@methodwhite/auto-hardening 1.0.0 → 1.7.2

package/CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+
+## 1.7.2 - 2026-08-02
+
+- Añadido workflow de publicación npm mediante Trusted Publishing/OIDC.
+- La publicación de releases se valida automáticamente antes de ejecutarse.
+
+## 1.7.1 - 2026-08-02
+
+- Corregida la auditoría cuando el módulo `Microsoft.PowerShell.Security` no puede cargarse.
+- La ausencia de `Get-ExecutionPolicy` se reporta como `Unavailable` sin interrumpir el análisis.
+
+## 1.7.0 - 2026-08-02
+
+- Añadido inventario detallado de Scheduled Tasks.
+- Añadida detección de persistencia WMI, trabajos BITS y perfiles de PowerShell.
+- Añadidos hash SHA-256 y estado de firma Authenticode para archivos detectados.
+- Añadida detección de políticas administradas por GPO/MDM.
+- Añadida clasificación de perfiles de red.
+- `--apply --yes` bloquea cambios locales cuando existen políticas administradas.
+- Limitado el volumen del escaneo para evitar falsos positivos y `ENOBUFS`.
+
+## 1.6.0 - 2026-08-02
+
+- Añadida auditoría de BitLocker, TPM y Secure Boot.
+- Añadida auditoría de RDP/NLA, SMBv1 y firma SMB.
+- Los controles de plataforma permanecen en modo `audit-only` y no se aplican automáticamente.
+- Corregida la ejecución de consultas PowerShell con bloques `if/else` en Windows.
+
+## 1.5.0 - 2026-08-02
+
+- Añadido detector de perfil para workstation, servidor miembro y Domain Controller.
+- Añadidas auditorías de Firewall, Defender, Windows Update, persistencia y archivos de riesgo.
+- Añadidos modos `--audit`, `--plan`, `--status`, `--capabilities` y `--apply --yes`.
+- Añadida cuarentena reversible de archivos, tareas programadas, servicios y claves Run/RunOnce.
+- Añadidos backups automáticos y rollback de Firewall y preferencias soportadas de Defender.
+- Corregida la restauración de rutas de Scheduled Tasks en Windows.
+- Añadida CI Linux + Windows y documentación de límites operativos.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MethodWhite Security
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,55 @@
+# @methodwhite/auto-hardening
+
+CLI defensivo para **auditar** y preparar medidas de hardening en Windows. El modo predeterminado es seguro y no modifica el sistema. Detecta workstation, servidor, dominio, Active Directory y Domain Controller antes de aplicar políticas.
+
+> Este proyecto no sustituye una política corporativa, un backup ni una evaluación profesional. Prueba cualquier cambio en una máquina o VM de laboratorio antes de aplicarlo.
+
+## Requisitos
+
+- Node.js `>=18.18.0`
+- Windows para las comprobaciones específicas del sistema
+- Consola elevada solo para futuras operaciones de aplicación
+
+## Uso
+
+```bash
+npx @methodwhite/auto-hardening --audit
+npx @methodwhite/auto-hardening --capabilities
+npx @methodwhite/auto-hardening --persistence
+npx @methodwhite/auto-hardening --files
+npx @methodwhite/auto-hardening --quarantine <finding-id> --yes
+npx @methodwhite/auto-hardening --restore <finding-id>
+npx @methodwhite/auto-hardening --audit --json
+npx @methodwhite/auto-hardening --plan
+npx @methodwhite/auto-hardening --apply --yes
+npx @methodwhite/auto-hardening --rollback <backup-id>
+npm run lint
+npm test
+```
+
+`--full` está deliberadamente protegido: no aplica políticas silenciosamente. Las políticas se habilitarán una a una después de documentar su impacto, reversión y test correspondiente. `--apply --yes` requiere Windows, una consola elevada y un backup automático; los Domain Controllers permanecen en modo `audit-only`.
+
+La CI ejecuta validación en Ubuntu y un smoke test en Windows. La prueba de CI en Windows no reemplaza una VM de laboratorio con políticas de dominio, Defender Tamper Protection y GPO corporativas.
+
+## Principios
+
+- Dry-run por defecto.
+- Fail-safe: errores no se interpretan como sistema seguro.
+- Sin telemetría ni red saliente propia.
+- Sin secretos ni credenciales.
+- Cambios explícitos, reversibles y auditables.
+- Compatible con el Tier S++ SecDevOps del ecosistema MethodWhite.
+- Audita BitLocker, TPM, Secure Boot, RDP/NLA, SMBv1 y firma SMB sin modificarlos automáticamente.
+
+## Desarrollo
+
+```bash
+npm install
+npm run lint
+npm test
+npm pack --dry-run
+```
+
+## Licencia
+
+MIT. Ver [`LICENSE`](LICENSE).

