validSignature
-            self.parentPID = parentPID
-        }
-
-        public var displayName: String {
-            appName ?? processName
-        }
-
-    }
-
-}

SecretKit/Info.plist

@@ -1,24 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>$(DEVELOPMENT_LANGUAGE)</string>
-	<key>CFBundleExecutable</key>
-	<string>$(EXECUTABLE_NAME)</string>
-	<key>CFBundleIdentifier</key>
-	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
-	<key>CFBundlePackageType</key>
-	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
-	<key>CFBundleShortVersionString</key>
-	<string>$(CI_VERSION)</string>
-	<key>CFBundleVersion</key>
-	<string>$(CURRENT_PROJECT_VERSION)</string>
-	<key>NSHumanReadableCopyright</key>
-	<string>$(PRODUCT_NAME) is MIT Licensed.</string>
-</dict>
-</plist>

SecretKit/SecretKit.h

@@ -1,11 +0,0 @@
-#import <Foundation/Foundation.h>
-
-//! Project version number for SecretKit.
-FOUNDATION_EXPORT double SecretKitVersionNumber;
-
-//! Project version string for SecretKit.
-FOUNDATION_EXPORT const unsigned char SecretKitVersionString[];
-
-// In this header, you should import all the public headers of your framework using statements like #import <SecretKit/PublicHeader.h>
-
-

SecretKit/SecureEnclave/SecureEnclave.swift

@@ -1 +0,0 @@
-public enum SecureEnclave {}

SecretKit/SecureEnclave/SecureEnclaveSecret.swift

@@ -1,16 +0,0 @@
-import Foundation
-import Combine
-
-extension SecureEnclave {
-
-    public struct Secret: SecretKit.Secret {
-
-        public let id: Data
-        public let name: String
-        public let algorithm = Algorithm.ellipticCurve
-        public let keySize = 256
-        public let publicKey: Data
-
-    }
-
-}

SecretKit/SecureEnclave/SecureEnclaveStore.swift

@@ -1,190 +0,0 @@
-import Foundation
-import Security
-import CryptoTokenKit
-import LocalAuthentication
-
-extension SecureEnclave {
-
-    public class Store: SecretStoreModifiable {
-
-        public var isAvailable: Bool {
-            // For some reason, as of build time, CryptoKit.SecureEnclave.isAvailable always returns false
-            // error msg "Received error sending GET UNIQUE DEVICE command"
-            // Verify it with TKTokenWatcher manually.
-            TKTokenWatcher().tokenIDs.contains("com.apple.setoken")
-        }
-        public let id = UUID()
-        public let name = NSLocalizedString("Secure Enclave", comment: "Secure Enclave")
-        @Published public private(set) var secrets: [Secret] = []
-
-        public init() {
-            DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { _ in
-                self.reloadSecrets(notify: false)
-            }
-            loadSecrets()
-        }
-
-        // MARK: Public API
-
-        public func create(name: String, requiresAuthentication: Bool) throws {
-            var accessError: SecurityError?
-            let flags: SecAccessControlCreateFlags
-            if requiresAuthentication {
-                flags = [.privateKeyUsage, .userPresence]
-            } else {
-                flags = .privateKeyUsage
-            }
-            let access =
-                SecAccessControlCreateWithFlags(kCFAllocatorDefault,
-                                                kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-                                                flags,
-                                                &accessError) as Any
-            if let error = accessError {
-                throw error.takeRetainedValue() as Error
-            }
-
-            let attributes = [
-                kSecAttrLabel: name,
-                kSecAttrKeyType: Constants.keyType,
-                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
-                kSecAttrApplicationTag: Constants.keyTag,
-                kSecPrivateKeyAttrs: [
-                    kSecAttrIsPermanent: true,
-                    kSecAttrAccessControl: access
-                ]
-            ] as CFDictionary
-
-            var privateKey: SecKey? = nil
-            var publicKey: SecKey? = nil
-            let status = SecKeyGeneratePair(attributes, &publicKey, &privateKey)
-            guard privateKey != nil, let pk = publicKey else {
-                throw KeychainError(statusCode: status)
-            }
-            try savePublicKey(pk, name: name)
-            reloadSecrets()
-        }
-
-        public func delete(secret: Secret) throws {
-            let deleteAttributes = [
-                kSecClass: kSecClassKey,
-                kSecAttrApplicationLabel: secret.id as CFData
-                ] as CFDictionary
-            let status = SecItemDelete(deleteAttributes)
-            if status != errSecSuccess {
-                throw KeychainError(statusCode: status)
-            }
-            reloadSecrets()
-        }
-
-        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
-            let context = LAContext()
-            context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
-            context.localizedCancelTitle = "Deny"
-            let attributes = [
-                kSecClass: kSecClassKey,
-                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-                kSecAttrApplicationLabel: secret.id as CFData,
-                kSecAttrKeyType: Constants.keyType,
-                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
-                kSecAttrApplicationTag: Constants.keyTag,
-                kSecUseAuthenticationContext: context,
-                kSecReturnRef: true
-                ] as CFDictionary
-            var untyped: CFTypeRef?
-            let status = SecItemCopyMatching(attributes, &untyped)
-            if status != errSecSuccess {
-                throw KeychainError(statusCode: status)
-            }
-            guard let untypedSafe = untyped else {
-                throw KeychainError(statusCode: errSecSuccess)
-            }
-            let key = untypedSafe as! SecKey
-            var signError: SecurityError?
-            guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else {
-                throw SigningError(error: signError)
-            }
-            return signature as Data
-        }
-
-    }
-
-}
-
-extension SecureEnclave.Store {
-
-    private func reloadSecrets(notify: Bool = true) {
-        secrets.removeAll()
-        loadSecrets()
-        if notify {
-            DistributedNotificationCenter.default().post(name: .secretStoreUpdated, object: nil)
-        }
-    }
-
-    private func loadSecrets() {
-        let attributes = [
-            kSecClass: kSecClassKey,
-            kSecAttrKeyType: SecureEnclave.Constants.keyType,
-            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
-            kSecAttrKeyClass: kSecAttrKeyClassPublic,
-            kSecReturnRef: true,
-            kSecMatchLimit: kSecMatchLimitAll,
-            kSecReturnAttributes: true
-            ] as CFDictionary
-        var untyped: CFTypeRef?
-        SecItemCopyMatching(attributes, &untyped)
-        guard let typed = untyped as? [[CFString: Any]] else { return }
-        let wrapped: [SecureEnclave.Secret] = typed.map {
-            let name = $0[kSecAttrLabel] as? String ?? "Unnamed"
-            let id = $0[kSecAttrApplicationLabel] as! Data
-            let publicKeyRef = $0[kSecValueRef] as! SecKey
-            let publicKeyAttributes = SecKeyCopyAttributes(publicKeyRef) as! [CFString: Any]
-            let publicKey = publicKeyAttributes[kSecValueData] as! Data
-            return SecureEnclave.Secret(id: id, name: name, publicKey: publicKey)
-        }
-        secrets.append(contentsOf: wrapped)
-    }
-
-    private func savePublicKey(_ publicKey: SecKey, name: String) throws {
-        let attributes = [
-            kSecClass: kSecClassKey,
-            kSecAttrKeyType: SecureEnclave.Constants.keyType,
-            kSecAttrKeyClass: kSecAttrKeyClassPublic,
-            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
-            kSecValueRef: publicKey,
-            kSecAttrIsPermanent: true,
-            kSecReturnData: true,
-            kSecAttrLabel: name
-            ] as CFDictionary
-        let status = SecItemAdd(attributes, nil)
-        if status != errSecSuccess {
-            throw SecureEnclave.KeychainError(statusCode: status)
-        }
-    }
-}
-
-extension SecureEnclave {
-
-    public struct KeychainError: Error {
-        public let statusCode: OSStatus
-    }
-
-    public struct SigningError: Error {
-        public let error: SecurityError?
-    }
-
-}
-
-extension SecureEnclave {
-
-    public typealias SecurityError = Unmanaged<CFError>
-
-}
-
-extension SecureEnclave {
-
-    enum Constants {
-        static let keyTag = "com.maxgoedjen.secretive.secureenclave.key".data(using: .utf8)! as CFData
-        static let keyType = kSecAttrKeyTypeECSECPrimeRandom
-    }
-
-}

