Launch v0.7.0 → main: README rebuild + collateral + eBPF advisory

CHANGELOG.md

@@ -6,6 +6,17 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.7.0] — 2026-06-24
+
+### Added
+
+- **eBPF capture discoverability — an experimental, opt-in advisory.** When no
+  eBPF source is active, the server now logs a one-line notice (Linux only) that
+  on-host TLS capture exists and how to enable it (`ebpf` cargo feature + a
+  `type = "ebpf"` source — there is no `--ebpf` runtime flag). The Settings
+  page's eBPF capture toggle is now tagged **experimental** and its description
+  spells out the opt-in requirements.
+
 ### Changed
 
 - **OpenTelemetry-aligned rename of the storage entities and HTTP API.** The
@@ -21,6 +32,21 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   for `spans`/`traces`. Existing DuckDB/ClickHouse databases auto-migrate in
   place on init() with no data loss (idempotent detect-then-rename).
 
+### Docs
+
+- **README rebuilt for the launch — GIF-first, conversion-driven layout.**
+  Headline tagline "The Wireshark for AI Agents", a hero demo GIF up top, a
+  30-second pcap-replay quick start, and a three-up "What Makes Heron Different"
+  table (agent-turn reconstruction · service topology · SFT trajectory export),
+  while preserving the existing technical accuracy (passive positioning across
+  wire *and* on-host TLS boundary, opt-in eBPF, `docs/configure.md` links,
+  `just`-based contributor flow). API examples updated to the canonical
+  `/api/traces` routes.
+- **Corrected launch collateral added under `launch/`.** Paste-ready Product
+  Hunt / Hacker News / Twitter copy aligned to the shipped product: install via
+  the `curl … install.sh` one-liner (no npm package), canonical `/api/traces`
+  endpoint, and v0.7.0 framing.
+
 ## [0.6.0] — 2026-06-16
 
 ### Changed

VERSION

@@ -1 +1 @@
-0.6.0
+0.7.0

console/package.json

@@ -1,7 +1,7 @@
 {
   "name": "console",
   "private": true,
-  "version": "0.6.0",
+  "version": "0.7.0",
   "type": "module",
   "scripts": {
     "dev": "vite",

console/src/pages/settings.tsx

@@ -324,6 +324,12 @@ function EbpfCaptureToggle({
         <div className="flex items-center gap-2 text-xs font-medium">
           <span aria-hidden>🛰️</span>
           <span>eBPF capture (on-host TLS)</span>
+          <span
+            className="rounded-full border border-amber-500/40 bg-amber-500/10 px-1.5 py-0.5 text-[10px] font-normal text-amber-700 dark:text-amber-400"
+            title="On-host eBPF capture is experimental and opt-in."
+          >
+            experimental
+          </span>
           {!available && (
             <span className="rounded-full border border-border px-1.5 py-0.5 text-[10px] font-normal text-muted-foreground">
               unavailable in this build
@@ -332,8 +338,8 @@ function EbpfCaptureToggle({
         </div>
         <div className="mt-0.5 text-[11px] text-muted-foreground">
           {available
-            ? "Read TLS plaintext at the SSL_read / SSL_write boundary with per-process attribution. Toggling rewrites the config and restarts capture (~2–3s)."
-            : "Requires a Linux build compiled with the `ebpf` feature (CAP_BPF + kernel BTF)."}
+            ? "Experimental, opt-in. Read TLS plaintext at the SSL_read / SSL_write boundary with per-process attribution. Toggling rewrites the config and restarts capture (~2–3s)."
+            : "Experimental, opt-in. Requires a Linux build compiled with the `ebpf` feature (CAP_BPF + kernel BTF)."}
         </div>
       </div>
       <button