package/SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+
+Report vulnerabilities privately to the repository maintainer. Do not include secrets, personal data or exploit payloads in public issues.
+
+The tool is dry-run by default. Any future hardening policy must include a test, rollback procedure, documentation and an explicit opt-in.

package/auto-hardening.js

@@ -0,0 +1,309 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import { execFileSync } from 'node:child_process';
+import { randomUUID, createHash } from 'node:crypto';
+import chalk from 'chalk';
+
+const VERSION = '1.7.2';
+const quarantineDir = process.env.PROGRAMDATA ? path.join(process.env.PROGRAMDATA, 'MethodWhite', 'auto-hardening', 'quarantine') : path.join(os.tmpdir(), 'methodwhite-auto-hardening', 'quarantine');
+const stateDir = process.env.PROGRAMDATA ? path.join(process.env.PROGRAMDATA, 'MethodWhite', 'auto-hardening') : path.join(os.tmpdir(), 'methodwhite-auto-hardening');
+const powershell = (script) => execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+const isWindows = process.platform === 'win32';
+const profiles = {
+  'workstation-home': { id: 'workstation-home', scope: 'workstation', mode: 'apply-safe' },
+  'workstation-domain': { id: 'workstation-domain', scope: 'domain-member', mode: 'apply-safe' },
+  'server-member': { id: 'server-member', scope: 'member-server', mode: 'apply-safe' },
+  'domain-controller': { id: 'domain-controller', scope: 'domain-controller', mode: 'audit-only' },
+};
+
+function usage() {
+  console.log(`auto-hardening ${VERSION}\n\nUsage:\n  auto-hardening --audit [--json]       Inspect the current posture\n  auto-hardening --plan                Show changes without applying them\n  auto-hardening --apply --yes         Apply reversible policies\n  auto-hardening --status              Show supported policy status
+  auto-hardening --capabilities        Detect OS, domain, roles and network profiles\n  auto-hardening --rollback <id>       Restore a previous backup\n  auto-hardening --help                Show this help`);
+}
+
+function requireWindows() { if (!isWindows) throw new Error('Esta operación solo puede ejecutarse en Windows.'); }
+function requireAdmin() {
+  requireWindows();
+  const elevated = powershell('[Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator');
+  if (elevated.toLowerCase() !== 'true') throw new Error('Abre PowerShell como Administrador.');
+}
+function psJson(script) { return JSON.parse(powershell(`${script} | ConvertTo-Json -Depth 8 -Compress`)); }
+function ensureStateDir() { fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 }); }
+
+function detectSystem() {
+  if (!isWindows) return { platform: process.platform, profile: 'non-windows', isServer: false, domainJoined: false, domainController: false, networkProfiles: [] };
+  const computer = psJson('Get-CimInstance Win32_ComputerSystem | Select-Object Name, Domain, PartOfDomain, DomainRole, Manufacturer, Model');
+  const osInfo = psJson('Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber, ProductType');
+  const network = psJson('Get-NetConnectionProfile | Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity');
+  const rolesRaw = psJson("& { if (Get-Command Get-WindowsFeature -ErrorAction SilentlyContinue) { Get-WindowsFeature | Where-Object {$_.InstallState -eq 'Installed'} | Select-Object Name, DisplayName } else { @() } }");
+  const roles = (Array.isArray(rolesRaw) ? rolesRaw : [rolesRaw]).filter(Boolean);
+  const domainController = [4, 5].includes(Number(computer.DomainRole));
+  const isServer = Number(osInfo.ProductType) !== 1;
+  const domainJoined = Boolean(computer.PartOfDomain);
+  const networkProfiles = Array.isArray(network) ? network : [network];
+  let profile = domainController ? 'domain-controller' : isServer && domainJoined ? 'server-member' : domainJoined ? 'workstation-domain' : 'workstation-home';
+  return { platform: 'win32', hostname: computer.Name, os: osInfo.Caption, version: osInfo.Version, build: osInfo.BuildNumber, isServer, domainJoined, domain: domainJoined ? computer.Domain : null, domainController, profile, networkProfiles, roles: roles.map((r) => r.Name).filter(Boolean), adDetected: domainController || roles.some((r) => ['AD-Domain-Services', 'DNS'].includes(r.Name)) };
+}
+
+function persistenceFindings() {
+  if (!isWindows) return { platform: process.platform, findings: [] };
