feat: v0.2.0 — incident response, dev-credential surface, TCC inventory, baseline integrity

[DareDev256]

The kit was born from a breach and, until this release, had nothing for the hour after one. Repo-wide grep before this branch: "revoke" 0 hits, "forwarding rule" 0, "deploy key" 0, "reinstall" 0. canary/README.md ended at "you find out" and handed off to no procedure — a user whose decoy fires at 2am was holding an alert with no next step, on the compromised machine.

Human

./panic.sh --short                 # the ordered checklist, phone-sized
./panic.sh --triage                # ...plus live "did anything get root?" probes
./preserve.sh -o /Volumes/USB      # capture evidence before cleaning up
./exposurescan/exposurescan.py --tcc
zsh tests/run-corpus.zsh           # 78/78
bash tests/test-watchpost-baseline.sh   # 10/10
cd exposurescan && python3 -m unittest discover -s tests   # 72 (was 47)

Run --tcc on your own machine. It will tell you which binaries already hold Full Disk Access, Accessibility and Screen Recording — the grants a pasted payload inherits for free.

Agent

Intent. Close the three gaps the v0.2.0 plan ranked highest by real-victim impact, and nothing else. No new tools; the kit stays at six.

The ordering in INCIDENT.md is the deliverable, not the prose. Two steps are commonly inverted and both inversions waste the entire effort:

1. Crypto before anything. It is the only irreversible loss. A seed phrase is the wallet — "change the password" does nothing.
2. Kill sessions before changing passwords. A stolen cookie authenticates without the password and without 2FA, and a password change does not reliably invalidate live sessions. Reset first and stop there, and the attacker is still signed in, behind a password that now protects nothing. exposurescan.py already said cookies "bypass password + MFA"; the kit never turned that into a procedure.

Developer tokens are ordered by blast radius — npm/PyPI publish tokens first, because that is where a personal breach becomes a supply-chain breach; cloud keys disable-then-delete so the audit trail survives deletion.

WatchPost could be blinded by one rm. Deleting baseline.json was read as a first run: the next run printed "No diffing on first run" and silently absorbed whatever had just been planted as legitimate. An .armed marker makes deletion alertable; an HMAC tag catches pre-seeding the file so a later plant diffs as already-known; the baseline is 0600 in a 0700 dir (it was 0644, and it enumerates every persistence entry on the machine). Test C in the new suite is the one I care about most: a genuinely new plant is still reported after all the hardening — it is easy to lock a monitor down until it stops monitoring.

What was deliberately NOT built, and why, because the roadmap's credibility depends on this section being unflattering:

• preserve.sh defers wholly to Jamf Aftermath when installed and stops. Free, Swift, purpose-built, collects a superset. The value here is the ClickFix-specific ordering, not the collection.
• No general hardening scanner. FileVault, firewall, update settings, sudoers, the CIS sweep — mSCP and Pareto own that and own it better. Only the narrow ClickFix-relevant slice (--tcc) ships, and the README cites them for the rest.

Honest limits documented rather than papered over:

• The WatchPost HMAC key sits beside the baseline under the same user, so anyone already running as you can forge it. This is tamper-evidence, not tamper-proofing. The root-owned /var/db/watchpost variant that would be proof is named and explicitly not claimed.
• Safari login counts are not obtainable without a keychain prompt. The report names the surface and says why rather than printing a fabricated number.
• redact()'s proximity rule over-fires on labels containing a bare auth/token/cookie, and on filenames ≥20 chars. The tool's own strings were reworded rather than weakening the rule, per the project's stated policy; the residual over-fire is documented.

Edge cases. SSH key encryption is read from the header only, bounded to 112 base64 chars — short of the private section in both the PEM and openssh-key-v1 layouts. An unparseable header reports as ENCRYPTED, because unknown must never render as the P0 case. preserve.sh's unified-log query filters on process rather than eventMessage CONTAINS, which forces a full log-store scan that runs for minutes — long enough that during a real incident you kill it and lose the artifact entirely.

Verification. ExposureScan's 64 TCC grants matched a hand-run sqlite3 over both databases exactly — none invented, none missed. Leak tests grep the rendered markdown and the JSON sidecar for fixture key bodies and every fake token, asserting zero hits. Both feature commits are independently green, so git bisect stays usable.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AcTJUv94F34MdtGZCGyyur