u-chan-secrets 3.0.2 → 3.0.3

package/README.md

@@ -2,7 +2,7 @@
 
 A local MCP server that signs into approved websites with Bitwarden credentials. A privileged service performs credential entry in an isolated browser and transfers filtered session state into a dedicated user Chrome profile.
 
-V3 adds diagnostics, temporary approvals, explicit login outcomes, and a native management window. The source version is `3.0.2`; merging this repository does not publish an npm package or update an installed service.
+V3 adds diagnostics, temporary approvals, explicit login outcomes, and a native management window. The source version is `3.0.3`; merging this repository does not publish an npm package or update an installed service.
 
 **Verification:** Windows/macOS build and test CI is separate from installed-service security verification. Native process identity, input isolation, permissions, and installation rehearsals remain [release gates](docs/attack-checklist.md). See [validation evidence](docs/superpowers/research/2026-10-29-v3-validation.md) and [SECURITY.md](SECURITY.md).
 
@@ -200,6 +200,8 @@ Supported V3 tooling refuses V2 downgrade after migration. Historical V2 adminis
 
 Package updates verify registry signatures and integrity and retain private dependencies. Changed dependencies or native helpers require a trusted administrator reinstall. Expired/exhausted grants and already transferred website sessions are separate from vault lock and upgrade state.
 
+Versions 3.0.0–3.0.2 have an npm signature-verification defect and cannot reliably bootstrap their own update. Install the matching corrected package from a trusted shell, then use the administrator reinstall above. Version 3.0.3 requires SHA-512 integrity and a valid signature from its pinned npm key; unsigned repository-attestation JSON cannot replace that signature. Future signing-key rotation fails closed and requires a trusted verifier upgrade.
+
 For V1 data, use `u-chan import-v1 [path]`: each entry requires protected approval. Retire user-side Bitwarden sessions and the old `bw-session` file through a trusted migration process; never copy them into the service as trusted authorization.
 
 ## Validation and security

package/dist/platform/darwin/manage-script.js

@@ -1,33 +1,33 @@
 export function buildJxaManagementScript(req) {
-    return `ObjC.import('Cocoa');
-ObjC.import('stdlib');
-var alert = $.NSAlert.alloc.init;
-alert.messageText = ${JSON.stringify(req.title)};
-alert.informativeText = ${JSON.stringify('Phrase: ' + req.phrase)};
-['Refresh','Previous','Next','Lock','Unlock','Revoke selected','Close'].forEach(function(t){ alert.addButtonWithTitle(t); });
-var view = $.NSView.alloc.initWithFrame($.NSMakeRect(0,0,640,420));
-var scroll = $.NSScrollView.alloc.initWithFrame($.NSMakeRect(0,50,640,370));
-scroll.hasVerticalScroller = true;
-var text = $.NSTextView.alloc.initWithFrame($.NSMakeRect(0,0,620,370));
-text.editable = false;
-text.string = ${JSON.stringify(req.lines.join('\n'))};
-scroll.documentView = text;
-view.addSubview(scroll);
-var domains = ${JSON.stringify(req.domains ?? [])};
-var select = $.NSPopUpButton.alloc.initWithFramePullsDown($.NSMakeRect(0,5,640,32),false);
-domains.forEach(function(d){ select.addItemWithTitle(d); });
-view.addSubview(select);
-alert.accessoryView = view;
-var response = Number(alert.runModal) - 1000;
-var actions = ['refresh','previous','next','lock','unlock','revoke','close'];
-var result = {action: actions[response] || 'close'};
-if (result.action === 'revoke') {
-  var index = Number(select.indexOfSelectedItem);
-  if (index < 0 || index >= domains.length) result.action = 'refresh';
-  else result.domain = domains[index];
-}
-$.NSFileHandle.fileHandleWithStandardOutput.writeData(
- $.NSString.alloc.initWithString(JSON.stringify(result)).dataUsingEncoding($.NSUTF8StringEncoding));
-$.exit(0);
+    return `ObjC.import('Cocoa');
+ObjC.import('stdlib');
+var alert = $.NSAlert.alloc.init;
+alert.messageText = ${JSON.stringify(req.title)};
+alert.informativeText = ${JSON.stringify('Phrase: ' + req.phrase)};
+['Refresh','Previous','Next','Lock','Unlock','Revoke selected','Close'].forEach(function(t){ alert.addButtonWithTitle(t); });
+var view = $.NSView.alloc.initWithFrame($.NSMakeRect(0,0,640,420));
+var scroll = $.NSScrollView.alloc.initWithFrame($.NSMakeRect(0,50,640,370));
+scroll.hasVerticalScroller = true;
+var text = $.NSTextView.alloc.initWithFrame($.NSMakeRect(0,0,620,370));
+text.editable = false;
+text.string = ${JSON.stringify(req.lines.join('\n'))};
+scroll.documentView = text;
+view.addSubview(scroll);
+var domains = ${JSON.stringify(req.domains ?? [])};
+var select = $.NSPopUpButton.alloc.initWithFramePullsDown($.NSMakeRect(0,5,640,32),false);
+domains.forEach(function(d){ select.addItemWithTitle(d); });
+view.addSubview(select);
+alert.accessoryView = view;
+var response = Number(alert.runModal) - 1000;
+var actions = ['refresh','previous','next','lock','unlock','revoke','close'];
+var result = {action: actions[response] || 'close'};
+if (result.action === 'revoke') {
+  var index = Number(select.indexOfSelectedItem);
+  if (index < 0 || index >= domains.length) result.action = 'refresh';
+  else result.domain = domains[index];
+}
+$.NSFileHandle.fileHandleWithStandardOutput.writeData(
+ $.NSString.alloc.initWithString(JSON.stringify(result)).dataUsingEncoding($.NSUTF8StringEncoding));
+$.exit(0);
 `;
 }

