feat: expand read-only security audit for v1.4.0

CHANGELOG.md

@@ -6,6 +6,20 @@ All notable changes are documented here. Versions follow Semantic Versioning.
 
 No unreleased changes.
 
+## [1.4.0] - 2026-08-30
+
+### Added
+
+- Added read-only system-volume BitLocker and UEFI Secure Boot status to the audit.
+- Added `audit --json` for machine-readable audit output on standard output.
+- Added smoke-test and self-test coverage for the new audit fields and status mappings.
+- Aligned the EXE assembly and file metadata with toolkit version 1.4.0 and added a self-test guard.
+
+### Compatibility
+
+- Restore now accepts valid v1.3.2 and v1.3.3 backup manifests in addition to the existing compatible versions.
+- An unavailable BitLocker provider or insufficient read permission is reported as `Unavailable`, not as an unencrypted volume.
+
 ## [1.3.3] - 2026-08-28
 
 ### Fixed
@@ -89,7 +103,8 @@ Build, launch, version, self-test, audit, plan, report generation, listener list
 
 The first public Windows toolkit layout and safety documentation.
 
-[Unreleased]: https://github.com/KBT096/windows-secure-toolkit/compare/v1.3.3...HEAD
+[Unreleased]: https://github.com/KBT096/windows-secure-toolkit/compare/v1.4.0...HEAD
+[1.4.0]: https://github.com/KBT096/windows-secure-toolkit/releases/tag/v1.4.0
 [1.3.3]: https://github.com/KBT096/windows-secure-toolkit/releases/tag/v1.3.3
 [1.3.2]: https://github.com/KBT096/windows-secure-toolkit/releases/tag/v1.3.2
 [1.3.1]: https://github.com/KBT096/windows-secure-toolkit/releases/tag/v1.3.1

PROJECT_SUMMARY.md

@@ -18,11 +18,12 @@
 
 `src/WinSecure.cs` 负责：
 
-- 系统能力探测与只读审计；
+- 系统能力探测与只读审计，包括 BitLocker 与 UEFI 安全启动状态；
 - 注册表、Guest、SMBv1、RDP/NLA 和防火墙策略的备份与恢复；
 - 保守基线的预览、确认、执行和逐项结果；
 - Defender 扫描、DISM/SFC 验证、监听端口与版本检查；
 - 只读 `doctor` 兼容性诊断及其 JSON 输出；
+- 只读 `audit --json` 自动化输出；
 - 只读 `backups` 备份目录和清单状态查看；
 - 交互菜单、命令行参数和无修改自检。
 
@@ -51,6 +52,7 @@
 - 真实 `cmd.exe` 入口；
 - 版本、帮助和计划模式；
 - 审计报告生成与 JSON 文件；
+- `audit --json` 标准输出及 BitLocker、安全启动字段；
 - `doctor` 人类可读和 `--json` 两种输出；
 - `backups --json` 备份目录状态输出；
 - 缺少恢复路径时的错误码；
@@ -70,7 +72,7 @@
 
 - 扩展真实 Windows Server 版本测试矩阵；
 - 让 `doctor` 输出成为问题报告前的统一环境快照；
-- 为审计 JSON 提供稳定 schema 与兼容性测试；
+- 继续为审计 JSON 保持稳定 schema 与兼容性测试；
 - 增加由用户明确选择的单项配置，而不是扩大默认基线；
 - 根据真实 Issue、PR 和运行反馈调整检查项；
 - 为 Release 提供可追溯的编译附件，并保留源代码构建路径。

README.en.md

@@ -7,14 +7,15 @@
 
 Windows security settings are a bit like the fuse box: nobody wants to stare at it all day, but a small record is useful when something goes wrong.
 
-Current version: `1.3.3`.
+Current version: `1.4.0`.
 
 This is a small local toolkit with a CMD/BAT entry point and a C# engine. It checks, previews, backs up, and restores a conservative set of settings. It does not promise a magic “secure” button. Sadly, those are still out of stock.
 
