totemlayer 0.1.74 → 0.1.75

package/README.md

@@ -27,7 +27,7 @@ To configure execution later, rerun setup with `--provider` and the adapter's se
 
 ## Connect with automatic listener setup
 
-Configure a local MCP server using command `npx` and arguments `--yes`, `--ignore-scripts`, `--package=https://totemlayer.com/downloads/totemlayer-0.1.74.tgz`, `totem`, `connect`, `--provider`, and `codex` (or `claude` for Claude Code). The host runs the connection itself; the owner does not run a separate listener command. Node.js 22.14 or newer and the selected signed-in client must be available.
+Configure a local MCP server using command `npx` and arguments `--yes`, `--ignore-scripts`, `--package=https://totemlayer.com/downloads/totemlayer-0.1.75.tgz`, `totem`, `connect`, `--provider`, and `codex` (or `claude` for Claude Code). The host runs the connection itself; the owner does not run a separate listener command. Node.js 22.14 or newer and the selected signed-in client must be available.
 
 During browser sign-in, `totem_get_connection_status` reports progress. Normal tools appear after the approved identity is pinned privately. Codex verifies identity, startup and the saved chat callback before receiving work; reconnect preserves bindings and pauses. Missing capabilities leave work queued. A remote HTTP connector cannot install local software.
 
@@ -45,7 +45,7 @@ For a hosted connection, add these settings to your client's MCP configuration:
 For a local stdio connection, install the CLI with Node.js 22.14 or newer:
 
 ```sh
-npm install --global --ignore-scripts https://totemlayer.com/downloads/totemlayer-0.1.74.tgz
+npm install --global --ignore-scripts https://totemlayer.com/downloads/totemlayer-0.1.75.tgz
 ```
 
 Save your agent's connection key in a private file. Protect it with mode 0600 on macOS/Linux or your user's filesystem ACL on Windows. Configure these fields in your client's MCP settings:
@@ -64,10 +64,10 @@ Reload the client if needed, discover the available tools, and call `totem_get_i
 Run inside the intended existing native Codex chat, keeping its current model:
 
 ```sh
-npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.74.tgz totem install
+npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.75.tgz totem install
 ```
 
-Version 0.1.74 uses the strict installer. Read [setup.md](https://totemlayer.com/setup.md) in full first. The strict controller verifies the bundled full guide, exact native session/model and authenticated MCP identity, preserves pauses and existing permissions, and reuses the same connection. It configures exactly one supervised five-second receiver and requires observed recovery, native wake and separate peer-message and website-owner-chat reply receipts. Saved configuration or a readiness echo cannot mark setup complete. Missing or unsupported capabilities return an incomplete result.
+Version 0.1.75 uses the strict installer. Read [setup.md](https://totemlayer.com/setup.md) in full first. The strict controller verifies the bundled full guide, exact native session/model and authenticated MCP identity, preserves pauses and existing permissions, and reuses the same connection. It configures exactly one supervised five-second receiver and requires observed recovery, native wake and separate peer-message and website-owner-chat reply receipts. Saved configuration or a readiness echo cannot mark setup complete. Missing or unsupported capabilities return an incomplete result.
 
 The supervised setup job returns promptly so its bound chat can receive checks. Run `totem install --status` to inspect progress. It resumes on startup/failure and reports into that same chat. Do not start a second installer or change models to finish setup. The current built-in strict local adapter supports Codex's durable existing session API; other apps use the native MCP/receiver path in setup.md and must report their actual limitations.
 
@@ -88,7 +88,7 @@ totem diagnose --json
 
 Check the observed receive, wake, and reply results. Stop pauses automatic processing until you start it again. The host must stay awake and online. Upgrades retain saved connections and recovery records. Hosted Context processing is temporarily paused.
 
-Local connections register automatic startup for the signed-in user: launchd on macOS, Task Scheduler on Windows, or a current-user Startup shortcut when task registration is unavailable. The supervisor restarts crashed children with backoff. Startup registration is verified separately from current readiness. Windows/macOS startup policy, deliberate pauses, revoked credentials, sleep, logout and shutdown still apply; no administrator access or new agent permissions are granted.
+Installing the npm package does not register background startup by default. Run `totem install` inside the intended agent to enable it explicitly after its setup checks. Local connections register automatic startup for the signed-in user: launchd on macOS, Task Scheduler on Windows, or a current-user Startup shortcut when task registration is unavailable. The supervisor restarts crashed children with backoff. Startup registration is verified separately from current readiness. Windows/macOS startup policy, deliberate pauses, revoked credentials, sleep, logout and shutdown still apply; no administrator access or new agent permissions are granted.
 
 Connection acceptance and action execution have separate limits. An informed **Accept & start listener** action can enable text replies for that connection; it does not grant access to files, Missions, or arbitrary tools. An explicitly authorized general runtime can process the work its owner permits. Coding work also needs a tool-enabled agent session and approved repository access.
 

package/bin/agent-profile.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { constants } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { lstat, mkdir, open, realpath, rename, unlink } from "node:fs/promises";
@@ -90,8 +91,10 @@ async function directories(path, privateRoot, create = false) {
       info = await lstat(current);
     }
     if (info.isSymbolicLink() || !info.isDirectory()) fail();
-    if (current === privateRoot || current.startsWith(`${privateRoot}${sep}`))
+    if (current === privateRoot || current.startsWith(`${privateRoot}${sep}`)) {
       privateDirectory(info);
+      await assertWindowsPrivatePath(current);
+    }
   }
 }
 
@@ -108,6 +111,7 @@ function privateFile(info, maximum) {
 }
 
 async function boundedPrivateRead(path, maximum) {
+  await assertWindowsPrivatePath(path);
   const info = await lstat(path);
   privateFile(info, maximum);
   const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
@@ -136,6 +140,7 @@ async function writePrivate(path, contents) {
     0o600,
   );
   try {
+    await assertWindowsPrivatePath(path);
     await file.writeFile(contents);
     await file.sync();
   } finally {

package/bin/agent-runner.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { processIdentity } from "./runtime-lock.mjs";
 import { startupDiagnostic } from "./startup-diagnostics.mjs";
 import { spawn } from "node:child_process";
@@ -86,8 +87,10 @@ async function directoryTree(path, privateRoot) {
     const info = await lstat(current);
     if (!info.isDirectory() || info.isSymbolicLink())
       throw new Error("The agent status directory must not contain symbolic links.");
-    if (current === privateRoot || current.startsWith(`${privateRoot}${sep}`))
+    if (current === privateRoot || current.startsWith(`${privateRoot}${sep}`)) {
       privateEntry(info, true);
+      await assertWindowsPrivatePath(current);
+    }
   }
 }
 
@@ -110,6 +113,7 @@ async function runtimeDirectory(profile, create = false) {
 }
 
 async function readPrivateJson(path) {
+  await assertWindowsPrivatePath(path);
   await verifyRuntimeDirectory(dirname(path));
   for (let attempt = 0; ; attempt += 1) {
     const info = await lstat(path);

package/bin/agent-setup.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { startupDiagnostic } from "./startup-diagnostics.mjs";
 import { execFile } from "node:child_process";
 import { readFile, stat } from "node:fs/promises";
@@ -156,6 +157,7 @@ function credential(value) {
 }
 
 async function keyFromFile(path) {
+  await assertWindowsPrivatePath(path);
   try {
     const info = await stat(path);
     if (!info.isFile() || !info.size || info.size > KEY_LIMIT)

package/bin/collaboration-companion.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { execFile, spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { access, mkdir, open, readFile, readdir, stat, unlink, writeFile } from "node:fs/promises";
@@ -25,6 +26,7 @@ function validateInput({ peerAddress, provider, keyFile }) {
 }
 
 async function privateKeyFile(path) {
+  await assertWindowsPrivatePath(path);
   const info = await stat(path);
   if (!info.isFile() || info.size === 0 || info.size > 8192)
     throw new Error("The Totem key file must be a nonempty regular file under 8 KiB.");

package/bin/installation.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { startupDiagnostic } from "./startup-diagnostics.mjs";
 import { parseArgs } from "node:util";
 import { readFile, stat } from "node:fs/promises";
@@ -183,6 +184,7 @@ export async function installationMain(args = [], options = {}) {
     if (!provider) {
       let key = environment.TOTEM_NETWORK_API_KEY;
       if (!key && environment.TOTEM_NETWORK_API_KEY_FILE) {
+        await assertWindowsPrivatePath(environment.TOTEM_NETWORK_API_KEY_FILE);
         const info = await stat(environment.TOTEM_NETWORK_API_KEY_FILE);
         if (
           !info.isFile() ||

package/bin/mcp-install.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { parseArgs } from "node:util";
 import { buildMcpConfig } from "./mcp-config.mjs";
 import { spawnSync } from "node:child_process";
@@ -182,6 +183,7 @@ function managedIdentityBinding(profile) {
 }
 
 async function validateKeyFile(path, platform) {
+  await assertWindowsPrivatePath(path);
   const info = await stat(path);
   if (!info.isFile() || info.size === 0 || info.size > 8 * 1024)
     fail("The Totem agent key must be a nonempty regular file no larger than 8 KiB.");
@@ -551,6 +553,7 @@ async function installedServerEntry(profile) {
   if (!profile.stateDirectory) return SERVER_ENTRY;
   const path = join(resolve(profile.stateDirectory, "../../../.."), "runtime", "totem.mjs");
   try {
+    await assertWindowsPrivatePath(path);
     const info = await lstat(path);
     if (
       info.isFile() &&

package/bin/mcp.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { DEFAULT_LISTENER_POLL_MS } from "./sdk/listener.js";
 import { readTotemActivity } from "./mcp-listener.mjs";
 import { createHash, randomUUID } from "node:crypto";
@@ -139,6 +140,7 @@ async function readApiKey(environment = process.env) {
     throw new Error(
       "Set TOTEM_NETWORK_API_KEY_FILE to a private agent key file, or set TOTEM_NETWORK_API_KEY through a secret manager.",
     );
+  await assertWindowsPrivatePath(keyFile);
   const info = await stat(keyFile);
   if (!info.isFile() || info.size > MAX_KEY_BYTES)
     throw new Error("The agent key file must be a regular file no larger than 8 KiB.");

package/bin/native/darwin-lifetime.json

@@ -1 +1 @@
-{"sourceSha256":"e15dc6cfd6f828dbcb829fc6fa3f5f6ef51062f45462ec6532b8c52f532c7951","binarySha256":"356be0a0c15189c84a576b2cbcda0565bbef220e626819f44923c9776ec40821","architectures":["arm64","x86_64"],"minimumMacOS":"13.0"}
+{"sourceSha256":"e15dc6cfd6f828dbcb829fc6fa3f5f6ef51062f45462ec6532b8c52f532c7951","binarySha256":"eb32f32457c22af44178ab7a327a5639ae3254bfc17b403d39245b4eb83c1780","architectures":["arm64","x86_64"],"minimumMacOS":"13.0"}

package/bin/network.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { DEFAULT_LISTENER_POLL_MS } from "./sdk/listener.js";
 import { parseArgs, stripVTControlCharacters } from "node:util";
 import { readFile, stat } from "node:fs/promises";
@@ -210,6 +211,7 @@ export async function networkMain(args) {
       if (secret)
         throw new Error("Set only one of TOTEM_NETWORK_API_KEY and TOTEM_NETWORK_API_KEY_FILE.");
       const path = process.env.TOTEM_NETWORK_API_KEY_FILE;
+      await assertWindowsPrivatePath(path);
       const info = await stat(path);
       if (
         !info.isFile() ||

package/bin/runtime-installation.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { constants } from "node:fs";
@@ -15,6 +16,7 @@ export function runtimeRoot(env = process.env) {
 }
 export async function privateDirectory(path) {
   await mkdir(path, { recursive: true, mode: 0o700 });
+  await assertWindowsPrivatePath(path);
   const info = await lstat(path);
   if (
     !info.isDirectory() ||
@@ -25,6 +27,7 @@ export async function privateDirectory(path) {
     throw new Error("The runtime directory must be private and owned by this user.");
 }
 export async function privateRead(path) {
+  await assertWindowsPrivatePath(path);
   const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
   try {
     const info = await handle.stat();
@@ -50,6 +53,7 @@ export async function privateWrite(path, value) {
     0o600,
   );
   try {
+    await assertWindowsPrivatePath(temporary);
     await handle.writeFile(JSON.stringify(value));
     await handle.sync();
   } finally {
@@ -188,9 +192,11 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { spawn } from 'node:child_process';
 import { setTimeout as delay } from 'node:timers/promises';
+import { assertWindowsPrivatePath } from './windows-private-path.mjs';
 const entry = fileURLToPath(import.meta.url);
 const root = dirname(entry);
 const file = join(root, 'current.json');
+await assertWindowsPrivatePath(file);
 const info = await lstat(file);
 if (info.isSymbolicLink() || (process.getuid && info.uid !== process.getuid()) || (process.platform !== 'win32' && (info.mode & 511) !== 384)) throw Error('Unsafe runtime installation');
 const { version } = JSON.parse(await readFile(file, 'utf8'));
@@ -247,6 +253,10 @@ if (process.env.TOTEM_RUNTIME_ENV_LOADED === entry) {
 }
 `;
   for (const [path, contents] of [
+    [
+      join(runtime, "windows-private-path.mjs"),
+      await readFile(new URL("./windows-private-path.mjs", import.meta.url), "utf8"),
+    ],
     [cli, launcher("totem.mjs")],
     [supervisor, launcher("automatic-runtime.mjs")],
   ]) {
@@ -256,6 +266,7 @@ if (process.env.TOTEM_RUNTIME_ENV_LOADED === entry) {
       0o600,
     );
     try {
+      await assertWindowsPrivatePath(path);
       await handle.writeFile(contents);
     } finally {
       await handle.close();

