Real fix for hung user-folder scans: prune dep-caches BEFORE recursing (v4.1.4)

Brad ran v4.1.3 and AIVision was still hung. Diagnosis: the v4.1.1 fix
applied the exclusion pattern AFTER Get-ChildItem -Recurse had already
walked into node_modules / site-packages / .venv / etc. PowerShell's
pipeline filter can't prune mid-recursion the way Python's os.walk can.

Fix: new helper Get-PrunedFiles in forensic-common.ps1 that uses .NET
DirectoryInfo.EnumerateDirectories with explicit name-pruning before
descending. node_modules / site-packages / .venv / conda envs / etc.
are skipped at the directory-traversal level — they're never enumerated.

Applied to all 5 user-folder scanners that previously hung on dep caches:
- Scan-AIVisionArtifacts (4 walks: onnx, exe+py, ino, requirements/pyproject)
- Scan-LuaScripts
- Scan-UserScriptContents
- Scan-ObscuredFileNames
- Scan-KnownHashes

Verified end-to-end on Brad's machine (v3.1.3 had killed at 36s+ in
AIVision and counting). Post-fix run:

  Scan-AIVisionArtifacts:    33.87s  (completes; was unbounded)
  Scan-KnownHashes:          14.89s
  Scan-LuaScripts:           14.05s
  Scan-Downloads:             8.20s
  Scan-Drivers:               6.85s
  ...everything else < 5s
  TOTAL:                     92.92s

Still room to push AIVision lower (the .exe/.py walk + per-pattern
keyword regex is the bulk), but it's no longer the hang case.

Default pruned dir-name list lives in $Script:DefaultPrunedDirNames at
the top of the helper so future scanners can opt in via Get-PrunedFiles
instead of bare Get-ChildItem -Recurse.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Sutaigne

.gitignore

@@ -33,3 +33,4 @@ AlibiRigReport_*_visual.html
 *alibi-pc.summary
 *alibi-console.summary
 *alibi-loldb.json
+_test_*

HASHES.txt

@@ -3,12 +3,8 @@
 # To verify a kit you received:
 #   1. Download HASHES.txt from this repo at the matching tag.
 #   2. In the kit folder, run:  sha256sum -c HASHES.txt
-#      (or, pure-Windows: Get-FileHash per file).
-#   3. Every line must report 'OK'. Mismatch = modified kit; don't trust the report.
 #
-# Re-generated on each release.
-#
-# Format: <SHA256>  <relative-path>
+# Re-generated on each release. Format: <SHA256>  <relative-path>
 
 # --- repo root: the runnable distribution ---
 314058db7beff3511bb59556f34b9d5dd35e7fdb54fc3dd6d7193b0f45e01a82 *Run scan.bat
@@ -21,7 +17,7 @@ da10d733a8628d518a9931693761f02645eb63d8278d08d9df7f8c1d7e53108f *scanner/consol
 8c3c8eaf9d99990de6e60a513dfb3f97f57eaa350c5fbfc1e22698a9a00bcc3d *scanner/console-rig-audit.ps1
 0b680b000ecc2b500bbde276aadac5a850a8dcbc11c8990f52a96e21a11b22a1 *scanner/console-run-check.bat
 065ef704012b8c3f410916e702165dc1fd197d586d852fc8473af735273b0d0b *scanner/console-setup-checklist.html
-2fd6b2c9d1d43fee58d303bcb27b3e5dde31c4b6c8d57e300ac5e6bf46f602e8 *scanner/forensic-common.ps1
+f023d3250bd536023ac13d86476bd30ad7b058d519e70d893a1df988ab204889 *scanner/forensic-common.ps1
 f697d59ff68523d3aa9ba3dd8dbd015659230a221c0c668b16a574e2f1156c4b *scanner/forensic-scan.ps1
 671c81e911af316569e92ce162cfee0bb5efaff9c8096942c9b7c102aa809f40 *scanner/generate-visual-companion-console.ps1
 659db814bc9ee87bda9506fa613780bc8e6da3a487866e040d46c8bac59fd957 *scanner/generate-visual-companion.ps1

