u-chan-secrets 3.0.3 → 4.0.0

package/scripts/windows-security/attacker.cs

@@ -0,0 +1,137 @@
+// Disposable fixture only. Records F24 canary counts, never ordinary keystrokes or images.
+using System;
+using System.IO;
+using System.IO.Pipes;
+using System.Drawing;
+using System.Diagnostics;
+using System.Collections.Generic;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+using System.Threading;
+using System.Windows.Forms;
+
+public static class UChanDesktopAttacker
+{
+    private delegate IntPtr Hook(int code, IntPtr message, IntPtr data);
+    private static Hook callback = ObserveCanary;
+    private static int canaries;
+    [DllImport("user32.dll", SetLastError=true)] private static extern IntPtr SetWindowsHookEx(int kind, Hook hook, IntPtr module, uint thread);
+    [DllImport("user32.dll")] private static extern bool UnhookWindowsHookEx(IntPtr hook);
+    [DllImport("user32.dll")] private static extern IntPtr CallNextHookEx(IntPtr hook, int code, IntPtr message, IntPtr data);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode)] private static extern IntPtr GetModuleHandle(string name);
+    [DllImport("user32.dll", SetLastError=true)] private static extern uint SendInput(uint count, INPUT[] inputs, int size);
+    [DllImport("user32.dll", SetLastError=true)] private static extern bool PostMessage(IntPtr window, uint message, IntPtr wParam, IntPtr lParam);
+    [DllImport("user32.dll", SetLastError=true)] private static extern bool PrintWindow(IntPtr window, IntPtr dc, uint flags);
+    [DllImport("user32.dll")] private static extern bool ShowWindow(IntPtr window,int command);
+    [DllImport("user32.dll", CharSet=CharSet.Unicode, SetLastError=true)] private static extern IntPtr OpenDesktop(string name, uint flags, bool inherit, uint access);
+    [DllImport("user32.dll")] private static extern bool CloseDesktop(IntPtr desktop);
+    [StructLayout(LayoutKind.Sequential)] private struct MOUSE { public int x,y; public uint data,flags,time; public IntPtr extra; }
+    [StructLayout(LayoutKind.Sequential)] private struct KEY { public ushort key,scan; public uint flags,time; public IntPtr extra; }
+    [StructLayout(LayoutKind.Explicit)] private struct UNION { [FieldOffset(0)] public MOUSE mouse; [FieldOffset(0)] public KEY keyboard; }
+    [StructLayout(LayoutKind.Sequential)] private struct INPUT { public uint kind; public UNION data; }
+
+    private static IntPtr ObserveCanary(int code, IntPtr message, IntPtr data)
+    {
+        if(code >= 0 && Marshal.ReadInt32(data) == 0x87) canaries++;
+        return CallNextHookEx(IntPtr.Zero,code,message,data);
+    }
+    private static uint Key(ushort key)
+    {
+        INPUT[] values = new INPUT[2];
+        values[0].kind=1; values[0].data.keyboard.key=key;
+        values[1].kind=1; values[1].data.keyboard.key=key; values[1].data.keyboard.flags=2;
+        return SendInput(2,values,Marshal.SizeOf(typeof(INPUT)));
+    }
+    private static void Pump(int milliseconds)
+    {
+        Stopwatch watch=Stopwatch.StartNew();
+        while(watch.ElapsedMilliseconds < milliseconds){ Application.DoEvents(); Thread.Sleep(5); }
+    }
+    private static int Markers(Bitmap image)
+    {
+        int count=0;
+        for(int x=0;x<image.Width;x+=4) for(int y=0;y<image.Height;y+=4)
+        { Color c=image.GetPixel(x,y); if(c.R==1 && c.G==254 && c.B==71) count++; }
+        return count;
+    }
+    private static bool RenderMarker(IntPtr window, int width, int height)
+    {
+        using(Bitmap bitmap=new Bitmap(width,height)) using(Graphics graphics=Graphics.FromImage(bitmap))
+        {
+            IntPtr dc=graphics.GetHdc();
+            try { PrintWindow(window,dc,0); } finally { graphics.ReleaseHdc(dc); }
+            return Markers(bitmap)>32;
+        }
+    }
+    private static bool DeniedDesktop(string name,uint access)
+    {
+        IntPtr desktop=OpenDesktop(name,0,false,access);
+        if(desktop!=IntPtr.Zero){CloseDesktop(desktop);return false;}
+        return Marshal.GetLastWin32Error()==5;
+    }
+    private static void Put(List<string> results,string key,object value){results.Add(key+"="+value);}
+
+    [STAThread] public static int Main(string[] args)
+    {
