copysec 0.9.9__tar.gz

copysec-0.9.9/PKG-INFO

@@ -0,0 +1,157 @@
+Metadata-Version: 2.3
+Name: copysec
+Version: 0.9.9
+Summary: Clipboard guard: only the active application and its process tree can access the clipboard
+Author: Lunixizm0
+Author-email: Lunixizm0 <copysec@lunixizm.website>
+Requires-Dist: pillow>=12.3.0
+Requires-Dist: psutil>=7.2.2
+Requires-Dist: pystray>=0.19.5
+Requires-Python: >=3.14
+Description-Content-Type: text/markdown
+
+# CopySec
+
+Clipboard protection: only the **active (foreground) application** and its **process tree**
+can read the clipboard. Every unauthorized read attempt receives **empty data** and is
+logged as JSONL.
+
+## How it works
+
+Windows does not allow ACLs on the clipboard; instead, CopySec takes ownership of the
+clipboard via *delayed rendering*. Whenever any process calls `GetClipboardData`, the
+system forwards the request to CopySec as a `WM_RENDERFORMAT` message; at that moment
+`GetOpenClipboardWindow()` resolves the requester's PID and a decision is made:
+
+- Allowed: ourselves, the foreground window's process, descendants of the foreground
+  process (child/grandchild), allowlist
+- Denied: no format is rendered, the reader receives `NULL`, and the event is logged
+
+The real content is kept in memory; the clipboard always remains owned by CopySec.
+On exit or pause, the real data is written back to the clipboard.
+
+## Installation and running
+
+```powershell
+uv sync
+uv run copysec            # with tray icon
+uv run copysec --no-tray --verbose   # console mode + live log
+```
+
+To run as administrator, open PowerShell via "Run as administrator" and run the same
+command (not required; all APIs used work with normal privileges).
+
+## Configuration
+
+`%LOCALAPPDATA%\CopySec\config.json` is created on first run:
+
+| Field | Default | Meaning |
+|---|---|---|
+| `allowlist` | `["svchost.exe"]` | Always-allowed exe names (case-insensitive). `svchost.exe` covers the Win+V clipboard history service (cbdhsvc) |
+| `allow_uwp_frame_host` | `false` | Legacy escape hatch: allows every request from `ApplicationFrameHost.exe` itself. Regular UWP paste works out of the box because CopySec resolves the frame-hosted app's real process; enable only if some packaged app still fails |
+| `deny_unknown_requester` | `true` | Deny when it cannot be determined which window opened the clipboard (spyware can pass NULL) |
+| `log_allows` | `false` | Also log allowed accesses |
+
+Logs: `%LOCALAPPDATA%\CopySec\logs\audit-YYYYMMDD.jsonl`. When a file reaches 1 MB
+it is rotated to `audit-YYYYMMDD.1.jsonl`, `.2.jsonl`, and so on for the rest of the day.
+On every startup CopySec also checks the whole logs folder: if it exceeds 10 MB, the
+oldest files are deleted until 5 MB or less remains. A `logs_pruned` record notes how
+many files were removed.
+Note: with `--config <path>` the log directory becomes `<path parent>\logs` instead.
+
+Rearm benchmarking: every `rearmed` record carries `dur_ms` (the re-arm operation
+itself), `avg_ms` (rolling mean over the last 64 re-arms), `samples`, and, when the
+clipboard was busy before the success, `settle_ms` (time from first failed attempt to
+success). Watch them live with `--verbose`.
+
+## Testing
+
+Everything (unit + integration) in one run:
+
+```powershell
+uv run pytest
+```
+
+The two integration tests (`matrix_a`, `matrix_b`) drive the real guard end to end
+through the PowerShell scripts in `scripts\` and need an interactive desktop session;
+each adds roughly 15-20 seconds. Useful selections:
+
+```powershell
+uv run pytest -m "not integration" -q   # unit tests only
+uv run pytest -m integration -q         # matrices only
+powershell -File scripts\matrix_a.ps1   # denied reader to empty data, restore on exit
+powershell -File scripts\matrix_b.ps1   # allowlisted reader to real data
+uv run python scripts\spy_sim.py        # background "spy" simulator (live monitoring)
+```
+
+Notes:
+
