windowsweep 1.3.2 → 1.4.0

package/modules/tool_releases.ps1

@@ -0,0 +1,197 @@
+# tool_releases.ps1 - section 28: superseded tool releases and downloaded updates; the running/current one is kept.
+# Seen on the P52 (2026-11-02): 27 Codex releases (11 GB) beside one current junction, Electron updater installers
+# left after the app that downloaded them was removed, an Ollama update download, and Node versions no project pins.
+# ASCII only.
+
+function ConvertTo-ReleaseVersion {
+  <# .SYNOPSIS "0.166.0-x86_64-pc-windows-msvc" -> [version] 0.166.0; $null for any other folder shape. #>
+  param([string] $Name)
+  if ($Name -match '^(\d+)\.(\d+)\.(\d+)(-[A-Za-z0-9_.-]+)?$') { return [version]("{0}.{1}.{2}" -f $Matches[1], $Matches[2], $Matches[3]) }
+  return $null
+}
+
+function Get-CodexReleasePlan {
+  <# .SYNOPSIS Split Codex standalone releases into Keep and Drop. Kept: the `current` junction's target, every
+     newer release (an update not switched to yet), the newest older one (rollback) and any folder that is not a
+     plain version. Without a readable `current` link nothing is dropped (fail closed). -Root and -CurrentLink
+     let the self-test plan a fixture. #>
+  param([string] $Root = '', [string] $CurrentLink = '')
+  if (-not $Root) { $Root = Join-Path $Script:P.U '.codex\packages\standalone\releases' }
+  if (-not $CurrentLink) { $CurrentLink = Join-Path (Split-Path -Parent $Root) 'current' }
+  $plan = [pscustomobject]@{ Root = (Get-FullPath $Root); Current = $null; Keep = @(); Drop = @(); Reason = '' }
+  if (-not (Test-DirPresent $Root)) { $plan.Reason = 'no Codex releases folder'; return $plan }
+  $current = $null
+  try {
+    $link = Get-Item -LiteralPath $CurrentLink -Force -ErrorAction Stop
+    if (Test-ReparsePoint $link) { $current = Get-FullPath ([string](@($link.Target)[0])) }
+  } catch { $current = $null }
+  if (-not $current -or -not (Test-DirPresent $current)) { $plan.Reason = 'no readable current-release link - nothing is removed'; return $plan }
+  $plan.Current = $current
+  $ic = [StringComparison]::OrdinalIgnoreCase
+  $rows = @()
+  foreach ($e in (Get-ChildEntries $Root)) {
+    if (-not ($e -is [IO.DirectoryInfo]) -or (Test-ReparsePoint $e)) { continue }
+    $rows += [pscustomobject]@{ Path = (Remove-LongPrefix $e.FullName); Version = (ConvertTo-ReleaseVersion $e.Name) }
+  }
+  $cur = @($rows | Where-Object { $_.Path.Equals($current, $ic) }) | Select-Object -First 1
+  if ($null -eq $cur -or $null -eq $cur.Version) {
+    $plan.Reason = 'the current release is not a version folder under the releases root - nothing is removed'
+    $plan.Keep = @($rows | ForEach-Object { $_.Path })
+    return $plan
+  }
+  $rollback = @($rows | Where-Object { $null -ne $_.Version -and $_.Version -lt $cur.Version } | Sort-Object Version -Descending) | Select-Object -First 1
+  foreach ($r in $rows) {
+    $keepIt = ($r.Path.Equals($current, $ic) -or $null -eq $r.Version -or $r.Version -gt $cur.Version -or ($null -ne $rollback -and $r.Path.Equals($rollback.Path, $ic)))
+    if ($keepIt) { $plan.Keep += $r.Path } else { $plan.Drop += $r.Path }
+  }
+  return $plan
+}
+
+function Get-CodexReleaseExceptions {
+  <# .SYNOPSIS The D79 exceptions for lib/safety.ps1: exactly the Drop folders of the live plan, nothing else. #>
+  $plan = Get-CodexReleasePlan
+  if ($plan.Reason) { return @() }
+  return @($plan.Drop)
+}
+
+function Get-BusyExecutablePaths {
+  <# .SYNOPSIS Executable paths of running processes (one CIM read), so a release folder in use is never removed. #>
+  try { return @(Get-CimInstance Win32_Process -ErrorAction Stop | ForEach-Object { [string]$_.ExecutablePath } | Where-Object { $_ }) } catch { return @() }
+}
+
+function Invoke-CodexReleasePrune {
+  <# .SYNOPSIS Remove the Drop folders through the chokepoint (which refuses anything the D79 exception does not name). #>
+  $plan = Get-CodexReleasePlan
+  if ($plan.Reason) { Write-Info "Codex releases - $($plan.Reason)"; return }
+  Write-Note ("Codex releases: {0} kept (current {1}), {2} superseded" -f $plan.Keep.Count, (Split-Path -Leaf $plan.Current), $plan.Drop.Count)
+  if ($plan.Drop.Count -eq 0) { Write-Info 'Codex releases - nothing superseded'; return }
+  $busy = @(Get-BusyExecutablePaths)
+  foreach ($d in $plan.Drop) {
+    $prefix = $d.TrimEnd('\') + '\'
+    if (@($busy | Where-Object { $_.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase) }).Count -gt 0) { Write-Note "in use by a running process, kept: $d"; continue }
+    $r = Remove-PathSafe -Path $d -Within $plan.Root -Label 'Codex release'