+        List<string> results=new List<string>();
+        IntPtr hook=IntPtr.Zero;
+        try
+        {
+            bool medium=!WindowsIdentity.GetCurrent().IsSystem && !new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator);
+            Put(results,"nonElevated",medium);
+            if(!medium)throw new InvalidOperationException("Non-elevated caller required");
+            hook=SetWindowsHookEx(13,callback,GetModuleHandle(null),0);
+            if(hook==IntPtr.Zero)throw new InvalidOperationException("Hook positive control unavailable");
+            bool captureControl;
+            using(Form control=new Form())
+            {
+                control.Text="U-Chan disposable positive control";
+                control.ClientSize=new Size(96,96); control.BackColor=Color.FromArgb(1,254,71); control.TopMost=true;
+                control.Show(); ShowWindow(control.Handle,5); control.Activate(); control.Update(); Pump(200);
+                captureControl=RenderMarker(control.Handle,128,128);
+                Key(0x87); Pump(300);
+                control.Close();
+            }
+            Put(results,"hookPositiveControl",canaries>0); Put(results,"capturePositiveControl",captureControl);
+            if(canaries==0 || !captureControl)throw new InvalidOperationException("Positive control failed");
+            canaries=0;
+            File.WriteAllText(args[1]+".armed","ready");
+            Stopwatch watch=Stopwatch.StartNew();
+            while(!File.Exists(args[0]+".metadata") && watch.ElapsedMilliseconds<120000)Pump(20);
+            string[] metadata=File.ReadAllLines(args[0]+".metadata");
+            if(metadata.Length!=6 || metadata[4]!=args[2])throw new InvalidOperationException("Stale fixture metadata");
+            Put(results,"runId",args[2]);
+            Put(results,"desktopReadDenied",DeniedDesktop(metadata[0],1));
+            Put(results,"desktopHookDenied",DeniedDesktop(metadata[0],8));
+            Put(results,"desktopSwitchDenied",DeniedDesktop(metadata[0],0x100));
+            bool pipeDenied=false,spoofDenied=false,connected=false;
+            try {using(NamedPipeClientStream pipe=new NamedPipeClientStream(".",metadata[5],PipeDirection.Out)){pipe.Connect(300);connected=true;}}
+            catch(UnauthorizedAccessException){pipeDenied=true;}
+            catch(IOException e){pipeDenied=(e.HResult&0xffff)==5;Put(results,"replyPipeErrorCode",e.HResult&0xffff);}
+            catch(TimeoutException){Put(results,"replyPipeErrorCode","timeout");}
+            Put(results,"replyPipeConnectDenied",pipeDenied);
+            Put(results,"replyPipeConnected",connected);
+            try {using(NamedPipeServerStream pipe=new NamedPipeServerStream(metadata[1],PipeDirection.In,1)){}}
+            catch(IOException){spoofDenied=true;} catch(UnauthorizedAccessException){spoofDenied=true;}
+            Put(results,"replyPipeSpoofDenied",spoofDenied);
+            IntPtr form=new IntPtr(long.Parse(metadata[2])), button=new IntPtr(long.Parse(metadata[3]));
+            Put(results,"postClickAccepted",PostMessage(button,0xF5,IntPtr.Zero,IntPtr.Zero));
+            Put(results,"sendInputCount",Key(0x0D));
+            Put(results,"printWindowSawMarker",RenderMarker(form,500,420));
+            bool screenMarker=false;
+            try {
+                Rectangle bounds=Screen.PrimaryScreen.Bounds;
+                using(Bitmap image=new Bitmap(bounds.Width,bounds.Height)) using(Graphics graphics=Graphics.FromImage(image))
+                { graphics.CopyFromScreen(bounds.Location,Point.Empty,bounds.Size); screenMarker=Markers(image)>32; }
+            } catch(System.ComponentModel.Win32Exception) { }
+            Put(results,"screenCaptureSawMarker",screenMarker);
+            watch.Restart();
+            while(!File.Exists(args[0]+".done") && watch.ElapsedMilliseconds<10000)Pump(20);
+            Pump(100); Put(results,"protectedCanaryEvents",canaries);
+        }
+        catch(Exception e){Put(results,"errorType",e.GetType().Name);Put(results,"errorCode",e.HResult&0xffff);}
+        finally {if(hook!=IntPtr.Zero)UnhookWindowsHookEx(hook);}
+        File.WriteAllLines(args[1]+".attacker",results);
+        return 0;
+    }
+}

