Show why the extension failed to start

core/src/os/macos/uninstall.rs

@@ -26,8 +26,10 @@ pub fn uninstall() -> Result<(), BoxError> {
         Err(error) if error.code() == errSecItemNotFound => false,
         Err(error) => return Err(error.into()),
     };
-    // Reading a secret's data is limited to the extension, so delete without checking it exists.
-    system_keychain::delete_secret(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT)?;
+    if system_keychain::load_secret(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT)?.is_some() {
+        system_keychain::delete_secret(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT)?;
+        removed = true;
+    }
     EnclaveKey::delete()?;
     for path in [CA_FILE, ENV_AGENT] {
         match std::fs::remove_file(path) {

macos/App/FirewallModel.swift

@@ -212,9 +212,6 @@ final class FirewallModel: NSObject, ObservableObject {
                 forExtensionWithIdentifier: FirewallIDs.extensionBundleID, queue: .main))
             extensionStep = .pending
             log("System extension deactivated, macOS finishes removing it on the next reboot")
-        } catch OSSystemExtensionError.extensionNotFound {
-            extensionStep = .pending
-            log("No system extension to deactivate")
         } catch {
             extensionStep = .failed(error.localizedDescription)
             log("Deactivation failed: \(error.localizedDescription)")

macos/build.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Builds and signs StrixFirewall.app and packages it as build/Firewall.pkg.
+# Builds and signs StrixFirewall.app, installs it to /Applications, and packages it as build/Firewall.pkg.
 # The package is notarized with the notarytool keychain profile in NOTARY_PROFILE; `build.sh debug`
 # makes a Debug build and skips notarization.
 #
@@ -39,6 +39,7 @@ PKG_ROOT=build/pkg-root
 main() {
   build
   sign
+  install_app
   package
   [ $CONFIGURATION = Debug ] || notarize
 }
@@ -63,6 +64,13 @@ sign() {
   codesign --verify --deep --strict "$APP"
 }
 
+# The extension can only be activated from /Applications.
+install_app() {
+  echo "==> Installing /Applications/StrixFirewall.app"
+  rm -rf /Applications/StrixFirewall.app
+  cp -R "$APP" /Applications/StrixFirewall.app
+}
+
 # Marked non-relocatable so the installer never updates another copy with the same bundle id.
 package() {
   echo "==> Packaging build/Firewall.pkg"