witbitz-code 1.6.9__tar.gz → 1.7.0__tar.gz

{witbitz_code-1.6.9/src/witbitz_code.egg-info → witbitz_code-1.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.6.9
+Version: 1.7.0
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT
@@ -19,6 +19,7 @@ Requires-Dist: websockets>=13
 Requires-Dist: httpx>=0.25
 Requires-Dist: segno>=1.5
 Requires-Dist: tinfoil<0.15,>=0.14
+Requires-Dist: pillow>=10
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Requires-Dist: pyflakes>=3; extra == "test"

{witbitz_code-1.6.9 → witbitz_code-1.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.6.9"
+version = "1.7.0"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -26,6 +26,8 @@ dependencies = [
   # Tinfoil's own verifier (attestation + Sigstore + TLS pinning) — the confidential proxy reads images and files a
   # text-only confidential model cannot, in Tinfoil's attested enclave (tinfoil_read.py). Pinned to a series on purpose.
   "tinfoil>=0.14,<0.15",
+  # Older screenshots are re-encoded smaller before a request leaves (images.py): TrustedRouter drops a ~10 MB request.
+  "pillow>=10",
 ]
 
 [project.optional-dependencies]

{witbitz_code-1.6.9 → witbitz_code-1.7.0}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.6.9"
+__version__ = "1.7.0"

{witbitz_code-1.6.9 → witbitz_code-1.7.0}/src/witbitz_code/confidential.py

@@ -26,7 +26,7 @@ from typing import Any, Callable
 
 import httpx
 
-from . import keys, models as mdl, receipt as rcp, tinfoil_read
+from . import images, keys, models as mdl, receipt as rcp, tinfoil_read
 from .gateway import verify_gateway_attestation
 
 TR_UPSTREAM = "https://api.trustedrouter.com"
@@ -577,6 +577,12 @@ class ConfidentialProxy:
                 return
             req.headers = [(k, v) for k, v in req.headers if k.lower() not in ("authorization", "x-api-key")] + [("authorization", "Bearer " + cred["trustedrouter"])]
             tinfoil = cred.get("tinfoil") or ""
+        if isinstance(body, dict):
+            shrunk, rep = await asyncio.to_thread(images.shrink_older_images, body)
+            if shrunk is not body:
+                body, req.body = shrunk, dumps(shrunk).encode("utf-8")
+                if rep["dropped"]:
+                    self.log(f"code-confidential: the request was {rep['before'] // 1024} KB; {rep['dropped']} older screenshot(s) left out to send it")
         conf = self.models.get(body.get("model")) if isinstance(body, dict) and isinstance(body.get("model"), str) else None
         if not conf:
             await self._pass_through(req, res, body, target)

{witbitz_code-1.6.9 → witbitz_code-1.7.0}/src/witbitz_code/connector.py

@@ -41,6 +41,8 @@ from .plugins import notes_plugin_path as default_notes_plugin, notes_root as de
 from .payers import SessionPayers
 from .seen import SEEN_ROUTE, merge_seen, norm_seen
 from .dirs import DIRS_ROUTE, list_dirs
+from . import seccheck
+from .seccheck import SECURITY_ROUTE
 from .mkdir import MKDIR_ROUTE, mkdir_in
 from .pairings import DEFAULT_OPENCODE_URL, hostname, read_env_password
 from .relay import RELAY_URL, Connect, RelayPeer, allowed_event_path, allowed_request, project_response
@@ -157,6 +159,7 @@ class PairingServer:
                  asks_reconcile_ms: float = ASKS_RECONCILE_MS, notes_root: str | None = None,
                  notes_plugin_path: Path | None = None, payers: SessionPayers | None = None) -> None:
         self.pairing = pairing
+        self._security: seccheck.SecurityCheck | None = None  # read on the first ask (seccheck.py)
         # WHO PAYS (payers.py): this pairing's account owns the turns it starts; the proxy bills each call to its owner.
         self._payers = payers
         self._cid = _js.js_string(pairing.get("computerId") or "")
@@ -407,6 +410,14 @@ class PairingServer:
             st, b = list_dirs(path=q.get("path", ""))
             await reply(st, b)
             return
+        # "THIS COMPUTER'S SECURITY" (seccheck.py): the same check as the witbitz-code page, for the account's own Spaces app —
+        # read here, sealed through the relay like every answer, never written to the account's stores. Python only (the Node
+        # download answers 404 and the page says the check is not available there).
+        if bare == SECURITY_ROUTE and m.get("m") == "GET":
+            if self._security is None:
+                self._security = seccheck.SecurityCheck()
+            await reply(200, await asyncio.to_thread(self._security.status))
+            return
         # "NEW FOLDER" (mkdir.py = tools/code-mkdir.mjs): one clean leaf under the folder the picker shows. Answered HERE.
         if bare == MKDIR_ROUTE and m.get("m") == "POST":
             q = dict(urllib.parse.parse_qsl(query, keep_blank_values=True))

