# Configured Authentication and Clear Menu Implementation Plan

**Intent:** Make the saved login approach explicit and make Connect always use it; fix faint/uneven status icons shown in the supplied screenshot.
**Current Behavior:** The connect arrow chooses a one-off override, the saved approach is unclear while connected, Bitwarden uses hidden auto-submit while local imported OTP uses visible/manual submit. Ring track is faint and a round tiny arc looks like an isolated dot.
**Expected Outcome:** A persistent Manual/Automatic setting, with Automatic source Key on this Mac/Bitwarden. Both automatic sources use hidden autofill/OTP/submit (explicitly confirmed by the user). One Connect button without a launch-mode menu. All status symbols fit a consistent 16pt box; neutral visible track and non-rounded progress cap.
**Target-Perspective Output:** Synthetic save/status/launch checks prove that each selection survives restart/update, Connect uses stored choice and both auto sources produce the same launch flags. Swift build and existing regressions pass. Screenshot is user-provided evidence; no new screenshots or GUI checks.
**Truth Owner:** CLI/env own saved auth choice and last automatic source; Swift only sends a setter command and renders returned status. Existing Keychain and importer still own secrets.
**Contract Boundary:** Add canonical `keychain-auto`; retain `manual-keychain`, `bitwarden-auto`, legacy CLI aliases and additive status metadata. New `--set-auth=manual|auto|keychain|bitwarden` saves configuration only. The UI clears inherited auth-selector env overrides and passes no auth override when connecting.
**Cutover:** Existing `manual-keychain + LOCAL_OTP=1` resolves to keychain-auto under the newly approved behavior; explicit manual aliases force LOCAL_OTP=0. Installer preserves and renders the canonical profile; successful import activates keychain-auto.
**Displaced Path:** Remove the connect dropdown and one-off choices from the app UI. Replace old manual-local submit behavior with the user-approved automatic behavior. No parallel Swift preferences for auth.
**Value Density:** Keep existing CLI, Keychain, PyOTP and runtime patches. Use native pickers and an atomic env setter, not another auth service.
**Acceptance Evidence:** Automated temporary-home selection/save/status tests, fake client launch matrix, importer regressions, settings preservation, native build, icon source/geometry review and POST correctness review.
**Evidence Lane:** Automated checks and supplied screenshot inspection only. No installed config changes, real Keychain, live VPN, app/GUI launch or screenshots.
**Kill Criteria:** Connect never picks the first available override; the active setting remains visible in every state; both auto sources have identical browser/submit flags; failed save cannot falsely update the UI; changing settings cannot reconnect an active session; no unsupported claim that a local secret necessarily came from Yandex.
**Architecture Slice:** CLI normalization/status/setter/preflight/launch -> Swift saved settings UI; importer/installer template migration; status label drawing. Existing unrelated dirty work, DNS, SSO selectors and reconnect policy are excluded.
**Plan Review Gate:** Requires PRE review before execution.

## Tasks

1. Root adds keychain-auto, atomic setter and auth status metadata. `LEMANA_VPN_AUTO_SOURCE` records the preferred automatic source so toggling manual/automatic preserves the last source; it is not a separate active mode. Writes update owned MODE/LOCAL_OTP/AUTH_PROFILE/CREDENTIAL_SOURCE/USE_BITWARDEN/AUTO_SOURCE together and preserve other settings. Setter runs before connection or patch side effects, and never reads secret values.
2. Root updates installer defaults/templates/migration and importer activation/copy. Local source is labeled “Ключ на этом Mac” because Bitwarden and import share the existing Keychain entry. Preflight gives source-specific setup guidance; missing credentials stop auto launch instead of prompting invisibly.
3. Root replaces the app dropdown with one configured connect action and native saved-mode/source controls. Save requests disable concurrent save/connect/import; only successful CLI status updates the selection. An active connection keeps running; settings apply next time. Normalize icon boxes/contrast/caps from supplied evidence.
4. Root adds focused fixture tests, updates earlier expectations intentionally changed by full auto, runs regression ladder and records native visual acceptance as untested. Read-only agents perform PRE/POST and correctness/maintainability review.

## Approved behavior

| UI choice | Canonical mode | Password/code source | Browser / submit |
| --- | --- | --- | --- |
| Вручную | manual-keychain | Saved password + manually entered OTP | shown / off |
| Автоматически, Ключ на этом Mac | keychain-auto | Existing Keychain username/password/TOTP | hidden / on |
| Автоматически, Bitwarden | bitwarden-auto | Existing Bitwarden sync to Keychain | hidden / on |

`--manual-full` stays a diagnostic no-autofill command. `--debug` still makes the browser visible. The app will explain a missing/incompatible CLI and disable mode editing until refreshed; there is no automatic fallback to a different mode.

## Completed evidence

- UI now has two persisted modes and a separate automatic-source selector. Connect has no dropdown and sends no mode override. Status refresh is the only settings reader in Swift; connection events cannot overwrite saved settings. Saving, incomplete setup and in-progress authentication are guarded appropriately, with visible save errors.
- Canonical keychain-auto, approved legacy-local migration, importer activation, installer template/wizard and remembered auto source are integrated. Both automatic sources share the hidden/OTP/submit launch branch. The setter changes only the env file and preserves unrelated settings.
- Supplied screenshot/code review identified a faint track plus rounded short arc, rather than a demonstrable off-center circle. Track is now adaptive neutral at 0.45 alpha, progress cap is butt, and system/menu symbols use consistent boxes. No new native visual inspection was run.
- `tests/auth_settings.py`: PASS for all saved choices, last-auto-source restoration, failure/no side effects, local readiness and explicit manual override.
- `tests/smoke.sh`: PASS, including actual setter → ordinary no-override fake-client launch for manual, local automatic and Bitwarden automatic; both automatic sources produce hidden browser and submit enabled.
- `tests/configuration.py`: 11 checks PASS, including profile migration/update and explicit manual override. Importer, menu/timing/transport and logging regression checks PASS. Shell syntax and `git diff --check` PASS.
- Final `swift build -c release --package-path app`: PASS (3.75 s). PRE and POST correctness/maintainability reviews passed after fixing stale connection-module snapshots and hidden save errors.
- No real installation, live VPN, secret-store operation or GUI testing was performed. Native visual quality and real automatic SSO remain unverified in this turn; prior unrelated dirty work is preserved.