+- The matrices take over the clipboard and briefly move window focus; do not run
+  pytest sessions in parallel.
+- Without an interactive desktop (SSH, services) they skip automatically.
+
+Manual scenario:
+
+1. Start CopySec and run spy_sim in the background (it sees empty data).
+2. Write something in Notepad, press Ctrl+A and Ctrl+C, then Ctrl+V in Notepad (works because it is foreground).
+3. spy_sim output must stay empty; `deny` lines accumulate in the audit log.
+4. Tray > Pause: spy_sim now sees the content. Resume closes it again.
+
+## Known limitations
+
+- Between the user copying and CopySec taking ownership there is a millisecond-scale
+  window in which a very fast reader can see the real data once.
+- After an allowed read, the content stays as real clipboard data for a short time;
+  CopySec returns it to delayed mode within ~50 ms (re-arm). Other readers racing
+  during that window can see the data. Allowlisted components that read continuously,
+  such as clipboard history (cbdhsvc), keep triggering this cycle; that is normal.
+- Owner-tied formats (CF_OWNERDISPLAY and CF_DSP*) cannot be carried across ownership
+  changes; they are skipped.
+- Brief exposure window: after an allowed app reads the clipboard, Windows keeps the
+  real data available until CopySec re-arms delayed rendering (normally well under a
+  second, retried aggressively). A process reading inside that window may see the
+  data without being checked.
+- UWP paste works automatically: when the foreground window belongs to
+  `ApplicationFrameHost.exe`, CopySec resolves the hosted app's process through its
+  `CoreWindow` child window and applies the normal rules to it.
+- Rare UIPI quirks are possible with elevated (high IL) readers plus a non-admin guard;
+  if you hit issues, run both at the same integrity level.
+
+## Troubleshooting
+
+- **Pasted content came out empty:** The reading app is not foreground or was denied.
+  Check the `deny` lines printed with `--verbose` (the `rule` field explains why:
+  `no-match`, `unknown-requester`, ...). If needed add the exe name to `allowlist`,
+  or for exotic packaged apps that still fail enable `allow_uwp_frame_host`.
+- **Leave the clipboard cleanly:** Close CopySec with Ctrl+C or tray > Exit (the real
+  data is written back to the clipboard). If you force-kill it from Task Manager the
+  delayed-render data goes away too and the clipboard ends up empty; that is Windows'
+  delayed rendering behavior.
+- **Running elevated (admin PowerShell):** Supported and verified. Windows delivers
+  clipboard render messages across integrity levels, so non-elevated apps still go
+  through the normal decision path; elevation of the guard itself grants nothing to
+  any reader. Verify anytime with `scripts\xil_check.ps1` (spawns a real Medium-IL
+  reader via a scheduled task and checks both the deny and allow paths).
+- **Do not run two copies:** Only one guard can take ownership at a time; the second
+  one waits pointlessly.
+- **`rearm_failed` / `rearmed` pairs in the log:** Normal when an allowlisted
+  background reader (typically the clipboard history service, `cbdhsvc` inside
+  `svchost.exe`) keeps the clipboard open right after reading. CopySec re-arms its
+  delayed rendering as soon as the clipboard frees up (retried every 500 ms);
+  during that gap the real data is briefly readable by anyone (see Known limitations).
+  A `consecutive` count above a few would signal something is holding the clipboard
+  open for a long time.
+
+## Architecture
+
+```
+src/copysec/
+    winapi.py     ctypes Win32 bindings (clipboard, global memory, DIB to HBITMAP)
+    store.py      real content store + adopt/flush/render
+    policy.py     decision engine (foreground, process tree, allowlist)
+    proctree.py   psutil-based PID/exe/ancestor-chain cache
+    guard.py      hidden window, WndProc, message loop
+    audit.py      JSONL audit log + rate limit
+    tray.py       pystray tray icon
+    cli.py        entry point
+```