SecretKit/SmartCard/SmartCard.swift

@@ -1 +0,0 @@
-public enum SmartCard {}

SecretKit/SmartCard/SmartCardStore.swift

@@ -1,165 +0,0 @@
-import Foundation
-import Security
-import CryptoTokenKit
-import LocalAuthentication
-
-// TODO: Might need to split this up into "sub-stores?"
-// ie, each token has its own Store.
-extension SmartCard {
-
-    public class Store: SecretStore {
-
-        // TODO: Read actual smart card name, eg "YubiKey 5c"
-        @Published public var isAvailable: Bool = false
-        public let id = UUID()
-        public private(set) var name = NSLocalizedString("Smart Card", comment: "Smart Card")
-        @Published public private(set) var secrets: [Secret] = []
-        private let watcher = TKTokenWatcher()
-        private var tokenID: String?
-
-        public init() {
-            tokenID = watcher.nonSecureEnclaveTokens.first
-            watcher.setInsertionHandler { string in
-                guard self.tokenID == nil else { return }
-                guard !string.contains("setoken") else { return }
-
-                self.tokenID = string
-                self.reloadSecrets()
-                self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
-            }
-            if let tokenID = tokenID {
-                self.isAvailable = true
-                self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
-            }
-            loadSecrets()
-        }
-
-        // MARK: Public API
-
-        public func create(name: String) throws {
-            fatalError("Keys must be created on the smart card.")
-        }
-
-        public func delete(secret: Secret) throws {
-            fatalError("Keys must be deleted on the smart card.")
-        }
-
-        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
-            guard let tokenID = tokenID else { fatalError() }
-            let context = LAContext()
-            context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
-            context.localizedCancelTitle = "Deny"
-            let attributes = [
-                kSecClass: kSecClassKey,
-                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-                kSecAttrApplicationLabel: secret.id as CFData,
-                kSecAttrTokenID: tokenID,
-                kSecUseAuthenticationContext: context,
-                kSecReturnRef: true
-                ] as CFDictionary
-            var untyped: CFTypeRef?
-            let status = SecItemCopyMatching(attributes, &untyped)
-            if status != errSecSuccess {
-                throw KeychainError(statusCode: status)
-            }
-            guard let untypedSafe = untyped else {
-                throw KeychainError(statusCode: errSecSuccess)
-            }
-            let key = untypedSafe as! SecKey
-            var signError: SecurityError?
-            let signatureAlgorithm: SecKeyAlgorithm
-            switch (secret.algorithm, secret.keySize) {
-            case (.ellipticCurve, 256):
-                signatureAlgorithm = .ecdsaSignatureMessageX962SHA256
-            case (.ellipticCurve, 384):
-                signatureAlgorithm = .ecdsaSignatureMessageX962SHA384
-            default:
-                fatalError()
-            }
-            guard let signature = SecKeyCreateSignature(key, signatureAlgorithm, data as CFData, &signError) else {
-                throw SigningError(error: signError)
-            }
-            return signature as Data
-        }
-
-    }
-
-}
-
-extension SmartCard.Store {
-
-    private func smartcardRemoved(for tokenID: String? = nil) {
-        self.tokenID = nil
-        reloadSecrets()
-    }
-
-    private func reloadSecrets() {
-        DispatchQueue.main.async {
-            self.isAvailable = self.tokenID != nil
-            self.secrets.removeAll()
-            self.loadSecrets()
-        }
-    }
-
-    private func loadSecrets() {
-        guard let tokenID = tokenID else { return }
-        // Hack to read name if there's only one smart card
-        let slotNames = TKSmartCardSlotManager().slotNames
-        if watcher.nonSecureEnclaveTokens.count == 1 && slotNames.count == 1 {
-            name = slotNames.first!
-        } else {
-            name = NSLocalizedString("Smart Card", comment: "Smart Card")
-        }
-
-        let attributes = [
-            kSecClass: kSecClassKey,
-            kSecAttrTokenID: tokenID,
-            kSecAttrKeyType: kSecAttrKeyTypeEC, // Restrict to EC
-            kSecReturnRef: true,
-            kSecMatchLimit: kSecMatchLimitAll,
-            kSecReturnAttributes: true
-            ] as CFDictionary
-        var untyped: CFTypeRef?
-        SecItemCopyMatching(attributes, &untyped)
-        guard let typed = untyped as? [[CFString: Any]] else { return }
-        let wrapped: [SmartCard.Secret] = typed.map {
-            let name = $0[kSecAttrLabel] as? String ?? "Unnamed"
-            let tokenID = $0[kSecAttrApplicationLabel] as! Data
-            let algorithm = Algorithm(secAttr: $0[kSecAttrKeyType] as! NSNumber)
-            let keySize = $0[kSecAttrKeySizeInBits] as! Int
-            let publicKeyRef = $0[kSecValueRef] as! SecKey
-            let publicKeySecRef = SecKeyCopyPublicKey(publicKeyRef)!
-            let publicKeyAttributes = SecKeyCopyAttributes(publicKeySecRef) as! [CFString: Any]
-            let publicKey = publicKeyAttributes[kSecValueData] as! Data
-            return SmartCard.Secret(id: tokenID, name: name, algorithm: algorithm, keySize: keySize, publicKey: publicKey)
-        }
-        secrets.append(contentsOf: wrapped)
-    }
-
-}
-
-extension TKTokenWatcher {
-
-    fileprivate var nonSecureEnclaveTokens: [String] {
-        tokenIDs.filter { !$0.contains("setoken") }
-    }
-
-}
-
-extension SmartCard {
-
-    public struct KeychainError: Error {
-        public let statusCode: OSStatus
-    }
-
-    public struct SigningError: Error {
-        public let error: SecurityError?
-    }
-
-}
-
-extension SmartCard {
-
-    public typealias SecurityError = Unmanaged<CFError>
-
-}

SecretKitTests/AnySecretTests.swift

@@ -1,17 +0,0 @@
-import Foundation
-import XCTest
-@testable import SecretKit
-
-class AnySecretTests: XCTestCase {
-
-    func testEraser() {
-        let secret = SmartCard.Secret(id: UUID().uuidString.data(using: .utf8)!, name: "Name", algorithm: .ellipticCurve, keySize: 256, publicKey: UUID().uuidString.data(using: .utf8)!)
-        let erased = AnySecret(secret)
-        XCTAssert(erased.id == secret.id as AnyHashable)
-        XCTAssert(erased.name == secret.name)
-        XCTAssert(erased.algorithm == secret.algorithm)
-        XCTAssert(erased.keySize == secret.keySize)
-        XCTAssert(erased.publicKey == secret.publicKey)
-    }
-
-}

SecretKitTests/Info.plist

@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>$(DEVELOPMENT_LANGUAGE)</string>
-	<key>CFBundleExecutable</key>
-	<string>$(EXECUTABLE_NAME)</string>
-	<key>CFBundleIdentifier</key>
-	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
-	<key>CFBundlePackageType</key>
-	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
-	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
-	<key>CFBundleVersion</key>
-	<string>1</string>
-</dict>
-</plist>

SecretKitTests/OpenSSHReaderTests.swift

@@ -1,25 +0,0 @@
-import Foundation
-import XCTest
-@testable import SecretKit
-
-class OpenSSHReaderTests: XCTestCase {
-
-    func testSignatureRequest() {
-        let reader = OpenSSHReader(data: Constants.signatureRequest)
-        let hash = reader.readNextChunk()
-        XCTAssert(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ=="))
-        let dataToSign = reader.readNextChunk()
-        XCTAssert(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU="))
-        let empty = reader.readNextChunk()
-        XCTAssert(empty.isEmpty)
-    }
-
-}
-
-extension OpenSSHReaderTests {
-
-    enum Constants {
-        static let signatureRequest = Data(base64Encoded: "AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QUAAADvAAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QUAAAAA")!
-    }
-
-}

SecretKitTests/OpenSSHWriterTests.swift

@@ -1,45 +0,0 @@
-import Foundation
-import XCTest
-@testable import SecretKit
-
-class OpenSSHWriterTests: XCTestCase {
-
-    let writer = OpenSSHKeyWriter()
-
-    func testECDSA256Fingerprint() {
-        XCTAssertEqual(writer.openSSHFingerprint(secret:  Constants.ecdsa256Secret), "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5")
-    }
-
-    func testECDSA256PublicKey() {
-        XCTAssertEqual(writer.openSSHString(secret:  Constants.ecdsa256Secret),
-        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")
-    }
-
-    func testECDSA256Hash() {
-    XCTAssertEqual(writer.data(secret: Constants.ecdsa256Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo="))
-    }
-
-    func testECDSA384Fingerprint() {
-        XCTAssertEqual(writer.openSSHFingerprint(secret:  Constants.ecdsa384Secret), "66:e0:66:d7:41:ed:19:8e:e2:20:df:ce:ac:7e:2b:6e")
-    }
-
-    func testECDSA384PublicKey() {
-        XCTAssertEqual(writer.openSSHString(secret:  Constants.ecdsa384Secret),
-                       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")
-    }
-
-    func testECDSA384Hash() {
-        XCTAssertEqual(writer.data(secret: Constants.ecdsa384Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ=="))
-    }
-
-}
-
-extension OpenSSHWriterTests {
-
-    enum Constants {
-        static let ecdsa256Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 256)", algorithm: .ellipticCurve, keySize: 256, publicKey: Data(base64Encoded: "BOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")!)
-        static let ecdsa384Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 384)", algorithm: .ellipticCurve, keySize: 384, publicKey: Data(base64Encoded: "BG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")!)
-
-    }
-
-}

Secretive.xcodeproj/xcshareddata/xcschemes/SecretAgentKit.xcscheme

@@ -1,85 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "1140"
-   version = "1.7">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES">
-      <BuildActionEntries>
-         <BuildActionEntry
-            buildForTesting = "YES"
-            buildForRunning = "YES"
-            buildForProfiling = "YES"
-            buildForArchiving = "YES"
-            buildForAnalyzing = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "5099A06B240242BA0062B6F2"
-               BuildableName = "SecretAgentKit.framework"
-               BlueprintName = "SecretAgentKit"
-               ReferencedContainer = "container:Secretive.xcodeproj">
-            </BuildableReference>
-         </BuildActionEntry>
-      </BuildActionEntries>
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Test"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES">
-      <TestPlans>
-         <TestPlanReference
-            reference = "container:Config/Secretive.xctestplan"
-            default = "YES">
-         </TestPlanReference>
-      </TestPlans>
-      <Testables>
-         <TestableReference
-            skipped = "NO"
-            parallelizable = "YES"
-            testExecutionOrdering = "random">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "5099A073240242BA0062B6F2"
-               BuildableName = "SecretAgentKitTests.xctest"
-               BlueprintName = "SecretAgentKitTests"
-               ReferencedContainer = "container:Secretive.xcodeproj">
-            </BuildableReference>
-         </TestableReference>
-      </Testables>
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES">
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "5099A06B240242BA0062B6F2"
-            BuildableName = "SecretAgentKit.framework"
-            BlueprintName = "SecretAgentKit"
-            ReferencedContainer = "container:Secretive.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>

