1
0
mirror of https://github.com/tw93/Mole.git synced 2026-03-22 22:30:08 +00:00
Commit Graph

1840 Commits

Author SHA1 Message Date
Tw93
a7b28faeda chore: auto format code 2026-03-14 01:22:54 +00:00
Tw93
7697acb711 test: speed up bats execution 2026-03-14 09:19:54 +08:00
Tw93
169be1e1f2 fix(timeout): inherit helper state and pass checks 2026-03-14 08:32:11 +08:00
Tw93
0d2f217f28 security: add regression tests for validatePath with special chars
- Add TestValidatePath covering Chinese, emoji, and special characters
- Add TestValidatePathWithChineseAndSpecialChars for filesystem tests
- Fix validatePath to detect .. components without rejecting valid paths

Ensures paths with $, ;, :, emoji, Chinese chars are not rejected
while still blocking path traversal attempts.
2026-03-14 08:26:45 +08:00
Tw93
951e395ab7 security: fix CodeQL command injection and path traversal alerts
- Add validatePath() helper to check path safety before external commands
- Validate paths in delete.go (moveToTrash), scanner.go (mdfind, du),
  and main.go (open command)
- Remove overly restrictive character whitelist that rejected valid
  macOS paths (Chinese, emoji, $, ;, etc.)
- Unify path validation logic across all three files

Fixes CodeQL alerts:
- Command injection in osascript (delete.go)
- Command injection in mdfind/du (scanner.go)
- Path traversal in open command (main.go)
2026-03-14 08:24:08 +08:00
Tw93
f6acfa774c feat(disk): enhance APFS disk usage reporting with Finder integration 2026-03-14 07:48:16 +08:00
Tw93
ea37d3e356 fix(purge): remove 60-char hard cap on path display width (issue #564)
The path column in 'mo purge' selection was capped at 60 characters
regardless of terminal width. On wide terminals (120+ cols) this caused
long project paths like ~/GitHub/Ulama/transformer-project to be
truncated unnecessarily to ~17 visible characters.

Remove the hard 60-char cap and let the available terminal space be the
only upper bound, which is already computed as:
  available_for_path = terminal_width - fixed_overhead

Paths now use as much space as the terminal allows while still keeping
the size and artifact-type columns readable.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-14 07:46:44 +08:00
Tw93
cb2eb1097a fix(analyze): add darwin build tag to all platform-specific files
All files in cmd/analyze/ are macOS-only but several were missing the
//go:build darwin constraint. On Linux (e.g. CodeQL CI), Go compiled
these files without the types defined in main.go (which had the tag),
causing undefined symbol errors for dirEntry, fileEntry, scanResult,
cacheEntry, historyEntry and model.

- Add //go:build darwin to heap.go, cache.go, scanner.go, cleanable.go,
  delete.go, format.go, constants.go and all *_test.go files

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-14 07:46:32 +08:00
Tw93
97d35c03d6 fix(purge): parallelize size calculations to prevent hang (issue #560)
Sequential du calls with 15s timeout each meant N artifacts × 15s of potential
wait when paths are on slow storage (network mounts, Syncthing, large dirs).
Now all du processes are launched concurrently; total time is bounded by the
single longest call (≤ 15s) rather than N × 15s.

fix(protection): protect CoreAudio paths in should_protect_path (issue #553)

Add com.apple.coreaudio*, com.apple.audio.*, and coreaudiod* to the protected
path patterns so deep-clean cannot touch audio subsystem caches, reducing risk
of audio output loss on Intel Macs running macOS Sequoia.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-14 00:00:08 +08:00
Tw93
fca8214276 chore: ignore Claude Code workspace files 2026-03-13 13:58:50 +08:00
Tw93
e6850329ae chore: ignore Claude Code local settings 2026-03-13 13:58:50 +08:00
Tw93
643cb8e9ac chore: add Claude Code skills for GitHub operations
Add github-ops skill for automated issue and PR management.
2026-03-13 13:58:50 +08:00
Dylan Joss
7350547458 feat: add JSON output tests and README docs for analyze and status (#556)
* feat: add JSON output tests and README docs for analyze and status

Add 7 BATS tests covering `--json` output for `mo analyze` and `mo status`:
- schema structure
- field types
- pipe auto-detection.

Also document the `--json` flag in a new "Machine-Readable Output" README section, including the auto-detection behavior when piped.

