From 0427dbb6c0f83b815eb301a0fa9d92e11b17e867 Mon Sep 17 00:00:00 2001
From: Tw93 <tw93@qq.com>
Date: Wed, 17 Dec 2025 20:42:25 +0800
Subject: [PATCH] feat: Expand critical system component protection in clean
 user logic and apply minor shell script fixes.

---
 lib/clean/project.sh | 3 ++-
 lib/clean/user.sh    | 4 ++--
 mole                 | 2 +-
 scripts/run-tests.sh | 2 +-
 4 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/lib/clean/project.sh b/lib/clean/project.sh
index e1ce157..e98559d 100644
--- a/lib/clean/project.sh
+++ b/lib/clean/project.sh
@@ -51,7 +51,7 @@ is_safe_project_artifact() {
 
     # Must not be a direct child of HOME directory
     # e.g., ~/.gradle is NOT safe, but ~/Projects/foo/.gradle IS safe
-    local relative_path="${path#$search_path/}"
+    local relative_path="${path#"$search_path"/}"
     local depth=$(echo "$relative_path" | tr -cd '/' | wc -c)
 
     # Require at least 1 level deep (inside a project folder)
@@ -323,6 +323,7 @@ clean_project_artifacts() {
     # Set up cleanup on interrupt
     local scan_pids=()
     local scan_temps=()
+    # shellcheck disable=SC2329
     cleanup_scan() {
         # Kill all background scans
         for pid in "${scan_pids[@]}"; do
diff --git a/lib/clean/user.sh b/lib/clean/user.sh
index 06e9c7a..f53c88a 100644
--- a/lib/clean/user.sh
+++ b/lib/clean/user.sh
@@ -121,7 +121,7 @@ clean_sandboxed_app_caches() {
         local bundle_id_lower=$(echo "$bundle_id" | tr '[:upper:]' '[:lower:]')
 
         # Check explicit critical system components (case-insensitive regex)
-        if [[ "$bundle_id_lower" =~ backgroundtaskmanagement || "$bundle_id_lower" =~ loginitems ]]; then
+        if [[ "$bundle_id_lower" =~ backgroundtaskmanagement || "$bundle_id_lower" =~ loginitems || "$bundle_id_lower" =~ systempreferences || "$bundle_id_lower" =~ controlcenter || "$bundle_id_lower" =~ biometrickit || "$bundle_id_lower" =~ sfl || "$bundle_id_lower" =~ tcc ]]; then
             continue
         fi
 
@@ -262,7 +262,7 @@ clean_application_support_logs() {
             continue
         fi
 
-        if [[ "$app_name" =~ backgroundtaskmanagement || "$app_name" =~ loginitems ]]; then
+        if [[ "$app_name_lower" =~ backgroundtaskmanagement || "$app_name_lower" =~ loginitems || "$app_name_lower" =~ systempreferences || "$app_name_lower" =~ controlcenter || "$app_name_lower" =~ biometrickit || "$app_name_lower" =~ sfl || "$app_name_lower" =~ tcc ]]; then
             continue
         fi
 
diff --git a/mole b/mole
index b1081ee..d618c99 100755
--- a/mole
+++ b/mole
@@ -198,7 +198,7 @@ show_version() {
     if command -v csrutil > /dev/null; then
         sip_status=$(csrutil status 2> /dev/null | grep -o "enabled\|disabled" || echo "Unknown")
         # Capitalize first letter
-        sip_status="$(tr '[:lower:]' '[:upper:]' <<< ${sip_status:0:1})${sip_status:1}"
+        sip_status="$(tr '[:lower:]' '[:upper:]' <<< "${sip_status:0:1}")${sip_status:1}"
     else
         sip_status="Unknown"
     fi
diff --git a/scripts/run-tests.sh b/scripts/run-tests.sh
index b37e225..2c7302c 100755
--- a/scripts/run-tests.sh
+++ b/scripts/run-tests.sh
@@ -14,7 +14,7 @@ YELLOW='\033[1;33m'
 NC='\033[0m'
 
 echo "==============================="
-echo "  Mole Test Runner"
+echo "Mole Test Runner"
 echo "==============================="
 echo ""