winbearable 0.1.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. winbearable-0.1.0/CHANGELOG.md +17 -0
  2. winbearable-0.1.0/LICENSE +21 -0
  3. winbearable-0.1.0/PKG-INFO +251 -0
  4. winbearable-0.1.0/README.md +221 -0
  5. winbearable-0.1.0/profiles/owner.toml +34 -0
  6. winbearable-0.1.0/profiles/paranoid.toml +25 -0
  7. winbearable-0.1.0/profiles/user-only.toml +47 -0
  8. winbearable-0.1.0/pyproject.toml +89 -0
  9. winbearable-0.1.0/src/winbearable/__init__.py +79 -0
  10. winbearable-0.1.0/src/winbearable/__main__.py +6 -0
  11. winbearable-0.1.0/src/winbearable/__pycache__/__init__.cpython-312.pyc +0 -0
  12. winbearable-0.1.0/src/winbearable/__pycache__/__main__.cpython-312.pyc +0 -0
  13. winbearable-0.1.0/src/winbearable/__pycache__/cli.cpython-312.pyc +0 -0
  14. winbearable-0.1.0/src/winbearable/__pycache__/const.cpython-312.pyc +0 -0
  15. winbearable-0.1.0/src/winbearable/__pycache__/engine.cpython-312.pyc +0 -0
  16. winbearable-0.1.0/src/winbearable/__pycache__/models.cpython-312.pyc +0 -0
  17. winbearable-0.1.0/src/winbearable/__pycache__/profiles.cpython-312.pyc +0 -0
  18. winbearable-0.1.0/src/winbearable/__pycache__/state.cpython-312.pyc +0 -0
  19. winbearable-0.1.0/src/winbearable/__pycache__/tui.cpython-312.pyc +0 -0
  20. winbearable-0.1.0/src/winbearable/__pycache__/wsl.cpython-312.pyc +0 -0
  21. winbearable-0.1.0/src/winbearable/backends/__init__.py +27 -0
  22. winbearable-0.1.0/src/winbearable/backends/__pycache__/__init__.cpython-312.pyc +0 -0
  23. winbearable-0.1.0/src/winbearable/backends/__pycache__/registry.cpython-312.pyc +0 -0
  24. winbearable-0.1.0/src/winbearable/backends/__pycache__/system.cpython-312.pyc +0 -0
  25. winbearable-0.1.0/src/winbearable/backends/registry.py +330 -0
  26. winbearable-0.1.0/src/winbearable/backends/system.py +453 -0
  27. winbearable-0.1.0/src/winbearable/cli.py +350 -0
  28. winbearable-0.1.0/src/winbearable/const.py +71 -0
  29. winbearable-0.1.0/src/winbearable/engine.py +413 -0
  30. winbearable-0.1.0/src/winbearable/models.py +356 -0
  31. winbearable-0.1.0/src/winbearable/profiles.py +188 -0
  32. winbearable-0.1.0/src/winbearable/state.py +72 -0
  33. winbearable-0.1.0/src/winbearable/tui.py +89 -0
  34. winbearable-0.1.0/src/winbearable/tweaks/__init__.py +9 -0
  35. winbearable-0.1.0/src/winbearable/tweaks/__pycache__/__init__.cpython-312.pyc +0 -0
  36. winbearable-0.1.0/src/winbearable/tweaks/__pycache__/catalog.cpython-312.pyc +0 -0
  37. winbearable-0.1.0/src/winbearable/tweaks/catalog.py +879 -0
  38. winbearable-0.1.0/src/winbearable/wsl.py +234 -0
winbearable-0.1.0/CHANGELOG.md ADDED
@@ -0,0 +1,17 @@
1
+ # Changelog
2
+
3
+ All notable changes to `winbearable` are documented in this file.
4
+
5
+ ## [0.1.0] - 2026-11-14
6
+
7
+ ### Added
8
+
9
+ - Bootstrap `winbearable` (`wb` / `winbearable` CLI) with `uv` build/test workflow and zero mandatory runtime dependencies.
10
+ - Pure native Python engine (`detect`, `plan`, `apply`, `rollback`, `status`, `doctor`) backed by `winreg` and structured subprocess execution (`shell=False`) without PowerShell wrappers.
11
+ - Policy-conflict detection (`BLOCKED_BY_POLICY`) when GPO or MDM owns a registry key.
12
+ - Atomic state snapshots in `%LOCALAPPDATA%\winbearable\state.json` enabling full `wb rollback [--to <run-id>]`.
13
+ - OneDrive eradication suite (`onedrive.disable_tray_autorun`, `onedrive.unpin_explorer`, `onedrive.disable_policy`, `onedrive.uninstall`).
14
+ - Search, Start Menu, Taskbar, Explorer, Copilot, Recall, Telemetry, and CIS-mapped native Windows hardening tweaks.
15
+ - Non-destructive `.wslconfig` and `/etc/wsl.conf` merger (`strict` and `convenient` presets) plus `wb wsl audit`, `wb wsl plan`, and `wb wsl apply`.
16
+ - Built-in TOML profiles (`user-only.toml`, `owner.toml`, `paranoid.toml`) with `extends` inheritance and `wb init` profile generator.
17
+ - Optional Textual TUI (`wb tui`) via `winbearable[tui]`.
winbearable-0.1.0/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
winbearable-0.1.0/PKG-INFO ADDED
@@ -0,0 +1,251 @@
1
+ Metadata-Version: 2.1
2
+ Name: winbearable
3
+ Version: 0.1.0
4
+ Summary: Make Windows + WSL2 bearable (and locked down) for Linux people who are stuck with it — pure native Python, zero PowerShell wrappers.
