witbitz-code 1.6.10__tar.gz → 1.7.1__tar.gz

{witbitz_code-1.6.10/src/witbitz_code.egg-info → witbitz_code-1.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.6.10
+Version: 1.7.1
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.6.10 → witbitz_code-1.7.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.6.10"
+version = "1.7.1"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"

{witbitz_code-1.6.10 → witbitz_code-1.7.1}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.6.10"
+__version__ = "1.7.1"

{witbitz_code-1.6.10 → witbitz_code-1.7.1}/src/witbitz_code/auto_runner.py

@@ -22,6 +22,7 @@ import asyncio
 import math
 import os
 import re
+import secrets
 import stat
 import time
 from collections.abc import Awaitable, Callable
@@ -42,6 +43,15 @@ MAX_USER_MESSAGES = 6
 MAX_DETAIL = 300
 PARENT_TTL_MS = 10 * 60_000
 AGENTS_TTL_MS = 60_000
+# THE REVIEWER'S MODEL (the owner, 2026-10-13: "I am not sure if the auto mode classifier is working correctly"). Reviewed as
+# an OpenCode session with the session's own model, a review carried OpenCode's whole agent prompt (~35k chars) ahead of ours
+# and the model's full reasoning: DeepSeek V4.1 Flash went from a 5 s median to 30 s timeouts, and every ask fell to the
+# person. Where the computer runs the model proxy (`model_url`), the policy is now asked DIRECTLY, of a fixed fast confidential
+# model, with a backup. Measured on 8 cases: GPT-OSS 120B 8/8 in 2.5–3.5 s, DeepSeek V4.1 Flash 8/8 in 5–16 s. Any failure is
+# still the person's. Held equal to tools/code-auto-runner.mjs.
+REVIEW_MODELS = ("openai/gpt-oss-120b", "deepseek/deepseek-v4.1-flash")
+REVIEW_TIMEOUT_MS = 45_000  # the whole review, backup included
+FIRST_TRY_MS = 20_000  # the first model's share, so a hung one leaves the backup time to answer
 MAX_DEPTH = 4  # parent links followed looking for the session in Auto
 REFUSAL_SUFFIX = "(Witbitz Auto mode refused this — try a narrower or safer step.)"
 _UNKNOWN = object()  # OpenCode could not say who a session's parent is (not cached)
@@ -107,11 +117,15 @@ def scratch_on_disk(paths: list[str], directory: str = SCRATCH_DIR) -> bool:
 
 class AutoRunner:
     def __init__(self, *, base: str, auth: Callable[[], dict], client: httpx.AsyncClient, state_path: Path | None,
-                 log_path: Path | None, poll_ms: float = 1000, review_timeout_ms: float = 30_000, home: str | None = None,
+                 log_path: Path | None, poll_ms: float = 1000, review_timeout_ms: float = REVIEW_TIMEOUT_MS, home: str | None = None,
                  on_verdict: Callable[[dict], Any] = lambda v: None, log: Callable[[str], Any] = lambda m: None,
                  now: Callable[[], int] = _now_ms, scratch_check: Callable[[list[str]], bool] = scratch_on_disk,
                  list_asks: Callable[[str], Awaitable[list | None]] | None = None,
-                 on_review: Callable[[str, bool], Any] | None = None) -> None:
+                 on_review: Callable[[str, bool], Any] | None = None, model_url: str = "",
+                 review_models: tuple[str, ...] | list[str] = REVIEW_MODELS, first_try_ms: float = FIRST_TRY_MS) -> None:
+        self._model_url = re.sub(r"/+\Z", "", model_url or "")
+        self._review_models = list(review_models)
+        self._first_try_ms = first_try_ms
         self._root = re.sub(r"/+\Z", "", base or "")
         # The review session's model calls are billed to the account that turned Auto on (payers.py): told when the
         # review opens and closes, since nothing from the Spaces app ever posts into it.
@@ -291,8 +305,60 @@ class AutoRunner:
             return []
         return allowed_folders(data.get("permission")) if ok and isinstance(data, dict) else []
 
