snare 1.5.0 — the gate: scan before code comes in or runs

snare now checks code before your coding agent pulls it in or runs it, and shows you what it found.

The incident behind this release was ordinary work: a pull, an install, npm run dev. A coding agent did it in a repository that had been poisoned upstream, and nobody found out for days. snare could have caught it. Nothing ran snare at that moment.

The gate

Before a clone, pull, merge, checkout, install or npm run, snare checks the code that command is about to bring in or run. If it's clean, the command goes ahead, adding about 0.4s; everyday commands like git status and ls add about 30ms. If it isn't clean, the command doesn't run and you see this:

🔥 FIRE ON THE MOUNTAIN — snare stopped this before it ran:
    npm run dev

  /path/to/repo carries a supply-chain payload:
  package.json:1 — "dev" runs api.js first, and api.js is obfuscated: one line of 29013 characters
      ↳ node api.js && next dev

Every finding shows the file, the line, what snare suspects and the code itself. It can be a false alarm: a minified file or an unusual config can look suspicious. So you decide:

• It's mine and harmless: snare gate allow '<repo>' asks about each finding. An approval is tied to the file's exact content, so if the file changes it's flagged again.
• Let snare take charge: snare respond.

Only the person at the keyboard can make either choice. A coding agent is refused both, and it can't turn the gate off.

Every coding agent gets it

snare asks before turning this on. When you install or update snare, it shows exactly which files it would change and asks. If you say yes, it adds the gate to Claude Code as a hook that runs automatically, and writes the same instruction into CLAUDE.md, AGENTS.md, ~/.codex/AGENTS.md and ~/.gemini/GEMINI.md, for each tool you have installed. Say no and nothing is changed, and you won't be asked again; snare agents install turns it on later. Nothing is installed when no one is at a terminal, or when a coding agent is the one running snare. snare agents status shows what's installed; snare agents uninstall restores your original files exactly.

snare respond acts on what it finds

• It starts with what the gate stopped, checked again now. For each one you choose clean (backed up and staged for your review, never committed or pushed), allow, or leave.
• If nothing turns out to be real, it offers to stop there instead of walking you through rotating every credential.
• A finished run starts a fresh check. Before, it replayed an old summary ("infected repos found: 2") without naming the repos or doing anything.

snare never deletes a repository or an organization

This is now enforced, not just true of today's code. Every GitHub and git call snare makes goes through one guard. It refuses repository and organization deletion, archiving and transfer, any API DELETE, and any push that removes remote branches. The selftest checks this, and fails if any code tries to get around the guard.

Also

• Husky is no longer reported as malware. A husky hook that downloads and runs code still is.
• The shell shield no longer breaks npm for coding agents.
• snare update refreshes the shield and the agent setup in place.

Known limits

• The automatic hook is Claude Code only. Codex, Cursor and Gemini get the written instruction, which they can ignore.
• npm install <package> runs that package's own install scripts. The gate checks the repository you are in, not the package you are adding.
• node_modules is left to snare scan repo.

Upgrade

snare update

Then check: snare agents status and snare doctor.

Full detail, including every bypass found and closed during seven review rounds, is in CHANGELOG.md.