u-chan-secrets 3.0.2 → 4.0.0

package/dist/platform/windows/assets/service-src.js

@@ -1,148 +1,148 @@
-export const SERVICE_HOST_CSHARP = `using System;
-using System.Diagnostics;
-using System.ServiceProcess;
-using System.Threading;
-
-namespace UChan.Platform.Windows.Assets
-{
-    public class UChanService : ServiceBase
-    {
-        private Process _process;
-        private readonly string[] _args;
-        private volatile bool _stopping;
-        private string _targetExe;
-        private string _targetArgs;
-
-        public UChanService(string[] args)
-        {
-            ServiceName = "UChanSecrets";
-            _args = args;
-        }
-
-        protected override void OnStart(string[] args)
-        {
-            _stopping = false;
-            string[] effectiveArgs = (args != null && args.Length > 0) ? args : _args;
-            string targetExe = null;
-            string targetArgs = "";
-
-            if (effectiveArgs != null && effectiveArgs.Length > 0)
-            {
-                targetExe = effectiveArgs[0];
-                if (effectiveArgs.Length > 1)
-                {
-                    string[] rest = new string[effectiveArgs.Length - 1];
-                    Array.Copy(effectiveArgs, 1, rest, 0, rest.Length);
-                    targetArgs = string.Join(" ", rest);
-                }
-            }
-            else
-            {
-                string baseDir = AppDomain.CurrentDomain.BaseDirectory;
-                string targetFile = System.IO.Path.Combine(baseDir, "service-target.txt");
-                if (System.IO.File.Exists(targetFile))
-                {
-                    string[] lines = System.IO.File.ReadAllLines(targetFile);
-                    if (lines.Length > 0)
-                    {
-                        targetExe = lines[0].Trim();
-                        if (lines.Length > 1)
-                        {
-                            targetArgs = lines[1].Trim();
-                        }
-                    }
-                }
-            }
-
-            if (string.IsNullOrEmpty(targetExe))
-            {
-                throw new InvalidOperationException("No target executable specified for UChanSecrets service.");
-            }
-
-            _targetExe = targetExe;
-            _targetArgs = targetArgs;
-            StartChild();
-        }
-
-        private void StartChild()
-        {
-            if (_stopping) return;
-            ProcessStartInfo psi = new ProcessStartInfo();
-            psi.FileName = _targetExe;
-            psi.Arguments = _targetArgs;
-            psi.UseShellExecute = false;
-            psi.CreateNoWindow = true;
-
-            string baseDir = AppDomain.CurrentDomain.BaseDirectory;
-
-            string logFile = System.IO.Path.GetFullPath(System.IO.Path.Combine(baseDir, "..", "service.log"));
-            psi.RedirectStandardOutput = true;
-            psi.RedirectStandardError = true;
-
-            Process proc = new Process();
-            proc.StartInfo = psi;
-            proc.EnableRaisingEvents = true;
-            proc.OutputDataReceived += (s, e) => {
-                if (!string.IsNullOrEmpty(e.Data)) {
-                    try { System.IO.File.AppendAllText(logFile, string.Format("[{0:s}] {1}", DateTime.Now, e.Data) + Environment.NewLine); } catch {}
-                }
-            };
-            proc.ErrorDataReceived += (s, e) => {
-                if (!string.IsNullOrEmpty(e.Data)) {
-                    try { System.IO.File.AppendAllText(logFile, string.Format("[{0:s}] [ERR] {1}", DateTime.Now, e.Data) + Environment.NewLine); } catch {}
-                }
-            };
-            proc.Exited += OnChildExited;
-            proc.Start();
-            proc.BeginOutputReadLine();
-            proc.BeginErrorReadLine();
-            _process = proc;
-        }
-
-        private void OnChildExited(object sender, EventArgs e)
-        {
-            if (_stopping) return;
-            Thread.Sleep(500);
-            if (_stopping) return;
-            try
-            {
-                StartChild();
-            }
-            catch
-            {
-            }
-        }
-
-        protected override void OnStop()
-        {
-            _stopping = true;
-            if (_process != null && !_process.HasExited)
-            {
-                try
-                {
-                    Process killer = Process.Start("taskkill.exe", string.Format("/F /T /PID {0}", _process.Id));
-                    if (killer != null)
-                    {
-                        killer.WaitForExit(5000);
-                    }
-                }
-                catch
-                {
-                    try
-                    {
-                        _process.Kill();
-                    }
-                    catch
-                    {
-                    }
-                }
-            }
-        }
-
-        public static void Main(string[] args)
-        {
