Native macOS agent that keeps the office VPN and the NAS shares working
without the shell wrapper it replaces.
- VPN: full port of the `ovpn` script — host-route pinning, gateway
discovery via networksetup, tunnel liveness by address plus pushed
route, startup grace, restart of a wedged daemon. Root steps are
batched into one system authorization prompt.
- SMB: mounts via NetFS, discovers shares from the server, detects
mounts event-driven through NSWorkspace, matches the host by resolved
alias so externally created mounts are recognised.
- Credentials never pass through the process: the VPN auth file is
written by `security` straight to disk, and the password is stored via
SecItemAdd rather than a command line visible in ps.
- UI: status window, settings editor, ⌘+/⌘− zoom that re-lays out rather
than scaling a bitmap.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
