docs: generate the release notes from CHANGELOG.md, and release 1.2.0 (#42)

The release notes were written twice — once in CHANGELOG.md and once as 233
lines of hand-written HTML in docs/src/changelog.html. Nothing kept them in
agreement, so the site could tell someone a fix had shipped when it had not,
which for this project is the same category of problem as a scanner reporting
clean on an infected repository.

CHANGELOG.md is the single source now. docs/changelog-gen.py renders it into
the page's existing markup: releases become sections, "### Fixed — false clean
results" and "### Fixed — destructive behaviour" mark their group and items
critical, (#41) becomes a link to the pull request, and @name becomes a profile
link. Update the changelog in a pull request and the website follows on the
next build — no second edit, and no way to drift.

CI fails if SNARE_VERSION has no matching CHANGELOG.md entry, or if the
generator produces no section for it. A version bump that forgets the changelog
would otherwise publish a page that silently omits the release.

1.2.0 itself is mostly other people's work: the remediation fix from
@phoenixdahdev (#39), which stopped `fix` deleting the build config it was
supposed to repair, and the new campaign it documents — npm's own lib/cli.js
rewritten in place, so every `npm` invocation ran the loader.

Co-authored-by: Avioflagos <ellumainc@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 3 people

.github/workflows/ci.yml

@@ -53,6 +53,20 @@ jobs:
           [ "$missing" = 0 ] && echo "help covers every top-level command"
           exit $missing
 
+      # The site's release notes are generated from CHANGELOG.md, so a version
+      # bump with no changelog entry would ship a page that silently omits the
+      # release. Fail here rather than there.
+      - name: Version has a changelog entry, and the site regenerates
+        run: |
+          v="$(grep -m1 '^SNARE_VERSION=' bin/snare | cut -d'"' -f2)"
+          grep -q "^## \[$v\]" CHANGELOG.md \
+            || { echo "::error::SNARE_VERSION is $v but CHANGELOG.md has no ## [$v] entry"; exit 1; }
+          echo "changelog has an entry for $v"
+          python3 docs/changelog-gen.py CHANGELOG.md > /tmp/rel.html
+          grep -q "id=\"v$(echo "$v" | tr . -)\"" /tmp/rel.html \
+            || { echo "::error::changelog-gen produced no section for $v"; exit 1; }
+          echo "release notes render for $v"
+
       - name: Detection works (selftest)
         run: |
           chmod +x bin/snare

CHANGELOG.md

@@ -182,6 +182,88 @@ Campaign `A8-4893-2`, two stages with two unrelated C2 addresses:
   and that a genuine font, a clean source file and an honest build task are left
   alone. 24 checks in total.
 
+## [1.2.0] — 2026-09-10
+
+Remediation could delete the file it was meant to clean. If you ran
+`snare fix --push` on a release before this one, check the repository: a build
+config may have been removed rather than repaired.
+
+### Fixed — destructive behaviour
+
+- **`fix` deleted the build config instead of cleaning it.** The delete pass
+  removed any file matching an IOC string, and a payload appended to
+  `postcss.config.mjs` *is* an IOC string — so the file was gone before the
+  strip pass further down the same function could reach it. It pushed a commit
+  that removed the malware and the project's build with it. Stripping runs
+  first now, and a file the project needs is cleaned and kept, never deleted.
+  Reported and fixed by @phoenixdahdev. (#39)
+- **`.vscode/tasks.json` was deleted whole**, losing honest build tasks along
+  with the injected `folderOpen` one. Only the malicious task goes now. (#39)
+- **A payload on a line of its own was never removed.** Both cleaners keyed on
+  the one-line signature. The new rule is gated narrowly — long, minified in
+  shape, a hard campaign marker *and* obfuscated code — because dropping a
+  whole line on a weaker signal is itself destructive. (#39)
+
+### Fixed — detection and coverage
+
+- **Worm artifacts and fake assets are now found by filename and magic bytes**
+  during remediation, not only during scanning: `scan` reported them and `fix`
+  walked straight past. (#39)
+- **npm's own `lib/cli.js` is checked.** A live host was found with ~1.4MB
+  appended to it after 200 spaces, so every `npm` invocation ran the loader —
+  `--ignore-scripts` does not help, because it is the package manager itself
+  and not a package script. New campaign `A8-4893-2`, with two C2 addresses and
+  a socket.io RAT held by a crontab `@reboot` line. (#39)
+- The doctor fixture path is normalised, so the npm check no longer failed on
+  macOS while passing on Linux — the suite reported "detection is broken" for a
+  detector that was working correctly. (#39)
+
+### Fixed — contribution and platform
+
+- **No pull request from a fork could ever pass CI.** `ci.yml` passed
+  `github.head_ref` to the reusable workflow, which then tried to check that
+  ref out of this repository — a fork's branch does not exist here, so checkout
+  failed three times before a single check ran. The first outside contribution
+  hit it, and the failure looked like the contributor's fault rather than ours.
+  It uses `refs/pull/N/head` now. (#40)
+- **Windows `guard install` failed with no explanation.** `schtasks.exe` needs
+  a Windows path and was handed an MSYS one, and every error was discarded. It
+  now converts the path, prints the real error, and falls back to a Startup
+  entry that needs no administrator rights. (#32)
+- snare flagged its own plugin manifest and skill, which quote the malware's
+  keywords because they describe it. (#38)
+
+### Added
+
+- **`snare respond`** — one guided clean-up instead of nine commands, in the
+  order that actually works: rotate credentials, clean the machine you push
+  from, then the repositories, then tell your collaborators. Resumable, asks
+  before every action, refuses to run unattended. (#33, #34)
+- **A passive update notice.** Every command now says, at most once a day and
+  in one line, when the installation is behind. It never blocks — the check is
+  cached and refreshed off the command path — sends nothing, and is off with
+  `SNARE_NO_UPDATE_CHECK=1`. The people who most need the fixes are the ones
+  who cloned once and never thought about it again. (#41)
+- **snare ships as a Claude Code plugin**, so a coding agent can find and run
+  it. (#38)
+- An incident-response walkthrough on the site, and a copy-paste prompt for
+  people who would rather have an AI assistant do the work — written to forbid
+  the assistant from running anything destructive without asking. (#36)
+
+### Changed
+
+- Post-scan guidance leads with rotating credentials and cleaning your machine,
+  not with `snare fix`. Cleaning repositories first is wasted work while the
+  machine that pushes to them is still infected. (#31)
+- The notify templates lead with rotation too, and carry the full list
+  including the clipboard and the Actions workflow that keeps exfiltrating
+  after the dropper is gone. (#32)
+- `snare version` no longer runs a live fetch to decide whether to nudge; a
+  one-line command took about five seconds on a slow link. (#41)
+- The site is a multi-page field guide with corrected document semantics, a
+  crawler policy naming 29 search and AI crawlers, `llms.txt`, and structured
+  data on every page. (#33, #35, #37)
+
 ## [1.1.0] — 2026-08-29
 
