examedix-reach 0.0.0-stage → 0.1.1

package/DISCLOSURE

@@ -0,0 +1,26 @@
+ExamediX Reach is a legitimate remote-workstation integration for computers that the user owns or is explicitly authorized to administer.
+
+The package can connect an authorized Windows computer to the ExamediX Reach service and expose user-approved workstation capabilities such as:
+- listing, reading, creating, editing, moving, copying and deleting authorized files;
+- searching authorized folders;
+- reading and writing supported document formats;
+- inspecting and managing processes;
+- starting and interacting with user-level processes;
+- running user-level PowerShell when the local user has explicitly enabled Reach Power Mode.
+
+These capabilities are dual-use because file, process and shell operations can resemble capabilities found in remote-administration or security tools. Reach is intended only for legitimate administration of the user's own or otherwise authorized computers.
+
+Reach includes security controls including:
+- explicit device pairing and account ownership checks;
+- OAuth-scoped access;
+- outbound-only TLS connections from the Windows agent;
+- no inbound workstation listener;
+- local filesystem boundaries;
+- blocking of credential stores, private keys and common secret files;
+- Power Mode disabled by default unless explicitly authorized in a local Windows consent dialog;
+- audit metadata with sensitive values redacted;
+- Windows DPAPI protection for the local device credential.
+
+Unauthorized access, credential theft, covert surveillance, malware deployment, destructive misuse, or bypassing security controls is prohibited by the Reach Terms of Service.
+
+Explicit local consent is collected before pairing/agent startup, stored on the computer, and may be changed with the power-mode command. A missing or inconsistent consent record fails closed. Power Mode runs with the permissions of the logged-in Windows user and is not a security sandbox.

package/README.md

@@ -1,3 +1,38 @@
-# Temporary Holding Version
+# ExamediX Reach
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+ExamediX Reach connects ChatGPT to Windows computers you own or are authorized to administer.
+
+## Quick start
+
+Requires Windows 10/11 and Node.js 20 or newer.
+
+```powershell
+npx --yes examedix-reach@latest remote
+```
+
+On the first run, Reach asks for **explicit local permission** to enable Power Mode, **before** starting the agent and pairing the computer. **No** is selected by default. Choose **No** for restricted operation, or **Yes** if you knowingly want ChatGPT to run PowerShell and Windows programs with your Windows user permissions. These commands may change or delete files, install software and use network services. Power Mode is not a sandbox.
+
+Reach then displays a pairing code and opens the account page. Sign in or create an account, pair your computer, and keep the agent process running while you need access through ChatGPT.
+
+## Change Power Mode permission
+
+```powershell
+npx --yes examedix-reach@latest power-mode
+```
+
+This shows the local consent dialog again. After changing permission, **stop and restart the running Reach agent**.
+
+The choice is stored locally in `%LOCALAPPDATA%\ExamediX\ReachData` and is reused on future starts when its consent record and agent configuration agree. A missing or inconsistent record never silently enables Power Mode.
+
+Additional commands:
+
+```powershell
+npx examedix-reach@latest setup
+npx examedix-reach@latest doctor
+npx examedix-reach@latest --version
+```
+
+Reach uses an outbound TLS connection; no inbound Windows port is required.
+
+Security and privacy: https://examedix.ch/reach/security  
+Support: https://examedix.ch/reach/support

package/THIRD-PARTY-NOTICES.txt

@@ -0,0 +1,17 @@
+ExamediX Reach third-party notices
+
+This distribution includes the Node.js runtime and open-source JavaScript dependencies.
+Node.js is distributed under its project license; the complete Node license file is included as runtime/NODE-LICENSE.txt.
+
+Direct runtime dependencies:
+- ws 8.x — MIT
+- exceljs 4.4.0 — MIT
+- jszip 3.x — MIT OR GPL-3.0-or-later
+- pdf-parse 2.4.5 — MIT
+- pdf-lib 1.17.1 — MIT
+
+Security-pinned transitive dependency:
+- uuid 11.1.1 — MIT (forced through npm overrides to avoid older-version security advisories)
+
+Transitive dependencies remain subject to their respective license terms included in the distributed node_modules packages.
+ExamediX Reach does not claim ownership of third-party open-source components.

package/bin/reach.js

@@ -0,0 +1,259 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import readline from "node:readline/promises";
+
+// Keep this version in sync with package.json before publishing.
+const VERSION = "0.1.1";
+const here = path.dirname(fileURLToPath(import.meta.url));
+const agent = path.resolve(here, "..", "dist", "agent.js");
+const command = (process.argv[2] || "remote").toLowerCase();
+const root = process.env.REACH_ROOT || (
+  process.platform === "win32" && process.env.LOCALAPPDATA
+    ? path.join(process.env.LOCALAPPDATA, "ExamediX", "ReachData")
+    : path.join(os.homedir(), ".examedix-reach")
+);
+const configFile = path.join(root, "config.json");
+const consentFile = path.join(root, "power-mode-consent.json");
+
+function openBrowser(url) {
+  try {
+    if (process.platform === "win32") {
+      const p = spawn("cmd.exe", ["/d", "/c", "start", "", url], {
+        detached: true, stdio: "ignore", windowsHide: true
+      });
+      p.unref();
+    } else if (process.platform === "darwin") {
+      const p = spawn("open", [url], { detached: true, stdio: "ignore" });
+      p.unref();
+    } else {
+      const p = spawn("xdg-open", [url], { detached: true, stdio: "ignore" });
+      p.unref();
+    }
+  } catch {}
+}
+
+function printHelp() {
+  console.log(`ExamediX Reach ${VERSION}
+
+Usage:
+  examedix-reach remote       Connect this computer to Reach (default)
+  examedix-reach setup        Create/show a pairing code, then exit
+  examedix-reach power-mode   Review or change local Power Mode permission
+  examedix-reach doctor       Check local prerequisites and Reach service
+  examedix-reach --version    Show version
+
+Examples:
+  npx examedix-reach@latest remote
+  npx examedix-reach@latest power-mode
+
+Local data:
+  ${root}
+
+Reach:
+  https://examedix.ch/reach
+`);
+}
+
+async function doctor() {
+  const result = {};
+  result.node = process.version;
+  result.platform = `${process.platform} ${os.release()}`;
+  result.root = root;
+  result.deviceFile = fs.existsSync(path.join(root, "device.json"));
+  result.agentFile = fs.existsSync(agent);
+  try {
+    const r = await fetch("https://examedix.ch/reach/health", {
+      signal: AbortSignal.timeout(10000)
+    });
+    result.service = r.ok ? "online" : `http-${r.status}`;
+  } catch (e) {
+    result.service = "unreachable";
+    result.error = e.message;
+  }
+  console.log(JSON.stringify(result, null, 2));
+  process.exit(result.agentFile && result.service === "online" ? 0 : 1);
+}
+
+function windowsOnly() {
+  if (process.platform !== "win32") {
+    throw new Error("ExamediX Reach currently supports Windows only.");
+  }
+}
+
+function readObject(file) {
+  if (!fs.existsSync(file)) return {};
+  const obj = JSON.parse(fs.readFileSync(file, "utf8"));
+  if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
+    throw new Error(`Invalid JSON object in ${file}; refusing to overwrite it.`);
+  }
+  return obj;
+}
+
+// Atomic replace to avoid a truncated configuration on interrupted writes.
+function atomicWriteJson(file, data) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(tmp, `${JSON.stringify(data, null, 2)}\n`, {
+      encoding: "utf8", flag: "wx", mode: 0o600
+    });
+    fs.renameSync(tmp, file);
+  } catch (err) {
+    try { fs.unlinkSync(tmp); } catch {}
+    throw err;
+  }
+}
+
+function readPriorConsent() {
+  const record = readObject(consentFile);
+  return typeof record.enabled === "boolean" ? record.enabled : null;
+}
+
+function setPowerMode(enabled, recordConsent = true) {
+  // Preserve all other agent settings rather than replacing config.json.
+  const cfg = readObject(configFile);
+  cfg.allowArbitraryExecution = enabled;
+  atomicWriteJson(configFile, cfg);
+  if (recordConsent) {
+    atomicWriteJson(consentFile, {
+      enabled,
+      recordedAt: new Date().toISOString(),
+      source: "examedix-reach-cli-explicit-local-consent"
+    });
+  }
+}
+
+// Exit code 10 means the person clicked Yes; 20 means No.
+// Other exit statuses mean the Windows dialog could not be shown.
+function askWindowsDialog() {
+  const script = String.raw`
+Add-Type -AssemblyName System.Windows.Forms
+$body = 'Power Mode lets ChatGPT, through ExamediX Reach, run Windows programs and PowerShell commands using your Windows account permissions.' + [Environment]::NewLine + [Environment]::NewLine + 'Commands may change or delete files, install software, and access network services.' + [Environment]::NewLine + [Environment]::NewLine + 'Enable Power Mode on this computer?' + [Environment]::NewLine + [Environment]::NewLine + 'Choose No for the safer restricted mode. You can change your choice later.'
+$result = [System.Windows.Forms.MessageBox]::Show($body, 'ExamediX Reach - Power Mode', [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Warning, [System.Windows.Forms.MessageBoxDefaultButton]::Button2)
+if ($result -eq [System.Windows.Forms.DialogResult]::Yes) { exit 10 }
+if ($result -eq [System.Windows.Forms.DialogResult]::No) { exit 20 }
+exit 1
+`;
+  const run = spawnSync("powershell.exe", [
+    "-NoProfile", "-STA", "-NonInteractive", "-Command", script
+  ], { encoding: "utf8", windowsHide: true, timeout: 300000 });
+  if (run.status === 10) return true;
+  if (run.status === 20) return false;
+  if (run.error) console.error(`Windows consent dialog unavailable: ${run.error.message}`);
+  if (run.stderr && run.stderr.trim()) console.error(run.stderr.trim());
+  return null;
+}
+
+async function askTerminalFallback() {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return null;
+  console.log("\nExamediX Reach - Power Mode");
+  console.log("Enabling Power Mode allows ChatGPT to run programs and PowerShell commands with your Windows permissions.");
+  console.log("Commands may change/delete files or use the network. Default: No.");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await rl.question("Enable Power Mode? [y/N]: ");
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+
+async function askConsent() {
+  const choice = askWindowsDialog();
+  if (choice !== null) return choice;
+  return askTerminalFallback();
+}
+
+async function ensurePowerModeChoice(force = false) {
+  windowsOnly();
+  fs.mkdirSync(root, { recursive: true });
+  const prior = readPriorConsent();
+  const cfg = readObject(configFile);
+
+  if (!force && prior !== null && cfg.allowArbitraryExecution === prior) {
+    console.log(`ExamediX Reach Power Mode: ${prior ? "ON" : "OFF"} (saved choice)`);
+    return;
+  }
+
+  // Fail closed whenever we lack a valid, matching record of explicit consent.
+  if (prior === null || cfg.allowArbitraryExecution !== prior) {
+    setPowerMode(false, false);
+  }
+
+  const selected = await askConsent();
+  if (selected === null) {
+    setPowerMode(false, false);
+    console.log("Power Mode OFF. Consent dialog unavailable; run in an interactive Windows session to select Power Mode.");
+    return;
+  }
+
+  setPowerMode(selected, true);
+  console.log(`ExamediX Reach Power Mode: ${selected ? "ON (authorized locally)" : "OFF (restricted mode)"}`);
+}
+
+function runAgent(args, openOnPair = false) {
+  windowsOnly();
+  fs.mkdirSync(root, { recursive: true });
+  const child = spawn(process.execPath, [agent, "--root", root, ...args], {
+    stdio: ["inherit", "pipe", "pipe"],
+    windowsHide: false
+  });
+  let opened = false;
+  child.stdout.on("data", buf => {
+    const text = buf.toString();
+    process.stdout.write(text);
+    if (openOnPair && !opened && text.includes("PAIRING CODE:")) {
+      opened = true;
+      console.log("\nOpening ExamediX Reach account/pairing page...");
+      openBrowser("https://examedix.ch/reach/signup");
+    }
+  });
+  child.stderr.on("data", buf => process.stderr.write(buf));
+  child.on("error", err => { console.error(`Could not start Reach agent: ${err.message}`); process.exitCode = 1; });
+  const forward = sig => { try { child.kill(sig); } catch {} };
+  process.on("SIGINT", () => forward("SIGINT"));
+  process.on("SIGTERM", () => forward("SIGTERM"));
+  child.on("exit", code => process.exit(code ?? 0));
+}
+
+async function main() {
+  if (command === "--version" || command === "-v" || command === "version") {
+    console.log(VERSION);
+    return;
+  }
+  if (command === "--help" || command === "-h" || command === "help") {
+    printHelp();
+    return;
+  }
+  if (command === "doctor") {
+    await doctor();
+    return;
+  }
+  if (command === "power-mode") {
+    await ensurePowerModeChoice(true);
+    console.log("Restart a running Reach agent to apply the new permission.");
+    return;
+  }
+  if (command === "setup" || command === "remote") {
+    // The approval must happen before the agent starts and before pairing.