+  const script = `
+    $findings = @()
+    $runPaths = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce')
+    foreach ($path in $runPaths) { if (Test-Path $path) { $p = Get-ItemProperty $path; foreach ($v in $p.PSObject.Properties) { if ($v.Name -notmatch '^PS') { $findings += [pscustomobject]@{ category='registry-run'; severity='medium'; location=$path; name=$v.Name; command=[string]$v.Value; reason='Autostart registry entry'; action='review' } } } } }
+    $startupPaths = @([Environment]::GetFolderPath('Startup'), [Environment]::GetFolderPath('CommonStartup'))
+    foreach ($path in $startupPaths) { if (Test-Path $path) { Get-ChildItem -Force $path | ForEach-Object { $findings += [pscustomobject]@{ category='startup-folder'; severity='medium'; location=$_.FullName; name=$_.Name; command=$_.FullName; reason='Startup folder item'; action='review' } } } }
+    if (Get-Command Get-ScheduledTask -ErrorAction SilentlyContinue) { Get-ScheduledTask | ForEach-Object { foreach ($a in $_.Actions) { $cmd = [string]$a.Execute + ' ' + [string]$a.Arguments; if ($cmd -match '(?i)\\Temp\\|\\AppData\\|powershell|wscript|cscript|mshta|rundll32|regsvr32') { $findings += [pscustomobject]@{ category='scheduled-task'; severity='high'; location=$_.TaskPath + $_.TaskName; name=$_.TaskName; command=$cmd; reason='Task uses a user/temp path or script host'; action='review' } } } } }
+    Get-CimInstance Win32_Service | Where-Object { $_.PathName -match '(?i)\\Users\\|\\Temp\\|powershell|wscript|cscript|mshta|rundll32|regsvr32' } | ForEach-Object { $findings += [pscustomobject]@{ category='service'; severity='high'; location=$_.Name; name=$_.DisplayName; command=[string]$_.PathName; reason='Service uses a user/temp path or script host'; action='review' } }
+    if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) {
+      try {
+        $filters = Get-CimInstance -Namespace root/subscription -ClassName __EventFilter -ErrorAction Stop
+        $consumers = Get-CimInstance -Namespace root/subscription -ClassName __EventConsumer -ErrorAction Stop
+        $bindings = Get-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding -ErrorAction Stop
+        foreach ($item in @($filters) + @($consumers) + @($bindings)) { $findings += [pscustomobject]@{ category='wmi-persistence'; severity='high'; location=$item.__PATH; name=$item.__CLASS; command=[string]$item.Name; reason='Permanent WMI subscription detected'; action='review' } }
+      } catch { }
+    }
+    if (Get-Command Get-BitsTransfer -ErrorAction SilentlyContinue) { Get-BitsTransfer -AllUsers -ErrorAction SilentlyContinue | Where-Object { $_.JobState -notin @('Transferred','Acknowledged','Cancelled') } | ForEach-Object { $findings += [pscustomobject]@{ category='bits-job'; severity='medium'; location=$_.JobId; name=$_.DisplayName; command=([string]$_.RemoteName); reason='Active BITS transfer requires review'; action='review' } } }
+    $profilePaths = @($PROFILE, $PROFILE.AllUsersAllHosts, $PROFILE.AllUsersCurrentHost, $PROFILE.CurrentUserCurrentHost) | Select-Object -Unique
+    foreach ($profilePath in $profilePaths) { if ($profilePath -and (Test-Path $profilePath)) { $findings += [pscustomobject]@{ category='powershell-profile'; severity='medium'; location=$profilePath; name=[IO.Path]::GetFileName($profilePath); command=$profilePath; reason='PowerShell profile executes at shell startup'; action='review' } } }
+    $findings | ConvertTo-Json -Depth 8 -Compress
+  `
+  const raw = powershell(script);
+  if (!raw) return { platform: process.platform, findings: [] };
+  const parsed = JSON.parse(raw);
+  return { platform: process.platform, findings: Array.isArray(parsed) ? parsed : [parsed] };
+}
+
+function findingId(finding) { return createHash('sha256').update(`${finding.category}:${finding.location}:${finding.name}`).digest('hex').slice(0, 16); }
+function psLiteral(value) { return `'${String(value ?? '').replaceAll("'", "''")}'`; }
+function taskPathFromLocation(location) {
+  const separator = String(location).lastIndexOf('\\');
+  return separator >= 0 ? String(location).slice(0, separator + 1) : '\\';
+}
+
+function withIds(result) { return { ...result, findings: result.findings.map((f) => ({ ...f, id: f.id || findingId(f) })) }; }
+
+function sensitiveFiles() {
+  if (!isWindows) return { platform: process.platform, findings: [] };
+  const script = `
+    $roots = @($env:ProgramData, $env:PUBLIC, $env:TEMP)
