phoenix-firewall v0.4.0

Phoenix Security Blue Shield - Firewall v0.4.0

Installation (userland — no root, no MDM)

# macOS / Linux
curl -sSfL https://github.com/Security-Phoenix-demo/blue-shield-firewall/releases/download/v0.4.0/phoenix-firewall_0.4.0_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/').tar.gz | tar -xz
mv phoenix-firewall ~/.local/bin/
phoenix-firewall init
phoenix-firewall enroll --api-key <your-key>

Note on code signing: binaries in this release are unsigned.
Apple notarization and Windows EV code signing are pending procurement.
Verify integrity via the provided checksums.txt (SHA-256).

Changelog

• 34e160d: Merge branch 'main' into feat/proxy-handshake-failmode-enrollment (@franksec42)
• b3c3be2: chore(deps): bump the go_modules group across 2 directories with 1 update (@dependabot[bot])
• fc2e8e5: chore(release): v0.4.0 — CHANGELOG, rules subcommand, version bump (@franksec42)
• b2511fb: feat(firewall): add proxy identity/health endpoint for shim handshake (@franksec42)
• 9fa0c7a: feat(firewall): enroll registers device with backend and reports comms failures (@franksec42)
• 3ed8978: feat(firewall): honor fail_mode (closed blocks) on backend API error (@franksec42)
• 45f0c01: feat(firewall): read agent.toml and expose FailMode in config (@franksec42)
• f1bf177: feat(firewall): report backend reachability via heartbeat and warn on comms failure (@franksec42)
• 44e823b: feat(firewall): shim HTTP identity handshake, fail-mode, and foreign-listener warning (@franksec42)
• bbba8d4: feat: containment for host-executed test packages (npm script deny + bypass detection) (@franksec42)
• 21a3a07: fix(firewall): address PR review critical and medium findings (@franksec42)
• 8ba252f: fix(firewall): resolve final-review findings (heartbeat, integrity, windows fail-mode, enroll chmod) (@franksec42)
• b454f67: fix(firewall): wire fail_mode through InstallPATH into shim generator (@franksec42)
• ee3fb65: fix: address PR #7 bot review findings (port validation, IPv6/schemeless URL handling, test coverage) (@franksec42)
• ee43288: fix: address code review – nil guards, idempotent stop, min interval, comment accuracy (@franksec42)
• b7d1277: fix: configurable proxy port via agent.toml + npm matcher :443 port stripping (@franksec42)
• 6057935: fix: correct ldflags symbol names in Makefile build/build-all targets (@franksec42)
• 26edf17: fix: proxy_port TOML override must respect PHOENIX_PORT env var (@franksec42)
• 178c385: fix: thread proxy_port into shim generator on all platforms (@franksec42)
• 0a99cb5: fix: thread tenant_id from enrollment through to evaluate + heartbeat (@franksec42)
• a85af20: fix: upsertTOMLLine inserts new keys before first [section] header (@franksec42)

Full Changelog: v0.3.1...v0.4.0