z-clean 0.3.1 → 0.3.3

package/src/scanner.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { ProcessTree } = require('./process-tree');
-const { matchPattern, AI_DIR_REGEX, buildAiDirRegex } = require('./detector/patterns');
+const { createPatternMatcher, AI_DIR_REGEX, buildAiDirRegex } = require('./detector/patterns');
 const { isWhitelisted } = require('./detector/whitelist');
 const { parseDuration, parseMemory } = require('./config');
 
@@ -18,6 +18,7 @@ const { parseDuration, parseMemory } = require('./config');
 function scan(config, opts = {}) {
   const tree = ProcessTree.build();
   const aiDirRegex = buildAiDirRegex(config.customAiDirs);
+  const matchConfiguredPattern = createPatternMatcher(config);
   const zombies = [];
   const warnings = Array.isArray(tree.warnings) ? [...tree.warnings] : [];
   const errors = Array.isArray(tree.errors) ? [...tree.errors] : [];
@@ -35,7 +36,7 @@ function scan(config, opts = {}) {
   // Iterate all processes in the tree
   for (const [, proc] of tree.byPid) {
     // Match against known AI tool patterns
-    const pattern = matchPattern(proc.cmd, config);
+    const pattern = matchConfiguredPattern(proc.cmd);
     if (!pattern) continue;
 
     // AI path filter: skip generic patterns if command isn't in an AI tool directory
@@ -47,6 +48,8 @@ function scan(config, opts = {}) {
       ? tree.hasAncestorMatching(proc.pid, (p) => p.pid === sessionPid)
       : false;
 
+    if (pattern.strictOrphan && !orphanResult.isOrphan) continue;
+
     // If pattern requires orphan status and process isn't orphaned, skip
     if (pattern.orphanOnly && !orphanResult.isOrphan && !sessionRelated) continue;
 
@@ -90,6 +93,7 @@ function scan(config, opts = {}) {
       startTime: proc.startTime,
       reason: reasons.join(', '),
       pattern: pattern.name,
+      matchLiteral: pattern.literal || null,
     });
   }
 

package/src/storage-security.js

@@ -0,0 +1,65 @@
+'use strict';
+
+const fs = require('fs');
+
+const SENSITIVE_HISTORY_FIELDS = ['args', 'argv', 'cmd', 'command', 'commandLine'];
+
+function secureDirectory(directory) {
+  if (!fs.existsSync(directory)) {
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  }
+  if (process.platform !== 'win32') fs.chmodSync(directory, 0o700);
+}
+
+function writePrivateFile(file, content) {
+  fs.writeFileSync(file, content, { encoding: 'utf-8', mode: 0o600 });
+  secureFile(file);
+}
+
+function appendPrivateFile(file, content) {
+  fs.appendFileSync(file, content, { encoding: 'utf-8', mode: 0o600 });
+  secureFile(file);
+}
+
+function secureFile(file) {
+  if (process.platform !== 'win32') fs.chmodSync(file, 0o600);
+}
+
+function sanitizeHistoryEntry(entry) {
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return entry;
+  const sanitized = { ...entry };
+  for (const field of SENSITIVE_HISTORY_FIELDS) delete sanitized[field];
+  return sanitized;
+}
+
+function sanitizeHistoryFile(file) {
+  if (!fs.existsSync(file)) return;
+
+  const raw = fs.readFileSync(file, 'utf-8');
+  const lines = raw.split(/\r?\n/).filter(Boolean);
+  let changed = false;
+  const sanitized = lines.map((line) => {
+    try {
+      const next = JSON.stringify(sanitizeHistoryEntry(JSON.parse(line)));
+      if (next !== line) changed = true;
+      return next;
+    } catch {
+      return line;
+    }
+  });
+
+  if (changed) {
+    writePrivateFile(file, sanitized.join('\n') + (sanitized.length ? '\n' : ''));
+  } else {
+    secureFile(file);
+  }
+}
+
+module.exports = {
+  appendPrivateFile,
+  sanitizeHistoryEntry,
+  sanitizeHistoryFile,
+  secureDirectory,
+  secureFile,
+  writePrivateFile,
+};

package/src/terminal-text.js

@@ -0,0 +1,11 @@
+'use strict';
+
+function sanitizeTerminalText(value) {
+  return String(value ?? '')
+    .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, '')
+    .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '')
+    .replace(/[\r\n]+/g, ' ')
+    .replace(/[\p{Cc}\p{Cf}]/gu, '');
+}
+
+module.exports = { sanitizeTerminalText };

package/src/windows-processes.js

@@ -1,16 +1,34 @@
 'use strict';
 
+const { providerDiagnostic } = require('./process-diagnostic');
+
 function normalizePid(pid) {
   const parsed = Number(pid);
   return Number.isInteger(parsed) && parsed > 0 ? parsed : null;
 }
 
 function readWMICProcesses(runtime) {
+  try {
+    runtime.execSync('where wmic', {
+      encoding: 'utf-8',
+      timeout: 5000,
+      maxBuffer: 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+  } catch {
+    return { processes: [], warnings: [] };
+  }
+
   let output;
   try {
     output = runtime.execSync(
       'wmic process get ProcessId,ParentProcessId,CommandLine,WorkingSetSize,CreationDate /format:csv',
-      { encoding: 'utf-8', timeout: 15000, maxBuffer: 10 * 1024 * 1024 }
+      {
+        encoding: 'utf-8',
+        timeout: 15000,
+        maxBuffer: 10 * 1024 * 1024,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      }
     );
   } catch (err) {
     return {
@@ -35,7 +53,12 @@ function readCIMProcesses(runtime) {
   try {
     output = runtime.execSync(
       'powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,CommandLine,WorkingSetSize,CreationDate | ConvertTo-Json -Compress"',
-      { encoding: 'utf-8', timeout: 15000, maxBuffer: 10 * 1024 * 1024 }
+      {
+        encoding: 'utf-8',
+        timeout: 15000,
+        maxBuffer: 10 * 1024 * 1024,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      }
     );
   } catch (err) {
     return {
@@ -63,7 +86,12 @@ function readWindowsProcess(pid, runtime) {
   try {
     output = runtime.execSync(
       `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter 'ProcessId = ${safePid}' | Select-Object ProcessId,CommandLine,CreationDate | ConvertTo-Json -Compress"`,
-      { encoding: 'utf-8', timeout: 5000, maxBuffer: 1024 * 1024 }
+      {
+        encoding: 'utf-8',
+        timeout: 5000,
+        maxBuffer: 1024 * 1024,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      }
     );
   } catch {
     return null;
@@ -87,7 +115,12 @@ function windowsProcessExists(pid, runtime) {
   try {
     const output = runtime.execSync(
       `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter 'ProcessId = ${safePid}' | Select-Object ProcessId | ConvertTo-Json -Compress"`,
-      { encoding: 'utf-8', timeout: 3000, maxBuffer: 1024 * 1024 }
+      {
+        encoding: 'utf-8',
+        timeout: 3000,
+        maxBuffer: 1024 * 1024,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      }
     );
     return parseJsonRows(String(output || '')).some((row) => Number(readField(row, 'ProcessId')) === safePid);
   } catch {
@@ -238,14 +271,6 @@ function parseCsvLine(line) {
   return parts;
 }
 
-function providerDiagnostic(provider, code, err) {
-  return {
-    code,
-    provider,
-    message: err instanceof Error ? err.message : String(err || ''),
-  };
-}
-
 module.exports = {
   normalizePid,
   readCIMProcesses,