+    await ensurePowerModeChoice();
+    const first = !fs.existsSync(path.join(root, "device.json"));
+    if (command === "remote" && first) {
+      console.log("First Reach connection: a pairing code will be created.");
+    }
+    runAgent(command === "setup" ? ["--pair-only"] : [], first);
+    return;
+  }
+  console.error(`Unknown command: ${command}\n`);
+  printHelp();
+  process.exitCode = 2;
+}
+
+main().catch(err => {
+  console.error(`ExamediX Reach: ${err.message}`);
+  process.exitCode = 1;
+});

package/dist/agent.js

@@ -0,0 +1,357 @@
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import https from "node:https";
+import { spawn, execFile, spawnSync } from "node:child_process";
+import { promisify } from "node:util";
+import WebSocket from "ws";
+import ExcelJS from "exceljs";
+import { PDFParse } from "pdf-parse";
+import JSZip from "jszip";
+import { PDFDocument, StandardFonts } from "pdf-lib";
+
+const VERSION="0.1.0";
+const PAIR_ONLY=process.argv.includes("--pair-only");
+if(process.argv.includes("--version")){console.log("ExamediX Reach Agent "+VERSION);process.exit(0);}
+if(process.argv.includes("--help")){console.log("ExamediX Reach Agent "+VERSION+"\nUsage: ReachAgent [--version] [--help] [--pair-only] [--root <path>]");process.exit(0);}
+const execFileAsync=promisify(execFile);
+
+function excelValue(v){
+  if(v==null)return "";
+  if(v instanceof Date)return v.toISOString();
+  if(typeof v!=="object")return v;
+  if(Object.prototype.hasOwnProperty.call(v,"result"))return excelValue(v.result);
+  if(Array.isArray(v.richText))return v.richText.map(x=>x.text||"").join("");
+  if(Object.prototype.hasOwnProperty.call(v,"text"))return String(v.text??"");
+  if(Object.prototype.hasOwnProperty.call(v,"hyperlink"))return String(v.text??v.hyperlink??"");
+  if(Object.prototype.hasOwnProperty.call(v,"error"))return String(v.error??"");
+  return JSON.stringify(v);
+}
+function colIndex(s){
+  let n=0;
+  for(const ch of String(s).toUpperCase())n=n*26+(ch.charCodeAt(0)-64);
+  return n-1;
+}
+function sliceA1(rows,range){
+  const m=String(range).trim().match(/^([A-Z]+)(\d+):([A-Z]+)(\d+)$/i);
+  if(!m)throw new Error("Excel range must use A1:D100 format.");
+  const c1=colIndex(m[1]),r1=Number(m[2])-1,c2=colIndex(m[3]),r2=Number(m[4])-1;
+  return rows.slice(r1,r2+1).map(row=>Array.from({length:c2-c1+1},(_,i)=>row[c1+i]??""));
+}
+function decodeXmlText(s){
+  return String(s)
+    .replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&quot;/g,'"')
+    .replace(/&apos;/g,"'").replace(/&amp;/g,"&")
+    .replace(/&#(\d+);/g,(_,n)=>String.fromCodePoint(Number(n)))
+    .replace(/&#x([0-9a-f]+);/gi,(_,n)=>String.fromCodePoint(parseInt(n,16)));
+}
+async function assertReadableFile(filePath,maxBytes,label="file"){
+  const st=await fsp.stat(filePath);
+  if(!st.isFile())throw new Error("Path is not a file.");
+  if(st.size>maxBytes)throw new Error(`${label} exceeds the local Reach safety limit (${Math.ceil(maxBytes/1024/1024)} MB).`);
+  return st;
+}
+async function loadSafeOfficeZip(filePath){
+  await assertReadableFile(filePath,config.maxFileReadBytes,"Office document");
+  const zip=await JSZip.loadAsync(await fsp.readFile(filePath));
+  const entries=Object.values(zip.files);
+  if(entries.length>config.maxOfficeEntries)throw new Error("Office document contains too many ZIP entries.");
+  let total=0;
+  for(const e of entries){
+    const n=Number(e?._data?.uncompressedSize||0);
+    if(Number.isFinite(n)){total+=n;if(total>config.maxOfficeUncompressedBytes)throw new Error("Office document expands beyond the local Reach safety limit.");}
+  }
+  return zip;
+}
+async function extractDocxText(filePath){
+  const zip=await loadSafeOfficeZip(filePath);
+  const entry=zip.file("word/document.xml");
+  if(!entry)throw new Error("Invalid DOCX: word/document.xml is missing.");
+  const docXmlSize=Number(entry?._data?.uncompressedSize||0);
+  if(docXmlSize>config.maxFileReadBytes)throw new Error("DOCX document.xml exceeds the local Reach safety limit.");
+  let xml=await entry.async("string");
+  xml=xml.replace(/<w:tab\b[^>]*\/>/gi,"\t")
+         .replace(/<w:br\b[^>]*\/>/gi,"\n")
+         .replace(/<\/w:tc>/gi,"\t")
+         .replace(/<\/w:tr>/gi,"\n")
+         .replace(/<\/w:p>/gi,"\n")
+         .replace(/<[^>]+>/g,"");
+  return decodeXmlText(xml).replace(/\t+\n/g,"\n").replace(/\n{3,}/g,"\n\n");
+}
+
+const rootIndex=process.argv.indexOf("--root");
+const rootArg=rootIndex>=0&&process.argv[rootIndex+1]?process.argv[rootIndex+1]:"";
+const ROOT=path.resolve(rootArg||process.env.REACH_ROOT||path.join(os.homedir(),".examedix-reach"));
+const DEVICE_FILE=path.join(ROOT,"device.json");
+const CONFIG_FILE=path.join(ROOT,"config.json");
+const DEFAULT_CONFIG={
+  allowedDirectories:[os.homedir()],
+  fileReadLineLimit:1000,
+  fileWriteLineLimit:1000,
+  telemetryEnabled:false,
+  defaultShell:"powershell.exe",
+  allowArbitraryExecution:false,
+  maxFileReadBytes:67108864,
+  maxImageReadBytes:20971520,
+  maxEditFileBytes:33554432,
+  maxSearchFileBytes:268435456,
+  maxOfficeUncompressedBytes:268435456,
+  maxOfficeEntries:10000,
+  blockedCommands:["format","diskpart","bcdedit","cipher","takeown","shutdown","restart-computer","stop-computer","remove-computer","enable-bitlocker","disable-bitlocker","clear-tpm","initialize-disk","clear-disk"],