+    if ($r.Removed -and -not $Script:WS.DryRun) { Write-Ok ("Codex release {0} removed ({1})" -f (Split-Path -Leaf $d), (Format-Bytes $r.Bytes)) }
+  }
+}
+
+function ConvertTo-NodePin {
+  <# .SYNOPSIS One version request from .nvmrc / .node-version / engines.node: exact, major, newest or unknown. #>
+  param([string] $Text)
+  $t = ([string]$Text).Trim().ToLowerInvariant()
+  if (-not $t) { return $null }
+  if ($t -in 'node', 'latest', 'stable', 'current' -or $t.StartsWith('lts')) { return [pscustomobject]@{ Kind = 'newest'; Major = 0; Version = $null; Text = $t } }
+  if ($t -match '^v?(\d+)\.(\d+)\.(\d+)$') { return [pscustomobject]@{ Kind = 'exact'; Major = [int]$Matches[1]; Version = [version]("{0}.{1}.{2}" -f $Matches[1], $Matches[2], $Matches[3]); Text = $t } }
+  if ($t -match '^[\^~>=<\s]*v?(\d+)') { return [pscustomobject]@{ Kind = 'major'; Major = [int]$Matches[1]; Version = $null; Text = $t } }
+  return [pscustomobject]@{ Kind = 'unknown'; Major = 0; Version = $null; Text = $t }
+}
+
+function Get-NodeVersionPlan {
+  <# .SYNOPSIS Which installed Node versions no project needs. Kept: the active one, every exact pin, and for a
+     major pin ("24", "^24", ">=24") the newest installed of that major - the one nvm would pick. An unreadable
+     pin keeps everything (fail closed). Pure: the self-test drives it with literals. #>
+  param([string[]] $Installed, [string] $Active, [pscustomobject[]] $Pins)
+  $plan = [pscustomobject]@{ Keep = @(); Drop = @(); Unmet = @(); Reason = '' }
+  $rows = @()
+  foreach ($i in @($Installed)) { $n = ConvertTo-NodePin $i; if ($n -and $n.Kind -eq 'exact') { $rows += [pscustomobject]@{ Name = $i; Version = $n.Version; Major = $n.Major } } }
+  $keep = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::OrdinalIgnoreCase)
+  if ($Active) { $null = $keep.Add($Active) }
+  foreach ($pin in @($Pins)) {
+    if ($null -eq $pin) { continue }
+    if ($pin.Kind -eq 'unknown') { $plan.Reason = "a version request could not be read ('$($pin.Text)') - nothing is removed"; $plan.Keep = @($Installed); return $plan }
+    $hit = $null
+    if ($pin.Kind -eq 'exact') { $hit = @($rows | Where-Object { $_.Version -eq $pin.Version }) | Select-Object -First 1 }
+    elseif ($pin.Kind -eq 'major') { $hit = @($rows | Where-Object { $_.Major -eq $pin.Major } | Sort-Object Version -Descending) | Select-Object -First 1 }
+    elseif ($pin.Kind -eq 'newest') { $hit = @($rows | Sort-Object Version -Descending) | Select-Object -First 1 }
+    if ($hit) { $null = $keep.Add($hit.Name) } else { $plan.Unmet += $pin.Text }
+  }
+  foreach ($r in $rows) { if ($keep.Contains($r.Name)) { $plan.Keep += $r.Name } else { $plan.Drop += $r.Name } }
+  return $plan
+}
+
+function Get-NodePins {
+  <# .SYNOPSIS Every Node version request under the scan roots: .nvmrc, .node-version and package.json engines.node,
+     at most four folders deep, never inside node_modules or a never-enter folder. #>
+  param([string[]] $Roots, [int] $MaxDepth = 4)
+  $pins = @()
+  foreach ($root in @($Roots)) {
+    if (-not (Test-DirPresent $root)) { continue }
+    $stack = New-Object System.Collections.Generic.Stack[object]
+    $stack.Push(@((Get-FullPath $root), 0))
+    $seen = 0
+    while ($stack.Count -gt 0 -and $seen -lt 20000) {
+      $item = $stack.Pop(); $dir = [string]$item[0]; $depth = [int]$item[1]
+      foreach ($e in (Get-ChildEntries $dir)) {
+        $seen++
+        if (Test-ReparsePoint $e) { continue }
+        if ($e -is [IO.DirectoryInfo]) {
+          if ($e.Name -eq 'node_modules' -or $e.Name.StartsWith('.') -or $Script:WS_NEVER_ENTER -contains $e.Name) { continue }
+          if ($depth -lt $MaxDepth) { $stack.Push(@((Remove-LongPrefix $e.FullName), $depth + 1)) }
+          continue
+        }
+        $file = Remove-LongPrefix $e.FullName
+        if ($e.Name -in '.nvmrc', '.node-version') {
+          try { $pins += ConvertTo-NodePin ([IO.File]::ReadAllText($file)) } catch { $null = $_ }
+        } elseif ($e.Name -eq 'package.json') {
+          try { $j = [IO.File]::ReadAllText($file) | ConvertFrom-Json; if ($j.engines -and $j.engines.node) { $pins += ConvertTo-NodePin ([string]$j.engines.node) } } catch { $null = $_ }
+        }
+      }
+    }
+  }
+  return @($pins | Where-Object { $_ })
+}
+
+function Invoke-NvmPrune {
+  <# .SYNOPSIS Remove unpinned Node versions with nvm itself (developer mode and --scan-roots only). The tool never
+     deletes inside the nvm folder; `nvm uninstall` does, through Invoke-External -Destructive. #>
+  $ws = $Script:WS
+  if ($ws.Developer -ne $true) { Write-Info 'Node versions - developer mode is off, left alone'; return }
