* ci: add go vet + staticcheck, branch protection, dependabot

* fix: remove unused listTokens and alertPayload (staticcheck U1000)

---------

Co-authored-by: clap [bot] <[email protected]>

Co-authored-by: clap [bot] <[email protected]>

* fix: omit SessionToken from awsproc credential_process JSON output

* ci: retrigger

---------

Co-authored-by: clap [bot] <[email protected]>

…igured (#8)

Co-authored-by: clap [bot] <[email protected]>

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5 to 6.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: implement snare scan command

- Add `snare scan` command to check canary integrity on disk
- Reports OK (✓), MODIFIED (⚠), MISSING (✗) per active canary
- Detects ORPHANED (?) canaries: snare.sh/c/ URLs in known paths with no manifest record
- Exits non-zero if any issues found (modified, missing, or orphaned)
- Output style matches `snare status` — clean, aligned, emoji indicators
- Add `snare scan` to usage string and command dispatch in Run()
- Export ScanManifest, ScanForOrphans, ScanResult, OrphanResult for testing
- Add scan_test.go with 14 tests covering all status categories + CLI integration
- bait.go already referenced `snare scan` correctly in error message

* feat: add huggingface, docker, azure canary types

---------

Co-authored-by: clap [bot] <[email protected]>

- Add `snare scan` command to check canary integrity on disk
- Reports OK (✓), MODIFIED (⚠), MISSING (✗) per active canary
- Detects ORPHANED (?) canaries: snare.sh/c/ URLs in known paths with no manifest record
- Exits non-zero if any issues found (modified, missing, or orphaned)
- Output style matches `snare status` — clean, aligned, emoji indicators
- Add `snare scan` to usage string and command dispatch in Run()
- Export ScanManifest, ScanForOrphans, ScanResult, OrphanResult for testing
- Add scan_test.go with 14 tests covering all status categories + CLI integration
- bait.go already referenced `snare scan` correctly in error message

Co-authored-by: clap [bot] <[email protected]>

Co-authored-by: clap [bot] <[email protected]>

Previously, snare arm planted ALL canaries by default and --precision
opted into the smaller high-signal set (awsproc, ssh, k8s).

This flips the default: precision mode (awsproc, ssh, k8s only) is now
the default behavior of snare arm. An --all flag opts into all canaries
including dotenv-based ones.

Rationale: Snare is built for developers running AI agents. Dotenv
canaries fire whenever any agent loads ~/.env, causing false positives
for the primary user base. Precision canaries (awsproc, ssh, k8s) fire
only on active credential use — zero false positives from your own
tooling.

Changes:
- snare arm with no flags → precision mode (awsproc, ssh, k8s only)
- snare arm --all → all canaries
- Remove --precision flag (now the default; --all is the opt-in)
- Update usage string, help text, and README
- Update tests: replace TestPrecisionMode/TestPrecisionModeOutput with
  TestDefaultPrecisionMode, TestDefaultArmOutput, TestAllFlagOutput

Co-authored-by: clap [bot] <[email protected]>

* chore: bump CHANGELOG for v0.2.0

* fix: giveaway-free token generation + rename v0.2.0 to v0.1.2

---------

Co-authored-by: clap [bot] <[email protected]>

…s, events --summary (#16)

* chore: bump CHANGELOG for v0.2.0

* fix: giveaway-free token generation + rename v0.2.0 to v0.1.2

* fix: azure in precision mode, npm reliability correction, precision mode text

- Add TypeAzure to precision defaults — HIGH reliability, fires only on
  active Azure SDK token refresh, no false positives from own tooling
- npm: correct reliability from Medium to High everywhere (README, cli text)
  npm fires on any scoped registry install — same class as k8s/ssh/awsproc
- Update precision mode display text to include azure
- Update README precision mode description

* fix: remove azure from precision mode

service-principal-credentials.json is not in the standard Azure SDK
credential chain — it requires an agent to explicitly hunt and parse
the file, making it medium reliability. Back to 3 precision canaries:
awsproc, ssh, k8s.

* feat: add --select mode to snare arm

Interactive TUI checklist for picking canaries. Precision types
pre-checked by default. Arrow keys / j/k to navigate, Space to
toggle, Enter to confirm, q/Ctrl-C to abort.

Shortcuts:
  a  select all
  n  select none
  p  reset to precision defaults

Requires an interactive terminal; fails clearly if stdin is not a TTY.
No new dependencies — raw mode via syscall.TCGETS/TCSETS.

* feat(canaries): add git credential.helper canary (TypeGit)

* feat(canaries): enhance terraform network_mirror canary with fake namespace and safe mode

* fix(canaries): demote TypeGit from precision to high

credential.helper only fires after HTTP 401 from the fake host.
The fake hostname has no DNS record, so git errors at DNS resolution
before ever issuing the auth challenge — meaning the helper never runs
for the most common agent behavior (clone/pull).

High reliability: still valuable when an agent explicitly runs
'git credential fill' with discovered URLs (active credential hunting).
Not precision: doesn't fire automatically via SDK/OS auth flow.

* refactor: introduce three reliability tiers (precision/high/medium)

precision: awsproc, ssh, k8s — fire via SDK/OS hooks, no DNS needed
high:      aws, gcp, npm, git, pypi — fire on active credential use
medium:    azure, openai, anthropic, mcp, github, stripe, hf, docker, terraform, generic

Moves azure and git out of high, updates allSelectEntries order and tier
labels to match. pypi gets side-effect warning in --select display.

* feat(cli): add snare events --summary for ASN/UA distribution view

* fix(readme): correct precision mode — remove azure, update false positive claim, add --select

* chore: v0.1.2 release prep

- CHANGELOG: rewrite 0.1.2 entry with actual PR contents
- bait.go: fix TypeGit comment — HIGH not PRECISION, explain DNS limitation

* docs(readme): comprehensive v0.1.2 refresh

- Canary table: add git and terraform, fix azure to Medium, sort by tier
- Add three-tier system description (Precision/High/Medium) replacing old two-tier
- Commands: add snare arm --select, snare events --summary, snare scan
- Counts: 13 types → 18 types, 10+ → 18 throughout
- awsproc: replace 'no other canary tool' with specific CloudTrail comparison
- Comparison table: update type counts

* docs(arch): update precision mode reference (--precision removed, now default)

---------

Co-authored-by: clap [bot] <[email protected]>

syscall.TCGETS/TCSETS are Linux-only — darwin build failed in CI.
Split into terminal_linux.go, terminal_darwin.go, terminal_other.go.
darwin uses TIOCGETA/TIOCSETA ioctl constants instead.

Co-authored-by: clap [bot] <[email protected]>

Co-authored-by: clap [bot] <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>

Co-authored-by: clap [bot] <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>

Co-authored-by: clap [bot] <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>

…ie (#22) (#27)

* fix: replace dashboard ?token= query param with HttpOnly session cookie (#22)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: make session cookie Secure flag conditional on TLSDomain

Secure=true breaks plain HTTP self-hosted instances (localhost, internal
servers without TLS). Only set Secure when TLSDomain is configured.

---------

Co-authored-by: clap [bot] <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>

* ci: sign release checksums with Sigstore/cosign (#21)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* docs: add release verification instructions (#21)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: clap [bot] <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>

Co-authored-by: clap [bot] <[email protected]>