u-chan-secrets 3.0.2 → 4.0.0

package/scripts/verify-windows-adversarial.mjs

@@ -0,0 +1,142 @@
+// Two-stage disposable check: --prepare runs non-elevated; --run requires UAC approval.
+// No vault is unlocked and no real passwords, keyboard text or screenshots are recorded.
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import os from 'node:os'
+import { randomUUID } from 'node:crypto'
+import { spawn, execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { compileCsharp } from '../dist/platform/windows/assets/compiler.js'
+import { PROMPT_HELPER_CSHARP } from '../dist/platform/windows/assets/prompt-src.js'
+import { defaultAdminCheck } from '../dist/platform/windows/install.js'
+import { setAdminOnlyAcl } from '../dist/platform/windows/acl.js'
+import { accepted } from './windows-security/result-policy.mjs'
+
+if (process.platform !== 'win32') throw new Error('Windows required')
+const exec = promisify(execFile), command = process.argv[2], runIdArgument = process.argv[3]
+const quote = s => "'" + s.replaceAll("'", "''") + "'"
+const ps = script => exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], { windowsHide: true })
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
+const publicRoot = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'UChanSecurityChecks')
+async function createChannel(runId) {
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(runId ?? '')) throw new Error('Fresh run UUID required')
+  const directory = path.join(publicRoot, runId)
+  const channelScript = await fs.readFile(new URL('./windows-security/public-channel.ps1', import.meta.url), 'utf8')
+  await ps('$probePublicRoot=' + quote(publicRoot) + ';$probeRunDirectory=' + quote(directory) + ';' + channelScript)
+  return directory
+}
+async function publishReport(directory, report) {
+  const temporaryReport = path.join(directory, 'report.json.tmp')
+  await fs.writeFile(temporaryReport, JSON.stringify(report, null, 2), { flag: 'wx' })
+  await fs.rename(temporaryReport, path.join(directory, 'report.json'))
+}
+
+if (command === '--prepare') {
+  if (await defaultAdminCheck()) throw new Error('Prepare must run non-elevated')
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), 'u-chan-security-'))
+  const runId = randomUUID(), prefix = path.join(directory, 'probe'), publicDirectory = path.join(publicRoot, runId), publicPrefix = path.join(publicDirectory, 'probe'), attacker = path.join(directory, 'attacker.exe')
+  await compileCsharp(await fs.readFile(new URL('./windows-security/attacker.cs', import.meta.url), 'utf8'), attacker, { outputType: 'WindowsApplication', referencedAssemblies: ['System.Windows.Forms.dll', 'System.Drawing.dll'] })
+  const child = spawn(attacker, [publicPrefix, prefix, runId], { windowsHide: true, stdio: 'ignore' })
+  let spawnError
+  child.once('error', e => { spawnError = e })
+  const exited = new Promise(resolve => child.once('exit', resolve))
+  const config = { runId, prefix, attackerPid: child.pid, directory, publicDirectory }
+  await fs.writeFile(path.join(directory, 'config.json'), JSON.stringify(config))
+  const deadline = Date.now() + 5000
+  while (Date.now() < deadline) {
+    if (spawnError) throw spawnError
+    if (await fs.stat(prefix + '.armed').catch(() => null)) break
+    if (await fs.stat(prefix + '.attacker').catch(() => null)) throw new Error('Attacker positive control failed: ' + await fs.readFile(prefix + '.attacker', 'utf8'))
+    await sleep(100)
+  }
+  if (!await fs.stat(prefix + '.armed').catch(() => null)) throw new Error('Attacker did not arm')
+  // Keep the child referenced: run --run <runId> concurrently in a second, elevated terminal.
+  console.log(JSON.stringify({ ...config, armed: true, nextCommand: 'node scripts/verify-windows-adversarial.mjs --run ' + runId }))
+  await exited
+  const nativeReport = path.join(publicDirectory, 'report.json'), reportDeadline = Date.now() + 30000
+  while (Date.now() < reportDeadline && !await fs.stat(nativeReport).catch(() => null)) await sleep(100)
+  const native = JSON.parse(await fs.readFile(nativeReport, 'utf8'))
+  const observed = Object.fromEntries((await fs.readFile(prefix + '.attacker', 'utf8')).trim().split(/\r?\n/).map(line => line.split('=')))
+  const report = { ...native, attacker: observed, ok: accepted(native, observed, runId) }
+  await fs.writeFile(path.join(directory, 'report.json'), JSON.stringify(report, null, 2))
+  console.log(JSON.stringify(report))
+  if (!report.ok) process.exitCode = 1
+} else if (command === '--run') {
+  if (!await defaultAdminCheck()) throw new Error('Run requires administrator privileges')
+  const runId = runIdArgument
+  // Atomically create a read-public, admin/SYSTEM-write-only channel. Never read or write user-supplied paths while elevated.
