Leave installing the app to the package

core/src/os/macos/uninstall.rs

@@ -26,10 +26,8 @@ pub fn uninstall() -> Result<(), BoxError> {
         Err(error) if error.code() == errSecItemNotFound => false,
         Err(error) => return Err(error.into()),
     };
-    if system_keychain::load_secret(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT)?.is_some() {
-        system_keychain::delete_secret(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT)?;
-        removed = true;
-    }
+    // Reading a secret's data is limited to the extension, so delete without checking it exists.
+    system_keychain::delete_secret(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT)?;
     EnclaveKey::delete()?;
     for path in [CA_FILE, ENV_AGENT] {
         match std::fs::remove_file(path) {

macos/App/FirewallModel.swift

@@ -26,11 +26,14 @@ enum StepStatus: Equatable {
 enum FirewallError: Error, LocalizedError {
     case extensionUnavailable
     case screeningDidNotStart(NEVPNStatus)
+    case extensionStopped(String)
 
     var errorDescription: String? {
         switch self {
         case .extensionUnavailable: return "The extension is not running"
         case let .screeningDidNotStart(status): return "Screening did not start (\(status.label))"
+        case let .extensionStopped(reason):
+            return "The extension stopped: \(reason). Its log: log show --last 5m --predicate 'subsystem BEGINSWITH \"\(FirewallIDs.appBundleID)\"'"
         }
     }
 }
@@ -209,6 +212,9 @@ final class FirewallModel: NSObject, ObservableObject {
                 forExtensionWithIdentifier: FirewallIDs.extensionBundleID, queue: .main))
             extensionStep = .pending
             log("System extension deactivated, macOS finishes removing it on the next reboot")
+        } catch OSSystemExtensionError.extensionNotFound {
+            extensionStep = .pending
+            log("No system extension to deactivate")
         } catch {
             extensionStep = .failed(error.localizedDescription)
             log("Deactivation failed: \(error.localizedDescription)")
@@ -294,8 +300,14 @@ final class FirewallModel: NSObject, ObservableObject {
         try await manager.loadFromPreferences()
         watched = manager
 
+        screeningStep = .running("Starting the extension")
         try manager.connection.startVPNTunnel()
         guard try await wait(for: .connected, on: manager.connection) else {
+            do {
+                try await manager.connection.fetchLastDisconnectError()
+            } catch {
+                throw FirewallError.extensionStopped(error.localizedDescription)
+            }
             throw FirewallError.screeningDidNotStart(manager.connection.status)
         }
         return "Screening package downloads"
@@ -319,9 +331,13 @@ final class FirewallModel: NSObject, ObservableObject {
         return "Screening disabled"
     }
 
+    /// Gives up early once a start has failed, which shows as connecting then disconnected.
     private func wait(for status: NEVPNStatus, on connection: NEVPNConnection) async throws -> Bool {
+        var connecting = false
         for _ in 0 ..< 60 {
             if connection.status == status { return true }
+            if connection.status == .connecting { connecting = true }
+            if connecting && connection.status == .disconnected { return false }
             try await Task.sleep(nanoseconds: 250_000_000)
         }
         return false

macos/build.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Builds and signs StrixFirewall.app, installs it to /Applications, and packages it as build/Firewall.pkg.
+# Builds and signs StrixFirewall.app and packages it as build/Firewall.pkg.
 # The package is notarized with the notarytool keychain profile in NOTARY_PROFILE; `build.sh debug`
 # makes a Debug build and skips notarization.
 #
@@ -39,7 +39,6 @@ PKG_ROOT=build/pkg-root
 main() {
   build
   sign
-  install_app
   package
   [ $CONFIGURATION = Debug ] || notarize
 }
@@ -64,13 +63,6 @@ sign() {
   codesign --verify --deep --strict "$APP"
 }
 
-# The extension can only be activated from /Applications.
-install_app() {
-  echo "==> Installing /Applications/StrixFirewall.app"
-  rm -rf /Applications/StrixFirewall.app
-  cp -R "$APP" /Applications/StrixFirewall.app
-}
-
 # Marked non-relocatable so the installer never updates another copy with the same bundle id.
 package() {
   echo "==> Packaging build/Firewall.pkg"