u-chan-secrets 4.0.0 → 5.0.0

package/scripts/windows-security/browser-worker.mjs

@@ -10,13 +10,18 @@ import { moduleAuditSucceeded } from './result-policy.mjs'
 const exec = promisify(execFile), root = path.resolve(process.argv[2])
 const home = path.join(process.env.ProgramData ?? 'C:\\ProgramData', 'u-chan-secrets')
 if (!root.startsWith(path.resolve(home, '#0 backup') + path.sep)) throw new Error('Unsafe fixture path')
+const program = process.argv[4] ? path.resolve(process.argv[4]) : path.join(home, 'program')
+if (program !== path.join(home, 'program') && !program.startsWith(path.resolve(home, '#0 backup') + path.sep)) throw new Error('Unsafe candidate path')
+const endpoint = process.argv[5] ?? 'http://127.0.0.1:9222', matrix = process.argv[6] === 'matrix'
 const result = { ok: false }, started = Date.now()
-const load = relative => import(pathToFileURL(path.join(home, 'program', relative)).href)
+const load = relative => import(pathToFileURL(path.join(program, relative)).href)
 const { stdout: identity } = await exec('whoami.exe', ['/user'], { windowsHide: true })
 if (!identity.includes('S-1-5-18')) throw new Error('SYSTEM runner required')
 const username = randomUUID() + '@example.invalid', password = randomUUID() + randomUUID(), cookie = 'u_chan_probe_' + randomUUID().replaceAll('-', '')
 let server, shared, userPage, browser, provider, bitwarden, bwTimer
 let receivedCredentials = false
+let sharedInputCount = 0
+let matrixMetadata
 try {
   const { chromium } = await load('node_modules/playwright/index.mjs')
   const { IsolatedLogin } = await load('dist/service/isolated-login.js')
@@ -36,20 +41,41 @@ try {
   })
   await new Promise(resolve => server.listen(0, '127.0.0.1', resolve))
   const origin = 'http://127.0.0.1:' + server.address().port
-  shared = await chromium.connectOverCDP('http://127.0.0.1:9222')
+  shared = await chromium.connectOverCDP(endpoint)
+  if (matrix) {
+    const binding = '__uChanMatrixInput' + randomUUID().replaceAll('-', '')
+    await shared.contexts()[0].exposeBinding(binding, () => { sharedInputCount++ })
+    await shared.contexts()[0].addInitScript(name => document.addEventListener('input', () => { void window[name]().catch(() => {}) }, true), binding)
+    const { inspectServiceDesktopBrowser } = await load('dist/platform/windows/desktop-browser.js')
+    matrixMetadata = JSON.parse(await fs.readFile(path.join(root, 'matrix-context.json'), 'utf8'))
+    const { observeCdpBrowser } = await load('dist/core/doctor.js')
+    result.fixtureBrowser = await observeCdpBrowser(endpoint)
+    result.desktopIdentity = await inspectServiceDesktopBrowser(endpoint, matrixMetadata.ownerSid, { ...process.env, U_CHAN_DESKTOP_HOME: matrixMetadata.desktopHome }, result.fixtureBrowser)
+    result.wrongBrowserRejected = await inspectServiceDesktopBrowser(endpoint, matrixMetadata.ownerSid, { ...process.env, U_CHAN_DESKTOP_HOME: matrixMetadata.desktopHome }, result.fixtureBrowser === 'edge' ? 'chrome' : 'edge') !== 'pass'
+  }
   userPage = await shared.contexts()[0].newPage()
   await userPage.addInitScript(() => { window.__uChanProbeInputCount = 0; document.addEventListener('input', () => { window.__uChanProbeInputCount++ }, true) })
   await userPage.goto(origin)
   await userPage.locator('input[type=email]').fill('positive-control@example.invalid')
   result.initScriptPositiveControl = await userPage.evaluate(() => window.__uChanProbeInputCount > 0)
+  if (matrix) { await new Promise(resolve => setTimeout(resolve, 150)); result.allPageInputPositiveControl = sharedInputCount > 0; sharedInputCount = 0 }
   await userPage.goto(origin)