scanner/forensic-common.ps1

@@ -556,6 +556,84 @@ function Score-And-Add {
     }
 }
 
+# ============================================================================
+# Get-PrunedFiles — fast recursive file walker that prunes dependency-cache
+# directories BEFORE descending. PowerShell's Get-ChildItem -Recurse can't
+# do this (any -Where applied to the pipeline runs after enumeration, so
+# node_modules / site-packages / .venv / etc. get fully walked before the
+# filter rejects results). This helper uses .NET DirectoryInfo enumeration
+# with explicit pruning, which is dramatically faster on ML-heavy / dev
+# machines.
+#
+# Returns System.IO.FileInfo objects — same shape as Get-ChildItem -File,
+# so callers can use .FullName, .Name, .Length, .CreationTime, .LastWriteTime,
+# .DirectoryName, .Extension, .BaseName interchangeably.
+# ============================================================================
+
+$Script:DefaultPrunedDirNames = @(
+    'node_modules', '.git', '.hg', '.svn', 'site-packages',
+    'venv', '.venv', 'env', 'envs',
+    '__pycache__', '.pytest_cache', '.mypy_cache', '.ruff_cache', '.tox',
+    'anaconda3', 'miniconda3', 'conda',
+    '.cache', '.npm', '.yarn',
+    '.next', '.nuxt', '.cargo', '.rustup'
+)
+
+function Get-PrunedFiles {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$Root,
+        [string[]]$Extensions = $null,        # e.g. @('.onnx') or @('.exe','.py')
+        [int]$MaxDepth = 8,
+        [int]$ResultCap = 0,                  # 0 = unlimited
+        [string[]]$ExcludeDirNames = $null    # $null = default dep-cache list
+    )
+    if (-not (Test-Path -LiteralPath $Root)) { return }
+
+    $excludes = if ($null -ne $ExcludeDirNames) { $ExcludeDirNames } else { $Script:DefaultPrunedDirNames }
+    $excludeSet = @{}
+    foreach ($n in $excludes) { $excludeSet[$n.ToLower()] = $true }
+
+    $extSet = $null
+    if ($Extensions) {
+        $extSet = @{}
+        foreach ($e in $Extensions) {
+            $k = if ($e.StartsWith('.')) { $e.ToLower() } else { '.' + $e.ToLower() }
+            $extSet[$k] = $true
+        }
+    }
+
+    $results = [System.Collections.Generic.List[System.IO.FileInfo]]::new()
+    $stack = [System.Collections.Generic.Stack[object]]::new()
+    try {
+        $stack.Push(@{ Dir = [System.IO.DirectoryInfo]::new($Root); Depth = 0 })
+    } catch { return $results }
+
+    while ($stack.Count -gt 0) {
+        $cur = $stack.Pop()
+        $dir = $cur.Dir
+        $depth = $cur.Depth
+
+        try {
+            foreach ($f in $dir.EnumerateFiles()) {
+                if ($extSet -and -not $extSet.ContainsKey($f.Extension.ToLower())) { continue }
+                [void]$results.Add($f)
+                if ($ResultCap -gt 0 -and $results.Count -ge $ResultCap) { return $results }
+            }
+        } catch {}
+
+        if ($depth -ge $MaxDepth) { continue }
+
+        try {
+            foreach ($d in $dir.EnumerateDirectories()) {
+                if ($excludeSet.ContainsKey($d.Name.ToLower())) { continue }
+                $stack.Push(@{ Dir = $d; Depth = $depth + 1 })
+            }
+        } catch {}
+    }
+    return $results
+}
+
 # ============================================================================
 # SCAN FUNCTIONS
 # ============================================================================
@@ -1109,17 +1187,15 @@ function Scan-UserScriptContents {
     $scanRoots = $scanRoots | Where-Object { Test-Path $_ }
 