+    async def _ask_model(self, m: str, prompt: dict, rid: str) -> tuple[dict | None, str]:
+        body = {"model": m, "messages": [{"role": "system", "content": prompt["system"]}, {"role": "user", "content": prompt["text"]}],
+                "max_tokens": 1500, "reasoning_effort": "low", "stream": False}
+        r = await self._client.post(f"{self._model_url}/chat/completions", headers={"content-type": "application/json", "x-session-id": rid},
+                                    content=_js.utf8(_js.stringify(body)))
+        try:
+            data = _js.parse(r.text)
+        except ValueError:
+            data = None
+        choices = data.get("choices") if isinstance(data, dict) and isinstance(data.get("choices"), list) else []
+        msg = choices[0].get("message") if choices and isinstance(choices[0], dict) and isinstance(choices[0].get("message"), dict) else {}
+        text = msg.get("content") if 200 <= r.status_code < 300 and isinstance(msg.get("content"), str) else ""
+        verdict = parse_verdict(text) if text else None
+        if verdict:
+            return verdict, ""
+        return None, f"answered {r.status_code}" if not 200 <= r.status_code < 300 else "no verdict in its answer" if text else "no answer"
+
+    async def _review_direct(self, prompt: dict) -> tuple[dict | None, str, str]:
+        """Ask the policy of the review models in turn, through the computer's model proxy (billed like the session: on_review)."""
+        rid = "ses_review_" + secrets.token_urlsafe(9)
+        until = time.monotonic() + self._review_timeout_ms / 1000
+        notes: list[str] = []
+        if self._on_review:
+            self._on_review(rid, True)
+        try:
+            for i, m in enumerate(self._review_models):
+                left = until - time.monotonic()
+                if left <= 0:
+                    break
+                limit = left if i == len(self._review_models) - 1 else min(left, self._first_try_ms / 1000)
+                try:
+                    verdict, why = await asyncio.wait_for(self._ask_model(m, prompt, rid), limit)
+                except asyncio.TimeoutError:
+                    verdict, why = None, "did not answer in time"
+                except asyncio.CancelledError:
+                    raise
+                except Exception:
+                    verdict, why = None, "could not be reached"
+                if verdict:
+                    return verdict, f"trustedrouter/{m}", ""
+                notes.append(f"{m}: {why}")
+        finally:
+            if self._on_review:
+                self._on_review(rid, False)
+        first = self._review_models[0] if self._review_models else ""
+        secs = math.floor(self._review_timeout_ms / 1000 + 0.5) or 1
+        return None, f"trustedrouter/{first}", f"the reviewer did not answer ({'; '.join(notes) or f'nothing within {secs} s'})"
+
     async def _review(self, req: dict, directory: str, owner: str | None = None, folders: list[str] | None = None) -> tuple[dict | None, str, str]:
         model, user_messages, tools = await self._session_context(owner or req["sessionID"], directory)
+        if self._model_url and self._review_models:
+            call = req.get("tool") if isinstance(req.get("tool"), dict) else {}
+            tool = tools.get(call["callID"], "") if isinstance(call.get("callID"), str) else ""
+            return await self._review_direct(reviewer_prompt(req, directory, user_messages, tool, folders or []))
         if not model:
             return None, "", "the session has no model to review with yet"
         label = f"{_js.js_string(model['providerID'])}/{_js.js_string(model['modelID'])}"

{witbitz_code-1.6.10 → witbitz_code-1.7.1}/src/witbitz_code/cli.py

@@ -261,7 +261,8 @@ async def serve(args: list[str], *, stop: Any = None, live_out: dict | None = No
             return 0
         if child is not None:
             _err("witbitz-code: model calls are paid by each account's own coding keys; confidential models are enforced (min_privacy + verified receipts)")
-        connector = await start_connector(pairings, payers=payers)
+        # Auto mode's reviewer asks the policy of the model proxy directly (auto_runner.REVIEW_MODELS), billed like the session.
+        connector = await start_connector(pairings, payers=payers, model_url=f"http://127.0.0.1:{proxy.port}/v1" if proxy else "")
         live["status"] = asyncio.ensure_future(_check_keys_every(live_keys, keys_http))
         live["connector"] = connector
         if live_out is not None:

{witbitz_code-1.6.10 → witbitz_code-1.7.1}/src/witbitz_code/connector.py

@@ -41,6 +41,8 @@ from .plugins import notes_plugin_path as default_notes_plugin, notes_root as de
 from .payers import SessionPayers
 from .seen import SEEN_ROUTE, merge_seen, norm_seen
 from .dirs import DIRS_ROUTE, list_dirs
+from . import seccheck
+from .seccheck import SECURITY_ROUTE
 from .mkdir import MKDIR_ROUTE, mkdir_in
 from .pairings import DEFAULT_OPENCODE_URL, hostname, read_env_password
 from .relay import RELAY_URL, Connect, RelayPeer, allowed_event_path, allowed_request, project_response
@@ -155,8 +157,10 @@ class PairingServer:
                  max_response_bytes: int = MAX_RESPONSE, auto_dir: Path | None = None, auto_poll_ms: float = 1000,
                  attach_root: Path | None = None, attach_max_file_bytes: int = MAX_FILE_BYTES,
                  asks_reconcile_ms: float = ASKS_RECONCILE_MS, notes_root: str | None = None,
-                 notes_plugin_path: Path | None = None, payers: SessionPayers | None = None) -> None:
+                 notes_plugin_path: Path | None = None, payers: SessionPayers | None = None,
+                 model_url: str = "") -> None:
         self.pairing = pairing
+        self._security: seccheck.SecurityCheck | None = None  # read on the first ask (seccheck.py)
         # WHO PAYS (payers.py): this pairing's account owns the turns it starts; the proxy bills each call to its owner.
         self._payers = payers
         self._cid = _js.js_string(pairing.get("computerId") or "")
@@ -209,7 +213,8 @@ class PairingServer:
         self.auto = AutoRunner(base=self.base, auth=self._auth, client=client, poll_ms=auto_poll_ms, log=log,
                                state_path=auto_dir / f"auto-{safe_id}.json", log_path=auto_dir / "auto-log.jsonl",
                                on_verdict=lambda v: self.peer.send({"t": "autoverdict", **v, "ts": int(time.time() * 1000)}),
-                               list_asks=self._pending_asks, on_review=self._own_review)
+                               list_asks=self._pending_asks, on_review=self._own_review,
+                               model_url=model_url)  # the reviewer asks the model proxy directly (auto_runner.REVIEW_MODELS)
 
     # ── lifecycle ─────────────────────────────────────────────────────────────────────────────────────────────────────
     async def start(self) -> None:
@@ -407,6 +412,14 @@ class PairingServer:
             st, b = list_dirs(path=q.get("path", ""))
             await reply(st, b)
             return
+        # "THIS COMPUTER'S SECURITY" (seccheck.py): the same check as the witbitz-code page, for the account's own Spaces app —
+        # read here, sealed through the relay like every answer, never written to the account's stores. Python only (the Node
+        # download answers 404 and the page says the check is not available there).
+        if bare == SECURITY_ROUTE and m.get("m") == "GET":
+            if self._security is None:
+                self._security = seccheck.SecurityCheck()
+            await reply(200, await asyncio.to_thread(self._security.status))
+            return
         # "NEW FOLDER" (mkdir.py = tools/code-mkdir.mjs): one clean leaf under the folder the picker shows. Answered HERE.
         if bare == MKDIR_ROUTE and m.get("m") == "POST":
             q = dict(urllib.parse.parse_qsl(query, keep_blank_values=True))
@@ -869,7 +882,8 @@ async def start_connector(pairings: list[dict], *, flush_ms: float = 120, log: C
                           max_response_bytes: int = MAX_RESPONSE, auto_dir: Path | None = None, auto_poll_ms: float = 1000,
                           attach_root: Path | None = None, attach_max_file_bytes: int = MAX_FILE_BYTES,
                           asks_reconcile_ms: float = ASKS_RECONCILE_MS, notes_root: str | None = None,
-                          notes_plugin_path: Path | None = None, payers: SessionPayers | None = None) -> Connector:
+                          notes_plugin_path: Path | None = None, payers: SessionPayers | None = None,
+                          model_url: str = "") -> Connector:
     """Serve the given pairings until stop()/aclose(). Options exist for tests: flush_ms, log, client, connect,
     request_timeout_ms, max_senders, max_response_bytes, auto_dir, auto_poll_ms."""
     client = client or local_client()
@@ -884,7 +898,7 @@ async def start_connector(pairings: list[dict], *, flush_ms: float = 120, log: C
         s = PairingServer(p, client=client, flush_ms=flush_ms, log=log, connect=connect, request_timeout_ms=request_timeout_ms,
                           max_senders=max_senders, max_response_bytes=max_response_bytes, auto_dir=auto_dir, auto_poll_ms=auto_poll_ms,
                           attach_root=attach_root, attach_max_file_bytes=attach_max_file_bytes, asks_reconcile_ms=asks_reconcile_ms,
-                          notes_root=notes_root, notes_plugin_path=notes_plugin_path, payers=payers)
+                          notes_root=notes_root, notes_plugin_path=notes_plugin_path, payers=payers, model_url=model_url)
         await s.start()
         servers.append(s)
     return Connector(servers, client, payers)