witbitz_code-1.7.0/src/witbitz_code/images.py

@@ -0,0 +1,125 @@
+"""OLDER IMAGES ARE SHRUNK BEFORE A REQUEST LEAVES THIS COMPUTER.
+
+OpenCode sends the whole conversation on every call, and every screenshot in it rides along as a full base64 PNG. A model
+reads an image as a fixed number of tokens whatever its bytes, so the context stays small while the REQUEST grows with each
+screenshot — and TrustedRouter drops a request of about 10 MB without answering (measured 2026-10-12: 9 MB answered,
+10 MB closed the connection; a session with 18 screenshots reached 11 MB and every message in it failed).
+
+So: the newest KEEP_FULL images go as they are; every older one is re-encoded as a JPEG no larger than MAX_SIDE on its
+longest side. A screenshot of ~1 MB becomes ~100–200 KB and still reads. The result is cached by content, so the same old
+screenshot shrinks to the same bytes on every call (a provider's prompt cache keeps working from there on). If the request
+is STILL over BUDGET, the oldest images are replaced by a one-line note, newest kept — a request that cannot be sent helps
+no one. No image library, or an image it cannot decode: that image is left as it is (the budget rule still applies).
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import io
+import json
+import re
+from collections import OrderedDict
+from typing import Any
+
+KEEP_FULL = 3
+MAX_SIDE = 1280
+JPEG_QUALITY = 70
+BUDGET = 8 * 1024 * 1024  # bytes of request body; TrustedRouter's limit is ~10 MB
+CACHE_MAX = 256
+_DATA_URL = re.compile(r"^data:([^;,]+)?(?:;[^,]*)?;base64,(.*)$", re.S)
+
+_cache: "OrderedDict[str, str | None]" = OrderedDict()
+
+
+def _image_parts(body: dict) -> list[tuple[int, int]]:
+    """(message, part) of every inline image, oldest first."""
+    out = []
+    for mi, msg in enumerate(body.get("messages") or []):
+        content = msg.get("content") if isinstance(msg, dict) else None
+        if not isinstance(content, list):
+            continue
+        for pi, part in enumerate(content):
+            if isinstance(part, dict) and part.get("type") == "image_url" and _DATA_URL.match(str((part.get("image_url") or {}).get("url") or "")):
+                out.append((mi, pi))
+    return out
+
+
+def shrink_data_url(url: str) -> str | None:
+    """A smaller JPEG data URL for this image, or None (no library, cannot decode, or not smaller)."""
+    key = hashlib.sha256(url.encode("utf-8", "replace")).hexdigest()
+    if key in _cache:
+        _cache.move_to_end(key)
+        return _cache[key]
+    out = None
+    try:
+        from PIL import Image  # optional: without it, images go as they are
+        m = _DATA_URL.match(url)
+        raw = base64.b64decode(m.group(2), validate=False)
+        with Image.open(io.BytesIO(raw)) as im:
+            im.load()
+            im = im.convert("RGBA") if im.mode in ("P", "LA") else im