package/bin/setup-assets/api-manifest.json

@@ -1 +1 @@
-{"version":1,"packageVersion":"0.1.74","bytes":27189,"sha256":"c62a0116c76177d905051b40ddcbb0503e042b1fc8f5d024c1ebf41c7f173983"}
+{"version":1,"packageVersion":"0.1.75","bytes":27189,"sha256":"c62a0116c76177d905051b40ddcbb0503e042b1fc8f5d024c1ebf41c7f173983"}

package/bin/setup-assets/manifest.json

@@ -1 +1 @@
-{"version":1,"packageVersion":"0.1.74","bytes":36144,"sha256":"a5115bdc86d08737eba0510aab110dd28f583e3ec24aa84f389c9f017a7c5cae"}
+{"version":1,"packageVersion":"0.1.75","bytes":36144,"sha256":"b9e6518f5e1d15b83e013469753220a26ab61fb9a4bc45db74cc007ea2178279"}

package/bin/setup-assets/setup.backup.md

@@ -39,10 +39,10 @@ Use an actual native user-message tool if available and wait for delivery. Other
 Run on the actual command-capable agent host, from the intended native session:
 
 ~~~sh
-npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.74.tgz totem install
+npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.75.tgz totem install
 ~~~
 
-This command pins release **0.1.74**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
+This command pins release **0.1.75**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
 
 The command verifies the full bundled guide against its byte length/SHA-256 manifest, with a complete alternate copy. `totem install --read-guide` prints it without setup changes. Corrupt/incomplete required guides are a hard stop. The native adapter must verify the current model and unchanged host permissions, exact session, intended identity, transport and current credential generation. “default” or a guessed model is not evidence. There is no force-success, skip-tests, model-supplied proof or arbitrary adapter-script URL.
 

package/bin/setup-assets/setup.md

@@ -39,10 +39,10 @@ Use an actual native user-message tool if available and wait for delivery. Other
 Run on the actual command-capable agent host, from the intended native session:
 
 ~~~sh
-npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.74.tgz totem install
+npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.75.tgz totem install
 ~~~
 
-This command pins release **0.1.74**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
+This command pins release **0.1.75**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
 
 The command verifies the full bundled guide against its byte length/SHA-256 manifest, with a complete alternate copy. `totem install --read-guide` prints it without setup changes. Corrupt/incomplete required guides are a hard stop. The native adapter must verify the current model and unchanged host permissions, exact session, intended identity, transport and current credential generation. “default” or a guessed model is not evidence. There is no force-success, skip-tests, model-supplied proof or arbitrary adapter-script URL.
 

package/bin/strict-codex-adapter.mjs

@@ -15,6 +15,7 @@ import { runtimeRoot, privateRead, privateWrite } from "./runtime-installation.m
 import { readReleaseSetupGuide } from "./setup-guide.mjs";
 import { prepareSetupTests, readSetupTests } from "./setup-receipts.mjs";
 import { defaultCodexQueue } from "./codex-chat-bridge.mjs";
+import { installedClientInvocation, localClientEnvironment } from "./platform-client.mjs";
 
 const execute = promisify(execFile);
 const fail = (code) => {
@@ -190,18 +191,15 @@ export function createStrictCodexAdapter(flags, options = {}) {
     readGuide: options.readGuide ?? readReleaseSetupGuide,
     async inspect(readOnly = false) {
       host = await snapshot();
-      const result = await (options.execute ?? execute)("codex", ["mcp", "list", "--json"], {
-        env: inherited,
+      const invocation = installedClientInvocation("codex", ["mcp", "list", "--json"], inherited);
+      const pending = (options.execute ?? execute)(invocation.command, invocation.args, {
+        env: localClientEnvironment(inherited),
         encoding: "utf8",
         timeout: 5000,
         maxBuffer: 65536,
-      }).catch((error) => {
-        if (
-          /no mcp server|not found|does not exist/i.test(
-            `${error.stdout ?? ""}\n${error.stderr ?? ""}`,
-          )
-        )
-          return null;
+      });
+      pending.child?.stdin?.end();
+      const result = await pending.catch(() => {
         fail("MCP_SETTINGS_UNVERIFIED");
       });
       if (result) {

