u-chan-secrets 5.0.0 → 5.1.0

package/dist/platform/windows/assets/prompt-src.js

@@ -303,6 +303,7 @@ namespace UChan.Platform.Windows.Assets
                     if (args[i] == "--domains") domains = ParseLines(args[i + 1]);
                 return RunManagement(title, phrase, lines, domains);
             }
+            if (mode == "password") return RunPasswordDialog(title, phrase, lines);
 
             Form form = new Form();
             form.Text = title;
@@ -311,7 +312,7 @@ namespace UChan.Platform.Windows.Assets
             form.StartPosition = FormStartPosition.CenterScreen;
             form.MaximizeBox = false;
             form.MinimizeBox = false;
-            form.ClientSize = new Size(460, mode == "password" ? 380 : 320);
+            form.ClientSize = new Size(760, 520);
 
             // Anti-phishing phrase banner
             Panel banner = new Panel();
@@ -335,35 +336,16 @@ namespace UChan.Platform.Windows.Assets
             contentPanel.Padding = new Padding(16);
             contentPanel.AutoScroll = true;
 
-            int yOffset = 60;
-            foreach (string line in lines)
-            {
-                Label lbl = new Label();
-                lbl.Text = line;
-                lbl.Location = new Point(16, yOffset);
-                lbl.Size = new Size(428, 22);
-                lbl.AutoEllipsis = true;
-                contentPanel.Controls.Add(lbl);
-                yOffset += 24;
-            }
-
-            TextBox txtPassword = null;
-            if (mode == "password")
-            {
-                Label pwdLabel = new Label();
-                pwdLabel.Text = "Master Password:";
-                pwdLabel.Location = new Point(16, yOffset + 8);
-                pwdLabel.Size = new Size(428, 20);
-                contentPanel.Controls.Add(pwdLabel);
-                yOffset += 30;
-
-                txtPassword = new TextBox();
-                txtPassword.Location = new Point(16, yOffset);
-                txtPassword.Size = new Size(428, 24);
-                txtPassword.UseSystemPasswordChar = true;
-                txtPassword.MaxLength = 512;
-                contentPanel.Controls.Add(txtPassword);
-            }
+            TextBox details = new TextBox();
+            details.Multiline = true;
+            details.ReadOnly = true;
+            details.WordWrap = true;
+            details.ScrollBars = ScrollBars.Vertical;
+            details.MaxLength = 65536;
+            details.Location = new Point(16, 60);
+            details.Size = new Size(728, 330);
+            details.Text = string.Join(Environment.NewLine, lines.ToArray());
+            contentPanel.Controls.Add(details);
 
             // Bottom panel for countdown & buttons
             Panel bottomPanel = new Panel();
@@ -418,10 +400,6 @@ namespace UChan.Platform.Windows.Assets
             form.Shown += (s, e) =>
             {
                 timer.Start();
-                if (txtPassword != null)
-                {
-                    txtPassword.Focus();
-                }
             };
 
             DialogResult result = form.ShowDialog();
@@ -429,16 +407,160 @@ namespace UChan.Platform.Windows.Assets
 
             if (result == DialogResult.OK)
             {
-                if (mode == "password" && txtPassword != null)
-                {
-                    Console.Write(txtPassword.Text);
-                }
                 return 0;
             }
 