-  browser = await chromium.launch({ headless: true, executablePath: await privateBrowserPath(home) })
-  provider = new CdpBrowserProvider('http://127.0.0.1:9222')
-  const target = new CdpSessionTarget(provider)
+  browser = await chromium.launch({ headless: true, executablePath: await privateBrowserPath(home), args: ['--disable-http2', '--disable-quic'] })
+  provider = new CdpBrowserProvider(endpoint, matrixMetadata ? { validate: async requested => {
+    const { inspectServiceDesktopBrowser } = await load('dist/platform/windows/desktop-browser.js')
+    return await inspectServiceDesktopBrowser(endpoint, matrixMetadata.ownerSid, { ...process.env, U_CHAN_DESKTOP_HOME: matrixMetadata.desktopHome }, requested) === 'pass'
+  } } : {})
+  const target = new CdpSessionTarget(provider, { hostCheck: (_entry, url) => new URL(url).hostname === '127.0.0.1' })
+  if (matrix) {
+    await provider.withPage(async page => { await page.goto(origin); await page.locator('input[type=email]').fill('cross-connection-control@example.invalid') }, undefined, result.fixtureBrowser)
+    await new Promise(resolve => setTimeout(resolve, 150))
+    result.crossConnectionInputPositiveControl = sharedInputCount > 0
+    sharedInputCount = 0
+  }
   const login = new IsolatedLogin({ launch: async () => browser, target, timeoutMs: 15000, hostCheck: url => new URL(url).hostname === '127.0.0.1' })
-  const outcome = await login.run({ domain: '127.0.0.1', hosts: ['127.0.0.1'], item: 'disposable', loginUrl: origin + '/login', success: { selector: '#signed-in' } }, async () => ({ username, password }))
+  const outcome = await login.run({ domain: '127.0.0.1', hosts: ['127.0.0.1'], item: 'disposable', loginUrl: origin + '/login', success: { selector: '#signed-in' } }, async () => ({ username, password }), { browser: result.fixtureBrowser ?? 'chrome' })
   result.confirmedFixtureLogin = outcome.status === 'logged_in' && receivedCredentials
-  result.sharedInputEvents = await userPage.evaluate(() => window.__uChanProbeInputCount)
+  result.sharedInputEvents = matrix ? sharedInputCount : await userPage.evaluate(() => window.__uChanProbeInputCount)
   await userPage.goto(origin + '/account')
   result.transferredFixtureSession = await userPage.locator('#signed-in').isVisible()
   const { CoreService } = await load('dist/core/service.js')
@@ -60,9 +86,9 @@ try {
   await store.upsert(once)
   let credentialReads = 0
   const deps = { vault: { status: async () => 'unlocked', getLogin: async () => { credentialReads++; return { username, password } } }, allowlist: store, approver: { ask: async () => false }, audit: { record: async () => {} }, login, mode: async () => 'easy' }
-  const core = new CoreService(deps), attempts = await Promise.all([core.login(once.domain), core.login(once.domain)])
+  const core = new CoreService(deps), attempts = await Promise.all([core.login(once.domain, result.fixtureBrowser ?? 'chrome'), core.login(once.domain, result.fixtureBrowser ?? 'chrome')])
   const restarted = new CoreService({ ...deps, allowlist: new AllowlistStore(grantPath) })
-  const replay = await restarted.login(once.domain)
+  const replay = await restarted.login(once.domain, result.fixtureBrowser ?? 'chrome')
   result.onceGrantConcurrency = attempts.filter(r => r.ok).length === 1 && attempts.filter(r => r.code === 'grant_exhausted').length === 1 && credentialReads === 1 && replay.code === 'grant_exhausted'
   let wall = Date.now(), mono = 0
   const timed = { ...once, grantId: randomUUID(), remainingUses: undefined, expiresAt: new Date(wall + 60000).toISOString() }
@@ -71,6 +97,19 @@ try {