witbitz_code-1.7.1/src/witbitz_code/seccheck.py

@@ -0,0 +1,226 @@
+"""THIS COMPUTER'S SECURITY CHECK (the owner, 2026-10-12: infostealers on a desktop — "can the helper check the desktop status
+and recommend what to do" → "Yes"). witbitz-code runs as an ordinary program on the computer, so it can read what a web page
+never can: Windows' antivirus, its settings, the firewall, disk encryption, updates, the account's rights. It READS without
+an administrator; a Fix that changes a setting goes through Windows' own admin prompt (UAC), and nothing changes silently.
+A setting Windows wants changed in its own app (memory integrity: driver checks; BitLocker: a recovery key) opens that page.
+
+It is ADVICE, not proof: malware already running as this user can fake anything a program running as this user reads.
+It finds weak settings before something gets in; it cannot say that nothing has. The page and Spaces say so.
+
+Windows only for now (also from WSL, where it reads the Windows that hosts it). Other systems: {"supported": False}.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import shutil
+import subprocess
+import sys
+import time
+from typing import Callable
+
+SECURITY_ROUTE = "/witbitz/security"  # the connector answers it for the paired Spaces app (connector.py)
+
+# ONE PowerShell read. Every part is guarded: a part Windows refuses reads as null, never as a failure of the whole check.
+PROBE_PS = r"""
+$ErrorActionPreference = 'SilentlyContinue'
+$o = [ordered]@{}
+$s = Get-MpComputerStatus
+if ($s) { $o.defender = [ordered]@{ realtime = [bool]$s.RealTimeProtectionEnabled; behavior = [bool]$s.BehaviorMonitorEnabled;
+  tamper = [bool]$s.IsTamperProtected; sigAgeDays = [int]$s.AntivirusSignatureAge; mode = "$($s.AMRunningMode)" } }
+$p = Get-MpPreference
+if ($p) { $o.prefs = [ordered]@{ cloud = [int]$p.MAPSReporting; pua = [int]$p.PUAProtection; network = [int]$p.EnableNetworkProtection } }
+$o.antivirus = @(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | ForEach-Object {
+  [ordered]@{ name = "$($_.displayName)"; on = ((($_.productState -shr 12) -band 0xF) -eq 1) } })
+$dg = Get-CimInstance -Namespace root/Microsoft/Windows/DeviceGuard -ClassName Win32_DeviceGuard
+if ($dg) { $o.memoryIntegrity = [bool](@($dg.SecurityServicesRunning) -contains 2) }
+$o.firewall = @(Get-NetFirewallProfile | ForEach-Object { [ordered]@{ name = "$($_.Name)"; on = [bool]$_.Enabled } })
+try { $bl = (New-Object -ComObject Shell.Application).NameSpace("$env:SystemDrive\").Self.ExtendedProperty('System.Volume.BitLockerProtection'); if ($bl -ne $null) { $o.bitlocker = [int]$bl } } catch {}
+try { $d = (New-Object -ComObject Microsoft.Update.AutoUpdate).Results.LastInstallationSuccessDate; if ($d) { $o.updateDaysAgo = [int]((Get-Date) - [datetime]$d).TotalDays } } catch {}
+$uac = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
+if ($uac) { $o.uac = [ordered]@{ on = ([int]$uac.EnableLUA -eq 1); prompt = [int]$uac.ConsentPromptBehaviorAdmin } }
+$o.admin = [bool]((whoami /groups /fo csv | Out-String) -match 'S-1-5-32-544')
+$o.os = "$((Get-CimInstance Win32_OperatingSystem).Caption)"
+$o | ConvertTo-Json -Depth 4 -Compress
+"""
+
+# The fixes. "ps" runs ELEVATED through Windows' admin prompt; "open" opens Windows' own page for a setting it checks itself.
+FIXES = {
+    "pua": {"ps": "Set-MpPreference -PUAProtection Enabled"},
+    "network": {"ps": "Set-MpPreference -EnableNetworkProtection Enabled"},
+    "cloud": {"ps": "Set-MpPreference -MAPSReporting Advanced"},
+    "firewall": {"ps": "Set-NetFirewallProfile -All -Enabled True"},
+    "signatures": {"ps": "Update-MpSignature"},
+    "antivirus": {"open": "windowsdefender://threat"},
+    "memoryIntegrity": {"open": "windowsdefender://coreisolation"},
+    "tamper": {"open": "windowsdefender://threatsettings"},
+    "realtime": {"open": "windowsdefender://threatsettings"},
+    "bitlocker": {"open": "ms-settings:deviceencryption"},
+    "updates": {"open": "ms-settings:windowsupdate"},
+}
+
+
+def recommendations(s: dict | None) -> list[dict]:
+    """[{id, ok, title, why, fix?}] — what this computer has and what it should change, plainly. Pure: tests feed it readings."""
+    if not s:
+        return []
+    out: list[dict] = []
+
+    def add(id_: str, ok: bool | None, title: str, why: str = "") -> None:
+        if ok is None:
+            return  # Windows did not say: say nothing rather than guess
+        item = {"id": id_, "ok": bool(ok), "title": title, "why": "" if ok else why}
+        if not ok and id_ in FIXES:
+            item["fix"] = "admin" if "ps" in FIXES[id_] else "open"
+        out.append(item)
+
+    other_av = [a for a in (s.get("antivirus") or []) if a.get("on") and "defender" not in (a.get("name") or "").lower()]
+    d = s.get("defender")
+    if other_av:
+        out.append({"id": "antivirus", "ok": True, "title": f"Antivirus: {other_av[0]['name']}", "why": ""})
+    elif d:
+        add("realtime", d.get("realtime") and d.get("behavior"), "Microsoft Defender real-time protection",
+            "Real-time protection is off — malware can run without being stopped. Turn it on in Windows Security.")
+        add("tamper", d.get("tamper"), "Tamper protection",
+            "Tamper protection is off — malware can turn Defender off before it acts.")
+        age = d.get("sigAgeDays")
+        add("signatures", None if age is None else age <= 3, "Virus definitions",
+            f"Defender's definitions are {age} days old — it will miss newer malware.")
+        p = s.get("prefs") or {}
+        add("cloud", None if p.get("cloud") is None else p["cloud"] >= 1, "Cloud protection",
+            "Cloud protection is off — brand-new malware is recognised much later.")
+        add("pua", None if p.get("pua") is None else p["pua"] == 1, "Blocking unwanted apps",
+            "Bundled and unwanted apps are only logged, not blocked. Stealers often arrive inside them.")
+        add("network", None if p.get("network") is None else p["network"] == 1, "Blocking malicious sites in every app",
+            "Network protection is off — only Edge blocks known malicious sites; other apps and malware can still reach them.")
+    else:
+        out.append({"id": "antivirus", "ok": False, "title": "Antivirus", "why": "No antivirus answered. Open Windows Security and turn Microsoft Defender on.",
+                    "fix": "open"})
+    add("memoryIntegrity", s.get("memoryIntegrity"), "Memory integrity (Core isolation)",
+        "Memory integrity is off — malware that reaches the system's core is much harder to stop. Turning it on needs a restart.")
+    fw = s.get("firewall") or []
+    add("firewall", None if not fw else all(f.get("on") for f in fw), "Firewall",
+        "The firewall is off for: " + ", ".join(f["name"] for f in fw if not f.get("on")) + ".")
+    bl = s.get("bitlocker")
+    add("bitlocker", None if bl is None else bl in (1, 3, 5), "Disk encryption (BitLocker)",
+        "The disk is not encrypted — anyone with the laptop can read it. Turn on device encryption and keep its recovery key safe.")
+    days = s.get("updateDaysAgo")
+    add("updates", None if days is None else days <= 21, "Windows updates",
+        f"Windows last installed updates {days} days ago. Updates close the holes malware uses.")
+    uac = s.get("uac") or {}
+    add("uac", None if not uac else (uac.get("on") and uac.get("prompt") != 0), "Admin prompt (UAC)",
+        "UAC is off or never asks — any program you run gets full control of the computer.")
+    if s.get("admin"):
+        out.append({"id": "adminAccount", "ok": False, "title": "Daily account",
+                    "why": "You use an administrator account every day. A standard account for daily use, with the admin account kept for installs, "
+                           "stops much malware from taking over the whole computer. (Optional, but the strongest single step.)"})
+    return out
+
+
+def summary(items: list[dict]) -> dict:
+    todo = [i for i in items if not i["ok"]]
+    return {"checked": len(items), "todo": len(todo), "titles": [i["title"] for i in todo]}
+
+
+# ── running it ──────────────────────────────────────────────────────────────────────────────────────────────────────
+def _in_wsl() -> bool:
+    try:
+        with open("/proc/version", encoding="utf-8") as f:
+            return "microsoft" in f.read().lower()
+    except OSError:
+        return False
+
+
+def powershell() -> str | None:
+    """The PowerShell that reads Windows: native, or the host's from WSL. None off Windows."""
+    if sys.platform == "win32":
+        return shutil.which("powershell.exe") or shutil.which("powershell") or os.path.join(os.environ.get("SystemRoot", r"C:\Windows"), "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+    if _in_wsl():
+        return shutil.which("powershell.exe") or ("/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe" if os.path.exists("/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe") else None)
+    return None
+
+
+def _run_ps(ps: str, script: str, timeout: int = 60) -> subprocess.CompletedProcess:
+    flags = getattr(subprocess, "CREATE_NO_WINDOW", 0)
+    return subprocess.run([ps, "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script],  # noqa: S603
+                          check=False, stdin=subprocess.DEVNULL, capture_output=True, text=True, errors="replace",
+                          timeout=timeout, creationflags=flags, cwd="/mnt/c" if _in_wsl() and os.path.isdir("/mnt/c") else None)
+
+
+def read_status(run: Callable[[str, str], subprocess.CompletedProcess] = _run_ps, ps: str | None = None) -> dict:
+    ps = ps or powershell()
+    if not ps:
+        return {"supported": False}
+    r = run(ps, PROBE_PS)
+    out = (r.stdout or "").strip().splitlines()
+    try:
+        return {"supported": True, **json.loads(out[-1] if out else "")}
+    except (ValueError, IndexError):
+        return {"supported": True, "error": "Windows did not answer the check" + (f" ({(r.stderr or '').strip()[:120]})" if r.stderr else "")}
+
+
+def fix(item_id: str, run: Callable[[str, str], subprocess.CompletedProcess] = _run_ps, ps: str | None = None) -> dict:
+    """Apply one fix: an admin change through Windows' UAC prompt, or Windows' own page for it. → {ok, why?}"""
+    f = FIXES.get(item_id)
+    ps = ps or powershell()
+    if not f or not ps:
+        return {"ok": False, "why": "nothing here can change that"}
+    if "open" in f:
+        r = run(ps, f"Start-Process '{f['open']}'", 30)
+        return {"ok": r.returncode == 0, "opened": True, **({} if r.returncode == 0 else {"why": "Windows did not open the page"})}
+    # Elevated: Windows shows its admin prompt; -Wait so the check that follows reads the result. A No at the prompt fails Start-Process.
+    inner = f["ps"].replace("'", "''")
+    script = (f"try {{ $p = Start-Process powershell -Verb RunAs -Wait -PassThru -WindowStyle Hidden "
+              f"-ArgumentList '-NoProfile','-Command','{inner}'; exit $p.ExitCode }} catch {{ exit 1223 }}")
+    r = run(ps, script, 300)
+    if r.returncode == 1223:
+        return {"ok": False, "why": "the admin prompt was declined — nothing changed"}
+    return {"ok": r.returncode == 0, **({} if r.returncode == 0 else {"why": f"Windows refused it (code {r.returncode})"})}
+
+
+class SecurityCheck:
+    """{supported, items, summary, at, os, error?} for the page; read at most once a minute, again right after a fix."""
+
+    TTL = 60
+
+    def __init__(self, *, read: Callable[[], dict] | None = None, apply: Callable[[str], dict] | None = None,
+                 now: Callable[[], float] = time.monotonic) -> None:
+        self._read = read or (lambda: read_status())  # looked up at call time
+        self._apply = apply or (lambda i: fix(i))
+        self._now = now
+        self._cache: tuple[float, dict] | None = None
+        self._task: asyncio.Task | None = None
+
+    def status(self, fresh: bool = False) -> dict:
+        if not fresh and self._cache and self._now() - self._cache[0] < self.TTL:
+            return self._cache[1]
+        try:
+            raw = self._read()
+        except Exception as e:  # noqa: BLE001 — a reading, never a failure of the page
+            raw = {"supported": True, "error": f"could not check ({str(e)[:80]})"}
+        if not raw.get("supported"):
+            out = {"supported": False}
+        else:
+            items = recommendations(raw if not raw.get("error") else None)
+            out = {"supported": True, "items": items, "summary": summary(items), "os": raw.get("os") or "",
+                   "at": int(time.time()), **({"error": raw["error"]} if raw.get("error") else {})}
+        self._cache = (self._now(), out)
+        return out
+
+    def peek(self) -> dict:
+        """What the page shows NOW, never waiting on Windows (a read takes seconds): the last reading, and a fresh one started
+        in the background when it is stale. {"checking": True} before the first one lands."""
+        stale = not self._cache or self._now() - self._cache[0] >= self.TTL
+        if stale and not (self._task and not self._task.done()):
+            try:
+                self._task = asyncio.get_running_loop().create_task(asyncio.to_thread(self.status, True))
+            except RuntimeError:
+                pass
+        return self._cache[1] if self._cache else {"checking": True}
+
+    async def fix(self, item_id: str) -> dict:
+        r = await asyncio.to_thread(self._apply, item_id)
+        await asyncio.to_thread(self.status, True)  # the card shows the result at once
+        return r

