Monitoring System Events with Endpoint Security

At a glance

Project structure

Source bundle/
├── SampleEndpointApp/
│   ├── main.m
│   ├── AppDelegate.m
│   ├── ViewController.m
│   ├── AppDelegate.h
│   └── ViewController.h
├── Extension/
│   ├── auth_demo.c
│   ├── notify_demo.c
│   ├── Extension.entitlements
│   └── Info.plist
├── Configuration/
│   └── SampleCode.xcconfig
└── SampleEndpointApp.xcodeproj/
    ├── .xcodesamplecode.plist
    └── project.pbxproj

Structure observations

• Architecturally prominent files are ranked from entry points and role-named declarations; resource-only paths are omitted.
• Primary languages: C, C/Objective-C header, Objective-C.
• The verified tree contains 8 project/configuration file(s) and 2 source declaration(s).

Overall architecture

flowchart LR
    Bundle["Sample bundle"]
    V1["Extension"]
    V2["SampleEndpointApp"]
    Boundary["EndpointSecurity APIs"]
    Bundle --> V1
    V1 --> Boundary
    Bundle --> V2
    V2 --> Boundary

Reference code

SampleEndpointApp/main.m:9 — architecture anchor

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        // Setup code that might create autoreleased objects goes here.
    }
    return NSApplicationMain(argc, argv);
}

Interpretation

The branches represent separate entry-bearing project variants in the downloaded bundle, not runtime calls between those variants. Each branch is intentionally collapsed at the documented framework boundary; the detailed target-local flow remains in the cited files. Ownership is claimed only where the next section cites a stored property or assignment.

Ownership and state

classDiagram
    ViewController o-- OSSystemExtensionRequest : currentRequest
    ViewController o-- NSButton : installButton
    ViewController o-- NSTextView : textView

Ownership evidence

SampleEndpointApp/ViewController.m:12 — stored dependency or nearest verified ownership anchor

@interface ViewController ()

@property (strong) OSSystemExtensionRequest *currentRequest;
@property (weak) IBOutlet NSButton *installButton;
@property (unsafe_unretained) IBOutlet NSTextView *textView;

@end

Composition arrows indicate a source-visible construction expression or locally owned value state; aggregation means the owner stores or receives a dependency without proving exclusive lifetime ownership.

Concurrency, scheduling, and thread safety

Evidence limit: actor isolation, async/await, or Task creation does not by itself prove background-thread execution; Sendable conformance alone does not prove thread-safe mutation.

No source-visible execution, scheduling, or synchronization boundary was found in the indexed source.

@MainActor/MainActor.run, DispatchQueue.main, and RunLoop.main are reported as distinct isolation, queue, and event-loop mechanisms. A plain Task is kept separate from Task.detached; neither is labeled as a background thread.

State propagation, frameworks, and dependencies

Evidence limit: an import proves a source-level compilation dependency at the cited line; it does not prove runtime use, architectural adoption, or whether a Swift package is a direct application dependency.

receive(on:) describes downstream delivery scheduling, while subscribe(on:) describes upstream subscription/request/cancel scheduling. An import Combine alone establishes neither behavior nor a Store, reducer, Redux, or other application architecture.

Class and protocol design

SampleEndpointApp/AppDelegate.h:9 — representative type boundary

@interface AppDelegate : NSObject <NSUserNotificationCenterDelegate>

@end

No local protocol conformance is claimed as protocol-oriented design; external framework conformances are listed only as dependencies.

Access control

Reference code

SampleEndpointApp/ViewController.m:12 — representative boundary

@interface ViewController ()
// ...
@property (strong) OSSystemExtensionRequest *currentRequest;
// ...
@end

Swift declarations without a modifier are internal; explicit private, fileprivate, private(set), public, or open entries above are interpreted by language semantics. Objective-C/C samples instead rely on header and implementation boundaries, which are not equivalent to Swift lexical privacy.

Logic ownership and placement

Design patterns

Naming conventions

• Types: Controller: ViewController; Delegate: AppDelegate.
• Protocols: no local protocol declaration in the scanned source.
• Methods: applicationDidFinishLaunching, applicationWillTerminate, installExtension, viewDidLoad, setRepresentedObject, logText, logWithFormat, logError.
• Files: SampleEndpointApp/AppDelegate.m, SampleEndpointApp/ViewController.m, SampleEndpointApp/AppDelegate.h, SampleEndpointApp/ViewController.h.

Architecture takeaways

• main is the main source-visible entry or composition anchor for this sample.
• Framework work reaches Cocoa, EndpointSecurity, bsm, dispatch through a deliberately small high-level chain; the detailed API graph remains inside the cited implementation files.
• Stored-property evidence identifies lifecycle collaboration; it does not by itself prove exclusive object ownership.
• Access-control conclusions separate verified language visibility from the likely design rationale.
• The source does not justify labeling the design protocol-oriented.

Source map

• Official Apple documentation