gotchu 0.1.0__tar.gz

gotchu-0.1.0/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

gotchu-0.1.0/PKG-INFO

@@ -0,0 +1,99 @@
+Metadata-Version: 2.4
+Name: gotchu
+Version: 0.1.0
+Summary: Free, local protection for Windows against password-stealing malware: it guards the safe, not just the door.
+License-Expression: Apache-2.0
+Project-URL: Repository, https://github.com/AnshMittal08/GotchU
+Project-URL: Roadmap, https://github.com/AnshMittal08/GotchU/blob/main/ROADMAP.md
+Keywords: security,windows,infostealer,malware,hardening
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# GotchU
+
+[![CI](https://github.com/AnshMittal08/GotchU/actions/workflows/ci.yml/badge.svg)](https://github.com/AnshMittal08/GotchU/actions/workflows/ci.yml)
+
+Antivirus guards the door. GotchU guards the safe.
+
+Password-stealing malware does not need to break Windows. It runs once, copies your saved passwords,
+signed-in sessions, chat logins, keys and wallets, and leaves. Antivirus often misses it, and removing
+it afterwards does not un-steal anything.
+
+GotchU is a free, local tool for Windows that works on that problem from both sides: it has your back,
+and it catches the thief.
+
+Status: early. It works on the author's Windows 11 Home PC; it has not been tested widely.
+
+## What it does today
+
+| Command | Question it answers |
+|---|---|
+| `gotchu check <file>` | Is this download safe to open? Reads it without running it and looks for the packaging tricks malware uses, including password-protected archives and disk images. It opens zip files and folders; a 7z, RAR or other archive is reported as not looked inside, never as clean. |
+| `gotchu scan` | Am I infected right now? Looks at running programs and what starts with Windows (tasks, services, the Start-up folder), the hosts file, and browser extensions loaded from a folder instead of the store. |
+| `gotchu exposure` | What could a thief take from this PC today? Counts saved passwords, sessions, keys and wallets. Never shows or copies one. |
+| `gotchu harden` | Which Windows protections are off? Turns four of them on, saving the old setting so `--undo` is exact. |
+| `gotchu respond` | I ran something bad. What do I do? A checklist built from what is on this PC, in the order to do it. `--sites` adds the websites that have a password saved here (names only). |
+| `gotchu tripwire` | Plants decoy files (fake wallets and fake browser logins) no honest program opens. When one is read you get an alarm, and with `--cut` that program loses its internet. It also lists any program, other than the owner, that reads your browser, Telegram or Discord logins. Signed programs installed in Program Files, such as antivirus and backup tools, are listed rather than alarmed; an unsigned program reading your logins is put at the top of the report. It also tells you if its watcher has stopped. |
+| `gotchu vault` | Keeps key files encrypted with a passphrase, so a stolen copy is useless. `vault use` hands a key to one command and removes it afterwards. `vault passphrase` and `vault recovery` replace a forgotten passphrase or a lost recovery key. `vault backup` copies the vault, still encrypted, to another drive; `vault restore` brings it back. |
+| `gotchu setup` | Installs or updates the small scripts that run with administrator rights, in `C:\Program Files\gotchu`. Done for you the first time harden or the tripwire needs them; run it yourself after updating GotchU. `--remove` takes them away again. |
+| `gotchu ui` | A local window for check, scan, exposure and harden, and the tripwire's alarms and programs to review. |
+
+## Run it
+
+Needs Windows 10 or 11 and Python 3.10 or newer. No other packages.
+
+    python -m gotchu ui
+    python -m gotchu exposure
+    python -m gotchu tripwire --on
+    python -m gotchu vault create
+    python -m gotchu vault add --move my-server-key.pem
+    python -m gotchu vault use my-server-key.pem -- ssh -i {} user@host
+
+Or install it and use the short command:
+
+    python -m pip install .
+    gotchu ui
+
+With Smart App Control on (the first lock `gotchu harden` suggests), Windows may block the `gotchu` command
+that pip makes, saying "An Application Control policy has blocked this file": it is an unsigned program.
+`python -m gotchu` keeps working, because it runs through Python itself, which is signed. The planned
+signed installer removes the difference.
+
+Tests: `python -m unittest`. Every push is also linted and tested on Python 3.10 to 3.13 by GitHub Actions.
+
+To help, see [CONTRIBUTING.md](CONTRIBUTING.md). To report a weakness, see [SECURITY.md](SECURITY.md).
+
+## Promises
+
+- **Local.** Nothing leaves your PC. No account.
+- **Read-only unless you say so.** A change needs your yes and a Windows permission prompt, and can be undone.
+- **Plain language.** Every finding says what was seen, why it matters and what to do.
+- **Honest limits.** No tool stops every attack. The tripwire raises its alarm for decoys only; reads of real
+  login stores are listed for review, not yet alarmed; a patient attacker with administrator rights can switch any tool off. The vault protects
+  files at rest: a file you have taken out is an ordinary file again, and if you lose both the passphrase
+  and the recovery key, the files are gone. If GotchU itself sits in a folder your account can change (a
+  cloned copy, or Python installed just for you), a program running as you could change GotchU too;
+  `gotchu setup` tells you when that is the case.
+
+## How it works
+
+- [site/index.html](site/index.html): the landing page. One file; open it in a browser. Scrolling plays a
+  theft twice in 3D, once unguarded and once with GotchU.
+- [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md): the parts, what runs with which rights, and how the tripwire,
+  locks and vault work, as diagrams.
+- [docs/USER_FLOWS.md](docs/USER_FLOWS.md): who it is for and the journeys it is designed around.
+
+## Where it is going
+
+See [ROADMAP.md](ROADMAP.md) and [docs/PRODUCT_PLAN.md](docs/PRODUCT_PLAN.md): unlocking the vault with Windows Hello, an alarm for reads of real browser and chat stores, and an installer.
+
+## Licence
+
+Apache-2.0. See [LICENSE](LICENSE).

