@namewta/speculo 1.0.4 → 1.0.5

package/template/workflows/ops/H-computer-hygiene/scripts/run.ps1

@@ -0,0 +1,7 @@
+# Read-only audit wrapper. Run with a trusted Python 3.10+ interpreter.
+[CmdletBinding()]
+param([Parameter(ValueFromRemainingArguments = $true)][string[]]$AuditArgs)
+$ErrorActionPreference = 'Stop'
+$scriptFile = Join-Path $PSScriptRoot 'hygiene.py'
+& python $scriptFile audit @AuditArgs
+exit $LASTEXITCODE

package/template/workflows/ops/H-computer-hygiene/scripts/run.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+# Read-only audit wrapper. No sudo, installation, profile sourcing or cleanup.
+set -eu
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec python3 "$SCRIPT_DIR/hygiene.py" audit "$@"

package/template/workflows/ops/H-computer-hygiene/templates/config.example.json

@@ -0,0 +1,13 @@
+{
+  "schema_version": 1,
+  "project_roots": [],
+  "exclude_roots": [],
+  "target_root": null,
+  "max_entries_per_tree": 20000,
+  "max_entries_total": 200000,
+  "seconds_per_tree": 3.0,
+  "seconds_total": 90.0,
+  "project_depth": 3,
+  "min_age_days": 14,
+  "large_file_mib": 512
+}

package/template/workflows/ops/H-computer-hygiene/templates/maven-settings.fragment.xml

@@ -0,0 +1,6 @@
+<!-- EXAMPLE ONLY: merge localRepository into the existing settings.xml.
+     Do not replace the whole file: servers/profiles/mirrors may be essential.
+     Replace DEVROOT with a verified absolute path; back up local-only artifacts. -->
+<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0">
+  <localRepository>DEVROOT/data/maven/repository</localRepository>
+</settings>

package/template/workflows/ops/H-computer-hygiene/templates/native-evidence.example.json

@@ -0,0 +1,19 @@
+{
+  "schema_version": 1,
+  "record_kind": "TEMPLATE_NOT_REAL_EVIDENCE",
+  "scan_id": "REPLACE_WITH_REAL_SCAN_ID",
+  "collected_at": null,
+  "tool": "go",
+  "trusted_executable_path": "REPLACE_WITH_VERIFIED_ABSOLUTE_PATH",
+  "user_authorized_execution": false,
+  "argv": ["env", "GOPATH", "GOBIN", "GOCACHE", "GOMODCACHE", "GOROOT", "GOENV"],
+  "executed": false,
+  "exit_code": null,
+  "version": null,
+  "allowed_path_values": {},
+  "effective_scope": "unknown until actually queried; CLI/project/IDE may differ",
+  "full_stdout_recorded": false,
+  "full_environment_recorded": false,
+  "source_document_verified_at": null,
+  "limitations": ["Example only. Starting even a query can invoke shims, plugins, downloads or telemetry."]
+}