package/dist/platform/windows/assets/auth-src.js

@@ -1,191 +1,191 @@
-export const AUTH_HELPER_CSHARP = `using System;
-using System.Diagnostics;
-using System.Runtime.InteropServices;
-using System.Security.Principal;
-
-namespace UChan.Platform.Windows.Assets
-{
-    public static class AuthHelper
-    {
-        private const uint PROCESS_QUERY_INFORMATION = 0x0400;
-        private const uint PROCESS_QUERY_LIMITED_INFORMATION = 0x1000;
-        private const uint PROCESS_DUP_HANDLE = 0x0040;
-        private const uint TOKEN_QUERY = 0x0008;
-        private const uint DUPLICATE_SAME_ACCESS = 0x0002;
-
-        [DllImport("kernel32.dll", SetLastError = true)]
-        private static extern IntPtr GetCurrentProcess();
-
-        [DllImport("kernel32.dll", SetLastError = true)]
-        private static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, uint processId);
-
-        [DllImport("kernel32.dll", SetLastError = true)]
-        private static extern bool DuplicateHandle(
-            IntPtr hSourceProcessHandle,
-            IntPtr hSourceHandle,
-            IntPtr hTargetProcessHandle,
-            out IntPtr lpTargetHandle,
-            uint dwDesiredAccess,
-            bool bInheritHandle,
-            uint dwOptions);
-
-        [DllImport("kernel32.dll", SetLastError = true)]
-        private static extern bool GetNamedPipeClientProcessId(IntPtr pipeHandle, out uint clientProcessId);
-
-        [DllImport("advapi32.dll", SetLastError = true)]
-        private static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);
-
-        [DllImport("kernel32.dll", SetLastError = true)]
-        private static extern bool CloseHandle(IntPtr hObject);
-
-        private static string GetProcessUserSid(uint pid)
-        {
-            IntPtr hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid);
-            if (hProcess == IntPtr.Zero)
-            {
-                hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, pid);
-            }
-            if (hProcess == IntPtr.Zero) return null;
-
-            try
-            {
-                IntPtr hToken;
-                if (!OpenProcessToken(hProcess, TOKEN_QUERY, out hToken))
-                {
-                    return null;
-                }
-
-                try
-                {
-                    using (WindowsIdentity identity = new WindowsIdentity(hToken))
-                    {
-                        if (identity.User != null)
-                        {
-                            return identity.User.Value;
-                        }
-                    }
-                }
-                finally
-                {
-                    CloseHandle(hToken);
-                }
-            }
-            finally
-            {
-                CloseHandle(hProcess);
-            }
-            return null;
-        }
-
-        public static int Main(string[] args)
-        {
-            if (args.Length < 1)
-            {
-                Console.Error.WriteLine("Usage: auth-helper <serverPid> [targetSid]");
-                return 1;
-            }
-
-            uint serverPid;
-            if (!uint.TryParse(args[0], out serverPid))
-            {
-                Console.Error.WriteLine("Invalid server PID");
-                return 1;
-            }
-
-            string targetSid = args.Length > 1 ? args[1] : null;
-            bool hasTargetSid = !string.IsNullOrEmpty(targetSid) && !string.Equals(targetSid, "dummy", StringComparison.OrdinalIgnoreCase);
-
-            long pipeHandle = 0;
-            if (args.Length > 2)
-            {
-                long.TryParse(args[2], out pipeHandle);
-            }
-
-            string matchedSid = null;
-            string fallbackNonSystemSid = null;
-            string anySid = null;
-
-            IntPtr hServer = OpenProcess(PROCESS_DUP_HANDLE | PROCESS_QUERY_INFORMATION, false, serverPid);
-            if (hServer != IntPtr.Zero)
-            {
-                try
-                {
-                    // Exact handle of this connection when the server passes it; otherwise scan.
-                    int start = pipeHandle > 0 ? (int)pipeHandle : 4;
-                    int end = pipeHandle > 0 ? (int)pipeHandle + 4 : 0x10000;
-                    for (int h = start; h < end; h += 4)
-                    {
-                        IntPtr hLocal;
-                        if (DuplicateHandle(hServer, (IntPtr)h, GetCurrentProcess(), out hLocal, 0, false, DUPLICATE_SAME_ACCESS))
-                        {
-                            try
-                            {
-                                uint candidatePid;
-                                if (GetNamedPipeClientProcessId(hLocal, out candidatePid) && candidatePid != 0 && candidatePid != serverPid)
-                                {
-                                    string sid = GetProcessUserSid(candidatePid);
-                                    if (!string.IsNullOrEmpty(sid))
-                                    {
-                                        if (hasTargetSid && string.Equals(sid, targetSid, StringComparison.OrdinalIgnoreCase))
-                                        {
-                                            matchedSid = sid;
-                                            break;
-                                        }
-
-                                        if (!string.Equals(sid, "S-1-5-18", StringComparison.OrdinalIgnoreCase))
-                                        {
-                                            fallbackNonSystemSid = sid;
-                                        }
-
-                                        if (anySid == null)
-                                        {
-                                            anySid = sid;
-                                        }
-                                    }
-                                }
-                            }
-                            finally
-                            {
-                                CloseHandle(hLocal);
-                            }
-                        }
-                    }
-                }
-                finally
-                {
-                    CloseHandle(hServer);
-                }
-            }
-
-            string clientSid = matchedSid ?? fallbackNonSystemSid ?? anySid;
-
-            // Fail closed: if clientSid could not be identified on any pipe handle, reject
-            if (string.IsNullOrEmpty(clientSid))
-            {
-                Console.Error.WriteLine("Could not identify client process on pipe");
-                return 1;
-            }
-
-            // Verify string sid parses as SecurityIdentifier
-            try
-            {
-                SecurityIdentifier secId = new SecurityIdentifier(clientSid);
-            }
-            catch
-            {
-                Console.Error.WriteLine("Resolved SID is invalid");
-                return 1;
-            }
-
-            if (hasTargetSid && !string.Equals(clientSid, targetSid, StringComparison.OrdinalIgnoreCase))
-            {
-                Console.Error.WriteLine("SID mismatch: expected " + targetSid + " but got " + clientSid);
-                return 1;
-            }
-
-            Console.WriteLine("AUTHORIZED:" + clientSid);
