u-chan-secrets 4.0.0 → 5.0.0

package/dist/service/manage.js

@@ -26,12 +26,13 @@ export class ManagementService {
                     const grants = all.slice(page * 20, page * 20 + 20);
                     const lines = ['Vault: ' + status, lastAction, 'Grant page ' + (page + 1) + ': ' + grants.length + ' of ' + entries.length + ' shown. Use Previous/Next for more.'];
                     lines.push('Service version: ' + (safeVersion(checks?.serviceVersion) ?? 'unknown'), 'Service browser: ' + (['pass', 'fail'].includes(checks?.browser ?? '') ? checks?.browser : 'unknown'));
+                    lines.push('Observed desktop browser: ' + (checks?.browserKind === 'edge' ? 'Edge' : checks?.browserKind === 'chrome' ? 'Chrome' : 'unknown'));
                     if (status === 'locked')
                         lines.push('Next step: use Unlock to approve a protected vault unlock.');
                     if (checks?.assets !== 'pass' || checks?.permissions !== 'pass')
                         lines.push('Next step: run u-chan doctor; repair from a trusted administrator terminal.');
                     if (checks?.browser !== 'pass')
-                        lines.push('Next step: start dedicated Chrome and run u-chan setup.');
+                        lines.push('Next step: start the selected dedicated browser and run u-chan setup.');
                     for (const e of grants) {
                         let label = e.expiresAt ? 'until ' + e.expiresAt : e.remainingUses !== undefined ? e.remainingUses + ' attempts remaining' : 'permanent';
                         try {
@@ -42,7 +43,7 @@ export class ManagementService {
                         }
                         lines.push(clean(e.domain) + ' — ' + label);
                     }
-                    lines.push('Revocation stops future logins. It does not log out existing Chrome sessions.', 'Revocation waits for any earlier login to finish.', 'Diagnostics: assets ' + (checks?.assets ?? 'unknown') + '; permissions ' + (checks?.permissions ?? 'unknown'), 'Recent activity:');
+                    lines.push('Revocation stops future logins. It does not log out existing browser sessions.', 'Revocation waits for any earlier login to finish.', 'Diagnostics: assets ' + (checks?.assets ?? 'unknown') + '; permissions ' + (checks?.permissions ?? 'unknown'), 'Recent activity:');
                     for (const e of events.slice(-10)) {
                         const ts = Number.isFinite(Date.parse(e.ts)) ? new Date(e.ts).toISOString() : 'unknown time';
                         const action = ['login', 'request_allow', 'revoke', 'unlock', 'lock', 'mode', 'import', 'update'].includes(e.action) ? e.action : 'event';