+  if (@($ws.ScanRoots).Count -eq 0) { Write-Info 'Node versions - no --scan-roots, so project version requests cannot be read; nothing removed'; return }
+  $nvmHome = $env:NVM_HOME
+  if (-not $nvmHome) { $nvmHome = Join-Path $Script:P.L 'nvm' }
+  if (-not (Test-DirPresent $nvmHome)) { Write-Info 'Node versions - nvm for Windows not found'; return }
+  $installed = @(Get-ChildEntries $nvmHome | Where-Object { $_ -is [IO.DirectoryInfo] -and $_.Name -match '^v\d+\.\d+\.\d+$' } | ForEach-Object { $_.Name })
+  $active = ''
+  $symlink = $env:NVM_SYMLINK
+  if ($symlink) { try { $li = Get-Item -LiteralPath $symlink -Force -ErrorAction Stop; if (Test-ReparsePoint $li) { $active = Split-Path -Leaf ([string](@($li.Target)[0])) } } catch { $active = '' } }
+  if (-not $active) { Write-Info 'Node versions - the active version could not be read; nothing removed'; return }
+  $plan = Get-NodeVersionPlan -Installed $installed -Active $active -Pins @(Get-NodePins -Roots $ws.ScanRoots)
+  if ($plan.Reason) { Write-Info "Node versions - $($plan.Reason)"; return }
+  Write-Note ("Node versions: active {0}; kept {1}; not needed {2}" -f $active, ($plan.Keep -join ', '), ($plan.Drop -join ', '))
+  if (@($plan.Unmet).Count -gt 0) { Write-Note ("requested but not installed: " + (($plan.Unmet | Sort-Object -Unique) -join ', ')) }
+  if ($plan.Drop.Count -eq 0) { return }
+  if (-not (Test-CommandPresent 'nvm')) { Write-Warn ('nvm is not on PATH; remove them yourself with: nvm uninstall ' + (($plan.Drop | ForEach-Object { $_.TrimStart('v') }) -join ' / ')); return }
+  foreach ($v in $plan.Drop) {
+    $bytes = Get-DirectoryBytes (Join-Path $nvmHome $v)
+    $r = Invoke-External -FilePath 'nvm' -ArgumentList @('uninstall', $v.TrimStart('v')) -Destructive -Quiet -Label 'nvm'
+    if ($ws.DryRun) { Add-Freed $bytes; continue }
+    if (-not (Test-DirPresent (Join-Path $nvmHome $v))) { Add-Freed $bytes; Write-Ok ("Node {0} removed with nvm ({1})" -f $v, (Format-Bytes $bytes)) } else { Write-Warn "Node $v is still installed (nvm exit $($r.ExitCode))" }
+  }
+}
+
+function Get-Targets28 {
+  $P = $Script:P
+  $t = @((New-Target 28 'Codex superseded releases' (Join-Path $P.U '.codex\packages\standalone\releases') -Kind cmd -Note 'the current release, any newer one and the newest older one are kept'))
+  # Electron updaters named without "@" - section 8 owns the "@name-updater" ones. One target per folder, so the
+  # list shows each and section 23 knows the folder is cleaned here.
+  foreach ($e in (Get-ChildEntries $P.L)) {
+    if (-not ($e -is [IO.DirectoryInfo]) -or (Test-ReparsePoint $e) -or $e.Name.StartsWith('@') -or $e.Name -notlike '*-updater') { continue }
+    $t += (New-Target 28 "Electron updater downloads ($($e.Name))" (Remove-LongPrefix $e.FullName) -Mode clear-old -Days 7 -Note 'downloaded installers and pending updates idle 7+ days')
+  }
+  $t += (New-Target 28 'Ollama downloaded updates' (Join-Path $P.L 'Ollama\updates_v2') -Mode clear-old -Days 1)
+  $t += (New-Target 28 'Node versions no project requests (nvm)' (Join-Path $P.L 'nvm') -Kind cmd -Note 'developer mode and --scan-roots; nvm uninstall; the active and every requested version are kept')
+  return $t
+}
+
+function Invoke-Section28 {
+  Write-SectionIntro @(
+    'Tools that update themselves often keep every old release. This removes the superseded ones and old downloaded',
+    'updates. The release in use, any newer one and the newest older one stay, and a release a running program uses',
+    'is skipped. Node versions go only in developer mode, when no project under --scan-roots asks for them.'
+  )
+  $targets = @(Get-Targets28)
+  $null = Show-TargetSizes $targets
+  if (-not (Confirm-Section 'Remove superseded releases and old downloaded updates?')) { Write-Info 'skipped'; return }
+  Invoke-CodexReleasePrune
+  $null = Invoke-TargetList @($targets | Where-Object { $_.Kind -ne 'cmd' })
+  Invoke-NvmPrune
+}

package/modules/uninstall.ps1

@@ -0,0 +1,232 @@
+# uninstall.ps1 - section 26: uninstall programs you pick, each with its own registered uninstaller (D77), then
+# offer the folders they left (leftovers.ps1). Interactive only; --yes never selects. One program at a time:
+# some uninstallers hand the work to a helper, and a second one started meanwhile fails (Adobe's "Failed to
+# acquire Bootstrapper Lock", P52 2026-11-02). The silent forms below are the ones that worked on the P52 that
+# day. ASCII only.
+
+# Never offered: Windows parts, runtimes other programs need, drivers, hardware support, build kits, this tool.
