Argus 1.5.0

A regression fixed, and three bugs found by audit rather than by symptoms.

Regression: camera and microphone alerts stopped appearing. They fire within a second of each other, and the first card's fade-out was hiding the card views unconditionally, hiding the second card that had just been presented. Fixed, and the quiet period for device alerts is now twenty seconds rather than two minutes.

Found by auditing the code broadly:

• Data race on all persisted state. The monitor's background queue writes it constantly while the menu, board and menu bar icon read it on the main thread, with no synchronisation. Concurrently mutated Swift dictionaries corrupt or crash. Every access is now locked.
• Non-atomic state writes. A crash mid-write truncated the file, and the next launch silently discarded it, losing the baseline and re-announcing every known background item and listener as new. Writes are atomic, and an unreadable file is kept as .
• Unbounded state growth. Rate-limit stamps, assessed apps, networks and their devices grew forever. Pruned on every save.
• Wake from sleep now re-reads network, sessions, keystroke taps and exposure immediately.

sha256 84d48bc381c670245e6657216a36f3fba10e221a3579ab5282626f111401060f

Argus 1.4.3

Removes the dark empty block when a notification opens or closes.

Capturing the app's own window frame by frame found the panel open at full size with no visible content in 9 of 50 frames. Opening expanded the shape and then faded content in from zero; closing faded content out and only collapsed the shape afterwards. Either way there was a stretch of open, empty, dark panel.

Content is now drawn at full opacity and revealed by the mask as the shape springs open, and the shape collapses at the same moment the content fades on the way out.

Re-measured: 0 empty frames out of 90.

sha256 ce22e3b62fde66b784cd496dbf16fca1a6e4655f11d46597df83ef1fa34ef83e

Argus 1.4.2

The real fix for the panel dropping down the screen.

The body's tint, scan lines and the hairline under the notch were anchored to the bottom of the view. During a shrink the window is briefly taller than the shape it contains, so those layers were drawn at the bottom of that taller window, dropping by exactly the height difference. That is why closing the tall status board dropped further than closing a notification.

They are now anchored to the top of the view, so they stay under the notch whatever size the window is mid-animation.

Verified by tracking the cyan hairline across eighty frames of notification cycles: 31pt from the top in every frame.

sha256 360bcacf4aa080099c1ceecf7de1d43073cf556cf56610ef49742b54fc6d2319

Argus 1.4.1

Fixes the notch sliding down the screen when a notification closes.

The mask layer's frame was never being set, so when the window shrank after a card the mask kept its old geometry and the black shape appeared to drop. Core Animation was also implicitly animating those direct changes, stretching the slide over a quarter of a second.

The view, its layer and the mask are now resized together inside a transaction with implicit animation disabled, through a single helper, so every resize path behaves the same. Card and board content is anchored to the bottom of the body rather than the bottom of the window.

Verified by measuring the panel's bottom edge across seventy frames spanning several notification cycles: it only ever sits at the strip or card depth.

sha256 cd996341983d976199749596e4e9d8703ebc3e4fa97f4bd3800dd7b9b2c7f2b5

Argus 1.4.0 — keystroke taps and live sessions

Two things nothing else free will tell you.

• Something is reading your keystrokes. Argus enumerates every process that has installed a keyboard event tap, the mechanism that lets a program see every key you press in any app. Text expanders, clipboard managers and shortcut tools use it legitimately; so does every keylogger. Argus names the app and who signed it, and an unsigned tap is a warning rather than a note.
• Someone is signed in to your Mac right now. Not whether Screen Sharing is switched on, which the board already covered, but whether an SSH or Screen Sharing session is live, with the account and the address it came from.

Both use public APIs and need no entitlement. The status board is now 26 checks.

sha256 27dd7bed37acb4b04ece9d0591285ae42279ab2916de0dcc3ab922d57fdfe126

Argus 1.3.1

Fixes the always-on strip disappearing after an alert.

The real cause: the panel's window was sized to the larger of its old and new shape and only ever shrank on a full close, so returning from an alert to the strip left the window at alert size. That is the dark empty band. It now resizes down after every transition.

Underneath that, nothing owned what the panel was showing, so every code path had to remember to restore the strip. There is now a single panel mode, and the one-second ticker re-asserts it, so a missed restore repairs itself within a second.

