Release Nick 4.0 security and distribution updates

Author: EhsanAzish80

.github/workflows/ci.yml

@@ -6,58 +6,100 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: macos-26
-    timeout-minutes: 30
+    timeout-minutes: 45
+    env:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Check out source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          fetch-depth: 0
           lfs: true
 
       - name: Select Xcode
         run: |
-          ls /Applications/ | grep Xcode
-          sudo xcode-select -s "$(ls -d /Applications/Xcode*.app | sort -V | tail -1)"
+          XCODE_PATH="$(find /Applications -maxdepth 1 -type d -name 'Xcode*.app' | sort -V | tail -1)"
+          test -n "$XCODE_PATH"
+          sudo xcode-select -s "$XCODE_PATH"
           xcodebuild -version
 
       - name: Build Nick
         run: |
-          xcodebuild build -scheme Nick \
+          xcodebuild build \
+            -project Nick.xcodeproj \
+            -scheme Nick \
             -destination "platform=macOS" \
             CODE_SIGN_IDENTITY="" \
             CODE_SIGNING_REQUIRED=NO \
             CODE_SIGNING_ALLOWED=NO
 
-      - name: Build NickHelper
+      - name: Build shipping components
         run: |
-          xcodebuild build -scheme NickHelper \
-            -destination "platform=macOS" \
-            CODE_SIGN_IDENTITY="" \
-            CODE_SIGNING_REQUIRED=NO \
-            CODE_SIGNING_ALLOWED=NO
+          for scheme in NickExtension NickNetFilter NickHelper NickUninstaller; do
+            xcodebuild build \
+              -project Nick.xcodeproj \
+              -scheme "$scheme" \
+              -destination "platform=macOS" \
+              CODE_SIGN_IDENTITY="" \
+              CODE_SIGNING_REQUIRED=NO \
+              CODE_SIGNING_ALLOWED=NO
+          done
 
       - name: Run Tests
         run: |
-          xcodebuild test -scheme Nick \
+          rm -rf TestResults.xcresult
+          xcodebuild test \
+            -project Nick.xcodeproj \
+            -scheme Nick \
             -destination "platform=macOS" \
+            -enableCodeCoverage YES \
+            -resultBundlePath TestResults.xcresult \
             CODE_SIGN_IDENTITY="" \
             CODE_SIGNING_REQUIRED=NO \
-            CODE_SIGNING_ALLOWED=NO \
-            -resultBundlePath TestResults.xcresult
+            CODE_SIGNING_ALLOWED=NO
 
       - name: Test Summary
         if: always()
         run: |
           xcrun xcresulttool get test-results summary \
             --path TestResults.xcresult 2>/dev/null || echo "Test results unavailable"
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Upload Xcode result bundle
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: TestResults
+          path: TestResults.xcresult
+          if-no-files-found: warn
+          retention-days: 14
 
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: true
+          flags: macos
           xcode: true
           xcode_archive_path: TestResults.xcresult
+
+      - name: Convert coverage for SonarCloud
+        if: env.SONAR_TOKEN != ''
+        run: |
+          ./Scripts/xccov-to-sonarqube.sh TestResults.xcresult > sonar-coverage.xml
+          test -s sonar-coverage.xml
+
+      - name: Run SonarCloud analysis
+        if: env.SONAR_TOKEN != ''
+        uses: SonarSource/sonarqube-scan-action@v7
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.qualitygate.wait=true

.gitignore

@@ -9,8 +9,12 @@ build/
 *.moved-aside
 *.hmap
 *.ipa
+*.pkg
+*.dmg
 *.dSYM.zip
 *.dSYM
+*.xcresult/
+sonar-coverage.xml
 
 # Swift Package Manager
 .build/

ARCHITECTURE.md

@@ -2,15 +2,53 @@
 
 This document describes Nick's internal architecture, detection methodology, and security model. It's intended for contributors, security auditors, and anyone who wants to understand how Nick works before trusting it on their Mac.
 