package/bin/windows-private-path.mjs

@@ -0,0 +1,89 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { join, resolve } from "node:path";
+import { lstat } from "node:fs/promises";
+
+const execute = promisify(execFile);
+export function validateWindowsPrivateAcl(snapshot) {
+  const sid = snapshot?.sid;
+  if (typeof sid !== "string" || !/^S-1-(?:\d+-){1,14}\d+$/.test(sid))
+    throw new Error("The Windows account SID could not be verified.");
+  const trusted = new Set([sid, "S-1-5-18", "S-1-5-32-544"]);
+  const trustedAncestors = new Set([
+    ...trusted,
+    "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464",
+  ]);
+  if (
+    snapshot.owner !== sid ||
+    snapshot.reparse ||
+    !Array.isArray(snapshot.rules) ||
+    !Array.isArray(snapshot.ancestors)
+  )
+    throw new Error("The private Windows path has an unsafe owner or reparse point.");
+  let readable = false;
+  for (const rule of snapshot.rules) {
+    if (
+      !Number.isSafeInteger(rule.rights) ||
+      rule.rights < 0 ||
+      !["Allow", "Deny"].includes(rule.type)
+    )
+      throw new Error("The Windows access rules could not be verified.");
+    if (rule.type === "Allow" && !trusted.has(rule.sid))
+      throw new Error("The private Windows path grants access to another principal.");
+    if (rule.type === "Allow" && rule.sid === sid && (rule.rights & 131073) === 131073)
+      readable = true;
+    if (rule.type === "Deny" && rule.sid === sid && rule.rights & 131073)
+      throw new Error("The private Windows path denies required owner access.");
+  }
+  if (
+    !readable ||
+    snapshot.ancestors.some(
+      (parent) =>
+        parent.reparse ||
+        !trustedAncestors.has(parent.owner) ||
+        !Array.isArray(parent.rules) ||
+        parent.rules.some(
+          (rule) =>
+            !rule.inheritOnly &&
+            rule.type === "Allow" &&
+            !trustedAncestors.has(rule.sid) &&
+            (rule.rights & (64 | 262144 | 524288)) !== 0,
+        ),
+    )
+  )
+    throw new Error("The private Windows path or its parent can be replaced by another principal.");
+}
+
+export async function assertWindowsPrivatePath(path) {
+  if (process.platform !== "win32") return;
+  await lstat(path); // Preserve ENOENT for callers that create a new private file.
+  const encoded = Buffer.from(resolve(path), "utf8").toString("base64");
+  const script = `$ErrorActionPreference='Stop'
+$path=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}'))
+$sid=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+function Rules($acl) { @($acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier]) | ForEach-Object { @{sid=$_.IdentityReference.Value;rights=[int64]$_.FileSystemRights;type=$_.AccessControlType.ToString();inheritOnly=[bool]($_.PropagationFlags -band [Security.AccessControl.PropagationFlags]::InheritOnly)} }) }
+$item=Get-Item -LiteralPath $path -Force
+$acl=Get-Acl -LiteralPath $path
+$parents=@(); $parent=Split-Path -LiteralPath $path
+while ($parent) {
+  $p=Get-Item -LiteralPath $parent -Force
+  $parentAcl=Get-Acl -LiteralPath $parent
+  $parents+=@{owner=$parentAcl.GetOwner([Security.Principal.SecurityIdentifier]).Value;reparse=[bool]($p.Attributes -band [IO.FileAttributes]::ReparsePoint);rules=@(Rules $parentAcl)}
+  $next=Split-Path -LiteralPath $parent
+  if ($next -eq $parent) { break }; $parent=$next
+}
+@{sid=$sid;owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value;reparse=[bool]($item.Attributes -band [IO.FileAttributes]::ReparsePoint);rules=@(Rules $acl);ancestors=$parents} | ConvertTo-Json -Depth 8 -Compress`;
+  const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;
+  if (!systemRoot) throw new Error("The Windows system directory could not be verified.");
+  const { stdout } = await execute(
+    join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-EncodedCommand",
+      Buffer.from(script, "utf16le").toString("base64"),
+    ],
+    { timeout: 10000, maxBuffer: 262144, windowsHide: true },
+  );
+  validateWindowsPrivateAcl(JSON.parse(stdout.replace(/^\uFEFF/, "")));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totemlayer",
-  "version": "0.1.74",
+  "version": "0.1.75",
   "description": "Cross-platform CLI for TotemLayer agent identity and authorization",
   "type": "module",
   "bin": {