package/scripts/windows-security/browser-worker.mjs

@@ -0,0 +1,125 @@
+// SYSTEM-only disposable browser fixture. Random credentials stay in this process's memory.
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { createServer } from 'node:http'
+import { randomUUID } from 'node:crypto'
+import { execFile, spawn } from 'node:child_process'
+import { promisify } from 'node:util'
+import { moduleAuditSucceeded } from './result-policy.mjs'
+const exec = promisify(execFile), root = path.resolve(process.argv[2])
+const home = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'u-chan-secrets')
+if (!root.startsWith(path.resolve(home, '#0 backup') + path.sep)) throw new Error('Unsafe fixture path')
+const result = { ok: false }, started = Date.now()
+const load = relative => import(pathToFileURL(path.join(home, 'program', relative)).href)
+const { stdout: identity } = await exec('whoami.exe', ['/user'], { windowsHide: true })
+if (!identity.includes('S-1-5-18')) throw new Error('SYSTEM runner required')
+const username = randomUUID() + '@example.invalid', password = randomUUID() + randomUUID(), cookie = 'u_chan_probe_' + randomUUID().replaceAll('-', '')
+let server, shared, userPage, browser, provider, bitwarden, bwTimer
+let receivedCredentials = false
+try {
+  const { chromium } = await load('node_modules/playwright/index.mjs')
+  const { IsolatedLogin } = await load('dist/service/isolated-login.js')
+  const { CdpBrowserProvider, CdpSessionTarget } = await load('dist/core/browser.js')
+  const { privateBrowserPath } = await load('dist/platform/runtime-assets.js')
+  const form = '<!doctype html><title>U-Chan disposable security fixture</title><form method="post" action="/login"><input type="email" name="email"><input type="password" name="password"><button type="submit">Login</button></form>'
+  server = createServer((req, res) => {
+    if (req.method === 'POST') {
+      let body = ''; req.on('data', part => { body += part }); req.on('end', () => {
+        const fields = new URLSearchParams(body)
+        receivedCredentials = fields.get('email') === username && fields.get('password') === password
+        res.writeHead(303, { location: '/account', 'set-cookie': cookie + '=fixture; Path=/; HttpOnly; SameSite=Lax' }); res.end()
+      }); return
+    }
+    res.writeHead(200, { 'content-type': 'text/html' })
+    res.end(req.url === '/account' && req.headers.cookie?.includes(cookie + '=fixture') ? '<h1 id="signed-in">Disposable signed-in fixture</h1>' : form)
+  })
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve))
+  const origin = 'http://127.0.0.1:' + server.address().port
+  shared = await chromium.connectOverCDP('http://127.0.0.1:9222')
+  userPage = await shared.contexts()[0].newPage()
+  await userPage.addInitScript(() => { window.__uChanProbeInputCount = 0; document.addEventListener('input', () => { window.__uChanProbeInputCount++ }, true) })
+  await userPage.goto(origin)
+  await userPage.locator('input[type=email]').fill('positive-control@example.invalid')
+  result.initScriptPositiveControl = await userPage.evaluate(() => window.__uChanProbeInputCount > 0)
+  await userPage.goto(origin)
+  browser = await chromium.launch({ headless: true, executablePath: await privateBrowserPath(home) })
+  provider = new CdpBrowserProvider('http://127.0.0.1:9222')
+  const target = new CdpSessionTarget(provider)
+  const login = new IsolatedLogin({ launch: async () => browser, target, timeoutMs: 15000, hostCheck: url => new URL(url).hostname === '127.0.0.1' })
