examedix-reach 0.0.0-stage → 0.1.0

package/DISCLOSURE

@@ -0,0 +1,24 @@
+ExamediX Reach is a legitimate remote-workstation integration for computers that the user owns or is explicitly authorized to administer.
+
+The package can connect an authorized Windows computer to the ExamediX Reach service and expose user-approved workstation capabilities such as:
+- listing, reading, creating, editing, moving, copying and deleting authorized files;
+- searching authorized folders;
+- reading and writing supported document formats;
+- inspecting and managing processes;
+- starting and interacting with user-level processes;
+- running user-level PowerShell when the local user has explicitly enabled Reach Power Mode.
+
+These capabilities are dual-use because file, process and shell operations can resemble capabilities found in remote-administration or security tools. Reach is intended only for legitimate administration of the user's own or otherwise authorized computers.
+
+Reach includes security controls including:
+- explicit device pairing and account ownership checks;
+- OAuth-scoped access;
+- outbound-only TLS connections from the Windows agent;
+- no inbound workstation listener;
+- local filesystem boundaries;
+- blocking of credential stores, private keys and common secret files;
+- Power Mode disabled by default for ordinary users;
+- audit metadata with sensitive values redacted;
+- Windows DPAPI protection for the local device credential.
+
+Unauthorized access, credential theft, covert surveillance, malware deployment, destructive misuse, or bypassing security controls is prohibited by the Reach Terms of Service.

package/README.md

@@ -1,3 +1,26 @@
-# Temporary Holding Version
+# ExamediX Reach
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+ExamediX Reach securely connects ChatGPT to Windows computers you own or are authorized to administer.
+
+## Quick start
+
+Requirements: Windows 10/11 and Node.js 20 or newer.
+
+```powershell
+npx examedix-reach@latest remote
+```
+
+On first run Reach prints a pairing code and opens the Reach account page. Sign in or create an account, enter the code, and keep the process running while you want the computer reachable from ChatGPT.
+
+Useful commands:
+
+```powershell
+npx examedix-reach@latest setup
+npx examedix-reach@latest doctor
+npx examedix-reach@latest --version
+```
+
+Reach makes an outbound TLS connection only. It does not require an inbound Windows port.
+
+Security and privacy: https://examedix.ch/reach/security  
+Support: https://examedix.ch/reach/support

package/THIRD-PARTY-NOTICES.txt

@@ -0,0 +1,17 @@
+ExamediX Reach third-party notices
+
+This distribution includes the Node.js runtime and open-source JavaScript dependencies.
+Node.js is distributed under its project license; the complete Node license file is included as runtime/NODE-LICENSE.txt.
+
+Direct runtime dependencies:
+- ws 8.x — MIT
+- exceljs 4.4.0 — MIT
+- jszip 3.x — MIT OR GPL-3.0-or-later
+- pdf-parse 2.4.5 — MIT
+- pdf-lib 1.17.1 — MIT
+
+Security-pinned transitive dependency:
+- uuid 11.1.1 — MIT (forced through npm overrides to avoid older-version security advisories)
+
+Transitive dependencies remain subject to their respective license terms included in the distributed node_modules packages.
+ExamediX Reach does not claim ownership of third-party open-source components.

package/bin/reach.js

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const VERSION="0.1.0";
+const here=path.dirname(fileURLToPath(import.meta.url));
+const agent=path.resolve(here,"..","dist","agent.js");
+const command=(process.argv[2]||"remote").toLowerCase();
+const root=process.env.REACH_ROOT || (
+  process.platform==="win32" && process.env.LOCALAPPDATA
+    ? path.join(process.env.LOCALAPPDATA,"ExamediX","ReachData")
+    : path.join(os.homedir(),".examedix-reach")
+);
+
+function openBrowser(url){
+  try{
+    if(process.platform==="win32"){
+      const p=spawn("cmd.exe",["/d","/c","start","",url],{detached:true,stdio:"ignore",windowsHide:true});
+      p.unref();
+    } else if(process.platform==="darwin"){
+      const p=spawn("open",[url],{detached:true,stdio:"ignore"}); p.unref();
+    } else {
+      const p=spawn("xdg-open",[url],{detached:true,stdio:"ignore"}); p.unref();
+    }
+  }catch{}
+}
+
+function printHelp(){
+  console.log(`ExamediX Reach ${VERSION}
+
+Usage:
+  examedix-reach remote      Connect this computer to Reach (default)
+  examedix-reach setup       Create/show a pairing code, then exit
+  examedix-reach doctor      Check local prerequisites and Reach service
+  examedix-reach --version   Show version
+
+Examples:
+  npx examedix-reach@latest remote
+  npx examedix-reach@latest setup
+
+Local data:
+  ${root}
+
+Reach:
+  https://examedix.ch/reach
+`);
+}
+