Secretive/App.swift

@@ -1,96 +0,0 @@
-import Cocoa
-import SwiftUI
-import SecretKit
-import Brief
-
-@main
-struct Secretive: App {
-
-    private let storeList: SecretStoreList = {
-        let list = SecretStoreList()
-        list.add(store: SecureEnclave.Store())
-        list.add(store: SmartCard.Store())
-        return list
-    }()
-    private let agentStatusChecker = AgentStatusChecker()
-    private let justUpdatedChecker = JustUpdatedChecker()
-
-    @AppStorage("defaultsHasRunSetup") var hasRunSetup = false
-    @State private var showingSetup = false
-    @State private var showingCreation = false
-
-    @SceneBuilder var body: some Scene {
-        WindowGroup {
-            ContentView<Updater, AgentStatusChecker>(showingCreation: $showingCreation, runningSetup: $showingSetup, hasRunSetup: $hasRunSetup)
-                .environmentObject(storeList)
-                .environmentObject(Updater(checkOnLaunch: hasRunSetup))
-                .environmentObject(agentStatusChecker)
-                .onAppear {
-                    if !hasRunSetup {
-                        showingSetup = true
-                    }
-                }
-                .onReceive(NotificationCenter.default.publisher(for: NSApplication.didBecomeActiveNotification)) { _ in
-                    guard hasRunSetup else { return }
-                    agentStatusChecker.check()
-                    if agentStatusChecker.running && justUpdatedChecker.justUpdated {
-                        // Relaunch the agent, since it'll be running from earlier update still
-                        reinstallAgent()
-                    } else if !agentStatusChecker.running {
-                        forceLaunchAgent()
-                    }
-                }
-        }
-        .commands {
-            CommandGroup(after: CommandGroupPlacement.newItem) {
-                Button("New Secret") {
-                    showingCreation = true
-                }
-                .keyboardShortcut(KeyboardShortcut(KeyEquivalent("N"), modifiers: [.command, .shift]))
-            }
-            CommandGroup(replacing: .help) {
-                Button("Help") {
-                    NSWorkspace.shared.open(Constants.helpURL)
-                }
-            }
-            CommandGroup(after: .help) {
-                Button("Setup Secretive") {
-                    showingSetup = true
-                }
-            }
-            SidebarCommands()
-        }
-    }
-
-}
-
-extension Secretive {
-
-    private func reinstallAgent() {
-        justUpdatedChecker.check()
-        LaunchAgentController().install {
-            // Wait a second for launchd to kick in (next runloop isn't enough).
-            DispatchQueue.main.asyncAfter(deadline: .now() + 1) {
-                agentStatusChecker.check()
-                if !agentStatusChecker.running {
-                    forceLaunchAgent()
-                }
-            }
-        }
-    }
-
-    private func forceLaunchAgent() {
-        // We've run setup, we didn't just update, launchd is just not doing it's thing.
-        // Force a launch directly.
-        LaunchAgentController().forceLaunch { _ in
-            agentStatusChecker.check()
-        }
-    }
-
-}
-
-
-private enum Constants {
-    static let helpURL = URL(string: "https://github.com/maxgoedjen/secretive/blob/main/FAQ.md")!
-}
-

Secretive/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -1,60 +0,0 @@
-{
-  "images" : [
-    {
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "16x16"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "16x16"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "32x32"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "32x32"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "128x128"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "128x128"
-    },
-    {
-      "filename" : "Mac Icon.png",
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "256x256"
-    },
-    {
-      "filename" : "Mac Icon@0.25x.png",
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "256x256"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "512x512"
-    },
-    {
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "512x512"
-    }
-  ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  }
-}

Secretive/Controllers/AgentStatusChecker.swift

@@ -1,46 +0,0 @@
-import Foundation
-import Combine
-import AppKit
-
-protocol AgentStatusCheckerProtocol: ObservableObject {
-    var running: Bool { get }
-}
-
-class AgentStatusChecker: ObservableObject, AgentStatusCheckerProtocol {
-
-    @Published var running: Bool = false
-
-    init() {
-        check()
-    }
-
-    func check() {
-        running = instanceSecretAgentProcess != nil
-    }
-
-    // All processes, including ones from older versions, etc
-    var secretAgentProcesses: [NSRunningApplication] {
-        NSRunningApplication.runningApplications(withBundleIdentifier: Constants.secretAgentAppID)
-    }
-
-    // The process corresponding to this instance of Secretive
-    var instanceSecretAgentProcess: NSRunningApplication? {
-        let agents = secretAgentProcesses
-        for agent in agents {
-            guard let url = agent.bundleURL else { continue }
-            if url.absoluteString.hasPrefix(Bundle.main.bundleURL.absoluteString) {
-                return agent
-            }
-        }
-        return nil
-    }
-
-}
-
-extension AgentStatusChecker {
-
-    enum Constants {
-        static let secretAgentAppID = "com.maxgoedjen.Secretive.SecretAgent"
-    }
-
-}

Secretive/Controllers/JustUpdatedChecker.swift

@@ -1,34 +0,0 @@
-import Foundation
-import Combine
-import AppKit
-
-protocol JustUpdatedCheckerProtocol: ObservableObject {
-    var justUpdated: Bool { get }
-}
-
-class JustUpdatedChecker: ObservableObject, JustUpdatedCheckerProtocol {
-
-    @Published var justUpdated: Bool = false
-
-    init() {
-        check()
-    }
-
-    func check() {
-        let lastBuild = UserDefaults.standard.object(forKey: Constants.previousVersionUserDefaultsKey) as? String ?? "None"
-        let currentBuild = Bundle.main.infoDictionary!["CFBundleShortVersionString"] as! String
-        UserDefaults.standard.set(currentBuild, forKey: Constants.previousVersionUserDefaultsKey)
-        justUpdated = lastBuild != currentBuild
-    }
-
-
-
-}
-
-extension JustUpdatedChecker {
-
-    enum Constants {
-        static let previousVersionUserDefaultsKey = "com.maxgoedjen.Secretive.lastBuild"
-    }
-
-}

Secretive/Controllers/LaunchAgentController.swift

@@ -1,38 +0,0 @@
-import Foundation
-import ServiceManagement
-import AppKit
-import OSLog
-
-struct LaunchAgentController {
-
-    func install(completion: (() -> Void)? = nil) {
-        Logger().debug("Installing agent")
-        _ = setEnabled(false)
-        // This is definitely a bit of a "seems to work better" thing but:
-        // Seems to more reliably hit if these are on separate runloops, otherwise it seems like it sometimes doesn't kill old
-        // and start new?
-        DispatchQueue.main.asyncAfter(deadline: .now() + 0.1) {
-            _  = setEnabled(true)
-            completion?()
-        }
-
-    }
-
-    func forceLaunch(completion: ((Bool) -> Void)?) {
-        Logger().debug("Agent is not running, attempting to force launch")
-        let url = Bundle.main.bundleURL.appendingPathComponent("Contents/Library/LoginItems/SecretAgent.app")
-        NSWorkspace.shared.openApplication(at: url, configuration: NSWorkspace.OpenConfiguration()) { app, error in
-            completion?(error == nil)
-            if let error = error {
-                Logger().error("Error force launching \(error.localizedDescription)")
-            } else {
-                Logger().debug("Agent force launched")
-            }
-        }
-    }
-
-    private func setEnabled(_ enabled: Bool) -> Bool {
-        SMLoginItemSetEnabled("com.maxgoedjen.Secretive.SecretAgent" as CFString, enabled)
-    }
-
-}

Secretive/Controllers/ShellConfigurationController.swift

@@ -1,58 +0,0 @@
-import Foundation
-import Cocoa
-
-struct ShellConfigurationController {
-    
-    let socketPath = (NSHomeDirectory().replacingOccurrences(of: "com.maxgoedjen.Secretive.Host", with: "com.maxgoedjen.Secretive.SecretAgent") as NSString).appendingPathComponent("socket.ssh") as String
-    
-    var shellInstructions: [ShellConfigInstruction] {
-        [
-            ShellConfigInstruction(shell: "zsh",
-                                   shellConfigDirectory: "~/",
-                                   shellConfigFilename: ".zshrc",
-                                   text: "export SSH_AUTH_SOCK=\(socketPath)"),
-            ShellConfigInstruction(shell: "bash",
-                                   shellConfigDirectory: "~/",
-                                   shellConfigFilename: ".bashrc",
-                                   text: "export SSH_AUTH_SOCK=\(socketPath)"),
-            ShellConfigInstruction(shell: "fish",
-                                   shellConfigDirectory: "~/.config/fish",
-                                   shellConfigFilename: "config.fish",
-                                   text: "set -x SSH_AUTH_SOCK \(socketPath)"),
-        ]
-        
-    }
-    
-    
-    func addToShell(shellInstructions: ShellConfigInstruction) -> Bool {
-        let openPanel = NSOpenPanel()
-        // This is sync, so no need to strongly retain
-        let delegate = Delegate(name: shellInstructions.shellConfigFilename)
-        openPanel.delegate = delegate
-        openPanel.message = "Select \(shellInstructions.shellConfigFilename) to let Secretive configure your shell automatically."
-        openPanel.prompt = "Add to \(shellInstructions.shellConfigFilename)"
-        openPanel.canChooseFiles = true
-        openPanel.canChooseDirectories = false
-        openPanel.showsHiddenFiles = true
-        openPanel.directoryURL = URL(fileURLWithPath: shellInstructions.shellConfigDirectory)
-        openPanel.nameFieldStringValue = shellInstructions.shellConfigFilename
-        openPanel.allowedContentTypes = [.symbolicLink, .data, .plainText]
-        openPanel.runModal()
-        guard let fileURL = openPanel.urls.first else { return false }
-        let handle: FileHandle
-        do {
-            handle = try FileHandle(forUpdating: fileURL)
-            guard let existing = try handle.readToEnd(),
-                  let existingString = String(data: existing, encoding: .utf8) else { return false }
-            guard !existingString.contains(shellInstructions.text) else {
-                return true
-            }
-            try handle.seekToEnd()
-        } catch {
-            return false
-        }
-        handle.write("\n# Secretive Config\n\(shellInstructions.text)\n".data(using: .utf8)!)
-        return true
-    }
-    
-}

Secretive/Credits.rtf

@@ -1,24 +0,0 @@
-{\rtf1\ansi\ansicpg1252\cocoartf2511
-\cocoatextscaling0\cocoaplatform0{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
-{\colortbl;\red255\green255\blue255;}
-{\*\expandedcolortbl;;}
-\margl1440\margr1440\vieww9000\viewh8400\viewkind0
-\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6119\tx6480\tx7200\tx7920\tx8640\pardirnatural\partightenfactor0
-{\field{\*\fldinst{HYPERLINK "https://github.com/maxgoedjen/secretive"}}{\fldrslt 
-\f0\fs24 \cf0 GitHub Repository}}
-\f0\fs24 \
-\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural\partightenfactor0
-\cf0 \
-{\field{\*\fldinst{HYPERLINK "GITHUB_BUILD_URL"}}{\fldrslt Build Log}}\
-\
-Special Thanks To:\
-{\field{\*\fldinst{HYPERLINK "https://github.com/bdash"}}{\fldrslt Mark Rowe}}\
-{\field{\*\fldinst{HYPERLINK "https://github.com/danielctull"}}{\fldrslt Daniel Tull}}\
-{\field{\*\fldinst{HYPERLINK "https://github.com/davedelong"}}{\fldrslt Dave DeLong}}\
-{\field{\*\fldinst{HYPERLINK "https://github.com/esttorhe"}}{\fldrslt Esteban Torres}}\
-{\field{\*\fldinst{HYPERLINK "https://github.com/joeblau"}}{\fldrslt Joe Blau}}\
-{\field{\*\fldinst{HYPERLINK "https://github.com/marksands"}}{\fldrslt Mark Sands}}\
-{\field{\*\fldinst{HYPERLINK "https://github.com/mergesort"}}{\fldrslt Joe Fabisevich}}\
-{\field{\*\fldinst{HYPERLINK "https://github.com/phillco"}}{\fldrslt Phil Cohen}}\
-{\field{\*\fldinst{HYPERLINK "https://github.com/zackdotcomputer"}}{\fldrslt Zack Sheppard}}}
-{\field{\*\fldinst{HYPERLINK "https://github.com/zacwest"}}{\fldrslt Zac West}}}