package/dist/service/private-network.js

@@ -0,0 +1,97 @@
+import { createServer, request as httpRequest } from 'node:http';
+import { connect } from 'node:net';
+/** Per-context HTTP/CONNECT proxy: every redirect and child target must obtain a separately checked destination. */
+export async function createPrivateNetwork(hostCheck, signal, loopbackHttpOriginForTesting) {
+    let blocked = false, closing;
+    const testOrigin = loopbackHttpOriginForTesting ? new URL(loopbackHttpOriginForTesting) : undefined;
+    if (testOrigin && (testOrigin.protocol !== 'http:' || testOrigin.hostname !== '127.0.0.1' || testOrigin.username || testOrigin.password))
+        throw new Error('Invalid loopback fixture origin');
+    const sockets = new Set();
+    const allowed = (url) => {
+        try {
+            return !signal.aborted && !url.username && !url.password && hostCheck(url.href);
+        }
+        catch {
+            return false;
+        }
+    };
+    const track = (socket) => { sockets.add(socket); socket.once('close', () => sockets.delete(socket)); socket.on('error', () => { }); socket.setTimeout(60000, () => socket.destroy()); };
+    const server = createServer((incoming, response) => {
+        let url;
+        try {
+            url = new URL(incoming.url ?? '');
+        }
+        catch {
+            blocked = true;
+            response.writeHead(403);
+            response.end();
+            return;
+        }
+        if (!testOrigin || url.protocol !== 'http:' || url.origin !== testOrigin.origin || !allowed(url)) {
+            blocked = true;
+            response.writeHead(403);
+            response.end();
+            return;
+        }
+        const headers = { ...incoming.headers, host: testOrigin.host };
+        delete headers['proxy-authorization'];
+        delete headers['proxy-connection'];
+        // Plain HTTP exists only for explicitly injected loopback fixtures; the production path uses approved HTTPS CONNECT.
+        const outgoing = httpRequest({ hostname: '127.0.0.1', port: Number(testOrigin.port || 80), path: url.pathname + url.search, method: incoming.method, headers, agent: false }, upstream => {
+            response.writeHead(upstream.statusCode ?? 502, upstream.headers);
+            upstream.pipe(response);
+        });
+        outgoing.on('socket', track);
+        outgoing.on('error', () => { if (!response.headersSent)
+            response.writeHead(502); response.end(); });
+        incoming.on('error', () => outgoing.destroy());
+        incoming.pipe(outgoing); // No redirect following or credential buffering in the proxy.
+    });
+    server.on('connection', socket => { track(socket); if (sockets.size > 128)
+        socket.destroy(); });
+    server.on('clientError', (_error, socket) => socket.destroy());
+    server.on('upgrade', (_request, socket) => { blocked = true; socket.destroy(); }); // Production permits WSS via checked CONNECT only.
+    server.on('connect', (incoming, connection, head) => {
+        const client = connection;
+        let url;
+        try {
+            url = new URL('https://' + incoming.url);
+        }
+        catch {
+            blocked = true;
+            client.destroy();
+            return;
+        }
+        if (url.pathname !== '/' || url.search || url.hash || !allowed(url)) {
+            blocked = true;
+            client.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+            return;
+        }
+        const upstream = connect({ host: url.hostname.replace(/^\[|\]$/g, ''), port: Number(url.port || 443) });
+        track(upstream);
+        upstream.once('connect', () => {
+            if (signal.aborted || client.destroyed) {
+                upstream.destroy();
+                return;
+            }
+            client.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+            if (head.length)
+                upstream.write(head);
+            upstream.pipe(client);
+            client.pipe(upstream);
+        });
+        upstream.once('error', () => client.destroy());
+        client.once('close', () => upstream.destroy());
+    });
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', () => { server.off('error', reject); resolve(); }); });
+    const close = () => closing ??= new Promise(resolve => { signal.removeEventListener('abort', abort); for (const socket of sockets)
+        socket.destroy(); server.close(() => resolve()); });
+    const abort = () => { void close(); };
+    signal.addEventListener('abort', abort, { once: true });
+    if (signal.aborted)
+        await close();
+    const address = server.address();
+    if (!address || typeof address === 'string')
+        throw new Error('Private network unavailable');
+    return { proxy: { server: `http://127.0.0.1:${address.port}`, bypass: '<-loopback>' }, wasBlocked: () => blocked, close };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u-chan-secrets",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "U-Chan Secrets: local MCP server for Bitwarden-backed logins",
   "license": "MIT",
   "type": "module",

