witbitz-code 1.6.10__tar.gz → 1.7.0__tar.gz

{witbitz_code-1.6.10/src/witbitz_code.egg-info → witbitz_code-1.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.6.10
+Version: 1.7.0
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.6.10 → witbitz_code-1.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.6.10"
+version = "1.7.0"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"

{witbitz_code-1.6.10 → witbitz_code-1.7.0}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.6.10"
+__version__ = "1.7.0"

{witbitz_code-1.6.10 → witbitz_code-1.7.0}/src/witbitz_code/connector.py

@@ -41,6 +41,8 @@ from .plugins import notes_plugin_path as default_notes_plugin, notes_root as de
 from .payers import SessionPayers
 from .seen import SEEN_ROUTE, merge_seen, norm_seen
 from .dirs import DIRS_ROUTE, list_dirs
+from . import seccheck
+from .seccheck import SECURITY_ROUTE
 from .mkdir import MKDIR_ROUTE, mkdir_in
 from .pairings import DEFAULT_OPENCODE_URL, hostname, read_env_password
 from .relay import RELAY_URL, Connect, RelayPeer, allowed_event_path, allowed_request, project_response
@@ -157,6 +159,7 @@ class PairingServer:
                  asks_reconcile_ms: float = ASKS_RECONCILE_MS, notes_root: str | None = None,
                  notes_plugin_path: Path | None = None, payers: SessionPayers | None = None) -> None:
         self.pairing = pairing
+        self._security: seccheck.SecurityCheck | None = None  # read on the first ask (seccheck.py)
         # WHO PAYS (payers.py): this pairing's account owns the turns it starts; the proxy bills each call to its owner.
         self._payers = payers
         self._cid = _js.js_string(pairing.get("computerId") or "")
@@ -407,6 +410,14 @@ class PairingServer:
             st, b = list_dirs(path=q.get("path", ""))
             await reply(st, b)
             return
+        # "THIS COMPUTER'S SECURITY" (seccheck.py): the same check as the witbitz-code page, for the account's own Spaces app —
+        # read here, sealed through the relay like every answer, never written to the account's stores. Python only (the Node
+        # download answers 404 and the page says the check is not available there).
+        if bare == SECURITY_ROUTE and m.get("m") == "GET":
+            if self._security is None:
+                self._security = seccheck.SecurityCheck()
+            await reply(200, await asyncio.to_thread(self._security.status))
+            return
         # "NEW FOLDER" (mkdir.py = tools/code-mkdir.mjs): one clean leaf under the folder the picker shows. Answered HERE.
         if bare == MKDIR_ROUTE and m.get("m") == "POST":
             q = dict(urllib.parse.parse_qsl(query, keep_blank_values=True))

