windowsweep 1.0.1 → 1.1.0

package/modules/startup_audit.ps1

@@ -0,0 +1,126 @@
+# startup_audit.ps1 - section 25: everything that starts with the user or the machine. Report only.
+#
+# The tool shows; the user decides in Task Manager. That non-goal is deliberate: disabling a startup item is
+# a system configuration change, not cleanup, and a wrong one is invisible until the next boot.
+
+function Get-StartupApprovedState {
+  <# .SYNOPSIS enabled | disabled | unknown from an Explorer StartupApproved value.
+     The value is 12 bytes: a DWORD of flags then a FILETIME. Explorer stamps that FILETIME when the item is
+     DISABLED and zeroes it when the item is enabled, so a non-zero tail is the reliable signal.
+     Measured on Windows 10 19045 (2026-09-04): five items carried a real FILETIME under a leading 0x01, and
+     two enabled ones (0x01 and 0x04) carried an all-zero tail - the widely quoted "byte 0 is 02/03" table
+     does not hold there, so the tail is read first and 03 / 07 are kept only as a fallback marker.
+     A value shorter than 12 bytes is reported as unknown; it is never guessed. #>
+  param([byte[]] $Value)
+  if ($null -eq $Value -or $Value.Length -lt 12) { return 'unknown' }
+  for ($i = 4; $i -lt 12; $i++) { if ($Value[$i] -ne 0) { return 'disabled' } }
+  if ($Value[0] -eq 3 -or $Value[0] -eq 7) { return 'disabled' }
+  return 'enabled'
+}
+
+function Get-StartupApprovedMap {
+  <# .SYNOPSIS name -> enabled|disabled|unknown, from the StartupApproved keys Explorer maintains. #>
+  $map = @{}
+  $keys = @(
+    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run',
+    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32',
+    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder',
+    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run',
+    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder'
+  )
+  foreach ($k in $keys) {
+    $props = $null
+    try { $props = Get-ItemProperty -LiteralPath $k -ErrorAction Stop } catch { continue }
+    foreach ($prop in $props.PSObject.Properties) {
+      if ($prop.Name.StartsWith('PS')) { continue }
+      if (-not ($prop.Value -is [byte[]])) { continue }
+      $map[$prop.Name] = Get-StartupApprovedState -Value $prop.Value
+    }
+  }
+  return $map
+}
+
+function Get-StartupItems {
+  <# .SYNOPSIS Every startup entry the user can see, from all five places Windows keeps them. #>
+  $P = $Script:P
+  $approved = Get-StartupApprovedMap
+  $items = @()
+  $runKeys = @(
+    @('HKCU Run', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'),
+    @('HKCU RunOnce', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'),
+    @('HKLM Run', 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'),
+    @('HKLM RunOnce', 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'),
+    @('HKLM Run (32)', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'),
+    @('HKLM RunOnce (32)', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce')
+  )
+  foreach ($rk in $runKeys) {
+    # NOT $p: PowerShell variable names are case-insensitive, so $p would silently null the $P roots table.
+    $props = $null
+    try { $props = Get-ItemProperty -LiteralPath $rk[1] -ErrorAction Stop } catch { continue }
+    foreach ($prop in $props.PSObject.Properties) {
+      if ($prop.Name.StartsWith('PS')) { continue }
+      $state = 'enabled'
+      if ($approved.ContainsKey($prop.Name)) { $state = $approved[$prop.Name] }
+      $items += [pscustomobject]@{ Source = $rk[0]; Name = $prop.Name; State = $state; Command = [string]$prop.Value }
+    }
+  }
+  foreach ($folder in @(@('Startup (user)', (Join-Path $P.A 'Microsoft\Windows\Start Menu\Programs\Startup')), @('Startup (all users)', (Join-Path $P.PD 'Microsoft\Windows\Start Menu\Programs\Startup')))) {
+    if (-not (Test-DirPresent $folder[1])) { continue }
+    foreach ($e in (Get-ChildEntries $folder[1])) {
+      if ($e -is [IO.DirectoryInfo] -or $e.Name -eq 'desktop.ini') { continue }
+      $state = 'enabled'
+      if ($approved.ContainsKey($e.Name)) { $state = $approved[$e.Name] }
+      $items += [pscustomobject]@{ Source = $folder[0]; Name = $e.Name; State = $state; Command = (Remove-LongPrefix $e.FullName) }
+    }
+  }
+  try {
+    foreach ($t in (Get-ScheduledTask -ErrorAction Stop)) {
+      if (-not (@($t.Triggers) | Where-Object { $_.CimClass.CimClassName -eq 'MSFT_TaskLogonTrigger' })) { continue }
+      $state = 'enabled'
+      if ($t.State -eq 'Disabled') { $state = 'disabled' }
+      $cmd = ''
+      foreach ($a in @($t.Actions)) { if ($a.Execute) { $cmd = [string]$a.Execute } }
+      $items += [pscustomobject]@{ Source = 'Scheduled task (logon)'; Name = $t.TaskName; State = $state; Command = $cmd }
+    }
+  } catch { $null = $_ }
+  try {
+    foreach ($c in (Get-CimInstance Win32_StartupCommand -ErrorAction Stop)) {
+      if (@($items | Where-Object { $_.Name -eq $c.Name }).Count -gt 0) { continue }
+      $state = 'enabled'
+      if ($approved.ContainsKey([string]$c.Name)) { $state = $approved[[string]$c.Name] }
+      $items += [pscustomobject]@{ Source = "WMI ($($c.Location))"; Name = [string]$c.Name; State = $state; Command = [string]$c.Command }
+    }
+  } catch { $null = $_ }
+  return @($items | Sort-Object Source, Name)
+}
+
+function Get-Targets25 {
+  <# .SYNOPSIS Informational only. Section 25 changes nothing: it never disables or removes a startup item. #>
+  return @((New-Target 25 'Startup items (registry, folders, tasks)' 'Run keys + Startup folders + logon tasks' -Kind cmd -Note 'report only; change them yourself in Task Manager > Startup'))
+}
+
+function Invoke-Section25 {
+  $ws = $Script:WS
+  Write-SectionIntro @(
+    'Everything that launches when you sign in or the machine boots: Run and RunOnce keys, both Startup',
+    'folders, scheduled tasks with a logon trigger, and what Explorer records as enabled or disabled.',
+    'This section only shows them - change them in Task Manager > Startup, where you can undo it.'
+  )
+  $items = @(Get-StartupItems)
+  if ($items.Count -eq 0) { Write-Info 'no startup items found'; return }
+  Write-UiLine ("  {0,-22} {1,-30} {2,-9} {3}" -f 'SOURCE', 'NAME', 'STATE', 'COMMAND') 'White'
+  $lines = @("startup items - $(Get-Date -Format 'yyyy-MM-dd HH:mm')", '')
+  foreach ($it in $items) {
+    $color = 'Gray'
+    if ($it.State -eq 'disabled') { $color = 'DarkGray' }
+    $line = "  {0,-22} {1,-30} {2,-9} {3}" -f $it.Source, $it.Name, $it.State, $it.Command
+    Write-UiLine $line $color
+    $lines += $line.Trim()
+  }
+  $on = @($items | Where-Object { $_.State -eq 'enabled' }).Count
+  Write-Info "$($items.Count) startup item(s), $on enabled"
+  if (-not $ws.NoReport) {
+    $out = Join-Path $ws.ReportsDir ('startup-items-' + $ws.Stamp + '.txt')
+    try { [IO.File]::WriteAllLines($out, $lines); Write-Note "list saved: $out" } catch { $null = $_ }
+  }
+}