+$Script:WS_UNINSTALL_NEVER = @('*Redistributable*', '*Runtime*', '*Driver*', '*WebView2*', '*Chipset*', '*Firmware*',
+  'Microsoft Visual C++*', 'Microsoft .NET*', 'Microsoft ASP.NET*', 'Microsoft Edge*', 'Microsoft Visual Studio Installer*',
+  'Visual Studio Build Tools*', 'Windows Software Development Kit*', 'Windows SDK*', 'vs_*', 'Microsoft Update Health Tools*',
+  'Update for *', 'Security Update for *', 'Windows Subsystem for Linux*', 'Intel(R) *', "Intel$([char]0x00AE) *", 'Realtek *',
+  'NVIDIA PhysX*', '*Thunderbolt*', 'windowsweep*')
+
+function Split-CommandLine {
+  <# .SYNOPSIS "C:\a b\u.exe" /x  or  C:\a b\u.exe /x  ->  FilePath + Arguments. An unquoted path may hold spaces
+     (Steam's does), so it ends at the first program extension followed by a space or the end. #>
+  param([string] $Text)
+  $t = ([string]$Text).Trim()
+  if ($t.StartsWith('"')) {
+    $end = $t.IndexOf('"', 1)
+    if ($end -gt 0) { return [pscustomobject]@{ FilePath = $t.Substring(1, $end - 1); Arguments = $t.Substring($end + 1).Trim() } }
+  }
+  $m = [regex]::Match($t, '^(.+?\.(?:exe|sys|dll|com|bat|cmd|msc|cpl|scr))(?:\s+(.*))?$', [Text.RegularExpressions.RegexOptions]::IgnoreCase)
+  if ($m.Success) { return [pscustomobject]@{ FilePath = $m.Groups[1].Value; Arguments = $m.Groups[2].Value.Trim() } }
+  $parts = $t -split '\s+', 2
+  $tail = ''
+  if ($parts.Count -gt 1) { $tail = $parts[1] }
+  return [pscustomobject]@{ FilePath = $parts[0]; Arguments = $tail }
+}
+
+function Get-AdobeBaseVersion {
+  <# .SYNOPSIS Adobe's silent uninstall needs the product's BASE version, which only the installer's icon folder
+     records (ProgramData\Adobe\Installer\Icons\<SAP>_<base>): Photoshop 2023 registered 24.1, its base was 24.0. #>
+  param([string] $SapCode, [string] $IconsRoot = '')
+  if (-not $IconsRoot) { $IconsRoot = Join-Path $Script:P.PD 'Adobe\Installer\Icons' }
+  foreach ($e in (Get-ChildEntries $IconsRoot)) {
+    if ($e -is [IO.DirectoryInfo] -and $e.Name.StartsWith("$SapCode`_", [StringComparison]::OrdinalIgnoreCase)) { return $e.Name.Substring($SapCode.Length + 1) }
+  }
+  return ''
+}
+
+function Get-UninstallCommand {
+  <# .SYNOPSIS The command that removes one program, as the P52 cleanup proved them. Silent when a known silent
+     form exists; otherwise the vendor's own uninstaller with its own window. Pure apart from Adobe's icon lookup. #>
+  param([pscustomobject] $Row, [string] $AdobeIconsRoot = '')
+  $out = [pscustomobject]@{ FilePath = ''; Arguments = ''; Strategy = 'none'; Silent = $false; SuccessCodes = @(0); Helpers = @() }
+  $un = [string]$Row.UninstallString
+  if ($Row.QuietUninstallString) {
+    $c = Split-CommandLine $Row.QuietUninstallString
+    $out.FilePath = $c.FilePath; $out.Arguments = $c.Arguments; $out.Strategy = 'quiet'; $out.Silent = $true; $out.Helpers = @('_iu*', 'unins*', 'Au_*')
+    return $out
+  }
+  $guid = ''
+  if ($un -match '(\{[0-9A-Fa-f-]{36}\})') { $guid = $Matches[1] } elseif ($Row.KeyName -match '^\{[0-9A-Fa-f-]{36}\}$') { $guid = $Row.KeyName }
+  if ($guid -and ($Row.WindowsInstaller -eq 1 -or $un -match '(?i)msiexec')) {
+    # VMware Workstation registered no command at all - only its MSI product code (P52, 2026-11-02).
+    $out.FilePath = 'msiexec.exe'; $out.Arguments = "/x $guid /qn /norestart"; $out.Strategy = 'msi'; $out.Silent = $true; $out.SuccessCodes = @(0, 1641, 3010)
+    return $out
+  }
+  if (-not $un) { return $out }
+  $c = Split-CommandLine $un
+  $exe = [IO.Path]::GetFileName($c.FilePath).ToLowerInvariant()
+  $out.FilePath = $c.FilePath; $out.Arguments = $c.Arguments
+  if ($exe -match '^unins\d{3}\.exe$') { $out.Arguments = '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART'; $out.Strategy = 'inno'; $out.Silent = $true; $out.Helpers = @('_iu*', 'unins*') }
+  elseif ($exe -eq 'maintenancetool.exe') { $out.Arguments = 'purge --confirm-command'; $out.Strategy = 'qt-installer'; $out.Silent = $true }
+  elseif ($c.FilePath -match '(?i)\\Adobe Desktop Common\\HDBox\\Uninstaller\.exe$' -and $un -match '--sapCode=(\w+)') {
+    $sap = $Matches[1]
+    $platform = 'win64'
+    if ($un -match '--productPlatform=(\w+)') { $platform = $Matches[1] }
+    $base = Get-AdobeBaseVersion -SapCode $sap -IconsRoot $AdobeIconsRoot
+    if ($base) {
+      $out.FilePath = Join-Path (Split-Path -Parent $c.FilePath) 'Setup.exe'
+      $out.Arguments = "--uninstall=1 --sapCode=$sap --baseVersion=$base --platform=$platform --deleteUserPreferences=false"
+      $out.Strategy = 'adobe'; $out.Silent = $true; $out.Helpers = @('Set-up', 'HDHelper', 'Setup')
+    } else { $out.Strategy = 'vendor-ui' }
+  }
+  elseif ($c.FilePath -match '(?i)\\Application\\[\d.]+\\Installer\\[^\\]*setup\.exe$' -and $c.Arguments -match '--uninstall') {
+    # Chromium-family installers (Brave, Copilot's copilot_setup.exe): exit 19 is their success code.