copysec-0.9.9/README.md

@@ -0,0 +1,145 @@
+# CopySec
+
+Clipboard protection: only the **active (foreground) application** and its **process tree**
+can read the clipboard. Every unauthorized read attempt receives **empty data** and is
+logged as JSONL.
+
+## How it works
+
+Windows does not allow ACLs on the clipboard; instead, CopySec takes ownership of the
+clipboard via *delayed rendering*. Whenever any process calls `GetClipboardData`, the
+system forwards the request to CopySec as a `WM_RENDERFORMAT` message; at that moment
+`GetOpenClipboardWindow()` resolves the requester's PID and a decision is made:
+
+- Allowed: ourselves, the foreground window's process, descendants of the foreground
+  process (child/grandchild), allowlist
+- Denied: no format is rendered, the reader receives `NULL`, and the event is logged
+
+The real content is kept in memory; the clipboard always remains owned by CopySec.
+On exit or pause, the real data is written back to the clipboard.
+
+## Installation and running
+
+```powershell
+uv sync
+uv run copysec            # with tray icon
+uv run copysec --no-tray --verbose   # console mode + live log
+```
+
+To run as administrator, open PowerShell via "Run as administrator" and run the same
+command (not required; all APIs used work with normal privileges).
+
+## Configuration
+
+`%LOCALAPPDATA%\CopySec\config.json` is created on first run:
+
+| Field | Default | Meaning |
+|---|---|---|
+| `allowlist` | `["svchost.exe"]` | Always-allowed exe names (case-insensitive). `svchost.exe` covers the Win+V clipboard history service (cbdhsvc) |
+| `allow_uwp_frame_host` | `false` | Legacy escape hatch: allows every request from `ApplicationFrameHost.exe` itself. Regular UWP paste works out of the box because CopySec resolves the frame-hosted app's real process; enable only if some packaged app still fails |
+| `deny_unknown_requester` | `true` | Deny when it cannot be determined which window opened the clipboard (spyware can pass NULL) |
+| `log_allows` | `false` | Also log allowed accesses |
+
+Logs: `%LOCALAPPDATA%\CopySec\logs\audit-YYYYMMDD.jsonl`. When a file reaches 1 MB
+it is rotated to `audit-YYYYMMDD.1.jsonl`, `.2.jsonl`, and so on for the rest of the day.
+On every startup CopySec also checks the whole logs folder: if it exceeds 10 MB, the
+oldest files are deleted until 5 MB or less remains. A `logs_pruned` record notes how
+many files were removed.
+Note: with `--config <path>` the log directory becomes `<path parent>\logs` instead.
+
+Rearm benchmarking: every `rearmed` record carries `dur_ms` (the re-arm operation
+itself), `avg_ms` (rolling mean over the last 64 re-arms), `samples`, and, when the
+clipboard was busy before the success, `settle_ms` (time from first failed attempt to
+success). Watch them live with `--verbose`.
+
+## Testing
+
+Everything (unit + integration) in one run:
+
+```powershell
+uv run pytest
+```
+
+The two integration tests (`matrix_a`, `matrix_b`) drive the real guard end to end
+through the PowerShell scripts in `scripts\` and need an interactive desktop session;
+each adds roughly 15-20 seconds. Useful selections:
+
+```powershell
+uv run pytest -m "not integration" -q   # unit tests only
+uv run pytest -m integration -q         # matrices only
+powershell -File scripts\matrix_a.ps1   # denied reader to empty data, restore on exit
+powershell -File scripts\matrix_b.ps1   # allowlisted reader to real data
+uv run python scripts\spy_sim.py        # background "spy" simulator (live monitoring)
+```
+
+Notes:
+
+- The matrices take over the clipboard and briefly move window focus; do not run
+  pytest sessions in parallel.
+- Without an interactive desktop (SSH, services) they skip automatically.
+
+Manual scenario:
+