+  blockedCommandFragments:[".ssh","get-credential","cmdkey","vaultcmd","credentialmanager","get-secret","secretmanagement","get-clipboard","chrome\\user data","edge\\user data","mozilla\\firefox\\profiles",".aws\\credentials",".azure",".kube\\config",".git-credentials"],
+  restrictedDirectories:[".ssh",".gnupg",".aws",".azure",".kube","AppData\\Local\\Google\\Chrome\\User Data","AppData\\Local\\Microsoft\\Edge\\User Data","AppData\\Roaming\\Mozilla\\Firefox\\Profiles"],
+  restrictedFileNames:[".env",".npmrc",".pypirc",".netrc",".git-credentials","credentials","credentials.json","login data","id_rsa","id_ed25519","id_ecdsa","id_dsa"],
+  restrictedExtensions:[".pem",".key",".p12",".pfx",".kdbx"]
+};
+const sessions=new Map(), searches=new Map(), recent=[];
+let config={...DEFAULT_CONFIG};
+
+function loadConfig(){try{config={...DEFAULT_CONFIG,...JSON.parse(fs.readFileSync(CONFIG_FILE,"utf8"))};}catch{config={...DEFAULT_CONFIG};saveConfig();}}
+function saveConfig(){fs.mkdirSync(ROOT,{recursive:true});fs.writeFileSync(CONFIG_FILE,JSON.stringify(config,null,2));}
+loadConfig();
+
+function log(tool,args,result,ok=true){recent.push({ts:new Date().toISOString(),tool,args:JSON.stringify(args??{}).slice(0,500),ok});if(recent.length>200)recent.shift();return result;}
+function abs(p){return path.resolve(String(p));}
+function canonicalPath(p){
+  const requested=abs(p);
+  let cur=requested;
+  const suffix=[];
+  while(!fs.existsSync(cur)){
+    const parent=path.dirname(cur);
+    if(parent===cur)break;
+    suffix.unshift(path.basename(cur));
+    cur=parent;
+  }
+  let real=cur;
+  try{real=fs.realpathSync.native(cur);}catch{}
+  return path.resolve(real,...suffix);
+}
+function allowed(p){
+  const a=canonicalPath(p).toLowerCase(), roots=config.allowedDirectories||[];
+  if(!roots.length)return true;
+  return roots.some(r=>{const rr=canonicalPath(r).toLowerCase();return a===rr||a.startsWith(rr+path.sep.toLowerCase());});
+}
+function restrictedRoots(){return (config.restrictedDirectories||[]).map(p=>canonicalPath(path.join(os.homedir(),p)));}
+function restrictedPath(p){
+  const a=canonicalPath(p),low=a.toLowerCase(),base=path.basename(a).toLowerCase(),ext=path.extname(a).toLowerCase();
+  if(restrictedRoots().some(r=>{const x=r.toLowerCase();return low===x||low.startsWith(x+path.sep.toLowerCase());}))return true;
+  if((config.restrictedFileNames||[]).map(x=>x.toLowerCase()).includes(base))return true;
+  if((config.restrictedExtensions||[]).map(x=>x.toLowerCase()).includes(ext))return true;
+  return false;
+}
+function isAncestorOfRestricted(p){
+  const a=canonicalPath(p).toLowerCase();
+  return restrictedRoots().some(r=>{const x=r.toLowerCase();return x===a||x.startsWith(a+path.sep.toLowerCase());});
+}
+function ensureAllowed(p){if(!allowed(p))throw new Error(`Path not allowed: ${p}`);if(restrictedPath(p))throw new Error("Reach does not access credential stores, private keys, password vaults, or other restricted authentication data.");}
+function blocked(command){
+  const low=String(command).toLowerCase();
+  const exact=(config.blockedCommands||[]).find(x=>new RegExp("(^|[\\s;&|])"+String(x).replace(/[.*+?^$(){}|[\\]\\\\]/g,"\\\\$&")+"([\\s;&|]|$)","i").test(low));
+  if(exact)return exact;
+  const fragment=(config.blockedCommandFragments||[]).find(x=>low.includes(String(x).toLowerCase()));
+  if(fragment)return fragment;
+  if(/(^|[\\s"'\\/=])\.env($|[\\s"'\\/])/i.test(low))return ".env";
+  return null;
+}
+function safeUserCommand(command){
+  const s=String(command||"").trim();
+  return /^whoami(?:\s+\/\w+)?$/i.test(s) ||
+         /^hostname$/i.test(s) ||
+         /^git\s+(status|diff|log|branch|show)(?:\s+[^;&|]*)?$/i.test(s);
+}
+function sliceLines(text,offset=0,length=config.fileReadLineLimit){
+  const lines=text.replace(/\r\n/g,"\n").split("\n");
+  if(offset<0)return lines.slice(Math.max(0,lines.length+offset)).join("\n");
+  return lines.slice(offset,offset+length).join("\n");
+}
+async function powershell(command,timeoutMs=30000,internal=false){
+  if(!internal&&!config.allowArbitraryExecution&&!safeUserCommand(command))return {ok:false,message:"Arbitrary command execution is disabled in the local Reach settings. Only approved diagnostic commands are available."};
+  const denied=blocked(command);
+  if(denied)return {ok:false,message:`Command blocked by ExamediX Reach safety policy: ${denied}`};
+  try{const {stdout,stderr}=await execFileAsync("powershell.exe",["-NoLogo","-NoProfile","-NonInteractive","-Command",command],{windowsHide:true,timeout:Math.min(Math.max(Number(timeoutMs)||30000,1000),120000),maxBuffer:16*1024*1024,encoding:"utf8"});return {ok:true,stdout:stdout??"",stderr:stderr??""};}
+  catch(e){return {ok:false,stdout:e?.stdout??"",stderr:e?.stderr??"",message:e?.message??String(e),code:e?.code??null};}
+}
+function shellArgs(shell,command){
+  const s=(shell||config.defaultShell||"powershell.exe").toLowerCase();
+  if(s.includes("powershell")||s.endsWith("pwsh.exe"))return ["-NoLogo","-NoProfile","-Command",command];
+  if(s.endsWith("cmd.exe")||s==="cmd")return ["/d","/s","/c",command];
+  return ["-lc",command];
+}
+function startProc(command,shell){
