@namewta/speculo 1.0.5 → 1.0.7

package/template/workflows/ops/H-computer-hygiene/scripts/run.ps1

@@ -1,7 +0,0 @@
-# Read-only audit wrapper. Run with a trusted Python 3.10+ interpreter.
-[CmdletBinding()]
-param([Parameter(ValueFromRemainingArguments = $true)][string[]]$AuditArgs)
-$ErrorActionPreference = 'Stop'
-$scriptFile = Join-Path $PSScriptRoot 'hygiene.py'
-& python $scriptFile audit @AuditArgs
-exit $LASTEXITCODE

package/template/workflows/ops/H-computer-hygiene/scripts/run.sh

@@ -1,5 +0,0 @@
-#!/bin/sh
-# Read-only audit wrapper. No sudo, installation, profile sourcing or cleanup.
-set -eu
-SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-exec python3 "$SCRIPT_DIR/hygiene.py" audit "$@"

package/template/workflows/ops/H-computer-hygiene/templates/config.example.json

@@ -1,13 +0,0 @@
-{
-  "schema_version": 1,
-  "project_roots": [],
-  "exclude_roots": [],
-  "target_root": null,
-  "max_entries_per_tree": 20000,
-  "max_entries_total": 200000,
-  "seconds_per_tree": 3.0,
-  "seconds_total": 90.0,
-  "project_depth": 3,
-  "min_age_days": 14,
-  "large_file_mib": 512
-}

package/template/workflows/ops/H-computer-hygiene/templates/maven-settings.fragment.xml

@@ -1,6 +0,0 @@
-<!-- EXAMPLE ONLY: merge localRepository into the existing settings.xml.
-     Do not replace the whole file: servers/profiles/mirrors may be essential.
-     Replace DEVROOT with a verified absolute path; back up local-only artifacts. -->
-<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0">
-  <localRepository>DEVROOT/data/maven/repository</localRepository>
-</settings>

package/template/workflows/ops/H-computer-hygiene/templates/native-evidence.example.json

@@ -1,19 +0,0 @@
-{
-  "schema_version": 1,
-  "record_kind": "TEMPLATE_NOT_REAL_EVIDENCE",
-  "scan_id": "REPLACE_WITH_REAL_SCAN_ID",
-  "collected_at": null,
-  "tool": "go",
-  "trusted_executable_path": "REPLACE_WITH_VERIFIED_ABSOLUTE_PATH",
-  "user_authorized_execution": false,
-  "argv": ["env", "GOPATH", "GOBIN", "GOCACHE", "GOMODCACHE", "GOROOT", "GOENV"],
-  "executed": false,
-  "exit_code": null,
-  "version": null,
-  "allowed_path_values": {},
-  "effective_scope": "unknown until actually queried; CLI/project/IDE may differ",
-  "full_stdout_recorded": false,
-  "full_environment_recorded": false,
-  "source_document_verified_at": null,
-  "limitations": ["Example only. Starting even a query can invoke shims, plugins, downloads or telemetry."]
-}

