v1.5.0

Added

• Replay protection — the agent signs every outbound request with X-Notifier-Timestamp, X-Notifier-Nonce and X-Notifier-Signature (HMAC-SHA256 over timestamp\nnonce, keyed by the SHA-256 hash of the token). Additive and backward-compatible: the server verifies the signature only when present, so un-upgraded servers/agents are unaffected.
• NOTIFIER_TRIGGER_SECRET — inbound server→client backup triggers now authenticate against a dedicated trigger secret, with a runtime fallback to NOTIFIER_BACKUP_CODE for single-secret installs. This pairs with the control plane storing inbound tokens hashed at rest.
• Strong backup ZIP password policy in notifier:install — minimum 16 characters and at least 6 distinct characters; a strong password is auto-generated by default.

Security

• Hardened the release workflow (release.yml) against unauthorized publishes (tag/branch and permission guards).

Fixed

• Windows ZIP entry-path separator bug in PhpZipCreator — archive entry names are normalized to forward slashes so archives built on a Windows client are well-formed and exclusion matching works.