+  if(!config.allowArbitraryExecution&&!safeUserCommand(command))throw new Error("Arbitrary process execution is disabled in the local Reach settings. Only approved diagnostic commands are available.");
+  const denied=blocked(command);
+  if(denied)throw new Error(`Command blocked by ExamediX Reach safety policy: ${denied}`);
+  const sh=shell||config.defaultShell||"powershell.exe";
+  const child=spawn(sh,shellArgs(sh,command),{windowsHide:true,stdio:["pipe","pipe","pipe"]});
+  const sess={pid:child.pid,command,shell:sh,started:new Date().toISOString(),lines:[],partial:"",cursor:0,done:false,exitCode:null};
+  const push=buf=>{const text=sess.partial+buf.toString();const parts=text.split(/\r?\n/);sess.partial=parts.pop()??"";sess.lines.push(...parts);if(sess.lines.length>200000){const drop=sess.lines.length-150000;sess.lines.splice(0,drop);sess.cursor=Math.max(0,sess.cursor-drop);}};
+  child.stdout.on("data",push);child.stderr.on("data",push);
+  child.on("exit",code=>{if(sess.partial){sess.lines.push(sess.partial);sess.partial="";}sess.done=true;sess.exitCode=code;});
+  sess.child=child;sessions.set(child.pid,sess);return sess;
+}
+function readSess(sess,offset=0,length=config.fileReadLineLimit){
+  if(sess.partial){/* keep partial until line ends */}
+  let start;
+  if(offset===0){start=sess.cursor;sess.cursor=Math.min(sess.lines.length,start+length);}
+  else if(offset<0)start=Math.max(0,sess.lines.length+offset);
+  else start=offset;
+  const lines=sess.lines.slice(start,start+length);
+  return {pid:sess.pid,output:lines.join("\n"),start,returned:lines.length,total:sess.lines.length,done:sess.done,exitCode:sess.exitCode};
+}
+async function walk(root,fn,includeHidden=false){
+  const stack=[root];
+  while(stack.length){
+    const dir=stack.pop(); let ents=[]; try{ents=await fsp.readdir(dir,{withFileTypes:true});}catch{continue;}
+    for(const e of ents){if(!includeHidden&&e.name.startsWith("."))continue;if(e.isSymbolicLink())continue;const p=path.join(dir,e.name);if(!allowed(p)||restrictedPath(p))continue;if(e.isDirectory())stack.push(p);else if(e.isFile())await fn(p);}
+  }
+}
+function wildcardToRegExp(pat){return new RegExp("^"+pat.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*").replace(/\?/g,".")+"$","i");}
+async function runSearch(s){
+  try{
+    const root=abs(s.path);ensureAllowed(root);
+    const patt=s.literal?null:new RegExp(s.pattern,s.ignoreCase?"i":"");
+    const fileRe=s.filePattern?wildcardToRegExp(s.filePattern):null;
+    await walk(root,async p=>{
+      if(s.stopped||s.results.length>=s.maxResults)return;
+      const name=path.basename(p);
+      if(s.type==="files"){
+        const ok=s.literal?(s.ignoreCase?name.toLowerCase().includes(s.pattern.toLowerCase()):name.includes(s.pattern)):patt.test(name);
+        if(ok)s.results.push({path:p});
+      }else{
+        if(fileRe&&!fileRe.test(name))return;
+        let txt;try{const st=await fsp.stat(p);if(st.size>config.maxSearchFileBytes)return;txt=await fsp.readFile(p,"utf8");}catch{return;}
+        const lines=txt.split(/\r?\n/);
+        for(let i=0;i<lines.length&&s.results.length<s.maxResults;i++){
+          const line=lines[i],ok=s.literal?(s.ignoreCase?line.toLowerCase().includes(s.pattern.toLowerCase()):line.includes(s.pattern)):patt.test(line);
+          if(ok){s.results.push({path:p,line:i+1,text:line.slice(0,1000)});if(s.contextLines){/* compact V1: matching line only */}}
+        }
+      }
+    },s.includeHidden);
+    s.status=s.stopped?"STOPPED":"COMPLETED";
+  }catch(e){s.status="ERROR";s.error=e.message;}
+}
+
+async function dispatch(tool,args={}){
+  try{
+    if(tool==="system_info")return log(tool,args,await powershell("$mem=(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory; $os=[System.Environment]::OSVersion.VersionString; [pscustomobject]@{Computer=$env:COMPUTERNAME;User=$env:USERNAME;Windows=$os;RAM_GB=[math]::Round($mem/1GB,2);PowerShell=$PSVersionTable.PSVersion.ToString();CurrentDirectory=(Get-Location).Path}|ConvertTo-Json -Compress",30000,true));
+    if(tool==="run_powershell")return log(tool,args,await powershell(args.command,args.timeout_ms??30000,false));
+    if(tool==="read_file"){
+      const p=abs(args.path);ensureAllowed(p);const ext=path.extname(p).toLowerCase();const st=await fsp.stat(p);if(!st.isFile())throw new Error("Path is not a file.");
+      if([".png",".jpg",".jpeg",".gif",".webp"].includes(ext)){if(st.size>config.maxImageReadBytes)throw new Error("Image exceeds the local Reach base64 safety limit.");const b=await fsp.readFile(p);return log(tool,args,{ok:true,kind:"base64",mime:ext===".png"?"image/png":"image/"+ext.slice(1),data:b.toString("base64")});}
+      if([".xlsx",".xlsm"].includes(ext)){await loadSafeOfficeZip(p);const wb=new ExcelJS.Workbook();await wb.xlsx.readFile(p);const requested=args.sheet!=null?String(args.sheet):null;const ws=requested==null?wb.worksheets[0]:(/^\d+$/.test(requested)?wb.worksheets[Number(requested)]:wb.getWorksheet(requested));if(!ws)throw new Error("Sheet not found");const sn=ws.name;let arr=[];const cols=Math.max(ws.columnCount,1);ws.eachRow({includeEmpty:true},row=>{const vals=[];for(let c=1;c<=cols;c++)vals.push(excelValue(row.getCell(c).value));arr.push(vals);});if(args.range)arr=sliceA1(arr,args.range);if(args.offset!=null)arr=arr.slice(args.offset,args.offset+(args.length??config.fileReadLineLimit));return log(tool,args,{ok:true,sheet:sn,data:arr});}