witbitz_code-1.7.0/src/witbitz_code/seccheck.py

@@ -0,0 +1,226 @@
+"""THIS COMPUTER'S SECURITY CHECK (the owner, 2026-10-12: infostealers on a desktop — "can the helper check the desktop status
+and recommend what to do" → "Yes"). witbitz-code runs as an ordinary program on the computer, so it can read what a web page
+never can: Windows' antivirus, its settings, the firewall, disk encryption, updates, the account's rights. It READS without
+an administrator; a Fix that changes a setting goes through Windows' own admin prompt (UAC), and nothing changes silently.
+A setting Windows wants changed in its own app (memory integrity: driver checks; BitLocker: a recovery key) opens that page.
+
+It is ADVICE, not proof: malware already running as this user can fake anything a program running as this user reads.
+It finds weak settings before something gets in; it cannot say that nothing has. The page and Spaces say so.
+
+Windows only for now (also from WSL, where it reads the Windows that hosts it). Other systems: {"supported": False}.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import shutil
+import subprocess
+import sys
+import time
+from typing import Callable
+
+SECURITY_ROUTE = "/witbitz/security"  # the connector answers it for the paired Spaces app (connector.py)
+
+# ONE PowerShell read. Every part is guarded: a part Windows refuses reads as null, never as a failure of the whole check.
+PROBE_PS = r"""
+$ErrorActionPreference = 'SilentlyContinue'
+$o = [ordered]@{}
+$s = Get-MpComputerStatus
+if ($s) { $o.defender = [ordered]@{ realtime = [bool]$s.RealTimeProtectionEnabled; behavior = [bool]$s.BehaviorMonitorEnabled;
+  tamper = [bool]$s.IsTamperProtected; sigAgeDays = [int]$s.AntivirusSignatureAge; mode = "$($s.AMRunningMode)" } }
+$p = Get-MpPreference
+if ($p) { $o.prefs = [ordered]@{ cloud = [int]$p.MAPSReporting; pua = [int]$p.PUAProtection; network = [int]$p.EnableNetworkProtection } }
+$o.antivirus = @(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | ForEach-Object {
+  [ordered]@{ name = "$($_.displayName)"; on = ((($_.productState -shr 12) -band 0xF) -eq 1) } })
+$dg = Get-CimInstance -Namespace root/Microsoft/Windows/DeviceGuard -ClassName Win32_DeviceGuard
+if ($dg) { $o.memoryIntegrity = [bool](@($dg.SecurityServicesRunning) -contains 2) }
+$o.firewall = @(Get-NetFirewallProfile | ForEach-Object { [ordered]@{ name = "$($_.Name)"; on = [bool]$_.Enabled } })
+try { $bl = (New-Object -ComObject Shell.Application).NameSpace("$env:SystemDrive\").Self.ExtendedProperty('System.Volume.BitLockerProtection'); if ($bl -ne $null) { $o.bitlocker = [int]$bl } } catch {}
+try { $d = (New-Object -ComObject Microsoft.Update.AutoUpdate).Results.LastInstallationSuccessDate; if ($d) { $o.updateDaysAgo = [int]((Get-Date) - [datetime]$d).TotalDays } } catch {}
+$uac = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
+if ($uac) { $o.uac = [ordered]@{ on = ([int]$uac.EnableLUA -eq 1); prompt = [int]$uac.ConsentPromptBehaviorAdmin } }
+$o.admin = [bool]((whoami /groups /fo csv | Out-String) -match 'S-1-5-32-544')
+$o.os = "$((Get-CimInstance Win32_OperatingSystem).Caption)"
+$o | ConvertTo-Json -Depth 4 -Compress
+"""
+
+# The fixes. "ps" runs ELEVATED through Windows' admin prompt; "open" opens Windows' own page for a setting it checks itself.
+FIXES = {
+    "pua": {"ps": "Set-MpPreference -PUAProtection Enabled"},
+    "network": {"ps": "Set-MpPreference -EnableNetworkProtection Enabled"},
+    "cloud": {"ps": "Set-MpPreference -MAPSReporting Advanced"},
+    "firewall": {"ps": "Set-NetFirewallProfile -All -Enabled True"},
+    "signatures": {"ps": "Update-MpSignature"},
+    "antivirus": {"open": "windowsdefender://threat"},
+    "memoryIntegrity": {"open": "windowsdefender://coreisolation"},
+    "tamper": {"open": "windowsdefender://threatsettings"},
+    "realtime": {"open": "windowsdefender://threatsettings"},
+    "bitlocker": {"open": "ms-settings:deviceencryption"},
+    "updates": {"open": "ms-settings:windowsupdate"},
+}
+
+
+def recommendations(s: dict | None) -> list[dict]:
+    """[{id, ok, title, why, fix?}] — what this computer has and what it should change, plainly. Pure: tests feed it readings."""
+    if not s:
+        return []
+    out: list[dict] = []
+
+    def add(id_: str, ok: bool | None, title: str, why: str = "") -> None:
+        if ok is None:
+            return  # Windows did not say: say nothing rather than guess
+        item = {"id": id_, "ok": bool(ok), "title": title, "why": "" if ok else why}
+        if not ok and id_ in FIXES:
+            item["fix"] = "admin" if "ps" in FIXES[id_] else "open"
+        out.append(item)
+
+    other_av = [a for a in (s.get("antivirus") or []) if a.get("on") and "defender" not in (a.get("name") or "").lower()]
+    d = s.get("defender")
+    if other_av:
+        out.append({"id": "antivirus", "ok": True, "title": f"Antivirus: {other_av[0]['name']}", "why": ""})
+    elif d:
+        add("realtime", d.get("realtime") and d.get("behavior"), "Microsoft Defender real-time protection",
+            "Real-time protection is off — malware can run without being stopped. Turn it on in Windows Security.")
+        add("tamper", d.get("tamper"), "Tamper protection",
+            "Tamper protection is off — malware can turn Defender off before it acts.")
+        age = d.get("sigAgeDays")
+        add("signatures", None if age is None else age <= 3, "Virus definitions",
+            f"Defender's definitions are {age} days old — it will miss newer malware.")
+        p = s.get("prefs") or {}
+        add("cloud", None if p.get("cloud") is None else p["cloud"] >= 1, "Cloud protection",
+            "Cloud protection is off — brand-new malware is recognised much later.")
+        add("pua", None if p.get("pua") is None else p["pua"] == 1, "Blocking unwanted apps",
+            "Bundled and unwanted apps are only logged, not blocked. Stealers often arrive inside them.")
+        add("network", None if p.get("network") is None else p["network"] == 1, "Blocking malicious sites in every app",
+            "Network protection is off — only Edge blocks known malicious sites; other apps and malware can still reach them.")
+    else:
+        out.append({"id": "antivirus", "ok": False, "title": "Antivirus", "why": "No antivirus answered. Open Windows Security and turn Microsoft Defender on.",
+                    "fix": "open"})
+    add("memoryIntegrity", s.get("memoryIntegrity"), "Memory integrity (Core isolation)",
+        "Memory integrity is off — malware that reaches the system's core is much harder to stop. Turning it on needs a restart.")
+    fw = s.get("firewall") or []
+    add("firewall", None if not fw else all(f.get("on") for f in fw), "Firewall",
+        "The firewall is off for: " + ", ".join(f["name"] for f in fw if not f.get("on")) + ".")
+    bl = s.get("bitlocker")
+    add("bitlocker", None if bl is None else bl in (1, 3, 5), "Disk encryption (BitLocker)",
+        "The disk is not encrypted — anyone with the laptop can read it. Turn on device encryption and keep its recovery key safe.")
+    days = s.get("updateDaysAgo")
+    add("updates", None if days is None else days <= 21, "Windows updates",
+        f"Windows last installed updates {days} days ago. Updates close the holes malware uses.")
+    uac = s.get("uac") or {}
+    add("uac", None if not uac else (uac.get("on") and uac.get("prompt") != 0), "Admin prompt (UAC)",
+        "UAC is off or never asks — any program you run gets full control of the computer.")
+    if s.get("admin"):
+        out.append({"id": "adminAccount", "ok": False, "title": "Daily account",
+                    "why": "You use an administrator account every day. A standard account for daily use, with the admin account kept for installs, "
+                           "stops much malware from taking over the whole computer. (Optional, but the strongest single step.)"})
+    return out
+
+
+def summary(items: list[dict]) -> dict:
+    todo = [i for i in items if not i["ok"]]
+    return {"checked": len(items), "todo": len(todo), "titles": [i["title"] for i in todo]}
+
+
+# ── running it ──────────────────────────────────────────────────────────────────────────────────────────────────────
+def _in_wsl() -> bool:
+    try:
+        with open("/proc/version", encoding="utf-8") as f:
+            return "microsoft" in f.read().lower()
+    except OSError:
+        return False
+
+
+def powershell() -> str | None:
+    """The PowerShell that reads Windows: native, or the host's from WSL. None off Windows."""
+    if sys.platform == "win32":
+        return shutil.which("powershell.exe") or shutil.which("powershell") or os.path.join(os.environ.get("SystemRoot", r"C:\Windows"), "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+    if _in_wsl():
+        return shutil.which("powershell.exe") or ("/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe" if os.path.exists("/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe") else None)
+    return None
+
+
+def _run_ps(ps: str, script: str, timeout: int = 60) -> subprocess.CompletedProcess:
+    flags = getattr(subprocess, "CREATE_NO_WINDOW", 0)
+    return subprocess.run([ps, "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script],  # noqa: S603
+                          check=False, stdin=subprocess.DEVNULL, capture_output=True, text=True, errors="replace",
+                          timeout=timeout, creationflags=flags, cwd="/mnt/c" if _in_wsl() and os.path.isdir("/mnt/c") else None)
+
+
+def read_status(run: Callable[[str, str], subprocess.CompletedProcess] = _run_ps, ps: str | None = None) -> dict:
+    ps = ps or powershell()
+    if not ps:
+        return {"supported": False}
+    r = run(ps, PROBE_PS)
+    out = (r.stdout or "").strip().splitlines()
+    try:
+        return {"supported": True, **json.loads(out[-1] if out else "")}
+    except (ValueError, IndexError):
+        return {"supported": True, "error": "Windows did not answer the check" + (f" ({(r.stderr or '').strip()[:120]})" if r.stderr else "")}
+
+
+def fix(item_id: str, run: Callable[[str, str], subprocess.CompletedProcess] = _run_ps, ps: str | None = None) -> dict:
+    """Apply one fix: an admin change through Windows' UAC prompt, or Windows' own page for it. → {ok, why?}"""
+    f = FIXES.get(item_id)
+    ps = ps or powershell()
+    if not f or not ps:
+        return {"ok": False, "why": "nothing here can change that"}
+    if "open" in f:
+        r = run(ps, f"Start-Process '{f['open']}'", 30)
+        return {"ok": r.returncode == 0, "opened": True, **({} if r.returncode == 0 else {"why": "Windows did not open the page"})}
+    # Elevated: Windows shows its admin prompt; -Wait so the check that follows reads the result. A No at the prompt fails Start-Process.
+    inner = f["ps"].replace("'", "''")
+    script = (f"try {{ $p = Start-Process powershell -Verb RunAs -Wait -PassThru -WindowStyle Hidden "
+              f"-ArgumentList '-NoProfile','-Command','{inner}'; exit $p.ExitCode }} catch {{ exit 1223 }}")
+    r = run(ps, script, 300)
+    if r.returncode == 1223:
+        return {"ok": False, "why": "the admin prompt was declined — nothing changed"}
+    return {"ok": r.returncode == 0, **({} if r.returncode == 0 else {"why": f"Windows refused it (code {r.returncode})"})}
+
+
+class SecurityCheck:
+    """{supported, items, summary, at, os, error?} for the page; read at most once a minute, again right after a fix."""
+
+    TTL = 60
+
+    def __init__(self, *, read: Callable[[], dict] | None = None, apply: Callable[[str], dict] | None = None,
+                 now: Callable[[], float] = time.monotonic) -> None:
+        self._read = read or (lambda: read_status())  # looked up at call time
+        self._apply = apply or (lambda i: fix(i))
+        self._now = now
+        self._cache: tuple[float, dict] | None = None
+        self._task: asyncio.Task | None = None
+
+    def status(self, fresh: bool = False) -> dict:
+        if not fresh and self._cache and self._now() - self._cache[0] < self.TTL:
+            return self._cache[1]
+        try:
+            raw = self._read()
+        except Exception as e:  # noqa: BLE001 — a reading, never a failure of the page
+            raw = {"supported": True, "error": f"could not check ({str(e)[:80]})"}
+        if not raw.get("supported"):
+            out = {"supported": False}
+        else:
+            items = recommendations(raw if not raw.get("error") else None)
+            out = {"supported": True, "items": items, "summary": summary(items), "os": raw.get("os") or "",
+                   "at": int(time.time()), **({"error": raw["error"]} if raw.get("error") else {})}
+        self._cache = (self._now(), out)
+        return out
+
+    def peek(self) -> dict:
+        """What the page shows NOW, never waiting on Windows (a read takes seconds): the last reading, and a fresh one started
+        in the background when it is stale. {"checking": True} before the first one lands."""
+        stale = not self._cache or self._now() - self._cache[0] >= self.TTL
+        if stale and not (self._task and not self._task.done()):
+            try:
+                self._task = asyncio.get_running_loop().create_task(asyncio.to_thread(self.status, True))
+            except RuntimeError:
+                pass
+        return self._cache[1] if self._cache else {"checking": True}
+
+    async def fix(self, item_id: str) -> dict:
+        r = await asyncio.to_thread(self._apply, item_id)
+        await asyncio.to_thread(self.status, True)  # the card shows the result at once
+        return r