+  const outcome = await login.run({ domain: '127.0.0.1', hosts: ['127.0.0.1'], item: 'disposable', loginUrl: origin + '/login', success: { selector: '#signed-in' } }, async () => ({ username, password }))
+  result.confirmedFixtureLogin = outcome.status === 'logged_in' && receivedCredentials
+  result.sharedInputEvents = await userPage.evaluate(() => window.__uChanProbeInputCount)
+  await userPage.goto(origin + '/account')
+  result.transferredFixtureSession = await userPage.locator('#signed-in').isVisible()
+  const { CoreService } = await load('dist/core/service.js')
+  const { AllowlistStore } = await load('dist/core/allowlist.js')
+  const { GrantCoordinator } = await load('dist/service/grants.js')
+  const grantPath = path.join(root, 'fixture-grants.json'), store = new AllowlistStore(grantPath)
+  const once = { domain: '127.0.0.1', hosts: ['127.0.0.1'], item: 'disposable', loginUrl: origin + '/login', success: { selector: '#signed-in' }, grantId: randomUUID(), remainingUses: 1 }
+  await store.upsert(once)
+  let credentialReads = 0
+  const deps = { vault: { status: async () => 'unlocked', getLogin: async () => { credentialReads++; return { username, password } } }, allowlist: store, approver: { ask: async () => false }, audit: { record: async () => {} }, login, mode: async () => 'easy' }
+  const core = new CoreService(deps), attempts = await Promise.all([core.login(once.domain), core.login(once.domain)])
+  const restarted = new CoreService({ ...deps, allowlist: new AllowlistStore(grantPath) })
+  const replay = await restarted.login(once.domain)
+  result.onceGrantConcurrency = attempts.filter(r => r.ok).length === 1 && attempts.filter(r => r.code === 'grant_exhausted').length === 1 && credentialReads === 1 && replay.code === 'grant_exhausted'
+  let wall = Date.now(), mono = 0
+  const timed = { ...once, grantId: randomUUID(), remainingUses: undefined, expiresAt: new Date(wall + 60000).toISOString() }
+  await store.upsert(timed)
+  const clock = new GrantCoordinator(store, { now: () => wall, monotonic: () => mono })
+  wall -= 5000; mono += 1000
+  await clock.run(async () => {})
+  result.clockRollbackPersisted = (await new AllowlistStore(grantPath).get(timed.domain)).expiresAt === new Date(0).toISOString()
+  await fs.mkdir(path.join(root, 'bw-fixture'))
+  bitwarden = spawn(path.join(home, 'bin', 'bw.exe'), ['status'], { windowsHide: true, stdio: 'ignore', env: { ...process.env, BITWARDENCLI_APPDATA_DIR: path.join(root, 'bw-fixture'), BW_NOINTERACTION: 'true' } })
+  const bwFinished = new Promise(resolve => bitwarden.once('exit', resolve))
+  bwTimer = setTimeout(() => bitwarden.kill(), 15000)
+  const body = await fs.readFile(new URL('./module-audit.ps1', import.meta.url), 'utf8')
+  const encodedHome = Buffer.from(home, 'utf8').toString('base64')
+  const script = '$auditProcessId=' + process.pid + ';$auditServiceHome=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(' + JSON.stringify(encodedHome) + '));\n' + body
+  const audit = await exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], { windowsHide: true, timeout: 20000 })
+  result.nativeModules = JSON.parse(audit.stdout)
+  await bwFinished; clearTimeout(bwTimer)
+  let scanned = 0, matches = 0
+  for (const file of [path.join(home, 'audit.log'), path.join(home, 'service.log')]) {
+    const text = await fs.readFile(file, 'utf8').catch(() => '')