Secretive/Preview Content/Preview Assets.xcassets/Contents.json

@@ -1,6 +0,0 @@
-{
-  "info" : {
-    "version" : 1,
-    "author" : "xcode"
-  }
-}

Secretive/Preview Content/PreviewAgentStatusChecker.swift

@@ -1,12 +0,0 @@
-import Foundation
-import Combine
-
-class PreviewAgentStatusChecker: AgentStatusCheckerProtocol {
-
-    let running: Bool
-
-    init(running: Bool = true) {
-        self.running = running
-    }
-
-}

Secretive/Preview Content/PreviewStore.swift

@@ -1,70 +0,0 @@
-import Foundation
-import SecretKit
-
-enum Preview {}
-
-extension Preview {
-
-    struct Secret: SecretKit.Secret {
-
-        let id = UUID().uuidString
-        let name: String
-        let algorithm = Algorithm.ellipticCurve
-        let keySize = 256
-        let publicKey = UUID().uuidString.data(using: .utf8)!
-
-    }
-
-}
-
-extension Preview {
-
-    class Store: SecretStore, ObservableObject {
-
-        let isAvailable = true
-        let id = UUID()
-        var name: String { "Preview Store" }
-        @Published var secrets: [Secret] = []
-
-        init(secrets: [Secret]) {
-            self.secrets.append(contentsOf: secrets)
-        }
-
-        init(numberOfRandomSecrets: Int = 5) {
-            let new = (0..<numberOfRandomSecrets).map { Secret(name: String(describing: $0)) }
-            self.secrets.append(contentsOf: new)
-        }
-
-        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
-            return data
-        }
-
-    }
-
-    class StoreModifiable: Store, SecretStoreModifiable {
-
-        override var name: String { "Modifiable Preview Store" }
-
-        func create(name: String, requiresAuthentication: Bool) throws {
-        }
-
-        func delete(secret: Preview.Secret) throws {
-        }
-    }
-
-}
-
-extension Preview {
-
-    static func storeList(stores: [Store] = [], modifiableStores: [StoreModifiable] = []) -> SecretStoreList {
-        let list = SecretStoreList()
-        for store in stores {
-            list.add(store: store)
-        }
-        for storeModifiable in modifiableStores {
-            list.add(store: storeModifiable)
-        }
-        return list
-    }
-
-}

Secretive/Views/ContentView.swift

@@ -1,193 +0,0 @@
-import SwiftUI
-import SecretKit
-import Brief
-
-struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentStatusCheckerProtocol>: View {
-
-    @Binding var showingCreation: Bool
-    @Binding var runningSetup: Bool
-    @Binding var hasRunSetup: Bool
-
-    @EnvironmentObject private var storeList: SecretStoreList
-    @EnvironmentObject private var updater: UpdaterType
-    @EnvironmentObject private var agentStatusChecker: AgentStatusCheckerType
-
-    @State private var selectedUpdate: Release?
-    @State private var showingAppPathNotice = false
-
-    var body: some View {
-        VStack {
-            if storeList.anyAvailable {
-                StoreListView(showingCreation: $showingCreation)
-            } else {
-                NoStoresView()
-            }
-        }
-        .frame(minWidth: 640, minHeight: 320)
-        .toolbar {
-            updateNotice
-            setupNotice
-            appPathNotice
-            newItem
-        }
-    }
-
-}
-
-extension ContentView {
-
-    var updateNotice: ToolbarItem<Void, AnyView> {
-        guard let update = updater.update else {
-            return ToolbarItem { AnyView(EmptyView()) }
-        }
-        let color: Color
-        let text: String
-        if update.critical {
-            text = "Critical Security Update Required"
-            color = .red
-        } else {
-            text = "Update Available"
-            color = .orange
-        }
-        return ToolbarItem {
-            AnyView(
-                Button(action: {
-                    selectedUpdate = update
-                }, label: {
-                    Text(text)
-                        .font(.headline)
-                        .foregroundColor(.white)
-                })
-                .background(color)
-                .cornerRadius(5)
-                .popover(item: $selectedUpdate, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) { update in
-                    UpdateDetailView(update: update)
-                }
-            )
-        }
-    }
-
-    var newItem: ToolbarItem<Void, AnyView> {
-        guard storeList.modifiableStore?.isAvailable ?? false else {
-            return ToolbarItem { AnyView(EmptyView()) }
-        }
-        return ToolbarItem {
-            AnyView(
-                Button(action: {
-                    showingCreation = true
-                }, label: {
-                    Image(systemName: "plus")
-                })
-                .popover(isPresented: $showingCreation, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
-                    if let modifiable = storeList.modifiableStore {
-                        CreateSecretView(store: modifiable, showing: $showingCreation)
-                    }
-                }
-
-            )
-        }
-    }
-
-    var setupNotice: ToolbarItem<Void, AnyView> {
-        return ToolbarItem {
-            AnyView(
-                Group {
-                    if runningSetup || !hasRunSetup || !agentStatusChecker.running  {
-                        Button(action: {
-                            runningSetup = true
-                        }, label: {
-                            Group {
-                                if hasRunSetup && !agentStatusChecker.running {
-                                    Text("Secret Agent Is Not Running")
-                                } else {
-                                    Text("Setup Secretive")
-                                }
-                            }
-                            .font(.headline)
-                            .foregroundColor(.white)
-                        })
-                        .background(Color.orange)
-                        .cornerRadius(5)
-                    } else {
-                        EmptyView()
-                    }
-                }
-                .sheet(isPresented: $runningSetup) {
-                    SetupView(visible: $runningSetup, setupComplete: $hasRunSetup)
-                }
-            )
-        }
-    }
-
-    var appPathNotice: ToolbarItem<Void, AnyView> {
-        let controller = ApplicationDirectoryController()
-        guard !controller.isInApplicationsDirectory else {
-            return ToolbarItem { AnyView(EmptyView()) }
-        }
-        return ToolbarItem {
-            AnyView(
-                Button(action: {
-                    showingAppPathNotice = true
-                }, label: {
-                    Group {
-                        Text("Secretive Is Not in Applications Folder")
-                    }
-                    .font(.headline)
-                    .foregroundColor(.white)
-                })
-                .background(Color.orange)
-                .cornerRadius(5)
-                .popover(isPresented: $showingAppPathNotice, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
-                    VStack {
-                        Image(systemName: "exclamationmark.triangle")
-                            .resizable()
-                            .aspectRatio(contentMode: .fit)
-                            .frame(width: 64)
-                        Text("Secretive needs to be in your Applications folder to work properly. Please move it and relaunch.")
-                            .frame(maxWidth: 300)
-                    }
-                    .padding()
-                }
-            )
-        }
-    }
-
-}
-
-#if DEBUG
-
-struct ContentView_Previews: PreviewProvider {
-
-    private static let storeList: SecretStoreList = {
-        let list = SecretStoreList()
-        list.add(store: SecureEnclave.Store())
-        list.add(store: SmartCard.Store())
-        return list
-    }()
-    private static let agentStatusChecker = AgentStatusChecker()
-    private static let justUpdatedChecker = JustUpdatedChecker()
-
-    @State var hasRunSetup = false
-    @State private var showingSetup = false
-    @State private var showingCreation = false
-
-    static var previews: some View {
-        Group {
-            // Empty on modifiable and nonmodifiable
-            ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
-                .environmentObject(Preview.storeList(stores: [Preview.Store(numberOfRandomSecrets: 0)], modifiableStores: [Preview.StoreModifiable(numberOfRandomSecrets: 0)]))
-                .environmentObject(PreviewUpdater())
-                .environmentObject(agentStatusChecker)
-
-            // 5 items on modifiable and nonmodifiable
-            ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
-                .environmentObject(Preview.storeList(stores: [Preview.Store()], modifiableStores: [Preview.StoreModifiable()]))
-                .environmentObject(PreviewUpdater())
-                .environmentObject(agentStatusChecker)
-        }
-        .environmentObject(agentStatusChecker)
-
-    }
-}
-
-#endif