5
+ Author: hellqvio
6
+ License: MIT
7
+ Project-URL: Homepage, https://github.com/hellqvio86/winbearable
8
+ Project-URL: Documentation, https://github.com/hellqvio86/winbearable#readme
9
+ Project-URL: Repository, https://github.com/hellqvio86/winbearable.git
10
+ Project-URL: Issues, https://github.com/hellqvio86/winbearable/issues
11
+ Project-URL: Funding, https://github.com/sponsors/hellqvio86
12
+ Classifier: Development Status :: 4 - Beta
13
+ Classifier: Environment :: Console
14
+ Classifier: Intended Audience :: Developers
15
+ Classifier: Intended Audience :: System Administrators
16
+ Classifier: License :: OSI Approved :: MIT License
17
+ Classifier: Operating System :: Microsoft :: Windows :: Windows 11
18
+ Classifier: Operating System :: POSIX :: Linux
19
+ Classifier: Programming Language :: Python :: 3
20
+ Classifier: Programming Language :: Python :: 3.11
21
+ Classifier: Programming Language :: Python :: 3.12
22
+ Classifier: Programming Language :: Python :: 3.13
23
+ Classifier: Programming Language :: Python :: 3.14
24
+ Classifier: Topic :: System :: Systems Administration
25
+ Classifier: Typing :: Typed
26
+ Requires-Python: >=3.11
27
+ Description-Content-Type: text/markdown
28
+ Provides-Extra: tui
29
+ Requires-Dist: textual>=0.80.0; extra == "tui"
30
+
31
+ <p align="center">
32
+ <img src="assets/winbearable.svg" width="120" height="120" alt="winbearable logo">
33
+ </p>
34
+
35
+ # winbearable (`wb`)
36
+
37
+ <p align="center">
38
+ <a href="https://github.com/astral-sh/uv"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v1.json" alt="uv"></a>
39
+ <a href="https://github.com/astral-sh/ruff"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json" alt="Ruff"></a>
40
+ <a href="https://github.com/hellqvio86/winbearable/actions/workflows/ci.yml"><img src="coverage.svg" alt="Coverage"></a>
41
+ <img src="https://img.shields.io/badge/python-3.11+-blue.svg" alt="Python Version">
42
+ <img src="https://img.shields.io/badge/Windows_11-24H2%20%7C%2025H2+-0078D6.svg?logo=windows11&logoColor=white" alt="Windows 11">
43
+ </p>
44
+
45
+ > ### Foreword: Why Does This Exist?
46
+ >
47
+ > Let's be honest: nobody here *wants* to run Windows.
48
+ >
49
+ > Maybe your company's IT department forced you onto a corporate Windows laptop and told you to "just use WSL." Or maybe you bought an otherwise glorious ex-work ThinkPad or Dell Precision on the secondhand market, only to discover that the previous IT department forgot to give you the BIOS/UEFI supervisor password—and left **"Enable Microsoft 3rd Party UEFI CA"** turned **OFF**. So Secure Boot flatly refuses to boot a Fedora or Ubuntu USB stick, the NVMe boot order is padlocked, and Windows 11 + WSL2 is the only Linux kernel you are ever going to get on that silicon.
50
+ >
51
+ > Whatever cruel twist of fate landed you here, **this tool is for you.**
52
+ >
53
+ > We don't like Windows either. That's why `winbearable` (`wb`) is shamelessly opinionated:
54
+ > - **Latest Windows 11 Only (24H2 / 25H2+, Build >= 26100):** We don't support Windows 10 or ancient Windows 11 builds. Maintaining one version of Windows is painful enough.
55
+ > - **100% Native Python, Zero PowerShell Wrappers:** We use Python's standard library (`winreg`, `ctypes`, `tomllib`) and direct Win32 binaries (`wsl.exe`, `winget.exe`, `sc.exe`, `taskkill.exe`) with `shell=False`. It works even when corporate AppLocker/WDAC locks PowerShell into Constrained Language Mode.
56
+ > - **Kills the Annoying OneDrive Tray Icon:** Terminates `OneDrive.exe`, deletes the `HKCU\...\Run\OneDrive` autorun key so it stops haunting your system tray, unpins OneDrive from File Explorer, blocks it via machine policy when admin, and can uninstall it outright.
57
+ > - **Installs VS Code + Remote-WSL on the Windows Side:** Automatically installs `Microsoft.VisualStudioCode` (in user scope, no admin needed) plus the `ms-vscode-remote.remote-wsl` extension so typing `code .` in your WSL `bash` shell just works.
58
+ > - **Gives WSL2 75% of Your Host RAM:** Sizes `%USERPROFILE%\.wslconfig` to **75% of physical host RAM (rounded up to whole GiB)** with `networkingMode=mirrored`, `dnsTunneling=true`, `firewall=true`, and `sparseVhd=true`.
59
+
60
+ ---
61
+
62
+ ## 🚀 Zero-to-Bash Bootstrap (Fresh Windows 11 -> Linux Shell Fast)
63
+
64
+ If you are a Linux person staring at a fresh Windows 11 desktop, **do not open Edge, do not open the Microsoft Store, and do not click through GUI installers.**
65
+
66
+ Press **`Win + R`**, type **`cmd`**, hit **Enter**, and paste these commands to get `uv`, Python, VS Code, `winbearable`, and your Linux `bash` shell running in under two minutes:
67
+
68
+ ### Step 1: Install `uv` (and Python) via `winget` (No Admin Required)
69
+
70
+ `winget` is built into Windows 11. Installing `uv` with `--scope user` requires zero Administrator privileges, and `uv` automatically downloads and manages a standalone Python interpreter when needed:
71
+
72
+ ```cmd
73
+ winget install --exact --id Astral-sh.uv --scope user --accept-source-agreements --accept-package-agreements
74
+ ```
75
+
76
+ *(Optional: if you also want a standalone user-scoped Python on `PATH`, run `winget install --exact --id Python.Python.3.13 --scope user --accept-source-agreements --accept-package-agreements`)*
77
+
78
+ Refresh your `PATH` (or open a new `cmd` / Windows Terminal tab), then install `winbearable`:
79
+
80
+ ```cmd
81
+ uv tool update-shell
82
+ uv tool install winbearable
83
+ ```
84
+
85
+ ### Step 2: Install VS Code, Kill OneDrive Tray, Kill Bing Search & Fix Explorer (`wb`)
86
+
87
+ Preview every exact registry key, value, and `winget` package `wb` will touch (dry-run by default), then apply:
88
+
89
+ ```cmd
90
+ wb plan --profile user-only
91
+ wb apply --profile user-only --apply
92
+ ```
93
+
94
+ If you have Administrator rights on the machine (personal PC or unlocked local admin on an ex-work PC), open **`cmd` as Administrator** (`Ctrl + Shift + Enter`) and apply the `owner` profile instead:
95
+
96
+ ```cmd
97
+ wb plan --profile owner
98
+ wb apply --profile owner --apply
99
+ ```
100
+
101
+ ### Step 3: Give WSL2 75% of Host RAM & Drop Into Your `bash` Shell
102
+
103
+ Configure `%USERPROFILE%\.wslconfig` (sets WSL2 memory to **75% of physical host RAM rounded up to whole GiB**, `networkingMode=mirrored`, `dnsTunneling=true`, `firewall=true`, `sparseVhd=true`) and `/etc/wsl.conf`:
104
+
105
+ ```cmd
106
+ wb wsl plan --mode convenient
107
+ wb wsl apply --mode convenient --apply
108
+ ```
109
+
110
+ Now install your Linux distribution and enter `bash`:
111
+
112
+ ```cmd
113
+ REM Install Ubuntu 24.04 LTS or Fedora Linux 42
114
+ wsl.exe --install -d Ubuntu-24.04
115
+ REM Or: wsl.exe --install -d FedoraLinux-42
116
+
117
+ REM Apply hardened /etc/wsl.conf inside the distro and restart WSL
118
+ wb wsl apply --mode convenient --distro Ubuntu-24.04 --apply
119
+ wsl.exe --shutdown
120
+ wsl.exe
121
+ ```
122
+
123
+ Once inside your WSL `bash` shell, type `code .` to open your Linux project in the Windows-side VS Code GUI via `ms-vscode-remote.remote-wsl`.