-            return 0;
-        }
-    }
-}
+export const AUTH_HELPER_CSHARP = `using System;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+
+namespace UChan.Platform.Windows.Assets
+{
+    public static class AuthHelper
+    {
+        private const uint PROCESS_QUERY_INFORMATION = 0x0400;
+        private const uint PROCESS_QUERY_LIMITED_INFORMATION = 0x1000;
+        private const uint PROCESS_DUP_HANDLE = 0x0040;
+        private const uint TOKEN_QUERY = 0x0008;
+        private const uint DUPLICATE_SAME_ACCESS = 0x0002;
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        private static extern IntPtr GetCurrentProcess();
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        private static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, uint processId);
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        private static extern bool DuplicateHandle(
+            IntPtr hSourceProcessHandle,
+            IntPtr hSourceHandle,
+            IntPtr hTargetProcessHandle,
+            out IntPtr lpTargetHandle,
+            uint dwDesiredAccess,
+            bool bInheritHandle,
+            uint dwOptions);
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        private static extern bool GetNamedPipeClientProcessId(IntPtr pipeHandle, out uint clientProcessId);
+
+        [DllImport("advapi32.dll", SetLastError = true)]
+        private static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);
+
+        [DllImport("kernel32.dll", SetLastError = true)]
+        private static extern bool CloseHandle(IntPtr hObject);
+
+        private static string GetProcessUserSid(uint pid)
+        {
+            IntPtr hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid);
+            if (hProcess == IntPtr.Zero)
+            {
+                hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, pid);
+            }
+            if (hProcess == IntPtr.Zero) return null;
+
+            try
+            {
+                IntPtr hToken;
+                if (!OpenProcessToken(hProcess, TOKEN_QUERY, out hToken))
+                {
+                    return null;
+                }
+
+                try
+                {
+                    using (WindowsIdentity identity = new WindowsIdentity(hToken))
+                    {
+                        if (identity.User != null)
+                        {
+                            return identity.User.Value;
+                        }
+                    }
+                }
+                finally
+                {
+                    CloseHandle(hToken);
+                }
+            }
+            finally
+            {
+                CloseHandle(hProcess);
+            }
+            return null;
+        }
+
+        public static int Main(string[] args)
+        {
+            if (args.Length < 1)
+            {
+                Console.Error.WriteLine("Usage: auth-helper <serverPid> [targetSid]");
+                return 1;
+            }
+
+            uint serverPid;
+            if (!uint.TryParse(args[0], out serverPid))
+            {
+                Console.Error.WriteLine("Invalid server PID");
+                return 1;
+            }
+
+            string targetSid = args.Length > 1 ? args[1] : null;
+            bool hasTargetSid = !string.IsNullOrEmpty(targetSid) && !string.Equals(targetSid, "dummy", StringComparison.OrdinalIgnoreCase);
+
+            long pipeHandle = 0;
+            if (args.Length > 2)
+            {
+                long.TryParse(args[2], out pipeHandle);
+            }
+
+            string matchedSid = null;
+            string fallbackNonSystemSid = null;
+            string anySid = null;
+
+            IntPtr hServer = OpenProcess(PROCESS_DUP_HANDLE | PROCESS_QUERY_INFORMATION, false, serverPid);
+            if (hServer != IntPtr.Zero)
+            {
+                try
+                {
+                    // Exact handle of this connection when the server passes it; otherwise scan.
+                    int start = pipeHandle > 0 ? (int)pipeHandle : 4;
+                    int end = pipeHandle > 0 ? (int)pipeHandle + 4 : 0x10000;
+                    for (int h = start; h < end; h += 4)
+                    {
+                        IntPtr hLocal;
+                        if (DuplicateHandle(hServer, (IntPtr)h, GetCurrentProcess(), out hLocal, 0, false, DUPLICATE_SAME_ACCESS))
+                        {
+                            try
+                            {
+                                uint candidatePid;
+                                if (GetNamedPipeClientProcessId(hLocal, out candidatePid) && candidatePid != 0 && candidatePid != serverPid)
+                                {
+                                    string sid = GetProcessUserSid(candidatePid);
+                                    if (!string.IsNullOrEmpty(sid))
+                                    {
+                                        if (hasTargetSid && string.Equals(sid, targetSid, StringComparison.OrdinalIgnoreCase))
+                                        {
+                                            matchedSid = sid;
+                                            break;
+                                        }
+
+                                        if (!string.Equals(sid, "S-1-5-18", StringComparison.OrdinalIgnoreCase))
+                                        {
+                                            fallbackNonSystemSid = sid;
+                                        }
+
+                                        if (anySid == null)
+                                        {
+                                            anySid = sid;
+                                        }
+                                    }
+                                }
+                            }
+                            finally
+                            {
+                                CloseHandle(hLocal);
+                            }
+                        }
+                    }
+                }
+                finally
+                {
+                    CloseHandle(hServer);
+                }
+            }
+
+            string clientSid = matchedSid ?? fallbackNonSystemSid ?? anySid;
+
+            // Fail closed: if clientSid could not be identified on any pipe handle, reject
+            if (string.IsNullOrEmpty(clientSid))
+            {
+                Console.Error.WriteLine("Could not identify client process on pipe");
+                return 1;
+            }
+
+            // Verify string sid parses as SecurityIdentifier
+            try
+            {
+                SecurityIdentifier secId = new SecurityIdentifier(clientSid);
+            }
+            catch
+            {
+                Console.Error.WriteLine("Resolved SID is invalid");
+                return 1;
+            }
+
+            if (hasTargetSid && !string.Equals(clientSid, targetSid, StringComparison.OrdinalIgnoreCase))
+            {
+                Console.Error.WriteLine("SID mismatch: expected " + targetSid + " but got " + clientSid);
+                return 1;
+            }
+
+            Console.WriteLine("AUTHORIZED:" + clientSid);
+            return 0;
+        }
+    }
+}
 `;