+  const directory = await createChannel(runId), prefix = path.join(directory, 'probe')
+  const home = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'u-chan-secrets')
+  const root = path.join(home, '#0 backup', 'adversarial-' + randomUUID())
+  const task = 'UChanSecurityProbe-' + randomUUID()
+  const report = { ok: false, nativeFixture: true, root, runId }
+  let registered = false
+  try {
+    await fs.mkdir(root); await setAdminOnlyAcl(root)
+    const trace = path.join(root, 'trace.txt')
+    const metadata = prefix + '.metadata'
+    const head = 'public static class PromptHelper\n    {'
+    if (!PROMPT_HELPER_CSHARP.includes(head)) throw new Error('Fixture hooks no longer match')
+    let source = PROMPT_HELPER_CSHARP.replace(head, head + '\n        private static string ProbeDesktop; private static NamedPipeServerStream ProbeIdlePipe;')
+      .replace('desktop = CreateDesktop("UChan-" + Guid.NewGuid().ToString("N"),', 'ProbeDesktop="UChanProbe-"+Guid.NewGuid().ToString("N"); desktop = CreateDesktop(ProbeDesktop,')
+      .replace('int remainingSeconds = 120;', 'int remainingSeconds = 4;')
+      .replace('SwitchDesktop(original);', `if(SwitchDesktop(original)) File.AppendAllText(@"${trace}", "restored"+Environment.NewLine);`)
+    source = source.replace('timer.Start();\n                if (txtPassword != null)', `timer.Start();
+                string probePipe="";
+                for(int k=0;k+1<args.Length;k++)if(args[k]=="--output-pipe")probePipe=args[k+1];
+                File.AppendAllText(@"${trace}", "shown-system:"+WindowsIdentity.GetCurrent().IsSystem+";session:"+Process.GetCurrentProcess().SessionId+Environment.NewLine);
+                File.WriteAllLines(@"${metadata}",new string[]{ProbeDesktop,probePipe,form.Handle.ToInt64().ToString(),btnOk.Handle.ToInt64().ToString(),"${runId}",probePipe+"-idle"});
+                form.BeginInvoke((Action)delegate { form.Activate();btnOk.Focus();File.AppendAllText(@"${trace}","canary-send-count:"+UChanProbeCanary.Send()+Environment.NewLine); });
+                if (txtPassword != null)`)
+    source = source.replace('DialogResult result = form.ShowDialog();', `Panel probeMarker=new Panel(); probeMarker.BackColor=Color.FromArgb(1,254,71); probeMarker.Size=new Size(64,64); probeMarker.Location=new Point(0,0); form.Controls.Add(probeMarker); probeMarker.BringToFront();
+            form.KeyPreview=true; form.KeyDown+=(sender,eventArgs)=>{if(eventArgs.KeyCode==Keys.F24)File.AppendAllText(@"${trace}","protected-canary-received"+Environment.NewLine);};
+            DialogResult result = form.ShowDialog();`)
+    source = source.replace('List<string> childArgs = new List<string>(args);', `ProbeIdlePipe=new NamedPipeServerStream(name+"-idle",PipeDirection.In,1,PipeTransmissionMode.Byte,PipeOptions.Asynchronous,4096,4096,security);bool onlySystem=true;int systemRules=0;foreach(PipeAccessRule rule in pipe.GetAccessControl().GetAccessRules(true,true,typeof(SecurityIdentifier))){if(rule.AccessControlType==AccessControlType.Allow){systemRules++;if(rule.IdentityReference.Value!="S-1-5-18")onlySystem=false;}}File.AppendAllText(@"${trace}","pipe-system-only:"+(onlySystem&&systemRules>0)+Environment.NewLine);List<string> childArgs = new List<string>(args);`)
+    source += '\n' + await fs.readFile(new URL('./windows-security/canary.cs', import.meta.url), 'utf8')
+    if (!source.includes('shown-system:') || source.includes('int remainingSeconds = 120;')) throw new Error('Fixture substitution failed')
+    const attacked = path.join(root, 'attacked.exe'), failure = path.join(root, 'failure.exe')
+    await compileCsharp(source, attacked, { outputType: 'WindowsApplication', referencedAssemblies: ['System.Windows.Forms.dll', 'System.Drawing.dll'] })
+    const failing = PROMPT_HELPER_CSHARP
+      .replace('return RunDialog(args);', 'throw new InvalidOperationException("Disposable failure fixture");')
+      .replace('SwitchDesktop(original);', `if(SwitchDesktop(original)) File.AppendAllText(@"${trace}","failure-restored"+Environment.NewLine);`)
+    await compileCsharp(failing, failure, { outputType: 'WindowsApplication', referencedAssemblies: ['System.Windows.Forms.dll', 'System.Drawing.dll'] })
+    const output = path.join(root, 'native-result.json'), runner = path.join(root, 'runner.mjs')
+    await fs.writeFile(runner, `import{execFile}from'node:child_process';import fs from'node:fs';import{promisify}from'node:util';const exec=promisify(execFile);const results={};for(const[name,file]of ${JSON.stringify([['attacked', attacked], ['failure', failure]])}){const start=Date.now();try{const r=await exec(file,['--mode','confirm','--title','DISPOSABLE SECURITY TEST - DO NOT INTERACT','--phrase','DISPOSABLE TEST - NO PASSWORD','--lines','[]'],{timeout:20000,windowsHide:true});results[name]={exitCode:0,stdoutBytes:Buffer.byteLength(r.stdout),elapsedMs:Date.now()-start};}catch(e){results[name]={exitCode:e.code,stdoutBytes:Buffer.byteLength(e.stdout??''),elapsedMs:Date.now()-start};}if(name==='attacked')fs.writeFileSync(${JSON.stringify(prefix + '.done')},'done');}fs.writeFileSync(${JSON.stringify(output)},JSON.stringify(results));`)
+    await setAdminOnlyAcl(root)
+    await ps(`$ErrorActionPreference='Stop';$a=New-ScheduledTaskAction -Execute ${quote(path.join(home, 'bin', 'node.exe'))} -Argument ${quote('"' + runner + '"')} -WorkingDirectory ${quote(root)};$p=New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest;$s=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 2) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries;Register-ScheduledTask -TaskName ${quote(task)} -Action $a -Principal $p -Settings $s | Out-Null`)
+    registered = true
+    await ps(`Start-ScheduledTask -TaskName ${quote(task)}`)
+    const deadline = Date.now() + 60000
+    while (Date.now() < deadline && !await fs.stat(output).catch(() => null)) await sleep(200)
+    report.execution = JSON.parse(await fs.readFile(output, 'utf8'))
+    report.events = (await fs.readFile(trace, 'utf8')).trim().split(/\r?\n/)
+    report.ok = report.execution.attacked.exitCode === 1 && report.execution.attacked.elapsedMs >= 3500 && report.execution.attacked.stdoutBytes === 0 && report.execution.failure.exitCode === 1 && report.events.some(e => e.startsWith('shown-system:True;session:')) && report.events.includes('protected-canary-received') && report.events.includes('pipe-system-only:True') && report.events.includes('restored') && report.events.includes('failure-restored')
+  } catch (e) { report.errorType = e.name; report.errorMessage = String(e.message).slice(0, 300) }
+  finally { if (registered) await ps(`Stop-ScheduledTask -TaskName ${quote(task)} -ErrorAction SilentlyContinue;Unregister-ScheduledTask -TaskName ${quote(task)} -Confirm:$false`) }