124
+
125
+ > **Locked-Down PC Fallback (When `winget` or Microsoft Store is Blocked):**
126
+ > 1. Download the standalone `uv-x86_64-pc-windows-msvc.zip` binary release from GitHub (`github.com/astral-sh/uv/releases`) into `%USERPROFILE%\.local\bin`.
127
+ > 2. Run `uv tool install winbearable` (`uv` fetches Python into `%APPDATA%\uv\python` with zero admin rights).
128
+ > 3. If the Windows Store is blocked by GPO/MDM, install WSL via `wsl.exe --install --web-download -d Ubuntu-24.04`.
129
+
130
+ ---
131
+
132
+ ## 📋 Complete Registry & Package Changes Reference
133
+
134
+ Every `wb plan`, `wb apply`, `wb status`, and `wb rollback` command prints the **exact registry hive, key path, value name, value type, and `current -> target` value transition**. Below is the complete reference of what each tweak modifies:
135
+
136
+ ### 1. Opinionated Developer Apps (`apps.*`)
137
+
138
+ | Tweak ID | Admin? | Mechanism / Package ID | Scope | Extensions / Details |
139
+ | :--- | :---: | :--- | :---: | :--- |
140
+ | `apps.install_vscode` | No | `winget.exe install --id Microsoft.VisualStudioCode --exact` | `user` | Also installs `ms-vscode-remote.remote-wsl` via `code.cmd --install-extension` |
141
+
142
+ ### 2. OneDrive Eradication (`onedrive.*`)
143
+
144
+ | Tweak ID | Admin? | Registry Hive & Key Path | Value Name | Type | Target Value / Action |
145
+ | :--- | :---: | :--- | :--- | :---: | :--- |
146
+ | `onedrive.disable_tray_autorun` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` | `OneDrive` | `REG_SZ` | **`DELETE`** (+ stops `OneDrive.exe`) |
147
+ | `onedrive.unpin_explorer` | No | `HKCU\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}` | `System.IsPinnedToNameSpaceTree` | `REG_DWORD` | `0` |
148
+ | `onedrive.unpin_explorer` | No | `HKCU\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}` | `System.IsPinnedToNameSpaceTree` | `REG_DWORD` | `0` |
149
+ | `onedrive.disable_policy` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive` | `DisableFileSyncNGSC` | `REG_DWORD` | `1` |
150
+ | `onedrive.uninstall` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive` | `DisableFileSyncNGSC` | `REG_DWORD` | `1` (+ runs `OneDriveSetup.exe /uninstall`) |
151
+
152
+ ### 3. Search, Start Menu, Taskbar & File Explorer (`search.*`, `start.*`, `taskbar.*`, `explorer.*`)
153
+
154
+ | Tweak ID | Admin? | Registry Hive & Key Path | Value Name | Type | Target Value |
155
+ | :--- | :---: | :--- | :--- | :---: | :--- |
156
+ | `search.disable_bing` | No | `HKCU\Software\Policies\Microsoft\Windows\Explorer` | `DisableSearchBoxSuggestions` | `REG_DWORD` | `1` |
157
+ | `search.disable_bing` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Search` | `BingSearchEnabled` | `REG_DWORD` | `0` |
158
+ | `search.disable_highlights` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings` | `IsDynamicSearchBoxEnabled` | `REG_DWORD` | `0` |
159
+ | `search.hide_taskbar_box` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Search` | `SearchboxTaskbarMode` | `REG_DWORD` | `0` |
160
+ | `search.disable_cloud_and_history` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings` | `IsMSACloudSearchEnabled` | `REG_DWORD` | `0` |
161
+ | `search.disable_cloud_and_history` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings` | `IsAADCloudSearchEnabled` | `REG_DWORD` | `0` |
162
+ | `search.disable_cloud_and_history` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings` | `IsDeviceSearchHistoryEnabled` | `REG_DWORD` | `0` |
163
+ | `search.disable_wsearch_service` | Yes | `HKLM\SYSTEM\CurrentControlSet\Services\WSearch` | `Start` | `REG_DWORD` | `4` (`Disabled`) |
164
+ | `start.disable_recommendations` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager` | `SystemPaneSuggestionsEnabled` | `REG_DWORD` | `0` |
165
+ | `start.disable_recommendations` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager` | `SubscribedContent-338388Enabled` | `REG_DWORD` | `0` |
166
+ | `start.disable_recommendations` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager` | `SubscribedContent-338389Enabled` | `REG_DWORD` | `0` |
167
+ | `start.disable_recommendations` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager` | `SoftLandingEnabled` | `REG_DWORD` | `0` |
168
+ | `start.disable_recommendations` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `Start_IrisRecommendations` | `REG_DWORD` | `0` |
169
+ | `taskbar.disable_widgets_and_chat` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `TaskbarDa` | `REG_DWORD` | `0` |
170
+ | `taskbar.disable_widgets_and_chat` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `TaskbarMn` | `REG_DWORD` | `0` |
171
+ | `taskbar.disable_widgets_and_chat` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `ShowTaskViewButton` | `REG_DWORD` | `0` |
172
+ | `explorer.classic_context_menu` | No | `HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32` | `(Default)` | `REG_SZ` | `""` |
173
+ | `explorer.show_file_extensions` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `HideFileExt` | `REG_DWORD` | `0` (Always show file extensions) |
174
+ | `explorer.show_hidden_files` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `Hidden` | `REG_DWORD` | `1` (Show hidden files & dotfiles) |
175
+
176
+ ### 4. AI, Privacy & Native CIS Hardening (`ai.*`, `privacy.*`, `hardening.*`)
177
+
178
+ | Tweak ID | Admin? | Registry Hive & Key Path | Value Name | Type | Target Value |