+## Version 4 architecture
+
+Nick 4.0 separates user interface, local monitoring, privileged Endpoint
+Security observation, and optional network enforcement:
+
+```text
+Nick.app
+├── SecurityEngine and MonitorCoordinator
+├── local process, persistence, connection, capture, and system-audit monitors
+├── Smart Scan, Alerts, Timeline, Quarantine, Reports, and setup
+├── ExtensionXPCClient
+└── NetworkProtectionManager
+
+NickExtension.systemextension
+├── EndpointSecurityClient
+├── FileScanner and vendored libyara 4.5.5
+├── EmailAttachmentMonitor
+├── RansomwareDetector and FileIntegrityMonitor
+├── Behavioral and privacy event handling
+└── authenticated XPCServer
+
+NickNetFilter.systemextension
+├── FilterDataProvider
+├── deterministic NetworkProtectionPolicy
+├── ScamGuardian
+├── signed NetworkBlocklist envelope validation
+└── bounded privacy-safe health and block-event persistence
+```
+
+The main app never treats an installed bundle or saved preference as proof that
+a protection is working. System-extension and Network Extension rows become
+healthy only after current runtime state is verified.
+
 ## Design Principles
 
 1. **Defense in depth through correlation.** Any single signal (an unsigned binary, an outbound connection, a new LaunchAgent) could be benign. Nick's value is in correlating signals across monitors to surface genuinely suspicious behavior while minimizing false positives.
 
 2. **Minimal attack surface.** Nick uses zero third-party Swift dependencies. The privileged helper exposes the smallest possible XPC API. The app requests only the permissions it needs.
 
-3. **Offline by default.** Nick makes no network connections unless the user explicitly enables rule update checks. All scanning, analysis, and AI inference runs locally on the Mac.
+3. **Local analysis.** Scanning, correlation, and model inference run locally.
+   Network access is limited to explicit product functions such as Sparkle
+   update checks and future signed rule retrieval.
 
-4. **Separation of concerns.** The detection engine (`Core/`) has no UI dependency and can be tested, audited, and embedded independently. The UI (`App/`) is a thin layer over the engine. The privileged helper (`Helper/`) is isolated behind XPC.
+4. **Separation of concerns.** The detection engine (`Nick/Core/`) has no UI
+   dependency. The UI (`Nick/App/`) presents engine state. Endpoint Security
+   and network enforcement live in separate system extensions, and privileged
+   operations are isolated behind narrow authenticated XPC protocols.
 
 ---
 

CONTRIBUTING.md

@@ -4,15 +4,15 @@ Thanks for your interest in making Mac security better. Nick is built by the com
 
 ## Ways to Contribute
 
-### 🐛 Bug Reports & False Positives
+### Bug reports and false positives
 Found a bug or a false positive detection? Open an [issue](https://github.com/EhsanAzish80/Nick/issues/new) with:
 - macOS version and Mac model
 - Nick version
 - Steps to reproduce
 - Expected vs actual behavior
 - For false positives: the process/file that was flagged and why you believe it's safe
 
-### 🧬 YARA Rules
+### YARA rules
 Submit new detection rules for macOS-specific threats:
 
 1. Place your rule in the appropriate directory under `Rules/` (stealers, backdoors, adware, ransomware, or community)
@@ -36,7 +36,7 @@ Submit new detection rules for macOS-specific threats:
 4. Test your rule against known-good files to minimize false positives
 5. Open a PR with the rule and a brief description of the threat it detects
 
-### 🧠 Behavioral Scoring Model
+### Behavioral scoring model
 The CoreML threat scoring model can be improved with:
 - New training data (anonymized behavioral patterns from confirmed threats)
 - Feature engineering suggestions (new signals to correlate)
@@ -45,15 +45,16 @@ The CoreML threat scoring model can be improved with:
 
 See `Models/Training/` for the training pipeline and data format.
 
-### 💻 Code Contributions
+### Code contributions
 1. Fork the repository
 2. Create a feature branch: `git checkout -b feature/your-feature`
 3. Make your changes
-4. Run tests: `xcodebuild test -scheme NickTests`
+4. Run the full build and coverage command in
+   [Documentation/DEVELOPMENT.md](Documentation/DEVELOPMENT.md)
 5. Commit with a clear message: `git commit -m "Add SSH tunnel detection to NetworkAnalyzer"`
 6. Push and open a PR
 
-### 📖 Documentation
+### Documentation
 - Fix typos, clarify explanations, add examples
 - Document detection logic for specific threat types
 - Write guides for common use cases
@@ -68,16 +69,22 @@ See `Models/Training/` for the training pipeline and data format.
 - All public APIs must have documentation comments
 
 ### Architecture Rules
-- `Core/` must have **zero** UI dependencies — it's a pure detection engine
-- `App/` depends on `Core/` but never the reverse
-- `Helper/` has the smallest possible API surface — every XPC method must be justified
+- `Nick/Core/` must have no UI dependencies; it is the testable detection engine.
+- `Nick/App/` depends on `Nick/Core/`, never the reverse.
+- Privileged and extension XPC protocols must expose the smallest justified API.
+- The main app must authenticate extension health before reporting protection.
+- Network enforcement must fail open when configuration is unavailable.
 - No third-party Swift packages. Apple frameworks and POSIX APIs only.
-- `libyara` is the sole C dependency and must remain vendored
+- Vendored libyara updates must record the exact upstream version and pass the
+  complete false-positive test suite.
 