+  await publishReport(directory, report)
+  console.log(JSON.stringify(report))
+  if (!report.ok) process.exitCode = 1
+} else if (command === '--browser') {
+  if (!await defaultAdminCheck()) throw new Error('Browser fixture requires administrator privileges')
+  const publicDirectory = await createChannel(runIdArgument ?? randomUUID())
+  const home = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'u-chan-secrets')
+  const root = path.join(home, '#0 backup', 'browser-probe-' + randomUUID()), task = 'UChanBrowserProbe-' + randomUUID()
+  let registered = false
+  try {
+    await fs.mkdir(root); await setAdminOnlyAcl(root)
+    const runner = path.join(root, 'runner.mjs')
+    await fs.copyFile(new URL('./windows-security/browser-worker.mjs', import.meta.url), runner)
+    await fs.copyFile(new URL('./windows-security/module-audit.ps1', import.meta.url), path.join(root, 'module-audit.ps1'))
+    await fs.copyFile(new URL('./windows-security/result-policy.mjs', import.meta.url), path.join(root, 'result-policy.mjs'))
+    await setAdminOnlyAcl(root)
+    const transcripts = path.join(process.env.USERPROFILE, '.codex', 'sessions')
+    await ps(`$ErrorActionPreference='Stop';$a=New-ScheduledTaskAction -Execute ${quote(path.join(home, 'bin', 'node.exe'))} -Argument ${quote('"' + runner + '" "' + root + '" "' + transcripts + '"')} -WorkingDirectory ${quote(root)};$p=New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest;$s=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 3) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries;Register-ScheduledTask -TaskName ${quote(task)} -Action $a -Principal $p -Settings $s | Out-Null`)
+    registered = true; await ps(`Start-ScheduledTask -TaskName ${quote(task)}`)
+    const output = path.join(root, 'browser-result.json'), deadline = Date.now() + 90000
+    while (Date.now() < deadline && !await fs.stat(output).catch(() => null)) await sleep(200)
+    const report = JSON.parse(await fs.readFile(output, 'utf8'))
+    await publishReport(publicDirectory, { ...report, evidence: root })
+    console.log(JSON.stringify({ ...report, evidence: root }))
+    if (!report.ok) process.exitCode = 1
+  } finally { if (registered) await ps(`Stop-ScheduledTask -TaskName ${quote(task)} -ErrorAction SilentlyContinue;Unregister-ScheduledTask -TaskName ${quote(task)} -Confirm:$false`) }
+} else throw new Error('Use concurrent --prepare and --run <runId> terminals, or --browser from an administrator terminal')

package/scripts/verify-windows-prompt-desktop.mjs

@@ -1,50 +1,50 @@
-// Run from a trusted administrator terminal after building and installing the service.
-// Exercises SYSTEM relay, desktop entry, restoration and reply transport without a password UI.
-import fs from 'node:fs/promises'
-import path from 'node:path'
-import { randomUUID } from 'node:crypto'
-import { promisify } from 'node:util'
-import { execFile } from 'node:child_process'
-import { compileCsharp } from '../dist/platform/windows/assets/compiler.js'
-import { PROMPT_HELPER_CSHARP } from '../dist/platform/windows/assets/prompt-src.js'
-import { defaultAdminCheck } from '../dist/platform/windows/install.js'
-import { setAdminOnlyAcl } from '../dist/platform/windows/acl.js'
-
-if (process.platform !== 'win32' || !await defaultAdminCheck()) throw new Error('Use a trusted Windows administrator terminal')
-const home = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'u-chan-secrets')
-const root = path.join(home, '#0 backup', 'desktop-probe-' + randomUUID())
-const task = 'UChanDesktopProbe-' + randomUUID()
-const exec = promisify(execFile)
-const powershell = script => exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], { windowsHide: true })
-const quote = value => "'" + value.replaceAll("'", "''") + "'"
-let registered = false
-try {
-  await fs.mkdir(root)
-  await setAdminOnlyAcl(root)
-  const trace = path.join(root, 'desktop-trace.txt')
-  if (!PROMPT_HELPER_CSHARP.includes('return RunDialog(args);') || !PROMPT_HELPER_CSHARP.includes('SwitchDesktop(original);')) throw new Error('Native probe hooks no longer match; no helper was run')
-  const source = PROMPT_HELPER_CSHARP
-    .replace('return RunDialog(args);', `File.AppendAllText(@"${trace}", "entered"+Environment.NewLine); return 0;`)
-    .replace('SwitchDesktop(original);', `if (SwitchDesktop(original)) File.AppendAllText(@"${trace}", "restored"+Environment.NewLine);`)
-  const helper = path.join(root, 'probe.exe')
-  await compileCsharp(source, helper, { outputType: 'WindowsApplication', referencedAssemblies: ['System.Windows.Forms.dll', 'System.Drawing.dll'] })
-  const output = path.join(root, 'result.json'), runner = path.join(root, 'runner.mjs')
-  await fs.writeFile(runner, `import{execFile}from'node:child_process';import fs from'node:fs';execFile(${JSON.stringify(helper)},['--mode','confirm','--phrase','DISPOSABLE-NATIVE-PROBE','--lines','[]'],{timeout:35000,windowsHide:true},(e,out)=>fs.writeFileSync(${JSON.stringify(output)},JSON.stringify({exitCode:e?.code??0,stdoutBytes:Buffer.byteLength(out)})));`)
-  await setAdminOnlyAcl(root)
-  await powershell(`$ErrorActionPreference='Stop';$a=New-ScheduledTaskAction -Execute ${quote(path.join(home, 'bin', 'node.exe'))} -Argument ${quote('"' + runner + '"')};$p=New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest;$s=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 2) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries;Register-ScheduledTask -TaskName ${quote(task)} -Action $a -Principal $p -Settings $s | Out-Null`)
-  registered = true
-  await powershell(`Start-ScheduledTask -TaskName ${quote(task)}`)
-  const deadline = Date.now() + 60000
-  let execution
-  while (Date.now() < deadline) {
-    try { execution = JSON.parse(await fs.readFile(output, 'utf8')); break }
-    catch (e) { if (e.code !== 'ENOENT') throw e }
-    await new Promise(resolve => setTimeout(resolve, 500))
-  }
-  const events = await fs.readFile(trace, 'utf8').catch(() => '')
-  const ok = execution?.exitCode === 0 && execution.stdoutBytes === 0 && events.trim() === 'entered\r\nrestored'
-  console.log(JSON.stringify({ ok, nativeDryRun: true, desktopEntered: events.includes('entered'), desktopRestored: events.includes('restored'), execution, evidence: root }))
-  if (!ok) process.exitCode = 1
-} finally {
-  if (registered) await powershell(`Stop-ScheduledTask -TaskName ${quote(task)} -ErrorAction SilentlyContinue;Unregister-ScheduledTask -TaskName ${quote(task)} -Confirm:$false`)
-}
+// Run from a trusted administrator terminal after building and installing the service.