package/scripts/debug-install.bat

@@ -1,69 +1,69 @@
-@echo off
-setlocal
-set ROOT=%~dp0..
-
-fltmc.exe >nul 2>&1
-if %errorlevel% neq 0 (
-    echo [*] Requesting Administrator elevation...
-    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
-    exit /b
-)
-
-cd /d "%ROOT%"
-echo ========================================================
-echo       U-Chan Secrets V2 Installation & Setup
-echo ========================================================
-echo.
-echo [*] Step 1: Stopping previous service (if any)...
-taskkill /F /IM prompt-helper.exe >nul 2>&1
-taskkill /F /IM auth-helper.exe >nul 2>&1
-call node dist\cli.js uninstall
-echo.
-echo [*] Step 2: Installing U-Chan Windows Service...
-call node dist\cli.js install
-if %errorlevel% neq 0 (
-    echo.
-    echo [X] Installation failed with exit code %errorlevel%.
-    pause
-    exit /b %errorlevel%
-)
-icacls C:\ProgramData\u-chan-secrets\bin /grant "Users:(OI)(CI)RX" >nul 2>&1
-echo.
-echo [*] Step 3: Checking service status...
-sc.exe query u-chan-secrets
-echo.
-
-echo [*] Step 4: Bitwarden Vault Login...
-set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
-set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
-if not exist "%BW_BIN%" (
-    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
-)
-
-if exist "%BW_BIN%" (
-    "%BW_BIN%" status > "%TEMP%\bw_stat.json" 2>&1
-    findstr /C:"\"unauthenticated\"" "%TEMP%\bw_stat.json" >nul 2>&1
-    if %errorlevel% equ 0 (
-        echo [!] Bitwarden is not logged in for the privileged service.
-        echo [*] Please log in to your Bitwarden vault below:
-        "%BW_BIN%" login
-    ) else (
-        echo [+] Bitwarden vault is already logged in.
-    )
-    del "%TEMP%\bw_stat.json" >nul 2>&1
-) else (
-    echo [!] Warning: bw.exe not found.
-)
-
-echo.
-copy /y C:\ProgramData\u-chan-secrets\service.log "%ROOT%\service-copy.log" >nul 2>&1
-copy /y C:\ProgramData\u-chan-secrets\settings.json "%ROOT%\settings-copy.json" >nul 2>&1
-echo ========================================================
-echo [+] Service and Bitwarden configuration complete!
-echo.
-echo Next: Close this window, open your normal terminal, and run:
-echo    u-chan import-v1
-echo    u-chan unlock
-echo ========================================================
-echo.
-pause
+@echo off
+setlocal
+set ROOT=%~dp0..
+
+fltmc.exe >nul 2>&1
+if %errorlevel% neq 0 (
+    echo [*] Requesting Administrator elevation...
+    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
+    exit /b
+)
+
+cd /d "%ROOT%"
+echo ========================================================
+echo       U-Chan Secrets V2 Installation & Setup
+echo ========================================================
+echo.
+echo [*] Step 1: Stopping previous service (if any)...
+taskkill /F /IM prompt-helper.exe >nul 2>&1
+taskkill /F /IM auth-helper.exe >nul 2>&1
+call node dist\cli.js uninstall
+echo.
+echo [*] Step 2: Installing U-Chan Windows Service...
+call node dist\cli.js install
+if %errorlevel% neq 0 (
+    echo.
+    echo [X] Installation failed with exit code %errorlevel%.
+    pause
+    exit /b %errorlevel%
+)
+icacls C:\ProgramData\u-chan-secrets\bin /grant "Users:(OI)(CI)RX" >nul 2>&1
+echo.
+echo [*] Step 3: Checking service status...
+sc.exe query u-chan-secrets
+echo.
+
+echo [*] Step 4: Bitwarden Vault Login...
+set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
+set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
+if not exist "%BW_BIN%" (
+    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
+)
+
+if exist "%BW_BIN%" (
+    "%BW_BIN%" status > "%TEMP%\bw_stat.json" 2>&1
+    findstr /C:"\"unauthenticated\"" "%TEMP%\bw_stat.json" >nul 2>&1
+    if %errorlevel% equ 0 (
+        echo [!] Bitwarden is not logged in for the privileged service.
+        echo [*] Please log in to your Bitwarden vault below:
+        "%BW_BIN%" login
+    ) else (
+        echo [+] Bitwarden vault is already logged in.
+    )
+    del "%TEMP%\bw_stat.json" >nul 2>&1
+) else (
+    echo [!] Warning: bw.exe not found.
+)
+
+echo.
+copy /y C:\ProgramData\u-chan-secrets\service.log "%ROOT%\service-copy.log" >nul 2>&1
+copy /y C:\ProgramData\u-chan-secrets\settings.json "%ROOT%\settings-copy.json" >nul 2>&1
+echo ========================================================
+echo [+] Service and Bitwarden configuration complete!
+echo.
+echo Next: Close this window, open your normal terminal, and run:
+echo    u-chan import-v1
+echo    u-chan unlock
+echo ========================================================
+echo.
+pause