+      if(ext===".xls")throw new Error("Legacy .xls is not supported by the secure Reach build. Convert it to .xlsx first.");
+      if(ext===".pdf"){if(st.size>config.maxFileReadBytes)throw new Error("PDF exceeds the local Reach safety limit.");const parser=new PDFParse({data:await fsp.readFile(p)});try{const data=await parser.getText();return log(tool,args,{ok:true,pages:data.total,text:sliceLines(data.text,args.offset??0,args.length??config.fileReadLineLimit)});}finally{await parser.destroy();}}
+      if(ext===".docx"){const text=await extractDocxText(p);return log(tool,args,{ok:true,text:sliceLines(text,args.offset??0,args.length??config.fileReadLineLimit)});}
+      if(st.size>config.maxFileReadBytes)throw new Error("Text file exceeds the local Reach direct-read safety limit; use Search or Power Mode streaming commands for very large files.");const txt=await fsp.readFile(p,"utf8");return log(tool,args,{ok:true,text:sliceLines(txt,args.offset??0,args.length??config.fileReadLineLimit)});
+    }
+    if(tool==="read_multiple_files"){const out=[];for(const p of args.paths||[]){try{out.push({path:p,result:await dispatch("read_file",{path:p})});}catch(e){out.push({path:p,error:e.message});}}return log(tool,args,{ok:true,files:out});}
+    if(tool==="write_file"){
+      const p=abs(args.path);ensureAllowed(p);await fsp.mkdir(path.dirname(p),{recursive:true});const ext=path.extname(p).toLowerCase();
+      if(ext===".xlsx"){const parsed=JSON.parse(args.content);const wb=new ExcelJS.Workbook();if(Array.isArray(parsed)){const ws=wb.addWorksheet("Sheet1");for(const row of parsed)ws.addRow(Array.isArray(row)?row:[row]);}else{for(const [name,rows] of Object.entries(parsed)){const ws=wb.addWorksheet(String(name).slice(0,31)||"Sheet");for(const row of rows)ws.addRow(Array.isArray(row)?row:[row]);}}await wb.xlsx.writeFile(p);return log(tool,args,{ok:true,path:p});}
+      if(ext===".xls"||ext===".xlsm")throw new Error("Reach writes .xlsx only; .xls/.xlsm rewriting is disabled to avoid format or macro loss.");
+      if(args.mode==="append")await fsp.appendFile(p,args.content,"utf8");else await fsp.writeFile(p,args.content,"utf8");return log(tool,args,{ok:true,path:p,bytes:Buffer.byteLength(args.content)});
+    }
+    if(tool==="write_pdf"){
+      const src=abs(args.path),out=abs(args.outputPath||args.path);ensureAllowed(src);ensureAllowed(out);await fsp.mkdir(path.dirname(out),{recursive:true});let doc;
+      if(Array.isArray(args.content)){
+        const st=await fsp.stat(src).catch(()=>null);if(!st)throw new Error("Source PDF not found");doc=await PDFDocument.load(await fsp.readFile(src));
+        for(const op of args.content){
+          if(op.type==="delete"){for(const idx of [...op.pageIndexes].sort((a,b)=>b-a))if(idx>=0&&idx<doc.getPageCount())doc.removePage(idx);}
+          else if(op.type==="insert"){
+            if(op.sourcePdfPath){const sp=abs(op.sourcePdfPath);ensureAllowed(sp);const sd=await PDFDocument.load(await fsp.readFile(sp));const pages=await doc.copyPages(sd,sd.getPageIndices());let at=Math.max(0,Math.min(op.pageIndex,doc.getPageCount()));for(const pg of pages)doc.insertPage(at++,pg);}
+            else{const font=await doc.embedFont(StandardFonts.Helvetica);const page=doc.insertPage(Math.max(0,Math.min(op.pageIndex,doc.getPageCount())));const txt=String(op.markdown||"").replace(/[#*_>-]/g,"");const lines=txt.match(/.{1,90}(?:\s|$)/g)||[""];let y=page.getHeight()-50;for(const line of lines){if(y<40)break;page.drawText(line.trim(),{x:50,y,size:11,font});y-=16;}}
+          }
+        }
+      }else{
+        doc=await PDFDocument.create();const font=await doc.embedFont(StandardFonts.Helvetica);const txt=String(args.content||"").replace(/[#*_>-]/g,"");const lines=txt.match(/.{1,90}(?:\s|$)/g)||[""];let page=doc.addPage(),y=page.getHeight()-50;for(const line of lines){if(y<40){page=doc.addPage();y=page.getHeight()-50;}page.drawText(line.trim(),{x:50,y,size:11,font});y-=16;}
+      }
+      await fsp.writeFile(out,await doc.save());return log(tool,args,{ok:true,path:out,pages:doc.getPageCount()});
+    }
+    if(tool==="create_directory"){const p=abs(args.path);ensureAllowed(p);await fsp.mkdir(p,{recursive:true});return log(tool,args,{ok:true,path:p});}
+    if(tool==="move_file"){const s=abs(args.source),d=abs(args.destination);ensureAllowed(s);ensureAllowed(d);const st=await fsp.stat(s);if(st.isDirectory()&&isAncestorOfRestricted(s))throw new Error("Reach will not move a directory that contains restricted authentication data.");await fsp.mkdir(path.dirname(d),{recursive:true});await fsp.rename(s,d);return log(tool,args,{ok:true,source:s,destination:d});}
+    if(tool==="copy_file"){const s=abs(args.source),d=abs(args.destination);ensureAllowed(s);ensureAllowed(d);const st=await fsp.stat(s);if(st.isDirectory()&&isAncestorOfRestricted(s))throw new Error("Reach will not recursively copy a directory that contains restricted authentication data.");await fsp.mkdir(path.dirname(d),{recursive:true});await fsp.cp(s,d,{recursive:true,force:!!args.overwrite});return log(tool,args,{ok:true,source:s,destination:d});}