package/dist/platform/windows/assets/service-src.js

@@ -1,148 +1,148 @@
-export const SERVICE_HOST_CSHARP = `using System;
-using System.Diagnostics;
-using System.ServiceProcess;
-using System.Threading;
-
-namespace UChan.Platform.Windows.Assets
-{
-    public class UChanService : ServiceBase
-    {
-        private Process _process;
-        private readonly string[] _args;
-        private volatile bool _stopping;
-        private string _targetExe;
-        private string _targetArgs;
-
-        public UChanService(string[] args)
-        {
-            ServiceName = "UChanSecrets";
-            _args = args;
-        }
-
-        protected override void OnStart(string[] args)
-        {
-            _stopping = false;
-            string[] effectiveArgs = (args != null && args.Length > 0) ? args : _args;
-            string targetExe = null;
-            string targetArgs = "";
-
-            if (effectiveArgs != null && effectiveArgs.Length > 0)
-            {
-                targetExe = effectiveArgs[0];
-                if (effectiveArgs.Length > 1)
-                {
-                    string[] rest = new string[effectiveArgs.Length - 1];
-                    Array.Copy(effectiveArgs, 1, rest, 0, rest.Length);
-                    targetArgs = string.Join(" ", rest);
-                }
-            }
-            else
-            {
-                string baseDir = AppDomain.CurrentDomain.BaseDirectory;
-                string targetFile = System.IO.Path.Combine(baseDir, "service-target.txt");
-                if (System.IO.File.Exists(targetFile))
-                {
-                    string[] lines = System.IO.File.ReadAllLines(targetFile);
-                    if (lines.Length > 0)
-                    {
-                        targetExe = lines[0].Trim();
-                        if (lines.Length > 1)
-                        {
-                            targetArgs = lines[1].Trim();
-                        }
-                    }
-                }
-            }
-
-            if (string.IsNullOrEmpty(targetExe))
-            {
-                throw new InvalidOperationException("No target executable specified for UChanSecrets service.");
-            }
-
-            _targetExe = targetExe;
-            _targetArgs = targetArgs;
-            StartChild();
-        }
-
-        private void StartChild()
-        {
-            if (_stopping) return;
-            ProcessStartInfo psi = new ProcessStartInfo();
-            psi.FileName = _targetExe;
-            psi.Arguments = _targetArgs;
-            psi.UseShellExecute = false;
-            psi.CreateNoWindow = true;
-
-            string baseDir = AppDomain.CurrentDomain.BaseDirectory;
-
-            string logFile = System.IO.Path.GetFullPath(System.IO.Path.Combine(baseDir, "..", "service.log"));
-            psi.RedirectStandardOutput = true;
-            psi.RedirectStandardError = true;
-
-            Process proc = new Process();
-            proc.StartInfo = psi;
-            proc.EnableRaisingEvents = true;
-            proc.OutputDataReceived += (s, e) => {
-                if (!string.IsNullOrEmpty(e.Data)) {
-                    try { System.IO.File.AppendAllText(logFile, string.Format("[{0:s}] {1}", DateTime.Now, e.Data) + Environment.NewLine); } catch {}
-                }
-            };
-            proc.ErrorDataReceived += (s, e) => {
-                if (!string.IsNullOrEmpty(e.Data)) {
-                    try { System.IO.File.AppendAllText(logFile, string.Format("[{0:s}] [ERR] {1}", DateTime.Now, e.Data) + Environment.NewLine); } catch {}
-                }
-            };
-            proc.Exited += OnChildExited;
-            proc.Start();
-            proc.BeginOutputReadLine();
-            proc.BeginErrorReadLine();
-            _process = proc;
-        }
-
-        private void OnChildExited(object sender, EventArgs e)
-        {
-            if (_stopping) return;
-            Thread.Sleep(500);
-            if (_stopping) return;
-            try
-            {
-                StartChild();
-            }
-            catch
-            {
-            }
-        }
-
-        protected override void OnStop()
-        {
-            _stopping = true;
-            if (_process != null && !_process.HasExited)
-            {
-                try
-                {
-                    Process killer = Process.Start("taskkill.exe", string.Format("/F /T /PID {0}", _process.Id));
-                    if (killer != null)
-                    {
-                        killer.WaitForExit(5000);
-                    }
-                }
-                catch
-                {
-                    try
-                    {
-                        _process.Kill();
-                    }
-                    catch
-                    {
-                    }
-                }
-            }
-        }
-
-        public static void Main(string[] args)
-        {
-            ServiceBase.Run(new UChanService(args));
