Release v2.0.0

scripts/audit-windows-smoke.ps1

@@ -2,8 +2,9 @@ param(
   [ValidateSet("PlanOnly", "Capture")]
   [string]$Mode = "PlanOnly",
   [string]$DataRoot = "C:\ProgramData\ProxyWarden",
-  [string]$ProxiFyreRoot = "C:\Tools\ProxiFyre",
-  [string]$SingBoxRoot = "C:\Program Files\ProxyWarden\sing-box",
+  [string]$AppRoot = "C:\Program Files\ProxyWarden",
+  [string]$ProxiFyreRoot = "C:\Program Files\ProxyWarden\components\ProxiFyre",
+  [string]$SingBoxRoot = "C:\Program Files\ProxyWarden\components\sing-box",
   [string]$ForeignServiceName = "",
   [string]$OutputPath = ""
 )
@@ -110,10 +111,35 @@ function Get-SecretFindingCategories {
   return $findings
 }
 
+function Get-InternalStateEvidence {
+  param([string]$Root)
+
+  $categories = [ordered]@{
+    cutoverJournal = ".proxywarden-cutover"
+    cutoverQuarantine = ".proxywarden-quarantine"
+    packageStaging = ".proxywarden-package-staging"
+    privilegedJobs = ".proxywarden-privileged-jobs"
+    serviceLogs = ".proxywarden-service-logs"
+    singBoxCleanupTombstone = ".proxywarden-sing-box-cleanup"
+  }
+
+  $result = @()
+  foreach ($entry in $categories.GetEnumerator()) {
+    $path = Join-Path $Root $entry.Value
+    $item = Get-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue
+    $result += [ordered]@{
+      category = $entry.Key
+      present = $null -ne $item
+      itemType = if ($null -eq $item) { $null } elseif ($item.PSIsContainer) { "directory" } else { "file" }
+    }
+  }
+  return $result
+}
+
 try {
-  $quotedServiceFixture = '"C:\Program Files\ProxyWarden\sing-box\ProxyWardenSingBox.exe" -service'
+  $quotedServiceFixture = '"C:\Program Files\ProxyWarden\components\sing-box\ProxyWardenSingBox.exe" -service'
   $quotedExecutable = Get-ServiceExecutablePath -PathName $quotedServiceFixture
-  if (-not (Test-PathUnderRoot -Path $quotedExecutable -Root "C:\Program Files\ProxyWarden\sing-box")) {
+  if (-not (Test-PathUnderRoot -Path $quotedExecutable -Root "C:\Program Files\ProxyWarden\components\sing-box")) {
     throw "Quoted service PathName ownership self-test failed."
   }
 
@@ -122,11 +148,12 @@ try {
     serviceNames = @("ProxiFyreService", "ProxyWardenSingBox")
     foreignServiceName = $ForeignServiceName
     roots = [ordered]@{
+      app = [IO.Path]::GetFullPath($AppRoot)
       data = [IO.Path]::GetFullPath($DataRoot)
       proxifyre = [IO.Path]::GetFullPath($ProxiFyreRoot)
       singbox = [IO.Path]::GetFullPath($SingBoxRoot)
     }
-    checks = @("service-state-and-path", "managed-root-membership", "file-metadata", "secret-category-scan")
+    checks = @("service-state-and-path", "managed-root-membership", "file-metadata", "secret-category-scan", "internal-state-presence-only")
   }
 
   if ($Mode -eq "PlanOnly") {
@@ -167,6 +194,7 @@ try {
     ownership = $ownership
     files = @(Get-FileEvidence -Root $DataRoot)
     secretFindingCategories = @(Get-SecretFindingCategories -Root $DataRoot)
+    internalState = @(Get-InternalStateEvidence -Root $AppRoot)
   }
   $report | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $outputFullPath -Encoding UTF8
 
@@ -175,6 +203,7 @@ try {
     serviceCount = @($services | Where-Object found).Count
     fileCount = @($report.files).Count
     secretFindingCount = @($report.secretFindingCategories).Count
+    internalStateCategoryCount = @($report.internalState).Count
   }
 } catch {
   New-Result -Success $false -Action "audit-windows-smoke.$($Mode.ToLowerInvariant())" -Changed $false -Message $_.Exception.Message -Details @{}