$ show maxgoedjen/secretive
Secretive is a macOS application that stores SSH private keys in the Apple Secure Enclave (or on smart cards such as YubiKeys) and exposes them through an SSH agent, making private key material non-exportable by hardware design. The architecture is a main SwiftUI management app (Secretive) plus a background login-item agent (SecretAgent) that owns a Unix socket at ~/Library/Containers/.../socket.ssh. SSH clients connect to this socket; the agent parses the SSH agent wire protocol, matches the requested key, enforces the key's access-control policy (Touch ID, Apple Watch, or password), has the Secure Enclave produce the signature, and returns an OpenSSH-formatted response. All untrusted input parsing (agent messages, certificate files) is delegated to sandboxed XPC services with hard-coded code-signing requirements, and network access for update checks is isolated to a dedicated XPC service with a declared Internet Access Policy. The code is Swift 6 with strict concurrency, strict memory safety, and warnings-as-errors, and has zero third-party dependencies by explicit project policy. The codebase is organized into small Swift packages: SecretKit (protocols and type erasers for secrets/stores), SecureEnclaveSecretKit and SmartCardSecretKit (concrete key stores), SSHProtocolKit (binary encoding/decoding of OpenSSH keys, certificates, signatures, and the agent protocol), SecretAgentKit (the agent, socket controller, authentication batcher, request-provenance tracer), XPCWrappers (a typed Codable RPC layer over NSXPCConnection), SettingsKit (keychain-backed settings), and Brief (semver update checking). Several of these are cleanly isolated: OpenSSHReader, SemVer, the FormatStyle data formatters, the keychain-backed SettingsStore, and the typed XPC session wrapper could be lifted into new projects largely untouched. The signature writer's mpint encoding correctly handles OpenSSH's signed-bignum rules (stripping leading zero bytes, prefixing 0x00 when the sign bit is set), which is subtle and covered by dedicated tests. Tests use real captured binary fixtures for protocol compatibility and cover agent identity listing, signing, witness objection behavior, authentication batching, and update selection logic. CI runs tests, CodeQL, nightly notarized builds, and attestation-backed auditable releases. Minor soft spots include duplicated certificate-migration code, two different SecretAgent entry points (SwiftUI App and AppDelegate), and a parsed-but-disabled session-bind extension, indicating ongoing refactoring rather than architectural debt.
The LLM identified 5 files worth highlighting for reuse:
A self-contained reader for OpenSSH's length-prefixed binary wire format. Imports only Foundation, maintains a cursor over remaining data, reads fixed-width big-endian integers, strings, and nested sub-readers, and throws typed errors on truncation. It is the shared foundation for all SSH agent message, certificate, and signature decoding in the project, and could be extracted into any project needing to decode SSH-style binary payloads.
A typed, Codable-safe wrapper around NSXPCConnection that turns Apple's untyped XPC proxy into a generic async API: send(_:) async throws -> Response, with module-specific Codable errors unwrapped from the transport layer and optional service warm-up. Paired with XPCServiceDelegate in the same module, it enforces code-signing requirements on every connection in release builds. This is a reusable pattern for any macOS app that wants to isolate unsafe parsing or privileged work in sandboxed XPC services.
A keychain-backed, type-safe settings store defined by a SettingsKey protocol with associated values and defaults. Unlike UserDefaults, values live in the macOS keychain with this-device-only accessibility, providing stronger ownership guarantees; reads fall back to defaults and writes use add-then-update semantics. It imports no internal modules, so this generic pattern can be dropped into any macOS app needing tamper-resistant, per-app settings rather than plist-based defaults.
Encodes raw CryptoKit signature output into OpenSSH wire format for ECDSA, ML-DSA, and RSA. The non-obvious craft is the private mpint(fromFixedWidthPositiveBytes:) helper, which implements OpenSSH's arbitrary-precision signed-integer rules: strip leading zero bytes and prefix 0x00 when the sign bit would otherwise be set. This subtle encoding, plus the r||s splitting for ECDSA, is covered by dedicated tests and is a solid reference for anyone writing SSH signature serialization.
Walks the process ancestry of a socket peer using sysctl KERN_PROC_PID, proc_pidpath, and SecCode validity checks to produce a provenance chain (e.g., ssh -> git -> zsh -> Terminal.app) with per-process code-signature status. This is non-obvious macOS systems programming that powers Secretive's user-facing 'which app is requesting your key' UI and its intact-chain warning. Apart from a small provenance type, it is self-contained and is a reusable pattern for any Mac app needing request attribution or an audit trail.