+            if im.mode == "RGBA":
+                bg = Image.new("RGB", im.size, (255, 255, 255))
+                bg.paste(im, mask=im.split()[3])
+                im = bg
+            elif im.mode != "RGB":
+                im = im.convert("RGB")
+            if max(im.size) > MAX_SIDE:
+                im.thumbnail((MAX_SIDE, MAX_SIDE), Image.LANCZOS)
+            buf = io.BytesIO()
+            im.save(buf, "JPEG", quality=JPEG_QUALITY, optimize=True)
+        small = "data:image/jpeg;base64," + base64.b64encode(buf.getvalue()).decode("ascii")
+        out = small if len(small) < len(url) else None
+    except Exception:  # noqa: BLE001 — an image we cannot shrink is sent as it is
+        out = None
+    _cache[key] = out
+    while len(_cache) > CACHE_MAX:
+        _cache.popitem(last=False)
+    return out
+
+
+def _size(body: dict) -> int:
+    return len(json.dumps(body, separators=(",", ":"), ensure_ascii=False).encode("utf-8"))
+
+
+def shrink_older_images(body: Any, keep_full: int = KEEP_FULL, budget: int = BUDGET) -> tuple[Any, dict]:
+    """(body, report). The body is a NEW dict when anything changed; the input is never mutated."""
+    report = {"shrunk": 0, "dropped": 0, "before": 0, "after": 0}
+    if not isinstance(body, dict):
+        return body, report
+    parts = _image_parts(body)
+    if not parts:
+        return body, report
+    messages = list(body["messages"])
+    touched: set[int] = set()
+
+    def put(mi: int, pi: int, part: dict) -> None:
+        if mi not in touched:
+            messages[mi] = {**messages[mi], "content": list(messages[mi]["content"])}
+            touched.add(mi)
+        messages[mi]["content"][pi] = part
+
+    older = parts[:-keep_full] if keep_full > 0 else parts
+    for mi, pi in older:
+        part = messages[mi]["content"][pi]
+        small = shrink_data_url(part["image_url"]["url"])
+        if small:
+            put(mi, pi, {**part, "image_url": {**part["image_url"], "url": small}})
+            report["shrunk"] += 1
+    out = {**body, "messages": messages} if touched else body
+    size = _size(out)
+    if size > budget:
+        report["before"] = size
+        for mi, pi in parts[:-1]:  # the newest image is never dropped
+            if size <= budget:
+                break
+            part = messages[mi]["content"][pi]
+            was = len(json.dumps(part, separators=(",", ":"), ensure_ascii=False).encode("utf-8"))
+            note = {"type": "text", "text": "[An earlier screenshot was removed here to keep the request small enough to send.]"}
+            put(mi, pi, note)
+            size -= was - len(json.dumps(note, separators=(",", ":")).encode("utf-8"))
+            report["dropped"] += 1
+        out = {**body, "messages": messages}
+        report["after"] = size
+    return out, report