Verified by tracing the panel's on-screen size through a full cycle of five alerts plus the status board: every one returned to the strip, and it never got stuck.

Also

• Cards close after 3 seconds instead of 10.
• The strip is one centred line that sizes itself to its content, keeping CPU, MEM, NET and WIFI labels with tighter spacing.
• Demo cards are prefixed DEMO so a sample can never be mistaken for a real detection.

sha256 259cc6375ebb7999efa70e7a4c9a09aa6357c2ef64013f7ea95f99c0831bc9b3

Argus 1.3.0 — always-on stats

A live strip under the notch, if you want one.

Turn on Always-on stats in the menu and the notch keeps a shallow band showing CPU, memory in use, network throughput up and down, and Wi-Fi signal with link speed. It yields to alerts and to the status board, then comes back.

Every number comes from a Mach or BSD call rather than a spawned tool, which is what makes a one-second refresh affordable: 1.1% of one core, and flat memory over three minutes of measurement. Off by default.

Fixed

• The panel was swallowing menu bar clicks. It spans the whole menu bar row, so icons either side of the notch became unclickable. Clicks in that row outside the hardware notch now pass straight through.
• The strip went blank after opening the status board. Restoring it is now unconditional instead of depending on an animation completion.
• The vendor table loads on first use rather than at launch, and polling intervals are longer now that network changes arrive as system events.

sha256 c5a4a9145a4f06027af8820872a5bae6be92d008264267634b17ce96eee043b3

Argus 1.2.0

Camera and microphone alerts, a much deeper persistence sweep, and two menu bugs fixed.

New

• Camera and microphone activation. Argus tells you when either goes live, using the same public CoreMediaIO and CoreAudio properties OverSight uses. Event-driven, no polling, no entitlement. It deliberately does not guess which app is responsible: naming the process needs Endpoint Security, and a wrong name would be worse than none.
• Persistence sweep widened from three launch directories to twenty-four locations, modelled on what KnockKnock enumerates: startup items, kernel extensions, authorisation plugins, QuickLook and Spotlight plugins, audio and directory plugins, internet plugins, widgets, services, periodic scripts, event rules, browser extensions, login and logout hooks, DYLD library inserts and the system crontab.

Fixed

• Home toggled at random. A cold ARP entry briefly hid the gateway's hardware address, so the network key flipped form and the saved record stopped being found. The key is now stable.
• Granting Location seemed to do nothing. The network name now appears immediately and is confirmed.
• Launch at Login reports failures instead of failing silently.
• Recent events are clickable and replay the card.
• Pause confirms itself and dims the menu bar icon, with the resume time in the tooltip.
• Escape-to-dismiss removed: it never worked for a non-activating panel. Click anywhere to dismiss.
• Zero force unwraps remain anywhere in the source.

668 KB · no telemetry · no network connections (one optional HTTPS check, off by default).

sha256 69a231dd8fbe1ff6335d413bb6a946c379727e9c4b8a27697d063ca56d3af1a4

Argus 1.1.0

Ledge is now Argus. Named for Argus Panoptes, the hundred-eyed watchman who never slept.

Argus tells you in plain English when your network or your Mac's exposure changes: open Wi-Fi, VPN off, a server suddenly reachable by everyone, a router that changed hardware, a new device at home, something new set to run at login.

This release

• Renamed throughout: bundle identifier app.argus.mac, new state directory, new wordmark icon.
• Alerts queue instead of overwriting each other when several changes land at once.
• Router impersonation no longer records the impostor gateway as a known network; the same-name (evil twin) check now compares against the most-visited match and requires three prior visits, so a single earlier sighting cannot trigger it.
• New --selftest drives the alert engine with synthetic transitions, so the dangerous paths can be verified without a hostile network. --dump prints everything Argus believes for auditing against the raw commands.

Install. macOS blocks apps that Apple has not notarized, and notarizing needs a paid account this project does not have. After dragging it to Applications:

xattr -dr com.apple.quarantine /Applications/Argus.app

or open it once and use System Settings › Privacy & Security › Open Anyway. The Control-click → Open shortcut was removed in macOS 15.

655 KB · one process · no daemon, no kernel extension, no telemetry, no network connections.

sha256 c2b6f6cfdbf4b611eb6b99a3f0256c9949dbdf6d8bca9ccb7db748bc0b24b788