-            ServiceBase.Run(new UChanService(args));
-        }
-    }
-}
+export const SERVICE_HOST_CSHARP = `using System;
+using System.Diagnostics;
+using System.ServiceProcess;
+using System.Threading;
+
+namespace UChan.Platform.Windows.Assets
+{
+    public class UChanService : ServiceBase
+    {
+        private Process _process;
+        private readonly string[] _args;
+        private volatile bool _stopping;
+        private string _targetExe;
+        private string _targetArgs;
+
+        public UChanService(string[] args)
+        {
+            ServiceName = "UChanSecrets";
+            _args = args;
+        }
+
+        protected override void OnStart(string[] args)
+        {
+            _stopping = false;
+            string[] effectiveArgs = (args != null && args.Length > 0) ? args : _args;
+            string targetExe = null;
+            string targetArgs = "";
+
+            if (effectiveArgs != null && effectiveArgs.Length > 0)
+            {
+                targetExe = effectiveArgs[0];
+                if (effectiveArgs.Length > 1)
+                {
+                    string[] rest = new string[effectiveArgs.Length - 1];
+                    Array.Copy(effectiveArgs, 1, rest, 0, rest.Length);
+                    targetArgs = string.Join(" ", rest);
+                }
+            }
+            else
+            {
+                string baseDir = AppDomain.CurrentDomain.BaseDirectory;
+                string targetFile = System.IO.Path.Combine(baseDir, "service-target.txt");
+                if (System.IO.File.Exists(targetFile))
+                {
+                    string[] lines = System.IO.File.ReadAllLines(targetFile);
+                    if (lines.Length > 0)
+                    {
+                        targetExe = lines[0].Trim();
+                        if (lines.Length > 1)
+                        {
+                            targetArgs = lines[1].Trim();
+                        }
+                    }
+                }
+            }
+
+            if (string.IsNullOrEmpty(targetExe))
+            {
+                throw new InvalidOperationException("No target executable specified for UChanSecrets service.");
+            }
+
+            _targetExe = targetExe;
+            _targetArgs = targetArgs;
+            StartChild();
+        }
+
+        private void StartChild()
+        {
+            if (_stopping) return;
+            ProcessStartInfo psi = new ProcessStartInfo();
+            psi.FileName = _targetExe;
+            psi.Arguments = _targetArgs;
+            psi.UseShellExecute = false;
+            psi.CreateNoWindow = true;
+
+            string baseDir = AppDomain.CurrentDomain.BaseDirectory;
+
+            string logFile = System.IO.Path.GetFullPath(System.IO.Path.Combine(baseDir, "..", "service.log"));
+            psi.RedirectStandardOutput = true;
+            psi.RedirectStandardError = true;
+
+            Process proc = new Process();
+            proc.StartInfo = psi;
+            proc.EnableRaisingEvents = true;
+            proc.OutputDataReceived += (s, e) => {
+                if (!string.IsNullOrEmpty(e.Data)) {
+                    try { System.IO.File.AppendAllText(logFile, string.Format("[{0:s}] {1}", DateTime.Now, e.Data) + Environment.NewLine); } catch {}
+                }
+            };
+            proc.ErrorDataReceived += (s, e) => {
+                if (!string.IsNullOrEmpty(e.Data)) {
+                    try { System.IO.File.AppendAllText(logFile, string.Format("[{0:s}] [ERR] {1}", DateTime.Now, e.Data) + Environment.NewLine); } catch {}
+                }
+            };
+            proc.Exited += OnChildExited;
+            proc.Start();
+            proc.BeginOutputReadLine();
+            proc.BeginErrorReadLine();
+            _process = proc;
+        }
+
+        private void OnChildExited(object sender, EventArgs e)
+        {
+            if (_stopping) return;
+            Thread.Sleep(500);
+            if (_stopping) return;
+            try
+            {
+                StartChild();
+            }
+            catch
+            {
+            }
+        }
+
+        protected override void OnStop()
+        {
+            _stopping = true;
+            if (_process != null && !_process.HasExited)
+            {
+                try
+                {
+                    Process killer = Process.Start("taskkill.exe", string.Format("/F /T /PID {0}", _process.Id));
+                    if (killer != null)
+                    {
+                        killer.WaitForExit(5000);
+                    }
+                }
+                catch
+                {
+                    try
+                    {
+                        _process.Kill();
+                    }
+                    catch
+                    {
+                    }
+                }
+            }
+        }
+
+        public static void Main(string[] args)
+        {
+            ServiceBase.Run(new UChanService(args));
+        }
+    }
+}
 `;