+    $findings = @()
+    $trusted = '(?i)\\ProgramData\\(Microsoft\\Windows Defender|chocolatey|docker|GitHub|kind)(\\|$)'
+    foreach ($root in $roots) { if ($root -and (Test-Path $root)) { Get-ChildItem -LiteralPath $root -File -Recurse -Depth 5 -ErrorAction SilentlyContinue | Where-Object { $_.Name -ne 'desktop.ini' -and $_.FullName -notmatch $trusted -and $_.Extension -in @('.ps1','.vbs','.js','.hta','.dll','.exe') -and $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | Select-Object -First 50 | ForEach-Object { $sig=Get-AuthenticodeSignature -FilePath $_.FullName -ErrorAction SilentlyContinue; $hash=(Get-FileHash -LiteralPath $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash; $status=[string]$sig.Status; $severity=if ($status -eq 'Valid') { 'low' } else { 'medium' }; $findings += [pscustomobject]@{ category='sensitive-file'; severity=$severity; location=$_.FullName; name=$_.Name; command=$_.FullName; sha256=$hash; signatureStatus=$status; signer=[string]$sig.SignerCertificate.Subject; reason='Recent executable or script in a high-risk directory'; action='review' } } } }
+    $findings | ConvertTo-Json -Depth 8 -Compress
+  `
+  const raw = powershell(script);
+  if (!raw) return { platform: process.platform, findings: [] };
+  const parsed = JSON.parse(raw);
+  return withIds({ platform: process.platform, findings: Array.isArray(parsed) ? parsed : [parsed] });
+}
+
+function scheduledTaskInventory() {
+  if (!isWindows) return { platform: process.platform, tasks: [] };
+  const raw = psJson("& { if (Get-Command Get-ScheduledTask -ErrorAction SilentlyContinue) { Get-ScheduledTask | ForEach-Object { $task=$_; [pscustomobject]@{TaskPath=$task.TaskPath; TaskName=$task.TaskName; State=[string]$task.State; Author=[string]$task.Author; Hidden=[bool]$task.Settings.Hidden; RunLevel=[string]$task.Principal.RunLevel; LogonType=[string]$task.Principal.LogonType; Actions=@($task.Actions | ForEach-Object { [pscustomobject]@{Execute=[string]$_.Execute; Arguments=[string]$_.Arguments} })} } } else { @() } }");
+  const tasks = Array.isArray(raw) ? raw : raw ? [raw] : [];
+  return { platform: process.platform, tasks: tasks.slice(0, 1000) };
+}
+
+function localSecurityPosture() {
+  const raw = psJson("$admins=Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object Name, ObjectClass, PrincipalSource; $accounts=Get-LocalUser -ErrorAction SilentlyContinue | Where-Object Enabled | Select-Object Name, LastLogon, PasswordRequired, PasswordExpires; $uac=Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' -ErrorAction SilentlyContinue; $executionPolicy=@(); try { $executionPolicy=@(Get-ExecutionPolicy -List -ErrorAction Stop | Select-Object Scope, ExecutionPolicy) } catch { $executionPolicy=@([pscustomobject]@{Scope='Unavailable'; ExecutionPolicy='Unavailable'}) }; [pscustomobject]@{Administrators=@($admins); EnabledLocalAccounts=@($accounts); UAC=[pscustomobject]@{EnableLUA=$uac.EnableLUA; ConsentPromptBehaviorAdmin=$uac.ConsentPromptBehaviorAdmin}; PowerShellExecutionPolicy=$executionPolicy}");
+  return raw || { Administrators: [], EnabledLocalAccounts: [], UAC: {}, PowerShellExecutionPolicy: [] };
+}
+
+function configurationSources() {
+  const raw = psJson("$paths=@('HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender','HKLM:\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall','HKLM:\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device'); $items=@(); foreach($path in $paths) { if(Test-Path $path) { $items += Get-ItemProperty -Path $path -ErrorAction SilentlyContinue | Select-Object PSPath,* -ExcludeProperty PSParentPath,PSChildName,PSDrive,PSProvider } }; [pscustomobject]@{PolicyPaths=$paths; Detected=$items.Count -gt 0; Items=$items}");
+  return raw || { Detected: false, Items: [] };
+}
+
+function securityPosture() {
+  const bitlocker = psJson("& { if (Get-Command Get-BitLockerVolume -ErrorAction SilentlyContinue) { Get-BitLockerVolume -MountPoint $env:SystemDrive | Select-Object MountPoint, ProtectionStatus, VolumeStatus, EncryptionMethod } else { [pscustomobject]@{Available=$false} } }");
+  const tpm = psJson("& { if (Get-Command Get-Tpm -ErrorAction SilentlyContinue) { Get-Tpm | Select-Object TpmPresent, TpmReady, LockoutHealTime } else { [pscustomobject]@{Available=$false} } }");
+  const secureBoot = psJson("& { try { [pscustomobject]@{Available=$true; Enabled=([bool](Confirm-SecureBootUEFI -ErrorAction Stop))} } catch { [pscustomobject]@{Available=$false; Enabled=$null; Error=$_.Exception.Message} } }");