package/template/workflows/ops/H-computer-hygiene/tests/cli_smoke.py

@@ -1,65 +0,0 @@
-#!/usr/bin/env python3
-"""Linux-only end-to-end CLI test in a temporary HOME; no real account scan."""
-import hashlib
-import json
-import os
-import platform
-import subprocess
-import sys
-import tempfile
-import time
-from pathlib import Path
-
-
-def main():
-    if platform.system() != "Linux":
-        print(json.dumps({"status": "skipped", "reason": "Linux fixture test; native platform acceptance is separate"}))
-        return 0
-    script = Path(__file__).resolve().parents[1] / "scripts/hygiene.py"
-    stages = []
-    with tempfile.TemporaryDirectory(prefix="hygiene-cli-fixture-") as tmp:
-        root = Path(tmp).resolve()
-        home = root / "home"
-        cache = home / ".npm/_cacache"
-        payload = cache / "content-v2/aa/data"
-        payload.parent.mkdir(parents=True)
-        payload.write_bytes(b"CLI-FIXTURE-ONLY\n")
-        original = hashlib.sha256(payload.read_bytes()).hexdigest()
-        old = time.time() - 40 * 86400
-        for path in sorted(cache.rglob("*"), key=lambda x: len(x.parts), reverse=True):
-            os.utime(path, (old, old))
-        os.utime(cache, (old, old))
-        (home / "bin").mkdir()
-        env = {"HOME": str(home), "PATH": str(home / "bin"), "LANG": "C.UTF-8", "PYTHONDONTWRITEBYTECODE": "1"}
-        def call(stage, args, expected=0, raw=False):
-            result = subprocess.run([sys.executable, str(script), *args], env=env, cwd=root,
-                                    capture_output=True, text=True, timeout=30, check=False)
-            stages.append({"stage": stage, "exit_code": result.returncode, "expected": expected})
-            if result.returncode != expected:
-                raise RuntimeError(f"{stage} failed: {result.stderr}")
-            return result.stdout.strip() if raw else (json.loads(result.stdout) if result.stdout.strip() else None)
-        version = call("version", ["--version"], raw=True)
-        files = call("audit", ["audit", "--output", str(root / "reports")])
-        assert payload.exists() and not (home / ".speculo-hygiene").exists()
-        review = call("review", ["review", "--plan", files["plan"]])
-        assert len(review["actions"]) == 1
-        approval = root / "approval.json"
-        result = call("approve", ["approve", "--plan", files["plan"], "--ids", review["actions"][0]["id"],
-                                   "--output", str(approval), "--ack", "I_REVIEWED_EACH_ID"])
-        args = ["apply", "--plan", files["plan"], "--approval", str(approval), "--confirm", result["apply_confirmation"]]
-        call("missing-tools-closed-refused", args, expected=2)
-        assert payload.exists()
-        applied = call("apply", [*args, "--tools-closed"])
-        assert not payload.exists() and applied["freed_disk_space"] is False
-        preview = call("restore-preview", ["restore", "--receipt", applied["receipt"]])
-        call("restore", ["restore", "--receipt", applied["receipt"], "--confirm", preview["confirmation"]])
-        assert payload.exists() and hashlib.sha256(payload.read_bytes()).hexdigest() == original
-        output = {"status": "passed", "fixture_only": True, "temporary_home_only": True,
-                  "version": version, "stages": stages, "restored_payload_hash_matches": True,
-                  "default_audit_no_source_mutation": True, "no_permanent_deletion": True}
-    print(json.dumps(output, ensure_ascii=False, indent=2))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

