Flowlight 0.6.3

What's new in 0.6.3

Rule templates, and applying one to the row you're looking at.

Writing a good blocking rule means knowing what to block, and that is the part nobody has time for. There are twenty-two templates now, in five groups:

• AI agents — no package installs, no container images or model weights, no other model providers, GitHub read-only.
• Ways out — paste sites, webhook catchers, anonymous file drops, tunnels, mail-sending services, DNS over HTTPS, consumer cloud storage.
• Telemetry and analytics — product analytics, crash and error reporting, Apple advertising and analytics, install attribution.
• Working hours — this app only during working hours, not at the weekend, this destination during working hours.
• One-off investigation — block this for an hour, or until Flowlight quits, while you work out what it is.

Apply one from anywhere. Right-click a row in Live, Reports, AI Agents or Inspect and the templates that make sense for what that row knows are offered. A whole-Mac template only appears on a destination row if it already covers that destination, so right-clicking an analytics endpoint offers the analytics template and right-clicking something unrelated doesn't get fifteen irrelevant items.

Nothing permanent happens unseen. Only rules that undo themselves — an hour, or this run of Flowlight — are applied straight away. Anything permanent opens the editor pre-filled; anything writing more than one rule opens a card listing every host, every schedule and the caveat, because there is no sensible editor for seven rules at once.

The domains were checked, not copied. Lists circulating on the internet carry dead entries — metrics.apple.com, bashupload.com and anonfiles.com are all gone, and all three are still in lists people use. Every destination here was resolved before it went in. The reverse case is more interesting: Statsig ingests through unbranded domains like featuregates.org and prodregistryv2.org, which nobody scanning a traffic list would ever pick out. That is the argument for a template library existing at all.

Each template says what it can't do. Where one needs HTTPS inspection, or the Network Extension, the card says so — and "stop an agent opening SSH" isn't here at all, because rules match destinations rather than ports and a half-working template is worse than an absent one.

Install

Signed with Developer ID and notarized by Apple.

• brew install --cask xinbetween/tap/flowlight
• Flowlight.dmg — drag to Applications.
• Flowlight-0.6.3.pkg — installs to /Applications; offers to quit a running copy first.

macOS 15 or later, Apple silicon and Intel.

Checksums

b4748dfbcf417e19d21bfe15958cb70732400079730bfcfc2caabc1d2cef9320  Flowlight.dmg
5b19a3f02ed3df8915c0bdbf4949ed5741406600969e3389b0aaba9d6494429a  Flowlight-0.6.3.pkg