+// Exercises SYSTEM relay, desktop entry, restoration and reply transport without a password UI.
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { promisify } from 'node:util'
+import { execFile } from 'node:child_process'
+import { compileCsharp } from '../dist/platform/windows/assets/compiler.js'
+import { PROMPT_HELPER_CSHARP } from '../dist/platform/windows/assets/prompt-src.js'
+import { defaultAdminCheck } from '../dist/platform/windows/install.js'
+import { setAdminOnlyAcl } from '../dist/platform/windows/acl.js'
+
+if (process.platform !== 'win32' || !await defaultAdminCheck()) throw new Error('Use a trusted Windows administrator terminal')
+const home = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'u-chan-secrets')
+const root = path.join(home, '#0 backup', 'desktop-probe-' + randomUUID())
+const task = 'UChanDesktopProbe-' + randomUUID()
+const exec = promisify(execFile)
+const powershell = script => exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], { windowsHide: true })
+const quote = value => "'" + value.replaceAll("'", "''") + "'"
+let registered = false
+try {
+  await fs.mkdir(root)
+  await setAdminOnlyAcl(root)
+  const trace = path.join(root, 'desktop-trace.txt')
+  if (!PROMPT_HELPER_CSHARP.includes('return RunDialog(args);') || !PROMPT_HELPER_CSHARP.includes('SwitchDesktop(original);')) throw new Error('Native probe hooks no longer match; no helper was run')
+  const source = PROMPT_HELPER_CSHARP
+    .replace('return RunDialog(args);', `File.AppendAllText(@"${trace}", "entered"+Environment.NewLine); return 0;`)
+    .replace('SwitchDesktop(original);', `if (SwitchDesktop(original)) File.AppendAllText(@"${trace}", "restored"+Environment.NewLine);`)
+  const helper = path.join(root, 'probe.exe')
+  await compileCsharp(source, helper, { outputType: 'WindowsApplication', referencedAssemblies: ['System.Windows.Forms.dll', 'System.Drawing.dll'] })
+  const output = path.join(root, 'result.json'), runner = path.join(root, 'runner.mjs')
+  await fs.writeFile(runner, `import{execFile}from'node:child_process';import fs from'node:fs';execFile(${JSON.stringify(helper)},['--mode','confirm','--phrase','DISPOSABLE-NATIVE-PROBE','--lines','[]'],{timeout:35000,windowsHide:true},(e,out)=>fs.writeFileSync(${JSON.stringify(output)},JSON.stringify({exitCode:e?.code??0,stdoutBytes:Buffer.byteLength(out)})));`)
+  await setAdminOnlyAcl(root)
+  await powershell(`$ErrorActionPreference='Stop';$a=New-ScheduledTaskAction -Execute ${quote(path.join(home, 'bin', 'node.exe'))} -Argument ${quote('"' + runner + '"')};$p=New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest;$s=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 2) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries;Register-ScheduledTask -TaskName ${quote(task)} -Action $a -Principal $p -Settings $s | Out-Null`)
+  registered = true
+  await powershell(`Start-ScheduledTask -TaskName ${quote(task)}`)
+  const deadline = Date.now() + 60000
+  let execution
+  while (Date.now() < deadline) {
+    try { execution = JSON.parse(await fs.readFile(output, 'utf8')); break }
+    catch (e) { if (e.code !== 'ENOENT') throw e }
+    await new Promise(resolve => setTimeout(resolve, 500))
+  }
+  const events = await fs.readFile(trace, 'utf8').catch(() => '')
+  const ok = execution?.exitCode === 0 && execution.stdoutBytes === 0 && events.trim() === 'entered\r\nrestored'
+  console.log(JSON.stringify({ ok, nativeDryRun: true, desktopEntered: events.includes('entered'), desktopRestored: events.includes('restored'), execution, evidence: root }))
+  if (!ok) process.exitCode = 1
+} finally {
+  if (registered) await powershell(`Stop-ScheduledTask -TaskName ${quote(task)} -ErrorAction SilentlyContinue;Unregister-ScheduledTask -TaskName ${quote(task)} -Confirm:$false`)
+}

package/scripts/verify-windows-user-boundary.mjs

@@ -0,0 +1,56 @@
+// Non-destructive checks. Run as the ordinary desktop user, never as administrator.