package/template/workflows/ops/H-computer-hygiene/tests/cli_smoke.py

@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+"""Linux-only end-to-end CLI test in a temporary HOME; no real account scan."""
+import hashlib
+import json
+import os
+import platform
+import subprocess
+import sys
+import tempfile
+import time
+from pathlib import Path
+
+
+def main():
+    if platform.system() != "Linux":
+        print(json.dumps({"status": "skipped", "reason": "Linux fixture test; native platform acceptance is separate"}))
+        return 0
+    script = Path(__file__).resolve().parents[1] / "scripts/hygiene.py"
+    stages = []
+    with tempfile.TemporaryDirectory(prefix="hygiene-cli-fixture-") as tmp:
+        root = Path(tmp).resolve()
+        home = root / "home"
+        cache = home / ".npm/_cacache"
+        payload = cache / "content-v2/aa/data"
+        payload.parent.mkdir(parents=True)
+        payload.write_bytes(b"CLI-FIXTURE-ONLY\n")
+        original = hashlib.sha256(payload.read_bytes()).hexdigest()
+        old = time.time() - 40 * 86400
+        for path in sorted(cache.rglob("*"), key=lambda x: len(x.parts), reverse=True):
+            os.utime(path, (old, old))
+        os.utime(cache, (old, old))
+        (home / "bin").mkdir()
+        env = {"HOME": str(home), "PATH": str(home / "bin"), "LANG": "C.UTF-8", "PYTHONDONTWRITEBYTECODE": "1"}
+        def call(stage, args, expected=0, raw=False):
+            result = subprocess.run([sys.executable, str(script), *args], env=env, cwd=root,
+                                    capture_output=True, text=True, timeout=30, check=False)
+            stages.append({"stage": stage, "exit_code": result.returncode, "expected": expected})
+            if result.returncode != expected:
+                raise RuntimeError(f"{stage} failed: {result.stderr}")
+            return result.stdout.strip() if raw else (json.loads(result.stdout) if result.stdout.strip() else None)
+        version = call("version", ["--version"], raw=True)
+        files = call("audit", ["audit", "--output", str(root / "reports")])
+        assert payload.exists() and not (home / ".speculo-hygiene").exists()
+        review = call("review", ["review", "--plan", files["plan"]])
+        assert len(review["actions"]) == 1
+        approval = root / "approval.json"
+        result = call("approve", ["approve", "--plan", files["plan"], "--ids", review["actions"][0]["id"],
+                                   "--output", str(approval), "--ack", "I_REVIEWED_EACH_ID"])
+        args = ["apply", "--plan", files["plan"], "--approval", str(approval), "--confirm", result["apply_confirmation"]]
+        call("missing-tools-closed-refused", args, expected=2)
+        assert payload.exists()
+        applied = call("apply", [*args, "--tools-closed"])
+        assert not payload.exists() and applied["freed_disk_space"] is False
+        preview = call("restore-preview", ["restore", "--receipt", applied["receipt"]])
+        call("restore", ["restore", "--receipt", applied["receipt"], "--confirm", preview["confirmation"]])
+        assert payload.exists() and hashlib.sha256(payload.read_bytes()).hexdigest() == original
+        output = {"status": "passed", "fixture_only": True, "temporary_home_only": True,
+                  "version": version, "stages": stages, "restored_payload_hash_matches": True,
+                  "default_audit_no_source_mutation": True, "no_permanent_deletion": True}
+    print(json.dumps(output, ensure_ascii=False, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/template/workflows/ops/H-computer-hygiene/tests/make_examples.py

