xVigil 1.0.0

xVigil 1.0.0

First stable release. xVigil is a menu bar app that surfaces what macOS's
built-in protections — XProtect, Gatekeeper, quarantine — are quietly doing,
and lets you actively scan the places they never look.

Highlights

• Menu bar summary: Gatekeeper status, XProtect definition & Remediator
  versions, recent quarantine events at a glance
• Loud detections: background sweeps of XProtect logs; any finding turns
  the menu bar icon into a red warning shield, banners the popover, and lands
  in a Detections dashboard section
• Quarantine drill-down: browse, search, and filter every quarantine
  event; locate the on-disk file via its quarantine xattr; see today's
  Gatekeeper verdict, code-signature chain, and log context around the event
• XProtect activity: raw log noise clustered into readable scan runs
• On-demand ClamAV scanning: scan folders XProtect never proactively
  checks using your own ClamAV install (brew install clamav), with
  signature-staleness warnings. Report-only — xVigil never quarantines or
  deletes anything
• App behavior: shield Dock icon while the dashboard is open; optional
  start-at-login toggle

Since 0.2.0

• Fixed pagination dropping quarantine events that share a timestamp
• Dock icon + proper .icns, start-at-login support, misc. robustness fixes

Installing

Unzip and drag xVigil.app to Applications. Releases are ad-hoc signed:
right-click → Open on first launch. Requires macOS 15+. Universal binary
(Apple Silicon + Intel). ClamAV is optional, only needed for on-demand scans.

xVigil 0.2.0 (beta)

xVigil 0.2.0 (beta)

Detections are now loud, and xVigil can actively scan on demand.

New

• Loud detections: a background monitor sweeps XProtect logs; any finding
  turns the menu bar icon into a red warning shield, banners the popover, and
  appears in a new Detections dashboard section with full detail.
• On-demand ClamAV scanning: point xVigil at folders XProtect never
  proactively checks (Homebrew prefixes, Downloads) and scan with your own
  ClamAV install (brew install clamav). Prefers the clamd daemon, falls back
  to clamscan, warns when signature databases are stale, streams results
  live with reveal-in-Finder. Report-only — xVigil never quarantines or
  deletes anything.
• CLI: new engine and scan commands.

Improved

• Detection classification requires actual threat language — "no threats
  detected" no longer registers as a detection.

Installing

Unzip and drag xVigil.app to Applications. Ad-hoc signed beta: right-click
→ Open on first launch. Requires macOS 15+. Universal binary.
ClamAV is optional and only needed for on-demand scanning.

xVigil 0.1.0 (beta)

xVigil 0.1.0 (beta)

First public beta of xVigil — a menu bar app that surfaces what macOS's
built-in protections (XProtect, Gatekeeper, quarantine) are quietly doing.

Features

• Menu bar summary: Gatekeeper status, XProtect definition & Remediator
  versions, recent quarantine events at a glance
• Dashboard: browse, search, and filter every quarantine event on your
  Mac, with full event details
• Drill-down: locates the on-disk file for an event (via its quarantine
  xattr), shows today's Gatekeeper verdict and code-signature chain, plus
  unified-log context around the event
• XProtect activity: raw log noise clustered into readable scan runs

Installing

Unzip and drag xVigil.app to Applications. This beta is ad-hoc signed, so
right-click → Open on first launch (the Gatekeeper-visibility app makes
you talk to Gatekeeper — consider it a live demo).

Requires macOS 15 or later. Universal binary (Apple Silicon + Intel).

Known limitations

• Unified-log queries for long windows can take a minute (progress is shown)
• File location only succeeds for recent events — macOS purges old quarantine
  DB rows and deletes downloads; "file not found" is normal
• No notifications yet; refresh is manual or on-open