+    if ($c.Arguments -notmatch '--force-uninstall') { $out.Arguments = ($c.Arguments + ' --force-uninstall').Trim() }
+    $out.Strategy = 'chromium'; $out.Silent = $true; $out.SuccessCodes = @(0, 19)
+  }
+  elseif ($exe -like '*installer.exe' -and $c.Arguments -match '(?i)\buninstall\b') {
+    $args2 = $c.Arguments.Replace('"', '').Trim()
+    if ($args2 -notmatch '--quiet') { $args2 = "$args2 --quiet" }
+    $out.Arguments = $args2; $out.Strategy = 'quiet-flag'; $out.Silent = $true
+  }
+  elseif ($exe -in 'uninstall.exe', 'uninst.exe', 'uninstaller.exe') {
+    if ($c.Arguments -cnotmatch '(^|\s)/S(\s|$)') { $out.Arguments = ($c.Arguments + ' /S').Trim() }
+    $out.Strategy = 'nsis'; $out.Silent = $true; $out.Helpers = @('Au_*')
+  }
+  elseif ($exe -in 'winget', 'winget.exe' -and $c.Arguments -match '^uninstall\b') {
+    # winget's portable packages (jq, FFmpeg, age, ... on the P52) register winget itself as their uninstaller.
+    $out.Arguments = ($c.Arguments + ' --silent --disable-interactivity --accept-source-agreements').Trim(); $out.Strategy = 'winget'; $out.Silent = $true
+  }
+  elseif ($exe -eq 'rustup.exe' -and $c.Arguments -match '^self uninstall\b') {
+    if ($c.Arguments -notmatch '(^|\s)-y(\s|$)') { $out.Arguments = ($c.Arguments + ' -y').Trim() }
+    $out.Strategy = 'rustup'; $out.Silent = $true
+  }
+  elseif ($c.FilePath -match '(?i)\\Package Cache\\\{[0-9A-Fa-f-]{36}\}\\[^\\]+\.exe$' -and $c.Arguments -match '(?i)/uninstall') {
+    # A WiX bundle in the Package Cache: /quiet is the bundle engine's own switch.
+    if ($c.Arguments -notmatch '(?i)/quiet') { $out.Arguments = ($c.Arguments + ' /quiet /norestart').Trim() }
+    $out.Strategy = 'wix-bundle'; $out.Silent = $true
+  }
+  elseif ($c.Arguments -match '(?i)(^|\s)(--yes|-y|--silent|--quiet|/quiet|/qn|/silent|/verysilent)(\s|$)' -or $c.Arguments -cmatch '(^|\s)/S(\s|$)') {
+    $out.Strategy = 'registered-silent'; $out.Silent = $true   # Python's manager registers "uninstall --yes --by-id ..."
+  }
+  else { $out.Strategy = 'vendor-ui' }
+  return $out
+}
+
+function Test-UninstallOffered {
+  <# .SYNOPSIS False for Windows parts, updates, runtimes, drivers, build kits, this tool and entries with no uninstaller. #>
+  param([pscustomobject] $Row)
+  if (-not $Row.DisplayName -or $Row.SystemComponent -eq 1 -or $Row.ParentKeyName) { return $false }
+  if ($Row.ReleaseType -match '(?i)update|hotfix') { return $false }
+  if (-not $Row.UninstallString -and -not $Row.QuietUninstallString -and $Row.WindowsInstaller -ne 1) { return $false }
+  foreach ($pat in $Script:WS_UNINSTALL_NEVER) { if ($Row.DisplayName -like $pat) { return $false } }
+  return $true
+}
+
+function Get-UninstallCandidates {
+  <# .SYNOPSIS Programs section 26 may offer, largest first, one row per registry key. #>
+  return @(Get-InstalledProgramRows | Where-Object { Test-UninstallOffered $_ } | Sort-Object { [long]$_.EstimatedSizeKb } -Descending)
+}
+
+function Wait-UninstallDone {
+  <# .SYNOPSIS After the uninstaller's own process exits: wait for its registry key to go while any of its known
+     helper processes still runs (the work often continues there), up to MaxMinutes. Returns $true when gone. #>
+  param([string] $KeyPath, [string[]] $Helpers, [int] $MaxMinutes = 15)
+  $deadline = (Get-Date).AddMinutes($MaxMinutes)
+  $quietSince = Get-Date
+  while ((Get-Date) -lt $deadline) {
+    if (-not (Test-Path -LiteralPath "Registry::$KeyPath")) { return $true }
+    $busy = @(Get-Process -ErrorAction SilentlyContinue | Where-Object { $n = $_.ProcessName; @($Helpers | Where-Object { $n -like $_ }).Count -gt 0 })
+    if ($busy.Count -gt 0) { $quietSince = Get-Date } elseif (((Get-Date) - $quietSince).TotalSeconds -ge 20) { break }
+    Start-Sleep -Seconds 3
+  }
+  return (-not (Test-Path -LiteralPath "Registry::$KeyPath"))
+}
+
+function Invoke-ProgramUninstall {
+  <# .SYNOPSIS Remove one program with its own uninstaller. Returns removed | pending | failed | skipped | dry-run. #>
+  param([pscustomobject] $Row)
+  $ws = $Script:WS
+  $cmd = Get-UninstallCommand $Row
+  if ($cmd.Strategy -eq 'none') { Write-Warn "$($Row.DisplayName) - no uninstall command is registered; remove it from Settings > Apps"; return 'skipped' }
+  if ($cmd.FilePath -match '^[A-Za-z]:\\' -and -not (Test-Path -LiteralPath $cmd.FilePath)) {
+    Write-Warn "$($Row.DisplayName) - its uninstaller is missing ($($cmd.FilePath)); remove the entry from Settings > Apps"
+    return 'skipped'
+  }
+  $needsAdmin = ($Row.Machine -and -not $ws.IsAdmin)
+  $display = ('"{0}" {1}' -f $cmd.FilePath, $cmd.Arguments).Trim()
+  if ($ws.DryRun) {
+    $suffix = ''
+    if ($needsAdmin) { $suffix = '   (installed for all users: needs an elevated run)' }
+    Write-DryRun ("would uninstall {0} [{1}]: {2}{3}" -f $Row.DisplayName, $cmd.Strategy, $display, $suffix)
