feat: snare respond — one guided clean-up instead of nine commands - #33
Merged
Conversation
added 2 commits
August 29, 2026 13:45
The site was one 67KB scroll with an eight-item nav and no mobile navigation at all. It is now nine pages built from fragments in docs/src/ by docs/build.sh, sharing one stylesheet and one script. Nav is six items instead of eight, plus a version pill that links to the changelog. Old anchors are forwarded — /#infected, /#install, /#detect, /#commands and /#security are already published in the dev.to write-up, the X thread and the notices filed on nine repositories, so they redirect to their new pages rather than dropping people at the top of the home page. Three layout bugs, two of which predate this change: - No mobile navigation. Under 720px every link was display:none, so a phone had the logo and a button. There is now a real drawer; Escape closes it and focus returns to the toggle. - Content touched the screen edge. .hero used the padding shorthand, which reset the horizontal padding it inherits from .wrap to zero. Block-only padding now, with a 16px floor on the gutter. - ol.chain descriptions collapsed into the 32px counter column. The <span> had no grid-column, so it auto-placed onto the next row in column one. This hit the mechanism steps and the bug-report list. New pages: docs.html gathers the documentation and closes two gaps — authentication and extending detection were in the README but nowhere on the site. changelog.html is built from CHANGELOG.md with false-clean defects listed first. community.html carries the discussion links and a giscus thread backed by GitHub Discussions. giscus is the only third-party code here and it loads on community.html alone, never on a page carrying a command someone might paste into a shell. It needs the giscus app installed on the repository; until then the page shows a link to Discussions instead. Also adds sitemap.xml and robots.txt, per-page titles, descriptions and canonical URLs, a sticky section bar on the reference pages, and a theme toggle. set-links.sh now edits docs/src/index.html.
AviOfLagos
added a commit
that referenced
this pull request
Aug 29, 2026
* site: split the field guide into real pages, and fix three layout bugs The site was one 67KB scroll with an eight-item nav and no mobile navigation at all. It is now nine pages built from fragments in docs/src/ by docs/build.sh, sharing one stylesheet and one script. Nav is six items instead of eight, plus a version pill that links to the changelog. Old anchors are forwarded — /#infected, /#install, /#detect, /#commands and /#security are already published in the dev.to write-up, the X thread and the notices filed on nine repositories, so they redirect to their new pages rather than dropping people at the top of the home page. Three layout bugs, two of which predate this change: - No mobile navigation. Under 720px every link was display:none, so a phone had the logo and a button. There is now a real drawer; Escape closes it and focus returns to the toggle. - Content touched the screen edge. .hero used the padding shorthand, which reset the horizontal padding it inherits from .wrap to zero. Block-only padding now, with a 16px floor on the gutter. - ol.chain descriptions collapsed into the 32px counter column. The <span> had no grid-column, so it auto-placed onto the next row in column one. This hit the mechanism steps and the bug-report list. New pages: docs.html gathers the documentation and closes two gaps — authentication and extending detection were in the README but nowhere on the site. changelog.html is built from CHANGELOG.md with false-clean defects listed first. community.html carries the discussion links and a giscus thread backed by GitHub Discussions. giscus is the only third-party code here and it loads on community.html alone, never on a page carrying a command someone might paste into a shell. It needs the giscus app installed on the repository; until then the page shows a link to Discussions instead. Also adds sitemap.xml and robots.txt, per-page titles, descriptions and canonical URLs, a sticky section bar on the reference pages, and a theme toggle. set-links.sh now edits docs/src/index.html. * feat: restore snare respond (lost when main moved) snare respond was merged as #33, then main was moved back to 56df09b before the multi-page site branch was merged on top, so the commit is no longer an ancestor of main and lib/respond.sh disappeared from the tree. This restores 8641f7e unchanged. It touches only bin/snare and lib/respond.sh and does not go near docs/, so the new multi-page site is untouched. Verified against the current main: shellcheck clean, selftest 10/10, the non-interactive guard still refuses, and the help-completeness check passes with respond included. --------- Co-authored-by: Apple <Apple@MacBook-Air.local> Co-authored-by: Avioflagos <ellumainc@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Someone who has just found 15 infected repos shouldn't have to pick between nine commands and read a manual to learn the order. The order is the part that matters and it isn't obvious.
Six steps, each asking before acting: triage → rotate → machine → scan → fix → notify → verify.
Rotation assists rather than blocks
npm tokens are the highest-priority credential and fully automatable, so snare lists them and offers to revoke them outright. It lists SSH keys, opens the browser for what it can't act on, and prints the rest.
Then it asks whether you've rotated — and if you haven't, it continues. A hard block sounds responsible, but a blocked user abandons the whole clean-up, which is worse than a warned one. The answer is recorded, re-raised before anything is pushed, restated at the end, and shown in
--statusuntil dealt with.The destructive choice is made once
tips-or-purge is asked once, up front, with what purging costs spelled out. Asking per-repo invites a rhythm of
y y ythrough the most destructive operation in the tool. Per-repo you then gety/N/all/skip.Resumable
A bad case is an hour of work. State lives in
$SNARE_HOME/respond-state; re-running skips completed steps and doesn't redo finished repos.--statusshows progress,--resetstarts over.Safety
Refuses to run unattended (no tty, or
CIset) with exit 2 and the individual commands printed. Never prompts where nobody can answer, never assumes yes, and everything that pushes defaults to no.doctorstays read-only and now points atrespond.Verified: non-interactive refusal, CI refusal, full cascade with scripted answers, resume skipping completed steps, and
--reset.Docs update deliberately not included — @AviOfLagos is reworking the site layout, so the website copy for this lands separately to avoid a collision.