{witbitz_code-1.6.10 → witbitz_code-1.7.0}/src/witbitz_code/ui.py

@@ -35,7 +35,7 @@ from importlib import resources
 from pathlib import Path
 from typing import Any, Awaitable, Callable
 
-from . import __version__, devicelink, link, net, ports, qr, uitools, uninstall, winbg, wizard, wslstart
+from . import __version__, devicelink, link, net, ports, qr, seccheck, uitools, uninstall, winbg, wizard, wslstart
 from . import pair as pair_cmd
 from . import pairings as pp
 
@@ -127,10 +127,12 @@ class Manager:
                  login_enable: Callable[[dict], tuple] = wslstart.startup_enable,
                  login_disable: Callable[[dict], bool] = wslstart.startup_disable,
                  port_owners: Callable[[int], list] | None = None, stop_pid: Callable[[int], bool] | None = None,
-                 tools: uitools.Tools | None = None, label: dict | None = None, log: deque | None = None) -> None:
+                 tools: uitools.Tools | None = None, label: dict | None = None, log: deque | None = None,
+                 security: seccheck.SecurityCheck | None = None) -> None:
         self._serve, self._is_listening, self._pair, self._link = serve, is_listening, pair, link_node
         self._load, self._keys_line = load_pairings, keys_line
         self.tools = tools or uitools.Tools()
+        self.security = security or seccheck.SecurityCheck()
         self._owners = port_owners or ports.port_owners
         self._stop_pid = stop_pid or uninstall.stop_process
         self._elsewhere_cache: tuple[float, dict | None] | None = None
@@ -214,7 +216,7 @@ class Manager:
                 serving = {"state": "elsewhere", "port": el["port"], "owners": el["owners"]}
         return {"version": __version__, "computer": self.label, "paired": paired, "serving": serving, "pair": pair,
                 "login": self.login(), "busy": self.busy, "background": self.background,
-                "tools": await asyncio.to_thread(self.tools.status), "log": list(self.log)[-14:]}
+                "tools": await asyncio.to_thread(self.tools.status), "security": self.security.peek(), "log": list(self.log)[-14:]}
 
     async def elsewhere(self, fresh: bool = False) -> dict | None:
         """{port, owners} when THIS person's other process holds OpenCode's port or the model proxy's (port + 100) while this
@@ -535,6 +537,7 @@ class Server:
             "/api/login": lambda: self.m.set_login(bool(data.get("on"))),
             "/api/quit": self.m.quit,
             "/api/tools/install": self.m.tools.install,
+            "/api/security/fix": lambda: self.m.security.fix(str(data.get("id") or "")),
         }
         act = actions.get(path)
         if not act:

{witbitz_code-1.6.10 → witbitz_code-1.7.0}/src/witbitz_code/ui_static/app.css

@@ -51,3 +51,11 @@ footer { font-size: 13px; text-align: center; }
 .actions:not(:has(button:not([hidden]))) { display: none; }
 button.small { font-size: 13px; padding: 2px 10px; margin-left: 8px; }
 pre.cmd { background: var(--off-bg); color: var(--text); padding: 8px 10px; border-radius: 8px; }
+/* the security check (seccheck.py) */
+p.small, div.small { font-size: 12.5px; }
+.sec-list { list-style: none; padding: 0; margin: 8px 0; }
+.sec-list li { padding: 8px 0; border-top: 1px solid var(--line, #e5e7eb); }
+.sec-list li:first-child { border-top: 0; }
+.sec-list li.todo .sec-head span { font-weight: 600; }
+.sec-list li.ok { opacity: .7; }
+.sec-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }

{witbitz_code-1.6.10 → witbitz_code-1.7.0}/src/witbitz_code/ui_static/app.js

@@ -97,6 +97,7 @@ function render(s) {
   $('footerText').textContent = s.background ? 'runs in the background — Start menu → Witbitz Code opens this page' : 'keep its window open — closing it stops witbitz-code'
   show($('quit'), !!s.background)
   renderTools(s.tools, paired)
+  renderSecurity(s.security)
 
   $('log').textContent = (s.log || []).join('\n')
 }
@@ -161,6 +162,46 @@ function renderTools(t, paired) {
   $('toolsLog').textContent = lines.join('\n')
 }
 