+    Add-Freed ([long]$Row.EstimatedSizeKb * 1024)
+    return 'dry-run'
+  }
+  if ($needsAdmin) {
+    Write-Warn "$($Row.DisplayName) - installed for all users, so its uninstaller needs Administrator rights (skipped)"
+    $ws.Hints += 'Uninstall programs installed for all users from an elevated run:  windowsweep --only 26 --elevate'
+    return 'skipped'
+  }
+  $loc = ([string]$Row.InstallLocation).Trim().Trim('"').TrimEnd('\')
+  if ($loc -and (Test-DirPresent $loc)) {
+    $prefix = (Get-FullPath $loc) + '\'
+    $running = @(Get-BusyExecutablePaths | Where-Object { $_.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase) })
+    if ($running.Count -gt 0) { Write-Warn "$($Row.DisplayName) is running ($([IO.Path]::GetFileName($running[0]))) - close it and run section 26 again"; return 'skipped' }
+  }
+  if (-not $cmd.Silent) { Write-Note "$($Row.DisplayName) has no silent form - its own uninstaller window opens; finish it there" }
+  Write-LogLine "uninstall [$($cmd.Strategy)]: $display"
+  $started = Get-Date
+  try {
+    $sp = @{ FilePath = $cmd.FilePath; PassThru = $true; ErrorAction = 'Stop' }
+    if ($cmd.Arguments) { $sp.ArgumentList = $cmd.Arguments }
+    $proc = Start-Process @sp
+    $null = $proc.Handle   # Windows PowerShell loses ExitCode unless the handle is cached while the process runs
+    if (-not $proc.WaitForExit(15 * 60 * 1000)) { Write-Warn "$($Row.DisplayName) - the uninstaller is still running after 15 minutes; left running"; return 'pending' }
+    $code = $proc.ExitCode
+  } catch { Write-Err "$($Row.DisplayName) - could not start its uninstaller: $($_.Exception.Message)"; return 'failed' }
+  $gone = Wait-UninstallDone -KeyPath $Row.KeyPath -Helpers $cmd.Helpers
+  $secs = [int]((Get-Date) - $started).TotalSeconds
+  Write-LogLine "uninstall exit $code after ${secs}s, entry gone: $gone : $($Row.DisplayName)"
+  if ($gone) { Add-Freed ([long]$Row.EstimatedSizeKb * 1024); Write-Ok ("{0} uninstalled ({1}s)" -f $Row.DisplayName, $secs); return 'removed' }
+  if ($cmd.SuccessCodes -contains $code) { Write-Warn "$($Row.DisplayName) - the uninstaller reported success but its entry is still there (a restart may finish it)"; return 'pending' }
+  Write-Err "$($Row.DisplayName) - the uninstaller exited with $code and the program is still installed"
+  return 'failed'
+}
+
+function Get-Targets26 {
+  return @((New-Target 26 'Installed programs (uninstall hives)' 'HKLM + HKCU Uninstall hives' -Kind cmd -Note 'you pick; each runs its own uninstaller, one at a time; its leftover folders are offered after'))
+}
+
+function Invoke-Section26 {
+  $ws = $Script:WS
+  Write-SectionIntro @(
+    'Programs you pick are removed with their own uninstaller, one at a time. Windows parts, runtimes, drivers and',
+    'build kits are never listed. Programs installed for all users need an elevated run. After a real uninstall, the',
+    'folders a program left are offered for the Recycle Bin. Nothing here runs without your selection.'
+  )
+  $rows = @(Get-UninstallCandidates)
+  if ($rows.Count -eq 0) { Write-Info 'no program can be offered'; return }
+  Write-UiLine ("  {0,3}  {1,10}  {2,-46} {3,-12} {4}" -f '#', 'SIZE', 'PROGRAM', 'HOW', 'NEEDS') 'White'
+  $i = 1
+  foreach ($r in $rows) {
+    $cmd = Get-UninstallCommand $r
+    $needs = ''
+    if ($r.Machine) { $needs = 'admin' }
+    $size = 'unknown'
+    if ($r.EstimatedSizeKb -gt 0) { $size = Format-Bytes ([long]$r.EstimatedSizeKb * 1024) }
+    $name = "$($r.DisplayName) $($r.DisplayVersion)".Trim()
+    if ($name.Length -gt 46) { $name = $name.Substring(0, 45) + '~' }
+    Write-UiLine ("  {0,3}  {1,10}  {2,-46} {3,-12} {4}" -f $i, $size, $name, $cmd.Strategy, $needs) 'Gray'
+    Add-JsonCandidate -Section 26 -Index $i -Path $r.KeyPath -Bytes ([long]$r.EstimatedSizeKb * 1024) -IdleDays -1 -Label $r.DisplayName
+    $i++
+  }
+  $picks = @(Read-MultiSelect -Total $rows.Count -NoAutoYes -Candidates @($rows | ForEach-Object { $_.KeyPath }))
+  if ($picks.Count -eq 0) { Write-Info 'nothing selected'; return }
+  if (-not $ws.DryRun) {
+    if (-not (Confirm-Ui -Prompt "Uninstall $($picks.Count) program(s), one at a time?" -Default 'n' -NoAutoYes -ScriptedOk)) { Write-Info 'skipped'; return }
+  }
+  $removed = @()
+  foreach ($k in $picks) {
+    $row = $rows[$k - 1]
+    if ((Invoke-ProgramUninstall -Row $row) -eq 'removed') { $removed += $row }
+  }
+  if ($ws.DryRun) { Write-Note 'the folders a program leaves are offered after a real uninstall'; return }
+  if ($removed.Count -eq 0) { return }
+  Write-Section 'Folders the removed programs left'
+  Invoke-LeftoverChoice -Rows @(Find-ProgramLeftovers -Programs $removed) -Section 26 -PathsOrConsoleOnly
+}

package/modules/windows_user.ps1

@@ -67,9 +67,38 @@ function Get-TempRoots {
