Release v1.1.3 · TheRealJesusTheHacker/NitroCore

Registry undo restore now refuses any snapshot entry outside HKCU — a
planted %APPDATA%\NitroCore\registry_undo\undo-*.json can never turn this
elevated process into a registry writer in another hive (every snapshot the
app writes is HKCU)
Helper executables (powershell, powercfg, cleanmgr, dism) are now
resolved via %SystemRoot%\System32 instead of PATH (system_tool_path()),
so a PATH-hijacked binary can never be picked up with admin rights
Build and dev dependencies fully pinned (setuptools==75.8.2 in
pyproject.toml; exact pins across requirements.txt /
requirements-dev.txt) for reproducible privileged builds

First pytest suite (NitroCore/tests/, 90+ tests): profiles/pipeline logic,
preview recorder, CLI parsing, reparse-point fail-closed gate, registry
undo serialization, dry-run paths for temp/disk/performance/services, and
restore-point guards. Windows-only paths are marked windows_only and
skipped off Windows; no test mutates the registry, services, or filesystem.
pyproject.toml: pytest config, ruff (E/F/I/W) and black (88 cols) settings.
CI now runs the pytest suite and ruff + black checks on every push/PR
(ubuntu runner, SHA-pinned actions).
requirements-dev.txt is now Linux-safe (no longer pulls in pywin32 via
requirements.txt); adds ruff.
Issue templates (bug report, feature request) and a PR template with a
safety checklist for system-mutating changes.
README rewritten with full per-tab feature rundown, architecture notes,
Preview Mode docs, verification guide, roadmap, and a Donations section.

Registry undo: snapshots are now cleared from memory once written to disk,
so repeated runs can't accumulate stale snapshots (a later "undo" could
previously revert values from an earlier run instead of the run being undone)
Temp/Downloads cleanup: pathologically deep directory trees (deeper than the
interpreter recursion limit) now skip that subtree instead of failing the
whole cleanup step with a RecursionError
Run All pipeline now invalidates the cached power-plan reading on
completion, so the header can't show a stale plan for up to 120 s (the
Pip-Boy purge path already did this)
Service Manager: service handles are now released in finally, fixing a
handle leak when a query/control call raised after the handle was opened
Restore-point PowerShell call now runs with -NonInteractive, matching the
pagefile optimization call site

Whole codebase formatted with black and ruff --fix (whitespace, import
order, two genuinely-unused imports removed). No behavior changes.

What's Changed

chore(deps): bump actions/setup-python from 5.6.0 to 7.0.0 by @dependabot[bot] in #9
chore(deps): bump github/codeql-action/autobuild from 3.38.3 to 4.38.2 by @dependabot[bot] in #10

Full Changelog: v1.1.2...v1.1.3