+import fs from 'node:fs/promises'
+import net from 'node:net'
+import path from 'node:path'
+import { defaultAdminCheck } from '../dist/platform/windows/install.js'
+import { IpcClient } from '../dist/ipc/client.js'
+import { defaultEndpoint } from '../dist/ipc/endpoint.js'
+import { FrameReader } from '../dist/ipc/protocol.js'
+
+if (process.platform !== 'win32' || await defaultAdminCheck()) throw new Error('Run from a non-elevated Windows terminal')
+const home = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'u-chan-secrets')
+const targets = ['settings.json', 'allowlist.json', 'audit.log', 'bin/node.exe', 'bin/bw.exe', 'bin/prompt-helper.exe', 'bin/service-host.exe', 'bin/service-target.txt', 'program/package.json', 'program/dist/service/main.js', 'bin/browser/chrome.exe']
+const files = []
+for (const target of targets) {
+  const item = { target, readDenied: false, writeDenied: false }
+  for (const [flag, key] of [['r', 'readDenied'], ['r+', 'writeDenied']]) {
+    try { const handle = await fs.open(path.join(home, target), flag); await handle.close() }
+    catch (e) { if (e.code === 'EACCES' || e.code === 'EPERM') item[key] = true; else item[key + 'Error'] = e.code }
+  }
+  files.push(item)
+}
+let protectedDirectoryDenied = false
+try { await fs.opendir(path.join(home, 'bw-data')).then(d => d.close()) }
+catch (e) { protectedDirectoryDenied = e.code === 'EACCES' || e.code === 'EPERM' }
+const endpoint = defaultEndpoint(process.env, process.platform)
+const client = new IpcClient(endpoint, { timeoutMs: 10000 })
+const before = await client.listAllowed()
+if (!before.ok) throw new Error('Cannot establish grant baseline')
+const options = [
+  { grant: { kind: 'timed', minutes: 0 } }, { grant: { kind: 'timed', minutes: 1441 } },
+  { grant: { kind: 'timed', minutes: 1.5 } }, { grant: { kind: 'once', remainingUses: 100 } },
+  { grant: { kind: 'permanent', expiresAt: 'never' } }, { success: { url: 'http://example.invalid/' } },
+  { success: { url: 'https://user:password@example.invalid/' } }, { success: { selector: '' } },
+  { grant: { kind: 'other' } }, { bypassApproval: true },
+]
+async function raw(params) {
+  return new Promise((resolve, reject) => {
+    const socket = net.connect(endpoint), reader = new FrameReader()
+    const timer = setTimeout(() => { socket.destroy(); reject(new Error('Invalid request did not fail promptly')) }, 3000)
+    const finish = r => { clearTimeout(timer); socket.destroy(); resolve(r) }
+    socket.on('connect', () => socket.write(JSON.stringify({ id: 1, method: 'request_allow', params }) + '\n'))
+    socket.on('data', chunk => { for (const frame of reader.push(chunk)) finish(frame) })
+    socket.on('error', e => { clearTimeout(timer); reject(e) })
+  })
+}
+let malformedRequestsDenied = 0
+for (const value of options) {
+  const r = await raw({ domain: 'v3-verification.invalid', loginUrl: 'https://v3-verification.invalid/', item: 'DISPOSABLE-INVALID-REQUEST', options: value })
+  if (r.ok !== false || r.message !== 'bad request') throw new Error('Malformed policy reached approval or mutation')
+  malformedRequestsDenied++
+}
+const after = await client.listAllowed()
+const grantsUnchanged = after.ok && before.message === after.message
+const ok = files.every(f => f.readDenied && f.writeDenied) && protectedDirectoryDenied && grantsUnchanged
+console.log(JSON.stringify({ ok, nonElevated: true, files, protectedDirectoryDenied, malformedRequestsDenied, grantsUnchanged }))
+if (!ok) process.exitCode = 1

package/scripts/windows-security/attacker.cs

@@ -0,0 +1,137 @@
+// Disposable fixture only. Records F24 canary counts, never ordinary keystrokes or images.
+using System;
+using System.IO;
+using System.IO.Pipes;
+using System.Drawing;
+using System.Diagnostics;
+using System.Collections.Generic;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+using System.Threading;
+using System.Windows.Forms;
+
+public static class UChanDesktopAttacker
+{
+    private delegate IntPtr Hook(int code, IntPtr message, IntPtr data);
+    private static Hook callback = ObserveCanary;
+    private static int canaries;
+    [DllImport("user32.dll", SetLastError=true)] private static extern IntPtr SetWindowsHookEx(int kind, Hook hook, IntPtr module, uint thread);
+    [DllImport("user32.dll")] private static extern bool UnhookWindowsHookEx(IntPtr hook);
+    [DllImport("user32.dll")] private static extern IntPtr CallNextHookEx(IntPtr hook, int code, IntPtr message, IntPtr data);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode)] private static extern IntPtr GetModuleHandle(string name);
+    [DllImport("user32.dll", SetLastError=true)] private static extern uint SendInput(uint count, INPUT[] inputs, int size);
+    [DllImport("user32.dll", SetLastError=true)] private static extern bool PostMessage(IntPtr window, uint message, IntPtr wParam, IntPtr lParam);
+    [DllImport("user32.dll", SetLastError=true)] private static extern bool PrintWindow(IntPtr window, IntPtr dc, uint flags);
+    [DllImport("user32.dll")] private static extern bool ShowWindow(IntPtr window,int command);
+    [DllImport("user32.dll", CharSet=CharSet.Unicode, SetLastError=true)] private static extern IntPtr OpenDesktop(string name, uint flags, bool inherit, uint access);
+    [DllImport("user32.dll")] private static extern bool CloseDesktop(IntPtr desktop);
+    [StructLayout(LayoutKind.Sequential)] private struct MOUSE { public int x,y; public uint data,flags,time; public IntPtr extra; }
+    [StructLayout(LayoutKind.Sequential)] private struct KEY { public ushort key,scan; public uint flags,time; public IntPtr extra; }
+    [StructLayout(LayoutKind.Explicit)] private struct UNION { [FieldOffset(0)] public MOUSE mouse; [FieldOffset(0)] public KEY keyboard; }
+    [StructLayout(LayoutKind.Sequential)] private struct INPUT { public uint kind; public UNION data; }
+
+    private static IntPtr ObserveCanary(int code, IntPtr message, IntPtr data)
+    {
+        if(code >= 0 && Marshal.ReadInt32(data) == 0x87) canaries++;