+    if (text) { scanned++; if (text.includes(password) || text.includes(username)) matches++ }
+  }
+  // SYSTEM's USERPROFILE differs; the trusted administrator passes the desktop transcript directory.
+  for (const session of process.argv[3] ? [process.argv[3]] : []) {
+    for (const file of await fs.readdir(session, { recursive: true }).catch(() => [])) {
+      if (!file.endsWith('.jsonl')) continue
+      const full = path.join(session, file), stat = await fs.stat(full).catch(() => null)
+      if (!stat || stat.mtimeMs < started || stat.size > 100 * 1024 * 1024) continue
+      const text = await fs.readFile(full, 'utf8'); scanned++; if (text.includes(password) || text.includes(username)) matches++
+    }
+  }
+  result.testSecretScan = { artifacts: scanned, matches }
+  const { NpmPackageVerifier } = await load('dist/service/update/verifier.js')
+  const { ServiceUpdater } = await load('dist/service/update/updater.js')
+  const verifier = new NpmPackageVerifier(), verified = await verifier.verify('3.0.2')
+  result.realRegistryVerification = verified.ok
+  if (verified.ok) {
+    const updateHome = path.join(root, 'update-fixture'), programDir = path.join(updateHome, 'program')
+    await fs.mkdir(path.join(programDir, 'node_modules'), { recursive: true })
+    const pkg = JSON.parse(await fs.readFile(path.join(home, 'program', 'package.json'), 'utf8'))
+    await fs.writeFile(path.join(programDir, 'package.json'), JSON.stringify({ ...pkg, version: '3.0.1' }))
+    await fs.writeFile(path.join(programDir, 'node_modules', 'private-marker'), 'preserve-private-dependencies')
+    const state = JSON.stringify({ protectedFixture: randomUUID() })
+    await fs.writeFile(path.join(updateHome, 'settings.json'), state)
+    let restarts = 0
+    const update = new ServiceUpdater({ programDir, stagingDir: path.join(updateHome, 'staging'), currentVersion: '3.0.1', verifier: { checkLatest: async () => ({ isNewer: true, latestVersion: '3.0.2' }), verify: async () => verified }, restarter: { restart: async () => { restarts++ } } })
+    const updated = await update.update()
+    await new Promise(resolve => setImmediate(resolve))
+    result.signedUpdateRehearsal = updated.ok && JSON.parse(await fs.readFile(path.join(programDir, 'package.json'), 'utf8')).version === '3.0.2' && await fs.readFile(path.join(programDir, 'node_modules', 'private-marker'), 'utf8') === 'preserve-private-dependencies' && await fs.readFile(path.join(updateHome, 'settings.json'), 'utf8') === state && restarts === 1
+  }
+  result.ok = result.initScriptPositiveControl && result.confirmedFixtureLogin && result.sharedInputEvents === 0 && result.transferredFixtureSession && result.onceGrantConcurrency && result.clockRollbackPersisted && moduleAuditSucceeded(result.nativeModules) && result.realRegistryVerification && result.signedUpdateRehearsal && matches === 0
+} catch (e) { result.errorType = e.name }
+finally {
+  clearTimeout(bwTimer); if (bitwarden && bitwarden.exitCode === null) bitwarden.kill()
+  if (shared) await shared.contexts()[0].clearCookies({ name: cookie }).catch(() => {})
+  await userPage?.close().catch(() => {}); await provider?.disconnect().catch(() => {}); await browser?.close().catch(() => {}); await shared?.close().catch(() => {})
+  if (server) await new Promise(resolve => { server.close(resolve); server.closeAllConnections() })
+}
+await fs.writeFile(path.join(root, 'browser-result.json'), JSON.stringify(result, null, 2))