+// This computer's security check (seccheck.py): what Windows has, what to change, and a Fix for what can be fixed from here.
+function renderSecurity(sec) {
+  const card = $('secCard')
+  if (!sec || sec.supported === false) return show(card, false)
+  show(card, true)
+  const items = sec.items || []
+  const todo = items.filter((i) => !i.ok)
+  $('secText').textContent = sec.checking ? 'Checking Windows…'
+    : sec.error ? sec.error
+    : todo.length ? `${todo.length} ${todo.length === 1 ? 'thing' : 'things'} to change` + (sec.os ? ` · ${sec.os}` : '')
+    : 'Everything checked here is set well ✓' + (sec.os ? ` · ${sec.os}` : '')
+  const list = $('secList')
+  const key = JSON.stringify(items) + '|' + !!(state && state.busy)
+  if (list.dataset.key === key) return
+  list.dataset.key = key
+  list.textContent = ''
+  for (const i of [...todo, ...items.filter((x) => x.ok)]) {
+    const li = document.createElement('li')
+    li.className = i.ok ? 'ok' : 'todo'
+    const head = document.createElement('div')
+    head.className = 'sec-head'
+    const t = document.createElement('span')
+    t.textContent = (i.ok ? '✓ ' : '! ') + i.title
+    head.append(t)
+    if (i.fix) {
+      const b = document.createElement('button')
+      b.type = 'button'
+      b.className = 'small'
+      b.textContent = i.fix === 'admin' ? 'Fix' : 'Open in Windows'
+      b.disabled = !!(state && state.busy)
+      b.onclick = () => act('/api/security/fix', { id: i.id },
+        i.fix === 'admin' ? `Change it now? Windows will ask for permission (an admin prompt) — say Yes there.` : '')
+      head.append(b)
+    }
+    li.append(head)
+    if (i.why) { const w = document.createElement('div'); w.className = 'muted small'; w.textContent = i.why; li.append(w) }
+    list.append(li)
+  }
+}
+
 let quitting = false
 async function quit() {
   if (!window.confirm('Quit Witbitz Code? Code in Spaces will not reach this computer until you open Witbitz Code from the Start menu again.')) return

{witbitz_code-1.6.10 → witbitz_code-1.7.0}/src/witbitz_code/ui_static/index.html

@@ -51,6 +51,14 @@
     <pre id="toolsLog" class="cmd" hidden></pre>
   </section>
 
+  <section class="card" id="secCard" hidden>
+    <h2>This computer's security</h2>
+    <p id="secText" class="muted"></p>
+    <ul id="secList" class="sec-list"></ul>
+    <p class="muted small">A check of Windows' settings, not a malware scan. It finds weak settings before something gets in;
+      malware already running here could hide from it.</p>
+  </section>
+
   <section class="card" id="loginCard" hidden>
     <label class="switch-row" for="login">
       <span>

{witbitz_code-1.6.10 → witbitz_code-1.7.0/src/witbitz_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.6.10
+Version: 1.7.0
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.6.10 → witbitz_code-1.7.0}/src/witbitz_code.egg-info/SOURCES.txt

@@ -38,6 +38,7 @@ src/witbitz_code/ports.py
 src/witbitz_code/qr.py
 src/witbitz_code/receipt.py
 src/witbitz_code/relay.py
+src/witbitz_code/seccheck.py
 src/witbitz_code/seen.py
 src/witbitz_code/tinfoil_read.py
 src/witbitz_code/tools_catalog.json
@@ -87,6 +88,7 @@ tests/test_ports.py
 tests/test_ports_win.py
 tests/test_registry.py
 tests/test_relay_codec.py
+tests/test_seccheck.py
 tests/test_setup.py
 tests/test_tools_probe.py
 tests/test_toolsetup.py