@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+"""Build explicitly synthetic examples without reading the real user's home/apps.
+
+Only isolated tempfile content is audited. Native OS inventories are replaced by
+fixture metadata. Never run this as evidence about a real computer.
+"""
+import importlib.util
+import json
+import os
+import tempfile
+import time
+from pathlib import Path
+
+WORK = Path(__file__).resolve().parents[1]
+spec = importlib.util.spec_from_file_location("hygiene", WORK / "scripts/hygiene.py")
+h = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(h)
+
+
+class FixtureAuditor(h.Auditor):
+    def platform_inventory(self):
+        self.coverage.append(dict(area="applications/startup", status="SIMULATED-NOT-NATIVE",
+                                  detail="Synthetic application metadata only; no real registry, Applications, launchd or service reads."))
+        example = {"name": "Example Editor", "version": "1.0-fixture", "system_component": False,
+                   "action": "fixture candidate; not real software and never uninstalled"}
+        if self.system == "Windows":
+            example["identity"] = "HKCU/Uninstall/FIXTURE-EXAMPLE-ID"
+        else:
+            example.update(path=str(self.home / "Applications/Example Editor.app"), bundle_id="invalid.example.editor")
+        return {"applications": [example], "startup": [], "persistent_environment": [],
+                "errors": ["Real OS inventory intentionally disabled for this example."]}
+
+
+def populate(home, system):
+    h.ensure_private_dir(home)
+    for folder in ("bin-primary", "bin-old"):
+        name = "java.exe" if system == "Windows" else "java"
+        binary = home / folder / name
+        binary.parent.mkdir(parents=True)
+        binary.write_text("FIXTURE: NOT EXECUTABLE CODE")
+        binary.chmod(0o755)
+    repo = home / ".m2/repository/example/internal/1.0"
+    repo.mkdir(parents=True)
+    (repo / "internal-1.0.jar").write_bytes(b"LOCAL_ONLY_FIXTURE" * 1024)
+    (home / ".m2/settings.xml").write_text(f"<settings><localRepository>{home / '.m2/repository'}</localRepository><servers><server><password>DO_NOT_EXPORT_DEMO_SECRET</password></server></servers></settings>")
+    cargo = home / ".cargo"
+    cargo.mkdir()
+    (cargo / "credentials.toml").write_text('token="DO_NOT_EXPORT_DEMO_SECRET"')
+    (cargo / "config.toml").write_text("# protected fixture config")
+    for kind, path in h.default_cache_allowlist(home, system).items():
+        relative = {"npm-content-cache": "content-v2/aa/data", "pip-cache": "wheels/aa/demo.whl", "go-build-cache": "aa/demo-a"}[kind]
+        f = path / relative
+        f.parent.mkdir(parents=True)
+        f.write_bytes(b"regenerable-fixture-cache\n" * 2048)
+        old = time.time() - 45 * 86400
+        for child in sorted(path.rglob("*"), key=lambda p: len(p.parts), reverse=True):
+            os.utime(child, (old, old))
+        os.utime(path, (old, old))
+    project = home / "Projects/example-web"
+    project.mkdir(parents=True)
+    (project / ".git").mkdir()
+    (project / "package.json").write_text('{"packageManager":"pnpm@9.0.0"}')
+    for name in ("pnpm-lock.yaml", "package-lock.json", ".nvmrc"):
+        (project / name).write_text("fixture")
+    (project / "node_modules").mkdir()
+    (project / "node_modules/local-note.txt").write_text("May be unique data: do not auto-delete")
+    (home / ".zshrc").write_text('export JAVA_HOME="$HOME/old-jdk" # DO_NOT_EXPORT_DEMO_SECRET\n')
+    (home / ".profile").write_text('export JAVA_HOME="$HOME/new-jdk"\n')
+    downloads = home / "Downloads"
+    downloads.mkdir()
+    (downloads / "old-installer.zip").write_bytes(b"installer fixture")
+    unsafe = downloads / "source-clone"
+    unsafe.mkdir()
+    (unsafe / ".git").write_text("gitdir: ../../Projects/example-web/.git/worktrees/example")
+    delimiter = ";" if system == "Windows" else ":"
+    return {"PATH": delimiter.join(str(home / n) for n in ("bin-primary", "bin-old", "bin-primary", "missing-bin")),
+            "HOME": str(home), "LOCALAPPDATA": str(home / "AppData/Local"),
+            "JAVA_HOME": str(home / "old-jdk"), "CARGO_HOME": str(cargo),
+            "GOCACHE": str(h.default_cache_allowlist(home, system)["go-build-cache"])}
+
+
+def main():
+    generated = []
+    for system, folder in (("Windows", "windows"), ("Darwin", "macos"), ("Linux", "linux")):
+        with tempfile.TemporaryDirectory(prefix="hygiene-demo-") as temporary:
+            home = Path(temporary).resolve() / "fixture-home"
+            env = populate(home, system)
+            auditor = FixtureAuditor(home=home, system=system, environ=env,
+                                     options={"project_roots": [str(home / "Projects"), str(home / "Downloads")], "seconds_per_tree": 10},
+                                     label="SYNTHETIC_FIXTURE_NOT_YOUR_COMPUTER", native_platform_reads=False)
+            report, plan = auditor.run()
+            report["host"].update(release="SIMULATED_OS_METADATA", machine="SIMULATED_ARCHITECTURE",
+                                  elevated=False, fingerprint="FIXTURE_NOT_FOR_APPROVAL",
+                                  disk_total_bytes=512 * 1024**3, disk_free_bytes=120 * 1024**3,
+                                  execution_context_signals={"fixture_only": True})
+            report["scope"]["limitations"].append("Disk capacity, architecture and application identity are illustrative fixture values, not real measurements.")
+            report["findings"] = [x for x in report["findings"] if x["category"] != "privilege"]
+            report["summary"]["findings"] = len(report["findings"])
+            output = WORK / "examples" / folder
+            output.mkdir(parents=True, exist_ok=True)
+            date = report["date"]
+            md = h.render_report(report, plan)
+            public = h.redact(report, home)
+            assert "DO_NOT_EXPORT_DEMO_SECRET" not in md + json.dumps(public)
+            (output / f"{date}.md").write_text(md, encoding="utf-8")
+            (output / f"{date}.json").write_bytes(h.json_bytes(public))
+            target = h.target_root(home, system, env, None)
+            (output / f"{date}.environment.md").write_text("**模拟示例，不是已执行迁移。**\n\n" + h.render_environment(report, target), encoding="utf-8")
+            generated.append({"system": system, "example": str(output / f"{date}.md"), "findings": len(report["findings"]), "quarantine_candidates": len(plan["actions"])})
+    print(json.dumps({"fixture_only": True, "generated": generated}, ensure_ascii=False, indent=2))
+
+
+if __name__ == "__main__":
+    main()