     $scriptFiles = [System.Collections.Generic.List[object]]::new()
+    # v4.1.4: Get-PrunedFiles handles dep-cache pruning + multi-extension walk
+    # in one pass per root (faster than the prior per-extension loop).
+    $scriptExts = @('.bat','.cmd','.ps1','.vbs','.wsf','.psm1','.lua','.ahk')
     foreach ($root in $scanRoots) {
-        foreach ($ext in @('*.bat','*.cmd','*.ps1','*.vbs','*.wsf','*.psm1','*.lua','*.ahk')) {
-            try {
-                Get-ChildItem $root -Recurse -File -Depth 8 -Filter $ext -ErrorAction SilentlyContinue |
-                    Where-Object {
-                        $_.Length -lt 10MB -and
-                        ($_.Name.ToLower() -notin $excludeNames) -and
-                        (-not ($selfDir -and $_.DirectoryName.ToLower().StartsWith($selfDir)))
-                    } |
-                    ForEach-Object { [void]$scriptFiles.Add($_) }
-            } catch {}
+        foreach ($f in (Get-PrunedFiles -Root $root -Extensions $scriptExts -ResultCap 3000)) {
+            if ($f.Length -ge 10MB) { continue }
+            if ($f.Name.ToLower() -in $excludeNames) { continue }
+            if ($selfDir -and $f.DirectoryName.ToLower().StartsWith($selfDir)) { continue }
+            [void]$scriptFiles.Add($f)
         }
     }
 
@@ -1207,25 +1283,24 @@ function Scan-ObscuredFileNames {
 
     $extWatchlist = @('.exe','.dll','.bat','.cmd','.ps1','.vbs','.lua','.ahk','.sys','.bin')
 
+    # v4.1.4: dep-cache prune. node_modules etc. would never be the place where
+    # someone hides a cheat under a hex-name; skipping these is detection-neutral.
     foreach ($root in $roots) {
-        try {
-            Get-ChildItem $root -Recurse -File -Depth 8 -ErrorAction SilentlyContinue |
-                Where-Object { $extWatchlist -contains $_.Extension.ToLower() -and $_.Length -lt 100MB } |
-                ForEach-Object {
-                    $name = $_.BaseName
-                    $reason = ''
-                    if ($name -match '^0x[0-9a-fA-F]+$') { $reason = "0x-prefix hex name ($name$($_.Extension))" }
-                    elseif ($name -match '^[0-9a-fA-F]{8,}$' -and $name -match '[a-fA-F]') { $reason = "raw hex name ($name$($_.Extension))" }
-                    elseif ($name -match '^\d{4,}$') { $reason = "pure-numeric name ($name$($_.Extension))" }
-                    elseif ($name -match '^[a-zA-Z0-9]{1,2}$' -and $name -notin @('go','vc','7z','C','x')) { $reason = "ultra-short obscured name ($name$($_.Extension))" }
-                    if ($reason) {
-                        Add-Finding 'ObscuredNames' $_.FullName "Obscured filename: $reason" 'MEDIUM' 'dual-use' @{
-                            FileName = $_.Name; FullPath = $_.FullName; Pattern = $reason
-                            SizeBytes = $_.Length; LastWrite = $_.LastWriteTime.ToString('s')
-                        }
-                    }
+        foreach ($f in (Get-PrunedFiles -Root $root -Extensions $extWatchlist -ResultCap 4000)) {
+            if ($f.Length -ge 100MB) { continue }
+            $name = $f.BaseName
+            $reason = ''
+            if ($name -match '^0x[0-9a-fA-F]+$') { $reason = "0x-prefix hex name ($name$($f.Extension))" }
+            elseif ($name -match '^[0-9a-fA-F]{8,}$' -and $name -match '[a-fA-F]') { $reason = "raw hex name ($name$($f.Extension))" }
+            elseif ($name -match '^\d{4,}$') { $reason = "pure-numeric name ($name$($f.Extension))" }
+            elseif ($name -match '^[a-zA-Z0-9]{1,2}$' -and $name -notin @('go','vc','7z','C','x')) { $reason = "ultra-short obscured name ($name$($f.Extension))" }
+            if ($reason) {
+                Add-Finding 'ObscuredNames' $f.FullName "Obscured filename: $reason" 'MEDIUM' 'dual-use' @{
+                    FileName = $f.Name; FullPath = $f.FullName; Pattern = $reason
+                    SizeBytes = $f.Length; LastWrite = $f.LastWriteTime.ToString('s')
                 }
-        } catch {}
+            }
+        }
     }
 }
 
