  _       _     
 | | __ _| |__  
 | |/ _` | '_ \ 
 | | (_| | |_) |
 |_|\__,_|_.__/ .

interactive / nothing leaves your tab

Try the systems, not the screenshots.

Four tools that normally need a terminal: the NetSift packet decoder, a Detection-Replay-Lab Sigma replay, the treecat and scc context compressor, and the fingerprint hardening simulator. Everything runs client-side — no upload, no account, no server round trip.

NetSift — packet inspector

NetSift's parsing core, ported to TypeScript so it can run here instead of in a container. Pick a preset or drop your own capture: the decoder walks Ethernet, IPv4/IPv6, TCP, UDP, DNS and HTTP, and reports the anomalies it can prove from the bytes — lengths that disagree, checksums that do not add up, blocks that claim more than they carry.

A well-formed libpcap capture: one DNS query, its response, and an HTTP/1.1 request over TCP. Correct lengths and checksums throughout.

Drop a .pcap or .pcapng here, or choose a file

format: pcap
packets: 3
bytes: 367
anomalies: 0 high · 0 med · 0 low

protocols: IPv4, TCP, UDP

packet #1 ts 1700000000.000000 captured 75 / original 75 bytes

anomalies

No anomalies: every declared length and checksum in this capture checks out.

Detection-Replay-Lab — Sigma rule replay

A detection is only as good as its false-positive story. Switch a selection off, make a match exact, or edit the condition and watch the verdict move — the third pane always shows which events matched, which selection carried the match, and why the rule fired or did not.

1 · event trace

trace

10 synthetic events · 5 matched by the current rule

Select an event to inspect every field.

2 · sigma rule

rule

A shell interpreter writes a launch agent and hands it to launchctl. The narrow form requires the interpreter to be osascript and the file to land in a user LaunchAgents directory.

toggle a conditioninterpreter activelaunch_agent_path activebootstrap activeinterpreter exact match (drop contains)launch_agent_path exact match (drop contains)bootstrap exact match (drop contains)

condition

title: Launch agent installed from a script interpreter
id: lab-macos-launchagent
level: high
logsource:
  product: macos
  category: process_creation
detection:
  interpreter:
    process_name|contains:
      - 'osascript'
  launch_agent_path:
    file_path|contains:
      - '/Library/LaunchAgents/'
  bootstrap:
    command_line|contains:
      - 'launchctl bootstrap'
  condition: interpreter and launch_agent_path and bootstrap
falsepositives:
  - Developer tooling that installs its own update agent through a scripted installer
  - IT provisioning scripts that run through osascript during onboarding

3 · match & false positives

ALERT 5 of 10 events

interpreterprocess_name contains osascript
- evt-02 osascript
- evt-03 osascript
- evt-07 osascript
launch_agent_pathfile_path contains /Library/LaunchAgents/
- evt-03 /Users/dev/Library/LaunchAgents/com.metrics.updater.plist
- evt-06 /Users/dev/Library/LaunchAgents/com.microsoft.update.agent.plist
bootstrapcommand_line contains launchctl bootstrap
- evt-04 launchctl bootstrap gui/501 /Users/dev/Library/LaunchAgents/com.metrics.updater.plist

why

condition "interpreter and launch_agent_path and bootstrap" evaluated true: 5 event(s) would alert
selection interpreter matched 3 event(s): evt-02, evt-03, evt-07
selection launch_agent_path matched 2 event(s): evt-03, evt-06
selection bootstrap matched 1 event(s): evt-04

known false positives

Developer tooling that installs its own update agent through a scripted installer
IT provisioning scripts that run through osascript during onboarding

treecat & scc — context compression

A repository is mostly implementation; a context pack is mostly declarations. Sweep the slider from the raw dump to the compiled pack and watch the token and cost figures move. The byte and line counts are read from this repository at build time.

Repository tree compression: the pack keeps the declaration outline of each file instead of the file body.

compression: raw dump → compiled pack

raw dump: 49890 B · 12473 tok
compiled pack: 747 B · 187 tok
in context now: 2529 B · 633 tok
cost now: $0.0019
cost at full pack: $0.0006
saved vs raw: 98% · 19573 tok

Tokens estimated at 4 characters per token; cost at $3.00 per million input tokens. Byte and line counts are read from this repository at build time; the pack is the declaration outline extracted from the same files.

src/lib/ascii/app.ts

raw dump · 49890 B · 1463 lines

import * as THREE from 'three';

import type { AsciiContent, PanelSection } from '@/lib/ascii/content';
import { createFrameGovernor } from '@/lib/ascii/governor';
import { buildLines, type Line, lineRows, panelWidth } from '@/lib/ascii/layout';
import { Noise } from '@/lib/ascii/noise';
import { Pretext } from '@/lib/ascii/pretext';
import { framePixelRatio } from '@/lib/ascii/resolution';
import { SCENES } from '@/lib/ascii/scenes';
import {
  INK,
  LIGHT,
  parseTheme,
  readStoredTheme,
  startVariant,
  storeTheme,
} from '@/lib/ascii/theme';
import type {
  AsciiScene,
  AsciiTheme,
  SceneEnv,
  SceneFactory,
  SceneInput,
  ThemeColors,
} from '@/lib/ascii/types';

// ASCII homepage runtime. Sizing, render loop, intro, stamped UI, content panels
// and variant switching. The render pipeline (sizing rules, glyph atlas, ramp,
// lum/sat boosts, 60Hz fixed-step sim, intro curve, stamped UI timings) follows
// paullew.is exactly — this is a TypeScript port of the prototype's main.js.

export interface AsciiHomeElements {
  root: HTMLElement;
  ascii: HTMLCanvasElement;
  gl: HTMLCanvasElement;
  panel: HTMLElement;
  panelInner: HTMLElement;
  controls: HTMLElement;
  fontBar: HTMLElement;
  pauseBtn: HTMLButtonElement;
  loader: HTMLElement | null;
}

export interface AsciiHomeOptions {
  elements: AsciiHomeElements;
  content: AsciiContent;
  /** Called whenever the panel width (in cells) changes so React can re-flow the text. */
  onPanelWidth(width: number): void;
}

export interface AsciiHomeDebug {
  pause(): void;
  play(): void;
  seek(frames: number): void;
  variant(v: number): Promise<void>;
  open(key: string): void;
  close(): void;
  tap(x: number, y: number): void;
  move(x: number, y: number): void;
  theme(t: AsciiTheme): void;

compiled pack · 747 B · 16 declarations

export interface AsciiHomeElements {
export interface AsciiHomeOptions {
export interface AsciiHomeDebug {
type Rgb = string;
interface MenuSlot {
interface UiLayout {
const smallScreen = () => window.innerWidth < 700;
const coarsePointer = () => window.matchMedia('(pointer: coarse)').matches;
const baseFontSize = () => (smallScreen() ? 9 : 10);
const dpr = () =>
function charGrid(pxIn: number) {
const rgba = (rgb: Rgb, a: number) => `rgba(${rgb},${Math.max(0, Math.min(1, a)).toFixed(2)})`;
const clamp01 = (x: number) => Math.max(0, Math.min(1, x));
const sstep = (a: number, b: number, x: number) => {
const isEditable = (t: EventTarget | null) =>
export function startAsciiHome({ elements, content: C, onPanelWidth }: AsciiHomeOptions): {

Fingerprint hardening simulator

The same page that lists your browser signals now measures the entropy each one contributes and shows what Standard Chrome, Brave Strict and Safari Lockdown Mode would leave behind.

open the fingerprint lab

back to home

opening record…