+1. Start CopySec and run spy_sim in the background (it sees empty data).
+2. Write something in Notepad, press Ctrl+A and Ctrl+C, then Ctrl+V in Notepad (works because it is foreground).
+3. spy_sim output must stay empty; `deny` lines accumulate in the audit log.
+4. Tray > Pause: spy_sim now sees the content. Resume closes it again.
+
+## Known limitations
+
+- Between the user copying and CopySec taking ownership there is a millisecond-scale
+  window in which a very fast reader can see the real data once.
+- After an allowed read, the content stays as real clipboard data for a short time;
+  CopySec returns it to delayed mode within ~50 ms (re-arm). Other readers racing
+  during that window can see the data. Allowlisted components that read continuously,
+  such as clipboard history (cbdhsvc), keep triggering this cycle; that is normal.
+- Owner-tied formats (CF_OWNERDISPLAY and CF_DSP*) cannot be carried across ownership
+  changes; they are skipped.
+- Brief exposure window: after an allowed app reads the clipboard, Windows keeps the
+  real data available until CopySec re-arms delayed rendering (normally well under a
+  second, retried aggressively). A process reading inside that window may see the
+  data without being checked.
+- UWP paste works automatically: when the foreground window belongs to
+  `ApplicationFrameHost.exe`, CopySec resolves the hosted app's process through its
+  `CoreWindow` child window and applies the normal rules to it.
+- Rare UIPI quirks are possible with elevated (high IL) readers plus a non-admin guard;
+  if you hit issues, run both at the same integrity level.
+
+## Troubleshooting
+
+- **Pasted content came out empty:** The reading app is not foreground or was denied.
+  Check the `deny` lines printed with `--verbose` (the `rule` field explains why:
+  `no-match`, `unknown-requester`, ...). If needed add the exe name to `allowlist`,
+  or for exotic packaged apps that still fail enable `allow_uwp_frame_host`.
+- **Leave the clipboard cleanly:** Close CopySec with Ctrl+C or tray > Exit (the real
+  data is written back to the clipboard). If you force-kill it from Task Manager the
+  delayed-render data goes away too and the clipboard ends up empty; that is Windows'
+  delayed rendering behavior.
+- **Running elevated (admin PowerShell):** Supported and verified. Windows delivers
+  clipboard render messages across integrity levels, so non-elevated apps still go
+  through the normal decision path; elevation of the guard itself grants nothing to
+  any reader. Verify anytime with `scripts\xil_check.ps1` (spawns a real Medium-IL
+  reader via a scheduled task and checks both the deny and allow paths).
+- **Do not run two copies:** Only one guard can take ownership at a time; the second
+  one waits pointlessly.
+- **`rearm_failed` / `rearmed` pairs in the log:** Normal when an allowlisted
+  background reader (typically the clipboard history service, `cbdhsvc` inside
+  `svchost.exe`) keeps the clipboard open right after reading. CopySec re-arms its
+  delayed rendering as soon as the clipboard frees up (retried every 500 ms);
+  during that gap the real data is briefly readable by anyone (see Known limitations).
+  A `consecutive` count above a few would signal something is holding the clipboard
+  open for a long time.
+
+## Architecture
+
+```
+src/copysec/
+    winapi.py     ctypes Win32 bindings (clipboard, global memory, DIB to HBITMAP)
+    store.py      real content store + adopt/flush/render
+    policy.py     decision engine (foreground, process tree, allowlist)
+    proctree.py   psutil-based PID/exe/ancestor-chain cache
+    guard.py      hidden window, WndProc, message loop
+    audit.py      JSONL audit log + rate limit
+    tray.py       pystray tray icon
+    cli.py        entry point
+```