gotchu-0.1.0/README.md

@@ -0,0 +1,81 @@
+# GotchU
+
+[![CI](https://github.com/AnshMittal08/GotchU/actions/workflows/ci.yml/badge.svg)](https://github.com/AnshMittal08/GotchU/actions/workflows/ci.yml)
+
+Antivirus guards the door. GotchU guards the safe.
+
+Password-stealing malware does not need to break Windows. It runs once, copies your saved passwords,
+signed-in sessions, chat logins, keys and wallets, and leaves. Antivirus often misses it, and removing
+it afterwards does not un-steal anything.
+
+GotchU is a free, local tool for Windows that works on that problem from both sides: it has your back,
+and it catches the thief.
+
+Status: early. It works on the author's Windows 11 Home PC; it has not been tested widely.
+
+## What it does today
+
+| Command | Question it answers |
+|---|---|
+| `gotchu check <file>` | Is this download safe to open? Reads it without running it and looks for the packaging tricks malware uses, including password-protected archives and disk images. It opens zip files and folders; a 7z, RAR or other archive is reported as not looked inside, never as clean. |
+| `gotchu scan` | Am I infected right now? Looks at running programs and what starts with Windows (tasks, services, the Start-up folder), the hosts file, and browser extensions loaded from a folder instead of the store. |
+| `gotchu exposure` | What could a thief take from this PC today? Counts saved passwords, sessions, keys and wallets. Never shows or copies one. |
+| `gotchu harden` | Which Windows protections are off? Turns four of them on, saving the old setting so `--undo` is exact. |
+| `gotchu respond` | I ran something bad. What do I do? A checklist built from what is on this PC, in the order to do it. `--sites` adds the websites that have a password saved here (names only). |
+| `gotchu tripwire` | Plants decoy files (fake wallets and fake browser logins) no honest program opens. When one is read you get an alarm, and with `--cut` that program loses its internet. It also lists any program, other than the owner, that reads your browser, Telegram or Discord logins. Signed programs installed in Program Files, such as antivirus and backup tools, are listed rather than alarmed; an unsigned program reading your logins is put at the top of the report. It also tells you if its watcher has stopped. |
+| `gotchu vault` | Keeps key files encrypted with a passphrase, so a stolen copy is useless. `vault use` hands a key to one command and removes it afterwards. `vault passphrase` and `vault recovery` replace a forgotten passphrase or a lost recovery key. `vault backup` copies the vault, still encrypted, to another drive; `vault restore` brings it back. |
+| `gotchu setup` | Installs or updates the small scripts that run with administrator rights, in `C:\Program Files\gotchu`. Done for you the first time harden or the tripwire needs them; run it yourself after updating GotchU. `--remove` takes them away again. |
+| `gotchu ui` | A local window for check, scan, exposure and harden, and the tripwire's alarms and programs to review. |
+
+## Run it
+
+Needs Windows 10 or 11 and Python 3.10 or newer. No other packages.
+
+    python -m gotchu ui
+    python -m gotchu exposure
+    python -m gotchu tripwire --on
+    python -m gotchu vault create
+    python -m gotchu vault add --move my-server-key.pem
+    python -m gotchu vault use my-server-key.pem -- ssh -i {} user@host
+
+Or install it and use the short command:
+
+    python -m pip install .
+    gotchu ui
+
+With Smart App Control on (the first lock `gotchu harden` suggests), Windows may block the `gotchu` command
+that pip makes, saying "An Application Control policy has blocked this file": it is an unsigned program.
+`python -m gotchu` keeps working, because it runs through Python itself, which is signed. The planned
+signed installer removes the difference.
+
+Tests: `python -m unittest`. Every push is also linted and tested on Python 3.10 to 3.13 by GitHub Actions.
+
+To help, see [CONTRIBUTING.md](CONTRIBUTING.md). To report a weakness, see [SECURITY.md](SECURITY.md).
+
+## Promises
+
+- **Local.** Nothing leaves your PC. No account.
+- **Read-only unless you say so.** A change needs your yes and a Windows permission prompt, and can be undone.
+- **Plain language.** Every finding says what was seen, why it matters and what to do.
+- **Honest limits.** No tool stops every attack. The tripwire raises its alarm for decoys only; reads of real
+  login stores are listed for review, not yet alarmed; a patient attacker with administrator rights can switch any tool off. The vault protects
+  files at rest: a file you have taken out is an ordinary file again, and if you lose both the passphrase
+  and the recovery key, the files are gone. If GotchU itself sits in a folder your account can change (a
+  cloned copy, or Python installed just for you), a program running as you could change GotchU too;
+  `gotchu setup` tells you when that is the case.
+
+## How it works
+
+- [site/index.html](site/index.html): the landing page. One file; open it in a browser. Scrolling plays a
+  theft twice in 3D, once unguarded and once with GotchU.
+- [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md): the parts, what runs with which rights, and how the tripwire,
+  locks and vault work, as diagrams.
+- [docs/USER_FLOWS.md](docs/USER_FLOWS.md): who it is for and the journeys it is designed around.
+
+## Where it is going
+
+See [ROADMAP.md](ROADMAP.md) and [docs/PRODUCT_PLAN.md](docs/PRODUCT_PLAN.md): unlocking the vault with Windows Hello, an alarm for reads of real browser and chat stores, and an installer.
+
+## Licence
+
+Apache-2.0. See [LICENSE](LICENSE).

