@hope_phenom/dsh-plugin-remote-use 0.0.0-stage → 0.2.24

package/slave/repair-workspace-integrity.ps1

@@ -0,0 +1,75 @@
+# repair-workspace-integrity.ps1 -- reset a workspace's stale Low mandatory label to Medium.
+#
+# WHY: DSH's workspace-write sandbox labels the workspace Low. The label survives the session and is
+# inherited by files copied into the tree, and Windows launches a Low-labelled image at Low
+# integrity. Under danger-full-access that leftover is what makes a GUI app unable to write
+# %LOCALAPPDATA% even though the agent shell is High (PITFALLS F41).
+#
+# The relay repairs the tree automatically on start when it runs at danger-full-access with an
+# explicit --task-dir. This script is the manual equivalent, and the repair path for a hand-managed
+# relay whose task directory is not passed as a flag.
+#
+# ASCII-only, param() first: Windows PowerShell 5.1 reads BOM-less files as ANSI.
+param(
+  [Parameter(Mandatory = $true)][string]$Path,
+  [switch]$WhatIf
+)
+
+$ErrorActionPreference = 'Stop'
+
+if (-not (Test-Path -LiteralPath $Path -PathType Container)) {
+  Write-Host "REFUSING: not a directory: $Path" -ForegroundColor Red
+  exit 2
+}
+$full = (Resolve-Path -LiteralPath $Path).Path
+if ($full -match '^[A-Za-z]:\\?$') {
+  Write-Host "REFUSING: $full is a drive root, not a workspace." -ForegroundColor Red
+  exit 2
+}
+
+$protected = @($env:SystemRoot, $env:ProgramFiles, ${env:ProgramFiles(x86)}, $env:ProgramData) |
+  Where-Object { $_ -and $_.Trim() -ne '' } |
+  ForEach-Object { $_.TrimEnd('\').ToLowerInvariant() }
+$target = $full.TrimEnd('\').ToLowerInvariant()
+foreach ($root in $protected) {
+  if ($target -eq $root -or $target.StartsWith($root + '\')) {
+    Write-Host "REFUSING: $full is a protected system location." -ForegroundColor Red
+    exit 2
+  }
+}
+
+$command = "icacls `"$full`" /setintegritylevel (OI)(CI)Medium /T /C /Q"
+Write-Host "workspace : $full"
+Write-Host "command   : $command"
+if ($WhatIf) {
+  Write-Host 'WHATIF: nothing changed.'
+  exit 0
+}
+
+# Show the label lines this tree carries BEFORE the reset, so the operator can see whether there was
+# anything to fix. The label name is localized on some Windows installs, so the decision is still the
+# unconditional idempotent set below rather than a text match.
+Write-Host '--- labels before (matching lines only) ---'
+$before = @(& icacls $full 2>&1)
+@($before | Where-Object { $_ -match 'Mandatory|Label|S-1-16' }) | ForEach-Object { Write-Host $_ }
+
+& icacls $full /setintegritylevel '(OI)(CI)Medium' /T /C /Q | Out-Null
+if ($LASTEXITCODE -ne 0) {
+  Write-Host "FAILED: icacls exited $LASTEXITCODE" -ForegroundColor Red
+  exit 1
+}
+
+Write-Host '--- labels after (top level) ---'
+$after = @(& icacls $full 2>&1)
+@($after | Where-Object { $_ -match 'Mandatory|Label|S-1-16' }) | ForEach-Object { Write-Host $_ }
+
+# Re-measure with the same probe the self-check uses. This is the difference between "the command
+# returned 0" and "a process launched from here is no longer Low".
+$probe = Join-Path $PSScriptRoot 'integrity-probe.ps1'
+if (Test-Path -LiteralPath $probe) {
+  Write-Host '--- probe ---'
+  & $probe -Workspace $full
+}
+
+Write-Host 'RESULT: OK -- the workspace tree was relabeled to Medium.' -ForegroundColor Green
+exit 0

package/slave/screenshot.ps1

@@ -0,0 +1,114 @@
+# screenshot.ps1 -- capture the worker's desktop.
+#
+# MUST RUN IN THE INTERACTIVE SESSION. In session 0 (SSH/services) there is no desktop,
+# `CopyFromScreen` throws or returns black, and `VirtualScreen` reports a stub size -- the
+# same session-0 false negative documented for the display checks.
+#
+# ASCII-ONLY: Windows PowerShell 5.1 reads a BOM-less file as ANSI, so a single non-ASCII
+# byte corrupts parsing (see the note in relay-ctl.ps1).
+#
+# The geometry report is written NEXT TO THIS SCRIPT ($PSScriptRoot), because the relay
+# reads it from the script's own directory. Writing it to a fixed absolute path is exactly
+# the mismatch that once made the self-check look like it produced no report, and it would
+# silently zero the screenshot's geometry metadata.
+#
+# Usage: screenshot.ps1 -Out C:\path\shot.png
+param([Parameter(Mandatory = $true)][string]$Out)
+
+$ErrorActionPreference = 'Stop'
+if ([string]::IsNullOrEmpty($PSScriptRoot)) { $PSScriptRoot = Split-Path -Parent $MyInvocation.MyCommand.Path }
+$report = Join-Path $PSScriptRoot 'screenshot-report.txt'
+# Explicit UTF-8 rather than Tee-Object: in Windows PowerShell 5.1 Tee-Object writes
+# UTF-16LE, and a UTF-8 reader then sees NUL bytes between characters so every prefix match
+# fails -- the relay silently reported 0x0 geometry because of exactly that. The reader in
+# relay.mjs also tolerates UTF-16 now, but the writer must not depend on it.
+function W($m) {
+  Write-Output $m
+  Add-Content -Path $report -Value $m -Encoding UTF8
+}
+
+Remove-Item $report -Force -ErrorAction SilentlyContinue
+Remove-Item $Out -Force -ErrorAction SilentlyContinue
+
+W "session=$((Get-Process -Id $PID).SessionId) interactive=$([Environment]::UserInteractive) user=$env:USERNAME"
+
+# ---------------------------------------------------------------------------
+# Hide our own console BEFORE capturing.
+#
+# This is not redundant with the launcher's `-WindowStyle Hidden` / `windowsHide: true`:
+# in practice a console window still reached the desktop and was photographed into the
+# frame (an empty one, because this script's output goes to a pipe). Hiding the window we
+# actually own is deterministic and independent of how we were started.
+#
+# It also removes a live focus hazard: a visible console can take foreground, which would
+# corrupt the very GUI measurements a screenshot exists to support.
+# ---------------------------------------------------------------------------
+Add-Type @'
+using System;
+using System.Runtime.InteropServices;
+public static class ConsoleHider {
+  [DllImport("kernel32.dll")] public static extern IntPtr GetConsoleWindow();
+  [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
+  [DllImport("user32.dll")] public static extern bool IsWindowVisible(IntPtr hWnd);
+  public static bool Hide() {
+    IntPtr h = GetConsoleWindow();
+    if (h == IntPtr.Zero) return false;          // launched with CREATE_NO_WINDOW
+    ShowWindow(h, 0);                            // SW_HIDE
+    return !IsWindowVisible(h);
+  }
+}
+'@ -ErrorAction SilentlyContinue
+$hidden = $false
+try { $hidden = [ConsoleHider]::Hide() } catch { }
+W "console hidden=$hidden"
+
+Add-Type -AssemblyName System.Windows.Forms
+Add-Type -AssemblyName System.Drawing
+
+# Report the layout first: a useful screenshot is only meaningful next to the geometry it
+# was taken from, and this is also how a wrong-session capture gets caught.
+$vs = [System.Windows.Forms.SystemInformation]::VirtualScreen
+W "virtualscreen x=$($vs.X) y=$($vs.Y) w=$($vs.Width) h=$($vs.Height)"
+foreach ($s in [System.Windows.Forms.Screen]::AllScreens) {
+  W ("screen {0} primary={1} bounds={2} bpp={3}" -f $s.DeviceName, $s.Primary, $s.Bounds, $s.BitsPerPixel)
+}
+
+if ($vs.Width -le 0 -or $vs.Height -le 0) {
+  W "FAIL: virtual screen is empty -- almost certainly session 0"
+  W "RESULT: FAILED"
+  exit 1
+}
+
+$bmp = New-Object System.Drawing.Bitmap($vs.Width, $vs.Height)
+$gfx = [System.Drawing.Graphics]::FromImage($bmp)
+try {
+  $gfx.CopyFromScreen($vs.Left, $vs.Top, 0, 0, $bmp.Size)
+} finally {
+  $gfx.Dispose()
+}
+
+# PNG, not JPEG: the point is often to read UI text back.
+$bmp.Save($Out, [System.Drawing.Imaging.ImageFormat]::Png)
+$bmp.Dispose()
+
+if (-not (Test-Path $Out)) { W "FAIL: no file written"; W "RESULT: FAILED"; exit 1 }
+$len = (Get-Item $Out).Length
+W "wrote $Out ($len bytes)"
+
+# A pure-black frame is the classic session-0 / no-desktop symptom, so check rather than
+# hand back something that looks like a successful capture.
+$probe = New-Object System.Drawing.Bitmap($Out)
+try {
+  $distinct = @{}
+  for ($x = 0; $x -lt $probe.Width; $x += [Math]::Max(1, [int]($probe.Width / 40))) {
+    for ($y = 0; $y -lt $probe.Height; $y += [Math]::Max(1, [int]($probe.Height / 30))) {
+      $distinct[$probe.GetPixel($x, $y).ToArgb()] = $true
+    }
+  }
+  W "distinct sampled colors: $($distinct.Count)"
+  if ($distinct.Count -le 1) { W "WARN: the frame is a single flat color -- capture may be blank" }
+} finally {
+  $probe.Dispose()
+}
+
+W "RESULT: OK"

package/slave/selfcheck.ps1

@@ -0,0 +1,350 @@
+# slave-selfcheck.ps1 -- DESIGN.md section 5.10 self-check.
+# ASCII-ONLY ON PURPOSE: Windows PowerShell 5.1 reads BOM-less files as ANSI, and a
+# non-ASCII byte sequence inside a string literal breaks parsing.
+# Dual mode: SYSTEM (boot) checks the system layer; interactive (logon) adds S7/S8.
+#
+# Output goes NEXT TO THIS SCRIPT ($PSScriptRoot), not to a fixed absolute path: the
+# relay reads the JSON from the script's own directory, so keeping them colocated makes
+# the pair relocatable and removes a silent mismatch when either is moved.
+#
+# `param()` must be the FIRST statement after the comments: PowerShell rejects it after any
+# assignment, and PS 5.1 reports that as a confusing "invalid assignment operator" further down.
+param(
+  # The GUI application under test, for S18. Empty means "this worker does not verify a specific
+  # app", which is reported as unconfigured rather than missing.
+  [string]$App = '',
+  # The task directory, for S20. The relay passes the directory it actually hands the agent, so the
+  # integrity probe measures the tree remote work really runs in. Empty means no probe.
+  [string]$Workspace = ''
+)
+$ErrorActionPreference = 'Continue'
+if ([string]::IsNullOrEmpty($PSScriptRoot)) { $PSScriptRoot = Split-Path -Parent $MyInvocation.MyCommand.Path }
+$outFile = Join-Path $PSScriptRoot 'selfcheck.json'
+$txtFile = Join-Path $PSScriptRoot 'selfcheck.txt'
+
+Add-Type -AssemblyName System.Windows.Forms -ErrorAction SilentlyContinue
+Add-Type @'
+using System;
+using System.Text;
+using System.Runtime.InteropServices;
+public class SC {
+  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
+  public struct DD {
+    public int cb;
+    [MarshalAs(UnmanagedType.ByValTStr, SizeConst=32)] public string DeviceName;
+    [MarshalAs(UnmanagedType.ByValTStr, SizeConst=128)] public string DeviceString;
+    public int StateFlags;
+    [MarshalAs(UnmanagedType.ByValTStr, SizeConst=128)] public string DeviceID;
+    [MarshalAs(UnmanagedType.ByValTStr, SizeConst=128)] public string DeviceKey;
+  }
+  [DllImport("user32.dll", CharSet=CharSet.Unicode)]
+  public static extern bool EnumDisplayDevices(string dev, uint n, ref DD d, uint flags);
+  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
+  public struct DEVMODE {
+    [MarshalAs(UnmanagedType.ByValTStr, SizeConst=32)] public string dmDeviceName;
+    public short dmSpecVersion, dmDriverVersion, dmSize, dmDriverExtra;
+    public int dmFields, dmPositionX, dmPositionY, dmDisplayOrientation, dmDisplayFixedOutput;
+    public short dmColor, dmDuplex, dmYResolution, dmTTOption, dmCollate;
+    [MarshalAs(UnmanagedType.ByValTStr, SizeConst=32)] public string dmFormName;
+    public short dmLogPixels;
+    public int dmBitsPerPel, dmPelsWidth, dmPelsHeight, dmDisplayFlags, dmDisplayFrequency;
+    public int dmICMMethod, dmICMIntent, dmMediaType, dmDitherType, dmReserved1, dmReserved2, dmPanningWidth, dmPanningHeight;
+  }
+  [DllImport("user32.dll", CharSet=CharSet.Unicode)] public static extern bool EnumDisplaySettings(string d,int m,ref DEVMODE dm);
+  [StructLayout(LayoutKind.Sequential)] public struct POINT { public int X,Y; }
+  [DllImport("user32.dll")] public static extern bool SetCursorPos(int x,int y);
+  [DllImport("user32.dll")] public static extern bool GetCursorPos(out POINT p);
+  [DllImport("user32.dll")] public static extern IntPtr OpenInputDesktop(uint f,bool i,uint a);
+  [DllImport("user32.dll")] public static extern bool CloseDesktop(IntPtr h);
+  [DllImport("user32.dll", CharSet=CharSet.Unicode)] public static extern bool GetUserObjectInformation(IntPtr h,int i,StringBuilder p,int n,out int need);
+  [DllImport("kernel32.dll")] public static extern uint WTSGetActiveConsoleSessionId();
+
+  public static string[] Adapters() {
+    var l = new System.Collections.Generic.List<string>();
+    var d = new DD(); d.cb = Marshal.SizeOf(typeof(DD)); uint i = 0;
+    while (EnumDisplayDevices(null, i, ref d, 0)) {
+      var mons = new System.Collections.Generic.List<string>();
+      var m = new DD(); m.cb = Marshal.SizeOf(typeof(DD)); uint j = 0;
+      while (EnumDisplayDevices(d.DeviceName, j, ref m, 0)) {
+        mons.Add(m.DeviceString + " flags=" + m.StateFlags);
+        m = new DD(); m.cb = Marshal.SizeOf(typeof(DD)); j++;
+      }
+      l.Add(d.DeviceName + " | " + d.DeviceString + " | flags=" + d.StateFlags + " | mons=" + mons.Count + " {" + string.Join(", ", mons) + "}");
+      d = new DD(); d.cb = Marshal.SizeOf(typeof(DD)); i++;
+    }
+    return l.ToArray();
+  }
+  public static string InputDesktop() {
+    IntPtr h = OpenInputDesktop(0, false, 0x0001);
+    if (h == IntPtr.Zero) return "<err " + Marshal.GetLastWin32Error() + ">";
+    try { var sb = new StringBuilder(256); int n; return GetUserObjectInformation(h, 2, sb, 512, out n) ? sb.ToString() : "?"; }
+    finally { CloseDesktop(h); }
+  }
+  public static string CursorTest(int x, int y) {
+    SetCursorPos(x - 3, y - 3); bool ok = SetCursorPos(x, y);
+    var p = new POINT(); GetCursorPos(out p);
+    return (p.X == x && p.Y == y) ? "ok" : ("FAIL set=" + ok + " got=" + p.X + "," + p.Y);
+  }
+  public static string ConsoleId() { return WTSGetActiveConsoleSessionId().ToString(); }
+}
+'@ -ErrorAction SilentlyContinue
+
+$checks = New-Object System.Collections.ArrayList
+function Add-Check($id, $name, $sev, $status, $expected, $actual, $fix) {
+  [void]$checks.Add([ordered]@{
+    id = $id; name = $name; severity = $sev; status = $status
+    expected = $expected; actual = $actual; fix = $fix
+  })
+}
+
+$sid = (Get-Process -Id $PID).SessionId
+$interactive = [Environment]::UserInteractive
+$adaps = @()
+try { $adaps = [SC]::Adapters() } catch {}
+$screens = @()
+try { $screens = @([System.Windows.Forms.Screen]::AllScreens) } catch {}
+$primary = $screens | Where-Object { $_.Primary } | Select-Object -First 1
+$vddAdap = @($adaps | Where-Object { $_ -match 'Virtual Display|MttVDD|VDD' })
+$edids = @()
+try { $edids = @(Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorID -ErrorAction SilentlyContinue) } catch {}
+$edidNames = @($edids | ForEach-Object { -join ($_.UserFriendlyName | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ }) })
+
+# S1 display device attached to the desktop
+Add-Check 'S1' 'display adapter attached' 'blocking' $(if ($adaps.Count -gt 0) { 'pass' } else { 'fail' }) '>=1 adapter' ($adaps.Count.ToString() + ' adapters') 'install/enable a display adapter'
+# S2 virtual display present with EDID
+Add-Check 'S2' 'virtual display present (not WinDisc fallback)' 'blocking' $(if ($vddAdap.Count -gt 0 -and $edids.Count -gt 0) { 'pass' } else { 'fail' }) 'VDD + EDID' ('vdd=' + $vddAdap.Count + ' edid=[' + ($edidNames -join ',') + ']') 'install/enable Virtual Display Driver'
+# S3 resolution
+$res = if ($primary) { "$($primary.Bounds.Width)x$($primary.Bounds.Height)" } else { '?' }
+Add-Check 'S3' 'primary resolution' 'warning' $(if ($res -eq '1920x1080') { 'pass' } else { 'warn' }) '1920x1080' $res 'put the target resolution first in vdd_settings.xml'
+# S4 primary at origin -- AND the report says whether that primary is the virtual display
+#
+# WHY THIS IS NOT A BLOCKING "MUST BE VIRTUAL" CHECK, after it briefly was one:
+#
+# DESIGN words S4 as "the virtual screen is primary AND at (0,0)". Enforcing the first half made a
+# real deployment unusable, and the reason is worth keeping: Windows 11 draws the LOGON UI on the
+# PRIMARY display only. Make the virtual display primary and the login screen is rendered on a
+# display with no physical output -- the operator's monitor stays black and they cannot log in.
+#
+# The requirement existed to guarantee "a coordinate space independent of the operator's monitor".
+# On a KVM that keeps presenting the monitor's EDID, Windows never sees the display disappear, so
+# that guarantee is already provided by the hardware -- and insisting on the virtual display only
+# moves the logon screen somewhere nobody can see it.
+#
+# What still blocks is the half that protects a running task: a primary that is not at (0,0) means
+# every absolute coordinate is silently offset. Whether the primary is the virtual display or the
+# operator's own is reported in `actual`, so the situation is visible without being fatal.
+$okOrigin = $false; $origin = '?'; $primaryIsVirtual = $false; $primaryAdapter = ''
+if ($primary) {
+  $origin = "primary=$($primary.DeviceName) at $($primary.Bounds.X),$($primary.Bounds.Y)"
+  $okOrigin = ($primary.Bounds.X -eq 0 -and $primary.Bounds.Y -eq 0)
+  # `Adapters()` returns one line per adapter, each starting with its device name (`\\.\DISPLAY1`),
+  # which is exactly what `Screen.DeviceName` gives us -- so no extra P/Invoke is needed.
+  $primaryAdapter = @($adaps | Where-Object { $_ -like "$($primary.DeviceName) *" }) | Select-Object -First 1
+  if ($primaryAdapter) { $primaryIsVirtual = [bool]($primaryAdapter -match 'Virtual Display|MttVDD|VDD') }
+}
+$primaryDesc = $origin + ' virtual=' + $primaryIsVirtual
+if ($primaryAdapter) { $primaryDesc = $primaryDesc + ' [' + (($primaryAdapter -split ' \| ')[1]) + ']' }
+Add-Check 'S4' 'primary monitor at origin' 'blocking' $(if ($okOrigin) { 'pass' } else { 'fail' }) 'primary at (0,0)' $primaryDesc 'ChangeDisplaySettingsEx CDS_SET_PRIMARY|CDS_NORESET then commit'
+# S5 DPI
+$scale = 1.00
+try { $g = [System.Drawing.Graphics]::FromHwnd([IntPtr]::Zero); if ($g) { $scale = [math]::Round($g.DpiX / 96.0, 2); $g.Dispose() } } catch {}
+Add-Check 'S5' 'DPI scale' 'blocking' $(if ($scale -eq 1.0) { 'pass' } else { 'fail' }) '1.00' $scale.ToString() 'set display scaling to 100%'
+# S6 console session
+$q = (& query.exe session 2>&1 | Out-String)
+$cid = [SC]::ConsoleId()
+$isConsole = ($q -match ('(?m)^>?console\s+\S*\s*' + $cid + '\s'))
+Add-Check 'S6' 'session bound to console' 'blocking' $(if ($isConsole) { 'pass' } else { 'fail' }) ('console id=' + $cid) ('mySession=' + $sid + ' consoleId=' + $cid) 'tscon <id> /dest:console as SYSTEM'
+# S7 unlocked (interactive only)
+if ($interactive) {
+  $dsk = [SC]::InputDesktop()
+  Add-Check 'S7' 'session unlocked' 'blocking' $(if ($dsk -eq 'Default') { 'pass' } else { 'fail' }) 'Default' $dsk 'unlock the session; disable auto-lock'
+} else {
+  Add-Check 'S7' 'session unlocked' 'blocking' 'unchecked' 'Default' 'n/a in system session' 'must be checked in an interactive session'
+}
+# S8 live input injection (interactive only)
+if ($interactive) {
+  $r = [SC]::CursorTest(960, 540)
+  Add-Check 'S8' 'SendInput / SetCursorPos live' 'blocking' $(if ($r -eq 'ok') { 'pass' } else { 'fail' }) 'cursor moves' $r 'requires S1+S6+S7 to pass'
+} else {
+  Add-Check 'S8' 'SendInput / SetCursorPos live' 'blocking' 'unchecked' 'cursor moves' 'n/a in system session' 'must be checked in an interactive session'
+}
+# S9 no sleep
+function PwrIdx($sub, $set) {
+  $o = & powercfg /q SCHEME_CURRENT $sub $set 2>&1 | Out-String
+  $m = [regex]::Matches($o, '0x[0-9a-fA-F]{8}')
+  if ($m.Count -ge 2) { return @([Convert]::ToInt64($m[$m.Count - 2].Value, 16), [Convert]::ToInt64($m[$m.Count - 1].Value, 16)) }
+  return @(-1, -1)
+}
+$standby = PwrIdx 'SUB_SLEEP' 'STANDBYIDLE'
+$hib = PwrIdx 'SUB_SLEEP' 'HIBERNATEIDLE'
+$noSleep = ($standby[0] -eq 0) -and ($standby[1] -eq 0) -and ($hib[0] -eq 0) -and ($hib[1] -eq 0)
+Add-Check 'S9' 'sleep/hibernate disabled' 'blocking' $(if ($noSleep) { 'pass' } else { 'fail' }) 'AC=0 DC=0' ('standby=' + ($standby -join '/') + ' hibernate=' + ($hib -join '/')) 'powercfg /change standby-timeout-ac 0 (AC and DC)'
+# S10 screensaver
+$ss = (Get-ItemProperty 'HKCU:\Control Panel\Desktop' -Name ScreenSaveActive -ErrorAction SilentlyContinue).ScreenSaveActive
+Add-Check 'S10' 'screensaver off' 'warning' $(if ("$ss" -eq '0') { 'pass' } else { 'warn' }) '0' "$ss" 'HKCU Control Panel Desktop ScreenSaveActive=0'
+# S11 no auto-lock policy
+$il = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name InactivityTimeoutSecs -ErrorAction SilentlyContinue).InactivityTimeoutSecs
+Add-Check 'S11' 'no auto-lock policy' 'warning' $(if ($null -eq $il) { 'pass' } else { 'warn' }) 'not set' $(if ($null -eq $il) { 'not set' } else { "$il" }) 'remove InactivityTimeoutSecs policy'
+# S12 QuickEdit off
+$qe = (Get-ItemProperty 'HKCU:\Console' -Name QuickEdit -ErrorAction SilentlyContinue).QuickEdit
+Add-Check 'S12' 'console QuickEdit off' 'blocking' $(if ("$qe" -eq '0') { 'pass' } else { 'fail' }) '0' "$qe" 'HKCU Console QuickEdit=0 and InsertMode=0'
+# S14 DSH installed
+#
+# The path is DERIVED, not hardcoded -- but "derive it from $env:LOCALAPPDATA" is NOT enough, and
+# getting that wrong once already is why this comment is long.
+#
+# The history: it used to be a literal path under one user's profile, correct on exactly one machine. The
+# first fix derived it from the environment, which is correct for an interactive run and WRONG for
+# the other mode this script has -- a boot check under a SYSTEM scheduled task, where
+# $env:LOCALAPPDATA points at C:\Windows\system32\config\systemprofile and no candidate matches.
+# So the naive derivation replaced a check that was right on one machine with one that is wrong on
+# all of them in that mode.
+#
+# The candidates are therefore gathered from every source that can name the install:
+#   1. a RUNNING DSH process -- whatever account we are, it says where DSH actually is
+#   2. the current account's install location
+#   3. Program Files
+#   4. every user profile on the machine -- what a SYSTEM run cannot see about itself
+$dshCandidates = New-Object System.Collections.ArrayList
+$runningDsh = Get-Process -Name 'DeepSeek Harness' -ErrorAction SilentlyContinue | Select-Object -First 1
+if ($runningDsh -and $runningDsh.Path) { [void]$dshCandidates.Add((Split-Path -Parent $runningDsh.Path)) }
+[void]$dshCandidates.Add((Join-Path $env:LOCALAPPDATA 'Programs\DeepSeek Harness'))
+[void]$dshCandidates.Add((Join-Path $env:ProgramFiles 'DeepSeek Harness'))
+if (${env:ProgramFiles(x86)}) { [void]$dshCandidates.Add((Join-Path ${env:ProgramFiles(x86)} 'DeepSeek Harness')) }
+[void]$dshCandidates.Add('C:\Program Files\DeepSeek Harness')
+$profileRoots = @()
+if ($env:SystemDrive) { $profileRoots += (Join-Path $env:SystemDrive 'Users') }
+foreach ($root in $profileRoots) {
+  Get-ChildItem $root -Directory -ErrorAction SilentlyContinue | ForEach-Object {
+    [void]$dshCandidates.Add((Join-Path $_.FullName 'AppData\Local\Programs\DeepSeek Harness'))
+  }
+}
+$dshCandidates = @($dshCandidates | Where-Object { $_ -and $_ -ne '' } | Select-Object -Unique)
+$ver = ''
+foreach ($candidate in $dshCandidates) {
+  if (-not (Test-Path $candidate)) { continue }
+  $exe = Get-ChildItem $candidate -Filter '*.exe' -ErrorAction SilentlyContinue | Select-Object -First 1
+  if ($exe) { $ver = $exe.VersionInfo.FileVersion; break }
+}
+Add-Check 'S14' 'DSH installed' 'blocking' $(if ($ver) { 'pass' } else { 'fail' }) 'installed' $(if ($ver) { $ver } else { 'nowhere in ' + $dshCandidates.Count + ' candidate locations' }) 'install DSH and match the master version'
+# S15 credentials
+# Same reasoning and the same sources: a SYSTEM run must still be able to find the account whose
+# DSH is signed in. The report names WHICH path it looked at, and lists them all when it finds
+# none, so a genuine "signed out" is distinguishable from "looked in the wrong place".
+$credCandidates = New-Object System.Collections.ArrayList
+[void]$credCandidates.Add((Join-Path $env:USERPROFILE '.dsh\.credentials.yaml'))
+[void]$credCandidates.Add((Join-Path $env:APPDATA 'dsh\.credentials.yaml'))
+foreach ($root in $profileRoots) {
+  Get-ChildItem $root -Directory -ErrorAction SilentlyContinue | ForEach-Object {
+    [void]$credCandidates.Add((Join-Path $_.FullName '.dsh\.credentials.yaml'))
+  }
+}
+$credCandidates = @($credCandidates | Where-Object { $_ -and $_ -ne '' } | Select-Object -Unique)
+$credFound = ''
+foreach ($candidate in $credCandidates) {
+  if (Test-Path $candidate) { $credFound = $candidate; break }
+}
+$hasCred = $credFound -ne ''
+Add-Check 'S15' 'model credentials present' 'blocking' $(if ($hasCred) { 'pass' } else { 'fail' }) 'exists' $(if ($hasCred) { $credFound } else { 'missing in ' + $credCandidates.Count + ' locations, including ' + $credCandidates[0] }) 'sign in to DSH on the worker'
+# S16 disk space
+$d = Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'" -ErrorAction SilentlyContinue
+$freeGB = if ($d) { [math]::Round($d.FreeSpace / 1GB, 1) } else { 0 }
+Add-Check 'S16' 'free disk space' 'warning' $(if ($freeGB -ge 50) { 'pass' } else { 'warn' }) '>=50 GB' "$freeGB GB" 'free up disk'
+# S17 GPU (informational)
+$gpu = (Get-CimInstance Win32_VideoController -ErrorAction SilentlyContinue | ForEach-Object { $_.Name + ' ' + $_.DriverVersion }) -join ' ; '
+Add-Check 'S17' 'GPU model/driver (reported)' 'info' 'pass' 'n/a' $gpu '-'
+# S18 target app present
+#
+# The path is CONFIGURABLE, and the check says which path it looked at.
+#
+# It used to be hardcoded to the reference worker's build output
+# ('C:\dsh-remote\avalonia-demo\...\avalonia-demo.exe'), so on every other machine it reported
+# 'missing' -- the same defect class as S14/S15: a check that names a specific machine's layout
+# and then reports the absence of that layout as a fault of the machine under test. It is a
+# `warning` rather than `blocking`, so the verdict was unaffected, but a report that warns about
+# something that is not wrong teaches the operator to stop reading the warnings.
+#
+# Unconfigured is not the same as missing, so it is reported as such. Pass -App <path>, or set
+# DSH_SELFCHECK_APP, to check for a specific application.
+$app = if (-not [string]::IsNullOrEmpty($App)) { $App } else { [string]$env:DSH_SELFCHECK_APP }
+if ([string]::IsNullOrEmpty($app)) {
+  Add-Check 'S18' 'target app present' 'warning' 'warn' 'configured app exists' 'not configured (pass -App or set DSH_SELFCHECK_APP)' 'set the app under test if this worker verifies one'
+} else {
+  $appThere = Test-Path $app
+  Add-Check 'S18' 'target app present' 'warning' $(if ($appThere) { 'pass' } else { 'warn' }) 'exists' $(if ($appThere) { 'present: ' + $app } else { 'missing at: ' + $app }) 'sync the app build output' 
+}
+
+# S20 workspace launch integrity
+#
+# WHY THIS IS IN THE READY REPORT: the failure it detects (a GUI app launched from the workspace
+# runs at Low integrity and cannot write %LOCALAPPDATA%) presents as an application or ACL fault.
+# The setting says danger-full-access, the agent shell is High, and only a copied executable reveals
+# the downgrade. The probe copies a signed system binary into the workspace and into %TEMP% and
+# compares the mandatory labels of the two child tokens.
+#
+# It is a warning, not a blocker: GUI work is broken, but the worker is otherwise usable and the fix
+# is a label reset rather than a redeploy. Unconfigured workspace means no probe, not a failure.
+# The relay only passes -Workspace under danger-full-access; a workspace-write workspace is SUPPOSED
+# to be Low, so warning about it there would be a false alarm.
+$integrity = $null
+if (-not [string]::IsNullOrEmpty($Workspace)) {
+  $probeScript = Join-Path $PSScriptRoot 'integrity-probe.ps1'
+  if (-not (Test-Path -LiteralPath $probeScript)) {
+    Add-Check 'S20' 'workspace launch integrity' 'warning' 'warn' 'same as %TEMP%' ('integrity-probe.ps1 missing next to selfcheck.ps1: ' + $probeScript) 'deploy integrity-probe.ps1 with the relay, or stage GUI apps outside the workspace'
+  } else {
+    try {
+      $raw = & $probeScript -Workspace $Workspace 2>$null
+      $integrity = ($raw | Out-String) | ConvertFrom-Json
+      $fmt = { param($x) if ($null -eq $x) { '?' } else { "$($x.level)($($x.sid))" } }
+      $actual = 'self=' + (& $fmt $integrity.self) + ' workspace=' + (& $fmt $integrity.workspace) + ' temp=' + (& $fmt $integrity.temp)
+      if ($integrity.error -ne '') { $actual = $actual + ' error=' + $integrity.error }
+      if ($integrity.degraded) {
+        Add-Check 'S20' 'workspace launch integrity' 'warning' 'warn' 'workspace at least %TEMP% integrity' $actual 'A Low label inherited from an earlier workspace-write session is downgrading apps in this tree. Under danger-full-access the relay repairs it on start (--task-dir), or run slave/repair-workspace-integrity.ps1 -Path <workspace>; otherwise stage the app outside the workspace with slave/stage-app.ps1'
+      } elseif ($null -eq $integrity.workspace -or $null -eq $integrity.temp) {
+        Add-Check 'S20' 'workspace launch integrity' 'warning' 'warn' 'same as %TEMP%' $actual 'the probe could not launch from one of the two directories; check that the task directory exists and is writable by this account'
+      } else {
+        Add-Check 'S20' 'workspace launch integrity' 'warning' 'pass' 'workspace at least %TEMP% integrity' $actual ''
+      }
+    } catch {
+      Add-Check 'S20' 'workspace launch integrity' 'warning' 'warn' 'same as %TEMP%' ('probe failed: ' + $_.Exception.Message) 'run slave/integrity-probe.ps1 -Workspace <dir> by hand to see the failure'
+    }
+  }
+}
+
+$blocking = @($checks | Where-Object { $_.severity -eq 'blocking' -and $_.status -eq 'fail' })
+$warn = @($checks | Where-Object { $_.severity -in @('blocking', 'warning') -and $_.status -eq 'warn' })
+$unchecked = @($checks | Where-Object { $_.status -eq 'unchecked' })
+$verdict = if ($blocking.Count -gt 0) { 'blocked' } elseif ($unchecked.Count -gt 0) { 'partial' } elseif ($warn.Count -gt 0) { 'warn' } else { 'ready' }
+
+$payload = [ordered]@{
+  schemaVersion = 1
+  generatedAt = (Get-Date).ToString('o')
+  worker = $env:COMPUTERNAME
+  sessionId = $sid
+  interactive = $interactive
+  # The master's dispatch gate needs to tell "the worker is broken" apart from "nobody
+  # is logged in on it": the first is a fault, the second is an operational state that
+  # cannot be fixed from the master. Without this field the gate only sees blocking
+  # failures and would report a logged-out worker as a fault (DESIGN section 5.10.6).
+  sessionSegment = $(if ($interactive) { 'ok' } else { 'unavailable' })
+  verdict = $verdict
+  blockingFailures = $blocking.Count
+  warnings = $warn.Count
+  unchecked = $unchecked.Count
+  # The task directory the integrity probe measured, and its raw readings. Null when no workspace
+  # was supplied -- "not probed" must be distinguishable from "probed and equal".
+  workspace = $Workspace
+  integrity = $integrity
+  checks = $checks
+}
+$payload | ConvertTo-Json -Depth 6 | Set-Content -Path $outFile -Encoding UTF8
+
+$lines = @()
+$lines += "verdict=$verdict blocking=$($blocking.Count) warn=$($warn.Count) unchecked=$($unchecked.Count) session=$sid interactive=$interactive"
+foreach ($c in $checks) {
+  $mark = switch ($c.status) { 'pass' { 'OK  ' } 'fail' { 'FAIL' } 'warn' { 'WARN' } 'unchecked' { '??  ' } default { '    ' } }
+  $lines += ("  [" + $mark + "] " + $c.id + " " + $c.name + " | expected=" + $c.expected + " | actual=" + $c.actual)
+}
+$lines += "json: $outFile"
+$lines | Set-Content -Path $txtFile -Encoding UTF8
+$lines | ForEach-Object { Write-Output $_ }

package/slave/stage-app.ps1

@@ -0,0 +1,116 @@
+# stage-app.ps1 -- copy a GUI app OUTSIDE the workspace before launching it.
+#
+# WHY: a workspace that a workspace-write session has ever used carries an inheritable Low mandatory
+# label. Windows launches a Low-labelled image at Low integrity, and a Low process cannot write
+# %LOCALAPPDATA% even when the account's ACL grants it. Copying the app to a normal user location
+# (%LOCALAPPDATA%\dsh-remote-use\staging by default) removes the inherited label, which is the
+# reliable alternative to repairing the workspace itself (PITFALLS F41).