package/scripts/desktop-browser.ps1

@@ -0,0 +1,103 @@
+# Shared user-side Chrome/Edge launcher and read-only process policy. No elevation or vault access.
+function Split-UChanWindowsCommandLine([string]$CommandLine) {
+    if (-not ('UChanWindowsCommandLine' -as [type])) {
+        Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class UChanWindowsCommandLine {
+    [DllImport("shell32.dll", SetLastError=true, CharSet=CharSet.Unicode)] static extern IntPtr CommandLineToArgvW(string value, out int count);
+    [DllImport("kernel32.dll")] static extern IntPtr LocalFree(IntPtr value);
+    public static string[] Split(string value) {
+        int count; IntPtr memory=CommandLineToArgvW(value,out count);
+        if(memory==IntPtr.Zero) throw new InvalidOperationException("Command line is unavailable");
+        try { string[] result=new string[count]; for(int i=0;i<count;i++)result[i]=Marshal.PtrToStringUni(Marshal.ReadIntPtr(memory,i*IntPtr.Size)); return result; }
+        finally { LocalFree(memory); }
+    }
+}
+'@
+    }
+    return [UChanWindowsCommandLine]::Split($CommandLine)
+}
+function Test-UChanBrowserProcess($Observation, [string]$Executable, [string]$Profile, [string]$OwnerSid, [int]$Port) {
+    if (-not $Observation.ExecutablePath -or -not $Observation.OwnerSid -or -not $Observation.CommandLine -or -not $Observation.Addresses) { return 'unknown' }
+    if ($Observation.ExecutablePath -ine $Executable -or $Observation.OwnerSid -ne $OwnerSid) { return 'fail' }
+    foreach ($address in $Observation.Addresses) { if ($address -notin @('127.0.0.1','::1')) { return 'fail' } }
+    try { $tokens = @(Split-UChanWindowsCommandLine $Observation.CommandLine) } catch { return 'unknown' }
+    if ($tokens.Count -lt 1 -or $tokens[0] -ine $Executable) { return 'fail' }
+    $profiles = @($tokens | Where-Object { $_ -imatch '^--user-data-dir(?:=|$)' })
+    if ($profiles.Count -ne 1 -or $profiles[0] -inotmatch '^--user-data-dir=.+$') { return 'fail' }
+    $actual = $profiles[0].Substring('--user-data-dir='.Length)
+    try { if ([IO.Path]::GetFullPath($actual).TrimEnd('\') -ine [IO.Path]::GetFullPath($Profile).TrimEnd('\')) { return 'fail' } } catch { return 'fail' }
+    $ports = @($tokens | Where-Object { $_ -imatch '^--remote-debugging-port(?:=|$)' })
+    if ($ports.Count -ne 1 -or $ports[0] -inotmatch '^--remote-debugging-port=[0-9]+$' -or $ports[0].Substring('--remote-debugging-port='.Length) -ne [string]$Port) { return 'fail' }
+    return 'pass'
+}
+
+function Get-UChanBrowserConfiguration([string]$Browser, [string]$HomeOverride, [string]$OwnerOverride, [string]$LocalOverride) {
+    $userHome = if ($HomeOverride) { $HomeOverride } elseif ($env:U_CHAN_HOME) { $env:U_CHAN_HOME } else { Join-Path $env:APPDATA 'u-chan-secrets' }
+    if (-not $Browser) { $Browser = $env:U_CHAN_BROWSER }
+    if (-not $Browser) {
+        $choice = Join-Path $userHome 'browser.json'
+        if (Test-Path -LiteralPath $choice) {
+            $item = Get-Item -LiteralPath $choice -Force
+            if ($item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Browser preference path is redirected.' }
+            $saved = Get-Content -LiteralPath $choice -Raw | ConvertFrom-Json
+            if (@($saved.PSObject.Properties).Count -ne 1) { throw 'Invalid browser preference.' }
+            $Browser = $saved.browser
+            if (-not $Browser) { throw 'Invalid browser preference.' }
+        } else { $Browser = 'chrome' }
+    }
+    if ($Browser -cnotin @('chrome','edge')) { throw 'Choose chrome or edge.' }
+    $profile = Join-Path $userHome ($Browser + '-profile')
+    $check = [IO.Path]::GetFullPath($profile)
+    while ($check) {
+        if ((Test-Path -LiteralPath $check) -and ((Get-Item -LiteralPath $check -Force).Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Dedicated browser profile is redirected.' }
+        $check = [IO.Path]::GetDirectoryName($check)
+    }
+    $cdp = [Uri]$(if ($env:U_CHAN_CDP) { $env:U_CHAN_CDP } else { 'http://127.0.0.1:9222' })