{witbitz_code-1.6.10 → witbitz_code-1.7.0}/tests/test_connector_e2e.py

@@ -893,3 +893,26 @@ def test_a_second_account_cannot_steer_into_a_turn_the_first_one_is_running():
                 await b.peer.aclose()
 
     run(go())
+
+
+def test_the_python_connector_answers_this_computers_security_check(monkeypatch):
+    """GET /witbitz/security (seccheck.py), sealed through the relay like any answer; OpenCode never hears of it."""
+    from witbitz_code import seccheck
+    from test_seccheck import OWNER
+    monkeypatch.setattr(seccheck, "read_status", lambda *a, **k: OWNER)
+
+    async def go():
+        async with Rig() as rig:
+            connector = PyConnector(rig, 2500, attachRoot=str(rig.attach_root))
+            await connector.start()
+            client = PyClient(rig.secret, rig.relay.url)
+            try:
+                await client.start()
+                r = await client.call("GET", "/witbitz/security")
+                body = json.loads(r["b"])
+                assert r["st"] == 200 and body["supported"] is True and body["summary"]["todo"] == 4, body
+                assert not any(h.get("url", "").startswith("/witbitz") for h in rig.oc.seen_copy())
+            finally:
+                await client.peer.aclose()
+                await connector.stop()
+    run(go())