witbitz_code-1.7.0/src/witbitz_code/seccheck.py

@@ -0,0 +1,226 @@
+"""THIS COMPUTER'S SECURITY CHECK (the owner, 2026-10-12: infostealers on a desktop — "can the helper check the desktop status
+and recommend what to do" → "Yes"). witbitz-code runs as an ordinary program on the computer, so it can read what a web page
+never can: Windows' antivirus, its settings, the firewall, disk encryption, updates, the account's rights. It READS without
+an administrator; a Fix that changes a setting goes through Windows' own admin prompt (UAC), and nothing changes silently.
+A setting Windows wants changed in its own app (memory integrity: driver checks; BitLocker: a recovery key) opens that page.
+
+It is ADVICE, not proof: malware already running as this user can fake anything a program running as this user reads.
+It finds weak settings before something gets in; it cannot say that nothing has. The page and Spaces say so.
+
+Windows only for now (also from WSL, where it reads the Windows that hosts it). Other systems: {"supported": False}.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import shutil
+import subprocess
+import sys
+import time
+from typing import Callable
+
+SECURITY_ROUTE = "/witbitz/security"  # the connector answers it for the paired Spaces app (connector.py)
+
+# ONE PowerShell read. Every part is guarded: a part Windows refuses reads as null, never as a failure of the whole check.
+PROBE_PS = r"""
+$ErrorActionPreference = 'SilentlyContinue'
+$o = [ordered]@{}
+$s = Get-MpComputerStatus
+if ($s) { $o.defender = [ordered]@{ realtime = [bool]$s.RealTimeProtectionEnabled; behavior = [bool]$s.BehaviorMonitorEnabled;
+  tamper = [bool]$s.IsTamperProtected; sigAgeDays = [int]$s.AntivirusSignatureAge; mode = "$($s.AMRunningMode)" } }
+$p = Get-MpPreference
+if ($p) { $o.prefs = [ordered]@{ cloud = [int]$p.MAPSReporting; pua = [int]$p.PUAProtection; network = [int]$p.EnableNetworkProtection } }
+$o.antivirus = @(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | ForEach-Object {
+  [ordered]@{ name = "$($_.displayName)"; on = ((($_.productState -shr 12) -band 0xF) -eq 1) } })
+$dg = Get-CimInstance -Namespace root/Microsoft/Windows/DeviceGuard -ClassName Win32_DeviceGuard
+if ($dg) { $o.memoryIntegrity = [bool](@($dg.SecurityServicesRunning) -contains 2) }
+$o.firewall = @(Get-NetFirewallProfile | ForEach-Object { [ordered]@{ name = "$($_.Name)"; on = [bool]$_.Enabled } })
+try { $bl = (New-Object -ComObject Shell.Application).NameSpace("$env:SystemDrive\").Self.ExtendedProperty('System.Volume.BitLockerProtection'); if ($bl -ne $null) { $o.bitlocker = [int]$bl } } catch {}
+try { $d = (New-Object -ComObject Microsoft.Update.AutoUpdate).Results.LastInstallationSuccessDate; if ($d) { $o.updateDaysAgo = [int]((Get-Date) - [datetime]$d).TotalDays } } catch {}
+$uac = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
+if ($uac) { $o.uac = [ordered]@{ on = ([int]$uac.EnableLUA -eq 1); prompt = [int]$uac.ConsentPromptBehaviorAdmin } }
+$o.admin = [bool]((whoami /groups /fo csv | Out-String) -match 'S-1-5-32-544')
+$o.os = "$((Get-CimInstance Win32_OperatingSystem).Caption)"
+$o | ConvertTo-Json -Depth 4 -Compress
+"""
+
+# The fixes. "ps" runs ELEVATED through Windows' admin prompt; "open" opens Windows' own page for a setting it checks itself.
+FIXES = {
+    "pua": {"ps": "Set-MpPreference -PUAProtection Enabled"},
+    "network": {"ps": "Set-MpPreference -EnableNetworkProtection Enabled"},
+    "cloud": {"ps": "Set-MpPreference -MAPSReporting Advanced"},
+    "firewall": {"ps": "Set-NetFirewallProfile -All -Enabled True"},
+    "signatures": {"ps": "Update-MpSignature"},
+    "antivirus": {"open": "windowsdefender://threat"},
+    "memoryIntegrity": {"open": "windowsdefender://coreisolation"},
+    "tamper": {"open": "windowsdefender://threatsettings"},
+    "realtime": {"open": "windowsdefender://threatsettings"},
+    "bitlocker": {"open": "ms-settings:deviceencryption"},
+    "updates": {"open": "ms-settings:windowsupdate"},
+}
+
+
+def recommendations(s: dict | None) -> list[dict]:
+    """[{id, ok, title, why, fix?}] — what this computer has and what it should change, plainly. Pure: tests feed it readings."""
+    if not s:
+        return []
+    out: list[dict] = []
+
+    def add(id_: str, ok: bool | None, title: str, why: str = "") -> None:
+        if ok is None:
+            return  # Windows did not say: say nothing rather than guess
+        item = {"id": id_, "ok": bool(ok), "title": title, "why": "" if ok else why}
+        if not ok and id_ in FIXES:
+            item["fix"] = "admin" if "ps" in FIXES[id_] else "open"
+        out.append(item)
+
+    other_av = [a for a in (s.get("antivirus") or []) if a.get("on") and "defender" not in (a.get("name") or "").lower()]
+    d = s.get("defender")
+    if other_av:
+        out.append({"id": "antivirus", "ok": True, "title": f"Antivirus: {other_av[0]['name']}", "why": ""})
+    elif d:
+        add("realtime", d.get("realtime") and d.get("behavior"), "Microsoft Defender real-time protection",
+            "Real-time protection is off — malware can run without being stopped. Turn it on in Windows Security.")
+        add("tamper", d.get("tamper"), "Tamper protection",
+            "Tamper protection is off — malware can turn Defender off before it acts.")
+        age = d.get("sigAgeDays")
+        add("signatures", None if age is None else age <= 3, "Virus definitions",
+            f"Defender's definitions are {age} days old — it will miss newer malware.")
+        p = s.get("prefs") or {}
+        add("cloud", None if p.get("cloud") is None else p["cloud"] >= 1, "Cloud protection",
+            "Cloud protection is off — brand-new malware is recognised much later.")
+        add("pua", None if p.get("pua") is None else p["pua"] == 1, "Blocking unwanted apps",
+            "Bundled and unwanted apps are only logged, not blocked. Stealers often arrive inside them.")
+        add("network", None if p.get("network") is None else p["network"] == 1, "Blocking malicious sites in every app",
+            "Network protection is off — only Edge blocks known malicious sites; other apps and malware can still reach them.")
+    else:
+        out.append({"id": "antivirus", "ok": False, "title": "Antivirus", "why": "No antivirus answered. Open Windows Security and turn Microsoft Defender on.",
+                    "fix": "open"})
+    add("memoryIntegrity", s.get("memoryIntegrity"), "Memory integrity (Core isolation)",
+        "Memory integrity is off — malware that reaches the system's core is much harder to stop. Turning it on needs a restart.")
+    fw = s.get("firewall") or []
+    add("firewall", None if not fw else all(f.get("on") for f in fw), "Firewall",
+        "The firewall is off for: " + ", ".join(f["name"] for f in fw if not f.get("on")) + ".")
+    bl = s.get("bitlocker")
+    add("bitlocker", None if bl is None else bl in (1, 3, 5), "Disk encryption (BitLocker)",
+        "The disk is not encrypted — anyone with the laptop can read it. Turn on device encryption and keep its recovery key safe.")
+    days = s.get("updateDaysAgo")
+    add("updates", None if days is None else days <= 21, "Windows updates",
+        f"Windows last installed updates {days} days ago. Updates close the holes malware uses.")
+    uac = s.get("uac") or {}
+    add("uac", None if not uac else (uac.get("on") and uac.get("prompt") != 0), "Admin prompt (UAC)",
+        "UAC is off or never asks — any program you run gets full control of the computer.")
+    if s.get("admin"):
+        out.append({"id": "adminAccount", "ok": False, "title": "Daily account",
+                    "why": "You use an administrator account every day. A standard account for daily use, with the admin account kept for installs, "
+                           "stops much malware from taking over the whole computer. (Optional, but the strongest single step.)"})
+    return out
+
+
+def summary(items: list[dict]) -> dict:
+    todo = [i for i in items if not i["ok"]]
+    return {"checked": len(items), "todo": len(todo), "titles": [i["title"] for i in todo]}
+
+
+# ── running it ──────────────────────────────────────────────────────────────────────────────────────────────────────
+def _in_wsl() -> bool:
+    try:
+        with open("/proc/version", encoding="utf-8") as f:
+            return "microsoft" in f.read().lower()
+    except OSError:
+        return False
+
+
+def powershell() -> str | None:
+    """The PowerShell that reads Windows: native, or the host's from WSL. None off Windows."""
+    if sys.platform == "win32":
+        return shutil.which("powershell.exe") or shutil.which("powershell") or os.path.join(os.environ.get("SystemRoot", r"C:\Windows"), "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+    if _in_wsl():
+        return shutil.which("powershell.exe") or ("/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe" if os.path.exists("/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe") else None)
+    return None
+
+
+def _run_ps(ps: str, script: str, timeout: int = 60) -> subprocess.CompletedProcess:
+    flags = getattr(subprocess, "CREATE_NO_WINDOW", 0)
+    return subprocess.run([ps, "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script],  # noqa: S603
+                          check=False, stdin=subprocess.DEVNULL, capture_output=True, text=True, errors="replace",
+                          timeout=timeout, creationflags=flags, cwd="/mnt/c" if _in_wsl() and os.path.isdir("/mnt/c") else None)
+
+
+def read_status(run: Callable[[str, str], subprocess.CompletedProcess] = _run_ps, ps: str | None = None) -> dict:
+    ps = ps or powershell()
+    if not ps:
+        return {"supported": False}
+    r = run(ps, PROBE_PS)
+    out = (r.stdout or "").strip().splitlines()
+    try:
+        return {"supported": True, **json.loads(out[-1] if out else "")}
+    except (ValueError, IndexError):
+        return {"supported": True, "error": "Windows did not answer the check" + (f" ({(r.stderr or '').strip()[:120]})" if r.stderr else "")}
+
+
+def fix(item_id: str, run: Callable[[str, str], subprocess.CompletedProcess] = _run_ps, ps: str | None = None) -> dict:
+    """Apply one fix: an admin change through Windows' UAC prompt, or Windows' own page for it. → {ok, why?}"""
+    f = FIXES.get(item_id)
+    ps = ps or powershell()
+    if not f or not ps:
+        return {"ok": False, "why": "nothing here can change that"}
+    if "open" in f:
+        r = run(ps, f"Start-Process '{f['open']}'", 30)
+        return {"ok": r.returncode == 0, "opened": True, **({} if r.returncode == 0 else {"why": "Windows did not open the page"})}
+    # Elevated: Windows shows its admin prompt; -Wait so the check that follows reads the result. A No at the prompt fails Start-Process.
+    inner = f["ps"].replace("'", "''")
+    script = (f"try {{ $p = Start-Process powershell -Verb RunAs -Wait -PassThru -WindowStyle Hidden "
+              f"-ArgumentList '-NoProfile','-Command','{inner}'; exit $p.ExitCode }} catch {{ exit 1223 }}")
+    r = run(ps, script, 300)
+    if r.returncode == 1223:
+        return {"ok": False, "why": "the admin prompt was declined — nothing changed"}
+    return {"ok": r.returncode == 0, **({} if r.returncode == 0 else {"why": f"Windows refused it (code {r.returncode})"})}
+
+
+class SecurityCheck:
+    """{supported, items, summary, at, os, error?} for the page; read at most once a minute, again right after a fix."""
+
+    TTL = 60
+
+    def __init__(self, *, read: Callable[[], dict] | None = None, apply: Callable[[str], dict] | None = None,
+                 now: Callable[[], float] = time.monotonic) -> None:
+        self._read = read or (lambda: read_status())  # looked up at call time
+        self._apply = apply or (lambda i: fix(i))
+        self._now = now
+        self._cache: tuple[float, dict] | None = None
+        self._task: asyncio.Task | None = None
+
+    def status(self, fresh: bool = False) -> dict:
+        if not fresh and self._cache and self._now() - self._cache[0] < self.TTL:
+            return self._cache[1]
+        try:
+            raw = self._read()
+        except Exception as e:  # noqa: BLE001 — a reading, never a failure of the page
+            raw = {"supported": True, "error": f"could not check ({str(e)[:80]})"}
+        if not raw.get("supported"):
+            out = {"supported": False}
+        else:
+            items = recommendations(raw if not raw.get("error") else None)
+            out = {"supported": True, "items": items, "summary": summary(items), "os": raw.get("os") or "",
+                   "at": int(time.time()), **({"error": raw["error"]} if raw.get("error") else {})}
+        self._cache = (self._now(), out)
+        return out
+
+    def peek(self) -> dict:
+        """What the page shows NOW, never waiting on Windows (a read takes seconds): the last reading, and a fresh one started
+        in the background when it is stale. {"checking": True} before the first one lands."""
+        stale = not self._cache or self._now() - self._cache[0] >= self.TTL
+        if stale and not (self._task and not self._task.done()):
+            try:
+                self._task = asyncio.get_running_loop().create_task(asyncio.to_thread(self.status, True))
+            except RuntimeError:
+                pass
+        return self._cache[1] if self._cache else {"checking": True}
+
+    async def fix(self, item_id: str) -> dict:
+        r = await asyncio.to_thread(self._apply, item_id)
+        await asyncio.to_thread(self.status, True)  # the card shows the result at once
+        return r

