@cfour-hi/dsh-plugin-devicex 0.0.0-stage → 1.7.0

package/host/win/network.ps1

@@ -0,0 +1,322 @@
+# Device X - Windows network inventory (adapters, routes, Wi-Fi, proxy, ports).
+#
+# Emits exactly one JSON document on stdout (no other stdout text).
+# Read-only: no admin rights, no network calls, no external modules. Wi-Fi data
+# comes from local `netsh wlan show interfaces` output only.
+$ErrorActionPreference = 'Stop'
+
+$errors = @()
+
+function To-LongOrNull($value) {
+  if ($null -eq $value) { return $null }
+  try { return [long]$value } catch { return $null }
+}
+
+function Invoke-NativeOem([scriptblock]$action) {
+  # Native console tools (netsh/tasklist/manage-bde/winget) write OEM/ANSI bytes
+  # on a non-English Windows. The bridge sets the console to UTF-8 for the JSON
+  # document; temporarily decode native output with the OEM code page so SSIDs,
+  # user names and device names are not mojibake, then restore in finally.
+  $originalEncoding = [Console]::OutputEncoding
+  $oemCodePage = 437
+  try {
+    $cultureCodePage = [System.Globalization.CultureInfo]::CurrentCulture.TextInfo.OEMCodePage
+    if ($cultureCodePage -gt 0) { $oemCodePage = $cultureCodePage }
+    [Console]::OutputEncoding = [System.Text.Encoding]::GetEncoding($oemCodePage)
+    return & $action
+  } finally {
+    [Console]::OutputEncoding = $originalEncoding
+  }
+}
+
+function Get-AdapterSpeedBps($adapter) {
+  # Get-NetAdapter exposes `Speed` (UInt64 bits per second) and `LinkSpeed` (a
+  # formatted string such as "1 Gbps"). Prefer the numeric property and parse
+  # the string as a fallback; never report the formatted string as a number.
+  $speed = To-LongOrNull $adapter.Speed
+  if ($null -ne $speed -and $speed -gt 0) { return $speed }
+  $text = [string]$adapter.LinkSpeed
+  if ($text -match '^([\d.]+)\s*(bps|Kbps|Mbps|Gbps|Tbps)') {
+    try { $value = [double]$matches[1] } catch { return $null }
+    $unit = $matches[2]
+    if ($unit -eq 'Kbps') { $value = $value * 1000 }
+    elseif ($unit -eq 'Mbps') { $value = $value * 1000000 }
+    elseif ($unit -eq 'Gbps') { $value = $value * 1000000000 }
+    elseif ($unit -eq 'Tbps') { $value = $value * 1000000000000 }
+    return [long][math]::Round($value)
+  }
+  return $null
+}
+
+# --------------------------------------------------------------- adapters --
+$adapters = @()
+try {
+  $netAdapters = @(Get-NetAdapter -ErrorAction Stop)
+  $loopbackAdapters = @()
+  try {
+    $hiddenAdapters = @(Get-NetAdapter -IncludeHidden -ErrorAction Stop)
+    foreach ($hiddenAdapter in $hiddenAdapters) {
+      if ([string]$hiddenAdapter.InterfaceDescription -match 'Loopback') { $loopbackAdapters += $hiddenAdapter }
+    }
+  } catch { $loopbackAdapters = @() }
+
+  $ipv4Map = @{}
+  $ipv6Map = @{}
+  try {
+    $addresses = @(Get-NetIPAddress -ErrorAction Stop)
+    foreach ($address in $addresses) {
+      $addressIndex = 0
+      if ($null -ne $address.InterfaceIndex) { $addressIndex = [int]$address.InterfaceIndex }
+      if ($addressIndex -le 0) { continue }
+      if (-not $ipv4Map.ContainsKey($addressIndex)) { $ipv4Map[$addressIndex] = @() }
+      if (-not $ipv6Map.ContainsKey($addressIndex)) { $ipv6Map[$addressIndex] = @() }
+      $ip = [string]$address.IPAddress
+      if (-not $ip) { continue }
+      if ($ip -eq '127.0.0.1' -or $ip -eq '::1') { continue }
+      if ($address.AddressFamily -eq 2) {
+        $ipv4Map[$addressIndex] += $ip
+      } elseif ($address.AddressFamily -eq 23) {
+        $ipv6Map[$addressIndex] += $ip
+      }
+    }
+  } catch { $errors += ('Get-NetIPAddress: ' + $_.Exception.Message) }
+
+  $seenNames = @{}
+  foreach ($adapter in @($netAdapters + $loopbackAdapters)) {
+    $adapterName = [string]$adapter.Name
+    if (-not $adapterName) { continue }
+    if ($seenNames.ContainsKey($adapterName)) { continue }
+    $seenNames[$adapterName] = $true
+    $adapterIndex = 0
+    if ($null -ne $adapter.ifIndex) { $adapterIndex = [int]$adapter.ifIndex }
+    $ipv4 = @()
+    if ($ipv4Map.ContainsKey($adapterIndex)) { $ipv4 = @($ipv4Map[$adapterIndex]) }
+    $ipv6 = @()
+    if ($ipv6Map.ContainsKey($adapterIndex)) { $ipv6 = @($ipv6Map[$adapterIndex]) }
+    $mtu = $null
+    if ($null -ne $adapter.MtuSize) { $mtu = [long]$adapter.MtuSize }
+    $medium = $null
+    if ($null -ne $adapter.NdisPhysicalMedium) { $medium = [int]$adapter.NdisPhysicalMedium }
+    $adapters += [ordered]@{
+      name = $adapterName
+      description = [string]$adapter.InterfaceDescription
+      status = [string]$adapter.Status
+      mac = [string]$adapter.MacAddress
+      mtu = $mtu
+      ifIndex = $adapterIndex
+      physical = [bool]$adapter.Physical
+      virtual = [bool]$adapter.Virtual
+      ndisMedium = $medium
+      linkSpeedBps = Get-AdapterSpeedBps $adapter
+      ipv4 = $ipv4
+      ipv6 = $ipv6
+    }
+  }
+} catch { $errors += ('Get-NetAdapter: ' + $_.Exception.Message) }
+
+# --------------------------------------------------------- default route --
+$defaultRoute = $null
+try {
+  # The effective Windows route metric is RouteMetric + InterfaceMetric; sort
+  # by that numeric sum (not a lexicographic two-key sort) so the reported
+  # default route is the real egress path when VPN / virtual adapters add
+  # extra defaults.
+  $routes = @(Get-NetRoute -DestinationPrefix '0.0.0.0/0' -ErrorAction Stop | Sort-Object -Property @{Expression = { [long]$_.RouteMetric + [long]$_.InterfaceMetric }})
+  if ($routes.Count -gt 0) {
+    $route = $routes[0]
+    $metric = $null
+    if ($null -ne $route.RouteMetric) { $metric = [long]$route.RouteMetric }
+    $routeIndex = $null
+    if ($null -ne $route.ifIndex) { $routeIndex = [long]$route.ifIndex }
+    $interfaceMetric = $null
+    if ($null -ne $route.InterfaceMetric) { $interfaceMetric = [long]$route.InterfaceMetric }
+    $defaultRoute = [ordered]@{
+      gateway = [string]$route.NextHop
+      interface = [string]$route.InterfaceAlias
+      ifIndex = $routeIndex
+      routeMetric = $metric
+      interfaceMetric = $interfaceMetric
+    }
+  }
+} catch { $errors += ('Get-NetRoute: ' + $_.Exception.Message) }
+
+# -------------------------------------------------------------------- DNS --
+$dnsServers = @()
+try {
+  $dnsAddresses = @(Get-DnsClientServerAddress -ErrorAction Stop)
+  foreach ($dnsAddress in $dnsAddresses) {
+    foreach ($server in @($dnsAddress.ServerAddresses)) {
+      $serverText = [string]$server
+      if (-not $serverText) { continue }
+      if ($serverText -eq '::') { continue }
+      if ($serverText -match '^fec0:0:0:ffff::') { continue }
+      if ($dnsServers -notcontains $serverText) { $dnsServers += $serverText }
+    }
+  }
+} catch { $errors += ('Get-DnsClientServerAddress: ' + $_.Exception.Message) }
+
+$searchDomains = @()
+try {
+  $globalDns = Get-DnsClientGlobalSetting -ErrorAction Stop
+  foreach ($suffix in @($globalDns.SuffixSearchList)) {
+    $suffixText = [string]$suffix
+    if ($suffixText -and $searchDomains -notcontains $suffixText) { $searchDomains += $suffixText }
+  }
+} catch {
+  try {
+    $dnsClients = @(Get-DnsClient -ErrorAction Stop)
+    foreach ($dnsClient in $dnsClients) {
+      $suffix = [string]$dnsClient.ConnectionSpecificSuffix
+      if ($suffix -and $searchDomains -notcontains $suffix) { $searchDomains += $suffix }
+    }
+  } catch { }
+}
+
+# ------------------------------------------------------------------ proxy --
+$proxy = $null
+try {
+  $internetSettings = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -ErrorAction Stop
+  $proxyEnable = $false
+  if ($null -ne $internetSettings.ProxyEnable) { $proxyEnable = ([int]$internetSettings.ProxyEnable -eq 1) }
+  $proxy = [ordered]@{
+    enable = $proxyEnable
+    server = [string]$internetSettings.ProxyServer
+    autoConfigUrl = [string]$internetSettings.AutoConfigURL
+    bypass = [string]$internetSettings.ProxyOverride
+  }
+} catch { $errors += ('Internet Settings proxy: ' + $_.Exception.Message) }
+
+# ------------------------------------------------------------------ Wi-Fi --
+# netsh labels are localized; parse on the tokens Windows never translates
+# ("SSID", "BSSID", "Mbps", "NN%") plus value-shape fallbacks.
+$wifi = $null
+try {
+  $wlanLines = @(Invoke-NativeOem { & netsh wlan show interfaces 2>$null })
+  if ($wlanLines.Count -gt 0) {
+    $parsedWifi = [ordered]@{}
+    $macValues = @()
+    $values = @()
+    foreach ($line in $wlanLines) {
+      $text = [string]$line
+      if ($text -match '^\s*([^:]+?)\s*:\s*(.*?)\s*$') {
+        $label = $matches[1]
+        $value = $matches[2]
+        $values += [pscustomobject]@{ label = $label; value = $value }
+        if ($value -match '^([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$') { $macValues += $value }
+      }
+    }
+    if ($values.Count -gt 0 -and -not $parsedWifi.name) { $parsedWifi.name = [string]$values[0].value }
+    foreach ($entry in $values) {
+      $label = [string]$entry.label
+      $value = [string]$entry.value
+      if ($label -eq 'SSID') { $parsedWifi.ssid = $value; continue }
+      if ($label -eq 'BSSID' -or $label -eq 'AP BSSID') { $parsedWifi.bssid = $value; continue }
+      if ($label -eq 'Name') { $parsedWifi.name = $value; continue }
+      if ($label -eq 'State') { $parsedWifi.state = $value; continue }
+      if ($label -eq 'Authentication') { $parsedWifi.authentication = $value; continue }
+      if ($label -eq 'Radio type') { $parsedWifi.radioType = $value; continue }
+      if ($value -match '^(\d{1,3})%$') { $parsedWifi.signalPercent = [int]$matches[1]; continue }
+      if ($label -match 'Mbps') {
+        if (-not $parsedWifi.receiveRateMbps) { $parsedWifi.receiveRateMbps = [double]$value }
+        else { $parsedWifi.transmitRateMbps = [double]$value }
+        continue
+      }
+      if ($value -match '^\d{1,3}$') {
+        $number = [int]$value
+        if ($number -ge 1 -and $number -le 233 -and -not $parsedWifi.channel) { $parsedWifi.channel = $number }
+      }
+    }
+    if (-not $parsedWifi.bssid -and $macValues.Count -gt 1) { $parsedWifi.bssid = [string]$macValues[$macValues.Count - 1] }
+    if ($parsedWifi.ssid -and [string]$parsedWifi.ssid -ne '') {
+      if (-not $parsedWifi.state) { $parsedWifi.state = 'connected' }
+      $wifi = $parsedWifi
+    }
+  }
+} catch { $errors += ('netsh wlan show interfaces: ' + $_.Exception.Message) }
+
+# ------------------------------------------------------- listening / sockets --
+$processNames = @{}
+try {
+  $runningProcesses = @(Get-Process -ErrorAction SilentlyContinue)
+  foreach ($process in $runningProcesses) {
+    try { $processNames[[int]$process.Id] = [string]$process.ProcessName } catch { }
+  }
+} catch { $processNames = @{} }
+
+$tcpListeners = @()
+$establishedCount = 0
+try {
+  $connections = @(Get-NetTCPConnection -ErrorAction Stop)
+  foreach ($connection in $connections) {
+    $state = [string]$connection.State
+    if ($state -eq 'Established') { $establishedCount += 1; continue }
+    if ($state -ne 'Listen') { continue }
+    $localPort = 0
+    if ($null -ne $connection.LocalPort) { $localPort = [int]$connection.LocalPort }
+    $ownerPid = 0
+    if ($null -ne $connection.OwningProcess) { $ownerPid = [int]$connection.OwningProcess }
+    $processName = $null
+    if ($processNames.ContainsKey($ownerPid)) { $processName = $processNames[$ownerPid] }
+    $tcpListeners += [ordered]@{
+      address = [string]$connection.LocalAddress
+      port = $localPort
+      pid = $ownerPid
+      process = $processName
+    }
+  }
+} catch {
+  $errors += ('Get-NetTCPConnection: ' + $_.Exception.Message)
+  try {
+    $listenConnections = @(Get-NetTCPConnection -State Listen -ErrorAction Stop)
+    foreach ($connection in $listenConnections) {
+      $localPort = 0
+      if ($null -ne $connection.LocalPort) { $localPort = [int]$connection.LocalPort }
+      $ownerPid = 0
+      if ($null -ne $connection.OwningProcess) { $ownerPid = [int]$connection.OwningProcess }
+      $processName = $null
+      if ($processNames.ContainsKey($ownerPid)) { $processName = $processNames[$ownerPid] }
+      $tcpListeners += [ordered]@{
+        address = [string]$connection.LocalAddress
+        port = $localPort
+        pid = $ownerPid
+        process = $processName
+      }
+    }
+  } catch { }
+}
+
+$udpListeners = @()
+try {
+  $endpoints = @(Get-NetUDPEndpoint -ErrorAction Stop)
+  foreach ($endpoint in $endpoints) {
+    $localPort = 0
+    if ($null -ne $endpoint.LocalPort) { $localPort = [int]$endpoint.LocalPort }
+    if ($localPort -le 0) { continue }
+    $ownerPid = 0
+    if ($null -ne $endpoint.OwningProcess) { $ownerPid = [int]$endpoint.OwningProcess }
+    $processName = $null
+    if ($processNames.ContainsKey($ownerPid)) { $processName = $processNames[$ownerPid] }
+    $udpListeners += [ordered]@{
+      address = [string]$endpoint.LocalAddress
+      port = $localPort
+      pid = $ownerPid
+      process = $processName
+    }
+  }
+} catch { $errors += ('Get-NetUDPEndpoint: ' + $_.Exception.Message) }
+
+# -------------------------------------------------------------------- emit --
+$result = [ordered]@{
+  generatedAt = ([DateTimeOffset]::UtcNow).ToUnixTimeMilliseconds()
+  adapters = $adapters
+  defaultRoute = $defaultRoute
+  dns = [ordered]@{ servers = $dnsServers; searchDomains = $searchDomains }
+  proxy = $proxy
+  wifi = $wifi
+  tcpListeners = $tcpListeners
+  udpListeners = $udpListeners
+  establishedCount = $establishedCount
+  errors = $errors
+}
+
+$result | ConvertTo-Json -Depth 8 -Compress

package/host/win/processes.ps1

@@ -0,0 +1,169 @@
+# Device X - Windows process inventory (perf counters + CIM + tasklist owners).
+#
+# Emits exactly one JSON document on stdout (no other stdout text).
+# Read-only: no admin rights, no network calls, no external modules.
+# CPU percent is reported in Task-Manager scale (raw perf counter divided by the
+# logical processor count); the Node mapper normalizes and rounds again.
+$ErrorActionPreference = 'Stop'
+
+$errors = @()
+
+function To-EpochMs($value) {
+  if ($null -eq $value) { return $null }
+  try { return ([DateTimeOffset]$value).ToUnixTimeMilliseconds() } catch { return $null }
+}
+
+function To-LongOrNull($value) {
+  if ($null -eq $value) { return $null }
+  try { return [long]$value } catch { return $null }
+}
+
+function Invoke-NativeOem([scriptblock]$action) {
+  # Native console tools (netsh/tasklist/manage-bde/winget) write OEM/ANSI bytes
+  # on a non-English Windows. The bridge sets the console to UTF-8 for the JSON
+  # document; temporarily decode native output with the OEM code page so SSIDs,
+  # user names and device names are not mojibake, then restore in finally.
+  $originalEncoding = [Console]::OutputEncoding
+  $oemCodePage = 437
+  try {
+    $cultureCodePage = [System.Globalization.CultureInfo]::CurrentCulture.TextInfo.OEMCodePage
+    if ($cultureCodePage -gt 0) { $oemCodePage = $cultureCodePage }
+    [Console]::OutputEncoding = [System.Text.Encoding]::GetEncoding($oemCodePage)
+    return & $action
+  } finally {
+    [Console]::OutputEncoding = $originalEncoding
+  }
+}
+
+$logicalCores = 0
+try { $logicalCores = [int]$env:NUMBER_OF_PROCESSORS } catch { $logicalCores = 0 }
+if ($logicalCores -le 0) { $logicalCores = 0 }
+
+$totalMemoryBytes = $null
+try {
+  $os = Get-CimInstance -ClassName Win32_OperatingSystem -ErrorAction Stop
+  if ($null -ne $os.TotalVisibleMemorySize) { $totalMemoryBytes = To-LongOrNull ([long]$os.TotalVisibleMemorySize * 1024) }
+} catch { $errors += ('Win32_OperatingSystem: ' + $_.Exception.Message) }
+
+# --- perf counters: instantaneous CPU percent + private working set ----------
+$perfMap = @{}
+try {
+  $processPerf = @(Get-CimInstance -ClassName Win32_PerfFormattedData_PerfProc_Process -ErrorAction Stop)
+  foreach ($row in $processPerf) {
+    $processId = 0
+    if ($null -ne $row.IDProcess) { $processId = [int]$row.IDProcess }
+    if ($processId -le 0) { continue }
+    $rawName = [string]$row.Name
+    if ($rawName -eq '_Total' -or $rawName -eq 'Idle') { continue }
+    $perfMap[$processId] = [pscustomobject]@{
+      name = ($rawName -replace '#\d+$', '')
+      percentProcessorTime = To-LongOrNull $row.PercentProcessorTime
+      workingSetPrivate = To-LongOrNull $row.WorkingSetPrivate
+      workingSet = To-LongOrNull $row.WorkingSet
+    }
+  }
+} catch { $errors += ('Win32_PerfFormattedData_PerfProc_Process: ' + $_.Exception.Message) }
+
+# --- CIM: identity, parent, command line, creation date ---------------------
+$cimProcesses = @()
+try {
+  $cimProcesses = @(Get-CimInstance -ClassName Win32_Process -Property ProcessId,ParentProcessId,Name,CommandLine,CreationDate,WorkingSetSize,ExecutablePath -ErrorAction Stop)
+} catch { $errors += ('Win32_Process: ' + $_.Exception.Message) }
+
+# --- tasklist: per-process user names (no elevation required) ---------------
+$userMap = @{}
+try {
+  $taskLines = @(Invoke-NativeOem { & tasklist.exe /fo csv /v /nh 2>$null })
+  $csvLines = @()
+  foreach ($line in $taskLines) {
+    if ([string]$line -match '^"') { $csvLines += [string]$line }
+  }
+  if ($csvLines.Count -gt 0) {
+    $taskRows = @($csvLines | ConvertFrom-Csv -Header 'ImageName','ProcessId','SessionName','SessionNumber','MemUsage','Status','UserName','CpuTime','WindowTitle')
+    foreach ($taskRow in $taskRows) {
+      $taskPid = 0
+      try { $taskPid = [int]$taskRow.ProcessId } catch { $taskPid = 0 }
+      if ($taskPid -le 0) { continue }
+      $userName = [string]$taskRow.UserName
+      if ($userName -and $userName -ne 'N/A') { $userMap[$taskPid] = $userName }
+    }
+  }
+} catch { $errors += ('tasklist: ' + $_.Exception.Message) }
+
+# --- Get-Process: responsiveness + total count ------------------------------
+$respondsMap = @{}
+$getProcessCount = 0
+try {
+  $allProcesses = @(Get-Process -ErrorAction SilentlyContinue)
+  $getProcessCount = $allProcesses.Count
+  foreach ($process in $allProcesses) {
+    $processId = [int]$process.Id
+    try {
+      $respondsMap[$processId] = [bool]$process.Responding
+    } catch { }
+  }
+} catch { $respondsMap = @{} }
+
+# --- merge ------------------------------------------------------------------
+$rows = @()
+$nowMs = ([DateTimeOffset]::UtcNow).ToUnixTimeMilliseconds()
+foreach ($process in $cimProcesses) {
+  $processId = 0
+  if ($null -ne $process.ProcessId) { $processId = [int]$process.ProcessId }
+  if ($processId -le 0) { continue }
+  $name = [string]$process.Name
+  if (-not $name) {
+    if ($perfMap.ContainsKey($processId)) { $name = [string]$perfMap[$processId].name }
+  }
+  if (-not $name) { $name = 'unknown' }
+  $cpuPercent = 0.0
+  $workingSetBytes = $null
+  if ($perfMap.ContainsKey($processId)) {
+    $perfRow = $perfMap[$processId]
+    if ($null -ne $perfRow.percentProcessorTime) { $cpuPercent = [double]$perfRow.percentProcessorTime }
+    if ($null -ne $perfRow.workingSetPrivate) { $workingSetBytes = To-LongOrNull $perfRow.workingSetPrivate }
+    if ($null -eq $workingSetBytes -and $null -ne $perfRow.workingSet) { $workingSetBytes = To-LongOrNull $perfRow.workingSet }
+  }
+  if ($null -eq $workingSetBytes) { $workingSetBytes = To-LongOrNull $process.WorkingSetSize }
+  $user = $null
+  if ($userMap.ContainsKey($processId)) { $user = $userMap[$processId] }
+  $state = 'running'
+  if ($respondsMap.ContainsKey($processId) -and $respondsMap[$processId] -eq $false) { $state = 'not responding' }
+  $command = [string]$process.CommandLine
+  if (-not $command) { $command = [string]$process.ExecutablePath }
+  if (-not $command) { $command = $name }
+  $creationMs = To-EpochMs $process.CreationDate
+  $elapsed = $null
+  if ($null -ne $creationMs -and $nowMs -gt $creationMs) {
+    $elapsed = [long][math]::Floor(($nowMs - $creationMs) / 1000)
+  }
+  $parentId = $null
+  if ($null -ne $process.ParentProcessId) { $parentId = [int]$process.ParentProcessId }
+  $rows += [ordered]@{
+    pid = $processId
+    ppid = $parentId
+    name = $name
+    command = $command
+    cpuPercent = $cpuPercent
+    workingSetBytes = $workingSetBytes
+    user = $user
+    state = $state
+    creationDateMs = $creationMs
+    elapsed = $elapsed
+  }
+}
+
+$total = $getProcessCount
+if ($rows.Count -gt $total) { $total = $rows.Count }
+
+# -------------------------------------------------------------------- emit --
+$result = [ordered]@{
+  generatedAt = ([DateTimeOffset]::UtcNow).ToUnixTimeMilliseconds()
+  totalMemoryBytes = $totalMemoryBytes
+  logicalCores = $logicalCores
+  total = $total
+  processes = $rows
+  errors = $errors
+}
+
+$result | ConvertTo-Json -Depth 8 -Compress

package/host/win/security.ps1

@@ -0,0 +1,197 @@
+# Device X - Windows security posture (BitLocker, Secure Boot, Defender, firewall, UAC).
+#
+# Emits exactly one JSON document on stdout (no other stdout text).
+# Read-only. Some sources (BitLocker, Secure Boot) can require elevation; a
+# denied read is reported as null + a non-fatal errors[] entry, never faked.
+$ErrorActionPreference = 'Stop'
+
+$errors = @()
+
+function Invoke-NativeOem([scriptblock]$action) {
+  # Native console tools (netsh/tasklist/manage-bde/winget) write OEM/ANSI bytes
+  # on a non-English Windows. The bridge sets the console to UTF-8 for the JSON
+  # document; temporarily decode native output with the OEM code page so SSIDs,
+  # user names and device names are not mojibake, then restore in finally.
+  $originalEncoding = [Console]::OutputEncoding
+  $oemCodePage = 437
+  try {
+    $cultureCodePage = [System.Globalization.CultureInfo]::CurrentCulture.TextInfo.OEMCodePage
+    if ($cultureCodePage -gt 0) { $oemCodePage = $cultureCodePage }
+    [Console]::OutputEncoding = [System.Text.Encoding]::GetEncoding($oemCodePage)
+    return & $action
+  } finally {
+    [Console]::OutputEncoding = $originalEncoding
+  }
+}
+
+# --------------------------------------------------------------- BitLocker --
+$fileVault = [ordered]@{ enabled = $null; raw = $null }
+$systemDrive = $env:SystemDrive
+if (-not $systemDrive) { $systemDrive = 'C:' }
+try {
+  $bitLockerVolume = Get-BitLockerVolume -MountPoint $systemDrive -ErrorAction Stop
+  $protectionEnabled = $null
+  if ($null -ne $bitLockerVolume.ProtectionStatus) {
+    $protectionValue = [int]$bitLockerVolume.ProtectionStatus
+    if ($protectionValue -eq 1) { $protectionEnabled = $true }
+    elseif ($protectionValue -eq 0) { $protectionEnabled = $false }
+  }
+  $volumeStatus = [string]$bitLockerVolume.VolumeStatus
+  $rawText = 'ProtectionStatus=' + [string]$bitLockerVolume.ProtectionStatus
+  if ($volumeStatus) { $rawText = $rawText + '; VolumeStatus=' + $volumeStatus }
+  $fileVault = [ordered]@{ enabled = $protectionEnabled; raw = $rawText; volumeStatus = $volumeStatus }
+} catch {
+  $bitLockerError = $_.Exception.Message
+  try {
+    $manageBdeLines = @(Invoke-NativeOem { & manage-bde.exe -status $systemDrive 2>$null })
+    $manageBdeText = ($manageBdeLines -join "`n")
+    $manageBdeEnabled = $null
+    if ($manageBdeText -match 'Protection On') { $manageBdeEnabled = $true }
+    elseif ($manageBdeText -match 'Protection Off') { $manageBdeEnabled = $false }
+    $rawLine = $null
+    foreach ($line in $manageBdeLines) {
+      if ([string]$line -match 'Protection Status') { $rawLine = ([string]$line).Trim(); break }
+    }
+    if ($rawLine) {
+      if ($rawLine -match 'Protection On') { $manageBdeEnabled = $true }
+      elseif ($rawLine -match 'Protection Off') { $manageBdeEnabled = $false }
+    }
+    $fileVault = [ordered]@{ enabled = $manageBdeEnabled; raw = $manageBdeText; volumeStatus = $null }
+    $errors += ('Get-BitLockerVolume: ' + $bitLockerError)
+  } catch {
+    $errors += ('BitLocker: ' + $bitLockerError)
+    $fileVault = [ordered]@{ enabled = $null; raw = $bitLockerError; volumeStatus = $null }
+  }
+}
+
+# -------------------------------------------------------------- Secure Boot --
+$sip = [ordered]@{ enabled = $null; raw = $null }
+try {
+  $secureBootEnabled = Confirm-SecureBootUEFI -ErrorAction Stop
+  $sip = [ordered]@{ enabled = [bool]$secureBootEnabled; raw = 'Secure Boot: ' + [string]$secureBootEnabled }
+} catch {
+  $sip = [ordered]@{ enabled = $null; raw = $_.Exception.Message }
+  $errors += ('Secure Boot: ' + $_.Exception.Message)
+}
+
+# ----------------------------------------------------------------- Defender --
+$gatekeeper = [ordered]@{ enabled = $null; raw = $null }
+try {
+  $defenderStatus = Get-MpComputerStatus -ErrorAction Stop
+  $realTimeEnabled = $null
+  if ($null -ne $defenderStatus.RealTimeProtectionEnabled) {
+    $realTimeEnabled = [bool]$defenderStatus.RealTimeProtectionEnabled
+  }
+  $rawText = 'RealTimeProtectionEnabled=' + [string]$defenderStatus.RealTimeProtectionEnabled
+  if ($null -ne $defenderStatus.AntivirusEnabled) { $rawText = $rawText + '; AntivirusEnabled=' + [string]$defenderStatus.AntivirusEnabled }
+  if ($defenderStatus.AntivirusSignatureVersion) { $rawText = $rawText + '; SignatureVersion=' + [string]$defenderStatus.AntivirusSignatureVersion }
+  $gatekeeper = [ordered]@{ enabled = $realTimeEnabled; raw = $rawText }
+} catch {
+  $gatekeeper = [ordered]@{ enabled = $null; raw = $_.Exception.Message }
+  $errors += ('Get-MpComputerStatus: ' + $_.Exception.Message)
+}
+
+# ---------------------------------------------------------------- Firewall --
+$firewall = [ordered]@{ enabled = $null; raw = $null; stealthMode = $null }
+try {
+  $profiles = @(Get-NetFirewallProfile -ErrorAction Stop)
+  $allEnabled = $null
+  $parts = @()
+  if ($profiles.Count -gt 0) {
+    $allEnabled = $true
+    foreach ($profile in $profiles) {
+      $profileEnabled = [bool]$profile.Enabled
+      if (-not $profileEnabled) { $allEnabled = $false }
+      $parts += ([string]$profile.Name + '=' + [string]$profile.Enabled)
+    }
+  }
+  $firewall = [ordered]@{
+    enabled = $allEnabled
+    raw = ($parts -join ', ')
+    stealthMode = $null
+  }
+} catch {
+  $firewall = [ordered]@{ enabled = $null; raw = $_.Exception.Message; stealthMode = $null }
+  $errors += ('Get-NetFirewallProfile: ' + $_.Exception.Message)
+}
+
+# ------------------------------------------------------------------- users --
+$userInfo = [ordered]@{ current = $env:USERNAME; admins = @(); total = $null }
+try {
+  $localUsers = @(Get-LocalUser -ErrorAction Stop)
+  $userInfo.total = $localUsers.Count
+} catch {
+  try {
+    $fallbackUsers = @(Get-CimInstance -ClassName Win32_UserAccount -Filter 'LocalAccount = True' -ErrorAction Stop)
+    $userInfo.total = $fallbackUsers.Count
+  } catch { $errors += ('local user count: ' + $_.Exception.Message) }
+}
+try {
+  $adminGroup = $null
+  try { $adminGroup = Get-LocalGroup -SID 'S-1-5-32-544' -ErrorAction Stop } catch { $adminGroup = $null }
+  if ($null -eq $adminGroup) {
+    # The group display name is localized; resolve it by the well-known
+    # Administrators SID instead of the English name.
+    $adminGroup = Get-LocalGroup -ErrorAction Stop | Where-Object { $_.SID.Value -eq 'S-1-5-32-544' } | Select-Object -First 1
+  }
+  if ($null -eq $adminGroup) { throw 'Could not resolve the local Administrators group (S-1-5-32-544).' }
+  $members = @(Get-LocalGroupMember -Group $adminGroup -ErrorAction Stop)
+  $admins = @()
+  foreach ($member in $members) {
+    $memberName = [string]$member.Name
+    if ($memberName -match '\\') {
+      $parts = $memberName -split '\\'
+      $memberName = [string]$parts[$parts.Count - 1]
+    }
+    if ($memberName) { $admins += $memberName }
+  }
+  $userInfo.admins = $admins
+} catch { $errors += ('local administrators: ' + $_.Exception.Message) }
+
+# ------------------------------------------------------------ remote logon --
+$remoteLogin = $null
+try {
+  $terminalServer = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -ErrorAction Stop
+  if ($null -ne $terminalServer.fDenyTSConnections) {
+    $remoteLogin = ([int]$terminalServer.fDenyTSConnections -eq 0)
+  }
+} catch { $errors += ('Remote Desktop setting: ' + $_.Exception.Message) }
+
+# -------------------------------------------------------------- auto logon --
+$autoLogin = $null
+try {
+  $winlogon = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -ErrorAction Stop
+  $autoAdminLogon = [string]$winlogon.AutoAdminLogon
+  $defaultUserName = [string]$winlogon.DefaultUserName
+  if ($autoAdminLogon -eq '1' -and $defaultUserName) { $autoLogin = $defaultUserName }
+} catch { $errors += ('Winlogon auto logon: ' + $_.Exception.Message) }
+
+# UAC (collected for diagnostics; the frozen section shape has no UAC field yet).
+$uac = [ordered]@{ enabled = $null; consentPromptBehaviorAdmin = $null; raw = $null }
+try {
+  $policies = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -ErrorAction Stop
+  if ($null -ne $policies.EnableLUA) {
+    $uac.enabled = ([int]$policies.EnableLUA -eq 1)
+    $uac.raw = 'EnableLUA=' + [string]$policies.EnableLUA
+  }
+  if ($null -ne $policies.ConsentPromptBehaviorAdmin) {
+    $uac.consentPromptBehaviorAdmin = [int]$policies.ConsentPromptBehaviorAdmin
+    $uac.raw = ([string]$uac.raw + '; ConsentPromptBehaviorAdmin=' + [string]$policies.ConsentPromptBehaviorAdmin)
+  }
+} catch { $errors += ('UAC setting: ' + $_.Exception.Message) }
+
+# -------------------------------------------------------------------- emit --
+$result = [ordered]@{
+  generatedAt = ([DateTimeOffset]::UtcNow).ToUnixTimeMilliseconds()
+  fileVault = $fileVault
+  sip = $sip
+  gatekeeper = $gatekeeper
+  firewall = $firewall
+  users = $userInfo
+  remoteLogin = $remoteLogin
+  autoLogin = $autoLogin
+  uac = $uac
+  errors = $errors
+}
+
+$result | ConvertTo-Json -Depth 8 -Compress