+    if ($cdp.Scheme -ne 'http' -or $cdp.Host -notin @('127.0.0.1','localhost','[::1]','::1') -or $cdp.UserInfo -or $cdp.AbsolutePath -ne '/' -or $cdp.Query -or $cdp.Fragment) { throw 'Use an HTTP loopback CDP origin without credentials, path, query or fragment.' }
+    $suffix = if ($Browser -eq 'edge') { 'Microsoft\Edge\Application\msedge.exe' } else { 'Google\Chrome\Application\chrome.exe' }
+    $local = if ($LocalOverride) { $LocalOverride } else { $env:LOCALAPPDATA }
+    $candidates = @(foreach ($base in @($env:ProgramFiles, ${env:ProgramFiles(x86)}, $local)) { if ($base) { Join-Path $base $suffix } })
+    $executables = @($candidates | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf })
+    $owner = if ($OwnerOverride) { $OwnerOverride } else { [Security.Principal.WindowsIdentity]::GetCurrent().User.Value }
+    return @{ Browser=$Browser; Profile=$profile; Endpoint=$cdp; Executables=$executables; OwnerSid=$owner }
+}
+
+# Privileged checks derive the desktop home from the installed owner's SID, never SYSTEM's APPDATA or user preference files.
+function Get-UChanOwnerBrowserConfiguration([string]$OwnerSid, [string]$Browser) {
+    if ($OwnerSid -notmatch '^S-1-5-21-(?:[0-9]+-){3}[0-9]+$') { throw 'Installed desktop owner is invalid.' }
+    $profile = (Get-ItemProperty -LiteralPath ('HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\'+$OwnerSid) -ErrorAction Stop).ProfileImagePath
+    if (-not $profile) { throw 'Installed desktop owner profile is unavailable.' }
+    $profile = [Environment]::ExpandEnvironmentVariables($profile)
+    $roaming = Join-Path $profile 'AppData\Roaming'
+    $local = Join-Path $profile 'AppData\Local'
+    $shell = Get-ItemProperty -LiteralPath ('Registry::HKEY_USERS\'+$OwnerSid+'\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders') -ErrorAction SilentlyContinue
+    if ($shell.AppData) { $roaming = [Environment]::ExpandEnvironmentVariables(($shell.AppData -ireplace '%USERPROFILE%', $profile)) }
+    if ($shell.'Local AppData') { $local = [Environment]::ExpandEnvironmentVariables(($shell.'Local AppData' -ireplace '%USERPROFILE%', $profile)) }
+    $desktopHome = if ($env:U_CHAN_DESKTOP_HOME) { $env:U_CHAN_DESKTOP_HOME } else { Join-Path $roaming 'u-chan-secrets' }
+    return Get-UChanBrowserConfiguration $Browser $desktopHome $OwnerSid $local
+}
+
+function Get-UChanBrowserState($Configuration) {
+    try {
+        $listeners = @(Get-NetTCPConnection -State Listen -ErrorAction Stop | Where-Object LocalPort -eq $Configuration.Endpoint.Port)
+        if ($listeners.Count -eq 0) { return 'missing' }
+        $owners = @($listeners.OwningProcess | Select-Object -Unique)
+        if ($owners.Count -ne 1) { return 'fail' }
+        $process = Get-CimInstance Win32_Process -Filter ("ProcessId=" + $owners[0]) -ErrorAction Stop
+        if (-not $process) { return 'unknown' }
+        $owner = Invoke-CimMethod -InputObject $process -MethodName GetOwnerSid -ErrorAction Stop
+        $observation = @{ ExecutablePath=$process.ExecutablePath; OwnerSid=$owner.Sid; CommandLine=$process.CommandLine; Addresses=@($listeners.LocalAddress) }
+        if (-not $process.ExecutablePath) { return 'unknown' }
+        if ($process.ExecutablePath -notin $Configuration.Executables) { return 'fail' }
+        $policy = Test-UChanBrowserProcess $observation $process.ExecutablePath $Configuration.Profile $Configuration.OwnerSid $Configuration.Endpoint.Port
+        if ($policy -ne 'pass') { return $policy }
+        $version = Invoke-RestMethod -Uri ([Uri]::new($Configuration.Endpoint,'/json/version')) -TimeoutSec 2 -ErrorAction Stop
+        $socket = [Uri]$version.webSocketDebuggerUrl
+        if ($socket.Scheme -ne 'ws' -or $socket.Host -notin @('127.0.0.1','localhost','[::1]','::1') -or $socket.Port -ne $Configuration.Endpoint.Port -or $socket.UserInfo) { return 'fail' }
+        $edge = $version.'User-Agent' -match '(?:Edg|Edge)/'
+        if (($Configuration.Browser -eq 'edge') -ne $edge) { return 'fail' }
+        return 'pass'
+    } catch { return 'unknown' }
+}