+  const rdp = psJson("$path='HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server'; $nla='HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp'; [pscustomobject]@{Enabled=((Get-ItemProperty -Path $path -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections -eq 0); NLA=((Get-ItemProperty -Path $nla -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication -eq 1)}");
+  const smb = psJson("$feature=Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue; $server=Get-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters' -ErrorAction SilentlyContinue; [pscustomobject]@{SMB1State=[string]$feature.State; RequireSecuritySignature=$server.RequireSecuritySignature}");
+  return { bitlocker, tpm, secureBoot, rdp, smb };
+}
+
+function audit() {
+  if (!isWindows) return { system: detectSystem(), platform: process.platform, policies: [{ id: 'windows-only', status: 'skipped', message: 'Windows requerido' }] };
+  const rawProfiles = psJson('Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction');
+  const profiles = Array.isArray(rawProfiles) ? rawProfiles : [rawProfiles];
+  const defender = psJson('Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled, NISEnabled, IsTamperProtected');
+  const update = psJson('Get-Service wuauserv | Select-Object Name, Status, StartType');
+  const posture = securityPosture();
+  const localSecurity = localSecurityPosture();
+  const sources = configurationSources();
+  const networkCategories = (detectSystem().networkProfiles || []).map((profile) => ({ name: profile.Name, category: ['Public', 'Private', 'DomainAuthenticated'][Number(profile.NetworkCategory)] || 'Unknown', connectivity: profile.IPv4Connectivity }));
+  return { system: detectSystem(), persistence: persistenceFindings(), scheduledTasks: scheduledTaskInventory(), sensitiveFiles: sensitiveFiles(), securityPosture: posture, localSecurityPosture: localSecurity, configurationSources: sources, networkCategories, platform: process.platform, policies: [
+    { id: 'firewall', status: profiles.every((p) => p.Enabled && p.DefaultInboundAction === 'Block'), details: profiles },
+    { id: 'defender', status: Boolean(defender.AntivirusEnabled && defender.RealTimeProtectionEnabled), details: defender },
+    { id: 'windows-update', status: update.Status === 'Running', details: update },
+    { id: 'bitlocker', status: posture.bitlocker.ProtectionStatus === 'On' && posture.bitlocker.VolumeStatus === 'FullyEncrypted', details: posture.bitlocker, action: 'audit-only' },
+    { id: 'tpm', status: posture.tpm.TpmPresent === true && posture.tpm.TpmReady === true, details: posture.tpm, action: 'audit-only' },
+    { id: 'secure-boot', status: posture.secureBoot.Enabled === true, details: posture.secureBoot, action: 'audit-only' },
+    { id: 'rdp-nla', status: posture.rdp.Enabled !== true || posture.rdp.NLA === true, details: posture.rdp, action: 'audit-only' },
+    { id: 'smbv1-disabled', status: posture.smb.SMB1State !== 'Enabled', details: posture.smb, action: 'audit-only' },
+    { id: 'smb-signing', status: posture.smb.RequireSecuritySignature === 1 || posture.smb.RequireSecuritySignature === true, details: posture.smb, action: 'audit-only' },
+    { id: 'network-profile', status: networkCategories.every((profile) => profile.category !== 'Unknown'), details: networkCategories, action: 'audit-only' },
+    { id: 'managed-policy-conflict', status: sources.Detected === false, details: sources, action: 'audit-only' },
+    { id: 'uac', status: localSecurity.UAC?.EnableLUA === 1 || localSecurity.UAC?.EnableLUA === true, details: localSecurity.UAC, action: 'audit-only' },
+    { id: 'powershell-policy', status: !Array.isArray(localSecurity.PowerShellExecutionPolicy) || localSecurity.PowerShellExecutionPolicy.every((item) => item.ExecutionPolicy !== 'Unrestricted'), details: localSecurity.PowerShellExecutionPolicy, action: 'audit-only' },
+  ] };
+}
+
+function plan(report = audit()) {
+  return report.policies.map((policy) => ({ id: policy.id, action: policy.action === 'audit-only' ? 'audit-only' : policy.status === true ? 'none' : 'apply', reason: policy.action === 'audit-only' ? 'Requires manual review' : policy.status === true ? 'Compliant' : 'Review or harden policy' }));
+}
+
+function backup() {
+  requireAdmin(); ensureStateDir();
