Release Nick 4.0.1 build 408 network safety update

Author: EhsanAzish80

CHANGELOG.md

@@ -8,7 +8,33 @@ monotonically increasing macOS bundle build number.
 
 ## [Unreleased]
 
-No user-facing changes have been released since 4.0.
+No user-facing changes have been released since 4.0.1.
+
+## [4.0.1] - 2026-07-30
+
+### Changed
+
+- Scam Guardian is now observation-only and cannot interrupt ordinary network
+  traffic.
+- Network policy configuration is versioned; missing, stale, or invalid
+  configuration fails open.
+- Scam Guardian status and documentation now distinguish destination
+  monitoring from active blocking.
+- Endpoint Security and Network Extension setup continues to require current
+  runtime health before protection is shown as ready.
+
+### Fixed
+
+- Prevented the Network Filter from disrupting browsers, Git, developer tools,
+  AirDrop, Handoff, and other legitimate connections.
+- Corrected network observations so known-rule matches remain visible for
+  review without being converted into drop verdicts.
+
+### Verification
+
+- All 321 automated tests passed; 4 platform-dependent tests were skipped.
+- The signed package and disk image were notarized, stapled, and accepted by
+  Gatekeeper.
 
 ## [4.0] - 2026-07-27
 
@@ -71,7 +97,8 @@ See the [Nick 1.1 release](https://github.com/EhsanAzish80/Nick/releases/tag/v1.
 
 - Initial public release.
 
-[Unreleased]: https://github.com/EhsanAzish80/Nick/compare/v4.0.0...HEAD
+[Unreleased]: https://github.com/EhsanAzish80/Nick/compare/v4.0.1...HEAD
+[4.0.1]: https://github.com/EhsanAzish80/Nick/releases/tag/v4.0.1
 [4.0]: https://github.com/EhsanAzish80/Nick/releases/tag/v4.0.0
 [3.0]: https://github.com/EhsanAzish80/Nick/releases/tag/V3.0
 [1.2]: https://github.com/EhsanAzish80/Nick/releases/tag/v1.2

Documentation/RELEASE_CHECKLIST.md

@@ -32,8 +32,11 @@
 - [ ] Endpoint Security activates and reports the current build.
 - [ ] Full Disk Access guidance covers Nick and NickExtension.
 - [ ] Scam Guardian activates after one approval flow.
-- [ ] A reserved malicious test domain is blocked.
+- [ ] A reserved malicious test domain is reported without interrupting its
+      connection.
 - [ ] Normal Safari and third-party app networking remains available.
+- [ ] Git fetch/push, developer tools, AirDrop, Handoff, and clipboard
+      continuity remain available with both extensions enabled.
 - [ ] Email Guard detects a safe test fixture and an actionable attachment
       fixture.
 - [ ] Quarantine re-validation, move, listing, and restore work.

Documentation/ROADMAP.md

@@ -17,11 +17,16 @@ Delivered in source and release packaging:
 - YARA 4.5.5 and confidence-aware enforcement.
 - Native uninstaller and signed installer/disk-image pipeline.
 - Background performance, event-volume, and cache bounds.
+- Version 4.0.1 safety correction: Scam Guardian is observation-only and the
+  Network Filter cannot drop ordinary traffic.
 
 The clean-Mac checklist remains the release gate for every published build.
 
 ## Version 4.1: reliability and explainability
 
+- Add a reviewed, explicit enforcement design only after per-app controls,
+  time-limited allowances, recovery tests, and connectivity regression tests
+  are complete.
 - Persist setup diagnostics that users can export without exposing personal
   content.
 - Group repeated alerts by app, behavior, and time window.

Documentation/SECURITY_AUDIT.md

@@ -2,15 +2,16 @@
 
 ## Current release security status
 
-Nick 4.0 build 404 adds two restricted, security-sensitive surfaces beyond the
+Nick 4.0.1 build 408 includes two restricted, security-sensitive surfaces
+beyond the
 historical audit below:
 
 - `NickExtension`, an Endpoint Security system extension with authenticated
   XPC, bounded event handling, confidence-aware YARA enforcement, Email Guard,
   file integrity, privacy monitoring, and quarantine re-validation.
-- `NickNetFilter`, a Network Extension content filter with deterministic
-  allowlist-first policy, fail-open configuration, privacy-safe events, and
-  Ed25519 validation for downloaded rule envelopes.
+- `NickNetFilter`, a Network Extension content filter with fail-open,
+  observation-only policy, privacy-safe events, and Ed25519 validation for
+  downloaded rule envelopes. Build 408 contains no traffic-drop verdict path.
 
 Vendored YARA is version 4.5.5. The automated suite validates source behavior;
 it does not replace

Documentation/USER_GUIDE.md

@@ -48,15 +48,20 @@ malware exclusion.
 Scam Guardian evaluates connection hostnames. It does not read page contents,
 form data, messages, or full browsing history.
 