   wall -= 5000; mono += 1000
   await clock.run(async () => {})
   result.clockRollbackPersisted = (await new AllowlistStore(grantPath).get(timed.domain)).expiresAt === new Date(0).toISOString()
+  if (matrix) {
+    const { createPrivateNetwork } = await load('dist/service/private-network.js')
+    const network = await createPrivateNetwork(url => new URL(url).protocol === 'https:' && new URL(url).hostname === 'example.com', AbortSignal.timeout(20000))
+    const context = await browser.newContext({ serviceWorkers: 'block', proxy: network.proxy })
+    try {
+      const page = await context.newPage()
+      const response = await page.goto('https://example.com/', { waitUntil: 'domcontentloaded', timeout: 15000 })
+      const security = await response?.securityDetails()
+      result.privateHttpsHttpStatus = response?.status()
+      result.privateHttpsProtocol = security?.protocol?.startsWith('TLS') ? security.protocol : 'unknown'
+      result.privateHttpsCertificateValidated = !!response && new URL(response.url()).origin === 'https://example.com' && new URL(page.url()).origin === 'https://example.com' && result.privateHttpsProtocol !== 'unknown'
+    } finally { await context.close(); await network.close() }
+  }
   await fs.mkdir(path.join(root, 'bw-fixture'))
   bitwarden = spawn(path.join(home, 'bin', 'bw.exe'), ['status'], { windowsHide: true, stdio: 'ignore', env: { ...process.env, BITWARDENCLI_APPDATA_DIR: path.join(root, 'bw-fixture'), BW_NOINTERACTION: 'true' } })
   const bwFinished = new Promise(resolve => bitwarden.once('exit', resolve))
@@ -103,7 +142,7 @@ try {
   if (verified.ok) {
     const updateHome = path.join(root, 'update-fixture'), programDir = path.join(updateHome, 'program')
     await fs.mkdir(path.join(programDir, 'node_modules'), { recursive: true })
-    const pkg = JSON.parse(await fs.readFile(path.join(home, 'program', 'package.json'), 'utf8'))
+    const pkg = JSON.parse(await fs.readFile(path.join(program, 'package.json'), 'utf8'))
     await fs.writeFile(path.join(programDir, 'package.json'), JSON.stringify({ ...pkg, version: '3.0.1' }))
     await fs.writeFile(path.join(programDir, 'node_modules', 'private-marker'), 'preserve-private-dependencies')
     const state = JSON.stringify({ protectedFixture: randomUUID() })
@@ -115,6 +154,7 @@ try {
     result.signedUpdateRehearsal = updated.ok && JSON.parse(await fs.readFile(path.join(programDir, 'package.json'), 'utf8')).version === '3.0.2' && await fs.readFile(path.join(programDir, 'node_modules', 'private-marker'), 'utf8') === 'preserve-private-dependencies' && await fs.readFile(path.join(updateHome, 'settings.json'), 'utf8') === state && restarts === 1
   }
   result.ok = result.initScriptPositiveControl && result.confirmedFixtureLogin && result.sharedInputEvents === 0 && result.transferredFixtureSession && result.onceGrantConcurrency && result.clockRollbackPersisted && moduleAuditSucceeded(result.nativeModules) && result.realRegistryVerification && result.signedUpdateRehearsal && matches === 0
+  if (matrix) result.ok &&= result.allPageInputPositiveControl && result.crossConnectionInputPositiveControl && result.desktopIdentity === 'pass' && result.wrongBrowserRejected && result.privateHttpsCertificateValidated && ['chrome','edge'].includes(result.fixtureBrowser)
 } catch (e) { result.errorType = e.name }
 finally {
   clearTimeout(bwTimer); if (bitwarden && bitwarden.exitCode === null) bitwarden.kill()

package/scripts/windows-security/desktop-matrix.mjs

@@ -0,0 +1,54 @@
+// User-side half of the disposable Windows browser matrix. The administrator runs the SYSTEM fixture separately.