-        }
-    }
-}
+export const SERVICE_HOST_CSHARP = `using System;
+using System.Diagnostics;
+using System.ServiceProcess;
+using System.Threading;
+
+namespace UChan.Platform.Windows.Assets
+{
+    public class UChanService : ServiceBase
+    {
+        private Process _process;
+        private readonly string[] _args;
+        private volatile bool _stopping;
+        private string _targetExe;
+        private string _targetArgs;
+
+        public UChanService(string[] args)
+        {
+            ServiceName = "UChanSecrets";
+            _args = args;
+        }
+
+        protected override void OnStart(string[] args)
+        {
+            _stopping = false;
+            string[] effectiveArgs = (args != null && args.Length > 0) ? args : _args;
+            string targetExe = null;
+            string targetArgs = "";
+
+            if (effectiveArgs != null && effectiveArgs.Length > 0)
+            {
+                targetExe = effectiveArgs[0];
+                if (effectiveArgs.Length > 1)
+                {
+                    string[] rest = new string[effectiveArgs.Length - 1];
+                    Array.Copy(effectiveArgs, 1, rest, 0, rest.Length);
+                    targetArgs = string.Join(" ", rest);
+                }
+            }
+            else
+            {
+                string baseDir = AppDomain.CurrentDomain.BaseDirectory;
+                string targetFile = System.IO.Path.Combine(baseDir, "service-target.txt");
+                if (System.IO.File.Exists(targetFile))
+                {
+                    string[] lines = System.IO.File.ReadAllLines(targetFile);
+                    if (lines.Length > 0)
+                    {
+                        targetExe = lines[0].Trim();
+                        if (lines.Length > 1)
+                        {
+                            targetArgs = lines[1].Trim();
+                        }
+                    }
+                }
+            }
+
+            if (string.IsNullOrEmpty(targetExe))
+            {
+                throw new InvalidOperationException("No target executable specified for UChanSecrets service.");
+            }
+
+            _targetExe = targetExe;
+            _targetArgs = targetArgs;
+            StartChild();
+        }
+
+        private void StartChild()
+        {
+            if (_stopping) return;
+            ProcessStartInfo psi = new ProcessStartInfo();
+            psi.FileName = _targetExe;
+            psi.Arguments = _targetArgs;
+            psi.UseShellExecute = false;
+            psi.CreateNoWindow = true;
+
+            string baseDir = AppDomain.CurrentDomain.BaseDirectory;
+
+            string logFile = System.IO.Path.GetFullPath(System.IO.Path.Combine(baseDir, "..", "service.log"));
+            psi.RedirectStandardOutput = true;
+            psi.RedirectStandardError = true;
+
+            Process proc = new Process();
+            proc.StartInfo = psi;
+            proc.EnableRaisingEvents = true;
+            proc.OutputDataReceived += (s, e) => {
+                if (!string.IsNullOrEmpty(e.Data)) {
+                    try { System.IO.File.AppendAllText(logFile, string.Format("[{0:s}] {1}", DateTime.Now, e.Data) + Environment.NewLine); } catch {}
+                }
+            };
+            proc.ErrorDataReceived += (s, e) => {
+                if (!string.IsNullOrEmpty(e.Data)) {
+                    try { System.IO.File.AppendAllText(logFile, string.Format("[{0:s}] [ERR] {1}", DateTime.Now, e.Data) + Environment.NewLine); } catch {}
+                }
+            };
+            proc.Exited += OnChildExited;
+            proc.Start();
+            proc.BeginOutputReadLine();
+            proc.BeginErrorReadLine();
+            _process = proc;
+        }
+
+        private void OnChildExited(object sender, EventArgs e)
+        {
+            if (_stopping) return;
+            Thread.Sleep(500);
+            if (_stopping) return;
+            try
+            {
+                StartChild();
+            }
+            catch
+            {
+            }
+        }
+
+        protected override void OnStop()
+        {
+            _stopping = true;
+            if (_process != null && !_process.HasExited)
+            {
+                try
+                {
+                    Process killer = Process.Start("taskkill.exe", string.Format("/F /T /PID {0}", _process.Id));
+                    if (killer != null)
+                    {
+                        killer.WaitForExit(5000);
+                    }
+                }
+                catch
+                {
+                    try
+                    {
+                        _process.Kill();
+                    }
+                    catch
+                    {
+                    }
+                }
+            }
+        }
+
+        public static void Main(string[] args)
+        {
+            ServiceBase.Run(new UChanService(args));
+        }
+    }
+}
 `;

