Changelog

The validation overlay was calling AuthenticateAsync (Touch ID + keychain

read + password validation) when it only needs to verify Touch ID works.

Since the app is already unlocked at this point, there's no need to

retrieve the password from the keychain.

Added VerifyBiometricAsync to IBiometricService — prompts biometric only

with no keychain access. Moved EvaluateBiometricPolicyAsync out of the

DEBUG preprocessor block into the shared section so it's available in

both build configurations. Added logging to trace the verification flow.

Instead of closing the main window and showing the unlock screen when

validating biometric enrollment, the app now displays a frosted glass

overlay at ZIndex 2000 on top of the existing UI. The user sees a

verification prompt: succeed with biometric and it stays enabled, or

enter the master password and biometric gets disabled. The main window

stays open throughout — no shutdown, no window recreation.

Place Exit and Unlock buttons side by side on the lock screen so users

can quit the app without needing to unlock first. Exit uses the

secondary surface style, Unlock retains the primary accent style.

After enabling biometric unlock in settings, the app now locks

immediately and prompts the user to verify biometric works. If the user

successfully unlocks with biometric, the feature stays enabled. If they

cancel biometric and unlock with their master password instead, biometric

is automatically disabled and unenrolled — ensuring the user has proven

the biometric flow works before relying on it.

The modern SecItem keychain API requires the keychain-access-groups

entitlement, which unsigned .NET debug builds lack (errSecMissingEntitlement

-34018). Split MacBiometricService into two code paths using preprocessor

directives:

• DEBUG: Uses legacy SecKeychainAddGenericPassword / FindGenericPassword

(file-based keychain, no entitlements needed) with separate LAContext

Touch ID evaluation via ObjC block bridging.

• RELEASE: Uses modern SecItemAdd / SecItemCopyMatching with biometric

access control (kSecAccessControlBiometryCurrentSet) for signed builds.

Both paths store the master password in the macOS Keychain gated by

biometric verification and fall back to manual password entry on failure.