gotchu-0.1.0/gotchu/__init__.py

@@ -0,0 +1,3 @@
+"""gotchu - free, local, read-only checks for downloads and infections."""
+
+__version__ = "0.1.0"

gotchu-0.1.0/gotchu/__main__.py

@@ -0,0 +1,219 @@
+import argparse
+import json
+import os
+import sys
+
+from . import __version__, check, exposure, harden, report, respond, scan, tripwire
+
+
+def _choose_passphrase(getpass, prompt, nothing):
+    """Ask for a new passphrase twice. None (after saying why) if it is too short or the two differ."""
+    passphrase = getpass.getpass(f"{prompt} (at least 10 characters; a few random words work well): ")
+    if len(passphrase) < 10:
+        print(f"Too short. {nothing}")
+        return None
+    if passphrase != getpass.getpass("Type it again: "):
+        print(f"The two did not match. {nothing}")
+        return None
+    return passphrase
+
+
+RECOVERY_NOTE = ("Write this on paper now and keep it away from this PC. It is shown only once.\n"
+                 "If you forget the passphrase, this key is the only other way in. Lose both and the\n"
+                 "files in the vault are gone for good.")
+
+
+def _vault(args):
+    import getpass
+    import os
+
+    from . import vault
+    try:
+        if args.action == "create":
+            if vault.exists():
+                print("There is already a vault on this PC.")
+                return 1
+            passphrase = _choose_passphrase(getpass, "Choose a passphrase", "Nothing was created.")
+            if passphrase is None:
+                return 1
+            recovery = vault.create(passphrase)
+            print(f"\nVault created in {vault.FOLDER}\n\nRECOVERY KEY:  {recovery}\n\n{RECOVERY_NOTE}")
+            return 0
+        if args.action == "restore":
+            vault.restore(args.folder)
+            print(f"Vault restored from {args.folder}. It opens with the passphrase or recovery key it had when it was backed up.")
+            return 0
+        if not vault.exists():
+            print("There is no vault yet. Make one with: gotchu vault create")
+            return 1
+        if args.action == "backup":
+            count = vault.backup(args.folder)
+            print(f"Copied the vault ({count} files, still encrypted) to {args.folder}.\n"
+                  "The copy is useless without your passphrase or recovery key, so it is safe on a USB stick or in cloud storage.")
+            return 0
+        key = vault.unlock(getpass.getpass("Vault passphrase (or recovery key): "))
+        if args.action == "list":
+            print("\n".join(sorted(vault.names(key))) or "The vault is empty.")
+        elif args.action == "add":
+            for path in args.paths:
+                name = vault.add(key, path, name=args.name if len(args.paths) == 1 else None, move=args.move)
+                print(f"{name}: in the vault" + (", original deleted." if args.move else
+                      f". The original is still at {path} - delete it, or add with --move."))
+            if args.move:
+                print("A deleted file can sometimes be recovered from the disk. If a key was ever exposed, replace it.")
+        elif args.action == "get":
+            target = args.to or args.name
+            if os.path.exists(target):
+                print(f"{target} already exists. Nothing was written.")
+                return 1
+            with open(target, "wb") as f:
+                f.write(vault.get(key, args.name))
+            print(f"Written to {target}. It is an ordinary file again - delete it when you are done.")
+        elif args.action == "use":
+            command = [part for part in args.run if part != "--"]
+            if not command:
+                print("Give the command to run, for example: gotchu vault use server.pem -- ssh -i {} user@host")
+                return 1
+            return vault.use(key, args.name, command)
+        elif args.action == "passphrase":
+            passphrase = _choose_passphrase(getpass, "Choose a new passphrase", "Nothing was changed.")