+  const id = `${new Date().toISOString().replaceAll(':', '-')}-${randomUUID()}`;
+  const file = path.join(stateDir, `${id}.json`);
+  const snapshot = { id, createdAt: new Date().toISOString(), firewall: psJson('Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction'), defender: psJson('Get-MpPreference | Select-Object DisableRealtimeMonitoring, DisableBehaviorMonitoring, PUAProtection, EnableNetworkProtection') };
+  fs.writeFileSync(file, JSON.stringify(snapshot, null, 2), { mode: 0o600 });
+  return { id, file, snapshot };
+}
+
+function apply() {
+  requireAdmin();
+  const report = audit();
+  if (report.system.profile === 'domain-controller') throw new Error('Domain Controller detectado: el perfil es audit-only y requiere revisión explícita.');
+  if (report.configurationSources?.Detected === true) throw new Error('Políticas GPO/MDM detectadas: aplicación local bloqueada; revise el origen administrado.');
+  const changes = plan(report).filter((x) => x.action === 'apply');
+  if (!changes.length) return { changed: false, message: 'El sistema ya cumple las políticas soportadas.' };
+  const saved = backup();
+  try {
+    powershell('Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True -DefaultInboundAction Block -DefaultOutboundAction Allow');
+    powershell('Set-MpPreference -DisableRealtimeMonitoring $false -DisableBehaviorMonitoring $false -PUAProtection Enabled -EnableNetworkProtection Enabled');
+    const after = audit();
+    if (after.policies.some((p) => p.status !== true && p.id !== 'windows-update' && p.action !== 'audit-only')) throw new Error('La verificación posterior no fue satisfactoria.');
+    return { changed: true, backupId: saved.id, policies: after.policies };
+  } catch (error) {
+    console.error(chalk.red(`Aplicación incompleta: ${error.message}`));
+    console.error(chalk.yellow(`Backup disponible para rollback: ${saved.id}`));
+    throw error;
+  }
+}
+
+function rollback(id) {
+  requireAdmin();
+  if (!id || !/^[A-Za-z0-9._-]+$/.test(id)) throw new Error('Backup ID inválido.');
+  const file = path.join(stateDir, `${id}.json`);
+  if (!fs.existsSync(file)) throw new Error(`Backup no encontrado: ${id}`);
+  const snapshot = JSON.parse(fs.readFileSync(file, 'utf8'));
+  for (const profile of Array.isArray(snapshot.firewall) ? snapshot.firewall : [snapshot.firewall]) {
+    if (!profile?.Name) continue;
+    powershell(`Set-NetFirewallProfile -Profile ${psLiteral(profile.Name)} -Enabled $${Boolean(profile.Enabled)} -DefaultInboundAction ${profile.DefaultInboundAction} -DefaultOutboundAction ${profile.DefaultOutboundAction}`);
+  }
+  if (snapshot.defender && Object.keys(snapshot.defender).length) {
+    const defender = snapshot.defender;
+    const settings = [];
+    if (defender.DisableRealtimeMonitoring !== null && defender.DisableRealtimeMonitoring !== undefined) settings.push(`-DisableRealtimeMonitoring $${Boolean(defender.DisableRealtimeMonitoring)}`);
+    if (defender.DisableBehaviorMonitoring !== null && defender.DisableBehaviorMonitoring !== undefined) settings.push(`-DisableBehaviorMonitoring $${Boolean(defender.DisableBehaviorMonitoring)}`);
+    if (defender.PUAProtection) settings.push(`-PUAProtection ${psLiteral(defender.PUAProtection)}`);
+    if (defender.EnableNetworkProtection) settings.push(`-EnableNetworkProtection ${psLiteral(defender.EnableNetworkProtection)}`);
+    if (settings.length) powershell(`Set-MpPreference ${settings.join(' ')}`);
+  }
+  console.log(chalk.green(`Rollback aplicado: ${id}`));
+}
+
+
+function quarantine(id) {
+  requireAdmin();
+  if (!id || !/^[a-f0-9]{16}$/.test(id)) throw new Error('Finding ID inválido.');
+  const result = persistenceFindings();
+  const finding = result.findings.find((f) => f.id === id);
+  if (!finding) {
+    const fileFinding = sensitiveFiles().findings.find((f) => f.id === id);
+    if (fileFinding) return quarantineFile(fileFinding);
+    throw new Error(`Finding no encontrado: ${id}`);
+  }
+  ensureStateDir();
+  const recordFile = path.join(stateDir, `${id}.json`);
+  if (fs.existsSync(recordFile)) throw new Error(`Finding ya procesado: ${id}`);
+  let record;
+  if (finding.category === 'scheduled-task') {
+    const taskPath = taskPathFromLocation(finding.location);
+    const taskName = psLiteral(finding.name);
+    const taskPathLiteral = psLiteral(taskPath);
