FreeSnitch 0.4.5

Fixed

The firewall no longer switches itself off after a helper restart or update (#70).

Until now the network extension compared rule snapshots by generation number alone. The extension's counter lives in extension memory and survives a helper restart, while the helper's counter came from the database and could legitimately start over. A restarted or updated helper therefore looked older forever, every snapshot it sent was refused, and the Mac stayed unfiltered until the next reboot.

Snapshots are now ordered by (helper session, generation):

• a restarted helper opens a new session and is accepted immediately, at any generation
• a lower generation inside one session is still rejected, as before
• a snapshot from an older session is rejected even at a higher generation
• the published generation is made durable whenever it advances, so it survives a restart
• an extension still holding a pre-update generation converges on its own, with no reboot

The session counter is a persisted counter, not a clock value or a random id, so a backwards clock correction or a dual boot cannot make a newer helper look older. If the extension does refuse a snapshot, the app now recovers automatically by restarting the filter provider, bounded to 3 attempts spaced 30s apart, and never asks you to reboot.

The helper stands down when the app is dragged to the Trash (#71).

If the FreeSnitch bundle is gone, the root helper now stops enforcing instead of leaving a registered service behind whose binary no longer exists. It deliberately never unregisters, boots out or deletes anything, because an in-place update is exactly the moment a bundle looks briefly absent. It requires 5 separated absence observations spanning at least 600s before it stands down.

Repair Helper does the privileged restart itself (#69).

Confirmed fixed since 0.4.1: repairing a stale helper happens behind a macOS authorization prompt, not by pasting a sudo command into Terminal. The enabled service is never unregistered, so your approval stays intact.