Secretive/Views/CopyableView.swift

@@ -1,135 +0,0 @@
-import SwiftUI
-
-struct CopyableView: View {
-
-    var title: String
-    var image: Image
-    var text: String
-
-    @State private var interactionState: InteractionState = .normal
-
-    var body: some View {
-        VStack(alignment: .leading) {
-            HStack {
-                image
-                    .renderingMode(.template)
-                    .imageScale(.large)
-                    .foregroundColor(primaryTextColor)
-                Text(title)
-                    .font(.headline)
-                    .foregroundColor(primaryTextColor)
-                Spacer()
-                if interactionState != .normal {
-                    Text(hoverText)
-                        .bold()
-                        .textCase(.uppercase)
-                        .foregroundColor(secondaryTextColor)
-                        .transition(.opacity)
-                }
-
-            }
-            .padding(EdgeInsets(top: 20, leading: 20, bottom: 10, trailing: 20))
-            Divider()
-            Text(text)
-                .fixedSize(horizontal: false, vertical: true)
-                .foregroundColor(primaryTextColor)
-                .padding(EdgeInsets(top: 10, leading: 20, bottom: 20, trailing: 20))
-                .multilineTextAlignment(.leading)
-                .font(.system(.body, design: .monospaced))
-        }
-        .background(backgroundColor)
-        .frame(minWidth: 150, maxWidth: .infinity)
-        .cornerRadius(10)
-        .onHover { hovering in
-            withAnimation {
-                interactionState = hovering ? .hovering : .normal
-            }
-        }
-        .onDrag {
-            NSItemProvider(item: NSData(data: text.data(using: .utf8)!), typeIdentifier: kUTTypeUTF8PlainText as String)
-        }
-        .onTapGesture {
-            copy()
-            withAnimation {
-                interactionState = .clicking
-            }
-        }
-        .gesture(
-            TapGesture()
-                .onEnded {
-                    withAnimation {
-                        interactionState = .normal
-                    }
-                }
-        )
-    }
-
-    var hoverText: String {
-        switch interactionState {
-        case .hovering:
-            return "Click to Copy"
-        case .clicking:
-            return "Copied"
-        case .normal:
-            fatalError()
-        }
-    }
-
-    var backgroundColor: Color {
-        let color: NSColor
-        switch interactionState {
-        case .normal:
-            color = .windowBackgroundColor
-        case .hovering:
-            color = .unemphasizedSelectedContentBackgroundColor
-        case .clicking:
-            color = .selectedContentBackgroundColor
-        }
-        return Color(color)
-    }
-
-    var primaryTextColor: Color {
-        let color: NSColor
-        switch interactionState {
-        case .normal, .hovering:
-            color = .textColor
-        case .clicking:
-            color = .white
-        }
-        return Color(color)
-    }
-
-    var secondaryTextColor: Color {
-        let color: NSColor
-        switch interactionState {
-        case .normal, .hovering:
-            color = .secondaryLabelColor
-        case .clicking:
-            color = .white
-        }
-        return Color(color)
-    }
-
-    func copy() {
-        NSPasteboard.general.declareTypes([.string], owner: nil)
-        NSPasteboard.general.setString(text, forType: .string)
-    }
-
-    private enum InteractionState {
-        case normal, hovering, clicking
-    }
-
-}
-
-#if DEBUG
-
-struct CopyableView_Previews: PreviewProvider {
-    static var previews: some View {
-        Group {
-            CopyableView(title: "Title", image: Image(systemName: "figure.wave"), text: "Hello world.")
-            CopyableView(title: "Title", image: Image(systemName: "figure.wave"), text: "Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. ")
-        }
-    }
-}
-
-#endif

Secretive/Views/CreateSecretView.swift

@@ -1,53 +0,0 @@
-import SwiftUI
-import SecretKit
-
-struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
-    
-    @ObservedObject var store: StoreType
-    @Binding var showing: Bool
-    
-    @State private var name = ""
-    @State private var requiresAuthentication = true
-
-    var body: some View {
-        VStack {
-            HStack {
-                Image(nsImage: NSApp.applicationIconImage)
-                    .resizable()
-                    .frame(width: 64, height: 64)
-                    .padding()
-                VStack {
-                    HStack {
-                        Text("Create a New Secret").bold()
-                        Spacer()
-                    }
-                    HStack {
-                        Text("Name:")
-                        TextField("Shhhhh", text: $name).focusable()
-                    }
-                    HStack {
-                        Toggle(isOn: $requiresAuthentication) {
-                            Text("Requires Authentication (Biometrics or Password)")
-                        }
-                        Spacer()
-                    }
-                }
-            }
-            HStack {
-                Spacer()
-                Button("Cancel") {
-                    showing = false
-                }
-                .keyboardShortcut(.cancelAction)
-                Button("Create", action: save)
-                    .disabled(name.isEmpty)
-                    .keyboardShortcut(.defaultAction)
-            }
-        }.padding()
-    }
-    
-    func save() {
-        try! store.create(name: name, requiresAuthentication: requiresAuthentication)
-        showing = false
-    }
-}

Secretive/Views/DeleteSecretView.swift

@@ -1,57 +0,0 @@
-import SwiftUI
-import SecretKit
-
-struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
-
-    @ObservedObject var store: StoreType
-    let secret: StoreType.SecretType
-    var dismissalBlock: (Bool) -> ()
-
-    @State private var confirm = ""
-
-    var body: some View {
-        VStack {
-            HStack {
-                Image(nsImage: NSApp.applicationIconImage)
-                    .resizable()
-                    .frame(width: 64, height: 64)
-                    .padding()
-                VStack {
-                    HStack {
-                        Text("Delete \(secret.name)?").bold()
-                        Spacer()
-                    }
-                    HStack {
-                        Text("If you delete \(secret.name), you will not be able to recover it. Type \"\(secret.name)\" to confirm.")
-                        Spacer()
-                    }
-                    HStack {
-                        Text("Confirm Name:")
-                        TextField(secret.name, text: $confirm)
-                    }
-                }
-                .onExitCommand {
-                    dismissalBlock(false)
-                }
-            }
-            HStack {
-                Spacer()
-                Button("Delete", action: delete)
-                    .disabled(confirm != secret.name)
-                    .keyboardShortcut(.delete)
-                Button("Don't Delete") {
-                    dismissalBlock(false)
-                }
-                .keyboardShortcut(.cancelAction)
-            }
-        }
-        .padding()
-        .frame(minWidth: 400)
-    }
-    
-    func delete() {
-        try! store.delete(secret: secret)
-        dismissalBlock(true)
-    }
-
-}

Secretive/Views/NoStoresView.swift

@@ -1,23 +0,0 @@
-import SwiftUI
-
-struct NoStoresView: View {
-
-    var body: some View {
-        VStack {
-            Text("No Secure Storage Available").bold()
-            Text("Your Mac doesn't have a Secure Enclave, and there's not a compatible Smart Card inserted.")
-            Link("If you're looking to add one to your Mac, the YubiKey 5 Series are great.", destination: URL(string: "https://www.yubico.com/products/compare-yubikey-5-series/")!)
-        }.padding()
-    }
-    
-}
-
-#if DEBUG
-
-struct NoStoresView_Previews: PreviewProvider {
-    static var previews: some View {
-        NoStoresView()
-    }
-}
-
-#endif

Secretive/Views/SecretDetailView.swift

@@ -1,43 +0,0 @@
-import SwiftUI
-import SecretKit
-
-struct SecretDetailView<SecretType: Secret>: View {
-    
-    @State var secret: SecretType
-
-    private let keyWriter = OpenSSHKeyWriter()
-    
-    var body: some View {
-        Form {
-            Section {
-                CopyableView(title: "Fingerprint", image: Image(systemName: "touchid"), text: keyWriter.openSSHFingerprint(secret: secret))
-                Spacer()
-                    .frame(height: 20)
-                CopyableView(title: "Public Key", image: Image(systemName: "key"), text: keyWriter.openSSHString(secret: secret))
-                Spacer()
-            }
-        }
-        .padding()
-        .frame(minHeight: 200, maxHeight: .infinity)
-    }
-    
-    var keyString: String {
-        keyWriter.openSSHString(secret: secret)
-    }
-    
-    func copy() {
-        NSPasteboard.general.declareTypes([.string], owner: nil)
-        NSPasteboard.general.setString(keyString, forType: .string)
-    }
-    
-}
-
-#if DEBUG
-
-struct SecretDetailView_Previews: PreviewProvider {
-    static var previews: some View {
-        SecretDetailView(secret: Preview.Store(numberOfRandomSecrets: 1).secrets[0])
-    }
-}
-
-#endif

Secretive/Views/SecretListView.swift

@@ -1,41 +0,0 @@
-import SwiftUI
-import SecretKit
-
-struct SecretListView: View {
-
-    @ObservedObject var store: AnySecretStore
-    @Binding var activeSecret: AnySecret.ID?
-    @Binding var deletingSecret: AnySecret?
-
-    var deletedSecret: (AnySecret) -> Void
-
-    var body: some View {
-        ForEach(store.secrets) { secret in
-            NavigationLink(destination: SecretDetailView(secret: secret), tag: secret.id, selection: $activeSecret) {
-                Text(secret.name)
-            }.contextMenu {
-                if store is AnySecretStoreModifiable {
-                    Button(action: { delete(secret: secret) }) {
-                        Text("Delete")
-                    }
-                }
-            }
-            .popover(isPresented: .constant(deletingSecret == secret)) {
-                if let modifiable = store as? AnySecretStoreModifiable {
-                    DeleteSecretView(store: modifiable, secret: secret) { deleted in
-                        deletingSecret = nil
-                        if deleted {
-                            deletedSecret(AnySecret(secret))
-                        }
-                    }
-                }
-            }
-
-        }
-    }
-
-    func delete<SecretType: Secret>(secret: SecretType) {
-        deletingSecret = AnySecret(secret)
-    }
-
-}

