v0.2.2-alpha
Pre-release
If you downloaded v0.2.1-alpha, this is the one you wanted. That tag was
cut before the branding work landed, so its binary is the unbranded build.
The product has a name
It is called PCAP Triage. The binary, the repository and the module path
stay pcaptriage — only the strings a person reads changed: the window title,
the Help menu, the home screen, the About page, and the Windows file
properties.
The exported report's tool.name field deliberately still says pcaptriage.
It identifies which binary produced the file rather than naming the product,
so anything you have built against the JSON output is unaffected.
The placeholder icon is gone
The app shipped with the stock Wails logo. That glyph is what Windows showed
in Task Manager, on the taskbar, and on the SmartScreen prompt — the moment a
first-time user decides whether to trust an unsigned download from a stranger.
It is now the product mark, drawn separately at each size rather than
resampled: line art above 48px, a solid silhouette between 25 and 47, and
hand-placed pixels at 16 and 20. A scaled-down line drawing at 16px is an
unreadable grey smudge, which is the problem this replaced.
The mark also appears in the app bar and at the head of every exported report.
The report is the artifact that gets attached to tickets and emailed to
vendors, so it is the one that most needed to look like it came from
somewhere.
The report no longer says two things that were false
Its masthead carried a hardcoded "Partial build." directly above a sentence
announcing a complete rule set, and its capture-completeness note said the
capture-quality assessment "is R15, which is not implemented in this build"
while listing conditions that check already detects. Both stopped being true
when the fifteenth rule landed and stayed in place for two releases.
The report now states only what is derived from the rule registry, so neither
claim can contradict the build again. For a tool whose whole argument is that
it does not overclaim, false copy in the artifact that leaves the building was
the worst place for it.
Also
The repository now runs its test suite in CI on every push. It had never run
anywhere but a working tree that already had the files, which is how the
golden files sat committed with the wrong line endings through two releases —
every one of those tests would have failed on a fresh clone, and nothing ever
tried one.
No rule, threshold, detection logic or output schema changed in this
release. The JSON output is byte-identical to v0.2.1-alpha's for the same
capture.
Install
Download pcaptriage-gui.exe below. There is no installer — it is a single
file. Windows only.
Windows will warn you the first time. The binary is not code-signed, so
SmartScreen shows "Windows protected your PC" with an unknown publisher. That
is expected: code-signing certificates cost money annually and this is a free
tool. Click More info, then Run anyway.
Still an alpha. The thresholds deciding what counts as unusual are starting
points. Feedback on whether the ranking puts the right thing first remains the
most useful thing to send back — as does any capture it mishandles.