package/modules/windows_user.ps1

@@ -31,6 +31,7 @@ function Get-Targets09 {
     (New-Target 9 'Certificate URL cache' "$($P.LL)\Microsoft\CryptnetUrlCache" -Mode clear)
     (New-Target 9 'Diagnostics results' "$($P.L)\Diagnostics" -Mode clear-old -Days 30)
     (New-Target 9 'DNS resolver cache' 'ipconfig /flushdns' -Kind cmd)
+    (New-Target 9 'Microsoft Store download cache' 'wsreset.exe' -Kind cmd -Note 'printed as a next step, never run for you: wsreset has no silent mode and always opens the Store')
   )
 }
 
@@ -46,6 +47,11 @@ function Invoke-Section09 {
   $null = Invoke-TargetList $targets
   $r = Invoke-External -FilePath 'ipconfig.exe' -ArgumentList @('/flushdns') -Destructive -Quiet -Label 'ipconfig /flushdns'
   if ($r.Ran -and $r.ExitCode -eq 0) { Write-Ok 'DNS resolver cache flushed' }
+  # wsreset is the only lever for the Store download cache, and it has no silent switch: every build opens
+  # the Store window when it finishes. A cleanup run must not pop a window, so it is offered, never executed.
+  if (Test-PathPresent (Join-Path $Script:P.SR 'System32\wsreset.exe')) {
+    $Script:WS.Hints += 'Microsoft Store cache: run  wsreset.exe  yourself when you want it cleared (it opens the Store when it finishes)'
+  }
 }
 