             return 1;
         }
 
+        private static int RunPasswordDialog(string title, string phrase, List<string> lines)
+        {
+            using (Form form = new Form())
+            using (Timer timer = new Timer())
+            {
+                bool unlock = lines.Count == 1 && lines[0] == "Unlock the vault";
+                form.Text = title;
+                form.Font = new Font("Segoe UI", 10f);
+                form.AutoScaleDimensions = new SizeF(96f, 96f);
+                form.AutoScaleMode = AutoScaleMode.Dpi;
+                form.StartPosition = FormStartPosition.CenterScreen;
+                form.FormBorderStyle = FormBorderStyle.FixedDialog;
+                form.MaximizeBox = false;
+                form.MinimizeBox = false;
+                form.TopMost = true;
+                form.BackColor = SystemColors.Window;
+                form.ForeColor = SystemColors.WindowText;
+                form.ClientSize = new Size(520, 360);
+                form.Padding = new Padding(24);
+
+                TableLayoutPanel layout = new TableLayoutPanel();
+                layout.Dock = DockStyle.Top;
+                layout.AutoSize = true;
+                layout.ColumnCount = 1;
+                layout.ColumnStyles.Add(new ColumnStyle(SizeType.Percent, 100f));
+                layout.RowCount = 7;
+                for (int row = 0; row < layout.RowCount; row++) layout.RowStyles.Add(new RowStyle(SizeType.AutoSize));
+
+                Label heading = new Label();
+                heading.Text = unlock ? "Unlock vault" : "Confirm action";
+                heading.Font = new Font("Segoe UI", 18f, FontStyle.Bold);
+                heading.AutoSize = true;
+                heading.Margin = new Padding(0, 0, 0, 16);
+
+                Label verification = new Label();
+                verification.Text = "Verification phrase: " + phrase;
+                verification.AutoSize = true;
+                verification.MaximumSize = new Size(472, 0);
+                verification.Dock = DockStyle.Fill;
+                verification.Padding = new Padding(12);
+                verification.Margin = new Padding(0, 0, 0, 16);
+                verification.BackColor = SystemInformation.HighContrast ? SystemColors.Info : Color.FromArgb(235, 243, 255);
+                verification.ForeColor = SystemInformation.HighContrast ? SystemColors.InfoText : Color.FromArgb(16, 44, 87);
+
+                TextBox details = new TextBox();
+                details.Multiline = true;
+                details.ReadOnly = true;
+                details.WordWrap = true;
+                details.ScrollBars = lines.Count > 1 ? ScrollBars.Vertical : ScrollBars.None;
+                details.BorderStyle = BorderStyle.None;
+                details.BackColor = SystemColors.Window;
+                details.ForeColor = SystemColors.WindowText;
+                details.Text = string.Join(Environment.NewLine, lines.ToArray());
+                details.Height = Math.Min(144, Math.Max(32, lines.Count * 22));
+                details.Dock = DockStyle.Fill;
+                details.Margin = new Padding(0, 0, 0, 16);
+                details.AccessibleName = "Requested action";
+                details.TabStop = false;
+
+                Label passwordLabel = new Label();
+                passwordLabel.Text = "Master password";
+                passwordLabel.AutoSize = true;
+                passwordLabel.Margin = new Padding(0, 0, 0, 8);
+
+                TextBox txtPassword = new TextBox();
+                txtPassword.UseSystemPasswordChar = true;
+                txtPassword.MaxLength = 512;
+                txtPassword.Dock = DockStyle.Fill;
+                txtPassword.Margin = new Padding(0, 0, 0, 12);
+                txtPassword.AccessibleName = "Master password";
+                txtPassword.TabIndex = 0;
+
+                Label hint = new Label();
+                hint.Text = "Check your verification phrase before entering your password.";
+                hint.AutoSize = true;
+                hint.MaximumSize = new Size(472, 0);
+                hint.Margin = new Padding(0, 0, 0, 24);
+
+                TableLayoutPanel footer = new TableLayoutPanel();
+                footer.Dock = DockStyle.Fill;
+                footer.AutoSize = true;
+                footer.ColumnCount = 3;
+                footer.ColumnStyles.Add(new ColumnStyle(SizeType.Percent, 100f));
+                footer.ColumnStyles.Add(new ColumnStyle(SizeType.AutoSize));
+                footer.ColumnStyles.Add(new ColumnStyle(SizeType.AutoSize));
+                footer.Margin = new Padding(0);
+                Label countdown = new Label();
+                countdown.AutoSize = true;
+                countdown.Anchor = AnchorStyles.Left;
+                countdown.Margin = new Padding(0, 0, 12, 0);
+                countdown.Text = "Closes in 2:00";
+
+                Button cancel = new Button();
+                cancel.Text = "Cancel";
+                cancel.Size = new Size(96, 36);
+                cancel.Margin = new Padding(0, 0, 8, 0);
+                cancel.DialogResult = DialogResult.Cancel;
+                cancel.TabIndex = 2;
+                Button submit = new Button();
+                submit.Text = unlock ? "Unlock" : "Confirm";
+                submit.Size = new Size(104, 36);
+                submit.Margin = new Padding(0);
+                submit.DialogResult = DialogResult.OK;
+                submit.Enabled = false;
+                submit.TabIndex = 1;
+                submit.FlatStyle = FlatStyle.Flat;
+                submit.FlatAppearance.BorderSize = 1;
+                submit.UseVisualStyleBackColor = false;
+                submit.BackColor = SystemColors.Control;
+                submit.ForeColor = SystemColors.GrayText;
+                txtPassword.TextChanged += delegate {
+                    submit.Enabled = txtPassword.Text.Length > 0;
+                    submit.BackColor = submit.Enabled ? (SystemInformation.HighContrast ? SystemColors.Highlight : Color.FromArgb(29, 78, 216)) : SystemColors.Control;
+                    submit.ForeColor = submit.Enabled ? (SystemInformation.HighContrast ? SystemColors.HighlightText : Color.White) : SystemColors.GrayText;
+                };
+                footer.Controls.Add(countdown, 0, 0);
+                footer.Controls.Add(cancel, 1, 0);
+                footer.Controls.Add(submit, 2, 0);
+                layout.Controls.Add(heading, 0, 0);
+                layout.Controls.Add(verification, 0, 1);
+                layout.Controls.Add(details, 0, 2);
+                layout.Controls.Add(passwordLabel, 0, 3);
+                layout.Controls.Add(txtPassword, 0, 4);
+                layout.Controls.Add(hint, 0, 5);
+                layout.Controls.Add(footer, 0, 6);
+                form.Controls.Add(layout);
+                form.AcceptButton = submit;
+                form.CancelButton = cancel;
+                form.Load += delegate {
+                    layout.PerformLayout();
+                    form.ClientSize = new Size(form.ClientSize.Width, layout.GetPreferredSize(new Size(layout.Width, 0)).Height + form.Padding.Vertical);
+                };
+                int remainingSeconds = 120;
+                timer.Interval = 1000;
+                timer.Tick += delegate {
+                    remainingSeconds--;
+                    countdown.Text = "Closes in " + (remainingSeconds / 60).ToString() + ":" + (remainingSeconds % 60).ToString("00");
+                    if (remainingSeconds <= 0) { form.DialogResult = DialogResult.Cancel; form.Close(); }
+                };
+                form.Shown += delegate { txtPassword.Focus(); timer.Start(); };
+                DialogResult result = form.ShowDialog();
+                timer.Stop();
+                if (result == DialogResult.OK) Console.Write(txtPassword.Text);
+                txtPassword.Clear();
+                return result == DialogResult.OK ? 0 : 1;
+            }
+        }
+
         private static int RunManagement(string title, string phrase, List<string> lines, List<string> domains)
         {
             using (Form form = new Form())