+            if passphrase is None:
+                return 1
+            vault.change_passphrase(key, passphrase)
+            print("Passphrase changed. The old one no longer opens the vault; your recovery key still does.")
+        elif args.action == "recovery":
+            recovery = vault.replace_recovery(key)
+            print(f"\nNEW RECOVERY KEY:  {recovery}\n\nThe old recovery key no longer opens the vault.\n{RECOVERY_NOTE}")
+        else:
+            vault.remove(key, args.name)
+            print(f"{args.name} removed from the vault.")
+        return 0
+    except vault.WrongSecret:
+        print("That did not open the vault. Nothing was changed.")
+    except KeyError as e:
+        print(e.args[0])
+    except (OSError, ValueError) as e:
+        print(e)
+    return 1
+
+
+def _setup(args):
+    from . import admin
+    ok, message = admin.remove() if args.remove else admin.install()
+    print(message)
+    if ok and not args.remove:
+        if admin.own_folder_writable():
+            print(f"\nNote: gotchu itself is in a folder your account can change ({admin.HERE}). A program running as\n"
+                  "you could change it, including what it asks Windows to run as administrator. For the strongest\n"
+                  "setup, install gotchu with a Python that is installed for all users, in Program Files.")
+        if tripwire.status()["on"]:
+            print("\nThe tripwire is on: run gotchu tripwire --on once more so its watcher uses the new version.")
+    return 0 if ok else 1
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(prog="gotchu", description="Free, local, read-only PC safety checks.")
+    parser.add_argument("--version", action="version", version=__version__)
+    sub = parser.add_subparsers(dest="command", required=True)
+    p = sub.add_parser("check", help="inspect a download (zip, folder or file) without running it")
+    p.add_argument("path")
+    p.add_argument("--json", action="store_true", help="print the result as JSON")
+    p = sub.add_parser("scan", help="look for signs that this PC is infected right now")
+    p.add_argument("--json", action="store_true", help="print the result as JSON")
+    p = sub.add_parser("exposure", help="show what a thief could take from this PC right now (counts only)")
+    p.add_argument("--json", action="store_true", help="print the result as JSON")
+    p = sub.add_parser("harden", help="show which Windows protections are on; turn one on or put it back")
+    p.add_argument("--json", action="store_true", help="print the result as JSON")
+    changeable = [k["key"] for k in harden.LOCKS if k["can_apply"]]
+    p.add_argument("--on", choices=changeable, metavar="LOCK", help="turn on: " + ", ".join(changeable))
+    p.add_argument("--undo", choices=changeable, metavar="LOCK", help="put a lock back the way it was")
+    p = sub.add_parser("tripwire", help="decoy files that raise an alarm when a thief reads them")
+    p.add_argument("--json", action="store_true", help="print the result as JSON")
+    p.add_argument("--on", action="store_true", help="plant the decoys and start watching (alert only)")
+    p.add_argument("--cut", action="store_true", help="with --on: also block the reading program from the internet")
+    p.add_argument("--off", action="store_true", help="remove the decoys and put Windows back as it was")
+    p.add_argument("--restore", action="store_true", help="after an alarm: lift the internet blocks and clear the alarm")
+    p = sub.add_parser("vault", help="keep key files encrypted so a stolen copy is useless")
+    act = p.add_subparsers(dest="action", required=True)
+    act.add_parser("create", help="make the vault and choose its passphrase")
+    a = act.add_parser("add", help="encrypt files into the vault")
+    a.add_argument("paths", nargs="+")
+    a.add_argument("--move", action="store_true", help="delete the original once the vault copy is verified")