 ### Testing
 - Every detection capability must have corresponding unit tests
 - Include both positive tests (does it catch the threat?) and negative tests (does it avoid false positives?)
 - Integration tests should use realistic but safe mock data — never include actual malware in the repo
+- A system-extension build is not deployment proof. Release claims require the
+  clean-Mac checks in
+  [Documentation/RELEASE_CHECKLIST.md](Documentation/RELEASE_CHECKLIST.md).
 
 ## Pull Request Process
 

Documentation/DEVELOPMENT.md

@@ -0,0 +1,108 @@
+# Development and CI
+
+## Supported toolchain
+
+- macOS 26 or later.
+- Xcode 26 or later.
+- Swift 6.
+- The checked-in `Nick.xcodeproj` is authoritative.
+
+`project.yml` is retained as project-generation documentation but does not
+fully represent the filesystem-synchronized groups and release signing state.
+Do not regenerate the project for ordinary source-file changes.
+
+## Local build
+
+```sh
+xcodebuild build \
+  -project Nick.xcodeproj \
+  -scheme Nick \
+  -destination "platform=macOS" \
+  CODE_SIGN_IDENTITY="" \
+  CODE_SIGNING_REQUIRED=NO \
+  CODE_SIGNING_ALLOWED=NO
+```
+
+This validates compilation without requiring the maintainer's restricted
+entitlements. It does not validate system-extension activation.
+
+## Tests and coverage
+
+```sh
+rm -rf TestResults.xcresult
+
+xcodebuild test \
+  -project Nick.xcodeproj \
+  -scheme Nick \
+  -destination "platform=macOS" \
+  -enableCodeCoverage YES \
+  -resultBundlePath TestResults.xcresult \
+  CODE_SIGN_IDENTITY="" \
+  CODE_SIGNING_REQUIRED=NO \
+  CODE_SIGNING_ALLOWED=NO
+```
+
+Inspect the summary:
+
+```sh
+xcrun xcresulttool get test-results summary --path TestResults.xcresult
+```
+
+Generate SonarCloud generic coverage:
+
+```sh
+./Scripts/xccov-to-sonarqube.sh TestResults.xcresult > sonar-coverage.xml
+```
+
+## CI quality gates
+
+The GitHub workflow:
+
+1. Checks out full history and Git LFS objects.
+2. Selects the newest installed Xcode.
+3. Builds Nick, NickExtension, NickNetFilter, NickHelper, and NickUninstaller
+   through the Nick scheme.
+4. Runs unit and integration tests with Xcode coverage enabled.
+5. Uploads the result bundle as a diagnostic artifact.
+6. Uploads coverage to Codecov.
+7. Converts coverage and runs SonarCloud analysis when `SONAR_TOKEN` exists.
+
+Configure these repository secrets:
+
+- `CODECOV_TOKEN`
+- `SONAR_TOKEN`
+
+In SonarCloud, disable Automatic Analysis. The repository uses CI-based
+analysis so test coverage is attached to the same commit and pull request.
+
+## Static-analysis scope
+
+`sonar-project.properties` includes application, extension, helper, shared, and
+packaging source. Tests are classified separately. Vendored YARA headers and
+static libraries, generated build products, packages, disk images, Xcode result
+bundles, and Xcode user state are excluded.
+
+## Before requesting review
+
+```sh
+git diff --check
+git status --short
+```
+
+Then run the full test command above. Document any test that is skipped because
+the runner lacks a macOS service. A successful unsigned build is not a
+substitute for the clean-Mac system-extension matrix.
+
+## Signed runtime validation
+
+For a release candidate:
+
+1. Restart to clear system extensions waiting for uninstall.
+2. Install only the current notarized package.
+3. Confirm the installed app and both system extensions have the intended
+   version and build.
+4. Confirm fresh Endpoint Security and Network Filter health files.
+5. Verify a normal website is allowed and the reserved Scam Guardian test
+   destination is blocked.
+6. Test an Email Guard fixture, quarantine, restore, update, and uninstall.
+7. Observe idle CPU, memory, and logs for at least ten minutes.