launch/HN_and_Twitter_Posts.md

@@ -0,0 +1,55 @@
+# Hacker News & Twitter 发帖指南(修正版)
+
+> 修正基线:对齐已发布产品。相对 marketing 原稿的改动——
+> - 安装命令 `npm i -g heron-ai` → `curl … install.sh`
+> - eBPF "production-gated" → "experimental / opt-in"
+> - 版本表述 → v0.7.0(v0.5.6 的过滤作为历史时间线保留)
+> - 不出现运行时 `heron --ebpf` 命令
+>
+> eBPF 段最终取舍与 GIF 由 marketing 负责;本稿提供准确基线。
+
+## 1. Hacker News (Show HN)
+
+**标题:**
+`Show HN: Heron – passive agent observability that reconstructs agent turns from traffic`
+
+**正文:**
+```text
+We run Heron (https://github.com/Netis/heron) — a passive analyzer that reconstructs agent turns from network traffic — on our inference fleet.
+
+When we looked at the production data, we found that ~73% of Claude Code's opus-model calls in our capture weren't actual coding work. They were a hidden "security monitor" sidecar: a /v1/messages POST with a system prompt "You are a security monitor for autonomous AI coding agents", feeding the running transcript and returning a <block>yes/no verdict.
+
+Because it embeds the same transcript, the turn tracker initially merged it into the real turn and overwrote the answer with "<block>no" — masking real working sessions. v0.5.6 added filtering by system-prompt signature.
+
+Heron itself is a Rust single-binary, Apache-2.0 licensed, passive analyzer. It captures LLM traffic off the wire and stitches multi-call interactions into agent turns. On Linux it can additionally read TLS-encrypted traffic on-host via experimental, opt-in eBPF SSL_read/SSL_write uprobes — with per-process attribution. Current release: v0.7.0.
+
+https://github.com/Netis/heron
+```
+
+## 2. Twitter / X Thread
+
+**Tweet 1:**
+We just open-sourced the Wireshark for AI Agents. 🦩
+
+Passive. Reconstructs agent turns from traffic. On Linux, experimental eBPF reads TLS-encrypted calls on-host and tells you which process made each one.
+
+We found that ~73% of Claude Code's Opus turns in production are hidden security monitors. 🤯
+
+Zero SDK. Zero proxy. Zero restarts. 🧵👇
+[Attach hero GIF OR link https://youtu.be/yZzEBb-wK58]
+
+**Tweet 2:**
+Your agent was stuck in a 47-second loop. Your SDK noticed nothing.
+But Heron saw every call on the wire — and reconstructed the whole turn so you could see the loop.
+
+Heron passively captures traffic and assembles multi-call interactions into agent turns automatically.
+
+**Tweet 3:**
+You're throwing away thousands of real training samples every day.
+Turn on Heron. One click to convert production traffic into SFT trajectories.
+
+Open-source and free:
+⭐ GitHub: https://github.com/Netis/heron
+💻 Install: curl -fsSL https://raw.githubusercontent.com/Netis/heron/main/install.sh | INSTALL_DIR="$HOME/.local" sh
+🚀 PH: [Link to your PH Launch]
+```

launch/PH_Submission_Details.md

@@ -0,0 +1,57 @@
+# Product Hunt 提交资料包(修正版)
+
+> 修正基线:对齐已发布产品。相对 marketing 原稿的改动——
+> - 安装命令 `npm i -g heron-ai` → `curl … install.sh`(无 npm 包,console 为 private)
+> - eBPF "production-gated" → "experimental / opt-in"(仍是 opt-in cargo feature,Linux,需 CAP_BPF)
+> - 版本 → v0.7.0
+> - 不出现运行时 `heron --ebpf` 命令(eBPF 经 cargo feature + TOML 配置)
+>
+> eBPF 段的最终取舍与 hero GIF 由 marketing 负责;本稿提供准确基线。
+
+## 基本信息 (Basic Info)
+
+- **Name of product:** Heron
+- **Tagline (60 chars max):** The Wireshark for AI Agents
+- **Website URL:** https://heron-ai.pages.dev
+- **Pricing:** Free / Open Source
+- **Topics:** Developer Tools, Open Source, Artificial Intelligence, DevOps
+- **GitHub URL:** https://github.com/Netis/heron
+
+## 详细描述 (Description - 260 chars max)
+
+Heron is a passive network analyzer that reconstructs what your AI agents are actually doing. Zero SDKs. Zero proxy. On Linux, an experimental eBPF source reads TLS-encrypted LLM calls on-host and tells you which agent process made them.
+
+## 视频与图片 (Gallery)
+
+按顺序上传 `Heron_Launch_Package/producthunt-images` 和 `video` 中的文件:
+1. `heron-demo-narrated.mp4`(主 Demo 视频)
+2. `01_hero_preview.png`
+3. `02_ebpf_concept.png`
+4. `03_agent_turns.png`
+5. `04_services_topology.png`
+6. `05_http_exchanges.png`
+
+## Maker's First Comment (首发评论)
+
+```markdown
+Hey PH! 👋 I'm the team lead behind Heron at Netis.
+
+I built Heron because I got tired of my AI agent loops looking like 200 OK in the logs while the actual agent was stuck replaying the same tool call for 47 seconds straight.
+
+**What Heron does:**
+Heron is a passive analyzer that reconstructs what your AI agents are actually doing — from the traffic itself. No SDK, no proxy, nothing in the request path. It captures LLM traffic (OpenAI, Anthropic, Gemini, vLLM, SGLang, Ollama…), parses the wire protocol, and stitches multi-call interactions into agent turns you can actually debug.
+
+**What's new in v0.7.0:**
+🔬 On-host eBPF capture (experimental, opt-in) — hook SSL_read/SSL_write to read TLS-encrypted agent traffic as plaintext, with process attribution (which agent process made which call). No proxy, no TLS terminator.
+
+📊 We discovered that ~73% of Claude Code's Opus turns in our production capture were hidden security-monitor sidecars — Heron now filters them automatically so you see real agent work, not housekeeping noise.
+
+🧬 One-click SFT trajectory export — turn your production agent traffic into fine-tuning training data without re-running anything.
+
+Built in Rust, ships as a single binary with the React console embedded. Apache-2.0. Would love your feedback!
+
+🦩 Try it:
+  curl -fsSL https://raw.githubusercontent.com/Netis/heron/main/install.sh | INSTALL_DIR="$HOME/.local" sh
+  heron --pcap-file capture.pcap --no-retention
+⭐ GitHub: https://github.com/Netis/heron
+```