@@ -1301,14 +1376,13 @@ function Scan-KnownHashes {
     }
     $roots = $roots | Where-Object { Test-Path $_ }
 
+    # v4.1.4: dep-cache prune. Skips node_modules / site-packages / .venv etc.
+    # A real cheat-sample wouldn't be stashed inside an npm dependency tree.
     $candidates = [System.Collections.Generic.List[object]]::new()
     foreach ($root in $roots) {
-        foreach ($ext in @('*.exe','*.dll')) {
-            try {
-                Get-ChildItem $root -Recurse -File -Depth 8 -Filter $ext -ErrorAction SilentlyContinue |
-                    Where-Object { $_.Length -lt 100MB -and $_.Length -gt 0 } |
-                    ForEach-Object { [void]$candidates.Add($_) }
-            } catch {}
+        foreach ($f in (Get-PrunedFiles -Root $root -Extensions @('.exe','.dll') -ResultCap 2000)) {
+            if ($f.Length -le 0 -or $f.Length -ge 100MB) { continue }
+            [void]$candidates.Add($f)
         }
     }
 
@@ -1346,9 +1420,11 @@ function Scan-LuaScripts {
         "$env:USERPROFILE\Projects", "$env:USERPROFILE\Games"
     ) | Where-Object { $_ -and (Test-Path $_) }
 
+    # v4.1.4: prune dep-cache dirs (node_modules / site-packages / .venv / etc.)
+    # before recursing — those routinely contain bundled .lua files (Neovim
+    # plugins, build-tool .lua scripts) that aren't real cheat scripts.
     foreach ($root in $roots) {
-        Get-ChildItem $root -Recurse -File -Depth 8 -Filter '*.lua' -ErrorAction SilentlyContinue | ForEach-Object {
-            $file = $_
+        foreach ($file in (Get-PrunedFiles -Root $root -Extensions @('.lua') -ResultCap 1500)) {
             $zone = Get-DownloadSourceUrl $file.FullName
             $meta = @{
                 FileName       = $file.Name
@@ -1368,20 +1444,20 @@ function Scan-LuaScripts {
             if ($hit) {
                 $meta['Pattern'] = $hit
                 Add-Finding 'LuaScript' $file.FullName "[$hit] $($file.Name)" 'HIGH' 'cheat' $meta
-                return
+                continue
             }
 
             $hitC = Match-Keyword $lc $Keywords_High_Cheats
             if ($hitC) {
                 $meta['Pattern'] = $hitC
                 Add-Finding 'LuaScript' $file.FullName "[$hitC] $($file.Name)" 'HIGH' 'cheat' $meta
-                return
+                continue
             }
             $hitI = Match-Keyword $lc $Keywords_High_Input
             if ($hitI) {
                 $meta['Pattern'] = $hitI
                 Add-Finding 'LuaScript' $file.FullName "[$hitI] $($file.Name)" 'HIGH' 'input' $meta
-                return
+                continue
             }
 
             # No cheat or input-device keyword. Emit at INFO so the file is listed
@@ -1722,10 +1798,10 @@ function Scan-AIVisionArtifacts {
     # — walking them was the single biggest contributor to AIVision wall time.
     Write-Host '  [*] AI-vision aimbot artifacts (ONNX / YOLO / external HID)...' -ForegroundColor DarkGray
 