package/scripts/login-bw.bat

@@ -1,21 +1,21 @@
-@echo off
-setlocal
-set ROOT=%~dp0..
-
-fltmc.exe >nul 2>&1
-if %errorlevel% neq 0 (
-    echo [*] Requesting Administrator elevation...
-    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
-    exit /b
-)
-
-set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
-set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
-if not exist "%BW_BIN%" (
-    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
-)
-
-echo [*] Logging in to Bitwarden for U-Chan Service Store...
-"%BW_BIN%" login
-echo.
-pause
+@echo off
+setlocal
+set ROOT=%~dp0..
+
+fltmc.exe >nul 2>&1
+if %errorlevel% neq 0 (
+    echo [*] Requesting Administrator elevation...
+    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
+    exit /b
+)
+
+set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
+set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
+if not exist "%BW_BIN%" (
+    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
+)
+
+echo [*] Logging in to Bitwarden for U-Chan Service Store...
+"%BW_BIN%" login
+echo.
+pause

package/scripts/migrate.bat

@@ -1,4 +1,4 @@
-@echo off
-setlocal
-call "%~dp0debug-install.bat" %*
-
+@echo off
+setlocal
+call "%~dp0debug-install.bat" %*
+

package/scripts/start-browser.ps1

@@ -0,0 +1,33 @@
+param([ValidateSet('chrome','edge')][string]$Browser, [switch]$Background, [switch]$CheckOnly, [string]$DesktopOwnerSid)
+$ErrorActionPreference='Stop'
+. (Join-Path $PSScriptRoot 'desktop-browser.ps1')
+if ($DesktopOwnerSid) {
+    if (-not $CheckOnly) { throw 'An owner-specific inspection cannot launch a desktop browser.' }
+    $observed = 'unknown'
+    $kinds = if ($Browser) { @($Browser) } else { @('chrome','edge') }
+    foreach ($kind in $kinds) {
+        $configuration = Get-UChanOwnerBrowserConfiguration $DesktopOwnerSid $kind
+        $candidate = Get-UChanBrowserState $configuration
+        if ($candidate -eq 'pass') { 'pass'; return }
+        if ($candidate -eq 'fail' -or $candidate -eq 'missing') { $observed = 'fail' }
+    }
+    $observed; return
+}
+$configuration=Get-UChanBrowserConfiguration $Browser
+$state=Get-UChanBrowserState $configuration
+if ($CheckOnly) { if ($state -eq 'missing') { 'fail' } else { $state }; return }
+if ($state -eq 'pass') { Write-Host ($configuration.Browser + ' dedicated browser is ready.'); return }
+if ($state -ne 'missing') { throw 'The browser endpoint is occupied, mismatched, or unverifiable. Close only the previous dedicated U-Chan browser before switching; keep personal windows open.' }
+if ($configuration.Executables.Count -eq 0) { throw ($configuration.Browser + ' is not installed. Install it or explicitly select the other supported browser.') }
+New-Item -ItemType Directory -Force -Path $configuration.Profile | Out-Null
+$arguments=@(('--remote-debugging-port='+$configuration.Endpoint.Port), '--remote-debugging-address=127.0.0.1', ('--user-data-dir="'+$configuration.Profile+'"'), '--no-first-run')