copysec-0.9.9/pyproject.toml

@@ -0,0 +1,31 @@
+[project]
+name = "copysec"
+version = "0.9.9"
+description = "Clipboard guard: only the active application and its process tree can access the clipboard"
+readme = "README.md"
+requires-python = ">=3.14"
+dependencies = [
+    "pillow>=12.3.0",
+    "psutil>=7.2.2",
+    "pystray>=0.19.5",
+]
+
+[[project.authors]]
+name = "Lunixizm0"
+email = "copysec@lunixizm.website"
+
+[project.scripts]
+copysec = "copysec.cli:main"
+
+[build-system]
+requires = ["uv_build>=0.12.5,<0.13.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.1.1",
+    "ruff>=0.16.4",
+]
+
+[tool.pytest.ini_options]
+markers = ["integration: real desktop end-to-end tests via PowerShell matrices (slow)"]

copysec-0.9.9/pyproject.toml.orig

@@ -0,0 +1,32 @@
+[project]
+name = "copysec"
+version = "0.9.9"
+description = "Clipboard guard: only the active application and its process tree can access the clipboard"
+readme = "README.md"
+authors = [
+    { name = "Lunixizm0", email = "copysec@lunixizm.website" }
+]
+requires-python = ">=3.14"
+dependencies = [
+    "pillow>=12.3.0",
+    "psutil>=7.2.2",
+    "pystray>=0.19.5",
+]
+
+[project.scripts]
+copysec = "copysec.cli:main"
+
+[build-system]
+requires = ["uv_build>=0.12.5,<0.13.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.1.1",
+    "ruff>=0.16.4",
+]
+
+[tool.pytest.ini_options]
+markers = [
+    "integration: real desktop end-to-end tests via PowerShell matrices (slow)",
+]

copysec-0.9.9/src/copysec/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

copysec-0.9.9/src/copysec/__main__.py

@@ -0,0 +1,6 @@
+from copysec.cli import main
+
+__all__ = ["main"]
+
+if __name__ == "__main__":
+    raise SystemExit(main())