 # ---------------------------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windowsweep",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Safe-by-default Windows cleanup CLI - developer-aware, dry-run first, zero install via npx.",
   "bin": {
     "windowsweep": "bin/windowsweep.js"
@@ -24,7 +24,8 @@
     "LICENSE",
     "CHANGELOG.md",
     "SECURITY.md",
-    "VERSION"
+    "VERSION",
+    "AI-INTEGRATION-GUIDE.md"
   ],
   "engines": {
     "node": ">=14"

package/windowsweep.ps1

@@ -20,7 +20,11 @@ $Script:WS = @{
   ScanRoots = @(); ExcludePaths = @(); Hiberfil = ''; ResetBase = $false; Permanent = $false
   OnlyList = ''; Profile = ''; Exclude = ''; ExportFmt = 'both'; ExportId = 'latest'; PruneDays = 90
   LogsDir = ''; ReportsDir = ''; NoReport = $false; CleanupLogs = $false
-  JsonMode = $false; Quiet = $false; NoColor = $false; Ascii = $false
+  JsonMode = $false; Quiet = $false; NoColor = $false; Ascii = $false; Notify = $false
+  # Scripted selection (--select / --select-file): a person's choice made in advance. SelectActive is LATCHED
+  # once at parse time because SelectQueue empties as prompts consume it.
+  SelectQueue = @(); SelectPaths = @(); SelectActive = $false; LastSelectionScripted = $false
+  Candidates = @(); ScanTargets = @()
   TotalFreed = [long]0; TotalEstimated = [long]0; SectionFreed = [long]0
   Refusals = @(); Hints = @(); ExitCode = 0; Finished = $false; AllowOwnData = $false
 }
@@ -79,6 +83,11 @@ OPTIONS
       --large-file-mb N    Minimum size for section 19 (default 100)
       --hiberfil off|reduced|keep   What section 15 does       --reset-base   DISM /ResetBase in 14
       --permanent       Sections 18/19 delete instead of using the Recycle Bin
+      --select L        Pre-answer the next interactive selection, e.g. --select 1,3-5. Repeatable: the
+                        lists are consumed in the order the prompts appear
+      --select-file P   UTF-8 file of one full path per line, matched against each prompt's candidates.
+                        Either flag lets sections 17/18/19/23 run unattended - a person did choose
+      --notify          Show a Windows notification when the run ends
       --logs-dir P / --reports-dir P / --no-report / --cleanup-logs
       --json            One-line JSON summary on stdout (everything else on stderr)
   -q, --quiet           Less chatter     --no-color     --ascii (plain glyphs)
@@ -167,6 +176,15 @@ function Read-Arguments {
       '--reports-dir' { $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }; $ws.ReportsDir = $v }
       '--no-report' { $ws.NoReport = $true }
       '--cleanup-logs' { $ws.CleanupLogs = $true }
+      '--notify' { $ws.Notify = $true }
+      '--select' { $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }; $ws.SelectQueue += $v }
+      '--select-file' {
+        $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }
+        $f = Get-FullPath $v
+        if (-not $f -or -not (Test-Path -LiteralPath $f)) { throw "--select-file not found: $v" }
+        $ws.SelectPaths = @([IO.File]::ReadAllLines($f) | ForEach-Object { $_.Trim() } | Where-Object { $_ -and -not $_.StartsWith('#') })
+        if ($ws.SelectPaths.Count -eq 0) { throw "--select-file has no paths in it: $v" }
+      }
       '--json' { $ws.JsonMode = $true; $ws.Quiet = $true }
       { $_ -in '-q', '--quiet' } { $ws.Quiet = $true }
       '--no-color' { $ws.NoColor = $true }
@@ -179,6 +197,8 @@ function Read-Arguments {
   if ($ws.Profile -and -not $Script:WS_PROFILES.ContainsKey($ws.Profile)) {
     throw "unknown profile '$($ws.Profile)' (known: $($Script:WS_PROFILES.Keys -join ', '))"
   }
+  # Latched here, once: the queue is drained by the prompts, so a recomputed flag would flip to false mid-run.
+  $ws.SelectActive = ($ws.SelectQueue.Count -gt 0 -or $ws.SelectPaths.Count -gt 0)
 }
 
 function Initialize-Paths {