+        return CallNextHookEx(IntPtr.Zero,code,message,data);
+    }
+    private static uint Key(ushort key)
+    {
+        INPUT[] values = new INPUT[2];
+        values[0].kind=1; values[0].data.keyboard.key=key;
+        values[1].kind=1; values[1].data.keyboard.key=key; values[1].data.keyboard.flags=2;
+        return SendInput(2,values,Marshal.SizeOf(typeof(INPUT)));
+    }
+    private static void Pump(int milliseconds)
+    {
+        Stopwatch watch=Stopwatch.StartNew();
+        while(watch.ElapsedMilliseconds < milliseconds){ Application.DoEvents(); Thread.Sleep(5); }
+    }
+    private static int Markers(Bitmap image)
+    {
+        int count=0;
+        for(int x=0;x<image.Width;x+=4) for(int y=0;y<image.Height;y+=4)
+        { Color c=image.GetPixel(x,y); if(c.R==1 && c.G==254 && c.B==71) count++; }
+        return count;
+    }
+    private static bool RenderMarker(IntPtr window, int width, int height)
+    {
+        using(Bitmap bitmap=new Bitmap(width,height)) using(Graphics graphics=Graphics.FromImage(bitmap))
+        {
+            IntPtr dc=graphics.GetHdc();
+            try { PrintWindow(window,dc,0); } finally { graphics.ReleaseHdc(dc); }
+            return Markers(bitmap)>32;
+        }
+    }
+    private static bool DeniedDesktop(string name,uint access)
+    {
+        IntPtr desktop=OpenDesktop(name,0,false,access);
+        if(desktop!=IntPtr.Zero){CloseDesktop(desktop);return false;}
+        return Marshal.GetLastWin32Error()==5;
+    }
+    private static void Put(List<string> results,string key,object value){results.Add(key+"="+value);}
+
+    [STAThread] public static int Main(string[] args)
+    {
+        List<string> results=new List<string>();
+        IntPtr hook=IntPtr.Zero;
+        try
+        {
+            bool medium=!WindowsIdentity.GetCurrent().IsSystem && !new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator);
+            Put(results,"nonElevated",medium);
+            if(!medium)throw new InvalidOperationException("Non-elevated caller required");
+            hook=SetWindowsHookEx(13,callback,GetModuleHandle(null),0);
+            if(hook==IntPtr.Zero)throw new InvalidOperationException("Hook positive control unavailable");
+            bool captureControl;
+            using(Form control=new Form())
+            {
+                control.Text="U-Chan disposable positive control";
+                control.ClientSize=new Size(96,96); control.BackColor=Color.FromArgb(1,254,71); control.TopMost=true;
+                control.Show(); ShowWindow(control.Handle,5); control.Activate(); control.Update(); Pump(200);
+                captureControl=RenderMarker(control.Handle,128,128);
+                Key(0x87); Pump(300);
+                control.Close();
+            }
+            Put(results,"hookPositiveControl",canaries>0); Put(results,"capturePositiveControl",captureControl);
+            if(canaries==0 || !captureControl)throw new InvalidOperationException("Positive control failed");
+            canaries=0;
+            File.WriteAllText(args[1]+".armed","ready");
+            Stopwatch watch=Stopwatch.StartNew();
+            while(!File.Exists(args[0]+".metadata") && watch.ElapsedMilliseconds<120000)Pump(20);
+            string[] metadata=File.ReadAllLines(args[0]+".metadata");
+            if(metadata.Length!=6 || metadata[4]!=args[2])throw new InvalidOperationException("Stale fixture metadata");
+            Put(results,"runId",args[2]);
+            Put(results,"desktopReadDenied",DeniedDesktop(metadata[0],1));
+            Put(results,"desktopHookDenied",DeniedDesktop(metadata[0],8));
+            Put(results,"desktopSwitchDenied",DeniedDesktop(metadata[0],0x100));
+            bool pipeDenied=false,spoofDenied=false,connected=false;
+            try {using(NamedPipeClientStream pipe=new NamedPipeClientStream(".",metadata[5],PipeDirection.Out)){pipe.Connect(300);connected=true;}}
+            catch(UnauthorizedAccessException){pipeDenied=true;}
+            catch(IOException e){pipeDenied=(e.HResult&0xffff)==5;Put(results,"replyPipeErrorCode",e.HResult&0xffff);}
+            catch(TimeoutException){Put(results,"replyPipeErrorCode","timeout");}
+            Put(results,"replyPipeConnectDenied",pipeDenied);
+            Put(results,"replyPipeConnected",connected);
+            try {using(NamedPipeServerStream pipe=new NamedPipeServerStream(metadata[1],PipeDirection.In,1)){}}
+            catch(IOException){spoofDenied=true;} catch(UnauthorizedAccessException){spoofDenied=true;}
+            Put(results,"replyPipeSpoofDenied",spoofDenied);
+            IntPtr form=new IntPtr(long.Parse(metadata[2])), button=new IntPtr(long.Parse(metadata[3]));
+            Put(results,"postClickAccepted",PostMessage(button,0xF5,IntPtr.Zero,IntPtr.Zero));
+            Put(results,"sendInputCount",Key(0x0D));
+            Put(results,"printWindowSawMarker",RenderMarker(form,500,420));
+            bool screenMarker=false;
+            try {
+                Rectangle bounds=Screen.PrimaryScreen.Bounds;
+                using(Bitmap image=new Bitmap(bounds.Width,bounds.Height)) using(Graphics graphics=Graphics.FromImage(image))
+                { graphics.CopyFromScreen(bounds.Location,Point.Empty,bounds.Size); screenMarker=Markers(image)>32; }
+            } catch(System.ComponentModel.Win32Exception) { }
+            Put(results,"screenCaptureSawMarker",screenMarker);
+            watch.Restart();
+            while(!File.Exists(args[0]+".done") && watch.ElapsedMilliseconds<10000)Pump(20);
+            Pump(100); Put(results,"protectedCanaryEvents",canaries);
+        }
+        catch(Exception e){Put(results,"errorType",e.GetType().Name);Put(results,"errorCode",e.HResult&0xffff);}
+        finally {if(hook!=IntPtr.Zero)UnhookWindowsHookEx(hook);}
+        File.WriteAllLines(args[1]+".attacker",results);
+        return 0;
+    }
+}

package/scripts/windows-security/browser-worker.mjs

@@ -0,0 +1,125 @@
+// SYSTEM-only disposable browser fixture. Random credentials stay in this process's memory.
