Release Clean Your Data v0.4.0

.github/workflows/release.yml

@@ -6,20 +6,64 @@ on:
       - "v*"
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
+  verify:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install package
+        run: python -m pip install --no-deps .
+      - name: Compile and test
+        run: |
+          python -m compileall -q src audit-local-files/scripts tests
+          for test in tests/*_test.py; do python "$test"; done
+
   release:
+    needs: verify
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+      - name: Verify tag and package version
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          python - <<'PY'
+          import os
+          import tomllib
+          from pathlib import Path
+
+          version = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))["project"]["version"]
+          expected = f"v{version}"
+          if os.environ["RELEASE_TAG"] != expected:
+              raise SystemExit(f"release tag {os.environ['RELEASE_TAG']!r} must equal {expected!r}")
+          PY
       - name: Build distributions
         run: |
-          python -m pip install build
+          python -m pip install build twine
           python -m build
+          python -m twine check dist/*
+          python - <<'PY'
+          import zipfile
+          from pathlib import Path
+
+          wheel = next(Path("dist").glob("*.whl"))
+          with zipfile.ZipFile(wheel) as archive:
+              names = set(archive.namelist())
+          assert "clean_your_data/web/index.html" in names
+          PY
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}

.github/workflows/test.yml

@@ -31,6 +31,10 @@ jobs:
         run: python tests/interactive_test.py
       - name: Run terminal UI test
         run: python tests/tui_test.py
+      - name: Run local GUI test
+        run: python tests/gui_test.py
+      - name: Run Agent trace test
+        run: python tests/trace_test.py
       - name: Run cleanup loop test
         run: python tests/cleanup_test.py
       - name: Run workspace actions test

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.4.0 - 2026-08-12
+
+- Added `cyd gui [PATH]`, a local browser interface backed by the same scanner and cleanup gates as the TUI.
+- Added expandable relative-size browsing, bounded local previews, search, sorting, relationships, per-path Agent conversations, and responsive desktop/mobile layouts.
+- Added secret-free AI configuration for Codex, custom stdin/stdout commands, or AI-off operation.
+- Added exact-path cleanup baskets, system Trash moves, rescanning, and undo to the GUI.
+- Protected active roots, VCS metadata, credential stores, and common credential files from cleanup.
+- Bound the GUI to loopback with Host validation, per-run API tokens, cross-origin checks, path redaction, restrictive response headers, and no traceback disclosure.
+- Added the opt-in `cyd trace -- <command>` wrapper for Agent sessions.
+- Records metadata-only created, modified, and deleted paths while the traced command runs.
+- Persists local session and event evidence in `~/.clean-your-data/provenance.sqlite3`.
+- Reports attribution as an observed association, not as kernel-level proof of the exact writer process.
+
+## 0.3.1 - 2026-08-10
+
+- Added relative size bars to the space map so large siblings stand out immediately.
+- Added a first-screen space summary with folder, file, rebuildable, and staged counts.
+- Reworked the folder inspector into a plain-language space story with a next-best action.
+
 ## 0.3.0 - 2026-08-10
 
 - Added the installable `clean-your-data` Python package.

MANIFEST.in

@@ -3,3 +3,4 @@ include README.md
 include CHANGELOG.md
 recursive-include audit-local-files *.md *.yaml
 recursive-include audit-local-files/scripts *.py
+recursive-include src/clean_your_data/web *.html

PRIVACY.md

@@ -1,6 +1,14 @@
 # Privacy
 
-Clean Your Data is designed for local, metadata-first analysis. The bundled scanner does not make network requests and does not upload reports. An agent may download this public repository, but the scan itself runs on the user's machine. The optional TUI cleanup loop can move an exact user-confirmed path to the local system Trash; that action and its undo record stay on the machine.
+Clean Your Data is designed for local, metadata-first analysis. The bundled scanner and GUI server do not make network requests and do not upload reports. An agent may download this public repository, but the scan itself runs on the user's machine. The optional GUI/TUI cleanup loop can move an exact user-confirmed path to the local system Trash; that action and its undo record stay on the machine.
+
+## Local Browser GUI
+
+- The GUI binds only to `127.0.0.1` on a random port by default.
+- It validates the loopback Host; its JSON API requires a random per-run token and rejects cross-origin browser requests.
+- Public API responses omit absolute local paths and internal `_local_path` fields.
+- The browser receives redacted paths, bounded metadata, and only the preview the user explicitly selects.
+- Closing the server ends the session. Agent conversations in the browser are not persisted by Clean Your Data.
 
 ## Default Redaction
 
@@ -35,6 +43,14 @@ Avoid sharing reports created with:
 - Secrets, tokens, keychains, or credentials.
 - Source file contents.
 
+## Optional AI Commands
+
+AI is disabled or configured by the user. Clean Your Data can call an already authenticated Codex CLI or a trusted custom stdin/stdout command. It stores the selected mode and custom-command arguments verbatim in `~/.clean-your-data/ai-config.json`, with user-only file permissions where supported. The GUI reports that a command is configured but does not echo its arguments through the local browser API; `cyd config ai --show` is the explicit terminal view. There is no API-key field: never put credentials in command arguments, and keep them in the provider's environment or credential store.
+
+The opt-in tracer also stores the traced command and its arguments verbatim in the local `~/.clean-your-data/provenance.sqlite3` database. Do not put credentials directly in a traced command line. The state directory and database use user-only permissions where the operating system supports them.
+
+The stdin prompt constructed by Clean Your Data contains a redacted path, name, kind, size, modified time, category, and measurement status. Clean Your Data does not place the selected file preview or file contents in that prompt. The built-in Codex mode uses a read-only, ephemeral sandbox. A custom command still has its own operating-system permissions and may use its own network connection or credential store; configure only a trusted command and review that provider's privacy behavior separately.
+
 ## Sharing Reports
 
 Before sharing a report publicly: