v0.3.0

What's changed

New

• Render responses inside Sniper. A Render tab beside Pretty, Raw and Hex draws HTML and image responses in HTTP history, Replay and the fuzzer's results, the way Burp's Render tab and Caido's preview do. Pages are drawn in a sandboxed frame: scripts, forms, links and network access are off, so a captured page cannot run or call anything, Sniper's own API included. Thanks to @ksw9722 (#18).
• Load a rendered page's images, styles and fonts — off by default. Settings ▸ Display ▸ Render ▸ Load images, styles and fonts fetches what a page names through Sniper and the session's proxy chain and writes it into the page; scripts still never run. Those requests go to the target and to any other host the page names, and are not recorded in HTTP history.
• Reach chosen hosts directly while everything else uses the proxy chain. Connect directly to, under the proxy chain settings, takes scope patterns such as *.example.com and applies to captured HTTP and HTTPS, TLS passthrough, WebSockets and Replay. Replay's destination override now works with a chain when its target is on the list. sniper-cli capture proxy reads and writes the list as bypass_hosts. Thanks to @ksw9722 (#15).
• Read stored findings and event logs from the CLI. sniper-cli findings list, findings get, findings count and event-log list are read-only, pin the session they read, and keep dry runs offline.
• Manage passive scanner rules from the CLI. sniper-cli scanner config, scanner builtin and scanner custom read and edit a session's built-in and custom passive rules, with strict validation, dry runs, and a guard that refuses to overwrite a newer edit.
• Close and duplicate saved Replay tabs from the CLI. sniper-cli replay close and replay duplicate (and POST /api/replay/tabs/close and /duplicate) change saved HTTP Replay tabs without sending any traffic, guarded by the workspace revision. An open app picks the change up without losing a draft you have not saved.

Bug Fixes

• A streamed response no longer stays at "0 B" in HTTP history. Its row kept the in-progress size and note until a reload; it now updates when the body finishes, and an open inspector reloads the record.
• sniper-cli replay open --scheme http keeps the request's own port. A raw request with Host: localhost:18891 was sent to port 80. Only a scheme's default port, such as 443, is dropped now, the rule replay update already followed.

Packages

• macOS — a universal DMG (arm64 + x86_64), which is what the in-app updater looks for, with a .sha256 beside it.
• Windows x64 — a -setup.exe installer and a portable ZIP with sniper-desktop.exe, sniper.exe and sniper-cli.exe, each with a .sha256, built and attached by CI from this commit. Both need the Microsoft Edge WebView2 Runtime and are unsigned — check the checksum before running. See Windows setup and packaging.

Full Changelog

v0.2.13...v0.3.0