   return $roots
 }
 
+function Get-DeclaredTempRoots {
+  <# .SYNOPSIS 1.4.0: --temp-roots / tempRoots - folders a person uses as scratch space (C:\t on the P52, where
+     test runs left one browser profile per run). Existing ones, once each, never a Windows temp root twice. #>
+  $known = @(Get-TempRoots)
+  $out = @()
+  foreach ($r in @($Script:WS.TempRoots)) {
+    if (-not $r -or -not (Test-DirPresent $r)) { continue }
+    $f = Get-FullPath $r
+    if ($known -notcontains $f -and $out -notcontains $f) { $out += $f }
+  }
+  return $out
+}
+
+function Get-TempRootPlan {
+  <# .SYNOPSIS Pure over its inputs: the top-level entries of a declared temp root that go whole - nothing inside
+     written for -Days or more (the caller measures write/creation time only), and not named in any running
+     program's command line (a test browser using one as its profile). #>
+  param([object[]] $Entries, [int] $Days, [string[]] $BusyText)
+  $out = @()
+  foreach ($e in @($Entries)) {
+    if ($e.Idle -lt $Days) { continue }
+    $named = $false
+    foreach ($b in @($BusyText)) { if ($b -and $b.IndexOf($e.Path, [StringComparison]::OrdinalIgnoreCase) -ge 0) { $named = $true; break } }
+    if (-not $named) { $out += $e }
+  }
+  return $out
+}
+
 function Get-Targets10 {
   $t = @()
   foreach ($r in (Get-TempRoots)) { $t += (New-Target 10 'User temp' $r -Mode prune -Days $Script:WS.TempDays -Note "files idle $($Script:WS.TempDays)+ days; open files are skipped") }
+  foreach ($r in (Get-DeclaredTempRoots)) { $t += (New-Target 10 "Declared temp root ($r)" $r -Mode clear-old -Days $Script:WS.TempDays -Note "each entry idle $($Script:WS.TempDays)+ days goes whole; one a running program names is kept") }
   return $t
 }
 
@@ -79,11 +108,26 @@ function Invoke-Section10 {
     "Temporary files idle for $($ws.TempDays)+ days. Files a running program still has open are skipped, so an",
     'installer or build that is in progress right now is safe. Lower the window with --temp-days 1 for a harder sweep.'
   )
-  $targets = @(Get-Targets10)
-  if ($targets.Count -eq 0) { Write-Info 'no temp folders found'; return }
+  $targets = @(Get-Targets10 | Where-Object { $_.Mode -ne 'clear-old' })
+  $declared = @(Get-DeclaredTempRoots)
+  if ($targets.Count -eq 0 -and $declared.Count -eq 0) { Write-Info 'no temp folders found'; return }
   $null = Show-TargetSizes $targets
+  $busy = @()
+  if ($declared.Count -gt 0) { try { $busy = @(Get-CimInstance Win32_Process -Property CommandLine -ErrorAction Stop | ForEach-Object { [string]$_.CommandLine } | Where-Object { $_ }) } catch { $busy = @() } }
+  $plans = @()
+  foreach ($root in $declared) {
+    $entries = @(Get-ChildEntries $root | Where-Object { -not (Test-ReparsePoint $_) } | ForEach-Object { $full = Remove-LongPrefix $_.FullName; [pscustomobject]@{ Path = $full; Idle = (Get-IdleDays $full -WriteOnly) } })
+    $go = @(Get-TempRootPlan -Entries $entries -Days $ws.TempDays -BusyText $busy)
+    Write-UiLine ("  {0}: {1} of {2} entries idle {3}+ days and not in use" -f $root, $go.Count, $entries.Count, $ws.TempDays) 'Gray'
+    $plans += [pscustomobject]@{ Root = $root; Go = $go }
+  }
   if (-not (Confirm-Section "Remove temp files idle $($ws.TempDays)+ days?")) { Write-Info 'skipped'; return }
   $null = Invoke-TargetList $targets
+  foreach ($pl in $plans) {
+    $freed = [long]0; $n = 0
+    foreach ($e in $pl.Go) { $r = Remove-PathSafe -Path $e.Path -Within $pl.Root -Label 'declared temp root'; if ($r.Removed) { $freed += $r.Bytes; $n++ } }
+    if (-not $ws.DryRun -and $n -gt 0) { Write-Ok ("{0} - {1} entries removed ({2})" -f $pl.Root, $n, (Format-Bytes $freed)) }
+  }
 }
 
 # ---------------------------------------------------------------------------------------------

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "windowsweep",
-  "version": "1.3.2",
-  "description": "Developer-aware Windows cleanup CLI: dry-run first, personal folders refused, zero install via npx.",
+  "version": "1.4.0",
+  "description": "Windows cleanup CLI: dry-run first, personal files chosen row by row, zero install via npx.",
   "bin": {
     "windowsweep": "bin/windowsweep.js"
   },

package/windowsweep.ps1

@@ -14,10 +14,12 @@ $Script:WS_ROOT = Split-Path -Parent $MyInvocation.MyCommand.Path
 
 $Script:WS = @{
   Mode = 'walkthrough'; RawArgs = @($args); ScriptPath = $MyInvocation.MyCommand.Path
-  DryRun = $false; Yes = $false; Deep = $false; Elevate = $false; ElevatedChild = $false; BatchMode = $false
+  DryRun = $false; Yes = $false; Deep = $false; Elevate = $false; ElevatedChild = $false; ElevatedSummaryToken = ''; BatchMode = $false
   Days = $null; TempDays = $null; LargeFileMb = $null; PurgeAll = $false
   DeveloperFlag = $null; ForgetDeveloper = $false; Developer = $null; DeveloperSource = ''