 ## Core architecture and features
 
-- read-only checks for firewall, Defender, UAC, SMBv1, Guest, RDP/NLA, AutoRun, updates, and pending reboot;
+- read-only checks for firewall, Defender, UAC, SMBv1, Guest, RDP/NLA, AutoRun, BitLocker, Secure Boot, updates, and pending reboot;
 - Markdown and JSON audit reports;
+- `audit --json` for machine-readable output on standard output;
 - a preview-first baseline with explicit elevation and confirmation;
 - a SHA-256 checked manifest and firewall backup before changes;
 - same-machine, allowlisted restore;
@@ -44,13 +45,16 @@ No SDK? Open the [latest Release](https://github.com/KBT096/windows-secure-toolk
 build.cmd
 win_secure.cmd self-test
 win_secure.cmd audit
+win_secure.cmd audit --json
 win_secure.cmd plan
 win_secure.cmd doctor
 win_secure.cmd apply
 ```
 
 Run `apply` from an elevated CMD only after reading the plan. Restore example:
 
+BitLocker status can require an elevated CMD on some systems. `Unavailable` means that the state was not confirmed; it does not mean that the volume is unencrypted.
+
 ```cmd
 win_secure.cmd restore "C:\ProgramData\WindowsSecureToolkit\Backups\20260818-120000"
 ```
@@ -61,6 +65,7 @@ win_secure.cmd restore "C:\ProgramData\WindowsSecureToolkit\Backups\20260818-120
 | --- | --- |
 | `win_secure.cmd` | Open the menu |
 | `win_secure.cmd audit [path]` | Write Markdown + JSON reports |
+| `win_secure.cmd audit --json` | Write the read-only audit JSON to standard output |
 | `win_secure.cmd plan` | Preview only |
 | `win_secure.cmd apply [--yes]` | Back up and apply the baseline |
 | `win_secure.cmd restore <path>` | Validate and restore a backup |

README.md

@@ -7,14 +7,15 @@
 
 Windows 的安全设置有点像家里的电箱：平时没人想看，真出问题又希望它有记录。
 
-当前版本：`1.3.3`。
+当前版本：`1.4.0`。
 
 这个小工具从 CMD/BAT 进去，用 C# 做检查、预览、备份和恢复。它不负责把电脑变成“绝对安全”，只负责把常见的几件事做得清楚一点。
 
 ## 核心架构与功能
 
-- 只读审计：防火墙、Defender、UAC、SMBv1、Guest、RDP/NLA、AutoRun、更新服务和待重启状态；
+- 只读审计：防火墙、Defender、UAC、SMBv1、Guest、RDP/NLA、AutoRun、BitLocker、安全启动、更新服务和待重启状态；
 - 生成 Markdown 和 JSON 报告；
+- 支持 `audit --json` 将机器可读结果直接输出到标准输出；
 - 预览一套保守基线，确认以后才应用；
 - 应用前保存清单、SHA-256 和防火墙策略；
 - 在同一台电脑上校验后恢复备份；
@@ -58,10 +59,11 @@ win_secure.cmd self-test
 ```cmd
 win_secure.cmd doctor
 win_secure.cmd audit
+win_secure.cmd audit --json
 win_secure.cmd plan
 ```
 
-`doctor` 检查系统兼容性，`audit` 生成 Markdown 和 JSON 报告，`plan` 显示将要处理的项目和可能的影响。
+`doctor` 检查系统兼容性，`audit` 生成 Markdown 和 JSON 报告，`audit --json` 为自动化输出纯 JSON，`plan` 显示将要处理的项目和可能的影响。BitLocker 状态在部分系统上需要从提升后的 CMD 读取；`Unavailable` 表示没有确认到状态，不等于磁盘未加密。
 
 ### 第三步：确认后应用设置
 
@@ -93,6 +95,7 @@ win_secure.cmd restore "C:\ProgramData\WindowsSecureToolkit\Backups\20260818-120
 | --- | --- |
 | `win_secure.cmd` | 打开菜单 |
 | `win_secure.cmd audit [路径]` | 生成 Markdown + JSON 审计报告 |
+| `win_secure.cmd audit --json` | 将只读审计 JSON 输出到标准输出 |
 | `win_secure.cmd plan` | 预览，不修改系统 |
 | `win_secure.cmd apply [--yes]` | 备份并应用基线 |
 | `win_secure.cmd restore <路径>` | 校验并恢复备份 |

docs/WINDOWS_VALIDATION.md

@@ -21,9 +21,11 @@ The JSON form has `SchemaVersion`, `ToolkitVersion`, `GeneratedUtc`, `ComputerNa
 | CMD/BAT entry points | Not recorded in this matrix | Verified | Verified | The real Windows entry point forwards exit codes |
 | `self-test`, `version`, `help`, `plan` | Not recorded in this matrix | Verified | Verified | Core parsing and no-change checks run |
 | `doctor` and `doctor --json` | Not recorded in this matrix | Verified | Verified | Diagnostic output is available without system changes |