package/dist/service/update/verifier.js

@@ -1,8 +1,9 @@
 import crypto from 'node:crypto';
-export const DEFAULT_NPM_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3/MAFFxXKHiIkQO5cJ3Yhl5i
-6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg==
+export const DEFAULT_NPM_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+H
+OKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g==
 -----END PUBLIC KEY-----`;
+export const DEFAULT_NPM_KEY_ID = 'SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U';
 export function parseSemver(v) {
     const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(v.trim());
     if (!m)
@@ -91,14 +92,14 @@ export class NpmPackageVerifier {
     packageName;
     registryUrl;
     npmPublicKey;
-    requireSignature;
+    npmKeyId;
     expectedRepo;
     fetcher;
     constructor(opts = {}) {
         this.packageName = opts.packageName ?? 'u-chan-secrets';
         this.registryUrl = (opts.registryUrl ?? 'https://registry.npmjs.org').replace(/\/$/, '');
         this.npmPublicKey = opts.npmPublicKey ?? DEFAULT_NPM_PUBLIC_KEY;
-        this.requireSignature = opts.npmPublicKey !== undefined;
+        this.npmKeyId = opts.npmPublicKey === undefined ? DEFAULT_NPM_KEY_ID : undefined;
         this.expectedRepo = opts.expectedRepo ?? 'https://github.com/anchuwithdeadline/u-chan-secrets';
         this.fetcher = opts.fetcher ?? globalThis.fetch;
     }
@@ -145,17 +146,18 @@ export class NpmPackageVerifier {
             }
             // 2. ECDSA signature check
             const hasSignatures = Array.isArray(dist.signatures) && dist.signatures.length > 0;
-            const hasAttestations = Boolean(dist.attestations?.url);
-            if (!hasSignatures && (this.requireSignature || !hasAttestations)) {
+            if (!hasSignatures) {
                 return { ok: false, error: 'registry signature verification failed' };
             }
-            if (hasSignatures && this.npmPublicKey) {
-                const signedStr = `${this.packageName}@${targetVersion}:${dist.shasum}`;
+            if (hasSignatures) {
+                const signedStr = `${this.packageName}@${targetVersion}:${dist.integrity}`;
                 const signedData = Buffer.from(signedStr, 'utf8');
                 let valid = false;
                 for (const s of dist.signatures) {
+                    if (this.npmKeyId && s.keyid !== this.npmKeyId)
+                        continue;
                     try {
-                        if (crypto.verify(null, signedData, this.npmPublicKey, Buffer.from(s.sig, 'base64'))) {
+                        if (crypto.verify('sha256', signedData, this.npmPublicKey, Buffer.from(s.sig, 'base64'))) {
                             valid = true;
                             break;
                         }
@@ -167,6 +169,7 @@ export class NpmPackageVerifier {
                 }
             }
             // 3. Provenance check
+            // Repository metadata is an additional policy check, never a substitute for a valid signature.
             if (dist.attestations?.url) {
                 const attRes = await this.fetcher(dist.attestations.url);
                 if (!attRes.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u-chan-secrets",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "description": "U-Chan Secrets: local MCP server for Bitwarden-backed logins",
   "license": "MIT",
   "type": "module",

package/scripts/debug-install.bat

@@ -1,69 +1,69 @@
-@echo off
-setlocal
-set ROOT=%~dp0..
-
-fltmc.exe >nul 2>&1
-if %errorlevel% neq 0 (
-    echo [*] Requesting Administrator elevation...
-    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
-    exit /b
-)
-
-cd /d "%ROOT%"
-echo ========================================================
-echo       U-Chan Secrets V2 Installation & Setup
-echo ========================================================
-echo.
-echo [*] Step 1: Stopping previous service (if any)...
-taskkill /F /IM prompt-helper.exe >nul 2>&1
-taskkill /F /IM auth-helper.exe >nul 2>&1
-call node dist\cli.js uninstall
-echo.
-echo [*] Step 2: Installing U-Chan Windows Service...
-call node dist\cli.js install
-if %errorlevel% neq 0 (
-    echo.
-    echo [X] Installation failed with exit code %errorlevel%.
-    pause
-    exit /b %errorlevel%
-)
-icacls C:\ProgramData\u-chan-secrets\bin /grant "Users:(OI)(CI)RX" >nul 2>&1
-echo.
-echo [*] Step 3: Checking service status...
-sc.exe query u-chan-secrets
-echo.
-
-echo [*] Step 4: Bitwarden Vault Login...
-set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
-set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
-if not exist "%BW_BIN%" (
-    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
-)
-
-if exist "%BW_BIN%" (
-    "%BW_BIN%" status > "%TEMP%\bw_stat.json" 2>&1
-    findstr /C:"\"unauthenticated\"" "%TEMP%\bw_stat.json" >nul 2>&1
-    if %errorlevel% equ 0 (
-        echo [!] Bitwarden is not logged in for the privileged service.
-        echo [*] Please log in to your Bitwarden vault below:
-        "%BW_BIN%" login
-    ) else (
-        echo [+] Bitwarden vault is already logged in.
-    )
-    del "%TEMP%\bw_stat.json" >nul 2>&1
-) else (
-    echo [!] Warning: bw.exe not found.
-)
-
-echo.
-copy /y C:\ProgramData\u-chan-secrets\service.log "%ROOT%\service-copy.log" >nul 2>&1
-copy /y C:\ProgramData\u-chan-secrets\settings.json "%ROOT%\settings-copy.json" >nul 2>&1
-echo ========================================================
-echo [+] Service and Bitwarden configuration complete!
-echo.
-echo Next: Close this window, open your normal terminal, and run:
-echo    u-chan import-v1
-echo    u-chan unlock
-echo ========================================================
-echo.
-pause
+@echo off
+setlocal
+set ROOT=%~dp0..
+
+fltmc.exe >nul 2>&1
+if %errorlevel% neq 0 (
+    echo [*] Requesting Administrator elevation...
+    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
+    exit /b
+)
+
+cd /d "%ROOT%"
+echo ========================================================
+echo       U-Chan Secrets V2 Installation & Setup
+echo ========================================================
+echo.
+echo [*] Step 1: Stopping previous service (if any)...
+taskkill /F /IM prompt-helper.exe >nul 2>&1
+taskkill /F /IM auth-helper.exe >nul 2>&1
+call node dist\cli.js uninstall
+echo.
+echo [*] Step 2: Installing U-Chan Windows Service...
+call node dist\cli.js install
+if %errorlevel% neq 0 (
+    echo.
+    echo [X] Installation failed with exit code %errorlevel%.
+    pause
+    exit /b %errorlevel%
+)
+icacls C:\ProgramData\u-chan-secrets\bin /grant "Users:(OI)(CI)RX" >nul 2>&1
+echo.
+echo [*] Step 3: Checking service status...
+sc.exe query u-chan-secrets
+echo.
+
+echo [*] Step 4: Bitwarden Vault Login...
+set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
+set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
+if not exist "%BW_BIN%" (
+    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
+)
+
+if exist "%BW_BIN%" (
+    "%BW_BIN%" status > "%TEMP%\bw_stat.json" 2>&1
+    findstr /C:"\"unauthenticated\"" "%TEMP%\bw_stat.json" >nul 2>&1
+    if %errorlevel% equ 0 (
+        echo [!] Bitwarden is not logged in for the privileged service.
+        echo [*] Please log in to your Bitwarden vault below:
+        "%BW_BIN%" login
+    ) else (
+        echo [+] Bitwarden vault is already logged in.
+    )
+    del "%TEMP%\bw_stat.json" >nul 2>&1
+) else (
+    echo [!] Warning: bw.exe not found.
+)
+
+echo.
+copy /y C:\ProgramData\u-chan-secrets\service.log "%ROOT%\service-copy.log" >nul 2>&1
+copy /y C:\ProgramData\u-chan-secrets\settings.json "%ROOT%\settings-copy.json" >nul 2>&1
+echo ========================================================
+echo [+] Service and Bitwarden configuration complete!
+echo.
+echo Next: Close this window, open your normal terminal, and run:
+echo    u-chan import-v1
+echo    u-chan unlock
+echo ========================================================
+echo.
+pause