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { createServer } from 'node:http'
+import { randomUUID } from 'node:crypto'
+import { execFile, spawn } from 'node:child_process'
+import { promisify } from 'node:util'
+import { moduleAuditSucceeded } from './result-policy.mjs'
+const exec = promisify(execFile), root = path.resolve(process.argv[2])
+const home = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'u-chan-secrets')
+if (!root.startsWith(path.resolve(home, '#0 backup') + path.sep)) throw new Error('Unsafe fixture path')
+const result = { ok: false }, started = Date.now()
+const load = relative => import(pathToFileURL(path.join(home, 'program', relative)).href)
+const { stdout: identity } = await exec('whoami.exe', ['/user'], { windowsHide: true })
+if (!identity.includes('S-1-5-18')) throw new Error('SYSTEM runner required')
+const username = randomUUID() + '@example.invalid', password = randomUUID() + randomUUID(), cookie = 'u_chan_probe_' + randomUUID().replaceAll('-', '')
+let server, shared, userPage, browser, provider, bitwarden, bwTimer
+let receivedCredentials = false
+try {
+  const { chromium } = await load('node_modules/playwright/index.mjs')
+  const { IsolatedLogin } = await load('dist/service/isolated-login.js')
+  const { CdpBrowserProvider, CdpSessionTarget } = await load('dist/core/browser.js')
+  const { privateBrowserPath } = await load('dist/platform/runtime-assets.js')
+  const form = '<!doctype html><title>U-Chan disposable security fixture</title><form method="post" action="/login"><input type="email" name="email"><input type="password" name="password"><button type="submit">Login</button></form>'
+  server = createServer((req, res) => {
+    if (req.method === 'POST') {
+      let body = ''; req.on('data', part => { body += part }); req.on('end', () => {
+        const fields = new URLSearchParams(body)
+        receivedCredentials = fields.get('email') === username && fields.get('password') === password
+        res.writeHead(303, { location: '/account', 'set-cookie': cookie + '=fixture; Path=/; HttpOnly; SameSite=Lax' }); res.end()
+      }); return
+    }
+    res.writeHead(200, { 'content-type': 'text/html' })
+    res.end(req.url === '/account' && req.headers.cookie?.includes(cookie + '=fixture') ? '<h1 id="signed-in">Disposable signed-in fixture</h1>' : form)
+  })
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve))
+  const origin = 'http://127.0.0.1:' + server.address().port
+  shared = await chromium.connectOverCDP('http://127.0.0.1:9222')
+  userPage = await shared.contexts()[0].newPage()
+  await userPage.addInitScript(() => { window.__uChanProbeInputCount = 0; document.addEventListener('input', () => { window.__uChanProbeInputCount++ }, true) })
+  await userPage.goto(origin)
+  await userPage.locator('input[type=email]').fill('positive-control@example.invalid')
+  result.initScriptPositiveControl = await userPage.evaluate(() => window.__uChanProbeInputCount > 0)
+  await userPage.goto(origin)
+  browser = await chromium.launch({ headless: true, executablePath: await privateBrowserPath(home) })
+  provider = new CdpBrowserProvider('http://127.0.0.1:9222')
+  const target = new CdpSessionTarget(provider)
+  const login = new IsolatedLogin({ launch: async () => browser, target, timeoutMs: 15000, hostCheck: url => new URL(url).hostname === '127.0.0.1' })
+  const outcome = await login.run({ domain: '127.0.0.1', hosts: ['127.0.0.1'], item: 'disposable', loginUrl: origin + '/login', success: { selector: '#signed-in' } }, async () => ({ username, password }))
+  result.confirmedFixtureLogin = outcome.status === 'logged_in' && receivedCredentials
+  result.sharedInputEvents = await userPage.evaluate(() => window.__uChanProbeInputCount)
+  await userPage.goto(origin + '/account')
+  result.transferredFixtureSession = await userPage.locator('#signed-in').isVisible()
+  const { CoreService } = await load('dist/core/service.js')
+  const { AllowlistStore } = await load('dist/core/allowlist.js')
+  const { GrantCoordinator } = await load('dist/service/grants.js')
+  const grantPath = path.join(root, 'fixture-grants.json'), store = new AllowlistStore(grantPath)
+  const once = { domain: '127.0.0.1', hosts: ['127.0.0.1'], item: 'disposable', loginUrl: origin + '/login', success: { selector: '#signed-in' }, grantId: randomUUID(), remainingUses: 1 }
+  await store.upsert(once)
+  let credentialReads = 0
+  const deps = { vault: { status: async () => 'unlocked', getLogin: async () => { credentialReads++; return { username, password } } }, allowlist: store, approver: { ask: async () => false }, audit: { record: async () => {} }, login, mode: async () => 'easy' }
+  const core = new CoreService(deps), attempts = await Promise.all([core.login(once.domain), core.login(once.domain)])
+  const restarted = new CoreService({ ...deps, allowlist: new AllowlistStore(grantPath) })
+  const replay = await restarted.login(once.domain)
+  result.onceGrantConcurrency = attempts.filter(r => r.ok).length === 1 && attempts.filter(r => r.code === 'grant_exhausted').length === 1 && credentialReads === 1 && replay.code === 'grant_exhausted'
+  let wall = Date.now(), mono = 0
+  const timed = { ...once, grantId: randomUUID(), remainingUses: undefined, expiresAt: new Date(wall + 60000).toISOString() }
+  await store.upsert(timed)
+  const clock = new GrantCoordinator(store, { now: () => wall, monotonic: () => mono })
+  wall -= 5000; mono += 1000
+  await clock.run(async () => {})
+  result.clockRollbackPersisted = (await new AllowlistStore(grantPath).get(timed.domain)).expiresAt === new Date(0).toISOString()
+  await fs.mkdir(path.join(root, 'bw-fixture'))
+  bitwarden = spawn(path.join(home, 'bin', 'bw.exe'), ['status'], { windowsHide: true, stdio: 'ignore', env: { ...process.env, BITWARDENCLI_APPDATA_DIR: path.join(root, 'bw-fixture'), BW_NOINTERACTION: 'true' } })
+  const bwFinished = new Promise(resolve => bitwarden.once('exit', resolve))
+  bwTimer = setTimeout(() => bitwarden.kill(), 15000)
+  const body = await fs.readFile(new URL('./module-audit.ps1', import.meta.url), 'utf8')
+  const encodedHome = Buffer.from(home, 'utf8').toString('base64')
+  const script = '$auditProcessId=' + process.pid + ';$auditServiceHome=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(' + JSON.stringify(encodedHome) + '));\n' + body
+  const audit = await exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], { windowsHide: true, timeout: 20000 })
+  result.nativeModules = JSON.parse(audit.stdout)
+  await bwFinished; clearTimeout(bwTimer)
+  let scanned = 0, matches = 0
+  for (const file of [path.join(home, 'audit.log'), path.join(home, 'service.log')]) {
+    const text = await fs.readFile(file, 'utf8').catch(() => '')
+    if (text) { scanned++; if (text.includes(password) || text.includes(username)) matches++ }
+  }
+  // SYSTEM's USERPROFILE differs; the trusted administrator passes the desktop transcript directory.