+    a.add_argument("--name", help="store a single file under another name")
+    act.add_parser("list", help="show what is in the vault")
+    a = act.add_parser("get", help="take a file out as an ordinary file")
+    a.add_argument("name")
+    a.add_argument("--to", help="where to write it (default: this folder)")
+    a = act.add_parser("use", help="run a command with the file present only while it runs")
+    a.add_argument("name")
+    a.add_argument("run", nargs=argparse.REMAINDER, help="the command; {} is replaced by the file's path")
+    a = act.add_parser("remove", help="delete a file from the vault")
+    a.add_argument("name")
+    act.add_parser("passphrase", help="choose a new passphrase (opens with the old one or the recovery key)")
+    act.add_parser("recovery", help="make a new recovery key; the old one stops working")
+    a = act.add_parser("backup", help="copy the vault, still encrypted, to another folder or drive")
+    a.add_argument("folder", help="a new or empty folder")
+    a = act.add_parser("restore", help="bring a backed-up vault back onto a PC that has none")
+    a.add_argument("folder", help="the folder a backup was copied to")
+    p = sub.add_parser("respond", help="after running something bad: what to do, in what order")
+    p.add_argument("--json", action="store_true", help="print the result as JSON")
+    p.add_argument("--sites", action="store_true", help="also list the websites with a password saved on this PC (names only)")
+    p = sub.add_parser("setup", help="install or update gotchu's administrator helpers in Program Files")
+    p.add_argument("--remove", action="store_true", help="remove them, once nothing gotchu turned on still needs them")
+    p = sub.add_parser("ui", help="open the gotchu window in your browser")
+    p.add_argument("path", nargs="?", help="a download to check as soon as the window opens")
+    p.add_argument("--no-browser", action="store_true", help="start without opening a browser")
+    args = parser.parse_args(argv)
+
+    if args.command == "ui":
+        from . import ui
+        return ui.serve(open_browser=not args.no_browser, path=args.path)
+
+    if args.command == "vault":
+        return _vault(args)
+
+    if args.command == "setup":
+        return _setup(args)
+
+    try:
+        return _run(args)
+    except report.CouldNotRun as e:
+        print(e)
+        return 3
+
+
+def _run(args):
+    if args.command == "harden" and (args.on or args.undo):
+        ok, message = harden.change(args.on or args.undo, undo=bool(args.undo))
+        print(message)
+        return 0 if ok else 1
+
+    if args.command == "tripwire" and (args.on or args.off or args.restore):
+        ok, message = tripwire.change("on" if args.on else "off" if args.off else "restore", cut=args.cut)
+        print(message)
+        return 0 if ok else 1
+
+    if args.command == "check":
+        if not os.path.exists(args.path):
+            raise report.CouldNotRun(f"{args.path} does not exist. Check the path and try again.")
+        try:
+            result = check.result(args.path)
+        except OSError as e:
+            raise report.CouldNotRun(f"Windows would not let gotchu read {args.path} ({e.strerror or e}). "
+                                     "Try a copy in your Downloads folder.") from None
+    elif args.command == "tripwire":
+        result = tripwire.result()
+    elif args.command == "exposure":
+        result = exposure.result()
+    elif args.command == "respond":
+        result = respond.result(with_sites=args.sites)
+    else:
+        result = scan.result() if args.command == "scan" else harden.result()
+    print(json.dumps(result, indent=2) if args.json else report.render(result))
+    if args.command == "respond" and args.sites and not args.json:
+        print(f"\nWebsites with a password saved on this PC ({len(result['sites'])}):\n" + "\n".join(result["sites"]))
+    return {"danger": 2, "warn": 1}.get(result["level"], 0)
+
+
+if __name__ == "__main__":
+    sys.exit(main())