package/dist/platform/windows/doctor.js

@@ -1,5 +1,7 @@
 import { commandState } from '../../core/doctor.js';
 export const checkWindowsRegistration = () => commandState('sc.exe', ['query', 'u-chan-secrets'], s => /SERVICE_NAME:\s*u-chan-secrets/i.test(s));
+export const checkWindowsUac = () => commandState('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+    "$p=Get-ItemProperty -LiteralPath 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System'; if($p.EnableLUA -eq 1 -and $p.ConsentPromptBehaviorAdmin -eq 2 -and $p.PromptOnSecureDesktop -eq 1){'SAFE'}else{'UNSAFE'}"], s => s.trim() === 'SAFE');
 export function checkWindowsPermissions(home) {
     const encoded = Buffer.from(home, 'utf8').toString('base64');
     const script = `$ErrorActionPreference='Stop'; $p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); $root=Get-Item -LiteralPath $p -Force; if($root.Attributes -band [IO.FileAttributes]::ReparsePoint){'UNSAFE';exit}; $items=@($root)+@(Get-ChildItem -LiteralPath $p -Force -Recurse); foreach($i in $items){if($i.Attributes -band [IO.FileAttributes]::ReparsePoint){'UNSAFE';exit}; $acl=$i.GetAccessControl(); $owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value; if($owner -notin @('S-1-5-18','S-1-5-32-544')){'UNSAFE';exit}; foreach($ace in $acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])){if($ace.AccessControlType -eq 'Allow' -and $ace.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544')){'UNSAFE';exit}} }; 'SAFE'`;

package/dist/service/control.js

@@ -14,7 +14,7 @@ export class ControlService {
         this.grants = d.grants ?? new GrantCoordinator(d.allowlist);
     }
     async capabilities() {
-        return { ok: true, message: JSON.stringify({ protocol: 3, features: ['doctor', 'success_conditions', 'grants'] }) };
+        return { ok: true, message: JSON.stringify({ protocol: 3, features: ['doctor', 'success_conditions', 'grants'], serviceVersion: this.d.serviceVersion }) };
     }
     async diagnose() {
         try {

package/dist/service/doctor.js

@@ -1,14 +1,14 @@
 import { lstat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { privateBrowserPath } from '../platform/runtime-assets.js';
-import { bounded } from '../core/doctor.js';
+import { bounded, chromeState, safeCdpOrigin } from '../core/doctor.js';
 import { checkWindowsPermissions } from '../platform/windows/doctor.js';
 import { checkDarwinPermissions } from '../platform/darwin/doctor.js';
-export async function diagnoseService(home, vault, platform) {
+export async function diagnoseService(home, vault, platform, cdpEndpoint) {
     const paths = [join(home, 'program', 'dist', 'service', 'main.js'), join(home, 'program', 'node_modules'),
         platform === 'win32' ? join(home, 'bin', 'node.exe') : process.execPath,
         platform === 'win32' ? join(home, 'bin', 'bw.exe') : join(home, 'bin', 'bw')];
-    const [assets, permissions, status] = await Promise.all([
+    const [assets, permissions, status, browser] = await Promise.all([
         bounded(async () => {
             await privateBrowserPath(home);
             for (const p of paths) {
@@ -20,6 +20,8 @@ export async function diagnoseService(home, vault, platform) {
         }, 'unknown'),
         bounded(() => platform === 'win32' ? checkWindowsPermissions(home) : checkDarwinPermissions(home), 'unknown', 20000),
         bounded(() => vault.status(), 'unavailable'),
+        cdpEndpoint === undefined ? undefined : bounded(() => chromeState(cdpEndpoint), 'unknown'),
     ]);
-    return { assets, permissions, vault: status === 'unlocked' ? 'pass' : status === 'unavailable' ? 'unknown' : status };
+    return { assets, permissions, vault: status === 'unlocked' ? 'pass' : status === 'unavailable' ? 'unknown' : status,
+        ...(cdpEndpoint === undefined ? {} : { browser, browserEndpoint: safeCdpOrigin(cdpEndpoint) }) };
 }