+async function doctor(){
+  const result={};
+  result.node=process.version;
+  result.platform=`${process.platform} ${os.release()}`;
+  result.root=root;
+  result.deviceFile=fs.existsSync(path.join(root,"device.json"));
+  result.agentFile=fs.existsSync(agent);
+  try{
+    const r=await fetch("https://examedix.ch/reach/health",{signal:AbortSignal.timeout(10000)});
+    result.service=r.ok?"online":`http-${r.status}`;
+  }catch(e){result.service="unreachable"; result.error=e.message;}
+  console.log(JSON.stringify(result,null,2));
+  process.exit(result.agentFile&&result.service==="online"?0:1);
+}
+
+function runAgent(args,openOnPair=false){
+  if(process.platform!=="win32"){
+    console.error("ExamediX Reach 0.1.0 currently supports Windows only.");
+    process.exit(1);
+  }
+  fs.mkdirSync(root,{recursive:true});
+  const child=spawn(process.execPath,[agent,"--root",root,...args],{
+    stdio:["inherit","pipe","pipe"],
+    windowsHide:false
+  });
+  let opened=false;
+  child.stdout.on("data",buf=>{
+    const text=buf.toString();
+    process.stdout.write(text);
+    if(openOnPair&&!opened&&text.includes("PAIRING CODE:")){
+      opened=true;
+      console.log("\nOpening ExamediX Reach account/pairing page...");
+      openBrowser("https://examedix.ch/reach/signup");
+    }
+  });
+  child.stderr.on("data",buf=>process.stderr.write(buf));
+  const forward=sig=>{try{child.kill(sig);}catch{}};
+  process.on("SIGINT",()=>forward("SIGINT"));
+  process.on("SIGTERM",()=>forward("SIGTERM"));
+  child.on("exit",code=>process.exit(code??0));
+}
+
+if(command==="--version"||command==="-v"||command==="version"){
+  console.log(VERSION);
+  process.exit(0);
+}
+if(command==="--help"||command==="-h"||command==="help"){
+  printHelp();
+  process.exit(0);
+}
+if(command==="doctor"){
+  await doctor();
+}
+if(command==="setup"){
+  const first=!fs.existsSync(path.join(root,"device.json"));
+  runAgent(["--pair-only"],first);
+} else if(command==="remote"){
+  const first=!fs.existsSync(path.join(root,"device.json"));
+  if(first){
+    console.log("First Reach connection: a pairing code will be created.");
+  }
+  runAgent([],first);
+} else {
+  console.error(`Unknown command: ${command}\n`);
+  printHelp();
+  process.exit(2);
+}

package/dist/agent.js

@@ -0,0 +1,357 @@
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import https from "node:https";
+import { spawn, execFile, spawnSync } from "node:child_process";
+import { promisify } from "node:util";
+import WebSocket from "ws";
+import ExcelJS from "exceljs";
+import { PDFParse } from "pdf-parse";
+import JSZip from "jszip";
+import { PDFDocument, StandardFonts } from "pdf-lib";
+
+const VERSION="0.1.0";
+const PAIR_ONLY=process.argv.includes("--pair-only");
+if(process.argv.includes("--version")){console.log("ExamediX Reach Agent "+VERSION);process.exit(0);}
+if(process.argv.includes("--help")){console.log("ExamediX Reach Agent "+VERSION+"\nUsage: ReachAgent [--version] [--help] [--pair-only] [--root <path>]");process.exit(0);}
+const execFileAsync=promisify(execFile);
+
+function excelValue(v){
+  if(v==null)return "";
+  if(v instanceof Date)return v.toISOString();
+  if(typeof v!=="object")return v;
+  if(Object.prototype.hasOwnProperty.call(v,"result"))return excelValue(v.result);
+  if(Array.isArray(v.richText))return v.richText.map(x=>x.text||"").join("");
+  if(Object.prototype.hasOwnProperty.call(v,"text"))return String(v.text??"");
+  if(Object.prototype.hasOwnProperty.call(v,"hyperlink"))return String(v.text??v.hyperlink??"");
+  if(Object.prototype.hasOwnProperty.call(v,"error"))return String(v.error??"");
+  return JSON.stringify(v);
+}
+function colIndex(s){
+  let n=0;
+  for(const ch of String(s).toUpperCase())n=n*26+(ch.charCodeAt(0)-64);
+  return n-1;
+}
+function sliceA1(rows,range){
+  const m=String(range).trim().match(/^([A-Z]+)(\d+):([A-Z]+)(\d+)$/i);
+  if(!m)throw new Error("Excel range must use A1:D100 format.");
+  const c1=colIndex(m[1]),r1=Number(m[2])-1,c2=colIndex(m[3]),r2=Number(m[4])-1;
+  return rows.slice(r1,r2+1).map(row=>Array.from({length:c2-c1+1},(_,i)=>row[c1+i]??""));
+}
+function decodeXmlText(s){
+  return String(s)
+    .replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&quot;/g,'"')
+    .replace(/&apos;/g,"'").replace(/&amp;/g,"&")
+    .replace(/&#(\d+);/g,(_,n)=>String.fromCodePoint(Number(n)))
+    .replace(/&#x([0-9a-f]+);/gi,(_,n)=>String.fromCodePoint(parseInt(n,16)));
+}
+async function assertReadableFile(filePath,maxBytes,label="file"){
+  const st=await fsp.stat(filePath);
+  if(!st.isFile())throw new Error("Path is not a file.");
+  if(st.size>maxBytes)throw new Error(`${label} exceeds the local Reach safety limit (${Math.ceil(maxBytes/1024/1024)} MB).`);
+  return st;
+}