+if ($Background) { $arguments += '--no-startup-window' }
+Start-Process -FilePath $configuration.Executables[0] -ArgumentList $arguments -WindowStyle Hidden
+$deadline=[DateTime]::UtcNow.AddSeconds(15)
+do {
+    Start-Sleep -Milliseconds 300
+    $state=Get-UChanBrowserState $configuration
+    if ($state -eq 'pass') { Write-Host ($configuration.Browser + ' dedicated browser started.'); return }
+    if ($state -eq 'fail') { break }
+} while ([DateTime]::UtcNow -lt $deadline)
+throw 'Selected dedicated browser did not become verifiably ready. Check browser policy and run setup again.'

package/scripts/start-chrome.ps1

@@ -1,39 +1,5 @@
-param([switch]$Background)
+param([switch]$Background, [switch]$CheckOnly)
 $ErrorActionPreference = 'Stop'
-$home_ = if ($env:U_CHAN_HOME) { $env:U_CHAN_HOME } else { Join-Path $env:APPDATA 'u-chan-secrets' }
-$profileDir = Join-Path $home_ 'chrome-profile'   # dedicated profile, never the default Chrome profile
-$cdp = [Uri]$(if ($env:U_CHAN_CDP) { $env:U_CHAN_CDP } else { 'http://127.0.0.1:9222' })
-if ($cdp.Scheme -ne 'http' -or $cdp.Host -notin @('127.0.0.1', 'localhost', '[::1]', '::1') -or $cdp.UserInfo -or $cdp.AbsolutePath -ne '/' -or $cdp.Query -or $cdp.Fragment) {
-  throw 'Use an HTTP loopback CDP origin without user information, path, query or fragment.'
-}
-$port = $cdp.Port
-$bindHost = $cdp.Host
-
-# Already listening? Then do nothing (short TCP probe; Test-NetConnection is slow).
-$client = New-Object System.Net.Sockets.TcpClient
-try {
-  $iar = $client.BeginConnect($bindHost, $port, $null, $null)
-  if ($iar.AsyncWaitHandle.WaitOne(500) -and $client.Connected) {
-    Write-Host "Port $port already open; Chrome is already running with remote debugging."
-    return
-  }
-} catch { } finally { $client.Close() }
-
-$candidates = @(
-  (Join-Path $env:ProgramFiles 'Google\Chrome\Application\chrome.exe'),
-  (Join-Path ${env:ProgramFiles(x86)} 'Google\Chrome\Application\chrome.exe'),
-  (Join-Path $env:LOCALAPPDATA 'Google\Chrome\Application\chrome.exe')
-)
-$chrome = $candidates | Where-Object { $_ -and (Test-Path $_) } | Select-Object -First 1
-if (-not $chrome) { throw 'chrome.exe not found' }
-
-New-Item -ItemType Directory -Force -Path $profileDir | Out-Null
-$chromeArgs = @(
-  "--remote-debugging-port=$port",
-  "--remote-debugging-address=$bindHost",
-  "--user-data-dir=`"$profileDir`"",
-  '--no-first-run'
-)
-if ($Background) { $chromeArgs += '--no-startup-window' }
-Start-Process -FilePath $chrome -ArgumentList $chromeArgs -WindowStyle Hidden
-Write-Host "Chrome started (profile: $profileDir, CDP: http://${bindHost}:$port)"
+# Compatibility entry point: dedicated profile, never the default Chrome profile.
+# Already listening? Validate browser identity, owner, profile and CDP before reusing it.
+& (Join-Path $PSScriptRoot 'start-browser.ps1') -Browser chrome -Background:$Background -CheckOnly:$CheckOnly