179
+ | :--- | :---: | :--- | :--- | :---: | :--- |
180
+ | `ai.disable_copilot_user` | No | `HKCU\Software\Policies\Microsoft\Windows\WindowsCopilot` | `TurnOffWindowsCopilot` | `REG_DWORD` | `1` |
181
+ | `ai.disable_copilot_user` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `ShowCopilotButton` | `REG_DWORD` | `0` |
182
+ | `ai.disable_copilot_machine` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot` | `TurnOffWindowsCopilot` | `REG_DWORD` | `1` |
183
+ | `ai.disable_recall` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI` | `DisableAIDataAnalysis` | `REG_DWORD` | `1` |
184
+ | `ai.disable_recall` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI` | `TurnOffSavingSnapshots` | `REG_DWORD` | `1` |
185
+ | `privacy.disable_advertising_id` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo` | `Enabled` | `REG_DWORD` | `0` |
186
+ | `privacy.disable_tailored_experiences` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy` | `TailoredExperiencesWithDiagnosticDataEnabled` | `REG_DWORD` | `0` |
187
+ | `privacy.telemetry_minimal` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection` | `AllowTelemetry` | `REG_DWORD` | `0` |
188
+ | `privacy.telemetry_minimal` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\System` | `PublishUserActivities` | `REG_DWORD` | `0` |
189
+ | `privacy.telemetry_minimal` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\System` | `UploadUserActivities` | `REG_DWORD` | `0` |
190
+ | `hardening.disable_wsh_user` | No | `HKCU\Software\Microsoft\Windows Script Host\Settings` | `Enabled` | `REG_DWORD` | `0` |
191
+ | `hardening.disable_llmnr` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient` | `EnableMulticast` | `REG_DWORD` | `0` |
192
+ | `hardening.disable_wpad` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad` | `WpadOverride` | `REG_DWORD` | `1` |
193
+ | `hardening.disable_autorun` | Yes | `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer` | `NoDriveTypeAutoRun` | `REG_DWORD` | `255` |
194
+ | `hardening.powershell_scriptblock_logging` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging` | `EnableScriptBlockLogging` | `REG_DWORD` | `1` |
195
+ | `hardening.cmdline_process_audit` | Yes | `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit` | `ProcessCreationIncludeCmdLine_Enabled` | `REG_DWORD` | `1` |
196
+ | `hardening.enable_lsa_protection` | Yes | `HKLM\SYSTEM\CurrentControlSet\Control\Lsa` | `RunAsPPL` | `REG_DWORD` | `1` |
197
+ | `hardening.enable_vbs_hvci` | Yes | `HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard` | `EnableVirtualizationBasedSecurity` | `REG_DWORD` | `1` |
198
+ | `hardening.enable_vbs_hvci` | Yes | `HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity` | `Enabled` | `REG_DWORD` | `1` |
199
+
200
+ ---
201
+
202
+ ## Built-in TOML Profiles
203
+
204
+ | Profile | Requires Admin? | What It Configures |
205
+ | :--- | :--- | :--- |
206
+ | [`profiles/user-only.toml`](profiles/user-only.toml) | **No** (`HKCU` / user scope) | Installs Windows-side VS Code + `ms-vscode-remote.remote-wsl`, kills OneDrive tray autorun & Explorer pin, disables Bing web search, Search Highlights, taskbar search box, Start menu ads/recommendations, Widgets/Chat/Task View, restores classic Windows 11 right-click menu, shows file extensions/dotfiles, disables user Copilot, Advertising ID, and WSH. |
207
+ | [`profiles/owner.toml`](profiles/owner.toml) | **Yes** (`extends = "user-only"`) | Adds machine-wide OneDrive sync block (`DisableFileSyncNGSC=1`), disables Windows Recall & Copilot machine-wide, sets minimal telemetry, disables LLMNR, WPAD, AutoRun, and enables PowerShell ScriptBlock & 4688 command-line auditing. |
208
+ | [`profiles/paranoid.toml`](profiles/paranoid.toml) | **Yes** (`extends = "owner"`) | Uninstalls the OneDrive client, disables the `WSearch` indexer service, enables LSA `RunAsPPL` protection, enforces VBS/HVCI (`--i-know-what-im-doing`), and switches WSL2 to `strict` isolation (`[interop] enabled=false`, `[automount] enabled=false`). |
209
+
210
+ ---
211
+
212
+ ## Windows Build Support Policy
213
+
214
+ We don't like Windows enough to maintain legacy workarounds for EOL operating systems. **Only the latest Windows 11 releases (24H2 / 25H2+, build `>= 26100`) are supported.**
215
+
216
+ | Build Number | OS Release | Support Status |
217
+ | :--- | :--- | :--- |
218
+ | `26200+` | Windows 11 25H2 | **Supported** |
219
+ | `26100` | Windows 11 24H2 | **Supported** |
220
+ | `< 26100` | Older Windows 11 / Windows 10 | **Unsupported (`unsupported_build`)** |
221
+
222
+ ---
223
+
224
+ ## Development & Test Coverage Gate (`uv`)
225
+
226
+ ```bash
227
+ make venv # Create .venv and install dev dependencies via uv
228
+ make lint # ruff check + ruff format --check
229
+ make test # mypy --strict + pytest-cov (enforces >=80% coverage) + badge generation
230
+ make release-check # lint + test + TruffleHog + Trivy
231
+ ```
232
+
233
+ ## Documentation
234
+
235
+ - [Project Roadmap & TODO](TODO.md)
236
+ - [Linux Person's Windows Cheat Sheet](docs/linux-to-windows-cheatsheet.md)
237
+ - [AI Agent Instructions (`AGENTS.md`)](AGENTS.md)
238
+ - [Security Policy (`SECURITY.md`)](SECURITY.md)
239
+ - [Contributing Guide (`CONTRIBUTING.md`)](CONTRIBUTING.md)
240
+
241
+ ---
242
+
243
+ ## 📄 License
244
+
245
+ This project is licensed under the [MIT License](LICENSE).