   ScanRoots = @(); ExcludePaths = @(); Excluded = @(); Hiberfil = ''; ResetBase = $false; Permanent = $false
+  BrowserProfileRoots = @(); TempRoots = @(); PersonalRoots = @(); PersonalRootsReport = @()
+  BrowserProfileRootsExplicit = $false; TempRootsExplicit = $false; PersonalRootsExplicit = $false
   OnlyList = ''; Profile = ''; Exclude = ''; ExportFmt = 'both'; ExportId = 'latest'; PruneDays = 90
   LogsDir = ''; ReportsDir = ''; NoReport = $false; CleanupLogs = $false
   JsonMode = $false; Quiet = $false; NoColor = $false; Ascii = $false; Notify = $false
@@ -80,7 +82,10 @@ OPTIONS
       --developer / --not-developer   Override the saved developer answer for this run
       --forget-developer   Ask the developer question again
       --scan-roots "P1;P2"   Project roots for section 17     --exclude-path P   (repeatable, all sections)
+      --browser-profile-roots "P1;P2"   Folders of test/automation browser profiles: section 7 clears their caches
+      --temp-roots "P1;P2"   Scratch folders: section 10 removes each entry nothing wrote for --temp-days, never one in use
       --large-file-mb N    Minimum size for section 19 (default 100)
+      --personal-roots "P1;P2"   Folders section 19 scans besides Downloads for large or old files
       --hiberfil off|reduced|keep   What section 15 does       --reset-base   DISM /ResetBase in 14
       --permanent       Sections 18, 19 and 23 delete instead of using the Recycle Bin
       --select L        Pre-answer the next interactive selection, e.g. --select 1,3-5. Repeatable: the
@@ -161,6 +166,11 @@ function Read-Arguments {
       '--i-understand-deep' { $ws.Deep = $true }
       '--elevate' { $ws.Elevate = $true }
       '--elevated-child' { $ws.ElevatedChild = $true }
+      '--elevated-summary-token' {
+        $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }
+        if ($v -notmatch '^[a-f0-9]{32}$') { throw '--elevated-summary-token needs a 32-character hex token' }
+        $ws.ElevatedSummaryToken = $v
+      }
       { $_ -in '-d', '--days' } { $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }; if ($v -notmatch '^\d+$') { throw "--days needs a whole number, got '$v'" }; $ws.Days = [int]$v }
       '--temp-days' { $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }; if ($v -notmatch '^\d+$') { throw "--temp-days needs a whole number, got '$v'" }; $ws.TempDays = [int]$v }
       '--purge-all' { $ws.PurgeAll = $true }
@@ -169,6 +179,9 @@ function Read-Arguments {
       '--forget-developer' { $ws.ForgetDeveloper = $true }
       '--scan-roots' { $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }; $ws.ScanRoots = @($v -split ';' | ForEach-Object { $_.Trim() } | Where-Object { $_ }) }
       '--exclude-path' { $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }; $ws.ExcludePaths += $v }
+      '--browser-profile-roots' { $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }; $ws.BrowserProfileRoots = @($v -split ';' | ForEach-Object { $_.Trim() } | Where-Object { $_ }); $ws.BrowserProfileRootsExplicit = $true }
+      '--temp-roots' { $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }; $ws.TempRoots = @($v -split ';' | ForEach-Object { $_.Trim() } | Where-Object { $_ }); $ws.TempRootsExplicit = $true }
+      '--personal-roots' { $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }; $ws.PersonalRoots = @($v -split ';' | ForEach-Object { $_.Trim() } | Where-Object { $_ }); $ws.PersonalRootsExplicit = $true }
       '--large-file-mb' { $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }; if ($v -notmatch '^\d+$') { throw "--large-file-mb needs a whole number, got '$v'" }; $ws.LargeFileMb = [int]$v }
       '--hiberfil' { $v = $inline; if ($null -eq $v) { $v = Get-NextArg $argv ([ref]$i) $a }; if ($v -notin 'off', 'reduced', 'keep') { throw "--hiberfil must be off, reduced or keep" }; $ws.Hiberfil = $v }
       '--reset-base' { $ws.ResetBase = $true }
@@ -239,8 +252,13 @@ function Initialize-Settings {
   if ($null -eq $ws.LargeFileMb) { $ws.LargeFileMb = [int]$cfg.largeFileMb }
   if ($ws.ScanRoots.Count -eq 0 -and $cfg.scanRoots) { $ws.ScanRoots = @($cfg.scanRoots) }
   if ($cfg.excludePaths) { $ws.ExcludePaths = @($ws.ExcludePaths) + @($cfg.excludePaths) }
+  if (-not $ws.BrowserProfileRootsExplicit -and $cfg.browserProfileRoots) { $ws.BrowserProfileRoots = @($cfg.browserProfileRoots) }
+  if (-not $ws.TempRootsExplicit -and $cfg.tempRoots) { $ws.TempRoots = @($cfg.tempRoots) }
+  if (-not $ws.PersonalRootsExplicit -and $cfg.personalRoots) { $ws.PersonalRoots = @($cfg.personalRoots) }
   # Must come after the merge above, or every config-file exclusion is silently dropped.
   Initialize-Exclusions
+  # D79: computed after the merge for the same reason - the profile roots may come from the config file.
+  Initialize-ProfileRootExceptions
 }
 
 function Invoke-Main {