package/dist/platform/windows/doctor.js

@@ -2,8 +2,8 @@ import { commandState } from '../../core/doctor.js';
 export const checkWindowsRegistration = () => commandState('sc.exe', ['query', 'u-chan-secrets'], s => /SERVICE_NAME:\s*u-chan-secrets/i.test(s));
 export const checkWindowsUac = () => commandState('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
     "$p=Get-ItemProperty -LiteralPath 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System'; if($p.EnableLUA -eq 1 -and $p.ConsentPromptBehaviorAdmin -eq 2 -and $p.PromptOnSecureDesktop -eq 1){'SAFE'}else{'UNSAFE'}"], s => s.trim() === 'SAFE');
-export function checkWindowsPermissions(home) {
+export function checkWindowsPermissions(home, recursive = true) {
     const encoded = Buffer.from(home, 'utf8').toString('base64');
-    const script = `$ErrorActionPreference='Stop'; $p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); $root=Get-Item -LiteralPath $p -Force; if($root.Attributes -band [IO.FileAttributes]::ReparsePoint){'UNSAFE';exit}; $items=@($root)+@(Get-ChildItem -LiteralPath $p -Force -Recurse); foreach($i in $items){if($i.Attributes -band [IO.FileAttributes]::ReparsePoint){'UNSAFE';exit}; $acl=$i.GetAccessControl(); $owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value; if($owner -notin @('S-1-5-18','S-1-5-32-544')){'UNSAFE';exit}; foreach($ace in $acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])){if($ace.AccessControlType -eq 'Allow' -and $ace.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544')){'UNSAFE';exit}} }; 'SAFE'`;
+    const script = `$ErrorActionPreference='Stop'; $p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')); $root=Get-Item -LiteralPath $p -Force; if($root.Attributes -band [IO.FileAttributes]::ReparsePoint){'UNSAFE';exit}; $items=@($root)${recursive ? '+@(Get-ChildItem -LiteralPath $p -Force -Recurse)' : ''}; foreach($i in $items){if($i.Attributes -band [IO.FileAttributes]::ReparsePoint){'UNSAFE';exit}; $acl=$i.GetAccessControl(); $owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value; if($owner -notin @('S-1-5-18','S-1-5-32-544')){'UNSAFE';exit}; foreach($ace in $acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])){if($ace.AccessControlType -eq 'Allow' -and $ace.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544')){'UNSAFE';exit}} }; 'SAFE'`;
     return commandState('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], s => s.trim() === 'SAFE', 60000);
 }