{witbitz_code-1.6.10 → witbitz_code-1.7.1}/src/witbitz_code/ui.py

@@ -35,7 +35,7 @@ from importlib import resources
 from pathlib import Path
 from typing import Any, Awaitable, Callable
 
-from . import __version__, devicelink, link, net, ports, qr, uitools, uninstall, winbg, wizard, wslstart
+from . import __version__, devicelink, link, net, ports, qr, seccheck, uitools, uninstall, winbg, wizard, wslstart
 from . import pair as pair_cmd
 from . import pairings as pp
 
@@ -127,10 +127,12 @@ class Manager:
                  login_enable: Callable[[dict], tuple] = wslstart.startup_enable,
                  login_disable: Callable[[dict], bool] = wslstart.startup_disable,
                  port_owners: Callable[[int], list] | None = None, stop_pid: Callable[[int], bool] | None = None,
-                 tools: uitools.Tools | None = None, label: dict | None = None, log: deque | None = None) -> None:
+                 tools: uitools.Tools | None = None, label: dict | None = None, log: deque | None = None,
+                 security: seccheck.SecurityCheck | None = None) -> None:
         self._serve, self._is_listening, self._pair, self._link = serve, is_listening, pair, link_node
         self._load, self._keys_line = load_pairings, keys_line
         self.tools = tools or uitools.Tools()
+        self.security = security or seccheck.SecurityCheck()
         self._owners = port_owners or ports.port_owners
         self._stop_pid = stop_pid or uninstall.stop_process
         self._elsewhere_cache: tuple[float, dict | None] | None = None
@@ -214,7 +216,7 @@ class Manager:
                 serving = {"state": "elsewhere", "port": el["port"], "owners": el["owners"]}
         return {"version": __version__, "computer": self.label, "paired": paired, "serving": serving, "pair": pair,
                 "login": self.login(), "busy": self.busy, "background": self.background,
-                "tools": await asyncio.to_thread(self.tools.status), "log": list(self.log)[-14:]}
+                "tools": await asyncio.to_thread(self.tools.status), "security": self.security.peek(), "log": list(self.log)[-14:]}
 
     async def elsewhere(self, fresh: bool = False) -> dict | None:
         """{port, owners} when THIS person's other process holds OpenCode's port or the model proxy's (port + 100) while this
@@ -535,6 +537,7 @@ class Server:
             "/api/login": lambda: self.m.set_login(bool(data.get("on"))),
             "/api/quit": self.m.quit,
             "/api/tools/install": self.m.tools.install,
+            "/api/security/fix": lambda: self.m.security.fix(str(data.get("id") or "")),
         }
         act = actions.get(path)
         if not act:

{witbitz_code-1.6.10 → witbitz_code-1.7.1}/src/witbitz_code/ui_static/app.css

@@ -51,3 +51,11 @@ footer { font-size: 13px; text-align: center; }
 .actions:not(:has(button:not([hidden]))) { display: none; }
 button.small { font-size: 13px; padding: 2px 10px; margin-left: 8px; }
 pre.cmd { background: var(--off-bg); color: var(--text); padding: 8px 10px; border-radius: 8px; }
+/* the security check (seccheck.py) */
+p.small, div.small { font-size: 12.5px; }
+.sec-list { list-style: none; padding: 0; margin: 8px 0; }
+.sec-list li { padding: 8px 0; border-top: 1px solid var(--line, #e5e7eb); }
+.sec-list li:first-child { border-top: 0; }
+.sec-list li.todo .sec-head span { font-weight: 600; }
+.sec-list li.ok { opacity: .7; }
+.sec-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }

{witbitz_code-1.6.10 → witbitz_code-1.7.1}/src/witbitz_code/ui_static/app.js

@@ -97,6 +97,7 @@ function render(s) {
   $('footerText').textContent = s.background ? 'runs in the background — Start menu → Witbitz Code opens this page' : 'keep its window open — closing it stops witbitz-code'
   show($('quit'), !!s.background)
   renderTools(s.tools, paired)
+  renderSecurity(s.security)
 
   $('log').textContent = (s.log || []).join('\n')
 }
@@ -161,6 +162,46 @@ function renderTools(t, paired) {
   $('toolsLog').textContent = lines.join('\n')
 }
 