-If normal browsing stops:
+Nick 4.0.1 observes suspected phishing destinations but does not block
+connections. A finding appears in Nick for review while the application
+connection remains available.
+
+If normal browsing stops while the extension is enabled:
 
 1. Open Nick Settings.
 2. Disable Network Protection using the emergency control.
 3. Confirm browsing returns.
 4. Review website and app allowlists.
 5. Report the affected domain and app as a false positive.
 
-Nick's policy is fail-open when configuration is missing or invalid.
+Nick's policy is fail-open when configuration is missing, stale, or invalid.
+Build 408 also contains no Network Extension traffic-drop path.
 
 ## Email Guard
 

Nick.xcodeproj/project.pbxproj

@@ -23,6 +23,8 @@
 		E40000000000000000000001 /* NetworkProtectionPolicy.swift in Sources */ = {isa = PBXBuildFile; fileRef = E40000000000000000000000 /* NetworkProtectionPolicy.swift */; };
 		E40000000000000000000002 /* NetworkProtectionPolicy.swift in Sources */ = {isa = PBXBuildFile; fileRef = E40000000000000000000000 /* NetworkProtectionPolicy.swift */; };
 		E40000000000000000000004 /* ScamGuardian.swift in Sources */ = {isa = PBXBuildFile; fileRef = E40000000000000000000003 /* ScamGuardian.swift */; };
+		E40000000000000000000006 /* RansomwareNotePolicy.swift in Sources */ = {isa = PBXBuildFile; fileRef = E40000000000000000000005 /* RansomwareNotePolicy.swift */; };
+		E40000000000000000000007 /* RansomwareNotePolicy.swift in Sources */ = {isa = PBXBuildFile; fileRef = E40000000000000000000005 /* RansomwareNotePolicy.swift */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -113,6 +115,7 @@
 		BB55CC11DDEEFF00AA220060 /* NetworkExtension.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = NetworkExtension.framework; path = System/Library/Frameworks/NetworkExtension.framework; sourceTree = SDKROOT; };
 		D10000000000000000000002 /* Nick Uninstaller.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = "Nick Uninstaller.app"; sourceTree = BUILT_PRODUCTS_DIR; };
 		E40000000000000000000000 /* NetworkProtectionPolicy.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; name = NetworkProtectionPolicy.swift; path = Shared/NetworkProtectionPolicy.swift; sourceTree = SOURCE_ROOT; };
+		E40000000000000000000005 /* RansomwareNotePolicy.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; name = RansomwareNotePolicy.swift; path = Shared/RansomwareNotePolicy.swift; sourceTree = SOURCE_ROOT; };
 		E40000000000000000000003 /* ScamGuardian.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; name = ScamGuardian.swift; path = NickNetFilter/ScamGuardian.swift; sourceTree = SOURCE_ROOT; };
 /* End PBXFileReference section */
 
@@ -266,6 +269,7 @@
 				AA11223344556677AABB0005 /* YARAEngine.swift */,
 				AA11223344556677AABB0006 /* YARAMatch.swift */,
 				E40000000000000000000000 /* NetworkProtectionPolicy.swift */,
+				E40000000000000000000005 /* RansomwareNotePolicy.swift */,
 				E40000000000000000000003 /* ScamGuardian.swift */,
 			);
 			name = "Recovered References";
@@ -633,6 +637,7 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				E40000000000000000000007 /* RansomwareNotePolicy.swift in Sources */,
 				AA11223344556677AABB0015 /* YARAEngine.swift in Sources */,
 				AA11223344556677AABB0016 /* YARAMatch.swift in Sources */,
 			);
@@ -665,6 +670,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				E40000000000000000000001 /* NetworkProtectionPolicy.swift in Sources */,
+				E40000000000000000000006 /* RansomwareNotePolicy.swift in Sources */,
 				E40000000000000000000004 /* ScamGuardian.swift in Sources */,
 				AA11223344556677AABB0011 /* ESEvent.swift in Sources */,
 				AA11223344556677AABB0012 /* NickExtensionXPCProtocol.swift in Sources */,
@@ -743,7 +749,7 @@
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				COPY_PHASE_STRIP = NO;
-				CURRENT_PROJECT_VERSION = 405;
+				CURRENT_PROJECT_VERSION = 408;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
@@ -868,7 +874,7 @@
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				COPY_PHASE_STRIP = NO;
-				CURRENT_PROJECT_VERSION = 405;
+				CURRENT_PROJECT_VERSION = 408;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
@@ -998,7 +1004,7 @@
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
 				CODE_SIGN_ENTITLEMENTS = NickExtension/NickExtension.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 405;
+				CURRENT_PROJECT_VERSION = 408;
 				DEVELOPMENT_TEAM = UXGW5V3BY6;
 				ENABLE_HARDENED_RUNTIME = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -1055,7 +1061,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Developer ID Application";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 405;
+				CURRENT_PROJECT_VERSION = 408;
 				DEVELOPMENT_TEAM = UXGW5V3BY6;
 				"DEVELOPMENT_TEAM[sdk=macosx*]" = UXGW5V3BY6;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -1129,7 +1135,7 @@
 				CODE_SIGN_ENTITLEMENTS = NickNetFilter/NickNetFilter.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 405;
+				CURRENT_PROJECT_VERSION = 408;
 				DEVELOPMENT_TEAM = UXGW5V3BY6;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -1152,7 +1158,7 @@
 				CODE_SIGN_ENTITLEMENTS = NickNetFilter/NickNetFilter.Release.entitlements;
 				CODE_SIGN_IDENTITY = "Developer ID Application";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 405;
+				CURRENT_PROJECT_VERSION = 408;
 				DEVELOPMENT_TEAM = UXGW5V3BY6;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -1176,7 +1182,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 405;
+				CURRENT_PROJECT_VERSION = 408;
 				DEVELOPMENT_TEAM = UXGW5V3BY6;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -1204,7 +1210,7 @@
 				CODE_SIGN_IDENTITY = "Developer ID Application";
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 405;
+				CURRENT_PROJECT_VERSION = 408;
 				DEVELOPMENT_TEAM = UXGW5V3BY6;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_HARDENED_RUNTIME = YES;