+    const xml = powershell(`Export-ScheduledTask -TaskName ${taskName} -TaskPath ${taskPathLiteral}`);
+    record = { id, category: finding.category, name: finding.name, taskPath, xml, action: 'disable', createdAt: new Date().toISOString() };
+    powershell(`Disable-ScheduledTask -TaskName ${taskName} -TaskPath ${taskPathLiteral}`);
+  } else if (finding.category === 'service') {
+    const state = psJson(`Get-CimInstance Win32_Service -Filter "Name='${finding.location.replaceAll("'", "''")}'" | Select-Object Name, State, StartMode, PathName`);
+    record = { id, category: finding.category, service: state, action: 'stop-disable', createdAt: new Date().toISOString() };
+    powershell(`Stop-Service -Name '${finding.location.replaceAll("'", "''")}' -Force -ErrorAction SilentlyContinue; Set-Service -Name '${finding.location.replaceAll("'", "''")}' -StartupType Disabled`);
+  } else if (finding.category === 'registry-run') {
+    const value = finding.name.replaceAll("'", "''");
+    const key = finding.location.replaceAll("'", "''");
+    const oldValue = powershell(`(Get-ItemProperty -Path '${key}' -Name '${value}').${value}`);
+    record = { id, category: finding.category, registryPath: finding.location, valueName: finding.name, value: oldValue, action: 'remove-value', createdAt: new Date().toISOString() };
+    powershell(`Remove-ItemProperty -Path '${key}' -Name '${value}' -Force`);
+  } else {
+    throw new Error(`Cuarentena no soportada para categoría: ${finding.category}`);
+  }
+  fs.writeFileSync(recordFile, JSON.stringify(record, null, 2), { mode: 0o600 });
+  console.log(JSON.stringify({ quarantined: id, category: finding.category, backup: recordFile }, null, 2));
+}
+
+function quarantineFile(finding) {
+  ensureStateDir();
+  const source = path.resolve(finding.location);
+  if (!fs.existsSync(source) || !fs.statSync(source).isFile()) throw new Error('El finding ya no apunta a un archivo regular.');
+  const destination = path.join(quarantineDir, `${finding.id}-${path.basename(source)}`);
+  fs.mkdirSync(quarantineDir, { recursive: true, mode: 0o700 });
+  fs.renameSync(source, destination);
+  const record = { id: finding.id, category: finding.category, source, destination, quarantinedAt: new Date().toISOString(), sha256: createHash('sha256').update(fs.readFileSync(destination)).digest('hex') };
+  fs.writeFileSync(path.join(quarantineDir, `${finding.id}.json`), JSON.stringify(record, null, 2), { mode: 0o600 });
+  console.log(JSON.stringify(record, null, 2));
+}
+
+function restore(id) {
+  requireAdmin();
+  if (!id || !/^[a-f0-9]{16}$/.test(id)) throw new Error('Finding ID inválido.');
+  const stateRecord = path.join(stateDir, `${id}.json`);
+  if (fs.existsSync(stateRecord)) {
+    const record = JSON.parse(fs.readFileSync(stateRecord, 'utf8'));
+    if (record.category === 'scheduled-task') {
+      const encoded = Buffer.from(record.xml, 'utf8').toString('base64');
+      powershell(`$xml=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); Register-ScheduledTask -TaskName ${psLiteral(record.name)} -TaskPath ${psLiteral(record.taskPath)} -Xml $xml -Force`);
+    } else if (record.category === 'service') {
+      const serviceName = psLiteral(record.service.Name);
+      powershell(`Set-Service -Name ${serviceName} -StartupType ${psLiteral(record.service.StartMode)}; if (${psLiteral(record.service.State)} -eq 'Running') { Start-Service -Name ${serviceName} }`);
+    } else if (record.category === 'registry-run') {
+      powershell(`New-ItemProperty -Path ${psLiteral(record.registryPath)} -Name ${psLiteral(record.valueName)} -Value ${psLiteral(record.value)} -PropertyType String -Force`);
+    }
+    fs.unlinkSync(stateRecord);
+    console.log(JSON.stringify({ restored: id, category: record.category }, null, 2));
+    return;
+  }
+  const recordFile = path.join(quarantineDir, `${id}.json`);
+  if (!fs.existsSync(recordFile)) throw new Error(`Registro de cuarentena no encontrado: ${id}`);
+  const record = JSON.parse(fs.readFileSync(recordFile, 'utf8'));
+  if (!fs.existsSync(record.destination)) throw new Error('El archivo en cuarentena no existe.');
+  fs.mkdirSync(path.dirname(record.source), { recursive: true });
+  if (fs.existsSync(record.source)) throw new Error('El destino original ya existe; no se sobrescribe.');
+  fs.renameSync(record.destination, record.source);
+  fs.unlinkSync(recordFile);
+  console.log(JSON.stringify({ restored: record.source, id }, null, 2));