package/scripts/verify-windows-adversarial.mjs

@@ -121,16 +121,26 @@ if (command === '--prepare') {
   const publicDirectory = await createChannel(runIdArgument ?? randomUUID())
   const home = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'u-chan-secrets')
   const root = path.join(home, '#0 backup', 'browser-probe-' + randomUUID()), task = 'UChanBrowserProbe-' + randomUUID()
+  const program = process.argv[4] ? path.resolve(process.argv[4]) : path.join(home, 'program'), endpoint = process.argv[5] ?? 'http://127.0.0.1:9222', matrix = process.argv[6] === 'matrix'
+  if (program !== path.join(home, 'program') && !program.startsWith(path.resolve(home, '#0 backup') + path.sep)) throw new Error('Candidate must be in protected backup storage')
+  const { safeCdpOrigin } = await import('../dist/core/doctor.js')
+  if (!safeCdpOrigin(endpoint)) throw new Error('Unsafe fixture endpoint')
+  const desktopHome = matrix ? path.resolve(process.argv[7] ?? '') : undefined
+  if (matrix && (!desktopHome.startsWith(path.resolve(os.tmpdir(), 'u-chan-v5-matrix-' + runIdArgument) + path.sep) || !['chrome','edge'].includes(path.basename(desktopHome)))) throw new Error('Unsafe disposable desktop home')
   let registered = false
   try {
     await fs.mkdir(root); await setAdminOnlyAcl(root)
+    if (matrix) {
+      const settings = JSON.parse(await fs.readFile(path.join(home, 'settings.json'), 'utf8'))
+      await fs.writeFile(path.join(root, 'matrix-context.json'), JSON.stringify({ desktopHome, ownerSid: settings.authorizedSid }))
+    }
     const runner = path.join(root, 'runner.mjs')
     await fs.copyFile(new URL('./windows-security/browser-worker.mjs', import.meta.url), runner)
     await fs.copyFile(new URL('./windows-security/module-audit.ps1', import.meta.url), path.join(root, 'module-audit.ps1'))
     await fs.copyFile(new URL('./windows-security/result-policy.mjs', import.meta.url), path.join(root, 'result-policy.mjs'))
     await setAdminOnlyAcl(root)
     const transcripts = path.join(process.env.USERPROFILE, '.codex', 'sessions')
-    await ps(`$ErrorActionPreference='Stop';$a=New-ScheduledTaskAction -Execute ${quote(path.join(home, 'bin', 'node.exe'))} -Argument ${quote('"' + runner + '" "' + root + '" "' + transcripts + '"')} -WorkingDirectory ${quote(root)};$p=New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest;$s=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 3) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries;Register-ScheduledTask -TaskName ${quote(task)} -Action $a -Principal $p -Settings $s | Out-Null`)
+    await ps(`$ErrorActionPreference='Stop';$a=New-ScheduledTaskAction -Execute ${quote(path.join(home, 'bin', 'node.exe'))} -Argument ${quote('"' + runner + '" "' + root + '" "' + transcripts + '" "' + program + '" "' + endpoint + '"' + (matrix ? ' matrix' : ''))} -WorkingDirectory ${quote(root)};$p=New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest;$s=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 3) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries;Register-ScheduledTask -TaskName ${quote(task)} -Action $a -Principal $p -Settings $s | Out-Null`)
     registered = true; await ps(`Start-ScheduledTask -TaskName ${quote(task)}`)
     const output = path.join(root, 'browser-result.json'), deadline = Date.now() + 90000
     while (Date.now() < deadline && !await fs.stat(output).catch(() => null)) await sleep(200)