feat: v0.1.2 — three-tier canaries, --select mode, git/terraform types, events --summary#16
Merged
feat: v0.1.2 — three-tier canaries, --select mode, git/terraform types, events --summary#16
Conversation
added 14 commits
March 17, 2026 06:47
…ode text - Add TypeAzure to precision defaults — HIGH reliability, fires only on active Azure SDK token refresh, no false positives from own tooling - npm: correct reliability from Medium to High everywhere (README, cli text) npm fires on any scoped registry install — same class as k8s/ssh/awsproc - Update precision mode display text to include azure - Update README precision mode description
service-principal-credentials.json is not in the standard Azure SDK credential chain — it requires an agent to explicitly hunt and parse the file, making it medium reliability. Back to 3 precision canaries: awsproc, ssh, k8s.
Interactive TUI checklist for picking canaries. Precision types pre-checked by default. Arrow keys / j/k to navigate, Space to toggle, Enter to confirm, q/Ctrl-C to abort. Shortcuts: a select all n select none p reset to precision defaults Requires an interactive terminal; fails clearly if stdin is not a TTY. No new dependencies — raw mode via syscall.TCGETS/TCSETS.
…espace and safe mode
credential.helper only fires after HTTP 401 from the fake host. The fake hostname has no DNS record, so git errors at DNS resolution before ever issuing the auth challenge — meaning the helper never runs for the most common agent behavior (clone/pull). High reliability: still valuable when an agent explicitly runs 'git credential fill' with discovered URLs (active credential hunting). Not precision: doesn't fire automatically via SDK/OS auth flow.
precision: awsproc, ssh, k8s — fire via SDK/OS hooks, no DNS needed high: aws, gcp, npm, git, pypi — fire on active credential use medium: azure, openai, anthropic, mcp, github, stripe, hf, docker, terraform, generic Moves azure and git out of high, updates allSelectEntries order and tier labels to match. pypi gets side-effect warning in --select display.
…tive claim, add --select
- CHANGELOG: rewrite 0.1.2 entry with actual PR contents - bait.go: fix TypeGit comment — HIGH not PRECISION, explain DNS limitation
- Canary table: add git and terraform, fix azure to Medium, sort by tier - Add three-tier system description (Precision/High/Medium) replacing old two-tier - Commands: add snare arm --select, snare events --summary, snare scan - Counts: 13 types → 18 types, 10+ → 18 throughout - awsproc: replace 'no other canary tool' with specific CloudTrail comparison - Comparison table: update type counts
peg
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's in this PR
New canary types
git credential.helperin~/.gitconfig. Fires when an agent runsgit credential fillagainst the fake host.network_mirrorin~/.terraformrcwith fake provider namespace. New-file-only to avoid HCL corruption.New CLI features
snare arm --select— interactive TUI checklist. Arrow keys/j/k, Space toggle, Enter confirm. Precision canaries pre-checked. No new dependencies (raw mode via syscall).snare events --summary— ASN distribution, SDK/UA breakdown, likely-AI-agent count, per-canary hit counts. Covers 12 cloud provider ASNs.Reliability tier system
Three tiers replacing the old high/medium split:
Fixes
Tests
All 6 packages pass:
go test ./...Note: staging → main per normal workflow — Trevor's review required.