246
+
247
+ <p align="right">
248
+ <a href="https://www.buymeacoffee.com/olofhellqvc">
249
+ <img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me a Coffee" height="48">
250
+ </a>
251
+ </p>
winbearable-0.1.0/README.md ADDED
@@ -0,0 +1,221 @@
1
+ <p align="center">
2
+ <img src="assets/winbearable.svg" width="120" height="120" alt="winbearable logo">
3
+ </p>
4
+
5
+ # winbearable (`wb`)
6
+
7
+ <p align="center">
8
+ <a href="https://github.com/astral-sh/uv"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v1.json" alt="uv"></a>
9
+ <a href="https://github.com/astral-sh/ruff"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json" alt="Ruff"></a>
10
+ <a href="https://github.com/hellqvio86/winbearable/actions/workflows/ci.yml"><img src="coverage.svg" alt="Coverage"></a>
11
+ <img src="https://img.shields.io/badge/python-3.11+-blue.svg" alt="Python Version">
12
+ <img src="https://img.shields.io/badge/Windows_11-24H2%20%7C%2025H2+-0078D6.svg?logo=windows11&logoColor=white" alt="Windows 11">
13
+ </p>
14
+
15
+ > ### Foreword: Why Does This Exist?
16
+ >
17
+ > Let's be honest: nobody here *wants* to run Windows.
18
+ >
19
+ > Maybe your company's IT department forced you onto a corporate Windows laptop and told you to "just use WSL." Or maybe you bought an otherwise glorious ex-work ThinkPad or Dell Precision on the secondhand market, only to discover that the previous IT department forgot to give you the BIOS/UEFI supervisor password—and left **"Enable Microsoft 3rd Party UEFI CA"** turned **OFF**. So Secure Boot flatly refuses to boot a Fedora or Ubuntu USB stick, the NVMe boot order is padlocked, and Windows 11 + WSL2 is the only Linux kernel you are ever going to get on that silicon.
20
+ >
21
+ > Whatever cruel twist of fate landed you here, **this tool is for you.**
22
+ >
23
+ > We don't like Windows either. That's why `winbearable` (`wb`) is shamelessly opinionated:
24
+ > - **Latest Windows 11 Only (24H2 / 25H2+, Build >= 26100):** We don't support Windows 10 or ancient Windows 11 builds. Maintaining one version of Windows is painful enough.
25
+ > - **100% Native Python, Zero PowerShell Wrappers:** We use Python's standard library (`winreg`, `ctypes`, `tomllib`) and direct Win32 binaries (`wsl.exe`, `winget.exe`, `sc.exe`, `taskkill.exe`) with `shell=False`. It works even when corporate AppLocker/WDAC locks PowerShell into Constrained Language Mode.
26
+ > - **Kills the Annoying OneDrive Tray Icon:** Terminates `OneDrive.exe`, deletes the `HKCU\...\Run\OneDrive` autorun key so it stops haunting your system tray, unpins OneDrive from File Explorer, blocks it via machine policy when admin, and can uninstall it outright.
27
+ > - **Installs VS Code + Remote-WSL on the Windows Side:** Automatically installs `Microsoft.VisualStudioCode` (in user scope, no admin needed) plus the `ms-vscode-remote.remote-wsl` extension so typing `code .` in your WSL `bash` shell just works.
28
+ > - **Gives WSL2 75% of Your Host RAM:** Sizes `%USERPROFILE%\.wslconfig` to **75% of physical host RAM (rounded up to whole GiB)** with `networkingMode=mirrored`, `dnsTunneling=true`, `firewall=true`, and `sparseVhd=true`.
29
+
30
+ ---
31
+
32
+ ## 🚀 Zero-to-Bash Bootstrap (Fresh Windows 11 -> Linux Shell Fast)
33
+
34
+ If you are a Linux person staring at a fresh Windows 11 desktop, **do not open Edge, do not open the Microsoft Store, and do not click through GUI installers.**
35
+
36
+ Press **`Win + R`**, type **`cmd`**, hit **Enter**, and paste these commands to get `uv`, Python, VS Code, `winbearable`, and your Linux `bash` shell running in under two minutes:
37
+
38
+ ### Step 1: Install `uv` (and Python) via `winget` (No Admin Required)
39
+
40
+ `winget` is built into Windows 11. Installing `uv` with `--scope user` requires zero Administrator privileges, and `uv` automatically downloads and manages a standalone Python interpreter when needed:
41
+
42
+ ```cmd
43
+ winget install --exact --id Astral-sh.uv --scope user --accept-source-agreements --accept-package-agreements
44
+ ```
45
+
46
+ *(Optional: if you also want a standalone user-scoped Python on `PATH`, run `winget install --exact --id Python.Python.3.13 --scope user --accept-source-agreements --accept-package-agreements`)*
47
+
48
+ Refresh your `PATH` (or open a new `cmd` / Windows Terminal tab), then install `winbearable`:
49
+
50
+ ```cmd
51
+ uv tool update-shell
52
+ uv tool install winbearable
53
+ ```
54
+
55
+ ### Step 2: Install VS Code, Kill OneDrive Tray, Kill Bing Search & Fix Explorer (`wb`)
56
+
57
+ Preview every exact registry key, value, and `winget` package `wb` will touch (dry-run by default), then apply:
58
+
59
+ ```cmd
60
+ wb plan --profile user-only
61
+ wb apply --profile user-only --apply
62
+ ```
63
+
64
+ If you have Administrator rights on the machine (personal PC or unlocked local admin on an ex-work PC), open **`cmd` as Administrator** (`Ctrl + Shift + Enter`) and apply the `owner` profile instead:
65
+
66
+ ```cmd
67
+ wb plan --profile owner
68
+ wb apply --profile owner --apply
69
+ ```
70
+
71
+ ### Step 3: Give WSL2 75% of Host RAM & Drop Into Your `bash` Shell
72
+
73
+ Configure `%USERPROFILE%\.wslconfig` (sets WSL2 memory to **75% of physical host RAM rounded up to whole GiB**, `networkingMode=mirrored`, `dnsTunneling=true`, `firewall=true`, `sparseVhd=true`) and `/etc/wsl.conf`:
74
+
75
+ ```cmd
76
+ wb wsl plan --mode convenient
77
+ wb wsl apply --mode convenient --apply
78
+ ```
79
+
80
+ Now install your Linux distribution and enter `bash`:
81
+
82
+ ```cmd
83
+ REM Install Ubuntu 24.04 LTS or Fedora Linux 42
84
+ wsl.exe --install -d Ubuntu-24.04
85
+ REM Or: wsl.exe --install -d FedoraLinux-42
86
+
87
+ REM Apply hardened /etc/wsl.conf inside the distro and restart WSL
88
+ wb wsl apply --mode convenient --distro Ubuntu-24.04 --apply
89
+ wsl.exe --shutdown
90
+ wsl.exe
91
+ ```
92
+
93
+ Once inside your WSL `bash` shell, type `code .` to open your Linux project in the Windows-side VS Code GUI via `ms-vscode-remote.remote-wsl`.