+}
+
+const args = process.argv.slice(2);
+const flags = new Set(args);
+try {
+  if (flags.has('--help') || flags.has('-h')) { usage(); process.exit(0); }
+  if (args.includes('--rollback')) { rollback(args[args.indexOf('--rollback') + 1]); process.exit(0); }
+  if (args.includes('--quarantine')) { if (!flags.has('--yes')) throw new Error('--quarantine requiere --yes.'); quarantine(args[args.indexOf('--quarantine') + 1]); process.exit(0); }
+  if (args.includes('--restore')) { restore(args[args.indexOf('--restore') + 1]); process.exit(0); }
+  if (flags.has('--apply') && !flags.has('--yes')) throw new Error('--apply requiere confirmación explícita: añade --yes.');
+  const report = audit();
+  if (flags.has('--capabilities')) console.log(JSON.stringify(detectSystem(), null, 2));
+  if (flags.has('--persistence')) console.log(JSON.stringify(persistenceFindings(), null, 2));
+  if (flags.has('--files')) console.log(JSON.stringify(sensitiveFiles(), null, 2));
+  if (flags.has('--plan')) console.log(JSON.stringify(plan(report), null, 2));
+  else if (flags.has('--status') || flags.has('--audit') || flags.size === 0) console.log(flags.has('--json') ? JSON.stringify(report, null, 2) : JSON.stringify(report, null, 2));
+  if (flags.has('--apply')) console.log(JSON.stringify(apply(), null, 2));
+} catch (error) { console.error(chalk.red(`Error: ${error.message}`)); process.exitCode = 1; }

package/package.json

@@ -1,12 +1,19 @@
 {
   "name": "@methodwhite/auto-hardening",
-  "version": "1.0.0",
-  "description": "Auto-Hardening Tool - Aplica politicas de seguridad automaticamente en Windows",
-  "main": "auto-hardening.js",
+  "version": "1.7.2",
+  "description": "Audita y aplica medidas de hardening defensivo en Windows con modo dry-run seguro.",
   "type": "module",
+  "main": "auto-hardening.js",
+  "bin": {
+    "auto-hardening": "auto-hardening.js"
+  },
   "scripts": {
     "start": "node auto-hardening.js",
-    "harden": "node auto-hardening.js --full"
+    "audit": "node auto-hardening.js --audit",
+    "harden": "node auto-hardening.js --full",
+    "test": "node --test",
+    "lint": "node --check auto-hardening.js",
+    "pack:check": "npm pack --dry-run"
   },
   "keywords": [
     "security",
@@ -14,21 +21,34 @@
     "windows",
     "cis",
     "nist",
-    "endpoint-protection"
+    "endpoint-protection",
+    "devsecops"
   ],
   "author": "MethodWhite Security",
   "license": "MIT",
+  "engines": {
+    "node": ">=18.18.0"
+  },
   "repository": {
     "type": "git",
-    "url": "https://github.com/methodwhite/auto-hardening"
+    "url": "git+https://github.com/MethodWhite/auto-hardening.git"
   },
-  "engines": {
-    "node": ">=16.0.0"
+  "bugs": {
+    "url": "https://github.com/MethodWhite/auto-hardening/issues"
+  },
+  "homepage": "https://github.com/MethodWhite/auto-hardening#readme",
+  "files": [
+    "auto-hardening.js",
+    "profiles",
+    "README.md",
+    "LICENSE",
+    "SECURITY.md",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public"
   },
   "dependencies": {
     "chalk": "^5.3.0"
-  },
-  "bin": {
-    "auto-hardening": "./auto-hardening.js"
   }
 }

package/profiles/domain-controller.json

@@ -0,0 +1 @@
+{"id":"domain-controller","version":"1.0.0","scope":"domain-controller","mode":"audit-only","source":"Microsoft security guidance","policies":["ad-health-audit","sysvol-integrity-audit","ntds-protection-audit","kerberos-audit","gpo-conflict-audit"]}

package/profiles/server-member.json

@@ -0,0 +1 @@
+{"id":"server-member","version":"1.0.0","scope":"member-server","mode":"apply-safe","source":"Microsoft security guidance","policies":["firewall-inbound-block","defender-realtime","defender-pua","network-protection","audit-policy","rdp-nla-audit","smb-signing-audit"]}

package/profiles/workstation-domain.json

@@ -0,0 +1 @@
+{"id":"workstation-domain","version":"1.0.0","scope":"domain-member","mode":"apply-safe","source":"Microsoft security guidance","policies":["firewall-inbound-block","defender-realtime","defender-pua","network-protection","audit-policy","detect-gpo-conflicts"]}

package/profiles/workstation-home.json

@@ -0,0 +1 @@
+{"id":"workstation-home","version":"1.0.0","scope":"workstation","network":"Private/Public","mode":"apply-safe","source":"Microsoft security guidance","policies":["firewall-inbound-block","defender-realtime","defender-pua","network-protection","disable-smbv1"]}