-| Audit reports | Not recorded in this matrix | Verified | Verified | Markdown and JSON reports can be generated |
+| Audit reports and `audit --json` | Not recorded in this matrix | Verified | Verified | Markdown, file JSON, and standard-output JSON can be generated |
+| Secure Boot audit | Not recorded in this matrix | Verified | Smoke-tested | The registry-backed state is reported without changing firmware settings |
+| BitLocker audit | Not recorded in this matrix | `Unavailable` without elevation | Smoke-tested | The command handles inaccessible or absent providers without treating them as an unencrypted result |
 | Apply / Restore | Verified by the maintainer | Verified by the maintainer | Not run | The real privileged paths were exercised locally on both versions; CI intentionally does not perform system-changing operations |
 
-The maintainer has completed backed-up `Apply` and `Restore` validation on Windows 10 and Windows 11 through the normal elevated and confirmation flow. This is version-level evidence from the maintainer's test machines; it is not a claim that every Windows edition, policy combination, or managed environment behaves identically. A `Not recorded in this matrix` entry means that a separate result for that surface was not retained here; it does not mean the command is unsupported.
+The maintainer has completed backed-up `Apply` and `Restore` validation on Windows 10 and Windows 11 through the normal elevated and confirmation flow. This is version-level evidence from the maintainer's test machines; it is not a claim that every Windows edition, policy combination, or managed environment behaves identically. A `Not recorded in this matrix` entry means that a separate result for that surface was not retained here; it does not mean the command is unsupported. For BitLocker, `Unavailable` means the current token or WMI provider did not expose the state; it is not a negative encryption finding.
 
 The CI job remains a smoke-test gate, not a privileged deployment test. If behavior differs on Windows 10 or Windows 11, open an [Issue](https://github.com/KBT096/windows-secure-toolkit/issues) with the toolkit version, Windows edition/build, elevation state, exact command, sanitized output, and whether the backup was retained. Do not attach secrets, raw audit reports, or private system identifiers.

scripts/Test-Repository.cmd

@@ -59,6 +59,17 @@ call :run_ok_args backups --json
 
 if exist "%TEST_ROOT%" rmdir /s /q "%TEST_ROOT%"
 mkdir "%TEST_ROOT%" >nul 2>nul
+call "%TOOL_ROOT%win_secure.cmd" audit --json > "%TEST_ROOT%\audit-stdout.json"
+if errorlevel 1 (
+    echo [失败] audit --json 命令失败。
+    set /a FAILURES+=1
+) else (
+    echo [完成] audit --json 命令通过。
+    call :require_text "%TEST_ROOT%\audit-stdout.json" "SchemaVersion"
+    call :require_text "%TEST_ROOT%\audit-stdout.json" "bitlocker"
+    call :require_text "%TEST_ROOT%\audit-stdout.json" "secure-boot"
+)
+
 call "%TOOL_ROOT%win_secure.cmd" audit "%TEST_ROOT%"
 if errorlevel 1 (
     echo [失败] 审计报告命令失败。
@@ -108,6 +119,17 @@ if errorlevel 1 (
 )
 exit /b 0
 
+:require_text
+set /a CHECKS+=1
+findstr /i /c:"%~2" "%~1" >nul 2>nul
+if errorlevel 1 (
+    echo [失败] %~1 缺少文本：%~2
+    set /a FAILURES+=1
+) else (
+    echo [完成] %~1 包含文本：%~2
+)
+exit /b 0
+
 :run_ok
 set /a CHECKS+=1
 call "%TOOL_ROOT%win_secure.cmd" %~1 >nul