+async function loadSafeOfficeZip(filePath){
+  await assertReadableFile(filePath,config.maxFileReadBytes,"Office document");
+  const zip=await JSZip.loadAsync(await fsp.readFile(filePath));
+  const entries=Object.values(zip.files);
+  if(entries.length>config.maxOfficeEntries)throw new Error("Office document contains too many ZIP entries.");
+  let total=0;
+  for(const e of entries){
+    const n=Number(e?._data?.uncompressedSize||0);
+    if(Number.isFinite(n)){total+=n;if(total>config.maxOfficeUncompressedBytes)throw new Error("Office document expands beyond the local Reach safety limit.");}
+  }
+  return zip;
+}
+async function extractDocxText(filePath){
+  const zip=await loadSafeOfficeZip(filePath);
+  const entry=zip.file("word/document.xml");
+  if(!entry)throw new Error("Invalid DOCX: word/document.xml is missing.");
+  const docXmlSize=Number(entry?._data?.uncompressedSize||0);
+  if(docXmlSize>config.maxFileReadBytes)throw new Error("DOCX document.xml exceeds the local Reach safety limit.");
+  let xml=await entry.async("string");
+  xml=xml.replace(/<w:tab\b[^>]*\/>/gi,"\t")
+         .replace(/<w:br\b[^>]*\/>/gi,"\n")
+         .replace(/<\/w:tc>/gi,"\t")
+         .replace(/<\/w:tr>/gi,"\n")
+         .replace(/<\/w:p>/gi,"\n")
+         .replace(/<[^>]+>/g,"");
+  return decodeXmlText(xml).replace(/\t+\n/g,"\n").replace(/\n{3,}/g,"\n\n");
+}
+
+const rootIndex=process.argv.indexOf("--root");
+const rootArg=rootIndex>=0&&process.argv[rootIndex+1]?process.argv[rootIndex+1]:"";
+const ROOT=path.resolve(rootArg||process.env.REACH_ROOT||path.join(os.homedir(),".examedix-reach"));
+const DEVICE_FILE=path.join(ROOT,"device.json");
+const CONFIG_FILE=path.join(ROOT,"config.json");
+const DEFAULT_CONFIG={
+  allowedDirectories:[os.homedir()],
+  fileReadLineLimit:1000,
+  fileWriteLineLimit:1000,
+  telemetryEnabled:false,
+  defaultShell:"powershell.exe",
+  allowArbitraryExecution:false,
+  maxFileReadBytes:67108864,
+  maxImageReadBytes:20971520,
+  maxEditFileBytes:33554432,
+  maxSearchFileBytes:268435456,
+  maxOfficeUncompressedBytes:268435456,
+  maxOfficeEntries:10000,
+  blockedCommands:["format","diskpart","bcdedit","cipher","takeown","shutdown","restart-computer","stop-computer","remove-computer","enable-bitlocker","disable-bitlocker","clear-tpm","initialize-disk","clear-disk"],
+  blockedCommandFragments:[".ssh","get-credential","cmdkey","vaultcmd","credentialmanager","get-secret","secretmanagement","get-clipboard","chrome\\user data","edge\\user data","mozilla\\firefox\\profiles",".aws\\credentials",".azure",".kube\\config",".git-credentials"],
+  restrictedDirectories:[".ssh",".gnupg",".aws",".azure",".kube","AppData\\Local\\Google\\Chrome\\User Data","AppData\\Local\\Microsoft\\Edge\\User Data","AppData\\Roaming\\Mozilla\\Firefox\\Profiles"],
+  restrictedFileNames:[".env",".npmrc",".pypirc",".netrc",".git-credentials","credentials","credentials.json","login data","id_rsa","id_ed25519","id_ecdsa","id_dsa"],
+  restrictedExtensions:[".pem",".key",".p12",".pfx",".kdbx"]
+};
+const sessions=new Map(), searches=new Map(), recent=[];
+let config={...DEFAULT_CONFIG};
+
+function loadConfig(){try{config={...DEFAULT_CONFIG,...JSON.parse(fs.readFileSync(CONFIG_FILE,"utf8"))};}catch{config={...DEFAULT_CONFIG};saveConfig();}}
+function saveConfig(){fs.mkdirSync(ROOT,{recursive:true});fs.writeFileSync(CONFIG_FILE,JSON.stringify(config,null,2));}
+loadConfig();
+
+function log(tool,args,result,ok=true){recent.push({ts:new Date().toISOString(),tool,args:JSON.stringify(args??{}).slice(0,500),ok});if(recent.length>200)recent.shift();return result;}
+function abs(p){return path.resolve(String(p));}
+function canonicalPath(p){
+  const requested=abs(p);
+  let cur=requested;
+  const suffix=[];
+  while(!fs.existsSync(cur)){
+    const parent=path.dirname(cur);
+    if(parent===cur)break;
+    suffix.unshift(path.basename(cur));
+    cur=parent;
+  }
+  let real=cur;
+  try{real=fs.realpathSync.native(cur);}catch{}
+  return path.resolve(real,...suffix);
+}
+function allowed(p){
+  const a=canonicalPath(p).toLowerCase(), roots=config.allowedDirectories||[];
+  if(!roots.length)return true;
+  return roots.some(r=>{const rr=canonicalPath(r).toLowerCase();return a===rr||a.startsWith(rr+path.sep.toLowerCase());});
+}
+function restrictedRoots(){return (config.restrictedDirectories||[]).map(p=>canonicalPath(path.join(os.homedir(),p)));}
+function restrictedPath(p){
+  const a=canonicalPath(p),low=a.toLowerCase(),base=path.basename(a).toLowerCase(),ext=path.extname(a).toLowerCase();
+  if(restrictedRoots().some(r=>{const x=r.toLowerCase();return low===x||low.startsWith(x+path.sep.toLowerCase());}))return true;
+  if((config.restrictedFileNames||[]).map(x=>x.toLowerCase()).includes(base))return true;