package/scripts/windows-security/canary.cs

@@ -0,0 +1,16 @@
+// SYSTEM-side fixture: emits only the non-text F24 canary, never password data.
+public static class UChanProbeCanary
+{
+    [System.Runtime.InteropServices.DllImport("user32.dll",SetLastError=true)] private static extern uint SendInput(uint count, INPUT[] values,int size);
+    [System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)] private struct MOUSE { public int x,y; public uint data,flags,time; public System.IntPtr extra; }
+    [System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)] private struct KEY { public ushort key,scan; public uint flags,time; public System.IntPtr extra; }
+    [System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Explicit)] private struct UNION { [System.Runtime.InteropServices.FieldOffset(0)] public MOUSE mouse; [System.Runtime.InteropServices.FieldOffset(0)] public KEY keyboard; }
+    [System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)] private struct INPUT { public uint kind; public UNION data; }
+    public static uint Send()
+    {
+        INPUT[] values=new INPUT[2];
+        values[0].kind=1;values[0].data.keyboard.key=0x87;
+        values[1].kind=1;values[1].data.keyboard.key=0x87;values[1].data.keyboard.flags=2;
+        return SendInput(2,values,System.Runtime.InteropServices.Marshal.SizeOf(typeof(INPUT)));
+    }
+}

package/scripts/windows-security/module-audit.ps1

@@ -0,0 +1,36 @@
+# Internal SYSTEM fixture. The caller supplies auditProcessId and auditServiceHome.
+$ErrorActionPreference='Stop'
+Import-Module "$PSHOME\Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1"
+$all=@(Get-CimInstance Win32_Process)
+$ids=@($auditProcessId)
+for($i=0;$i -lt $ids.Count;$i++) {
+    $parent=$ids[$i]
+    $ids+=@($all|Where-Object{$_.ParentProcessId -eq $parent}|ForEach-Object{[int]$_.ProcessId})
+}
+$paths=@();$exited=0;$unreadableLive=@()
+foreach($id in $ids) {
+    try {$paths+=@((Get-Process -Id $id -ErrorAction Stop).Modules|ForEach-Object{$_.FileName})}
+    catch {if(Get-Process -Id $id -ErrorAction SilentlyContinue){$unreadableLive+=$id}else{$exited++}}
+}
+$paths=@($paths|Sort-Object -Unique)
+$servicePrefix=[IO.Path]::GetFullPath($auditServiceHome).TrimEnd('\')+'\'
+$windowsPrefix=[IO.Path]::GetFullPath($env:windir).TrimEnd('\')+'\'
+$outside=@($paths|Where-Object{-not $_.StartsWith($servicePrefix,[StringComparison]::OrdinalIgnoreCase)-and -not $_.StartsWith($windowsPrefix,[StringComparison]::OrdinalIgnoreCase)})
+$defender=0;$unsafe=@()
+foreach($file in $outside) {
+    $item=Get-Item -LiteralPath $file -Force
+    $signature=Get-AuthenticodeSignature -LiteralPath $file
+    $acl=$item.GetAccessControl()
+    $owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value
+    $trustedOwner=$owner -in @('S-1-5-18','S-1-5-32-544') -or $owner.StartsWith('S-1-5-80-')
+    $bad=@($acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])|Where-Object{
+        $_.AccessControlType -eq 'Allow' -and ($_.FileSystemRights -band 0xD0156) -and $_.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544') -and -not $_.IdentityReference.Value.StartsWith('S-1-5-80-')
+    })
+    if($file.StartsWith('C:\ProgramData\Microsoft\Windows Defender\Platform\',[StringComparison]::OrdinalIgnoreCase)-and -not ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)-and $trustedOwner -and $signature.Status -eq 'Valid' -and $signature.SignerCertificate.Subject -match 'O=Microsoft Corporation' -and $bad.Count -eq 0){$defender++}else{$unsafe+=$file}
+}
+@{
+    processes=$ids.Count;modules=$paths.Count;outside=$unsafe;verifiedDefenderModules=$defender
+    unreadableLive=$unreadableLive.Count;exitedBeforeInspection=$exited
+    bitwardenObserved=($paths -contains (Join-Path $auditServiceHome 'bin\bw.exe'))
+    browserObserved=(@($paths|Where-Object{$_.StartsWith((Join-Path $servicePrefix 'bin\browser\'),[StringComparison]::OrdinalIgnoreCase)}).Count -gt 0)
+}|ConvertTo-Json -Compress