Secretive/Views/SetupView.swift

@@ -1,296 +0,0 @@
-import SwiftUI
-
-struct SetupView: View {
-
-    @State var stepIndex = 0
-    @Binding var visible: Bool
-    @Binding var setupComplete: Bool
-
-    var body: some View {
-        GeometryReader { proxy in
-            VStack {
-                StepView(numberOfSteps: 3, currentStep: stepIndex, width: proxy.size.width)
-                GeometryReader { _ in
-                    HStack(spacing: 0) {
-                        SecretAgentSetupView(buttonAction: advance)
-                            .frame(width: proxy.size.width)
-                        SSHAgentSetupView(buttonAction: advance)
-                            .frame(width: proxy.size.width)
-                        UpdaterExplainerView {
-                            visible = false
-                            setupComplete = true
-                        }
-                        .frame(width: proxy.size.width)
-                    }
-                    .offset(x: -proxy.size.width * CGFloat(stepIndex), y: 0)
-                }
-            }
-        }
-        .frame(idealWidth: 500, idealHeight: 500)
-    }
-
-
-    func advance() {
-        withAnimation(.spring()) {
-            stepIndex += 1
-        }
-    }
-
-}
-
-struct StepView: View {
-
-    let numberOfSteps: Int
-    let currentStep: Int
-
-    // Ideally we'd have a geometry reader inside this view doing this for us, but that crashes on 11.0b7
-    let width: CGFloat
-
-    var body: some View {
-        ZStack(alignment: .leading) {
-            Rectangle()
-                .foregroundColor(.blue)
-                .frame(height: 5)
-            Rectangle()
-                .foregroundColor(.green)
-                .frame(width: max(0, ((width - (Constants.padding * 2)) / CGFloat(numberOfSteps - 1)) * CGFloat(currentStep) - (Constants.circleWidth / 2)), height: 5)
-                .animation(.spring())
-            HStack {
-                ForEach(0..<numberOfSteps) { index in
-                    ZStack {
-                        if currentStep > index {
-                            Circle()
-                                .foregroundColor(.green)
-                                .frame(width: Constants.circleWidth, height: Constants.circleWidth)
-                            Text("✓")
-                                .foregroundColor(.white)
-                                .bold()
-                        } else {
-                            Circle()
-                                .foregroundColor(.blue)
-                                .frame(width: Constants.circleWidth, height: Constants.circleWidth)
-                            if currentStep == index {
-                                Circle()
-                                    .strokeBorder(Color.white, lineWidth: 3)
-                                    .frame(width: Constants.circleWidth, height: Constants.circleWidth)
-                            }
-                            Text(String(describing: index + 1))
-                                .foregroundColor(.white)
-                                .bold()
-                        }
-                    }
-                    if index < numberOfSteps - 1 {
-                        Spacer(minLength: 30)
-                    }
-                }
-            }
-        }.padding(Constants.padding)
-    }
-
-}
-
-extension StepView {
-
-    enum Constants {
-
-        static let padding: CGFloat = 15
-        static let circleWidth: CGFloat = 30
-
-    }
-
-}
-
-struct SetupStepView<Content> : View where Content : View {
-
-    let title: String
-    let image: Image
-    let bodyText: String
-    let buttonTitle: String
-    let buttonAction: () -> Void
-    let content: Content
-
-    init(title: String, image: Image, bodyText: String, buttonTitle: String, buttonAction: @escaping () -> Void = {}, @ViewBuilder content: () -> Content) {
-        self.title = title
-        self.image = image
-        self.bodyText = bodyText
-        self.buttonTitle = buttonTitle
-        self.buttonAction = buttonAction
-        self.content = content()
-    }
-
-    var body: some View {
-        VStack {
-            Text(title)
-                .font(.title)
-            Spacer()
-            image
-                .resizable()
-                .aspectRatio(contentMode: .fit)
-                .frame(width: 64)
-            Spacer()
-            Text(bodyText)
-                .multilineTextAlignment(.center)
-            Spacer()
-            content
-            Spacer()
-            Button(buttonTitle) {
-                buttonAction()
-            }
-        }.padding()
-    }
-
-}
-
-struct SecretAgentSetupView: View {
-
-    let buttonAction: () -> Void
-
-    var body: some View {
-        SetupStepView(title: "Setup Secret Agent",
-                      image: Image(nsImage: NSApp.applicationIconImage),
-                      bodyText: "Secretive needs to set up a helper app to work properly. It will sign requests from SSH clients in the background, so you don't need to keep the main Secretive app open.",
-                      buttonTitle: "Install",
-                      buttonAction: install) {
-            (Text("This helper app is called ") + Text("Secret Agent").bold().underline() + Text(" and you may see it in Activity Manager from time to time."))
-                .multilineTextAlignment(.center)
-        }
-    }
-
-    func install() {
-        LaunchAgentController().install()
-        buttonAction()
-    }
-
-}
-
-struct SSHAgentSetupView: View {
-
-    let buttonAction: () -> Void
-
-    private static let controller = ShellConfigurationController()
-    @State private var selectedShellInstruction: ShellConfigInstruction = controller.shellInstructions.first!
-
-    var body: some View {
-        SetupStepView(title: "Configure your SSH Agent",
-                      image: Image(systemName: "terminal"),
-                      bodyText: "Add this line to your shell config telling SSH to talk to Secret Agent when it wants to authenticate. Secretive can either do this for you automatically, or you can copy and paste this into your config file.",
-                      buttonTitle: "I Added it Manually",
-                      buttonAction: buttonAction) {
-        Link("If you're trying to set up a third party app, check out the FAQ.", destination: URL(string: "https://github.com/maxgoedjen/secretive/blob/main/APP_CONFIG.md")!)
-            Picker(selection: $selectedShellInstruction, label: EmptyView()) {
-                ForEach(SSHAgentSetupView.controller.shellInstructions) { instruction in
-                    Text(instruction.shell)
-                        .tag(instruction)
-                        .padding()
-                }
-            }.pickerStyle(SegmentedPickerStyle())
-            CopyableView(title: "Add to \(selectedShellInstruction.shellConfigPath)", image: Image(systemName: "greaterthan.square"), text: selectedShellInstruction.text)
-            Button("Add it For Me") {
-                let controller = ShellConfigurationController()
-                if controller.addToShell(shellInstructions: selectedShellInstruction) {
-                    buttonAction()
-                }
-            }
-        }
-    }
-
-}
-
-class Delegate: NSObject, NSOpenSavePanelDelegate {
-
-    private let name: String
-
-    init(name: String) {
-        self.name = name
-    }
-
-    func panel(_ sender: Any, shouldEnable url: URL) -> Bool {
-        return url.lastPathComponent == name
-    }
-
-}
-
-struct UpdaterExplainerView: View {
-
-    let buttonAction: () -> Void
-
-    var body: some View {
-        SetupStepView(title: "Updates",
-                      image: Image(systemName: "dot.radiowaves.left.and.right"),
-                      bodyText: "Secretive will periodically check with GitHub to see if there's a new release. If you see any network requests to GitHub, that's why.",
-                      buttonTitle: "Okay",
-                      buttonAction: buttonAction) {
-            Link("Read more about this here.", destination: SetupView.Constants.updaterFAQURL)
-        }
-    }
-
-}
-
-extension SetupView {
-
-    enum Constants {
-        static let updaterFAQURL = URL(string: "https://github.com/maxgoedjen/secretive/blob/main/FAQ.md#whats-this-network-request-to-github")!
-    }
-
-}
-
-struct ShellConfigInstruction: Identifiable, Hashable {
-
-    var shell: String
-    var shellConfigDirectory: String
-    var shellConfigFilename: String
-    var text: String
-
-    var id: String {
-        shell
-    }
-
-    var shellConfigPath: String {
-        return (shellConfigDirectory as NSString).appendingPathComponent(shellConfigFilename)
-    }
-
-}
-
-#if DEBUG
-
-struct SetupView_Previews: PreviewProvider {
-
-    static var previews: some View {
-        Group {
-            SetupView(visible: .constant(true), setupComplete: .constant(false))
-        }
-    }
-
-}
-
-struct SecretAgentSetupView_Previews: PreviewProvider {
-
-    static var previews: some View {
-        Group {
-            SecretAgentSetupView(buttonAction: {})
-        }
-    }
-
-}
-
-struct SSHAgentSetupView_Previews: PreviewProvider {
-
-    static var previews: some View {
-        Group {
-            SSHAgentSetupView(buttonAction: {})
-        }
-    }
-
-}
-
-struct UpdaterExplainerView_Previews: PreviewProvider {
-
-    static var previews: some View {
-        Group {
-            UpdaterExplainerView(buttonAction: {})
-        }
-    }
-    
-}
-
-#endif

Secretive/Views/StoreListView.swift

@@ -1,53 +0,0 @@
-import SwiftUI
-import SecretKit
-
-struct StoreListView: View {
-
-    @Binding var showingCreation: Bool
-    
-    @State private var activeSecret: AnySecret.ID?
-    @State private var deletingSecret: AnySecret?
-
-    @EnvironmentObject private var storeList: SecretStoreList
-
-    var body: some View {
-        NavigationView {
-            List(selection: $activeSecret) {
-                ForEach(storeList.stores) { store in
-                    if store.isAvailable {
-                        Section(header: Text(store.name)) {
-                            if store.secrets.isEmpty {
-                                EmptyStoreView(store: store, activeSecret: $activeSecret)
-                            } else {
-                                SecretListView(store: store, activeSecret: $activeSecret, deletingSecret: $deletingSecret, deletedSecret: { _ in
-                                    activeSecret = nextDefaultSecret
-                                })
-                            }
-                        }
-                    }
-                }
-            }
-            .listStyle(SidebarListStyle())
-            .onAppear {
-                activeSecret = nextDefaultSecret
-            }
-            .frame(minWidth: 100, idealWidth: 240)
-        }
-
-    }
-
-}
-
-extension StoreListView {
-
-    var nextDefaultSecret: AnyHashable? {
-        let fallback: AnyHashable
-        if storeList.modifiableStore?.isAvailable ?? false {
-            fallback = EmptyStoreView.Constants.emptyStoreModifiableTag
-        } else {
-            fallback = EmptyStoreView.Constants.emptyStoreTag
-        }
-        return storeList.stores.compactMap(\.secrets.first).first?.id ?? fallback
-    }
-    
-}

Secretive/Views/UpdateView.swift

@@ -1,61 +0,0 @@
-import SwiftUI
-import Brief
-
-struct UpdateDetailView<UpdaterType: Updater>: View {
-
-    @EnvironmentObject var updater: UpdaterType
-
-    let update: Release
-
-    var body: some View {
-        VStack {
-            Text("Secretive \(update.name)").font(.title)
-            GroupBox(label: Text("Release Notes")) {
-                ScrollView {
-                    attributedBody
-                }
-            }
-            HStack {
-                if !update.critical {
-                    Button("Ignore") {
-                        updater.ignore(release: update)
-                    }
-                    Spacer()
-                }
-                Button("Update") {
-                    NSWorkspace.shared.open(update.html_url)
-                }
-                .keyboardShortcut(.defaultAction)
-            }
-            
-        }
-        .padding()
-        .frame(maxWidth: 500)
-    }
-
-    var attributedBody: Text {
-        var text = Text("")
-        for line in update.body.split(whereSeparator: \.isNewline) {
-            let attributed: Text
-            let split = line.split(separator: " ")
-            let unprefixed = split.dropFirst().joined()
-            if let prefix = split.first {
-                switch prefix {
-                case "#":
-                    attributed = Text(unprefixed).font(.title) + Text("\n")
-                case "##":
-                    attributed = Text(unprefixed).font(.title2) + Text("\n")
-                case "###":
-                    attributed = Text(unprefixed).font(.title3) + Text("\n")
-                default:
-                    attributed = Text(line) + Text("\n\n")
-                }
-            } else {
-                attributed = Text(line) + Text("\n\n")
-            }
-            text = text + attributed
-        }
-        return text
-    }
-
-}

SecretiveTests/Info.plist

@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>$(DEVELOPMENT_LANGUAGE)</string>
-	<key>CFBundleExecutable</key>
-	<string>$(EXECUTABLE_NAME)</string>
-	<key>CFBundleIdentifier</key>
-	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>$(PRODUCT_NAME)</string>
-	<key>CFBundlePackageType</key>
-	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
-	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
-	<key>CFBundleVersion</key>
-	<string>1</string>
-</dict>
-</plist>