 Everything since the initial release. If you installed snare before this,

bin/snare

@@ -3,7 +3,7 @@
 # https://github.com/  •  MIT
 set -uo pipefail
 
-SNARE_VERSION="1.1.0"
+SNARE_VERSION="1.2.0"
 # Resolve through symlinks: install.sh links this into ~/.local/bin, so
 # BASH_SOURCE is the link, not the real file. (readlink -f is not portable.)
 _src="${BASH_SOURCE[0]}"

docs/build.sh

@@ -17,6 +17,8 @@ cd "$(dirname "$0")"
 
 SITE="https://avioflagos.github.io/snare/"
 REPO="https://github.com/AviOfLagos/snare"
+tmp_rel="$(mktemp "${TMPDIR:-/tmp}/snarerel.XXXXXX")"
+trap 'rm -f "$tmp_rel"' EXIT
 VERSION="$(sed -n 's/^## \[\([0-9.]*\)\].*/\1/p' ../CHANGELOG.md | head -1)"
 [ -n "$VERSION" ] || { echo "could not read version from ../CHANGELOG.md" >&2; exit 1; }
 
@@ -201,7 +203,21 @@ NAVTOP
 NAVBOT
 
     # ---- body ----
-    grep -v '^<!--#' "$src"
+    # <!--#releases--> becomes the release notes rendered from CHANGELOG.md.
+    # They used to be written twice — there and as hand-written HTML here — so
+    # the site could claim a fix had shipped when it had not. One source now.
+    if grep -q '<!--#releases-->' "$src"; then
+      python3 changelog-gen.py ../CHANGELOG.md > "$tmp_rel" \
+        || { echo "changelog-gen failed for $src" >&2; exit 1; }
+      grep -v '^<!--#' "$src" | while IFS= read -r line; do
+        case "$line" in
+          *'<!--#releases-->'*) cat "$tmp_rel" ;;
+          *) printf '%s\n' "$line" ;;
+        esac
+      done
+    else
+      grep -v '^<!--#' "$src"
+    fi
 