package/dist/service/main.js

@@ -24,6 +24,7 @@ import { GrantCoordinator } from './grants.js';
 import { ensureV3State } from './state.js';
 import { ManagementService } from './manage.js';
 import { privateBrowserPath } from '../platform/runtime-assets.js';
+import { safeVersion } from '../core/doctor.js';
 export function prepareSocketEndpoint(endpoint, platform = process.platform) {
     if (platform !== 'win32') {
         const dir = dirname(endpoint);
@@ -64,9 +65,9 @@ export async function runService(platform = process.platform, env = process.env)
             target: new CdpSessionTarget(new CdpBrowserProvider(loadConfig(env, platform).cdpEndpoint)),
         });
         const core = new CoreService({ vault, allowlist, grants, approver, audit, login, mode: () => approver.effectiveMode() });
-        let currentVersion = '3.0.0';
+        let currentVersion = 'unknown';
         try {
-            currentVersion = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version;
+            currentVersion = safeVersion(JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version) ?? 'unknown';
         }
         catch { }
         const verifier = new NpmPackageVerifier();
@@ -82,8 +83,8 @@ export async function runService(platform = process.platform, env = process.env)
             stagingDir: cfg.stagingDir,
             currentVersion,
         });
-        const diagnose = () => diagnoseService(cfg.home, vault, platform);
-        const control = new ControlService({ vault, approver, limiter, settings, allowlist, grants, audit, platform, updater, diagnose, manage: () => manager.open() });
+        const diagnose = async () => ({ ...await diagnoseService(cfg.home, vault, platform, loadConfig(env, platform).cdpEndpoint), serviceVersion: safeVersion(currentVersion) });
+        const control = new ControlService({ vault, approver, limiter, settings, allowlist, grants, audit, platform, updater, diagnose, serviceVersion: safeVersion(currentVersion), manage: () => manager.open() });
         const manager = new ManagementService({
             store: allowlist, grants, vault, audit, diagnose, phrase: async () => (await settings.get()).phrase,
             show: req => adapters.prompt.manage ? adapters.prompt.manage(req) : Promise.reject(new Error('unsupported')),

package/dist/service/manage.js

@@ -1,6 +1,6 @@
 import { performance } from 'node:perf_hooks';
 import { clean, normalizeDomain } from '../core/allowlist.js';
-import { bounded } from '../core/doctor.js';
+import { bounded, safeVersion, SERVICE_DIAGNOSTIC_TIMEOUT_MS } from '../core/doctor.js';
 export class ManagementService {
     d;
     opened = false;
@@ -19,12 +19,19 @@ export class ManagementService {
                 const snapshot = await this.d.grants.run(async () => {
                     const [entries, status, events, checks] = await Promise.all([
                         this.d.store.list(), bounded(() => this.d.vault.status(), 'unavailable'),
-                        bounded(() => this.d.audit.readTail(10), []), bounded(this.d.diagnose, null),
+                        bounded(() => this.d.audit.readTail(10), []), bounded(this.d.diagnose, null, SERVICE_DIAGNOSTIC_TIMEOUT_MS),
                     ]);
                     const all = entries.filter(e => e.domain === normalizeDomain(e.domain));
                     page = Math.min(page, Math.max(0, Math.ceil(all.length / 20) - 1));
                     const grants = all.slice(page * 20, page * 20 + 20);
                     const lines = ['Vault: ' + status, lastAction, 'Grant page ' + (page + 1) + ': ' + grants.length + ' of ' + entries.length + ' shown. Use Previous/Next for more.'];
+                    lines.push('Service version: ' + (safeVersion(checks?.serviceVersion) ?? 'unknown'), 'Service browser: ' + (['pass', 'fail'].includes(checks?.browser ?? '') ? checks?.browser : 'unknown'));
+                    if (status === 'locked')
+                        lines.push('Next step: use Unlock to approve a protected vault unlock.');
+                    if (checks?.assets !== 'pass' || checks?.permissions !== 'pass')
+                        lines.push('Next step: run u-chan doctor; repair from a trusted administrator terminal.');
+                    if (checks?.browser !== 'pass')
+                        lines.push('Next step: start dedicated Chrome and run u-chan setup.');
                     for (const e of grants) {
                         let label = e.expiresAt ? 'until ' + e.expiresAt : e.remainingUses !== undefined ? e.remainingUses + ' attempts remaining' : 'permanent';
                         try {