package/scripts/login-bw.bat

@@ -1,21 +1,21 @@
-@echo off
-setlocal
-set ROOT=%~dp0..
-
-fltmc.exe >nul 2>&1
-if %errorlevel% neq 0 (
-    echo [*] Requesting Administrator elevation...
-    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
-    exit /b
-)
-
-set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
-set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
-if not exist "%BW_BIN%" (
-    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
-)
-
-echo [*] Logging in to Bitwarden for U-Chan Service Store...
-"%BW_BIN%" login
-echo.
-pause
+@echo off
+setlocal
+set ROOT=%~dp0..
+
+fltmc.exe >nul 2>&1
+if %errorlevel% neq 0 (
+    echo [*] Requesting Administrator elevation...
+    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
+    exit /b
+)
+
+set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
+set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
+if not exist "%BW_BIN%" (
+    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
+)
+
+echo [*] Logging in to Bitwarden for U-Chan Service Store...
+"%BW_BIN%" login
+echo.
+pause

package/scripts/migrate.bat

@@ -1,4 +1,4 @@
-@echo off
-setlocal
-call "%~dp0debug-install.bat" %*
-
+@echo off
+setlocal
+call "%~dp0debug-install.bat" %*
+

package/scripts/verify-windows-prompt-desktop.mjs

@@ -1,50 +1,50 @@
-// Run from a trusted administrator terminal after building and installing the service.
-// Exercises SYSTEM relay, desktop entry, restoration and reply transport without a password UI.
-import fs from 'node:fs/promises'
-import path from 'node:path'
-import { randomUUID } from 'node:crypto'
-import { promisify } from 'node:util'
-import { execFile } from 'node:child_process'
-import { compileCsharp } from '../dist/platform/windows/assets/compiler.js'
-import { PROMPT_HELPER_CSHARP } from '../dist/platform/windows/assets/prompt-src.js'
-import { defaultAdminCheck } from '../dist/platform/windows/install.js'
-import { setAdminOnlyAcl } from '../dist/platform/windows/acl.js'
-
-if (process.platform !== 'win32' || !await defaultAdminCheck()) throw new Error('Use a trusted Windows administrator terminal')
-const home = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'u-chan-secrets')
-const root = path.join(home, '#0 backup', 'desktop-probe-' + randomUUID())
-const task = 'UChanDesktopProbe-' + randomUUID()
-const exec = promisify(execFile)
-const powershell = script => exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], { windowsHide: true })
-const quote = value => "'" + value.replaceAll("'", "''") + "'"
-let registered = false
-try {
-  await fs.mkdir(root)
-  await setAdminOnlyAcl(root)
-  const trace = path.join(root, 'desktop-trace.txt')
-  if (!PROMPT_HELPER_CSHARP.includes('return RunDialog(args);') || !PROMPT_HELPER_CSHARP.includes('SwitchDesktop(original);')) throw new Error('Native probe hooks no longer match; no helper was run')
-  const source = PROMPT_HELPER_CSHARP
-    .replace('return RunDialog(args);', `File.AppendAllText(@"${trace}", "entered"+Environment.NewLine); return 0;`)
-    .replace('SwitchDesktop(original);', `if (SwitchDesktop(original)) File.AppendAllText(@"${trace}", "restored"+Environment.NewLine);`)
-  const helper = path.join(root, 'probe.exe')
-  await compileCsharp(source, helper, { outputType: 'WindowsApplication', referencedAssemblies: ['System.Windows.Forms.dll', 'System.Drawing.dll'] })
-  const output = path.join(root, 'result.json'), runner = path.join(root, 'runner.mjs')
-  await fs.writeFile(runner, `import{execFile}from'node:child_process';import fs from'node:fs';execFile(${JSON.stringify(helper)},['--mode','confirm','--phrase','DISPOSABLE-NATIVE-PROBE','--lines','[]'],{timeout:35000,windowsHide:true},(e,out)=>fs.writeFileSync(${JSON.stringify(output)},JSON.stringify({exitCode:e?.code??0,stdoutBytes:Buffer.byteLength(out)})));`)
-  await setAdminOnlyAcl(root)
-  await powershell(`$ErrorActionPreference='Stop';$a=New-ScheduledTaskAction -Execute ${quote(path.join(home, 'bin', 'node.exe'))} -Argument ${quote('"' + runner + '"')};$p=New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest;$s=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 2) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries;Register-ScheduledTask -TaskName ${quote(task)} -Action $a -Principal $p -Settings $s | Out-Null`)
-  registered = true
-  await powershell(`Start-ScheduledTask -TaskName ${quote(task)}`)
-  const deadline = Date.now() + 60000
-  let execution
-  while (Date.now() < deadline) {
-    try { execution = JSON.parse(await fs.readFile(output, 'utf8')); break }