+  if((config.restrictedExtensions||[]).map(x=>x.toLowerCase()).includes(ext))return true;
+  return false;
+}
+function isAncestorOfRestricted(p){
+  const a=canonicalPath(p).toLowerCase();
+  return restrictedRoots().some(r=>{const x=r.toLowerCase();return x===a||x.startsWith(a+path.sep.toLowerCase());});
+}
+function ensureAllowed(p){if(!allowed(p))throw new Error(`Path not allowed: ${p}`);if(restrictedPath(p))throw new Error("Reach does not access credential stores, private keys, password vaults, or other restricted authentication data.");}
+function blocked(command){
+  const low=String(command).toLowerCase();
+  const exact=(config.blockedCommands||[]).find(x=>new RegExp("(^|[\\s;&|])"+String(x).replace(/[.*+?^$(){}|[\\]\\\\]/g,"\\\\$&")+"([\\s;&|]|$)","i").test(low));
+  if(exact)return exact;
+  const fragment=(config.blockedCommandFragments||[]).find(x=>low.includes(String(x).toLowerCase()));
+  if(fragment)return fragment;
+  if(/(^|[\\s"'\\/=])\.env($|[\\s"'\\/])/i.test(low))return ".env";
+  return null;
+}
+function safeUserCommand(command){
+  const s=String(command||"").trim();
+  return /^whoami(?:\s+\/\w+)?$/i.test(s) ||
+         /^hostname$/i.test(s) ||
+         /^git\s+(status|diff|log|branch|show)(?:\s+[^;&|]*)?$/i.test(s);
+}
+function sliceLines(text,offset=0,length=config.fileReadLineLimit){
+  const lines=text.replace(/\r\n/g,"\n").split("\n");
+  if(offset<0)return lines.slice(Math.max(0,lines.length+offset)).join("\n");
+  return lines.slice(offset,offset+length).join("\n");
+}
+async function powershell(command,timeoutMs=30000,internal=false){
+  if(!internal&&!config.allowArbitraryExecution&&!safeUserCommand(command))return {ok:false,message:"Arbitrary command execution is disabled in the local Reach settings. Only approved diagnostic commands are available."};
+  const denied=blocked(command);
+  if(denied)return {ok:false,message:`Command blocked by ExamediX Reach safety policy: ${denied}`};
+  try{const {stdout,stderr}=await execFileAsync("powershell.exe",["-NoLogo","-NoProfile","-NonInteractive","-Command",command],{windowsHide:true,timeout:Math.min(Math.max(Number(timeoutMs)||30000,1000),120000),maxBuffer:16*1024*1024,encoding:"utf8"});return {ok:true,stdout:stdout??"",stderr:stderr??""};}
+  catch(e){return {ok:false,stdout:e?.stdout??"",stderr:e?.stderr??"",message:e?.message??String(e),code:e?.code??null};}
+}
+function shellArgs(shell,command){
+  const s=(shell||config.defaultShell||"powershell.exe").toLowerCase();
+  if(s.includes("powershell")||s.endsWith("pwsh.exe"))return ["-NoLogo","-NoProfile","-Command",command];
+  if(s.endsWith("cmd.exe")||s==="cmd")return ["/d","/s","/c",command];
+  return ["-lc",command];
+}
+function startProc(command,shell){
+  if(!config.allowArbitraryExecution&&!safeUserCommand(command))throw new Error("Arbitrary process execution is disabled in the local Reach settings. Only approved diagnostic commands are available.");
+  const denied=blocked(command);
+  if(denied)throw new Error(`Command blocked by ExamediX Reach safety policy: ${denied}`);
+  const sh=shell||config.defaultShell||"powershell.exe";
+  const child=spawn(sh,shellArgs(sh,command),{windowsHide:true,stdio:["pipe","pipe","pipe"]});
+  const sess={pid:child.pid,command,shell:sh,started:new Date().toISOString(),lines:[],partial:"",cursor:0,done:false,exitCode:null};
+  const push=buf=>{const text=sess.partial+buf.toString();const parts=text.split(/\r?\n/);sess.partial=parts.pop()??"";sess.lines.push(...parts);if(sess.lines.length>200000){const drop=sess.lines.length-150000;sess.lines.splice(0,drop);sess.cursor=Math.max(0,sess.cursor-drop);}};
+  child.stdout.on("data",push);child.stderr.on("data",push);
+  child.on("exit",code=>{if(sess.partial){sess.lines.push(sess.partial);sess.partial="";}sess.done=true;sess.exitCode=code;});
+  sess.child=child;sessions.set(child.pid,sess);return sess;
+}
+function readSess(sess,offset=0,length=config.fileReadLineLimit){
+  if(sess.partial){/* keep partial until line ends */}
+  let start;
+  if(offset===0){start=sess.cursor;sess.cursor=Math.min(sess.lines.length,start+length);}
+  else if(offset<0)start=Math.max(0,sess.lines.length+offset);
+  else start=offset;
+  const lines=sess.lines.slice(start,start+length);
+  return {pid:sess.pid,output:lines.join("\n"),start,returned:lines.length,total:sess.lines.length,done:sess.done,exitCode:sess.exitCode};
+}
+async function walk(root,fn,includeHidden=false){
+  const stack=[root];
+  while(stack.length){
+    const dir=stack.pop(); let ents=[]; try{ents=await fsp.readdir(dir,{withFileTypes:true});}catch{continue;}
+    for(const e of ents){if(!includeHidden&&e.name.startsWith("."))continue;if(e.isSymbolicLink())continue;const p=path.join(dir,e.name);if(!allowed(p)||restrictedPath(p))continue;if(e.isDirectory())stack.push(p);else if(e.isFile())await fn(p);}