witbitz_code-1.7.0/tests/test_seccheck.py

@@ -0,0 +1,143 @@
+"""This computer's security check (seccheck.py): Windows' readings → plain recommendations; a Fix goes through Windows' admin
+prompt or opens Windows' own page; the page never waits on Windows."""
+
+import asyncio
+import json
+import subprocess
+
+import httpx
+
+from witbitz_code import seccheck
+from test_ui import World, with_server, authed
+
+
+async def until(fn, s=5.0):
+    for _ in range(int(s / 0.05)):
+        if fn():
+            return True
+        await asyncio.sleep(0.05)
+    return False
+
+# The owner's laptop, as read on 2026-10-12 (Windows 11 Pro).
+OWNER = {"supported": True, "defender": {"realtime": True, "behavior": True, "tamper": True, "sigAgeDays": 1, "mode": "Normal"},
+         "prefs": {"cloud": 2, "pua": 2, "network": 0}, "antivirus": [{"name": "Windows Defender", "on": True}],
+         "memoryIntegrity": False, "firewall": [{"name": "Domain", "on": True}, {"name": "Private", "on": True}, {"name": "Public", "on": True}],
+         "bitlocker": 1, "updateDaysAgo": 1, "uac": {"on": True, "prompt": 5}, "admin": True, "os": "Microsoft Windows 11 Pro"}
+
+
+def by_id(items):
+    return {i["id"]: i for i in items}
+
+
+def test_the_owners_laptop_reads_as_the_four_things_to_change():
+    items = by_id(seccheck.recommendations(OWNER))
+    todo = sorted(k for k, v in items.items() if not v["ok"])
+    assert todo == ["adminAccount", "memoryIntegrity", "network", "pua"]
+    assert items["pua"]["fix"] == "admin" and items["network"]["fix"] == "admin"
+    assert items["memoryIntegrity"]["fix"] == "open", "Windows checks drivers first — its own switch, not a registry write"
+    assert "fix" not in items["adminAccount"], "a separate account is advice, never something we change"
+    for k in ("realtime", "tamper", "signatures", "cloud", "firewall", "bitlocker", "updates", "uac"):
+        assert items[k]["ok"] and not items[k]["why"], k
+
+
+def test_another_antivirus_replaces_defenders_rows():
+    s = {**OWNER, "antivirus": [{"name": "Windows Defender", "on": False}, {"name": "ESET Security", "on": True}], "defender": {"realtime": False}}
+    items = by_id(seccheck.recommendations(s))
+    assert items["antivirus"] == {"id": "antivirus", "ok": True, "title": "Antivirus: ESET Security", "why": ""}
+    assert not {"realtime", "pua", "network", "cloud"} & set(items), "Defender is passive there — its settings are not the protection"
+
+
+def test_no_antivirus_at_all_says_so_and_opens_windows_security():
+    items = by_id(seccheck.recommendations({**OWNER, "antivirus": [], "defender": None, "prefs": None}))
+    assert items["antivirus"]["ok"] is False and items["antivirus"]["fix"] == "open"
+
+
+def test_what_windows_did_not_say_is_not_guessed():
+    items = by_id(seccheck.recommendations({"defender": {"realtime": True, "behavior": True, "tamper": True}}))
+    assert set(items) == {"realtime", "tamper"}, items
+
+
+def test_weak_readings_each_get_a_reason():
+    s = {**OWNER, "defender": {**OWNER["defender"], "tamper": False, "sigAgeDays": 9}, "firewall": [{"name": "Public", "on": False}],
+         "bitlocker": 2, "updateDaysAgo": 60, "uac": {"on": True, "prompt": 0}, "admin": False}
+    items = by_id(seccheck.recommendations(s))
+    assert "9 days" in items["signatures"]["why"] and "Public" in items["firewall"]["why"] and "60 days" in items["updates"]["why"]
+    assert not items["bitlocker"]["ok"] and not items["uac"]["ok"] and "adminAccount" not in items
+
+
+def ran(code=0, out=""):
+    calls = []
+
+    def run(ps, script, timeout=60):
+        calls.append(script)
+        return subprocess.CompletedProcess([ps], code, out, "")
+    return run, calls
+
+
+def test_an_admin_fix_runs_elevated_through_the_uac_prompt():
+    run, calls = ran(0)
+    assert seccheck.fix("pua", run=run, ps="powershell.exe") == {"ok": True}
+    assert "-Verb RunAs" in calls[0] and "Set-MpPreference -PUAProtection Enabled" in calls[0]
+
+
+def test_a_declined_prompt_changes_nothing_and_says_so():
+    run, _ = ran(1223)
+    r = seccheck.fix("network", run=run, ps="powershell.exe")
+    assert r["ok"] is False and "declined" in r["why"]
+
+
+def test_an_open_fix_opens_windows_own_page_and_unknown_ids_are_refused():
+    run, calls = ran(0)
+    assert seccheck.fix("memoryIntegrity", run=run, ps="powershell.exe")["opened"] is True
+    assert "windowsdefender://coreisolation" in calls[0]
+    assert seccheck.fix("adminAccount", run=run, ps="powershell.exe")["ok"] is False
+    assert seccheck.fix("rm -rf", run=run, ps="powershell.exe")["ok"] is False and len(calls) == 1
+
+
+def test_the_probe_output_is_read_and_a_garbled_one_is_an_error():
+    run, _ = ran(0, "WARNING: noise\n" + json.dumps({k: v for k, v in OWNER.items() if k != "supported"}))
+    assert seccheck.read_status(run=run, ps="ps")["prefs"]["pua"] == 2
+    run, _ = ran(1, "not json")
+    assert "error" in seccheck.read_status(run=run, ps="ps")
+    assert seccheck.read_status() == {"supported": False}, "no PowerShell (macOS, Linux; and every test): not supported"
+
+
+def test_the_page_never_waits_on_windows():
+    import time
+
+    def slow_read():
+        time.sleep(0.4)
+        return OWNER
+
+    async def main():
+        sc = seccheck.SecurityCheck(read=slow_read)
+        t0 = time.monotonic()
+        assert sc.peek() == {"checking": True} and time.monotonic() - t0 < 0.1
+        await until(lambda: "items" in sc.peek())
+        assert sc.peek()["summary"]["todo"] == 4
+    asyncio.run(main())
+
+
+def test_the_page_shows_the_card_and_fixes_through_the_server():
+    applied = []
+
+    async def main():
+        w = World()
+        m = w.manager()
+        m.security = seccheck.SecurityCheck(read=lambda: OWNER if not applied else {**OWNER, "prefs": {**OWNER["prefs"], "pua": 1}},
+                                           apply=lambda i: applied.append(i) or {"ok": True})
+        srv, base = await with_server(m)
+        try:
+            async with httpx.AsyncClient() as c:
+                await until(lambda: "items" in m.security.peek())
+                s = (await c.get(base + "/api/status", headers=authed(srv))).json()["security"]
+                assert s["summary"]["todo"] == 4
+                r = await c.post(base + "/api/security/fix", headers=authed(srv, **{"content-type": "application/json"}), json={"id": "pua"})
+                assert r.json() == {"ok": True} and applied == ["pua"]
+                s = (await c.get(base + "/api/status", headers=authed(srv))).json()["security"]
+                assert s["summary"]["todo"] == 3, "read again right after the fix"
+                r = await c.post(base + "/api/security/fix", headers={"content-type": "application/json"}, json={"id": "pua"})
+                assert r.status_code in (401, 403), "only the page's own session may change Windows"
+        finally:
+            await srv.close()
+    asyncio.run(main())