+    if(tool==="delete_file"){const p=abs(args.path);ensureAllowed(p);const st=await fsp.stat(p).catch(()=>null);if(st?.isDirectory()&&isAncestorOfRestricted(p))throw new Error("Reach will not delete a directory that contains restricted authentication data.");await fsp.rm(p,{recursive:true,force:!!args.force});return log(tool,args,{ok:true,path:p});}
+    if(tool==="list_directory"){const root=abs(args.path);ensureAllowed(root);const depth=Math.max(1,Math.min(args.depth??2,20));const rows=[];async function rec(dir,d){let ents=await fsp.readdir(dir,{withFileTypes:true});for(const e of ents){if(e.isSymbolicLink())continue;const p=path.join(dir,e.name);if(!allowed(p)||restrictedPath(p))continue;rows.push({type:e.isDirectory()?"dir":"file",path:path.relative(root,p)||".",fullPath:p});if(e.isDirectory()&&d<depth)await rec(p,d+1);}}await rec(root,1);return log(tool,args,{ok:true,root,items:rows});}
+    if(tool==="get_file_info"){const p=abs(args.path);ensureAllowed(p);const st=await fsp.stat(p);const out={path:p,size:st.size,created:st.birthtime.toISOString(),modified:st.mtime.toISOString(),isDirectory:st.isDirectory(),isFile:st.isFile()};if(st.isFile()&&st.size<50*1024*1024){try{const t=await fsp.readFile(p,"utf8");out.lineCount=t.split(/\r?\n/).length;}catch{}}return log(tool,args,{ok:true,info:out});}
+    if(tool==="edit_block"){const p=abs(args.file_path);ensureAllowed(p);const ext=path.extname(p).toLowerCase();if([".docx",".xlsx",".xls",".xlsm",".pdf"].includes(ext))throw new Error("Binary Office/PDF files require their dedicated read/write tools; generic edit_block is disabled to prevent corruption.");const st=await fsp.stat(p);if(st.size>config.maxEditFileBytes)throw new Error("Text file exceeds the local Reach edit safety limit.");let txt=await fsp.readFile(p,"utf8");const old=String(args.old_string),neu=String(args.new_string);let count=0,pos=0;while((pos=txt.indexOf(old,pos))!==-1){count++;pos+=old.length;}const exp=args.expected_replacements??1;if(count!==exp)throw new Error(`Expected ${exp} replacements, found ${count}`);txt=txt.split(old).join(neu);await fsp.writeFile(p,txt,"utf8");return log(tool,args,{ok:true,replacements:count,path:p});}
+    if(tool==="start_process"){const s=startProc(args.command,args.shell);return log(tool,args,{ok:true,pid:s.pid,status:"RUNNING",command:s.command,shell:s.shell});}
+    if(tool==="read_process_output"){const s=sessions.get(Number(args.pid));if(!s)throw new Error("Session not found");return log(tool,args,{ok:true,...readSess(s,args.offset??0,args.length??config.fileReadLineLimit)});}
+    if(tool==="interact_with_process"){const s=sessions.get(Number(args.pid));if(!s)throw new Error("Session not found");s.child.stdin.write(String(args.input)+(String(args.input).endsWith("\n")?"":"\n"));await new Promise(r=>setTimeout(r,Math.min(args.timeout_ms??500,3000)));return log(tool,args,{ok:true,...readSess(s,0,args.length??config.fileReadLineLimit)});}
+    if(tool==="force_terminate"){const s=sessions.get(Number(args.pid));if(s&&!s.done)s.child.kill("SIGKILL");return log(tool,args,{ok:true,pid:Number(args.pid)});}
+    if(tool==="list_sessions")return log(tool,args,{ok:true,sessions:[...sessions.values()].map(s=>({pid:s.pid,command:s.command,shell:s.shell,started:s.started,done:s.done,exitCode:s.exitCode,lines:s.lines.length}))});
+    if(tool==="list_processes"){const r=await powershell("Get-Process | Select-Object Id,ProcessName,CPU,WorkingSet64,Path | ConvertTo-Json -Depth 2 -Compress",30000,true);return log(tool,args,r);}
+    if(tool==="kill_process"){const r=await powershell(`Stop-Process -Id ${Number(args.pid)} -Force -ErrorAction Stop; 'OK'`,30000,true);return log(tool,args,r);}
+    if(tool==="start_search"){const id="search_"+crypto.randomUUID();const s={id,path:args.path,pattern:args.pattern,type:args.searchType??"files",filePattern:args.filePattern,ignoreCase:args.ignoreCase!==false,literal:!!args.literalSearch,includeHidden:!!args.includeHidden,contextLines:args.contextLines??0,maxResults:Math.min(args.maxResults??1000,100000),results:[],status:"RUNNING",stopped:false,created:new Date().toISOString()};searches.set(id,s);runSearch(s);return log(tool,args,{ok:true,sessionId:id,status:s.status});}
+    if(tool==="get_more_search_results"){const s=searches.get(args.sessionId);if(!s)throw new Error("Search not found");const off=args.offset??0,len=args.length??100;const start=off<0?Math.max(0,s.results.length+off):off;return log(tool,args,{ok:true,status:s.status,error:s.error??null,total:s.results.length,results:s.results.slice(start,start+len)});}
+    if(tool==="stop_search"){const s=searches.get(args.sessionId);if(!s)throw new Error("Search not found");s.stopped=true;s.status="STOPPING";return log(tool,args,{ok:true,sessionId:s.id});}
+    if(tool==="list_searches")return log(tool,args,{ok:true,searches:[...searches.values()].map(s=>({id:s.id,status:s.status,path:s.path,pattern:s.pattern,type:s.type,total:s.results.length,created:s.created}))});
+
+    throw new Error(`Unknown tool: ${tool}`);
+  }catch(e){return log(tool,args,{ok:false,message:e?.message??String(e)},false);}
+}
+
+function postJson(url,obj){
+  return new Promise((resolve,reject)=>{
+    const u=new URL(url),data=Buffer.from(JSON.stringify(obj));
+    const r=https.request({hostname:u.hostname,port:443,path:u.pathname+u.search,method:"POST",headers:{"content-type":"application/json","content-length":data.length}},res=>{