SecretiveTests/SecretiveTests.swift

@@ -1,20 +0,0 @@
-import XCTest
-@testable import Secretive
-
-class SecretiveTests: XCTestCase {
-
-    override func setUp() {
-        // Put setup code here. This method is called before the invocation of each test method in the class.
-    }
-
-    override func tearDown() {
-        // Put teardown code here. This method is called after the invocation of each test method in the class.
-    }
-
-    func testExample() {
-        // This is an example of a functional test case.
-        // Use XCTAssert and related functions to verify your tests produce the correct results.
-    }
-
-
-}

Sources/Config/Config.xcconfig

@@ -1,2 +1,3 @@
 CI_VERSION = GITHUB_CI_VERSION
 CI_BUILD_NUMBER = GITHUB_BUILD_NUMBER
+CI_BUILD_LINK = GITHUB_BUILD_URL

Sources/Config/Secretive.xctestplan

@@ -0,0 +1,38 @@
+{
+  "configurations" : [
+    {
+      "id" : "5896AE5A-6D5A-48D3-837B-668B646A3273",
+      "name" : "Configuration 1",
+      "options" : {
+
+      }
+    }
+  ],
+  "defaultOptions" : {
+
+  },
+  "testTargets" : [
+    {
+      "target" : {
+        "containerPath" : "container:Packages",
+        "identifier" : "BriefTests",
+        "name" : "BriefTests"
+      }
+    },
+    {
+      "target" : {
+        "containerPath" : "container:Packages",
+        "identifier" : "SecretKitTests",
+        "name" : "SecretKitTests"
+      }
+    },
+    {
+      "target" : {
+        "containerPath" : "container:Packages",
+        "identifier" : "SecretAgentKitTests",
+        "name" : "SecretAgentKitTests"
+      }
+    }
+  ],
+  "version" : 1
+}

Sources/Packages/Package.swift

@@ -0,0 +1,95 @@
+// swift-tools-version:6.2
+// The swift-tools-version declares the minimum version of Swift required to build this package.
+
+import PackageDescription
+
+let package = Package(
+    name: "SecretivePackages",
+    defaultLocalization: "en",
+    platforms: [
+        .macOS(.v14)
+    ],
+    products: [
+        .library(
+            name: "SecretKit",
+            targets: ["SecretKit"]),
+        .library(
+            name: "SecureEnclaveSecretKit",
+            targets: ["SecureEnclaveSecretKit"]),
+        .library(
+            name: "SmartCardSecretKit",
+            targets: ["SmartCardSecretKit"]),
+        .library(
+            name: "SecretAgentKit",
+            targets: ["SecretAgentKit", "XPCWrappers"]),
+        .library(
+            name: "Brief",
+            targets: ["Brief"]),
+        .library(
+            name: "XPCWrappers",
+            targets: ["XPCWrappers"]),
+    ],
+    dependencies: [
+    ],
+    targets: [
+        .target(
+            name: "SecretKit",
+            dependencies: [],
+            resources: [localization],
+            swiftSettings: swiftSettings,
+        ),
+        .testTarget(
+            name: "SecretKitTests",
+            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
+            swiftSettings: swiftSettings,
+        ),
+        .target(
+            name: "SecureEnclaveSecretKit",
+            dependencies: ["SecretKit"],
+            resources: [localization],
+            swiftSettings: swiftSettings,
+        ),
+        .target(
+            name: "SmartCardSecretKit",
+            dependencies: ["SecretKit"],
+            resources: [localization],
+            swiftSettings: swiftSettings,
+        ),
+        .target(
+            name: "SecretAgentKit",
+            dependencies: ["SecretKit"],
+            resources: [localization],
+            swiftSettings: swiftSettings,
+        ),
+        .testTarget(
+            name: "SecretAgentKitTests",
+            dependencies: ["SecretAgentKit"],
+        ),
+        .target(
+            name: "Brief",
+            dependencies: ["XPCWrappers"],
+            resources: [localization],
+            swiftSettings: swiftSettings,
+        ),
+        .testTarget(
+            name: "BriefTests",
+            dependencies: ["Brief"],
+        ),
+        .target(
+            name: "XPCWrappers",
+            swiftSettings: swiftSettings,
+        ),
+    ]
+)
+
+var localization: Resource {
+    .process("../../Resources/Localizable.xcstrings")
+}
+
+var swiftSettings: [PackageDescription.SwiftSetting] {
+    [
+        .swiftLanguageMode(.v6),
+        .treatAllWarnings(as: .error),
+        .strictMemorySafety()
+    ]
+}

Sources/Packages/Sources/Brief/Documentation.docc/Documentation.md

@@ -0,0 +1,15 @@
+# ``Brief``
+
+Brief is a collection of protocols and concrete implmentation describing updates.
+
+## Topics
+
+### Versioning
+
+- ``SemVer``
+- ``Release``
+
+### Updater
+
+- ``UpdaterProtocol``
+- ``Updater``

Sources/Packages/Sources/Brief/Release.swift

@@ -0,0 +1,133 @@
+import Foundation
+import SwiftUI
+
+/// A release is a representation of a downloadable update.
+public struct Release: Codable, Sendable, Hashable {
+
+    /// The user-facing name of the release. Typically "Secretive 1.2.3"
+    public let name: String
+
+    /// A boolean describing whether or not the release is a prerelase build.
+    public let prerelease: Bool
+
+    /// A URL pointing to the HTML page for the release.
+    public let html_url: URL
+
+    /// A user-facing description of the contents of the update.
+    public let body: String
+
+    public let attributedBody: AttributedString
+
+    /// Initializes a Release.
+    /// - Parameters:
+    ///   - name: The user-facing name of the release.
+    ///   - prerelease: A boolean describing whether or not the release is a prerelase build.
+    ///   - html_url: A URL pointing to the HTML page for the release.
+    ///   - body: A user-facing description of the contents of the update.
+    public init(name: String, prerelease: Bool, html_url: URL, body: String) {
+        self.name = name
+        self.prerelease = prerelease
+        self.html_url = html_url
+        self.body = body
+        self.attributedBody = AttributedString(_markdown: body)
+    }
+
+    public init(_ release: GitHubRelease) {
+        self.name = release.name
+        self.prerelease = release.prerelease
+        self.html_url = release.html_url
+        self.body = release.body
+        self.attributedBody = AttributedString(_markdown: release.body)
+    }
+
+}
+
+public struct GitHubRelease: Codable, Sendable {
+    let name: String
+    let prerelease: Bool
+    let html_url: URL
+    let body: String
+}
+
+fileprivate extension AttributedString {
+
+    init(_markdown markdown: String) {
+        let split = markdown.split(whereSeparator: \.isNewline)
+        let lines = split
+            .compactMap {
+                try? AttributedString(markdown: String($0), options: .init(allowsExtendedAttributes: true, interpretedSyntax: .full))
+            }
+            .map { (string: AttributedString) in
+                guard case let .header(level) = string.runs.first?.presentationIntent?.components.first?.kind else { return string }
+                return AttributedString("\n") + string
+                    .transformingAttributes(\.font) { font in
+                        font.value = switch level {
+                        case 2: .headline.bold()
+                        case 3: .headline
+                        default: .subheadline
+                        }
+                    }
+                    .transformingAttributes(\.underlineStyle) { underline in
+                        underline.value = switch level {
+                        case 2: .single
+                        default: .none
+                        }
+                    }
+                + AttributedString("\n")
+            }
+        self = lines.reduce(into: AttributedString()) { partialResult, next in
+            partialResult.append(next)
+            partialResult.append(AttributedString("\n"))
+        }
+    }
+
+}
+
+extension Release: Identifiable {
+
+    public var id: String {
+        html_url.absoluteString
+    }
+
+}
+
+extension Release: Comparable {
+
+    public static func < (lhs: Release, rhs: Release) -> Bool {
+        lhs.version < rhs.version
+    }
+
+}
+
+extension Release {
+
+    /// A boolean describing whether or not the release contains critical security content.
+    /// - Note: this is determined by the presence of the phrase "Critical Security Update" in the ``body``.
+    /// - Warning: If this property is true, the user will not be able to dismiss UI or reminders associated with the update.
+    public var critical: Bool {
+        body.contains(Constants.securityContent)
+    }
+
+    /// A ``SemVer`` representation of the version number of the release.
+    public var version: SemVer {
+        SemVer(name)
+    }
+
+    /// The minimum macOS version required to run the update.
+    public var minimumOSVersion: SemVer {
+        guard let range = body.range(of: "Minimum macOS Version"),
+              let numberStart = body.rangeOfCharacter(from: CharacterSet.decimalDigits, options: [], range: range.upperBound..<body.endIndex) else { return SemVer("11.0.0") }
+        let numbersEnd = body.rangeOfCharacter(from: CharacterSet.whitespacesAndNewlines, options: [], range: numberStart.upperBound..<body.endIndex)?.lowerBound ?? body.endIndex
+        let version = numberStart.lowerBound..<numbersEnd
+        return SemVer(String(body[version]))
+    }
+
+}
+
+extension Release {
+
+    enum Constants {
+        static let securityContent = "Critical Security Update"
+    }
+
+}

Sources/Packages/Sources/Brief/SemVer.swift

@@ -0,0 +1,52 @@
+import Foundation
+
+/// A representation of a Semantic Version.
+public struct SemVer: Sendable {
+
+    /// The SemVer broken into an array of integers.
+    let versionNumbers: [Int]
+    public let previewDescription: String?
+
+    public var isTestBuild: Bool {
+        versionNumbers == [0, 0, 0]
+    }
+
+    /// Initializes a SemVer from a string representation.
+    /// - Parameter version: A string representation of the SemVer, formatted as "major.minor.patch".
+    public init(_ version: String) {
+        // Betas have the format 1.2.3_beta1
+        // Nightlies have the format 0.0.0_nightly-2025-09-03
+        let splitFull = version.split(separator: "_")
+        let strippedBeta = splitFull.first!
+        previewDescription = splitFull.count > 1 ? String(splitFull[1]) : nil
+        var split = strippedBeta.split(separator: ".").compactMap { Int($0) }
+        while split.count < 3 {
+            split.append(0)
+        }
+        versionNumbers = split
+    }
+
+    /// Initializes a SemVer from an `OperatingSystemVersion` representation.
+    /// - Parameter version: An  `OperatingSystemVersion` representation of the SemVer.
+    public init(_ version: OperatingSystemVersion) {
+        versionNumbers = [version.majorVersion, version.minorVersion, version.patchVersion]
+        previewDescription = nil
+    }
+
+}
+
+extension SemVer: Comparable {
+
+    public static func < (lhs: SemVer, rhs: SemVer) -> Bool {
+        for (latest, current) in zip(lhs.versionNumbers, rhs.versionNumbers) {
+            if latest < current {
+                return true
+            } else if latest > current {
+                return false
+            }
+        }
+        return false
+    }
+
+
+}