94
+
95
+ > **Locked-Down PC Fallback (When `winget` or Microsoft Store is Blocked):**
96
+ > 1. Download the standalone `uv-x86_64-pc-windows-msvc.zip` binary release from GitHub (`github.com/astral-sh/uv/releases`) into `%USERPROFILE%\.local\bin`.
97
+ > 2. Run `uv tool install winbearable` (`uv` fetches Python into `%APPDATA%\uv\python` with zero admin rights).
98
+ > 3. If the Windows Store is blocked by GPO/MDM, install WSL via `wsl.exe --install --web-download -d Ubuntu-24.04`.
99
+
100
+ ---
101
+
102
+ ## 📋 Complete Registry & Package Changes Reference
103
+
104
+ Every `wb plan`, `wb apply`, `wb status`, and `wb rollback` command prints the **exact registry hive, key path, value name, value type, and `current -> target` value transition**. Below is the complete reference of what each tweak modifies:
105
+
106
+ ### 1. Opinionated Developer Apps (`apps.*`)
107
+
108
+ | Tweak ID | Admin? | Mechanism / Package ID | Scope | Extensions / Details |
109
+ | :--- | :---: | :--- | :---: | :--- |
110
+ | `apps.install_vscode` | No | `winget.exe install --id Microsoft.VisualStudioCode --exact` | `user` | Also installs `ms-vscode-remote.remote-wsl` via `code.cmd --install-extension` |
111
+
112
+ ### 2. OneDrive Eradication (`onedrive.*`)
113
+
114
+ | Tweak ID | Admin? | Registry Hive & Key Path | Value Name | Type | Target Value / Action |
115
+ | :--- | :---: | :--- | :--- | :---: | :--- |
116
+ | `onedrive.disable_tray_autorun` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` | `OneDrive` | `REG_SZ` | **`DELETE`** (+ stops `OneDrive.exe`) |
117
+ | `onedrive.unpin_explorer` | No | `HKCU\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}` | `System.IsPinnedToNameSpaceTree` | `REG_DWORD` | `0` |
118
+ | `onedrive.unpin_explorer` | No | `HKCU\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}` | `System.IsPinnedToNameSpaceTree` | `REG_DWORD` | `0` |
119
+ | `onedrive.disable_policy` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive` | `DisableFileSyncNGSC` | `REG_DWORD` | `1` |
120
+ | `onedrive.uninstall` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive` | `DisableFileSyncNGSC` | `REG_DWORD` | `1` (+ runs `OneDriveSetup.exe /uninstall`) |
121
+
122
+ ### 3. Search, Start Menu, Taskbar & File Explorer (`search.*`, `start.*`, `taskbar.*`, `explorer.*`)
123
+
124
+ | Tweak ID | Admin? | Registry Hive & Key Path | Value Name | Type | Target Value |
125
+ | :--- | :---: | :--- | :--- | :---: | :--- |
126
+ | `search.disable_bing` | No | `HKCU\Software\Policies\Microsoft\Windows\Explorer` | `DisableSearchBoxSuggestions` | `REG_DWORD` | `1` |
127
+ | `search.disable_bing` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Search` | `BingSearchEnabled` | `REG_DWORD` | `0` |
128
+ | `search.disable_highlights` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings` | `IsDynamicSearchBoxEnabled` | `REG_DWORD` | `0` |
129
+ | `search.hide_taskbar_box` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Search` | `SearchboxTaskbarMode` | `REG_DWORD` | `0` |
130
+ | `search.disable_cloud_and_history` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings` | `IsMSACloudSearchEnabled` | `REG_DWORD` | `0` |
131
+ | `search.disable_cloud_and_history` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings` | `IsAADCloudSearchEnabled` | `REG_DWORD` | `0` |
132
+ | `search.disable_cloud_and_history` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings` | `IsDeviceSearchHistoryEnabled` | `REG_DWORD` | `0` |
133
+ | `search.disable_wsearch_service` | Yes | `HKLM\SYSTEM\CurrentControlSet\Services\WSearch` | `Start` | `REG_DWORD` | `4` (`Disabled`) |
134
+ | `start.disable_recommendations` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager` | `SystemPaneSuggestionsEnabled` | `REG_DWORD` | `0` |
135
+ | `start.disable_recommendations` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager` | `SubscribedContent-338388Enabled` | `REG_DWORD` | `0` |
136
+ | `start.disable_recommendations` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager` | `SubscribedContent-338389Enabled` | `REG_DWORD` | `0` |
137
+ | `start.disable_recommendations` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager` | `SoftLandingEnabled` | `REG_DWORD` | `0` |
138
+ | `start.disable_recommendations` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `Start_IrisRecommendations` | `REG_DWORD` | `0` |
139
+ | `taskbar.disable_widgets_and_chat` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `TaskbarDa` | `REG_DWORD` | `0` |
140
+ | `taskbar.disable_widgets_and_chat` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `TaskbarMn` | `REG_DWORD` | `0` |
141
+ | `taskbar.disable_widgets_and_chat` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `ShowTaskViewButton` | `REG_DWORD` | `0` |
142
+ | `explorer.classic_context_menu` | No | `HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32` | `(Default)` | `REG_SZ` | `""` |
143
+ | `explorer.show_file_extensions` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `HideFileExt` | `REG_DWORD` | `0` (Always show file extensions) |
144
+ | `explorer.show_hidden_files` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `Hidden` | `REG_DWORD` | `1` (Show hidden files & dotfiles) |
145
+
146
+ ### 4. AI, Privacy & Native CIS Hardening (`ai.*`, `privacy.*`, `hardening.*`)
147
+
148
+ | Tweak ID | Admin? | Registry Hive & Key Path | Value Name | Type | Target Value |