package/dist/service/update/verifier.js

@@ -1,8 +1,9 @@
 import crypto from 'node:crypto';
-export const DEFAULT_NPM_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3/MAFFxXKHiIkQO5cJ3Yhl5i
-6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg==
+export const DEFAULT_NPM_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+H
+OKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g==
 -----END PUBLIC KEY-----`;
+export const DEFAULT_NPM_KEY_ID = 'SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U';
 export function parseSemver(v) {
     const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(v.trim());
     if (!m)
@@ -91,14 +92,14 @@ export class NpmPackageVerifier {
     packageName;
     registryUrl;
     npmPublicKey;
-    requireSignature;
+    npmKeyId;
     expectedRepo;
     fetcher;
     constructor(opts = {}) {
         this.packageName = opts.packageName ?? 'u-chan-secrets';
         this.registryUrl = (opts.registryUrl ?? 'https://registry.npmjs.org').replace(/\/$/, '');
         this.npmPublicKey = opts.npmPublicKey ?? DEFAULT_NPM_PUBLIC_KEY;
-        this.requireSignature = opts.npmPublicKey !== undefined;
+        this.npmKeyId = opts.npmPublicKey === undefined ? DEFAULT_NPM_KEY_ID : undefined;
         this.expectedRepo = opts.expectedRepo ?? 'https://github.com/anchuwithdeadline/u-chan-secrets';
         this.fetcher = opts.fetcher ?? globalThis.fetch;
     }
@@ -145,17 +146,18 @@ export class NpmPackageVerifier {
             }
             // 2. ECDSA signature check
             const hasSignatures = Array.isArray(dist.signatures) && dist.signatures.length > 0;
-            const hasAttestations = Boolean(dist.attestations?.url);
-            if (!hasSignatures && (this.requireSignature || !hasAttestations)) {
+            if (!hasSignatures) {
                 return { ok: false, error: 'registry signature verification failed' };
             }
-            if (hasSignatures && this.npmPublicKey) {
-                const signedStr = `${this.packageName}@${targetVersion}:${dist.shasum}`;
+            if (hasSignatures) {
+                const signedStr = `${this.packageName}@${targetVersion}:${dist.integrity}`;
                 const signedData = Buffer.from(signedStr, 'utf8');
                 let valid = false;
                 for (const s of dist.signatures) {
+                    if (this.npmKeyId && s.keyid !== this.npmKeyId)
+                        continue;
                     try {
-                        if (crypto.verify(null, signedData, this.npmPublicKey, Buffer.from(s.sig, 'base64'))) {
+                        if (crypto.verify('sha256', signedData, this.npmPublicKey, Buffer.from(s.sig, 'base64'))) {
                             valid = true;
                             break;
                         }
@@ -167,6 +169,7 @@ export class NpmPackageVerifier {
                 }
             }
             // 3. Provenance check
+            // Repository metadata is an additional policy check, never a substitute for a valid signature.
             if (dist.attestations?.url) {
                 const attRes = await this.fetcher(dist.attestations.url);
                 if (!attRes.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u-chan-secrets",
-  "version": "3.0.2",
+  "version": "4.0.0",
   "description": "U-Chan Secrets: local MCP server for Bitwarden-backed logins",
   "license": "MIT",
   "type": "module",

package/scripts/start-chrome.ps1

@@ -1,7 +1,11 @@
+param([switch]$Background)
 $ErrorActionPreference = 'Stop'
 $home_ = if ($env:U_CHAN_HOME) { $env:U_CHAN_HOME } else { Join-Path $env:APPDATA 'u-chan-secrets' }
 $profileDir = Join-Path $home_ 'chrome-profile'   # dedicated profile, never the default Chrome profile
 $cdp = [Uri]$(if ($env:U_CHAN_CDP) { $env:U_CHAN_CDP } else { 'http://127.0.0.1:9222' })
+if ($cdp.Scheme -ne 'http' -or $cdp.Host -notin @('127.0.0.1', 'localhost', '[::1]', '::1') -or $cdp.UserInfo -or $cdp.AbsolutePath -ne '/' -or $cdp.Query -or $cdp.Fragment) {
+  throw 'Use an HTTP loopback CDP origin without user information, path, query or fragment.'
+}
 $port = $cdp.Port
 $bindHost = $cdp.Host
 
@@ -24,10 +28,12 @@ $chrome = $candidates | Where-Object { $_ -and (Test-Path $_) } | Select-Object
 if (-not $chrome) { throw 'chrome.exe not found' }
 
 New-Item -ItemType Directory -Force -Path $profileDir | Out-Null
-Start-Process -FilePath $chrome -ArgumentList @(
+$chromeArgs = @(
   "--remote-debugging-port=$port",
   "--remote-debugging-address=$bindHost",
-  "--user-data-dir=$profileDir",
+  "--user-data-dir=`"$profileDir`"",
   '--no-first-run'
 )
+if ($Background) { $chromeArgs += '--no-startup-window' }
+Start-Process -FilePath $chrome -ArgumentList $chromeArgs -WindowStyle Hidden
 Write-Host "Chrome started (profile: $profileDir, CDP: http://${bindHost}:$port)"