+  }
+}
+function wildcardToRegExp(pat){return new RegExp("^"+pat.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*").replace(/\?/g,".")+"$","i");}
+async function runSearch(s){
+  try{
+    const root=abs(s.path);ensureAllowed(root);
+    const patt=s.literal?null:new RegExp(s.pattern,s.ignoreCase?"i":"");
+    const fileRe=s.filePattern?wildcardToRegExp(s.filePattern):null;
+    await walk(root,async p=>{
+      if(s.stopped||s.results.length>=s.maxResults)return;
+      const name=path.basename(p);
+      if(s.type==="files"){
+        const ok=s.literal?(s.ignoreCase?name.toLowerCase().includes(s.pattern.toLowerCase()):name.includes(s.pattern)):patt.test(name);
+        if(ok)s.results.push({path:p});
+      }else{
+        if(fileRe&&!fileRe.test(name))return;
+        let txt;try{const st=await fsp.stat(p);if(st.size>config.maxSearchFileBytes)return;txt=await fsp.readFile(p,"utf8");}catch{return;}
+        const lines=txt.split(/\r?\n/);
+        for(let i=0;i<lines.length&&s.results.length<s.maxResults;i++){
+          const line=lines[i],ok=s.literal?(s.ignoreCase?line.toLowerCase().includes(s.pattern.toLowerCase()):line.includes(s.pattern)):patt.test(line);
+          if(ok){s.results.push({path:p,line:i+1,text:line.slice(0,1000)});if(s.contextLines){/* compact V1: matching line only */}}
+        }
+      }
+    },s.includeHidden);
+    s.status=s.stopped?"STOPPED":"COMPLETED";
+  }catch(e){s.status="ERROR";s.error=e.message;}
+}
+
+async function dispatch(tool,args={}){
+  try{
+    if(tool==="system_info")return log(tool,args,await powershell("$mem=(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory; $os=[System.Environment]::OSVersion.VersionString; [pscustomobject]@{Computer=$env:COMPUTERNAME;User=$env:USERNAME;Windows=$os;RAM_GB=[math]::Round($mem/1GB,2);PowerShell=$PSVersionTable.PSVersion.ToString();CurrentDirectory=(Get-Location).Path}|ConvertTo-Json -Compress",30000,true));
+    if(tool==="run_powershell")return log(tool,args,await powershell(args.command,args.timeout_ms??30000,false));
+    if(tool==="read_file"){
+      const p=abs(args.path);ensureAllowed(p);const ext=path.extname(p).toLowerCase();const st=await fsp.stat(p);if(!st.isFile())throw new Error("Path is not a file.");
+      if([".png",".jpg",".jpeg",".gif",".webp"].includes(ext)){if(st.size>config.maxImageReadBytes)throw new Error("Image exceeds the local Reach base64 safety limit.");const b=await fsp.readFile(p);return log(tool,args,{ok:true,kind:"base64",mime:ext===".png"?"image/png":"image/"+ext.slice(1),data:b.toString("base64")});}
+      if([".xlsx",".xlsm"].includes(ext)){await loadSafeOfficeZip(p);const wb=new ExcelJS.Workbook();await wb.xlsx.readFile(p);const requested=args.sheet!=null?String(args.sheet):null;const ws=requested==null?wb.worksheets[0]:(/^\d+$/.test(requested)?wb.worksheets[Number(requested)]:wb.getWorksheet(requested));if(!ws)throw new Error("Sheet not found");const sn=ws.name;let arr=[];const cols=Math.max(ws.columnCount,1);ws.eachRow({includeEmpty:true},row=>{const vals=[];for(let c=1;c<=cols;c++)vals.push(excelValue(row.getCell(c).value));arr.push(vals);});if(args.range)arr=sliceA1(arr,args.range);if(args.offset!=null)arr=arr.slice(args.offset,args.offset+(args.length??config.fileReadLineLimit));return log(tool,args,{ok:true,sheet:sn,data:arr});}
+      if(ext===".xls")throw new Error("Legacy .xls is not supported by the secure Reach build. Convert it to .xlsx first.");
+      if(ext===".pdf"){if(st.size>config.maxFileReadBytes)throw new Error("PDF exceeds the local Reach safety limit.");const parser=new PDFParse({data:await fsp.readFile(p)});try{const data=await parser.getText();return log(tool,args,{ok:true,pages:data.total,text:sliceLines(data.text,args.offset??0,args.length??config.fileReadLineLimit)});}finally{await parser.destroy();}}
+      if(ext===".docx"){const text=await extractDocxText(p);return log(tool,args,{ok:true,text:sliceLines(text,args.offset??0,args.length??config.fileReadLineLimit)});}
+      if(st.size>config.maxFileReadBytes)throw new Error("Text file exceeds the local Reach direct-read safety limit; use Search or Power Mode streaming commands for very large files.");const txt=await fsp.readFile(p,"utf8");return log(tool,args,{ok:true,text:sliceLines(txt,args.offset??0,args.length??config.fileReadLineLimit)});
+    }
+    if(tool==="read_multiple_files"){const out=[];for(const p of args.paths||[]){try{out.push({path:p,result:await dispatch("read_file",{path:p})});}catch(e){out.push({path:p,error:e.message});}}return log(tool,args,{ok:true,files:out});}
+    if(tool==="write_file"){
+      const p=abs(args.path);ensureAllowed(p);await fsp.mkdir(path.dirname(p),{recursive:true});const ext=path.extname(p).toLowerCase();
