XcodesApp is a native macOS SwiftUI application for discovering, downloading, installing, selecting, and uninstalling multiple versions of Apple's Xcode, including management of the iOS simulator runtimes that ship with them. The app surfaces a list of available Xcode versions (from the Xcode Releases API or the Apple Developer portal), drives the full install pipeline (download via URLSession or the bundled aria2c, verify code signature, unxip archive, move into /Applications, run elevated post-install steps), switches the active developer directory, and supports Apple ID sign-in with 2FA, SMS, security keys, and federated authentication. This repository is the app shell and privileged-helper layer; core domain logic and authentication live in the separate XcodesKit and XcodesLoginKit packages. The architecture is a clean three-part split. Xcodes/Backend holds a central observable AppState coordinator and small subsystems (downloader, helper client, process runner, dependency-injection environment); Xcodes/Frontend is a SwiftUI view layer organized into list, info pane, sign-in, and preferences modules; com.xcodesorg.xcodesapp.Helper is a separate privileged XPC service installed via SMJobBless, with peer connections verified by code-signing designated requirements and audit-token comparison before any xcode-select, license-accept, or file-operation work is performed. Update delivery uses Sparkle with a Jekyll-generated appcast hosted on GitHub Pages. The codebase is well engineered for a GUI app: the Environment/Current dependency-injection seam makes nearly all side effects mockable, and the test suite is unusually thorough, covering SRP authentication vectors from real Apple ID sessions, stale-async-task race conditions, new-version notifications, and download/install state transitions. The main weaknesses are the reliance on the private NSXPCConnection.auditToken API, several SPM dependencies pinned to main branches, some duplicated view helpers and stale branding text (RobotsAndPencils references, a hardcoded WWDC 2022 status message), and a manual multi-step release process. Maintenance is active: recent commits, CI running on the latest macOS/Xcode runners, Dependabot config, release-drafter workflow, and xcstrings localization validation. Technical drift is low — the code aggressively tracks current Apple platforms (macOS 26 branches, Xcode 26.5 CI), though the private-API usage and main-branch dependency pins remain chronic medium-term risks.