launch/README.md

@@ -0,0 +1,58 @@
+# Launch collateral — v0.7.0
+
+Paste-ready launch material, corrected to match the shipped product. Source was
+the marketing `Heron_Launch_Package.zip`; this folder holds the reconciled copy.
+
+## What's here
+
+- [`PH_Submission_Details.md`](PH_Submission_Details.md) — Product Hunt fields + Maker's first comment
+- [`HN_and_Twitter_Posts.md`](HN_and_Twitter_Posts.md) — Show HN post + Twitter/X thread
+
+## Corrections applied vs the marketing draft
+
+| Item | Draft | Corrected |
+| --- | --- | --- |
+| Install command | `npm i -g heron-ai` | `curl … install.sh` (no npm package; console is a private workspace pkg) |
+| eBPF maturity | "production-gated" | "experimental / opt-in" (cargo feature, Linux, `CAP_BPF`) |
+| eBPF invocation | `heron --ebpf` | removed — no such runtime flag; eBPF is enabled via the `ebpf` cargo feature + TOML `type = "ebpf"` |
+| API endpoint examples | `/api/agent-turns` | `/api/traces` (canonical after the OTel rename; old route still works as a deprecated alias) |
+| Version | v0.6.0 | v0.7.0 |
+
+## Owned by marketing (not in this branch)
+
+- **eBPF segment final wording + hero GIF.** The hero GIFs in the zip hardcode
+  `heron --ebpf` and show `Heron v0.6.0`; marketing will re-cut them (drop the
+  `--ebpf` command, bump the version). The repo's `docs/images/hero.gif` is
+  currently the valid `hero-pcap.gif` as a placeholder until the re-cut lands.
+- **Landing page** `https://heron-ai.pages.dev` — not in this repo (`site/` only
+  has a favicon); stand it up separately before launch.
+
+## Asset upload (Product Hunt — do not commit binaries to the repo)
+
+Upload directly to Product Hunt from the zip:
+`video/heron-demo-narrated.mp4` (main demo) + `producthunt-images/01…05`.
+
+## GitHub repo settings (do on launch day, via repo Settings)
+
+**Topics:**
+```
+ebpf, llm-tracing, agent-observability, passive-monitoring, llm-monitoring,
+ai-agent, network-probe, sft-training-data, wireshark, openai, anthropic,
+vllm, sglang
+```
+
+**Description:**
+```
+The Wireshark for AI Agents — passive observability that reconstructs agent
+turns from network traffic. Zero SDK, zero proxy, zero code changes. Export SFT
+training data from production traffic.
+```
+
+**Social preview:** upload a 1280×640 brand image (to be produced).
+
+## Release
+
+`v0.7.0` version files are already bumped (VERSION SSOT + Cargo.toml +
+package.json + CHANGELOG). Tag/publish (`git tag v0.7.0` → `release.yml`) is the
+explicit release step and gated on a passing `staging-soaked` status — do it on
+the soaked commit when ready, not as part of this docs branch.

server/Cargo.toml

@@ -8,7 +8,7 @@ exclude = ["h-ebpf-prog"]
 resolver = "2"
 
 [workspace.package]
-version = "0.6.0"
+version = "0.7.0"
 edition = "2021"
 license = "Apache-2.0"