v0.3.1

What's changed

New

• Map: a passive Service Map of what you captured. A new Map tool, right after Capture, draws the origins in a session's retained HTTP history and how they relate. It names the client behind each row, the servers behind each origin (edges, gateways, web and app servers, hosting platforms), the front-end frameworks, CMSs and libraries a page loads with their versions, how each origin authenticates, and what responses give away (debug pages, stack traces, source maps, keys, private addresses). Arrows are drawn by request kind (API call, navigation, frame, script, static file) and count CORS reads; a site's origins share a card; the map has its own display filter, as Burp's site map does. Nothing is probed, crawled, replayed or followed: the map reads only what is already retained.
• APIs: an origin's API as OpenAPI. Map ▸ APIs lists each origin's endpoints with ID segments grouped (/users/{number}), the parameters and body fields seen, statuses, media types and the credentials sent (never their values). Copy API docs copies an OpenAPI 3.1 document, and Open in Swagger Editor opens editor.swagger.io beside it.
• Scope on one screen again. Scope shows its rules beside the captured hosts and paths, with no views to switch.
• Recon: scoped endpoint discovery. A Recon tab combines a scoped static crawler, urlscan results and the Wayback CDX index into one session-owned endpoint inventory. A target is mandatory, scope defaults to its exact origin, history lookups and new urlscan scans each need their own acknowledgment, and every source reports its limits. Thanks to @ksw9722 (#24, #25).
• Opt-in HTTP history retention. Capture ▸ Settings ▸ HTTP History can keep the newest N rows per session. Off by default; rows that saved Replay tabs depend on are protected. sniper-cli capture http retention reads and sets the policy.
• Opt-in upstream socket peer. A Capture ▸ Settings card records the address each captured response came from, Off by default and never backfilled; sniper-cli capture http upstream-peer reads and sets it.
• More for agents. sniper-cli scope service-map (with openapi, unnamed and evidence reads) gives an agent the same map and API documents; intercept queues are readable with bounded waits; saved workspace data, tab labels and pins are readable and editable with revision guards; bundled skills report their status and can opt in to local updates.

Changed

• Findings list each issue once. A missing header or a cookie's flags is listed once per host, an error page, an exposed endpoint or an open redirect once per endpoint, and a leaked value, a version banner or a CORS origin once per value — not once per request. A session saved by an earlier version collapses the same way when it is opened.
• Far fewer false positives in Findings. Header checks judge only documents a browser navigates to (HSTS includes their redirects); CORS with credentials is no longer reported for the target's own site and is Low for another; version banners need a real version and skip CDN and gateway banners; three dotted words no longer count as a JWT; password, card, token and private-key rules skip code, templates, labels and UUIDs. On a 63,897-request crawl, stored findings went from 47,402 to 2,757.
• Findings name what the map names as exposed: management and debug endpoints (Spring Boot Actuator, phpinfo, Apache server-status, Go pprof, Jolokia and others), served .git/config and .env files, and backend addresses in BIG-IP cookies and proxy headers.

Bug Fixes

• No more lost bodies in a session you have not opened. Reading another session (--session-id, search, Replay from it) returned empty bodies after a restart, and a capture that completed into such a session saved its older rows without their bodies. Both now keep and read the bodies from disk.
• A page can no longer make Sniper loop on itself. The proxy forwarded requests for 127.1, 0, localhost., [::ffff:127.0.0.1] or any name resolving to this machine back into its own listener until it ran out of sockets; one fetch from a page browsed through Sniper was enough.
• Python clients accept Sniper's certificates. Python 3.13+ verifies strictly by default and refused every intercepted HTTPS connection ("Missing Authority Key Identifier"); Sniper's certificates now carry the identifier.
• Intercept rules match as Scope does. A rule for * or api-*.example.com held nothing.
• In-scope History rows stay when tagged or noted. With a glob or an exclude in Scope, such a row vanished from the "In scope" view on its next update.
• Cross-site reads of the local API are refused, so a page cannot make Sniper rebuild the map or search history without end.
• API docs never carry captured values: a ;jsessionid=… path parameter and a bare ?token query no longer appear in the document, and an origin's static files no longer crowd its API out of the 500-operation cap.
• The map loads when one origin has more than 50,000 rows, keeps an inspected source open while traffic is captured, opens View source in every section, filters by every product it lists, and searches headers as History's filter does. A BIG-IP cookie with a multi-byte character no longer breaks the map or the scanner.
• The CLI keeps the original when it forwards an edited intercept, previews the request a command will actually send (scope set-scope, fuzzer results, sequences, intercept rules), validates history-search sides, and no longer reports a saved tab label as failed.
• Recon applies a job's endpoint limit to what that job finds, not the whole inventory.
• Raw request targets survive the proxy and Replay. A target such as /a/../b or /%2e%2e/ is sent exactly as captured instead of being normalized.
• Replay keeps a redirect's authority, gives a raw request the scheme it is sent with, and shows retained response bytes in its Hex view.
• cURL export and import keep request bodies, including explicitly empty bodies, JSON fragments and UTF-8 escapes; raw HTTP splits headers at the first blank line; exported headers match their bodies.
• Decoder beautification and transformations keep literals and text intact.
• Drafts are kept in intercept editors while polling refreshes their records, and in Replay and editor tabs across session switches, tab creation and closing.
• WebSocket history stays fresh across filtered refreshes, and live History filters and annotations stay consistent.

Packages

• macOS — a universal DMG (arm64 + x86_64), which is what the in-app updater looks for, with a .sha256 beside it.
• Windows x64 — a -setup.exe installer and a portable ZIP with sniper-desktop.exe, sniper.exe and sniper-cli.exe, each with a .sha256, built and attached by CI from this commit. Both need the Microsoft Edge WebView2 Runtime and are unsigned — check the checksum before running. See Windows setup and packaging.
• Linux (Debian 13 x86_64, X11) — a .deb and a portable .tar.gz, each with a .sha256, built by CI from this commit, with the build manifest and the CI runtime check (-runtime-PASS.json: install, remove, reinstall and purge in a fresh Debian 13). They use the system GTK 3 and WebKitGTK 4.1; other distributions are outside the qualification. See Linux installation.

Full Changelog

v0.3.0...v0.3.1