+      if(ext===".xlsx"){const parsed=JSON.parse(args.content);const wb=new ExcelJS.Workbook();if(Array.isArray(parsed)){const ws=wb.addWorksheet("Sheet1");for(const row of parsed)ws.addRow(Array.isArray(row)?row:[row]);}else{for(const [name,rows] of Object.entries(parsed)){const ws=wb.addWorksheet(String(name).slice(0,31)||"Sheet");for(const row of rows)ws.addRow(Array.isArray(row)?row:[row]);}}await wb.xlsx.writeFile(p);return log(tool,args,{ok:true,path:p});}
+      if(ext===".xls"||ext===".xlsm")throw new Error("Reach writes .xlsx only; .xls/.xlsm rewriting is disabled to avoid format or macro loss.");
+      if(args.mode==="append")await fsp.appendFile(p,args.content,"utf8");else await fsp.writeFile(p,args.content,"utf8");return log(tool,args,{ok:true,path:p,bytes:Buffer.byteLength(args.content)});
+    }
+    if(tool==="write_pdf"){
+      const src=abs(args.path),out=abs(args.outputPath||args.path);ensureAllowed(src);ensureAllowed(out);await fsp.mkdir(path.dirname(out),{recursive:true});let doc;
+      if(Array.isArray(args.content)){
+        const st=await fsp.stat(src).catch(()=>null);if(!st)throw new Error("Source PDF not found");doc=await PDFDocument.load(await fsp.readFile(src));
+        for(const op of args.content){
+          if(op.type==="delete"){for(const idx of [...op.pageIndexes].sort((a,b)=>b-a))if(idx>=0&&idx<doc.getPageCount())doc.removePage(idx);}
+          else if(op.type==="insert"){
+            if(op.sourcePdfPath){const sp=abs(op.sourcePdfPath);ensureAllowed(sp);const sd=await PDFDocument.load(await fsp.readFile(sp));const pages=await doc.copyPages(sd,sd.getPageIndices());let at=Math.max(0,Math.min(op.pageIndex,doc.getPageCount()));for(const pg of pages)doc.insertPage(at++,pg);}
+            else{const font=await doc.embedFont(StandardFonts.Helvetica);const page=doc.insertPage(Math.max(0,Math.min(op.pageIndex,doc.getPageCount())));const txt=String(op.markdown||"").replace(/[#*_>-]/g,"");const lines=txt.match(/.{1,90}(?:\s|$)/g)||[""];let y=page.getHeight()-50;for(const line of lines){if(y<40)break;page.drawText(line.trim(),{x:50,y,size:11,font});y-=16;}}
+          }
+        }
+      }else{
+        doc=await PDFDocument.create();const font=await doc.embedFont(StandardFonts.Helvetica);const txt=String(args.content||"").replace(/[#*_>-]/g,"");const lines=txt.match(/.{1,90}(?:\s|$)/g)||[""];let page=doc.addPage(),y=page.getHeight()-50;for(const line of lines){if(y<40){page=doc.addPage();y=page.getHeight()-50;}page.drawText(line.trim(),{x:50,y,size:11,font});y-=16;}
+      }
+      await fsp.writeFile(out,await doc.save());return log(tool,args,{ok:true,path:out,pages:doc.getPageCount()});
+    }
+    if(tool==="create_directory"){const p=abs(args.path);ensureAllowed(p);await fsp.mkdir(p,{recursive:true});return log(tool,args,{ok:true,path:p});}
+    if(tool==="move_file"){const s=abs(args.source),d=abs(args.destination);ensureAllowed(s);ensureAllowed(d);const st=await fsp.stat(s);if(st.isDirectory()&&isAncestorOfRestricted(s))throw new Error("Reach will not move a directory that contains restricted authentication data.");await fsp.mkdir(path.dirname(d),{recursive:true});await fsp.rename(s,d);return log(tool,args,{ok:true,source:s,destination:d});}
+    if(tool==="copy_file"){const s=abs(args.source),d=abs(args.destination);ensureAllowed(s);ensureAllowed(d);const st=await fsp.stat(s);if(st.isDirectory()&&isAncestorOfRestricted(s))throw new Error("Reach will not recursively copy a directory that contains restricted authentication data.");await fsp.mkdir(path.dirname(d),{recursive:true});await fsp.cp(s,d,{recursive:true,force:!!args.overwrite});return log(tool,args,{ok:true,source:s,destination:d});}
+    if(tool==="delete_file"){const p=abs(args.path);ensureAllowed(p);const st=await fsp.stat(p).catch(()=>null);if(st?.isDirectory()&&isAncestorOfRestricted(p))throw new Error("Reach will not delete a directory that contains restricted authentication data.");await fsp.rm(p,{recursive:true,force:!!args.force});return log(tool,args,{ok:true,path:p});}
+    if(tool==="list_directory"){const root=abs(args.path);ensureAllowed(root);const depth=Math.max(1,Math.min(args.depth??2,20));const rows=[];async function rec(dir,d){let ents=await fsp.readdir(dir,{withFileTypes:true});for(const e of ents){if(e.isSymbolicLink())continue;const p=path.join(dir,e.name);if(!allowed(p)||restrictedPath(p))continue;rows.push({type:e.isDirectory()?"dir":"file",path:path.relative(root,p)||".",fullPath:p});if(e.isDirectory()&&d<depth)await rec(p,d+1);}}await rec(root,1);return log(tool,args,{ok:true,root,items:rows});}