+  for (const session of process.argv[3] ? [process.argv[3]] : []) {
+    for (const file of await fs.readdir(session, { recursive: true }).catch(() => [])) {
+      if (!file.endsWith('.jsonl')) continue
+      const full = path.join(session, file), stat = await fs.stat(full).catch(() => null)
+      if (!stat || stat.mtimeMs < started || stat.size > 100 * 1024 * 1024) continue
+      const text = await fs.readFile(full, 'utf8'); scanned++; if (text.includes(password) || text.includes(username)) matches++
+    }
+  }
+  result.testSecretScan = { artifacts: scanned, matches }
+  const { NpmPackageVerifier } = await load('dist/service/update/verifier.js')
+  const { ServiceUpdater } = await load('dist/service/update/updater.js')
+  const verifier = new NpmPackageVerifier(), verified = await verifier.verify('3.0.2')
+  result.realRegistryVerification = verified.ok
+  if (verified.ok) {
+    const updateHome = path.join(root, 'update-fixture'), programDir = path.join(updateHome, 'program')
+    await fs.mkdir(path.join(programDir, 'node_modules'), { recursive: true })
+    const pkg = JSON.parse(await fs.readFile(path.join(home, 'program', 'package.json'), 'utf8'))
+    await fs.writeFile(path.join(programDir, 'package.json'), JSON.stringify({ ...pkg, version: '3.0.1' }))
+    await fs.writeFile(path.join(programDir, 'node_modules', 'private-marker'), 'preserve-private-dependencies')
+    const state = JSON.stringify({ protectedFixture: randomUUID() })
+    await fs.writeFile(path.join(updateHome, 'settings.json'), state)
+    let restarts = 0
+    const update = new ServiceUpdater({ programDir, stagingDir: path.join(updateHome, 'staging'), currentVersion: '3.0.1', verifier: { checkLatest: async () => ({ isNewer: true, latestVersion: '3.0.2' }), verify: async () => verified }, restarter: { restart: async () => { restarts++ } } })
+    const updated = await update.update()
+    await new Promise(resolve => setImmediate(resolve))
+    result.signedUpdateRehearsal = updated.ok && JSON.parse(await fs.readFile(path.join(programDir, 'package.json'), 'utf8')).version === '3.0.2' && await fs.readFile(path.join(programDir, 'node_modules', 'private-marker'), 'utf8') === 'preserve-private-dependencies' && await fs.readFile(path.join(updateHome, 'settings.json'), 'utf8') === state && restarts === 1
+  }
+  result.ok = result.initScriptPositiveControl && result.confirmedFixtureLogin && result.sharedInputEvents === 0 && result.transferredFixtureSession && result.onceGrantConcurrency && result.clockRollbackPersisted && moduleAuditSucceeded(result.nativeModules) && result.realRegistryVerification && result.signedUpdateRehearsal && matches === 0
+} catch (e) { result.errorType = e.name }
+finally {
+  clearTimeout(bwTimer); if (bitwarden && bitwarden.exitCode === null) bitwarden.kill()
+  if (shared) await shared.contexts()[0].clearCookies({ name: cookie }).catch(() => {})
+  await userPage?.close().catch(() => {}); await provider?.disconnect().catch(() => {}); await browser?.close().catch(() => {}); await shared?.close().catch(() => {})
+  if (server) await new Promise(resolve => { server.close(resolve); server.closeAllConnections() })
+}
+await fs.writeFile(path.join(root, 'browser-result.json'), JSON.stringify(result, null, 2))

package/scripts/windows-security/canary.cs

@@ -0,0 +1,16 @@
+// SYSTEM-side fixture: emits only the non-text F24 canary, never password data.
+public static class UChanProbeCanary
+{
+    [System.Runtime.InteropServices.DllImport("user32.dll",SetLastError=true)] private static extern uint SendInput(uint count, INPUT[] values,int size);
+    [System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)] private struct MOUSE { public int x,y; public uint data,flags,time; public System.IntPtr extra; }
+    [System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)] private struct KEY { public ushort key,scan; public uint flags,time; public System.IntPtr extra; }
+    [System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Explicit)] private struct UNION { [System.Runtime.InteropServices.FieldOffset(0)] public MOUSE mouse; [System.Runtime.InteropServices.FieldOffset(0)] public KEY keyboard; }
+    [System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)] private struct INPUT { public uint kind; public UNION data; }
+    public static uint Send()
+    {
+        INPUT[] values=new INPUT[2];
+        values[0].kind=1;values[0].data.keyboard.key=0x87;
+        values[1].kind=1;values[1].data.keyboard.key=0x87;values[1].data.keyboard.flags=2;
+        return SendInput(2,values,System.Runtime.InteropServices.Marshal.SizeOf(typeof(INPUT)));
+    }
+}