aporter/inventory
Watch
1
0
Fork
You've already forked inventory
 1
Code Issues Pull requests 3 Projects Releases Packages Wiki Activity Actions

Offer to wipe the PC at the end of a run #3

Merged
aporter merged 2 commits from wipe-prompt into main 2026-11-04 13:20:55 +10:00
Conversation 0 Commits 2 Files changed 2 +197 -1
aporter commented 2026-11-04 13:19:29 +10:00
Owner

At the end of a run the script can now wipe the PC (Windows "Remove everything + clean the drive"), with time to pull the USB stick first. Version 2026.11.04.3.

Nothing is wiped unless all of these hold, in order:

  1. Running as admin, and this run's own results are uploaded (its PR was created) or verified on the USB stick (report.md + report.json non-empty).
  2. The tester types the PC's asset ID after a red warning. Enter, y, a wrong ID or no input all skip.
  3. Mains power (laptops) and WinRE enabled (reagentc /info).
  4. USB flushed (Write-VolumeCache; failure aborts), then the stick must actually be removed. Any key or 5 minutes cancels.
  5. 10 second countdown; any key cancels.

Then a one-shot SYSTEM scheduled task (no trigger, unique name, deleted afterwards) calls MDM RemoteWipe doWipeProtectedMethod, logging INVOKING / ACCEPTED / REJECTED / UNKNOWN. Only an explicit rejection opens Settings > Recovery for a manual reset. A timeout or any error after the task starts reports "unknown, do not run again". Windows Home skips the task and opens the Settings reset.

README: new "Wiping a PC" section, including that rerunning on an already-inventoried PC keeps its asset ID.

Tests (macOS pwsh 7, script functions loaded with Windows cmdlets stubbed): parse OK; 17 skip/cancel/failure paths create and start no task; Home opens only the manual route; task start failure gives UNKNOWN with no manual fallback; positive control creates and starts the task; generated SYSTEM payload parses. Not yet run on real Windows / PowerShell 5.1. The first real test is the rerun on the first PC.

Review-gate: gpt-6.1-sol fix-then-ship (Codex), plan and diff. Plan findings all applied (see commit 7d03d2a). Diff blockers fixed in 7547c5f: keys waiting in the buffer now cancel instead of being discarded; errors after Start-ScheduledTask are UNKNOWN, not REJECTED, so the manual reset never opens while a wipe may be running. Nit left: a missing RemoteWipe return value counts as accepted (no fallback either way).

🤖 Generated with Claude Code

At the end of a run the script can now wipe the PC (Windows "Remove everything + clean the drive"), with time to pull the USB stick first. Version 2026.11.04.3. Nothing is wiped unless all of these hold, in order: 1. Running as admin, and this run's own results are uploaded (its PR was created) or verified on the USB stick (report.md + report.json non-empty). 2. The tester types the PC's asset ID after a red warning. Enter, `y`, a wrong ID or no input all skip. 3. Mains power (laptops) and WinRE enabled (`reagentc /info`). 4. USB flushed (`Write-VolumeCache`; failure aborts), then the stick must actually be removed. Any key or 5 minutes cancels. 5. 10 second countdown; any key cancels. Then a one-shot SYSTEM scheduled task (no trigger, unique name, deleted afterwards) calls MDM RemoteWipe `doWipeProtectedMethod`, logging `INVOKING` / `ACCEPTED` / `REJECTED` / `UNKNOWN`. Only an explicit rejection opens Settings > Recovery for a manual reset. A timeout or any error after the task starts reports "unknown, do not run again". Windows Home skips the task and opens the Settings reset. README: new "Wiping a PC" section, including that rerunning on an already-inventoried PC keeps its asset ID. Tests (macOS pwsh 7, script functions loaded with Windows cmdlets stubbed): parse OK; 17 skip/cancel/failure paths create and start no task; Home opens only the manual route; task start failure gives UNKNOWN with no manual fallback; positive control creates and starts the task; generated SYSTEM payload parses. **Not yet run on real Windows / PowerShell 5.1.** The first real test is the rerun on the first PC. Review-gate: gpt-6.1-sol fix-then-ship (Codex), plan and diff. Plan findings all applied (see commit 7d03d2a). Diff blockers fixed in 7547c5f: keys waiting in the buffer now cancel instead of being discarded; errors after `Start-ScheduledTask` are UNKNOWN, not REJECTED, so the manual reset never opens while a wipe may be running. Nit left: a missing RemoteWipe return value counts as accepted (no fallback either way). 🤖 Generated with [Claude Code](https://claude.com/claude-code) 
Typed asset-ID confirmation, results must be uploaded or on the USB,
WinRE and mains power preflight, USB removal and a cancellable countdown,
then MDM RemoteWipe doWipeProtected via a one-shot SYSTEM task. Home
editions get the Settings reset instead.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
aporter deleted branch wipe-prompt 2026-11-04 13:20:55 +10:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
aporter/inventory!3
No description provided.