149
+ | :--- | :---: | :--- | :--- | :---: | :--- |
150
+ | `ai.disable_copilot_user` | No | `HKCU\Software\Policies\Microsoft\Windows\WindowsCopilot` | `TurnOffWindowsCopilot` | `REG_DWORD` | `1` |
151
+ | `ai.disable_copilot_user` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced` | `ShowCopilotButton` | `REG_DWORD` | `0` |
152
+ | `ai.disable_copilot_machine` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot` | `TurnOffWindowsCopilot` | `REG_DWORD` | `1` |
153
+ | `ai.disable_recall` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI` | `DisableAIDataAnalysis` | `REG_DWORD` | `1` |
154
+ | `ai.disable_recall` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI` | `TurnOffSavingSnapshots` | `REG_DWORD` | `1` |
155
+ | `privacy.disable_advertising_id` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo` | `Enabled` | `REG_DWORD` | `0` |
156
+ | `privacy.disable_tailored_experiences` | No | `HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy` | `TailoredExperiencesWithDiagnosticDataEnabled` | `REG_DWORD` | `0` |
157
+ | `privacy.telemetry_minimal` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection` | `AllowTelemetry` | `REG_DWORD` | `0` |
158
+ | `privacy.telemetry_minimal` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\System` | `PublishUserActivities` | `REG_DWORD` | `0` |
159
+ | `privacy.telemetry_minimal` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\System` | `UploadUserActivities` | `REG_DWORD` | `0` |
160
+ | `hardening.disable_wsh_user` | No | `HKCU\Software\Microsoft\Windows Script Host\Settings` | `Enabled` | `REG_DWORD` | `0` |
161
+ | `hardening.disable_llmnr` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient` | `EnableMulticast` | `REG_DWORD` | `0` |
162
+ | `hardening.disable_wpad` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad` | `WpadOverride` | `REG_DWORD` | `1` |
163
+ | `hardening.disable_autorun` | Yes | `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer` | `NoDriveTypeAutoRun` | `REG_DWORD` | `255` |
164
+ | `hardening.powershell_scriptblock_logging` | Yes | `HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging` | `EnableScriptBlockLogging` | `REG_DWORD` | `1` |
165
+ | `hardening.cmdline_process_audit` | Yes | `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit` | `ProcessCreationIncludeCmdLine_Enabled` | `REG_DWORD` | `1` |
166
+ | `hardening.enable_lsa_protection` | Yes | `HKLM\SYSTEM\CurrentControlSet\Control\Lsa` | `RunAsPPL` | `REG_DWORD` | `1` |
167
+ | `hardening.enable_vbs_hvci` | Yes | `HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard` | `EnableVirtualizationBasedSecurity` | `REG_DWORD` | `1` |
168
+ | `hardening.enable_vbs_hvci` | Yes | `HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity` | `Enabled` | `REG_DWORD` | `1` |
169
+
170
+ ---
171
+
172
+ ## Built-in TOML Profiles
173
+
174
+ | Profile | Requires Admin? | What It Configures |
175
+ | :--- | :--- | :--- |
176
+ | [`profiles/user-only.toml`](profiles/user-only.toml) | **No** (`HKCU` / user scope) | Installs Windows-side VS Code + `ms-vscode-remote.remote-wsl`, kills OneDrive tray autorun & Explorer pin, disables Bing web search, Search Highlights, taskbar search box, Start menu ads/recommendations, Widgets/Chat/Task View, restores classic Windows 11 right-click menu, shows file extensions/dotfiles, disables user Copilot, Advertising ID, and WSH. |
177
+ | [`profiles/owner.toml`](profiles/owner.toml) | **Yes** (`extends = "user-only"`) | Adds machine-wide OneDrive sync block (`DisableFileSyncNGSC=1`), disables Windows Recall & Copilot machine-wide, sets minimal telemetry, disables LLMNR, WPAD, AutoRun, and enables PowerShell ScriptBlock & 4688 command-line auditing. |
178
+ | [`profiles/paranoid.toml`](profiles/paranoid.toml) | **Yes** (`extends = "owner"`) | Uninstalls the OneDrive client, disables the `WSearch` indexer service, enables LSA `RunAsPPL` protection, enforces VBS/HVCI (`--i-know-what-im-doing`), and switches WSL2 to `strict` isolation (`[interop] enabled=false`, `[automount] enabled=false`). |
179
+
180
+ ---
181
+
182
+ ## Windows Build Support Policy
183
+
184
+ We don't like Windows enough to maintain legacy workarounds for EOL operating systems. **Only the latest Windows 11 releases (24H2 / 25H2+, build `>= 26100`) are supported.**
185
+
186
+ | Build Number | OS Release | Support Status |
187
+ | :--- | :--- | :--- |
188
+ | `26200+` | Windows 11 25H2 | **Supported** |
189
+ | `26100` | Windows 11 24H2 | **Supported** |
190
+ | `< 26100` | Older Windows 11 / Windows 10 | **Unsupported (`unsupported_build`)** |
191
+
192
+ ---
193
+
194
+ ## Development & Test Coverage Gate (`uv`)
195
+
196
+ ```bash
197
+ make venv # Create .venv and install dev dependencies via uv
198
+ make lint # ruff check + ruff format --check
199
+ make test # mypy --strict + pytest-cov (enforces >=80% coverage) + badge generation
200
+ make release-check # lint + test + TruffleHog + Trivy
201
+ ```
202
+
203
+ ## Documentation
204
+
205
+ - [Project Roadmap & TODO](TODO.md)
206
+ - [Linux Person's Windows Cheat Sheet](docs/linux-to-windows-cheatsheet.md)
207
+ - [AI Agent Instructions (`AGENTS.md`)](AGENTS.md)
208
+ - [Security Policy (`SECURITY.md`)](SECURITY.md)
209
+ - [Contributing Guide (`CONTRIBUTING.md`)](CONTRIBUTING.md)
210
+
211
+ ---
212
+
213
+ ## 📄 License
214
+
215
+ This project is licensed under the [MIT License](LICENSE).