package/dist/platform/windows/install.js

@@ -92,6 +92,10 @@ export async function installWindowsService(opts = {}) {
         const pkgRoot = opts.packageRoot ?? fileURLToPath(new URL('../../../', import.meta.url));
         await fs.cp(path.join(pkgRoot, 'dist'), path.join(stagedProgram, 'dist'), { recursive: true });
         await fs.cp(path.join(pkgRoot, 'package.json'), path.join(stagedProgram, 'package.json'));
+        await fs.mkdir(path.join(stagedProgram, 'scripts'));
+        for (const file of ['start-browser.ps1', 'desktop-browser.ps1']) {
+            await fs.copyFile(path.join(pkgRoot, 'scripts', file), path.join(stagedProgram, 'scripts', file));
+        }
         const srcNm = path.join(pkgRoot, 'node_modules');
         const destNm = path.join(stagedProgram, 'node_modules');
         {

package/dist/service/control.js

@@ -3,18 +3,22 @@ import { LOGIN_MSG } from '../core/vault.js';
 import { redact } from '../core/redact.js';
 import { UserFacingError } from '../core/types.js';
 import { GrantCoordinator } from './grants.js';
+import { performance } from 'node:perf_hooks';
 const BLOCKED = 'too many wrong passwords — try again in 15 minutes';
 const TITLE = 'U-Chan Secrets';
 /** Commands from the `u-chan` CLI. Audit entries never contain passwords or sessions. */
 export class ControlService {
     d;
     grants;
+    unlockPending;
+    lockEpoch = 0;
+    agentUnlockAfter = -Infinity;
     constructor(d) {
         this.d = d;
         this.grants = d.grants ?? new GrantCoordinator(d.allowlist);
     }
     async capabilities() {
-        return { ok: true, message: JSON.stringify({ protocol: 3, features: ['doctor', 'success_conditions', 'grants', 'verified_session_transfer'], serviceVersion: this.d.serviceVersion }) };
+        return { ok: true, message: JSON.stringify({ protocol: 3, features: ['doctor', 'success_conditions', 'grants', 'verified_session_transfer', 'agent_unlock', ...(this.d.githubSupported ? ['github_broker'] : []), ...(this.d.discordSupported ? ['discord_broker', 'discord_discovery'] : []), ...(this.d.updateBoot ? ['coordinated_update'] : [])], serviceVersion: this.d.serviceVersion, ...(this.d.updateBoot ? { release: this.d.updateBoot } : {}) }) };
     }
     async diagnose() {
         try {
@@ -63,15 +67,53 @@ export class ControlService {
         limiter.fail();
         return { ok: false, message: 'wrong password' };
     }
-    unlock() {
-        return this.guarded('unlock', async () => {
-            if ((await this.d.vault.status()) === 'unauthenticated')
+    requestUnlock() { return this.unlock(true); }
+    unlock(agentRequested = false) {
+        if (this.unlockPending)
+            return this.unlockPending;
+        const epoch = this.lockEpoch;
+        let prompted = false;
+        const pending = this.guarded('unlock', async () => {
+            const status = await this.d.vault.status();
+            if (epoch !== this.lockEpoch)
+                return { ok: false, message: 'unlock cancelled by lock' };
+            if (status === 'unauthenticated')
                 return { ok: false, message: LOGIN_MSG };
-            const refused = await this.checkedPassword(['Unlock the vault'], (pw) => this.d.vault.unlock(pw));
+            if (status === 'unlocked')
+                return { ok: true, message: 'already unlocked' };
+            if (status !== 'locked')
+                return { ok: false, message: 'vault unavailable; run u-chan doctor' };
+            if (agentRequested) {
+                if (this.d.limiter.blocked())
+                    return { ok: false, message: BLOCKED };
+                const now = this.d.now?.() ?? performance.now();
+                if (now < this.agentUnlockAfter)
+                    return { ok: false, message: 'unlock prompt cooldown; wait 30 seconds or use u-chan unlock manually' };
+                this.agentUnlockAfter = now + 30000;
+            }
+            prompted = !this.d.limiter.blocked();
+            const refused = await this.checkedPassword(['Unlock the vault'], async (pw) => {
+                if (epoch !== this.lockEpoch)
+                    throw new UserFacingError('unlock cancelled by lock');
+                const unlocked = await this.d.vault.unlock(pw);
+                if (epoch !== this.lockEpoch) {
+                    await this.d.vault.lock();
+                    throw new UserFacingError('unlock cancelled by lock');
+                }
+                return unlocked;
+            });
             return refused ?? { ok: true, message: 'unlocked' };
+        }).finally(() => {
+            if (prompted)
+                this.agentUnlockAfter = (this.d.now?.() ?? performance.now()) + 30000;
+            if (this.unlockPending === pending)
+                this.unlockPending = undefined;
         });
+        this.unlockPending = pending;
+        return pending;
     }
     lock() {
+        this.lockEpoch++;
         return this.guarded('lock', async () => {
             await this.d.vault.lock();
             return { ok: true, message: 'locked' };