     # ---- pager ----
     if [ -n "$prev" ] || [ -n "$next" ]; then

docs/changelog-gen.py

@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+"""Render CHANGELOG.md into the changelog page body.
+
+The release notes used to be written twice — once in CHANGELOG.md and once as
+hand-written HTML in docs/src/changelog.html — which meant they could disagree,
+and the website could tell someone a fix had shipped when it had not. This
+makes CHANGELOG.md the single source: update it in a pull request and the site
+follows on the next build.
+
+Mapping:
+    ## [1.2.0] — 2026-09-10   -> a release section, newest marked "Current"
+    ### Fixed — ...           -> a group heading; "false clean" or "destructive"
+                                 marks the group and its items critical, because
+                                 those are the failures that matter most here
+    - **Lead.** body (#41)    -> a list item, refs linked to the pull request
+    `code`  **bold**  *em*    -> <code> <strong> <em>
+"""
+import html
+import re
+import sys
+
+REPO = "https://github.com/AviOfLagos/snare"
+
+
+def inline(text: str) -> str:
+    """Escape, then re-introduce the small set of inline markup we allow."""
+    t = html.escape(text, quote=False)
+    t = re.sub(r"`([^`]+)`", r"<code>\1</code>", t)
+    t = re.sub(r"\*\*([^*]+)\*\*", r"<strong>\1</strong>", t)
+    t = re.sub(r"(?<!\*)\*([^*\n]+)\*(?!\*)", r"<em>\1</em>", t)
+    # (#41) and (#33, #34) -> links. @user -> a profile link.
+    def refs(m):
+        nums = re.findall(r"#(\d+)", m.group(1))
+        if not nums:
+            return m.group(0)
+        joined = ", ".join(f"#{n}" for n in nums)
+        return f' <a href="{REPO}/pull/{nums[0]}">{joined}</a>'
+    t = re.sub(r"\s*\(((?:#\d+(?:,\s*)?)+)\)", refs, t)
+    t = re.sub(r"@([A-Za-z0-9-]+)", r'<a href="https://github.com/\1">@\1</a>', t)
+    return t
+
+
+def slug(v: str) -> str:
+    return "v" + v.replace(".", "-")
+
+
+def is_critical(heading: str) -> bool:
+    h = heading.lower()
+    return "false clean" in h or "destructive" in h
+
+
+def parse(md: str):
+    """-> [ {version, date, lede, groups:[{title, critical, items:[str]}]} ]"""
+    releases, cur, group = [], None, None
+    lede_lines, item = [], None
+
+    def flush_item():
+        nonlocal item
+        if item is not None and group is not None:
+            group["items"].append(" ".join(item).strip())
+        item = None
+
+    def flush_lede():
+        nonlocal lede_lines
+        if cur is not None and lede_lines and not cur["lede"]:
+            cur["lede"] = " ".join(lede_lines).strip()
+        lede_lines = []
+
+    for raw in md.split("\n"):
+        line = raw.rstrip()
+        m = re.match(r"^## \[([0-9][0-9.]*)\]\s*—\s*(.+)$", line)
+        if m:
+            flush_item(); flush_lede()
+            cur = {"version": m.group(1), "date": m.group(2).strip(),
+                   "lede": "", "groups": []}
+            releases.append(cur); group = None
+            continue
+        if cur is None:
+            continue
+        m = re.match(r"^### (.+)$", line)
+        if m:
+            flush_item(); flush_lede()
+            group = {"title": m.group(1).strip(),
+                     "critical": is_critical(m.group(1)), "items": []}
+            cur["groups"].append(group)
+            continue
+        m = re.match(r"^- (.+)$", line)
+        if m:
+            flush_item()
+            item = [m.group(1)]
+            continue
+        if item is not None and line.startswith("  ") and line.strip():
+            item.append(line.strip())          # continuation of a list item
+            continue
+        if line.strip():
+            if group is None:
+                lede_lines.append(line.strip())  # prose under the release
+        else:
+            flush_item()
+    flush_item(); flush_lede()
+    return releases
+
+
+def render(releases) -> str:
+    out = []
+    for i, r in enumerate(releases):
+        tag = '\n        <span class="tag now">Current</span>' if i == 0 else ""
+        out.append(f'<section class="stack" id="{slug(r["version"])}">')
+        out.append('  <div class="rel">')
+        out.append('    <div class="rel-head">')
+        out.append(f'      <h2 class="rel-v">{html.escape(r["version"])}</h2>')
+        out.append(f'      <span class="rel-date">{html.escape(r["date"])}</span>{tag}')
+        out.append('    </div>')
+        if r["lede"]:
+            out.append(f'    <p class="lede">{inline(r["lede"])}</p>')
+        for g in r["groups"]:
+            cls = ' class="crit"' if g["critical"] else ""
+            out.append('    <div class="rel-group">')
+            out.append(f'      <h3{cls}>{inline(g["title"])}</h3>')
+            out.append('      <ul class="rel-list">')
+            for it in g["items"]:
+                out.append(f'        <li{cls}>{inline(it)}</li>')
+            out.append('      </ul>')
+            out.append('    </div>')
+        out.append('  </div>')
+        out.append('</section>')
+    return "\n".join(out)
+
+
+if __name__ == "__main__":
+    src = sys.argv[1] if len(sys.argv) > 1 else "../CHANGELOG.md"
+    rels = parse(open(src).read())
+    if not rels:
+        sys.exit("changelog-gen: no releases parsed from " + src)
+    sys.stdout.write(render(rels) + "\n")