Di-kairos/panic

📦 Moved: development continues in the paranoid-tools monorepo (panic/ directory, full history preserved). This repository is archived: its published releases stay downloadable and the installers keep working, but new issues, PRs and releases happen in the monorepo.

English · Русский

panic

One-step kill-switch — everything off the screen, vaults locked, one command.

Part of the Paranoid Tools ecosystem.

The scenario: a border crossing, coercion, "someone's coming." A single panic now (or a global hotkey via panic hotkey, default cmd + alt - p) hides and locks everything: force-detaches mounted volumes (including open vault disk images), clears the clipboard, and locks the screen.

Install

Checksum-verified install from the release tag — verify-then-run (don't trust, verify):

base=https://github.com/Di-kairos/panic/releases/latest/download
curl -fsSLO "$base/install.sh"
curl -fsSLO "$base/SHA256SUMS"
curl -fsSLO "$base/SHA256SUMS.sig"
printf '%s\n' 'releases@paranoid-tools namespaces="file" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICb2nz4EliRJIU0ExeF41klE/zlyo7XFY119mfzscn2U' > allowed_signers
ssh-keygen -Y verify -f allowed_signers -I releases@paranoid-tools -n file -s SHA256SUMS.sig < SHA256SUMS &&   # authenticity: Ed25519, pinned key
shasum -a 256 -c SHA256SUMS --ignore-missing &&   # integrity: verifies install.sh
less install.sh &&                               # read it — then run:
bash install.sh                                  # pulls panic + checksum, verifies, installs

Quick form (one line, skips verification — choose deliberately):

curl -fsSL https://github.com/Di-kairos/panic/releases/latest/download/install.sh | bash

install.sh pulls the binary and SHA256SUMS from the immutable release tag (not the moving main branch) and verifies the hash before installing. Environment variables: PANICVERSION (pin a specific tag instead of latest), PANICDEST (install path), PANICBASEURL (override the source entirely, for forks/tests).

Integrity vs authenticity (honest scope). The checksum proves the binary matches the SHA256SUMS published in the same release — it catches corruption, partial/cached tampering, and stops you running code off the moving main branch. Authenticity comes from the Ed25519 signature over SHA256SUMS: the snippet above and install.sh both verify it against a key pinned in this repo, and the installer fails closed when it can't (see SECURITY.md). Residual risk: one project key signs all five tools — see the ecosystem threat model. Pin a specific version with PANICVERSION=0.1.15 instead of latest for reproducibility.

Usage

panic status            # read-only preflight: show what `panic now` would affect
panic now               # hide & lock now
panic now --hard        # + kill cloud daemons, clear Recent items
panic hotkey install    # bind a global hotkey (cmd + alt - p) to `panic now`
panic hotkey status     # is the hotkey installed?
panic hotkey uninstall  # remove it (only the block panic manages)
panic version           # print the version (also -v / --version)
panic --help            # print usage (also -h / help)

The explicit now verb is deliberate: a kill-switch must not fire from an accidental bare panic with no arguments (bare panic prints usage and exits non-zero).

STLANG=ru switches messages to Russian (otherwise en, or auto-detected from the system locale).

What panic now does: