docs: visual tour with a screenshot of every feature - #6
Merged
Conversation
Add docs/screenshots.md — a follow-along visual tour with 15 screenshots covering the split-pane monitor, flow list (status/size, HTTP/1.1 + HTTP/2), detail view with JSON highlighting, request headers/body, on-the-fly gzip decode, filter, flag + flagged-only, sort, Repeater (inline response + attack modes), intercept pause + raw-bytes editor, help overlay, and curl/HAR export. Screenshots were captured headlessly (tmux + freeze) against a local demo API; all tokens/users are synthetic (sk-demo-FAKE-*) and no host/user paths appear. Link the tour and the hero image from the README. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A docs-only change (this PR included) ran a full go build, vet, and race-enabled test suite. Add a `changes` job that diffs the change set against its merge base and gates `build-test` on the result: markdown, docs/, LICENSE, and issue templates skip the build, and anything else — Go sources, go.mod/go.sum, .goreleaser.yaml, the workflows themselves — still builds, so the list needs no upkeep as new source files land. Gating a job rather than adding `paths-ignore:` to the trigger is deliberate: a workflow that never starts leaves a required check pending forever, whereas a job skipped by `if:` reports as skipped and satisfies branch protection. `build-test` therefore keeps reporting on every PR. The filter falls back to building whenever the base commit is missing or unreadable (force pushes, first push on a branch, manual dispatch), so a failure to work out the diff can't silently skip CI. Also adds workflow_dispatch for forcing a run by hand. release.yml is unchanged: it fires on v* tags only, which are cut deliberately and always need a build. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MavUrTwm29bQRDy2Nufoq3
Tag pushes can't use `paths:` — GitHub ignores path filters on tag events —
so release.yml gets the same treatment as a gate job: compare the tag
against the previous tag (`git describe --tags --abbrev=0 "$TAG^"`) and
skip GoReleaser when nothing but documentation changed between them.
Worth being explicit about the tradeoff, since a tag is a deliberate act
in a way a push isn't: a skipped release means a tag with no binaries,
no checksums, and a Homebrew cask still pointing at the previous version.
Two things keep that from being a trap — the skip is loud (a run
annotation plus a step summary saying what was skipped and why), and
`workflow_dispatch` with a tag input forces a release for a tag the
filter skipped or a run that failed. The first tag in the repo, or any
tag whose predecessor can't be resolved, always releases.
The filter itself moves to .github/scripts/needs-build.sh so both
workflows share one list of documentation-only paths instead of drifting
apart. It prints its verdict on stdout and diagnostics on stderr, which
also makes it runnable locally:
.github/scripts/needs-build.sh origin/main HEAD
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MavUrTwm29bQRDy2Nufoq3
The screenshot tour shows what each feature looks like; these fill in what
you do with it. Six pages under docs/, indexed by docs/README.md:
- getting-started.md — first capture, what the launcher injects into the
target's environment, triaging the flow list, where files land, and what
to check when no traffic appears
- keybindings.md — every binding by context, matching the ? overlay
- scope.md — the [!][field:]pattern grammar and the postures it produces
- intercepting.md — arming, the pause/edit/forward/drop loop, and what
"edit" means for each protocol
- repeater.md — {{variables}}, payload lists, and the five attack modes
with the request count each one produces
- exporting.md — every output, its key, its filename, and what it leaks
Each page carries the screenshots for its feature, so all 15 images are
now reachable from a page that explains them rather than only from the
tour. Everything here was read off the source rather than the README, so
a couple of behaviors are documented that weren't written down: specs
within one scope flag are OR'd (each spec becomes its own single-condition
rule and first match wins), a repeated flag keeps only its last value,
sort-by-size is descending, and the filter matches protocol and server
address as well as host/method/path/status.
That last point corrects a README example: `-scope 'method:=POST' -scope
'body:token'` was documented as "every POST that carries a token", but Go's
flag package drops the first value, and two specs would OR rather than AND
even in one flag. Rewritten to say what it does.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MavUrTwm29bQRDy2Nufoq3
Both gates keyed on `== 'true'`, which meant a `changes` job that errored skipped the gated job — a broken filter would have let a PR merge with no build and a tag publish nothing. Invert it: only an explicit "false" skips, so an empty output from a failed detect job still builds and still releases. `!cancelled()` keeps a cancelled run from proceeding, and also overrides the implicit `success()` that a bare `if:` would apply, which is what lets the gated job run after a failed dependency at all. This matches what needs-build.sh already does internally — every path it can't evaluate returns "true". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MavUrTwm29bQRDy2Nufoq3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
docs/screenshots.md— a follow-along visual tour with 15 screenshots, plus a hero image and link from the README.Coverage
Split-pane monitor · flow list (status/size, HTTP/1.1 + HTTP/2) · detail view + JSON highlighting · request headers/body · on-the-fly gzip decode · filter · flag + flagged-only · sort · Repeater (inline response + attack modes) · intercept pause · raw-bytes editor · help overlay · curl export · HAR export.
How they were made
Captured headlessly with tmux + freeze against a small local demo API (a shell as the target).
Safety
sk-demo-FAKE-0000.demo$prompt and ademohome — no real usernames or host paths appear (scanned every frame).Not included
WebSocket injection, gRPC, and transparent (nftables) capture need extra server infrastructure to stage and aren't pictured; noted as such in the doc.
🤖 Generated with Claude Code