package/template/workflows/ops/H-computer-hygiene/tests/make_examples.py

@@ -1,114 +0,0 @@
-#!/usr/bin/env python3
-"""Build explicitly synthetic examples without reading the real user's home/apps.
-
-Only isolated tempfile content is audited. Native OS inventories are replaced by
-fixture metadata. Never run this as evidence about a real computer.
-"""
-import importlib.util
-import json
-import os
-import tempfile
-import time
-from pathlib import Path
-
-WORK = Path(__file__).resolve().parents[1]
-spec = importlib.util.spec_from_file_location("hygiene", WORK / "scripts/hygiene.py")
-h = importlib.util.module_from_spec(spec)
-spec.loader.exec_module(h)
-
-
-class FixtureAuditor(h.Auditor):
-    def platform_inventory(self):
-        self.coverage.append(dict(area="applications/startup", status="SIMULATED-NOT-NATIVE",
-                                  detail="Synthetic application metadata only; no real registry, Applications, launchd or service reads."))
-        example = {"name": "Example Editor", "version": "1.0-fixture", "system_component": False,
-                   "action": "fixture candidate; not real software and never uninstalled"}
-        if self.system == "Windows":
-            example["identity"] = "HKCU/Uninstall/FIXTURE-EXAMPLE-ID"
-        else:
-            example.update(path=str(self.home / "Applications/Example Editor.app"), bundle_id="invalid.example.editor")
-        return {"applications": [example], "startup": [], "persistent_environment": [],
-                "errors": ["Real OS inventory intentionally disabled for this example."]}
-
-
-def populate(home, system):
-    h.ensure_private_dir(home)
-    for folder in ("bin-primary", "bin-old"):
-        name = "java.exe" if system == "Windows" else "java"
-        binary = home / folder / name
-        binary.parent.mkdir(parents=True)
-        binary.write_text("FIXTURE: NOT EXECUTABLE CODE")
-        binary.chmod(0o755)
-    repo = home / ".m2/repository/example/internal/1.0"
-    repo.mkdir(parents=True)
-    (repo / "internal-1.0.jar").write_bytes(b"LOCAL_ONLY_FIXTURE" * 1024)
-    (home / ".m2/settings.xml").write_text(f"<settings><localRepository>{home / '.m2/repository'}</localRepository><servers><server><password>DO_NOT_EXPORT_DEMO_SECRET</password></server></servers></settings>")
-    cargo = home / ".cargo"
-    cargo.mkdir()
-    (cargo / "credentials.toml").write_text('token="DO_NOT_EXPORT_DEMO_SECRET"')
-    (cargo / "config.toml").write_text("# protected fixture config")
-    for kind, path in h.default_cache_allowlist(home, system).items():
-        relative = {"npm-content-cache": "content-v2/aa/data", "pip-cache": "wheels/aa/demo.whl", "go-build-cache": "aa/demo-a"}[kind]
-        f = path / relative
-        f.parent.mkdir(parents=True)
-        f.write_bytes(b"regenerable-fixture-cache\n" * 2048)
-        old = time.time() - 45 * 86400
-        for child in sorted(path.rglob("*"), key=lambda p: len(p.parts), reverse=True):
-            os.utime(child, (old, old))
-        os.utime(path, (old, old))
-    project = home / "Projects/example-web"
-    project.mkdir(parents=True)
-    (project / ".git").mkdir()
-    (project / "package.json").write_text('{"packageManager":"pnpm@9.0.0"}')
-    for name in ("pnpm-lock.yaml", "package-lock.json", ".nvmrc"):
-        (project / name).write_text("fixture")
-    (project / "node_modules").mkdir()
-    (project / "node_modules/local-note.txt").write_text("May be unique data: do not auto-delete")
-    (home / ".zshrc").write_text('export JAVA_HOME="$HOME/old-jdk" # DO_NOT_EXPORT_DEMO_SECRET\n')
-    (home / ".profile").write_text('export JAVA_HOME="$HOME/new-jdk"\n')
-    downloads = home / "Downloads"
-    downloads.mkdir()
-    (downloads / "old-installer.zip").write_bytes(b"installer fixture")
-    unsafe = downloads / "source-clone"
-    unsafe.mkdir()
-    (unsafe / ".git").write_text("gitdir: ../../Projects/example-web/.git/worktrees/example")
-    delimiter = ";" if system == "Windows" else ":"
-    return {"PATH": delimiter.join(str(home / n) for n in ("bin-primary", "bin-old", "bin-primary", "missing-bin")),
-            "HOME": str(home), "LOCALAPPDATA": str(home / "AppData/Local"),
-            "JAVA_HOME": str(home / "old-jdk"), "CARGO_HOME": str(cargo),
-            "GOCACHE": str(h.default_cache_allowlist(home, system)["go-build-cache"])}
-
-
-def main():
-    generated = []
-    for system, folder in (("Windows", "windows"), ("Darwin", "macos"), ("Linux", "linux")):
-        with tempfile.TemporaryDirectory(prefix="hygiene-demo-") as temporary:
-            home = Path(temporary).resolve() / "fixture-home"
-            env = populate(home, system)
-            auditor = FixtureAuditor(home=home, system=system, environ=env,
-                                     options={"project_roots": [str(home / "Projects"), str(home / "Downloads")], "seconds_per_tree": 10},
-                                     label="SYNTHETIC_FIXTURE_NOT_YOUR_COMPUTER", native_platform_reads=False)
-            report, plan = auditor.run()
-            report["host"].update(release="SIMULATED_OS_METADATA", machine="SIMULATED_ARCHITECTURE",
-                                  elevated=False, fingerprint="FIXTURE_NOT_FOR_APPROVAL",
-                                  disk_total_bytes=512 * 1024**3, disk_free_bytes=120 * 1024**3,
-                                  execution_context_signals={"fixture_only": True})
-            report["scope"]["limitations"].append("Disk capacity, architecture and application identity are illustrative fixture values, not real measurements.")
-            report["findings"] = [x for x in report["findings"] if x["category"] != "privilege"]
-            report["summary"]["findings"] = len(report["findings"])
-            output = WORK / "examples" / folder
-            output.mkdir(parents=True, exist_ok=True)
-            date = report["date"]
-            md = h.render_report(report, plan)
-            public = h.redact(report, home)
-            assert "DO_NOT_EXPORT_DEMO_SECRET" not in md + json.dumps(public)
-            (output / f"{date}.md").write_text(md, encoding="utf-8")
-            (output / f"{date}.json").write_bytes(h.json_bytes(public))
-            target = h.target_root(home, system, env, None)
-            (output / f"{date}.environment.md").write_text("**模拟示例，不是已执行迁移。**\n\n" + h.render_environment(report, target), encoding="utf-8")
-            generated.append({"system": system, "example": str(output / f"{date}.md"), "findings": len(report["findings"]), "quarantine_candidates": len(plan["actions"])})
-    print(json.dumps({"fixture_only": True, "generated": generated}, ensure_ascii=False, indent=2))
-
-
-if __name__ == "__main__":
-    main()