/op-clean

description: Clean logs, metadata, and forensic traces from a target system
allowed-tools: ToolSearch, Bash, Read, Write, Glob, Grep, AskUserQuestion
argument-hint: <target-host> [--scope logs|metadata|timestamps|memory|full] [--dry-run]

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to /tmp/ or any system temporary directory.

Log and Trace Cleaning

Target and options: `$ARGUMENTS`

1. Parse `$ARGUMENTS` for target host, `--scope` (default `full`), and `--dry-run` flag. Store parsed values for use throughout the command.

2. If `--dry-run` is set: enumerate and list all artifacts that would be cleaned for each scope category without executing any destructive operations. Present a summary and exit.

3. **Logs** (`--scope logs` or `full`): Clear system log entries:

• Truncate or selectively edit `/var/log/auth.log`, `/var/log/syslog`, `/var/log/kern.log`
• Run `journalctl --vacuum-time=1s` to purge systemd journal entries
• Edit binary login records: `wtmp` (who was logged in), `btmp` (failed logins), `lastlog` (last login per user)
• Clear application-specific logs as identified

4. **Metadata** (`--scope metadata` or `full`): Strip file metadata from specified paths:

• Use `mat2` for broad metadata removal across file types
• Use `exiftool -all=` for image and document EXIF/XMP data
• Verify metadata removal by re-reading cleaned files

5. **Timestamps** (`--scope timestamps` or `full`): Manipulate file timestamps to cover tracks:

• Use `touch -r <reference-file> <target-file>` to copy timestamps from legitimate files
• Use `touch -t` with specific timestamps to backdate modified files
• Adjust directory timestamps to match surrounding entries

6. **Memory** (`--scope memory` or `full`): Clear volatile forensic artifacts:

• Clear swap: `swapoff -a && swapon -a`
• Wipe bash/zsh/python history: truncate `~/.bash_history`, `~/.zsh_history`, `~/.python_history`
• Clear shared memory: remove contents of `/dev/shm/`
• Drop page cache: `echo 3 > /proc/sys/vm/drop_caches`

7. **ALWAYS** ask the user for explicit confirmation before executing any destructive operations via `AskUserQuestion`. Show exactly what will be modified or deleted.

8. Log each cleaning action to the ops tracker with before/after state:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add <target> trace-clean <scope> "<action>" <before-state> <after-state>

9. Write the cleaning report to the project directory. Include what was cleaned, what was skipped, and any artifacts that could not be removed.

10. Update session metrics:

    node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" metric traces_eliminated