* chore: use waitgroup go in status collector

---------

Co-authored-by: Tw93 <hitw93@gmail.com>
2026-03-13 11:40:41 +08:00
github-actions[bot]
cce26022f3 chore: update contributors [skip ci] 2026-03-13 03:38:56 +00:00
c5d923cd48 fix(appli-support):using whitelist in application_support clean (#562)
* fix(appli-support):using whitelist in application_support clean

* fix: harden clash verge app support protection

---------

Co-authored-by: Tw93 <hitw93@gmail.com>
2026-03-13 11:38:37 +08:00
github-actions[bot]
e642817b1f chore: update contributors [skip ci] 2026-03-11 03:25:50 +00:00
Tw93
20a396b33e chore: add journal/ to gitignore, merge path docs into SECURITY_AUDIT 2026-03-11 11:25:03 +08:00
Tw93
f2525709d3 docs: tidy quick start formatting 2026-03-10 16:26:01 +08:00
Tw93
5fd6186057 ci: align workflow Go versions with go.mod 2026-03-10 16:23:10 +08:00
Nour
65b0db4e1c feat(clean): add opt-in Docker unused data pruning (#554)
* feat(clean): add opt-in Docker unused data pruning

* fix(clean): make docker prune default

---------

Co-authored-by: Tw93 <hitw93@gmail.com>
2026-03-10 16:20:40 +08:00
Tw93
2f627ac3df docs: refine safety design copy 2026-03-10 15:35:52 +08:00
dependabot[bot]
be1c36c20e chore(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 (#555)
Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.19.0 to 0.20.0.
- [Commits](https://github.com/golang/sync/compare/v0.19.0...v0.20.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 15:32:37 +08:00
dependabot[bot]
0876e74e86 chore(deps): bump actions/attest-build-provenance from 3 to 4 (#557)
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 3 to 4.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 15:32:22 +08:00
Tw93
af84d6f4be docs: strengthen public security signals 2026-03-10 15:31:07 +08:00
Tw93
a34cdee809 chore: auto format code 2026-03-09 16:24:43 +00:00
tw93
8c53923ce8 fix(status): improve disk card display refs #551 2026-03-08 23:46:46 +08:00
tw93
24da1e2ac1 fix(clean): speed up Python bytecode cache cleanup 2026-03-08 19:45:53 +08:00
tw93
4df6c9c531 chore: prepare release v1.30.0 V1.30.0 2026-03-08 16:43:59 +08:00
tw93
17751e29d9 ci: align release workflow with curated notes 2026-03-08 16:26:33 +08:00
tw93
943e68bb1c docs: refresh security audit reference 2026-03-08 15:35:45 +08:00
tw93
2a36c662aa fix: tighten orphan cleanup retention windows 2026-03-08 15:33:30 +08:00
tw93
26b267c4a2 fix: harden orphan cleanup and lsregister fallback 2026-03-08 15:29:25 +08:00
tw93
50efe51565 fix(clean): guard empty Xcode DeviceSupport arrays 2026-03-07 23:10:41 +08:00
github-actions[bot]
b12308f3ad chore: update contributors [skip ci] 2026-03-07 12:38:52 +00:00
Tw93
42cc50d0fd test(purge): cover empty menu options path 2026-03-07 20:36:47 +08:00
Tw93
faf29b05f1 Fix perl timeout fallback selection 2026-03-07 20:36:34 +08:00
Onur Taşhan
dfedc029d1 fix: handle empty menu_options in mo purge to prevent unbound variable error (#547)
When no artifacts are found during scanning, `menu_options` remains an
empty array. With `set -euo pipefail` active, expanding `${menu_options[@]}`
on an empty array causes a fatal "unbound variable" error (line 1325).

Add an early-return guard after the spinner stops: if no items were found,
print a friendly "No artifacts found to purge" message and exit cleanly.

Fixes #546
2026-03-07 20:33:47 +08:00
tw93
d189e1b84f test: fix update and cache cleanup cases 2026-03-07 20:03:11 +08:00
tw93
300aded07b fix(clean): avoid stalls in app support scan 2026-03-07 18:35:19 +08:00
tw93
89a9ae0ce2 fix(analyze): count top-level files in json output 2026-03-07 10:10:41 +08:00
tw93
09d0de0c8e perf(core): optimize base functions with caching and improve robustness
- Add global caching for `detect_architecture`, `get_darwin_major`, `get_optimal_parallel_jobs`, and `is_ansi_supported` to reduce subshell overhead.
- Improve robustness of `get_lsregister_path` by returning 1 on failure.
- Enhance security of `get_user_home` by replacing `eval echo` with `id -P`.
2026-03-06 19:42:15 +08:00
tw93
0fabc6feec fix(shell): suppress SC2016 in timeout perl fallback 2026-03-06 14:17:42 +08:00
Tw93
92ad46a396 fix(clean): harden project cache scans
Refs #541
2026-03-06 07:49:44 +08:00
Tw93
7e69a4eb71 clean orphaned Claude VM bundle
Fixes #537
2026-03-06 07:36:08 +08:00
Tw93
423c424f52 fix: gate main menu update action on update availability
Follow-up to #540.
2026-03-06 07:19:10 +08:00
Oleksandr Redko
603df79a01 refactor: fix modernize lint issues (#539) 2026-03-05 20:46:12 +08:00
tw93
fc006e32be remove startup intro animation from main menu 2026-03-05 19:13:20 +08:00
Tw93
a4890764d3 chore: auto format code 2026-03-05 09:51:52 +00:00
tw93
c3ea57d301 Resolve merge conflict in mole update helpers 2026-03-05 17:50:32 +08:00
tw93
f91975e5be Refine update/uninstall UX and stabilize brew flows 2026-03-05 17:46:05 +08:00