Retain infrastructure names and share/mount roots behind policy switches

Add a `retain` block to privacy_policy.json (all on by default) so assessments
show software, services, processes, tasks, shares/mounts and private peer IPs.
Values pass an identifier-pattern filter (digit runs, SSN/phone, e-mail, charset,
length, path depth). Accounts, command lines, child paths, filenames and public
peer IPs stay omitted. Linux collector and Windows PowerShell collectors updated;
tests cover retention, withholding and all-switches-off.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

powershell/Get-ServerStorage.ps1

@@ -4,7 +4,7 @@ function Get-SamsaraStorage {
         $index = 0
         $Result.data = @(Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType = 3' -Property DeviceID,Size,FreeSpace,FileSystem -ErrorAction Stop | ForEach-Object {
             $index++
-            [pscustomobject]@{ type = 'Volume'; name = 'Volume-' + $index
+            [pscustomobject]@{ type = 'Volume'; name = $(if (Test-SamsaraRetain 'storage_names_and_roots' ([string]$_.DeviceID)) { [string]$_.DeviceID } else { 'Volume-' + $index })
                 path = Get-SamsaraApprovedRoot (([string]$_.DeviceID) + '\')
                 filesystem = [string]$_.FileSystem; capacity_gib = [math]::Round(([double]$_.Size / 1GB), 2)
                 free_gib = [math]::Round(([double]$_.FreeSpace / 1GB), 2) }
@@ -20,7 +20,7 @@ function Get-SamsaraShares {
         $index = 0
         $Result.data = @(Get-SmbShare -ErrorAction Stop | ForEach-Object {
             $index++
-            $name = if ([string]$_.Name -match '^(ADMIN|IPC|[A-Z])\$$') { ([string]$_.Name).ToUpperInvariant() } else { 'Share-' + $index }
+            $name = if ([string]$_.Name -match '^(ADMIN|IPC|[A-Z])\$$') { ([string]$_.Name).ToUpperInvariant() } elseif (Test-SamsaraRetain 'storage_names_and_roots' ([string]$_.Name)) { [string]$_.Name } else { 'Share-' + $index }
             [pscustomobject]@{ type = 'SMB Share'; name = $name; path = Get-SamsaraApprovedRoot ([string]$_.Path)
                 capacity_gib = $null; free_gib = $null; special = [bool]$_.Special }
         })

powershell/Get-ServerSystem.ps1

@@ -8,7 +8,7 @@ function Get-SamsaraSystem {
         domain = 'Not collected'; domain_joined = $null
     }
     Get-SamsaraPrivacyConfiguration
-    if ($script:SamsaraPrivacy.approved_hostnames -ccontains [Environment]::MachineName) { $Result.data.hostname = [Environment]::MachineName }
+    if (($script:SamsaraPrivacy.approved_hostnames -ccontains [Environment]::MachineName) -or (Test-SamsaraRetain 'hostname' ([Environment]::MachineName))) { $Result.data.hostname = [Environment]::MachineName }
     Invoke-SamsaraRead $Result 'OS identity' {
         $os = Get-CimInstance -ClassName Win32_OperatingSystem -Property Version,BuildNumber,LastBootUpTime,ProductType -ErrorAction Stop
         $years = @{ '14393' = '2016'; '17763' = '2019'; '20348' = '2022'; '26100' = '2025' }

powershell/Get-ServerTasks.ps1

@@ -7,8 +7,8 @@ function Get-SamsaraTasks {
             $routine = ([string]$_.TaskPath).StartsWith('\Microsoft\Windows\', [StringComparison]::OrdinalIgnoreCase) -and
                 -not ([string]$_.TaskPath).StartsWith('\Microsoft\Windows\PowerShell\ScheduledJobs', [StringComparison]::OrdinalIgnoreCase)
             $state = switch ([int]$_.State) { 1 {'Disabled'} 2 {'Queued'} 3 {'Ready'} 4 {'Running'} default {'Unknown'} }
-            [pscustomobject]@{ name = $(if ($routine) { 'Maintenance-' + $index } else { 'Task-' + $index })
-                path = $(if ($routine) { '\Microsoft\Windows\Maintenance\' } else { 'Task folder omitted' })
+            [pscustomobject]@{ name = $(if (Test-SamsaraRetain 'task_names' ([string]$_.TaskName)) { [string]$_.TaskName } elseif ($routine) { 'Maintenance-' + $index } else { 'Task-' + $index })
+                path = $(if (Test-SamsaraRetain 'task_names' ([string]$_.TaskPath) -Path) { [string]$_.TaskPath } elseif ($routine) { '\Microsoft\Windows\Maintenance\' } else { 'Task folder omitted' })
                 enabled = ([int]$_.State -in @(2,3,4)); state = $state
                 account = 'Omitted by privacy policy'; triggers = 'Schedule details omitted; authorized scheduler review required.' }
         })

powershell/Inventory.Common.ps1

@@ -84,10 +84,22 @@ function Get-SamsaraPrivacyConfiguration {
     }
 }
 
+function Test-SamsaraRetain {
+    # Mirrors the `retain` block of privacy_policy.json; Python re-validates every value.
+    param([string]$Flag, [string]$Value, [switch]$Path)
+    Get-SamsaraPrivacyConfiguration
+    if ($script:SamsaraPrivacy.retain.$Flag -ne $true -or [string]::IsNullOrEmpty($Value)) { return $false }
+    if ($Value -match '[0-9]{6,}' -or $Value -match '(^|[\\/])\.\.([\\/]|$)') { return $false }
+    if ($Path) { return ($Value.Length -le 260 -and $Value -match "^([A-Za-z]:)?[\\/A-Za-z0-9 ._()+#`$,&'-]*$") }
+    return ($Value.Length -le 120 -and $Value -match "^[A-Za-z0-9][A-Za-z0-9 ._()+#`$:,&'@-]*$")
+}
+
 function Get-SamsaraPublicName {
     param([string]$Kind, [string]$Value, [int]$Index)
     Get-SamsaraPrivacyConfiguration
     $normalized = $Value.ToLowerInvariant() -replace '\.(exe|service)$', ''
+    $flag = switch ($Kind) { 'products' {'software_names'} 'processes' {'process_names'} default {'service_names'} }
+    if (Test-SamsaraRetain $flag $Value) { return $Value }
     if ($Kind -eq 'services' -and $script:SamsaraPrivacy.approved_service_names -ccontains $Value) { return $Value }
     if ($Kind -eq 'products') {
         if ($script:SamsaraPrivacy.approved_software_names -ccontains $Value) { return $Value }
@@ -108,6 +120,7 @@ function Get-SamsaraPublicName {
 function Get-SamsaraApprovedRoot {
     param([string]$Value)
     Get-SamsaraPrivacyConfiguration
+    if (Test-SamsaraRetain 'storage_names_and_roots' $Value -Path) { return $Value }
     if ($Value -notmatch '^[A-Za-z]:\\' -or $Value -match '(^|[\\/])\.\.([\\/]|$)' -or $Value -match '[\x00-\x1f]') { return 'Omitted by privacy policy' }
     foreach ($root in $script:SamsaraPrivacy.approved_share_roots) {
         if ($root -match '^[A-Za-z]:\\' -and $Value.TrimEnd([char]'\').Equals(([string]$root).TrimEnd([char]'\'), [StringComparison]::OrdinalIgnoreCase)) { return $Value }