{witbitz_code-1.6.9 → witbitz_code-1.7.0}/src/witbitz_code/ui.py

@@ -35,7 +35,7 @@ from importlib import resources
 from pathlib import Path
 from typing import Any, Awaitable, Callable
 
-from . import __version__, devicelink, link, net, ports, qr, uitools, uninstall, winbg, wizard, wslstart
+from . import __version__, devicelink, link, net, ports, qr, seccheck, uitools, uninstall, winbg, wizard, wslstart
 from . import pair as pair_cmd
 from . import pairings as pp
 
@@ -127,10 +127,12 @@ class Manager:
                  login_enable: Callable[[dict], tuple] = wslstart.startup_enable,
                  login_disable: Callable[[dict], bool] = wslstart.startup_disable,
                  port_owners: Callable[[int], list] | None = None, stop_pid: Callable[[int], bool] | None = None,
-                 tools: uitools.Tools | None = None, label: dict | None = None, log: deque | None = None) -> None:
+                 tools: uitools.Tools | None = None, label: dict | None = None, log: deque | None = None,
+                 security: seccheck.SecurityCheck | None = None) -> None:
         self._serve, self._is_listening, self._pair, self._link = serve, is_listening, pair, link_node
         self._load, self._keys_line = load_pairings, keys_line
         self.tools = tools or uitools.Tools()
+        self.security = security or seccheck.SecurityCheck()
         self._owners = port_owners or ports.port_owners
         self._stop_pid = stop_pid or uninstall.stop_process
         self._elsewhere_cache: tuple[float, dict | None] | None = None
@@ -214,7 +216,7 @@ class Manager:
                 serving = {"state": "elsewhere", "port": el["port"], "owners": el["owners"]}
         return {"version": __version__, "computer": self.label, "paired": paired, "serving": serving, "pair": pair,
                 "login": self.login(), "busy": self.busy, "background": self.background,
-                "tools": await asyncio.to_thread(self.tools.status), "log": list(self.log)[-14:]}
+                "tools": await asyncio.to_thread(self.tools.status), "security": self.security.peek(), "log": list(self.log)[-14:]}
 
     async def elsewhere(self, fresh: bool = False) -> dict | None:
         """{port, owners} when THIS person's other process holds OpenCode's port or the model proxy's (port + 100) while this
@@ -535,6 +537,7 @@ class Server:
             "/api/login": lambda: self.m.set_login(bool(data.get("on"))),
             "/api/quit": self.m.quit,
             "/api/tools/install": self.m.tools.install,
+            "/api/security/fix": lambda: self.m.security.fix(str(data.get("id") or "")),
         }
         act = actions.get(path)
         if not act:

{witbitz_code-1.6.9 → witbitz_code-1.7.0}/src/witbitz_code/ui_static/app.css

@@ -51,3 +51,11 @@ footer { font-size: 13px; text-align: center; }
 .actions:not(:has(button:not([hidden]))) { display: none; }
 button.small { font-size: 13px; padding: 2px 10px; margin-left: 8px; }
 pre.cmd { background: var(--off-bg); color: var(--text); padding: 8px 10px; border-radius: 8px; }
+/* the security check (seccheck.py) */
+p.small, div.small { font-size: 12.5px; }
+.sec-list { list-style: none; padding: 0; margin: 8px 0; }
+.sec-list li { padding: 8px 0; border-top: 1px solid var(--line, #e5e7eb); }
+.sec-list li:first-child { border-top: 0; }
+.sec-list li.todo .sec-head span { font-weight: 600; }
+.sec-list li.ok { opacity: .7; }
+.sec-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }

{witbitz_code-1.6.9 → witbitz_code-1.7.0}/src/witbitz_code/ui_static/app.js

@@ -97,6 +97,7 @@ function render(s) {
   $('footerText').textContent = s.background ? 'runs in the background — Start menu → Witbitz Code opens this page' : 'keep its window open — closing it stops witbitz-code'
   show($('quit'), !!s.background)
   renderTools(s.tools, paired)
+  renderSecurity(s.security)
 
   $('log').textContent = (s.log || []).join('\n')
 }
@@ -161,6 +162,46 @@ function renderTools(t, paired) {
   $('toolsLog').textContent = lines.join('\n')
 }
 
+// This computer's security check (seccheck.py): what Windows has, what to change, and a Fix for what can be fixed from here.
+function renderSecurity(sec) {
+  const card = $('secCard')
+  if (!sec || sec.supported === false) return show(card, false)
+  show(card, true)
+  const items = sec.items || []
+  const todo = items.filter((i) => !i.ok)
+  $('secText').textContent = sec.checking ? 'Checking Windows…'
+    : sec.error ? sec.error
+    : todo.length ? `${todo.length} ${todo.length === 1 ? 'thing' : 'things'} to change` + (sec.os ? ` · ${sec.os}` : '')
+    : 'Everything checked here is set well ✓' + (sec.os ? ` · ${sec.os}` : '')
+  const list = $('secList')
+  const key = JSON.stringify(items) + '|' + !!(state && state.busy)
+  if (list.dataset.key === key) return
+  list.dataset.key = key
+  list.textContent = ''
+  for (const i of [...todo, ...items.filter((x) => x.ok)]) {
+    const li = document.createElement('li')
+    li.className = i.ok ? 'ok' : 'todo'
+    const head = document.createElement('div')
+    head.className = 'sec-head'
+    const t = document.createElement('span')
+    t.textContent = (i.ok ? '✓ ' : '! ') + i.title
+    head.append(t)
+    if (i.fix) {
+      const b = document.createElement('button')
+      b.type = 'button'
+      b.className = 'small'
+      b.textContent = i.fix === 'admin' ? 'Fix' : 'Open in Windows'
+      b.disabled = !!(state && state.busy)
+      b.onclick = () => act('/api/security/fix', { id: i.id },
+        i.fix === 'admin' ? `Change it now? Windows will ask for permission (an admin prompt) — say Yes there.` : '')
+      head.append(b)
+    }
+    li.append(head)
+    if (i.why) { const w = document.createElement('div'); w.className = 'muted small'; w.textContent = i.why; li.append(w) }
+    list.append(li)
+  }
+}
+
 let quitting = false
 async function quit() {
   if (!window.confirm('Quit Witbitz Code? Code in Spaces will not reach this computer until you open Witbitz Code from the Start menu again.')) return

{witbitz_code-1.6.9 → witbitz_code-1.7.0}/src/witbitz_code/ui_static/index.html

@@ -51,6 +51,14 @@
     <pre id="toolsLog" class="cmd" hidden></pre>
   </section>
 
+  <section class="card" id="secCard" hidden>
+    <h2>This computer's security</h2>
+    <p id="secText" class="muted"></p>
+    <ul id="secList" class="sec-list"></ul>
+    <p class="muted small">A check of Windows' settings, not a malware scan. It finds weak settings before something gets in;
+      malware already running here could hide from it.</p>
+  </section>
+
   <section class="card" id="loginCard" hidden>
     <label class="switch-row" for="login">
       <span>

{witbitz_code-1.6.9 → witbitz_code-1.7.0/src/witbitz_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.6.9
+Version: 1.7.0
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT
@@ -19,6 +19,7 @@ Requires-Dist: websockets>=13
 Requires-Dist: httpx>=0.25
 Requires-Dist: segno>=1.5
 Requires-Dist: tinfoil<0.15,>=0.14
+Requires-Dist: pillow>=10
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Requires-Dist: pyflakes>=3; extra == "test"

{witbitz_code-1.6.9 → witbitz_code-1.7.0}/src/witbitz_code.egg-info/SOURCES.txt

@@ -21,6 +21,7 @@ src/witbitz_code/devicelink.py
 src/witbitz_code/dirs.py
 src/witbitz_code/folders.py
 src/witbitz_code/gateway.py
+src/witbitz_code/images.py
 src/witbitz_code/keys.py
 src/witbitz_code/link.py
 src/witbitz_code/mkdir.py
@@ -37,6 +38,7 @@ src/witbitz_code/ports.py
 src/witbitz_code/qr.py
 src/witbitz_code/receipt.py
 src/witbitz_code/relay.py
+src/witbitz_code/seccheck.py
 src/witbitz_code/seen.py
 src/witbitz_code/tinfoil_read.py
 src/witbitz_code/tools_catalog.json
@@ -77,6 +79,7 @@ tests/test_devicelink.py
 tests/test_dirs.py
 tests/test_files_and_compress.py
 tests/test_folders.py
+tests/test_images.py
 tests/test_outputs.py
 tests/test_pair_flows.py
 tests/test_plugins.py
@@ -85,6 +88,7 @@ tests/test_ports.py
 tests/test_ports_win.py
 tests/test_registry.py
 tests/test_relay_codec.py
+tests/test_seccheck.py
 tests/test_setup.py
 tests/test_tools_probe.py
 tests/test_toolsetup.py

{witbitz_code-1.6.9 → witbitz_code-1.7.0}/src/witbitz_code.egg-info/requires.txt

@@ -3,6 +3,7 @@ websockets>=13
 httpx>=0.25
 segno>=1.5
 tinfoil<0.15,>=0.14
+pillow>=10
 
 [test]
 pytest>=8