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import os from 'node:os'
+import { fileURLToPath } from 'node:url'
+import { createServer } from 'node:net'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { chromium } from 'playwright'
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
+import { isElevated } from '../../dist/client/codex-setup.js'
+import { inspectDesktopBrowser } from '../../dist/platform/windows/desktop-browser.js'
+const [command, browser, runId] = process.argv.slice(2)
+if (process.platform !== 'win32' || command !== '--prepare' || !['chrome','edge'].includes(browser) || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(runId ?? '')) throw new Error('Use --prepare chrome|edge <fresh UUID> on Windows')
+if (await isElevated()) throw new Error('Prepare must run as the non-elevated desktop owner')
+const root = path.join(os.tmpdir(), 'u-chan-v5-matrix-' + runId), home = path.join(root, browser)
+await fs.mkdir(root) // A fresh UUID must never reuse another fixture or personal profile.
+await fs.mkdir(home)
+const port = await new Promise((resolve, reject) => { const server = createServer(); server.once('error', reject); server.listen(0, '127.0.0.1', () => { const selected = server.address().port; server.close(() => resolve(selected)) }) })
+const endpoint = 'http://127.0.0.1:' + port, environment = { ...process.env, U_CHAN_HOME: home, U_CHAN_CDP: endpoint, U_CHAN_BROWSER: browser }
+const report = { runId, browser, ok: false }, exec = promisify(execFile)
+let connection
+try {
+  await exec('powershell.exe', ['-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-File',fileURLToPath(new URL('../start-browser.ps1',import.meta.url)),'-Browser',browser,'-Background'], { env: environment, windowsHide: true, timeout: 30000 })
+  report.desktopIdentity = await inspectDesktopBrowser({ endpoint, browser, profile: path.join(home,browser+'-profile') },environment)
+  if (report.desktopIdentity !== 'pass') throw new Error('Disposable browser identity failed')
+  connection = await chromium.connectOverCDP(endpoint)
+  await fs.writeFile(path.join(root,'prepared.json'),JSON.stringify({runId,browser,home,endpoint}),{flag:'wx'})
+  console.log(JSON.stringify({prepared:true,runId,browser,endpoint}))
+  const receipt = path.join(process.env.ProgramData ?? 'C:\\ProgramData','UChanSecurityChecks',runId,'report.json'), deadline=Date.now()+600000
+  while(Date.now()<deadline&&!await fs.stat(receipt).catch(()=>null))await new Promise(resolve=>setTimeout(resolve,500))
+  const native = JSON.parse(await fs.readFile(receipt,'utf8'))
+  report.systemFixturePassed = native.ok === true && native.fixtureBrowser === browser && native.desktopIdentity === 'pass'
+  const client = new Client({name:'u-chan-browser-matrix',version:'1.0.0'})
+  const transport = new StdioClientTransport({command:process.execPath,args:[path.join(path.dirname(process.execPath),'node_modules/npm/bin/npx-cli.js'),'@playwright/mcp@latest','--cdp-endpoint',endpoint],stderr:'pipe'})
+  try {
+    await client.connect(transport)
+    report.playwrightTools=(await client.listTools()).tools.length
+    report.sharedBrowserListing=!(await client.callTool({name:'browser_tabs',arguments:{action:'list'}})).isError
+  } finally {await client.close().catch(()=>{});await transport.close().catch(()=>{})}
+  report.ok=report.systemFixturePassed&&report.playwrightTools>0&&report.sharedBrowserListing
+}catch(error){report.errorType=error.name}
+finally{
+  // Only this verified disposable instance may be closed; never enumerate or terminate other browsers.
+  if(connection&&await inspectDesktopBrowser({endpoint,browser,profile:path.join(home,browser+'-profile')},environment)==='pass') {
+    const session=await connection.newBrowserCDPSession().catch(()=>null)
+    await session?.send('Browser.close').catch(()=>{})
+  }
+  await connection?.close().catch(()=>{})
+  await fs.writeFile(path.join(root,'complete.json'),JSON.stringify(report,null,2),{flag:'wx'})
+}
+console.log(JSON.stringify(report))
+if(!report.ok)process.exitCode=1