-    # Skip these directory NAMES (matched as path segments, case-insensitive).
-    # A real AI-aimbot constellation lives in a hand-organized user folder,
-    # not in a dependency cache. Skipping these is detection-neutral.
-    $excludePattern = '(?i)\\(node_modules|\.git|\.hg|\.svn|site-packages|\.venv|venv|env|envs|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|\.tox|anaconda3|miniconda3|conda|\.cache|\.npm|\.yarn|\.next|\.nuxt|\.cargo|\.rustup|dist-info)\\'
+    # v4.1.4 perf: use Get-PrunedFiles which prunes node_modules / site-packages
+    # / .venv / conda envs / etc. BEFORE recursing into them. The previous
+    # v4.1.1 fix only filtered AFTER Get-ChildItem enumerated, which on
+    # ML-heavy machines still hung walking caches with 100k+ files inside.
 
     $roots = @(
         "$env:USERPROFILE\Documents", "$env:USERPROFILE\Desktop",
@@ -1739,81 +1815,61 @@ function Scan-AIVisionArtifacts {
     $arduinoHits = [System.Collections.Generic.List[object]]::new()
     $pyDepHits = [System.Collections.Generic.List[object]]::new()
 
-    # Hard caps on the .exe/.py walk in particular — ML-heavy users can have
-    # tens of thousands of Python scripts across virtualenvs. We don't need
-    # to scan them all to find a named-brand aimbot binary.
     $exePyCapPerRoot = 800
     $pyDepCapPerRoot = 150
 
     foreach ($root in $roots) {
-        # ONNX models (YOLO weights). Cap recursion depth implicitly via cap on results.
-        try {
-            Get-ChildItem $root -Recurse -File -Depth 8 -Filter '*.onnx' -ErrorAction SilentlyContinue |
-                Where-Object { $_.FullName -notmatch $excludePattern } |
-                Select-Object -First 200 |
-                ForEach-Object { [void]$onnxFiles.Add($_) }
-        } catch {}
+        # ONNX models (YOLO weights).
+        foreach ($f in (Get-PrunedFiles -Root $root -Extensions @('.onnx') -ResultCap 200)) {
+            [void]$onnxFiles.Add($f)
+        }
 
         # Named-brand executables (HIGH on their own).
-        try {
-            Get-ChildItem $root -Recurse -File -Depth 8 -Include '*.exe','*.py' -ErrorAction SilentlyContinue |
-                Where-Object { $_.FullName -notmatch $excludePattern -and $_.Length -lt 200MB } |
-                Select-Object -First $exePyCapPerRoot |
-                ForEach-Object {
-                    $hit = Match-Keyword "$($_.Name) $($_.DirectoryName)" $VisionAimbot_AI_PC
-                    if ($hit) {
-                        $meta = @{
-                            Pattern   = $hit
-                            FileName  = $_.Name
-                            FullPath  = $_.FullName
-                            SizeBytes = $_.Length
-                            Created   = $_.CreationTime.ToString('s')
-                            LastWrite = $_.LastWriteTime.ToString('s')
-                        }
-                        Add-Finding 'AIVision' $_.FullName "[$hit] AI-vision aimbot executable: $($_.Name)" 'HIGH' 'cheat' $meta
-                        [void]$brandHits.Add($_)
-                    }
+        foreach ($f in (Get-PrunedFiles -Root $root -Extensions @('.exe','.py') -ResultCap $exePyCapPerRoot)) {
+            if ($f.Length -ge 200MB) { continue }
+            $hit = Match-Keyword "$($f.Name) $($f.DirectoryName)" $VisionAimbot_AI_PC
+            if ($hit) {
+                $meta = @{
+                    Pattern   = $hit
+                    FileName  = $f.Name
+                    FullPath  = $f.FullName
+                    SizeBytes = $f.Length
+                    Created   = $f.CreationTime.ToString('s')
+                    LastWrite = $f.LastWriteTime.ToString('s')
                 }
-        } catch {}
+                Add-Finding 'AIVision' $f.FullName "[$hit] AI-vision aimbot executable: $($f.Name)" 'HIGH' 'cheat' $meta
+                [void]$brandHits.Add($f)
+            }
+        }
 