+    if(tool==="get_file_info"){const p=abs(args.path);ensureAllowed(p);const st=await fsp.stat(p);const out={path:p,size:st.size,created:st.birthtime.toISOString(),modified:st.mtime.toISOString(),isDirectory:st.isDirectory(),isFile:st.isFile()};if(st.isFile()&&st.size<50*1024*1024){try{const t=await fsp.readFile(p,"utf8");out.lineCount=t.split(/\r?\n/).length;}catch{}}return log(tool,args,{ok:true,info:out});}
+    if(tool==="edit_block"){const p=abs(args.file_path);ensureAllowed(p);const ext=path.extname(p).toLowerCase();if([".docx",".xlsx",".xls",".xlsm",".pdf"].includes(ext))throw new Error("Binary Office/PDF files require their dedicated read/write tools; generic edit_block is disabled to prevent corruption.");const st=await fsp.stat(p);if(st.size>config.maxEditFileBytes)throw new Error("Text file exceeds the local Reach edit safety limit.");let txt=await fsp.readFile(p,"utf8");const old=String(args.old_string),neu=String(args.new_string);let count=0,pos=0;while((pos=txt.indexOf(old,pos))!==-1){count++;pos+=old.length;}const exp=args.expected_replacements??1;if(count!==exp)throw new Error(`Expected ${exp} replacements, found ${count}`);txt=txt.split(old).join(neu);await fsp.writeFile(p,txt,"utf8");return log(tool,args,{ok:true,replacements:count,path:p});}
+    if(tool==="start_process"){const s=startProc(args.command,args.shell);return log(tool,args,{ok:true,pid:s.pid,status:"RUNNING",command:s.command,shell:s.shell});}
+    if(tool==="read_process_output"){const s=sessions.get(Number(args.pid));if(!s)throw new Error("Session not found");return log(tool,args,{ok:true,...readSess(s,args.offset??0,args.length??config.fileReadLineLimit)});}
+    if(tool==="interact_with_process"){const s=sessions.get(Number(args.pid));if(!s)throw new Error("Session not found");s.child.stdin.write(String(args.input)+(String(args.input).endsWith("\n")?"":"\n"));await new Promise(r=>setTimeout(r,Math.min(args.timeout_ms??500,3000)));return log(tool,args,{ok:true,...readSess(s,0,args.length??config.fileReadLineLimit)});}
+    if(tool==="force_terminate"){const s=sessions.get(Number(args.pid));if(s&&!s.done)s.child.kill("SIGKILL");return log(tool,args,{ok:true,pid:Number(args.pid)});}
+    if(tool==="list_sessions")return log(tool,args,{ok:true,sessions:[...sessions.values()].map(s=>({pid:s.pid,command:s.command,shell:s.shell,started:s.started,done:s.done,exitCode:s.exitCode,lines:s.lines.length}))});
+    if(tool==="list_processes"){const r=await powershell("Get-Process | Select-Object Id,ProcessName,CPU,WorkingSet64,Path | ConvertTo-Json -Depth 2 -Compress",30000,true);return log(tool,args,r);}
+    if(tool==="kill_process"){const r=await powershell(`Stop-Process -Id ${Number(args.pid)} -Force -ErrorAction Stop; 'OK'`,30000,true);return log(tool,args,r);}
+    if(tool==="start_search"){const id="search_"+crypto.randomUUID();const s={id,path:args.path,pattern:args.pattern,type:args.searchType??"files",filePattern:args.filePattern,ignoreCase:args.ignoreCase!==false,literal:!!args.literalSearch,includeHidden:!!args.includeHidden,contextLines:args.contextLines??0,maxResults:Math.min(args.maxResults??1000,100000),results:[],status:"RUNNING",stopped:false,created:new Date().toISOString()};searches.set(id,s);runSearch(s);return log(tool,args,{ok:true,sessionId:id,status:s.status});}
+    if(tool==="get_more_search_results"){const s=searches.get(args.sessionId);if(!s)throw new Error("Search not found");const off=args.offset??0,len=args.length??100;const start=off<0?Math.max(0,s.results.length+off):off;return log(tool,args,{ok:true,status:s.status,error:s.error??null,total:s.results.length,results:s.results.slice(start,start+len)});}
+    if(tool==="stop_search"){const s=searches.get(args.sessionId);if(!s)throw new Error("Search not found");s.stopped=true;s.status="STOPPING";return log(tool,args,{ok:true,sessionId:s.id});}
+    if(tool==="list_searches")return log(tool,args,{ok:true,searches:[...searches.values()].map(s=>({id:s.id,status:s.status,path:s.path,pattern:s.pattern,type:s.type,total:s.results.length,created:s.created}))});
+
+    throw new Error(`Unknown tool: ${tool}`);
+  }catch(e){return log(tool,args,{ok:false,message:e?.message??String(e)},false);}
+}
+
+function postJson(url,obj){
+  return new Promise((resolve,reject)=>{
+    const u=new URL(url),data=Buffer.from(JSON.stringify(obj));
+    const r=https.request({hostname:u.hostname,port:443,path:u.pathname+u.search,method:"POST",headers:{"content-type":"application/json","content-length":data.length}},res=>{
+      const chunks=[];res.on("data",c=>chunks.push(c));res.on("end",()=>{try{const x=JSON.parse(Buffer.concat(chunks).toString("utf8"));if(res.statusCode>=200&&res.statusCode<300)resolve(x);else reject(new Error(x.error||("HTTP "+res.statusCode)));}catch(e){reject(e);}});
+    });r.on("error",reject);r.write(data);r.end();
+  });
+}
+function dpapiProtect(secret){