copysec-0.9.9/src/copysec/audit.py

@@ -0,0 +1,151 @@
+from __future__ import annotations
+
+import datetime as _dt
+import json
+import time
+from pathlib import Path
+
+
+class Audit:
+    MIN_INTERVAL = 1.0
+    MAX_FILE_BYTES = 1_000_000
+    MAX_DIR_BYTES = 10_000_000
+    TARGET_DIR_BYTES = 5_000_000
+
+    def __init__(self, log_dir: Path, log_allows: bool = False, verbose: bool = False):
+        import os
+
+        self.log_allows = log_allows
+        self.verbose = verbose
+        self.debug = os.environ.get("COPYSEC_DEBUG") == "1"
+        if self.debug:
+            self.log_allows = True
+        self._log_dir = Path(log_dir)
+        try:
+            self._log_dir.mkdir(parents=True, exist_ok=True)
+        except OSError:
+            self._log_dir = None
+        self._last: dict[tuple, float] = {}
+        self._dropped: dict[tuple, int] = {}
+        self._prune()
+
+    def _prune(self) -> None:
+        if self._log_dir is None:
+            return
+        try:
+            sized = []
+            total = 0
+            for path in sorted(self._log_dir.glob("audit-*.jsonl")):
+                try:
+                    st = path.stat()
+                except OSError:
+                    continue
+                sized.append((st.st_mtime, path.name, st.st_size, path))
+                total += st.st_size
+            if total <= self.MAX_DIR_BYTES:
+                return
+            freed = 0
+            removed = 0
+            for _, _, size, path in sorted(sized):
+                if total - freed <= self.TARGET_DIR_BYTES:
+                    break
+                try:
+                    path.unlink()
+                except OSError:
+                    continue
+                freed += size
+                removed += 1
+            if removed:
+                self.event("logs_pruned", removed=removed, freed_bytes=freed)
+        except OSError:
+            pass
+
+    def _path(self) -> Path | None:
+        if self._log_dir is None:
+            return None
+        day = _dt.datetime.now().astimezone().date().strftime("%Y%m%d")
+        base = f"audit-{day}"
+        path = self._log_dir / f"{base}.jsonl"
+        seq = 0
+        try:
+            while path.exists() and path.stat().st_size >= self.MAX_FILE_BYTES:
+                seq += 1
+                path = self._log_dir / f"{base}.{seq}.jsonl"
+        except OSError:
+            return None
+        return path
+
+    def _write(self, record: dict) -> None:
+        record.setdefault("ts", _dt.datetime.now().astimezone().isoformat(timespec="milliseconds"))
+        line = json.dumps(record, ensure_ascii=False)
+        path = self._path()
+        if path is not None:
+            try:
+                with open(path, "a", encoding="utf-8") as fh:
+                    fh.write(line + "\n")
+            except OSError:
+                pass
+        if self.verbose:
+            try:
+                print(line, flush=True)
+            except (OSError, UnicodeEncodeError):
+                pass
+
+    def _rate_ok(self, key: tuple) -> bool:
+        now = time.monotonic()
+        last = self._last.get(key)
+        if last is not None and now - last < self.MIN_INTERVAL:
+            self._dropped[key] = self._dropped.get(key, 0) + 1
+            return False
+        self._last[key] = now
+        return True
+
+    @staticmethod
+    def _proc_dict(info) -> dict | None:
+        if info is None:
+            return None
+        record = {"pid": info.pid, "exe": info.exe}
+        if getattr(info, "host_pid", None):
+            record["host_pid"] = info.host_pid
+        return record
+
+    def access(
+        self,
+        allowed: bool,
+        rule: str,
+        fmt: int,
+        fmt_name: str,
+        requester=None,
+        foreground=None,
+    ) -> None:
+        if allowed and not self.log_allows:
+            return
+        key = ("access", allowed, getattr(requester, "pid", None), fmt)
+        if not self._rate_ok(key):
+            return
+        record = {
+            "event": "allow" if allowed else "deny",
+            "rule": rule,
+            "fmt": fmt,
+            "fmt_name": fmt_name,
+            "requester": self._proc_dict(requester),
+            "foreground": self._proc_dict(foreground),
+        }
+        dropped = self._dropped.pop(key, None)
+        if dropped:
+            record["suppressed_repeats"] = dropped
+        self._write(record)
+
+    def event(self, name: str, rate_key: str | None = None, **fields) -> None:
+        if rate_key is not None:
+            key = ("event", rate_key)
+            if not self._rate_ok(key):
+                return
+            dropped = self._dropped.pop(key, None)
+            if dropped:
+                fields["suppressed_repeats"] = dropped
+        self._write({"event": name, **fields})
+
+    def probe(self, **fields) -> None:
+        if self.debug:
+            self._write({"event": "probe", **fields})