-        # Arduino sketches with HID-descriptor patterns - dead giveaway when
-        # paired with the ONNX/Python side of the constellation.
-        try {
-            Get-ChildItem $root -Recurse -File -Depth 8 -Filter '*.ino' -ErrorAction SilentlyContinue |
-                Where-Object { $_.FullName -notmatch $excludePattern } |
-                Select-Object -First 100 |
-                ForEach-Object {
-                    try {
-                        $content = Get-Content $_.FullName -Raw -ErrorAction Stop
-                        if ($content -match '(?i)(Mouse\.move|HID-Project|MouseAbsolute|Keyboard\.press.*Mouse)') {
-                            [void]$arduinoHits.Add($_)
-                        }
-                    } catch {}
+        # Arduino sketches with HID-descriptor patterns.
+        foreach ($f in (Get-PrunedFiles -Root $root -Extensions @('.ino') -ResultCap 100)) {
+            try {
+                $content = Get-Content $f.FullName -Raw -ErrorAction Stop
+                if ($content -match '(?i)(Mouse\.move|HID-Project|MouseAbsolute|Keyboard\.press.*Mouse)') {
+                    [void]$arduinoHits.Add($f)
                 }
-        } catch {}
+            } catch {}
+        }
 
-        # Python ML dependency markers - requirements.txt / pyproject.toml /
-        # site-packages dirs naming aimbot-typical libraries.
-        try {
-            Get-ChildItem $root -Recurse -File -Depth 8 -Include 'requirements.txt','pyproject.toml','*.cfg' -ErrorAction SilentlyContinue |
-                Where-Object { $_.FullName -notmatch $excludePattern } |
-                Select-Object -First $pyDepCapPerRoot |
-                ForEach-Object {
-                    try {
-                        $content = Get-Content $_.FullName -Raw -ErrorAction Stop
-                        $combo = 0
-                        if ($content -match '(?i)ultralytics') { $combo++ }
-                        if ($content -match '(?i)\btorch\b') { $combo++ }
-                        if ($content -match '(?i)\bmss\b') { $combo++ }
-                        if ($content -match '(?i)pyautogui|pydirectinput|pynput') { $combo++ }
-                        if ($content -match '(?i)opencv-python|cv2') { $combo++ }
-                        if ($content -match '(?i)onnxruntime') { $combo++ }
-                        if ($combo -ge 3) {
-                            [void]$pyDepHits.Add(@{ File=$_; Score=$combo })
-                        }
-                    } catch {}
+        # Python ML dependency markers - requirements.txt / pyproject.toml / .cfg
+        foreach ($f in (Get-PrunedFiles -Root $root -Extensions @('.txt','.toml','.cfg') -ResultCap ($pyDepCapPerRoot * 3))) {
+            $n = $f.Name.ToLower()
+            if ($n -ne 'requirements.txt' -and $n -ne 'pyproject.toml' -and -not $n.EndsWith('.cfg')) { continue }
+            try {
+                $content = Get-Content $f.FullName -Raw -ErrorAction Stop
+                $combo = 0
+                if ($content -match '(?i)ultralytics') { $combo++ }
+                if ($content -match '(?i)\btorch\b') { $combo++ }
+                if ($content -match '(?i)\bmss\b') { $combo++ }
+                if ($content -match '(?i)pyautogui|pydirectinput|pynput') { $combo++ }
+                if ($content -match '(?i)opencv-python|cv2') { $combo++ }
+                if ($content -match '(?i)onnxruntime') { $combo++ }
+                if ($combo -ge 3) {
+                    [void]$pyDepHits.Add(@{ File=$f; Score=$combo })
                 }
-        } catch {}
+            } catch {}
+        }
     }
 
     # Emit ONNX findings according to constellation rules.