+#
+# The relay repairs an explicitly armed workspace automatically under danger-full-access. This helper
+# is for the other two cases: a hand-managed relay with no --task-dir, and an operator who prefers to
+# keep GUI payloads out of the workspace entirely.
+#
+# ASCII-only, param() first: Windows PowerShell 5.1 reads BOM-less files as ANSI.
+param(
+  [Parameter(Mandatory = $true)][string]$Source,
+  [string]$Destination = '',
+  [string]$ExeName = '',
+  [switch]$Force,
+  [switch]$Launch,
+  [string]$Arguments = ''
+)
+
+$ErrorActionPreference = 'Stop'
+
+if (-not (Test-Path -LiteralPath $Source)) {
+  Write-Host "REFUSING: source does not exist: $Source" -ForegroundColor Red
+  exit 2
+}
+$sourceFull = (Resolve-Path -LiteralPath $Source).Path
+$sourceItem = Get-Item -LiteralPath $sourceFull
+$leaf = [System.IO.Path]::GetFileNameWithoutExtension($sourceItem.Name)
+if ([string]::IsNullOrEmpty($leaf)) { $leaf = 'app' }
+
+if ([string]::IsNullOrEmpty($Destination)) {
+  $stamp = (Get-Date).ToString('yyyyMMdd-HHmmss')
+  $Destination = Join-Path $env:LOCALAPPDATA ("dsh-remote-use\staging\" + $leaf + '-' + $stamp)
+}
+
+$targetItem = $null
+if ($sourceItem.PSIsContainer) {
+  $targetDir = $Destination
+  if ((Test-Path -LiteralPath $targetDir) -and -not $Force) {
+    Write-Host "REFUSING: destination exists: $targetDir (pass -Force to replace it)" -ForegroundColor Red
+    exit 2
+  }
+  if ((Test-Path -LiteralPath $targetDir) -and $Force) {
+    Remove-Item -LiteralPath $targetDir -Recurse -Force
+  }
+  New-Item -ItemType Directory -Path $targetDir -Force | Out-Null
+  Copy-Item -Path (Join-Path $sourceFull '*') -Destination $targetDir -Recurse -Force
+  $targetItem = Get-Item -LiteralPath $targetDir
+} else {
+  $targetDir = $Destination
+  if (Test-Path -LiteralPath $targetDir -PathType Leaf) {
+    $targetDir = Split-Path -Parent $targetDir
+  }
+  New-Item -ItemType Directory -Path $targetDir -Force | Out-Null
+  $targetFile = Join-Path $targetDir $sourceItem.Name
+  if ((Test-Path -LiteralPath $targetFile) -and -not $Force) {
+    Write-Host "REFUSING: destination exists: $targetFile (pass -Force to replace it)" -ForegroundColor Red
+    exit 2
+  }
+  Copy-Item -LiteralPath $sourceFull -Destination $targetFile -Force
+  $targetItem = Get-Item -LiteralPath $targetFile
+}
+
+# Make the staged copy's label explicit instead of inherited. The destination is normally Medium
+# already, but %LOCALAPPDATA% can itself be inside a tree that a sandbox has labelled.
+$stagedPath = $targetItem.FullName
+Write-Host "staged: $stagedPath"
+if ($targetItem.PSIsContainer) {
+  & icacls $stagedPath /setintegritylevel '(OI)(CI)Medium' /T /C /Q | Out-Null
+} else {
+  & icacls $stagedPath /setintegritylevel Medium | Out-Null
+}
+if ($LASTEXITCODE -ne 0) {
+  Write-Host "WARNING: could not set the staged copy's integrity label (icacls exit $LASTEXITCODE)" -ForegroundColor Yellow
+}
+
+$probe = Join-Path $PSScriptRoot 'integrity-probe.ps1'
+if (Test-Path -LiteralPath $probe) {
+  $probeDir = if ($targetItem.PSIsContainer) { $stagedPath } else { $targetDir }
+  & $probe -Workspace $probeDir
+}
+
+if ($Launch) {
+  if ($targetItem.PSIsContainer) {
+    $exe = $null
+    if (-not [string]::IsNullOrEmpty($ExeName)) {
+      $candidate = Join-Path $stagedPath $ExeName
+      if (Test-Path -LiteralPath $candidate) { $exe = $candidate }
+    } else {
+      $exe = @(Get-ChildItem -LiteralPath $stagedPath -Filter '*.exe' -File -ErrorAction SilentlyContinue | Select-Object -First 1)[0].FullName
+    }
+    if ([string]::IsNullOrEmpty($exe)) {
+      Write-Host 'REFUSING to launch: no .exe in the staged directory (pass -ExeName)' -ForegroundColor Red
+      exit 3
+    }
+    if ([string]::IsNullOrEmpty($Arguments)) {
+      Start-Process -FilePath $exe -WorkingDirectory $stagedPath
+    } else {
+      Start-Process -FilePath $exe -ArgumentList $Arguments -WorkingDirectory $stagedPath
+    }
+    Write-Host "launched: $exe"
+  } else {
+    if ([string]::IsNullOrEmpty($Arguments)) {
+      Start-Process -FilePath $stagedPath -WorkingDirectory $targetDir
+    } else {
+      Start-Process -FilePath $stagedPath -ArgumentList $Arguments -WorkingDirectory $targetDir
+    }
+    Write-Host "launched: $stagedPath"
+  }
+}
+
+Write-Host 'RESULT: OK -- the app is staged outside the workspace.' -ForegroundColor Green
+exit 0