v2.0.0 — the Mac agent becomes something you can look at

EgressView 2.0.0 = Hub 1.10.0 + Agent for Mac 0.3.0. The release number belongs to the pack; each component keeps its own. Nothing in the Hub breaks, which is why it is 1.10.0 and not 2.0.0.

The Mac agent stopped being a source of rows and became something you can look at. It draws where this Mac's traffic goes, which application sent it, when, and whether the destination appears on a threat feed — and it does the last one without telling anyone which addresses it asked about.

Threat information, checked on your Mac

Asking a service "is this address dangerous?" tells that service exactly which addresses worry you. So the indicators travel to the Mac and the questions never leave it.

• Hub-connected agents get the whole indicator set from their Hub over the new GET /api/agent/threat-intel — around 9,500 entries, ~580 KiB, ETag/304.
• Standalone agents may download the same four public lists themselves, opt-in and off by default. These are plain downloads, not lookup services: no key, and no destination of yours is sent.
• The choice between the two is never automatic. A Hub-enrolled agent is not offered the setting at all, so an hour of Hub downtime cannot start contacting third parties with nobody having touched anything.

Seeing your traffic

A globe with great-circle arcs leaving this Mac, a flow diagram from application to destination, and a timeline — sharing one period, so "which app caused that spike, and where was it going" is answerable. CSV export of the whole selected period. A connection log that sorts and filters by column, with country, data volume and port.

Saying what it does not know

This release fixes several faults that share one shape: the screen said nothing while something was wrong.

• The agent reported "Network monitoring active" while recording nothing. Four updates in a row stopped collection silently. Status now means traffic has actually arrived, and the app asks macOS every minute which copy of the extension it is running.
• The agent now records when it was really watching, shows what share of a period it could not see, and separates time the Mac was asleep — which is not a fault — from time it should have been recording and was not.
• Connections already open when monitoring starts are never observed. The charts say so rather than presenting a complete picture.
• An empty threat list is never shown as "nothing found" unless something was actually checked.

Also fixed

• The connection log ignored the name/address setting and always showed addresses.
• Export CSV did nothing when pressed — an accessory application has nothing to put a modal panel in front of.
• The agent used a fifth of a CPU core with its window open; it now loads only what the visible tab shows.

Upgrading

The Hub needs no migration from 1.9.0. The agent's own database migrates on launch (schema 4 → 7), append-only, preserving history. Threat information needs Hub 1.10.0 or newer; against an older Hub the agent says so rather than showing "no threats".

Full detail in the changelog.