+// This computer's security check (seccheck.py): what Windows has, what to change, and a Fix for what can be fixed from here.
+function renderSecurity(sec) {
+  const card = $('secCard')
+  if (!sec || sec.supported === false) return show(card, false)
+  show(card, true)
+  const items = sec.items || []
+  const todo = items.filter((i) => !i.ok)
+  $('secText').textContent = sec.checking ? 'Checking Windows…'
+    : sec.error ? sec.error
+    : todo.length ? `${todo.length} ${todo.length === 1 ? 'thing' : 'things'} to change` + (sec.os ? ` · ${sec.os}` : '')
+    : 'Everything checked here is set well ✓' + (sec.os ? ` · ${sec.os}` : '')
+  const list = $('secList')
+  const key = JSON.stringify(items) + '|' + !!(state && state.busy)
+  if (list.dataset.key === key) return
+  list.dataset.key = key
+  list.textContent = ''
+  for (const i of [...todo, ...items.filter((x) => x.ok)]) {
+    const li = document.createElement('li')
+    li.className = i.ok ? 'ok' : 'todo'
+    const head = document.createElement('div')
+    head.className = 'sec-head'
+    const t = document.createElement('span')
+    t.textContent = (i.ok ? '✓ ' : '! ') + i.title
+    head.append(t)
+    if (i.fix) {
+      const b = document.createElement('button')
+      b.type = 'button'
+      b.className = 'small'
+      b.textContent = i.fix === 'admin' ? 'Fix' : 'Open in Windows'
+      b.disabled = !!(state && state.busy)
+      b.onclick = () => act('/api/security/fix', { id: i.id },
+        i.fix === 'admin' ? `Change it now? Windows will ask for permission (an admin prompt) — say Yes there.` : '')
+      head.append(b)
+    }
+    li.append(head)
+    if (i.why) { const w = document.createElement('div'); w.className = 'muted small'; w.textContent = i.why; li.append(w) }
+    list.append(li)
+  }
+}
+
 let quitting = false
 async function quit() {
   if (!window.confirm('Quit Witbitz Code? Code in Spaces will not reach this computer until you open Witbitz Code from the Start menu again.')) return

{witbitz_code-1.6.10 → witbitz_code-1.7.1}/src/witbitz_code/ui_static/index.html

@@ -51,6 +51,14 @@
     <pre id="toolsLog" class="cmd" hidden></pre>
   </section>
 
+  <section class="card" id="secCard" hidden>
+    <h2>This computer's security</h2>
+    <p id="secText" class="muted"></p>
+    <ul id="secList" class="sec-list"></ul>
+    <p class="muted small">A check of Windows' settings, not a malware scan. It finds weak settings before something gets in;
+      malware already running here could hide from it.</p>
+  </section>
+
   <section class="card" id="loginCard" hidden>
     <label class="switch-row" for="login">
       <span>

{witbitz_code-1.6.10 → witbitz_code-1.7.1}/src/witbitz_code/uninstall.py

@@ -302,7 +302,7 @@ def remove_opencode_program(info: dict) -> dict:
     return {"ok": False, "why": f"{info['path']} is still there", "said": said} if os.path.exists(info["path"]) else {"ok": True, "said": said}
 
 
-WINDOWS_REINSTALL = "irm https://app.witbitz.chat/code.ps1 | iex"
+WINDOWS_REINSTALL = "the install lines at https://witbitz.chat/code (or Code in your Spaces app)"  # app-neutral: each app serves its own code.ps1
 
 
 def windows_installer_root() -> str:

{witbitz_code-1.6.10 → witbitz_code-1.7.1/src/witbitz_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.6.10
+Version: 1.7.1
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.6.10 → witbitz_code-1.7.1}/src/witbitz_code.egg-info/SOURCES.txt

@@ -38,6 +38,7 @@ src/witbitz_code/ports.py
 src/witbitz_code/qr.py
 src/witbitz_code/receipt.py
 src/witbitz_code/relay.py
+src/witbitz_code/seccheck.py
 src/witbitz_code/seen.py
 src/witbitz_code/tinfoil_read.py
 src/witbitz_code/tools_catalog.json
@@ -87,6 +88,7 @@ tests/test_ports.py
 tests/test_ports_win.py
 tests/test_registry.py
 tests/test_relay_codec.py
+tests/test_seccheck.py
 tests/test_setup.py
 tests/test_tools_probe.py
 tests/test_toolsetup.py