package/scripts/windows-security/public-channel.ps1

@@ -0,0 +1,31 @@
+# Internal admin fixture. Inputs are a fixed ProgramData root and a validated run UUID directory.
+$ErrorActionPreference='Stop'
+$admins=New-Object Security.Principal.SecurityIdentifier('S-1-5-32-544')
+$acl=New-Object Security.AccessControl.DirectorySecurity
+$acl.SetOwner($admins)
+$acl.SetAccessRuleProtection($true,$false)
+foreach($sid in @('S-1-5-18','S-1-5-32-544','S-1-5-32-545')) {
+    $rights=if($sid -eq 'S-1-5-32-545'){'ReadAndExecute'}else{'FullControl'}
+    $id=New-Object Security.Principal.SecurityIdentifier($sid)
+    $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($id,$rights,'ContainerInherit,ObjectInherit','None','Allow')))
+}
+function Assert-ProbeChannel([string]$target) {
+    $item=Get-Item -LiteralPath $target -Force
+    if(-not $item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)){throw 'Public channel is redirected'}
+    $current=$item.GetAccessControl()
+    if($current.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin @('S-1-5-18','S-1-5-32-544')){throw 'Public channel has untrusted owner'}
+    foreach($rule in $current.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])) {
+        if($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band 0xD0156) -and $rule.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544')){throw 'Public channel is writable by an untrusted identity'}
+    }
+}
+# Parent delete-child access could otherwise override the protected root's DACL.
+$parent=(Get-Item -LiteralPath ([IO.Path]::GetDirectoryName($probePublicRoot)) -Force).GetAccessControl()
+foreach($rule in $parent.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])) {
+    if($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band 0x40) -and -not ($rule.PropagationFlags -band [Security.AccessControl.PropagationFlags]::InheritOnly) -and $rule.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544') -and -not $rule.IdentityReference.Value.StartsWith('S-1-5-80-')){throw 'Public channel parent permits untrusted deletion'}
+}
+if(-not [IO.Directory]::Exists($probePublicRoot)){[IO.Directory]::CreateDirectory($probePublicRoot,$acl)|Out-Null}
+# Validate after creation as CreateDirectory may return an existing directory after a race.
+Assert-ProbeChannel $probePublicRoot
+if([IO.Directory]::Exists($probeRunDirectory)-or [IO.File]::Exists($probeRunDirectory)){throw 'Run UUID has already been used'}
+[IO.Directory]::CreateDirectory($probeRunDirectory,$acl)|Out-Null
+Assert-ProbeChannel $probeRunDirectory

package/scripts/windows-security/result-policy.d.mts

@@ -0,0 +1,2 @@
+export function accepted(native: unknown, attacker: unknown, runId?: string): boolean
+export function moduleAuditSucceeded(audit: unknown): boolean

package/scripts/windows-security/result-policy.mjs

@@ -0,0 +1,9 @@
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+export function accepted(native, attacker, runId) {
+  if (!uuid.test(runId ?? '') || !native || !attacker) return false
+  const expected = ['nonElevated', 'hookPositiveControl', 'capturePositiveControl', 'desktopReadDenied', 'desktopHookDenied', 'desktopSwitchDenied', 'replyPipeConnectDenied', 'replyPipeSpoofDenied']
+  return native.ok === true && native.runId === runId && attacker.runId === runId && expected.every(k => attacker[k] === 'True') && attacker.postClickAccepted === 'False' && attacker.replyPipeConnected === 'False' && attacker.printWindowSawMarker === 'False' && attacker.screenCaptureSawMarker === 'False' && attacker.protectedCanaryEvents === '0'
+}
+export function moduleAuditSucceeded(audit) {
+  return !!audit && Number.isInteger(audit.modules) && audit.modules > 0 && audit.unreadableLive === 0 && Array.isArray(audit.outside) && audit.outside.length === 0 && audit.bitwardenObserved === true && audit.browserObserved === true
+}