+  const script="Add-Type -AssemblyName System.Security;$s=[Console]::In.ReadToEnd();$b=[Text.Encoding]::UTF8.GetBytes($s);$e=[System.Security.Cryptography.ProtectedData]::Protect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Convert]::ToBase64String($e)";
+  const r=spawnSync("powershell.exe",["-NoLogo","-NoProfile","-NonInteractive","-Command",script],{input:String(secret),encoding:"utf8",windowsHide:true,maxBuffer:1024*1024});
+  if(r.status!==0)throw new Error("Could not protect local device credential with Windows DPAPI.");
+  return String(r.stdout).trim();
+}
+function dpapiUnprotect(ciphertext){
+  const script="Add-Type -AssemblyName System.Security;$s=[Console]::In.ReadToEnd();$e=[Convert]::FromBase64String($s.Trim());$b=[System.Security.Cryptography.ProtectedData]::Unprotect($e,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Text.Encoding]::UTF8.GetString($b)";
+  const r=spawnSync("powershell.exe",["-NoLogo","-NoProfile","-NonInteractive","-Command",script],{input:String(ciphertext),encoding:"utf8",windowsHide:true,maxBuffer:1024*1024});
+  if(r.status!==0)throw new Error("Could not decrypt the local Reach device credential for this Windows user.");
+  return String(r.stdout).trim();
+}
+function persistDevice(d){
+  const stored={...d};
+  delete stored.agent_token;
+  fs.writeFileSync(DEVICE_FILE,JSON.stringify(stored,null,2));
+}
+async function loadOrCreateDevice(){
+  if(fs.existsSync(DEVICE_FILE)){
+    let d;
+    try{d=JSON.parse(fs.readFileSync(DEVICE_FILE,"utf8"));}catch{throw new Error("Reach device identity file is invalid JSON.");}
+    if(d.agent_token_dpapi){
+      return {...d,agent_token:dpapiUnprotect(d.agent_token_dpapi)};
+    }
+    if(d.agent_token){
+      const token=d.agent_token;
+      const migrated={...d,agent_token_dpapi:dpapiProtect(token)};
+      delete migrated.agent_token;
+      persistDevice(migrated);
+      return {...migrated,agent_token:token};
+    }
+    throw new Error("Reach device identity is missing its local device credential.");
+  }
+  const agent_token=crypto.randomBytes(48).toString("base64url");
+  const pair=await postJson("https://examedix.ch/reach/api/agent/pair/start",{name:process.env.REACH_DEVICE_NAME||os.hostname(),platform:"Windows "+os.release(),version:VERSION,agent_token});
+  const d={device_id:pair.device_id,agent_token_dpapi:dpapiProtect(agent_token),pairing_code:pair.pairing_code,pairing_expires_at:Date.now()+pair.expires_in*1000};
+  persistDevice(d);
+  console.log("PAIRING CODE:",pair.pairing_code);
+  return {...d,agent_token};
+}
+const device=await loadOrCreateDevice();
+console.log("ExamediX Reach device:",device.device_id);
+if(device.pairing_code&&device.pairing_expires_at>Date.now())console.log("PAIRING CODE:",device.pairing_code);
+if(PAIR_ONLY)process.exit(0);
+
+let retry=1000;
+function connect(){
+  const url="wss://examedix.ch/reach/agent?device_id="+encodeURIComponent(device.device_id);
+  const ws=new WebSocket(url,{headers:{Authorization:"Bearer "+device.agent_token,"X-Reach-Agent-Version":VERSION},handshakeTimeout:15000});
+  ws.on("open",()=>{retry=1000;console.log("ExamediX Reach agent connected");});
+  ws.on("message",async data=>{let msg;try{msg=JSON.parse(data.toString());}catch{return;}if(!msg?.id||!msg?.tool)return;const result=await dispatch(msg.tool,msg.args||{});if(ws.readyState===WebSocket.OPEN)ws.send(JSON.stringify({id:msg.id,result}));});
+  ws.on("close",()=>{setTimeout(connect,retry);retry=Math.min(retry*2,30000);});
+  ws.on("error",e=>console.error("ExamediX Reach connection:",e.message));
+}
+connect();

package/package.json

@@ -1,6 +1,58 @@
-{
-  "name": "examedix-reach",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "examedix-reach",
+  "version": "0.1.0",
+  "description": "Securely connect ChatGPT to Windows computers you own or are authorized to administer.",
+  "type": "module",
+  "license": "UNLICENSED",
+  "author": "ExamediX Technologies",
+  "homepage": "https://examedix.ch/reach",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/examedix/examedix-reach.git"
+  },
+  "bugs": {
+    "url": "https://examedix.ch/reach/support"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "bin": {
+    "examedix-reach": "bin/reach.js",
+    "reach": "bin/reach.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "README.md",
+    "THIRD-PARTY-NOTICES.txt",
+    "DISCLOSURE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "chatgpt",
+    "mcp",
+    "windows",
+    "remote-work",
+    "file-system",
+    "process-management",
+    "workstation"
+  ],
+  "dependencies": {
+    "exceljs": "^4.4.0",
+    "jszip": "^3.10.1",
+    "pdf-lib": "^1.17.1",
+    "pdf-parse": "2.4.5",
+    "ws": "^8.18.3"
+  },
+  "overrides": {
+    "uuid": "11.1.1"
+  },
+  "os": [
+    "win32"
+  ],
+  "contentPolicy": {
+    "class": "dual-use"
+  }
+}