+      const chunks=[];res.on("data",c=>chunks.push(c));res.on("end",()=>{try{const x=JSON.parse(Buffer.concat(chunks).toString("utf8"));if(res.statusCode>=200&&res.statusCode<300)resolve(x);else reject(new Error(x.error||("HTTP "+res.statusCode)));}catch(e){reject(e);}});
+    });r.on("error",reject);r.write(data);r.end();
+  });
+}
+function dpapiProtect(secret){
+  const script="Add-Type -AssemblyName System.Security;$s=[Console]::In.ReadToEnd();$b=[Text.Encoding]::UTF8.GetBytes($s);$e=[System.Security.Cryptography.ProtectedData]::Protect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Convert]::ToBase64String($e)";
+  const r=spawnSync("powershell.exe",["-NoLogo","-NoProfile","-NonInteractive","-Command",script],{input:String(secret),encoding:"utf8",windowsHide:true,maxBuffer:1024*1024});
+  if(r.status!==0)throw new Error("Could not protect local device credential with Windows DPAPI.");
+  return String(r.stdout).trim();
+}
+function dpapiUnprotect(ciphertext){
+  const script="Add-Type -AssemblyName System.Security;$s=[Console]::In.ReadToEnd();$e=[Convert]::FromBase64String($s.Trim());$b=[System.Security.Cryptography.ProtectedData]::Unprotect($e,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Text.Encoding]::UTF8.GetString($b)";
+  const r=spawnSync("powershell.exe",["-NoLogo","-NoProfile","-NonInteractive","-Command",script],{input:String(ciphertext),encoding:"utf8",windowsHide:true,maxBuffer:1024*1024});
+  if(r.status!==0)throw new Error("Could not decrypt the local Reach device credential for this Windows user.");
+  return String(r.stdout).trim();
+}
+function persistDevice(d){
+  const stored={...d};
+  delete stored.agent_token;
+  fs.writeFileSync(DEVICE_FILE,JSON.stringify(stored,null,2));
+}
+async function loadOrCreateDevice(){
+  if(fs.existsSync(DEVICE_FILE)){
+    let d;
+    try{d=JSON.parse(fs.readFileSync(DEVICE_FILE,"utf8"));}catch{throw new Error("Reach device identity file is invalid JSON.");}
+    if(d.agent_token_dpapi){
+      return {...d,agent_token:dpapiUnprotect(d.agent_token_dpapi)};
+    }
+    if(d.agent_token){
+      const token=d.agent_token;
+      const migrated={...d,agent_token_dpapi:dpapiProtect(token)};
+      delete migrated.agent_token;
+      persistDevice(migrated);
+      return {...migrated,agent_token:token};
+    }
+    throw new Error("Reach device identity is missing its local device credential.");
+  }
+  const agent_token=crypto.randomBytes(48).toString("base64url");
+  const pair=await postJson("https://examedix.ch/reach/api/agent/pair/start",{name:process.env.REACH_DEVICE_NAME||os.hostname(),platform:"Windows "+os.release(),version:VERSION,agent_token});
+  const d={device_id:pair.device_id,agent_token_dpapi:dpapiProtect(agent_token),pairing_code:pair.pairing_code,pairing_expires_at:Date.now()+pair.expires_in*1000};
+  persistDevice(d);
+  console.log("PAIRING CODE:",pair.pairing_code);
+  return {...d,agent_token};
+}
+const device=await loadOrCreateDevice();
+console.log("ExamediX Reach device:",device.device_id);
+if(device.pairing_code&&device.pairing_expires_at>Date.now())console.log("PAIRING CODE:",device.pairing_code);
+if(PAIR_ONLY)process.exit(0);
+
+let retry=1000;
+function connect(){
+  const url="wss://examedix.ch/reach/agent?device_id="+encodeURIComponent(device.device_id);
+  const ws=new WebSocket(url,{headers:{Authorization:"Bearer "+device.agent_token,"X-Reach-Agent-Version":VERSION},handshakeTimeout:15000});
+  ws.on("open",()=>{retry=1000;console.log("ExamediX Reach agent connected");});
+  ws.on("message",async data=>{let msg;try{msg=JSON.parse(data.toString());}catch{return;}if(!msg?.id||!msg?.tool)return;const result=await dispatch(msg.tool,msg.args||{});if(ws.readyState===WebSocket.OPEN)ws.send(JSON.stringify({id:msg.id,result}));});
+  ws.on("close",()=>{setTimeout(connect,retry);retry=Math.min(retry*2,30000);});
+  ws.on("error",e=>console.error("ExamediX Reach connection:",e.message));
+}
+connect();

package/package.json

@@ -1,6 +1,58 @@
-{
-  "name": "examedix-reach",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "examedix-reach",
+  "version": "0.1.1",
+  "description": "Securely connect ChatGPT to Windows computers you own or are authorized to administer.",
+  "type": "module",
+  "license": "UNLICENSED",
+  "author": "ExamediX Technologies",
+  "homepage": "https://examedix.ch/reach",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/examedix/examedix-reach.git"
+  },
+  "bugs": {
+    "url": "https://examedix.ch/reach/support"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "bin": {
+    "examedix-reach": "bin/reach.js",
+    "reach": "bin/reach.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "README.md",
+    "THIRD-PARTY-NOTICES.txt",
+    "DISCLOSURE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "chatgpt",
+    "mcp",
+    "windows",
+    "remote-work",
+    "file-system",
+    "process-management",
+    "workstation"
+  ],
+  "dependencies": {
+    "exceljs": "^4.4.0",
+    "jszip": "^3.10.1",
+    "pdf-lib": "^1.17.1",
+    "pdf-parse": "2.4.5",
+    "ws": "^8.18.3"
+  },
+  "overrides": {
+    "uuid": "11.1.1"
+  },
+  "os": [
+    "win32"
+  ],
+  "contentPolicy": {
+    "class": "dual-use"
+  }
+}