feat: tell people they are behind, without being asked - #41
Merged
Merged
Conversation
`snare update --check` only ever helped someone who already suspected they
were out of date. The people who most need the fixes are the ones who cloned
once and never thought about it again — and several defects made the scanner
report a repository clean when it was not, which is precisely the result that
stops you looking further.
Every command now surfaces it, subject to three rules:
never blocks the network check runs detached and only a CACHED answer is
read on the command path. Measured: `snare help` 0.03s.
stays quiet one line, and only when actually behind
sends nothing a git ls-remote against a public repository. No identifier,
no telemetry, nothing about the user or their repositories.
Off with SNARE_NO_UPDATE_CHECK=1, and suppressed in CI or when stdout is not a
terminal, so it never lands in a pipe, a log or a script's output.
The detached refresh is best effort and nothing depends on it. Two things were
learned the hard way here: macOS ships no setsid, and backgrounding succeeds
even when the command does not exist, so the `||` fallback guarding it could
never fire. So the cache is also refreshed synchronously by the commands that
already wait on the network — doctor and scan github — which costs a user
nothing they would notice and makes the nudge work even where detaching does
not survive.
Also: `snare version` ran a live git fetch to decide whether to nudge, so a
command that prints one line took about five seconds on a slow link. It reads
the cache now. `update --check` still does the live check, because there the
waiting is the point.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
AviOfLagos
added a commit
that referenced
this pull request
Sep 10, 2026
…#42) The release notes were written twice — once in CHANGELOG.md and once as 233 lines of hand-written HTML in docs/src/changelog.html. Nothing kept them in agreement, so the site could tell someone a fix had shipped when it had not, which for this project is the same category of problem as a scanner reporting clean on an infected repository. CHANGELOG.md is the single source now. docs/changelog-gen.py renders it into the page's existing markup: releases become sections, "### Fixed — false clean results" and "### Fixed — destructive behaviour" mark their group and items critical, (#41) becomes a link to the pull request, and @name becomes a profile link. Update the changelog in a pull request and the website follows on the next build — no second edit, and no way to drift. CI fails if SNARE_VERSION has no matching CHANGELOG.md entry, or if the generator produces no section for it. A version bump that forgets the changelog would otherwise publish a page that silently omits the release. 1.2.0 itself is mostly other people's work: the remediation fix from @phoenixdahdev (#39), which stopped `fix` deleting the build config it was supposed to repair, and the new campaign it documents — npm's own lib/cli.js rewritten in place, so every `npm` invocation ran the loader. Co-authored-by: Avioflagos <ellumainc@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
snare update --checkonly helped someone who already suspected they were out of date. The people who most need the fixes are the ones who cloned once and never thought about it again — and several defects made the scanner report a repo clean when it wasn't, which is exactly the result that stops you looking further.Every command now surfaces it:
snare helpmeasured at 0.03sgit ls-remoteagainst a public repo. No identifier, no telemetryOff with
SNARE_NO_UPDATE_CHECK=1; suppressed in CI and when stdout isn't a terminal, so it never lands in a pipe or a log.Two things learned the hard way: macOS ships no
setsid, and backgrounding succeeds even when the command doesn't exist — so the||fallback guarding it could never fire. The detached refresh is therefore best-effort, and the cache is also refreshed synchronously bydoctorandscan github, which already wait on the network. Verified: cache populates deterministically afterdoctor.Also fixed:
snare versionran a livegit fetchto decide whether to nudge, so a one-line command took ~5s on a slow link. It reads the cache now.Verified: exit status preserved (findings still exit 1), silent when piped, silent under
CI=1, silent with the opt-out, and renders correctly on a tty when behind.🤖 Generated with Claude Code