copysec-0.9.9/src/copysec/cli.py

@@ -0,0 +1,106 @@
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+import time
+from pathlib import Path
+
+from .audit import Audit
+from .config import default_config_path, load_or_create
+from .guard import ClipboardGuard
+from .policy import Policy
+from .proctree import PsutilProcTree
+from .store import ContentStore
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="copysec",
+        description="Clipboard guard: only the active application and its process tree can access the clipboard.",
+    )
+    parser.add_argument("--no-tray", action="store_true", help="Run without the tray icon")
+    parser.add_argument("--verbose", action="store_true", help="Also echo log records to the console")
+    parser.add_argument(
+        "--config",
+        type=Path,
+        default=None,
+        help="Path to config.json (default: %%LOCALAPPDATA%%\\CopySec\\config.json)",
+    )
+    parser.add_argument(
+        "--smoke-seconds",
+        type=float,
+        default=None,
+        help=argparse.SUPPRESS,
+    )
+    return parser
+
+
+def main(argv=None) -> int:
+    try:
+        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    except (AttributeError, OSError):
+        pass
+
+    args = _build_parser().parse_args(argv)
+    config_path = args.config or default_config_path()
+    cfg = load_or_create(config_path)
+    log_dir = config_path.parent / "logs"
+
+    audit = Audit(log_dir, log_allows=cfg.log_allows, verbose=args.verbose)
+    tree = PsutilProcTree()
+
+    def resolve_name(pid):
+        info = tree.resolve(pid)
+        return info.exe if info else None
+
+    policy = Policy(
+        tree,
+        allowlist=set(cfg.allowlist),
+        allow_uwp_frame_host=cfg.allow_uwp_frame_host,
+        deny_unknown_requester=cfg.deny_unknown_requester,
+    )
+    store = ContentStore(audit, resolve_name)
+    guard = ClipboardGuard(policy, store, audit)
+
+    audit.event(
+        "started",
+        pid=os.getpid(),
+        python=sys.version.split()[0],
+        config=str(config_path),
+    )
+    guard.start()
+    if not guard.hwnd:
+        print("[copysec] Failed to create guard window. See logs for details.", file=sys.stderr)
+        return 1
+    guard.request_adopt()
+
+    print(f"[copysec] protection active | pid={os.getpid()}", flush=True)
+    print(f"[copysec] config : {config_path}", flush=True)
+    print(f"[copysec] logs   : {log_dir}", flush=True)
+    print("[copysec] to stop: Ctrl+C (console) or tray > Exit", flush=True)
+
+    exit_code = 0
+    try:
+        if args.no_tray or args.smoke_seconds is not None:
+            deadline = (
+                time.monotonic() + args.smoke_seconds
+                if args.smoke_seconds is not None
+                else None
+            )
+            while guard.is_alive:
+                if deadline is not None and time.monotonic() >= deadline:
+                    break
+                time.sleep(0.2)
+        else:
+            from .tray import TrayApp
+
+            TrayApp(guard, log_dir).run()
+    except KeyboardInterrupt:
+        print("\n[copysec] shutting down...", flush=True)
+    finally:
+        guard.stop()
+        if guard.thread:
+            guard.thread.join(timeout=5)
+        audit.event("stopped")
+    return exit_code

copysec-0.9.9/src/copysec/config.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+import json
+import os
+from dataclasses import asdict, dataclass, field
+from pathlib import Path
+
+
+@dataclass
+class Config:
+    allowlist: list[str] = field(default_factory=lambda: ["svchost.exe"])
+    allow_uwp_frame_host: bool = False
+    deny_unknown_requester: bool = True
+    log_allows: bool = False
+
+    def apply_dict(self, data: dict) -> None:
+        if not isinstance(data, dict):
+            return
+        if isinstance(data.get("allowlist"), list):
+            self.allowlist = [str(x) for x in data["allowlist"]]
+        for key in ("allow_uwp_frame_host", "deny_unknown_requester", "log_allows"):
+            if key in data and isinstance(data[key], bool):
+                setattr(self, key, data[key])
+
+
+def default_config_path() -> Path:
+    local = os.environ.get("LOCALAPPDATA")
+    base = Path(local) if local else Path.home() / "AppData" / "Local"
+    return base / "CopySec" / "config.json"
+
+
+def load_or_create(path: Path) -> Config:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    cfg = Config()
+    if path.exists():
+        try:
+            cfg.apply_dict(json.loads(path.read_text(encoding="utf-8-sig")))
+        except (OSError, json.JSONDecodeError):
+            pass
+    else:
+        try:
+            path.write_text(
+                json.dumps(asdict(cfg), indent=2) + "\n", encoding="utf-8"
+            )
+        except OSError:
+            pass
+    return cfg