216
+
217
+ <p align="right">
218
+ <a href="https://www.buymeacoffee.com/olofhellqvc">
219
+ <img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me a Coffee" height="48">
220
+ </a>
221
+ </p>
winbearable-0.1.0/profiles/owner.toml ADDED
@@ -0,0 +1,34 @@
1
+ # winbearable profile: owner
2
+ # Target: Personal or ex-work machine where you have Administrator rights.
3
+ # Inherits all per-user tweaks from user-only.toml and adds machine-wide policy & hardening tweaks.
4
+
5
+ name = "owner"
6
+ extends = "user-only"
7
+ description = "Full-control profile for machine owners: user-only tweaks plus machine-wide OneDrive policy block, Recall/Copilot removal, minimal telemetry, and baseline CIS hardening."
8
+
9
+ [wsl]
10
+ enabled = true
11
+ mode = "convenient"
12
+ networking_mode = "mirrored"
13
+ dns_tunneling = true
14
+ firewall = true
15
+ auto_proxy = true
16
+ systemd = true
17
+
18
+ [tweaks]
19
+ # --- OneDrive (Admin Policy) ---
20
+ # Source: https://learn.microsoft.com/en-us/sharepoint/use-group-policy
21
+ "onedrive.disable_policy" = true
22
+
23
+ # --- AI & Telemetry (Admin Policy) ---
24
+ # Source: https://learn.microsoft.com/en-us/windows/privacy/manage-windows-recall
25
+ "ai.disable_copilot_machine" = true
26
+ "ai.disable_recall" = true
27
+ "privacy.telemetry_minimal" = true
28
+
29
+ # --- Native Hardening (Admin Policy, CIS Benchmark) ---
30
+ "hardening.disable_llmnr" = true
31
+ "hardening.disable_wpad" = true
32
+ "hardening.disable_autorun" = true
33
+ "hardening.powershell_scriptblock_logging" = true
34
+ "hardening.cmdline_process_audit" = true
winbearable-0.1.0/profiles/paranoid.toml ADDED
@@ -0,0 +1,25 @@
1
+ # winbearable profile: paranoid
2
+ # Target: Maximum lockdown for high-security workstations.
3
+ # Inherits owner.toml and adds aggressive service/feature removal, VBS/HVCI, LSA PPL, and strict WSL isolation.
4
+
5
+ name = "paranoid"
6
+ extends = "owner"
7
+ description = "Aggressive lockdown profile: owner tweaks plus OneDrive client removal, WSearch service disable, LSA RunAsPPL, VBS/HVCI enforcement, and strict WSL2 isolation."
8
+
9
+ [wsl]
10
+ enabled = true
11
+ mode = "strict"
12
+ networking_mode = "mirrored"
13
+ dns_tunneling = true
14
+ firewall = true
15
+ auto_proxy = true
16
+ systemd = true
17
+
18
+ [tweaks]
19
+ # --- Aggressive Removals & Services ---
20
+ "onedrive.uninstall" = true
21
+ "search.disable_wsearch_service" = true
22
+
23
+ # --- High-Assurance Native Hardening (Requires --i-know-what-im-doing for high-risk items) ---
24
+ "hardening.enable_lsa_protection" = true
25
+ "hardening.enable_vbs_hvci" = true
winbearable-0.1.0/profiles/user-only.toml ADDED
@@ -0,0 +1,47 @@
1
+ # winbearable profile: user-only
2
+ # Target: Work PC or locked-down Windows 11 account with NO Administrator privileges.
3
+ # Every tweak in this profile operates strictly in HKCU / user scope.
4
+
5
+ name = "user-only"
6
+ description = "Per-user tweaks that require no Administrator privileges: install VS Code + Remote-WSL, kill OneDrive tray/Explorer pin, kill Bing search, ads, widgets, and restore classic Explorer behavior."
7
+
8
+ [wsl]
9
+ enabled = true
10
+ mode = "convenient"
11
+ networking_mode = "mirrored"
12
+ dns_tunneling = true
13
+ firewall = true
14
+ auto_proxy = true
15
+ systemd = true
16
+
17
+ [tweaks]
18
+ # --- Opinionated Developer Apps (No Admin, User Scope via winget) ---
19
+ # Source: https://code.visualstudio.com/docs/remote/wsl
20
+ "apps.install_vscode" = true
21
+
22
+ # --- OneDrive (No Admin) ---
23
+ # Source: https://learn.microsoft.com/en-us/sharepoint/per-machine-installation
24
+ "onedrive.disable_tray_autorun" = true
25
+ "onedrive.unpin_explorer" = true
26
+
27
+ # --- Search & Start Menu (No Admin) ---
28
+ # Source: https://learn.microsoft.com/en-us/windows/configuration/search/
29
+ "search.disable_bing" = true
30
+ "search.disable_highlights" = true
31
+ "search.hide_taskbar_box" = true
32
+ "search.disable_cloud_and_history" = true
33
+ "start.disable_recommendations" = true
34
+
35
+ # --- Taskbar & File Explorer (No Admin) ---
36
+ # Source: https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/
37
+ "taskbar.disable_widgets_and_chat" = true
38
+ "explorer.classic_context_menu" = true
39
+ "explorer.show_file_extensions" = true
40
+ "explorer.show_hidden_files" = true
41
+
42
+ # --- AI, Privacy & Hardening (No Admin) ---
43
+ # Source: https://learn.microsoft.com/en-us/windows/client-management/manage-windows-copilot
44
+ "ai.disable_copilot_user" = true
45
+ "privacy.disable_advertising_id" = true
46
+ "privacy.disable_tailored_experiences" = true
47
+ "hardening.disable_wsh_user" = true