Sources/Packages/Sources/Brief/Updater.swift

@@ -0,0 +1,101 @@
+import Foundation
+import Observation
+import XPCWrappers
+
+/// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version.
+@Observable public final class Updater: UpdaterProtocol, Sendable {
+
+    private let state = State()
+    @MainActor @Observable public final class State {
+        var update: Release? = nil
+        nonisolated init() {}
+    }
+    public var update: Release? {
+        state.update
+    }
+
+    /// The current version of the app that is running.
+    public let currentVersion: SemVer
+
+    /// The current OS version.
+    private let osVersion: SemVer
+
+    /// Initializes an Updater.
+    /// - Parameters:
+    ///   - checkOnLaunch: A boolean describing whether the Updater should check for available updates on launch.
+    ///   - checkFrequency: The interval at which the Updater should check for updates. Subject to a tolerance of 1 hour.
+    ///   - osVersion: The current OS version.
+    ///   - currentVersion: The current version of the app that is running.
+    public init(
+        checkOnLaunch: Bool,
+        checkFrequency: TimeInterval = Measurement(value: 24, unit: UnitDuration.hours).converted(to: .seconds).value,
+        osVersion: SemVer = SemVer(ProcessInfo.processInfo.operatingSystemVersion),
+        currentVersion: SemVer = SemVer(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.0.0")
+    ) {
+        self.osVersion = osVersion
+        self.currentVersion = currentVersion
+        Task {
+            if checkOnLaunch {
+                try await checkForUpdates()
+            }
+            while !Task.isCancelled {
+                try? await Task.sleep(for: .seconds(Int(checkFrequency)))
+                try await checkForUpdates()
+            }
+        }
+    }
+
+    /// Manually trigger an update check.
+    public func checkForUpdates() async throws {
+        let session = try await XPCTypedSession<[Release], Never>(serviceName: "com.maxgoedjen.Secretive.SecretiveUpdater")
+        await evaluate(releases: try await session.send())
+        session.complete()
+    }
+
+
+    /// Ignores a specified release. `update` will be nil if the user has ignored the latest available release.
+    /// - Parameter release: The release to ignore.
+    public func ignore(release: Release) async {
+        guard !release.critical else { return }
+        defaults.set(true, forKey: release.name)
+        await MainActor.run {
+            state.update = nil
+        }
+    }
+
+}
+
+extension Updater {
+
+    /// Evaluates the available downloadable releases, and selects the newest non-prerelease release that the user is able to run.
+    /// - Parameter releases: An array of ``Release`` objects.
+    func evaluate(releases: [Release]) async {
+        guard let release = releases
+                .sorted()
+                .reversed()
+                .filter({ !$0.prerelease })
+                .first(where: { $0.minimumOSVersion <= osVersion }) else { return }
+        guard !userIgnored(release: release) else { return }
+        guard !release.prerelease else { return }
+        let latestVersion = SemVer(release.name)
+        if latestVersion > currentVersion {
+            await MainActor.run {
+                state.update = release
+            }
+        }
+    }
+
+    /// Checks whether the user has ignored a release.
+    /// - Parameter release: The release to check.
+    /// - Returns: A boolean describing whether the user has ignored the release. Will always be false if the release is critical.
+    func userIgnored(release: Release) -> Bool {
+        guard !release.critical else { return false }
+        return defaults.bool(forKey: release.name)
+    }
+
+    /// The user defaults used to store user ignore state.
+    var defaults: UserDefaults {
+        UserDefaults(suiteName: "com.maxgoedjen.Secretive.updater.ignorelist")!
+    }
+
+}

Sources/Packages/Sources/Brief/UpdaterProtocol.swift

@@ -0,0 +1,13 @@
+import Foundation
+
+/// A protocol for retreiving the latest available version of an app.
+public protocol UpdaterProtocol: Observable, Sendable {
+
+    /// The latest update
+    @MainActor var update: Release? { get }
+
+    var currentVersion: SemVer { get }
+
+    func ignore(release: Release) async
+}
+

Sources/Packages/Sources/SecretAgentKit/Agent.swift

@@ -0,0 +1,157 @@
+import Foundation
+import CryptoKit
+import OSLog
+import SecretKit
+import AppKit
+
+/// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores.
+public final class Agent: Sendable {
+
+    private let storeList: SecretStoreList
+    private let witness: SigningWitness?
+    private let publicKeyWriter = OpenSSHPublicKeyWriter()
+    private let signatureWriter = OpenSSHSignatureWriter()
+    private let certificateHandler = OpenSSHCertificateHandler()
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "Agent")
+
+    /// Initializes an agent with a store list and a witness.
+    /// - Parameters:
+    ///   - storeList: The `SecretStoreList` to make available.
+    ///   - witness: A witness to notify of requests.
+    public init(storeList: SecretStoreList, witness: SigningWitness? = nil) {
+        logger.debug("Agent is running")
+        self.storeList = storeList
+        self.witness = witness
+        Task { @MainActor in
+            await certificateHandler.reloadCertificates(for: storeList.allSecrets)
+        }
+    }
+    
+}
+
+extension Agent {
+
+    public func handle(request: SSHAgent.Request, provenance: SigningRequestProvenance) async -> Data {
+        // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
+        await reloadSecretsIfNeccessary()
+        var response = Data()
+        do {
+            switch request {
+            case .requestIdentities:
+                response.append(SSHAgent.Response.agentIdentitiesAnswer.data)
+                response.append(await identities())
+                logger.debug("Agent returned \(SSHAgent.Response.agentIdentitiesAnswer.debugDescription)")
+            case .signRequest(let context):
+                response.append(SSHAgent.Response.agentSignResponse.data)
+                response.append(try await sign(data: context.dataToSign, keyBlob: context.keyBlob, provenance: provenance))
+                logger.debug("Agent returned \(SSHAgent.Response.agentSignResponse.debugDescription)")
+            case .unknown(let value):
+                logger.error("Agent received unknown request of type \(value).")
+                throw UnhandledRequestError()
+            default:
+                logger.debug("Agent received valid request of type \(request.debugDescription), but not currently supported.")
+                throw UnhandledRequestError()
+            }
+        } catch {
+            response = SSHAgent.Response.agentFailure.data
+            logger.debug("Agent returned \(SSHAgent.Response.agentFailure.debugDescription)")
+        }
+        return response.lengthAndData
+    }
+
+}
+
+extension Agent {
+
+    /// Lists the identities available for signing operations
+    /// - Returns: An OpenSSH formatted Data payload listing the identities available for signing operations.
+    func identities() async -> Data {
+        let secrets = await storeList.allSecrets
+        await certificateHandler.reloadCertificates(for: secrets)
+        var count = 0
+        var keyData = Data()
+
+        for secret in secrets {
+            let keyBlob = publicKeyWriter.data(secret: secret)
+            keyData.append(keyBlob.lengthAndData)
+            keyData.append(publicKeyWriter.comment(secret: secret).lengthAndData)
+            count += 1
+
+            if let (certificateData, name) = try? await certificateHandler.keyBlobAndName(for: secret) {
+                keyData.append(certificateData.lengthAndData)
+                keyData.append(name.lengthAndData)
+                count += 1
+            }
+        }
+        logger.log("Agent enumerated \(count) identities")
+        var countBigEndian = UInt32(count).bigEndian
+        let countData = unsafe Data(bytes: &countBigEndian, count: MemoryLayout<UInt32>.size)
+        return countData + keyData
+    }
+
+    /// Notifies witnesses of a pending signature request, and performs the signing operation if none object.
+    /// - Parameters:
+    ///   - data: The data to sign.
+    ///   - provenance: A ``SecretKit.SigningRequestProvenance`` object describing the origin of the request.
+    /// - Returns: An OpenSSH formatted Data payload containing the signed data response.
+    func sign(data: Data, keyBlob: Data, provenance: SigningRequestProvenance) async throws -> Data {
+        guard let (secret, store) = await secret(matching: keyBlob) else {
+            let keyBlobHex = keyBlob.compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }.joined()
+            logger.debug("Agent did not have a key matching \(keyBlobHex)")
+            throw NoMatchingKeyError()
+        }
+
+        try await witness?.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
+
+        let rawRepresentation = try await store.sign(data: data, with: secret, for: provenance)
+        let signedData = signatureWriter.data(secret: secret, signature: rawRepresentation)
+
+        try await witness?.witness(accessTo: secret, from: store, by: provenance)
+
+        logger.debug("Agent signed request")
+
+        return signedData
+    }
+
+}
+
+extension Agent {
+
+    /// Gives any store with no loaded secrets a chance to reload.
+    func reloadSecretsIfNeccessary() async {
+        for store in await storeList.stores {
+            if await store.secrets.isEmpty {
+                let name = await store.name
+                logger.debug("Store \(name, privacy: .public) has no loaded secrets. Reloading.")
+                await store.reloadSecrets()
+            }
+        }
+    }
+
+    /// Finds a ``Secret`` matching a specified hash whos signature was requested.
+    /// - Parameter hash: The hash to match against.
+    /// - Returns: A ``Secret`` and the ``SecretStore`` containing it, if a match is found.
+    func secret(matching hash: Data) async -> (AnySecret, AnySecretStore)? {
+        await storeList.allSecretsWithStores.first {
+            hash == publicKeyWriter.data(secret: $0.0)
+        }
+    }
+
+}
+
+
+extension Agent {
+
+    struct NoMatchingKeyError: Error {}
+    struct UnhandledRequestError: Error {}
+
+}
+
+extension SSHAgent.Response {
+
+    var data: Data {
+        var raw = self.rawValue
+        return unsafe Data(bytes: &raw, count: MemoryLayout<UInt8>.size)
+    }
+
+}