Nick/App/AppDelegate.swift

@@ -47,6 +47,17 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
     /// even when the main window is hidden.
     private var forceQuit = false
 
+    private var isRunningTests: Bool {
+        let environment = ProcessInfo.processInfo.environment
+        return environment["XCTestConfigurationFilePath"] != nil
+            || environment["XCTestBundlePath"] != nil
+            || environment["XCInjectBundleInto"] != nil
+            || environment["DYLD_INSERT_LIBRARIES"]?.contains("XCTest") == true
+            || NSClassFromString("XCTestCase") != nil
+            || Bundle.allBundles.contains { $0.bundlePath.hasSuffix(".xctest") }
+            || CommandLine.arguments.contains("-ApplePersistenceIgnoreState")
+    }
+
     /// Injected by `MainWindowView.onAppear`. Calls SwiftUI's `openSettings` environment
     /// action so the status-bar "Settings..." menu item opens the Settings scene through
     /// the official path instead of the private `showSettingsWindow:` selector.
@@ -74,17 +85,6 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
         // installed system extensions, and mutate persistent state while unit tests
         // are running. Keep the test host inert; individual tests construct only the
         // services they exercise.
-        let environment = ProcessInfo.processInfo.environment
-        let isRunningTests =
-            environment["XCTestConfigurationFilePath"] != nil
-            || environment["XCTestBundlePath"] != nil
-            || environment["XCInjectBundleInto"] != nil
-            || environment["DYLD_INSERT_LIBRARIES"]?.contains("XCTest") == true
-            || NSClassFromString("XCTestCase") != nil
-            || Bundle.allBundles.contains { $0.bundlePath.hasSuffix(".xctest") }
-            // Xcode's macOS XCTest host launches the app with this persistence
-            // suppression argument before the XCTest bundle itself is visible.
-            || CommandLine.arguments.contains("-ApplePersistenceIgnoreState")
         if isRunningTests {
             return
         }
@@ -126,10 +126,12 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
         }
         Task { @MainActor in
             await networkProtection.refresh()
-            engine.runFullScan()
             xpcClient.connect()
             let coord = MonitorCoordinator(engine: engine, correlator: ThreatCorrelator())
             coordinator = coord
+            // The coordinator's first tick performs the initial full scan.
+            // Starting another scan here duplicates process signature validation
+            // and can saturate a CPU core during launch.
             coord.startRealTimePipeline()
             NotificationManager.shared.setup()
             NSApp.servicesProvider = NickServicesProvider()
@@ -358,6 +360,10 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
     /// right-click menu (`forceQuit == true`), or (b) the main window is currently
     /// visible (i.e. ⌘Q is meaningful to the user).
     func applicationShouldTerminate(_: NSApplication) -> NSApplication.TerminateReply {
+        // XCTest owns the lifecycle of its host process. Never apply Nick's
+        // menu-bar "stay alive while hidden" policy to a test host, otherwise
+        // xcodebuild waits forever after the final test has completed.
+        if isRunningTests { return .terminateNow }
         if forceQuit { return .terminateNow }
         // canBecomeMain is unreliable during .accessory→.regular transitions; filter by
         // class instead. Prefer the titled "Nick" window over any other non-panel window.