-    catch (e) { if (e.code !== 'ENOENT') throw e }
-    await new Promise(resolve => setTimeout(resolve, 500))
-  }
-  const events = await fs.readFile(trace, 'utf8').catch(() => '')
-  const ok = execution?.exitCode === 0 && execution.stdoutBytes === 0 && events.trim() === 'entered\r\nrestored'
-  console.log(JSON.stringify({ ok, nativeDryRun: true, desktopEntered: events.includes('entered'), desktopRestored: events.includes('restored'), execution, evidence: root }))
-  if (!ok) process.exitCode = 1
-} finally {
-  if (registered) await powershell(`Stop-ScheduledTask -TaskName ${quote(task)} -ErrorAction SilentlyContinue;Unregister-ScheduledTask -TaskName ${quote(task)} -Confirm:$false`)
-}
+// Run from a trusted administrator terminal after building and installing the service.
+// Exercises SYSTEM relay, desktop entry, restoration and reply transport without a password UI.
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { promisify } from 'node:util'
+import { execFile } from 'node:child_process'
+import { compileCsharp } from '../dist/platform/windows/assets/compiler.js'
+import { PROMPT_HELPER_CSHARP } from '../dist/platform/windows/assets/prompt-src.js'
+import { defaultAdminCheck } from '../dist/platform/windows/install.js'
+import { setAdminOnlyAcl } from '../dist/platform/windows/acl.js'
+
+if (process.platform !== 'win32' || !await defaultAdminCheck()) throw new Error('Use a trusted Windows administrator terminal')
+const home = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'u-chan-secrets')
+const root = path.join(home, '#0 backup', 'desktop-probe-' + randomUUID())
+const task = 'UChanDesktopProbe-' + randomUUID()
+const exec = promisify(execFile)
+const powershell = script => exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], { windowsHide: true })
+const quote = value => "'" + value.replaceAll("'", "''") + "'"
+let registered = false
+try {
+  await fs.mkdir(root)
+  await setAdminOnlyAcl(root)
+  const trace = path.join(root, 'desktop-trace.txt')
+  if (!PROMPT_HELPER_CSHARP.includes('return RunDialog(args);') || !PROMPT_HELPER_CSHARP.includes('SwitchDesktop(original);')) throw new Error('Native probe hooks no longer match; no helper was run')
+  const source = PROMPT_HELPER_CSHARP
+    .replace('return RunDialog(args);', `File.AppendAllText(@"${trace}", "entered"+Environment.NewLine); return 0;`)
+    .replace('SwitchDesktop(original);', `if (SwitchDesktop(original)) File.AppendAllText(@"${trace}", "restored"+Environment.NewLine);`)
+  const helper = path.join(root, 'probe.exe')
+  await compileCsharp(source, helper, { outputType: 'WindowsApplication', referencedAssemblies: ['System.Windows.Forms.dll', 'System.Drawing.dll'] })
+  const output = path.join(root, 'result.json'), runner = path.join(root, 'runner.mjs')
+  await fs.writeFile(runner, `import{execFile}from'node:child_process';import fs from'node:fs';execFile(${JSON.stringify(helper)},['--mode','confirm','--phrase','DISPOSABLE-NATIVE-PROBE','--lines','[]'],{timeout:35000,windowsHide:true},(e,out)=>fs.writeFileSync(${JSON.stringify(output)},JSON.stringify({exitCode:e?.code??0,stdoutBytes:Buffer.byteLength(out)})));`)
+  await setAdminOnlyAcl(root)
+  await powershell(`$ErrorActionPreference='Stop';$a=New-ScheduledTaskAction -Execute ${quote(path.join(home, 'bin', 'node.exe'))} -Argument ${quote('"' + runner + '"')};$p=New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest;$s=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 2) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries;Register-ScheduledTask -TaskName ${quote(task)} -Action $a -Principal $p -Settings $s | Out-Null`)
+  registered = true
+  await powershell(`Start-ScheduledTask -TaskName ${quote(task)}`)
+  const deadline = Date.now() + 60000
+  let execution
+  while (Date.now() < deadline) {
+    try { execution = JSON.parse(await fs.readFile(output, 'utf8')); break }
+    catch (e) { if (e.code !== 'ENOENT') throw e }
+    await new Promise(resolve => setTimeout(resolve, 500))
+  }
+  const events = await fs.readFile(trace, 'utf8').catch(() => '')
+  const ok = execution?.exitCode === 0 && execution.stdoutBytes === 0 && events.trim() === 'entered\r\nrestored'
+  console.log(JSON.stringify({ ok, nativeDryRun: true, desktopEntered: events.includes('entered'), desktopRestored: events.includes('restored'), execution, evidence: root }))
+  if (!ok) process.exitCode = 1
+} finally {
+  if (registered) await powershell(`Stop-ScheduledTask -TaskName ${quote(task)} -ErrorAction SilentlyContinue;Unregister-ScheduledTask -TaskName ${quote(task)} -Confirm:$false`)
+}