package/dist/service/doctor.js

@@ -8,6 +8,9 @@ export async function diagnoseService(home, vault, platform, cdpEndpoint) {
     const paths = [join(home, 'program', 'dist', 'service', 'main.js'), join(home, 'program', 'node_modules'),
         platform === 'win32' ? join(home, 'bin', 'node.exe') : process.execPath,
         platform === 'win32' ? join(home, 'bin', 'bw.exe') : join(home, 'bin', 'bw')];
+    if (platform === 'win32')
+        for (const file of ['start-browser.ps1', 'desktop-browser.ps1'])
+            paths.push(join(home, 'program', 'scripts', file));
     const [assets, permissions, status, browser, browserKind] = await Promise.all([
         bounded(async () => {
             await privateBrowserPath(home);

package/dist/service/main.js

@@ -18,7 +18,11 @@ import { IsolatedLogin } from './isolated-login.js';
 import { PolicyApprover } from './policy-approver.js';
 import { SettingsStore } from './settings.js';
 import { NpmPackageVerifier } from './update/verifier.js';
-import { ServiceUpdater } from './update/updater.js';
+import { UpdateCoordinator } from './update/coordinator.js';
+import { UpdateGate } from './update/gate.js';
+import { readBootIdentity } from './update/files.js';
+import { productionJournal, secureUpdateDirectory, verifyUpdateActive, launchUpdateWorker } from './update/native.js';
+import { boundedRegistryFetch } from './update/network.js';
 import { diagnoseService } from './doctor.js';
 import { GrantCoordinator } from './grants.js';
 import { ensureV3State } from './state.js';
@@ -26,6 +30,13 @@ import { ManagementService } from './manage.js';
 import { privateBrowserPath } from '../platform/runtime-assets.js';
 import { safeVersion } from '../core/doctor.js';
 import { inspectServiceDesktopBrowser } from '../platform/windows/desktop-browser.js';
+import { DiscordStore } from '../discord/store.js';
+import { DiscordService } from '../discord/service.js';
+import { DiscordHttp } from '../discord/http.js';
+import { backupDiscordState } from './state.js';
+import { GithubStore, backupGithubPolicy } from '../github/store.js';
+import { GithubService } from '../github/service.js';
+import { GithubHttp } from '../github/http.js';
 export function prepareSocketEndpoint(endpoint, platform = process.platform) {
     if (platform !== 'win32') {
         const dir = dirname(endpoint);
@@ -61,6 +72,12 @@ export async function runService(platform = process.platform, env = process.env)
         const allowlist = new AllowlistStore(cfg.allowlistPath, () => stateReady ??= ensureV3State(cfg.home).catch(e => { stateReady = undefined; throw e; }));
         const grants = new GrantCoordinator(allowlist);
         const audit = new FileAuditLog(cfg.auditPath);
+        let discordStateReady;
+        const discordStore = new DiscordStore(cfg.discordAllowlistPath, () => discordStateReady ??= backupDiscordState(cfg.home).catch(e => { discordStateReady = undefined; throw e; }));
+        const discord = new DiscordService({ platform, store: discordStore, vault, approver, audit, http: new DiscordHttp(), queue: work => grants.run(work) });
+        let githubStateReady;
+        const githubStore = new GithubStore(join(cfg.home, 'github-allowlist.json'), () => githubStateReady ??= ensureV3State(cfg.home).then(() => backupGithubPolicy(cfg.home, secureUpdateDirectory)).catch(error => { githubStateReady = undefined; throw error; }));
+        const github = new GithubService({ platform, store: githubStore, vault, approver, audit, http: new GithubHttp(), queue: work => grants.run(work) });
         const endpoint = loadConfig(env, platform).cdpEndpoint;
         const validateTarget = platform === 'win32' ? async (browser = 'chrome') => {
             const owner = (await settings.get()).authorizedSid;
@@ -76,27 +93,27 @@ export async function runService(platform = process.platform, env = process.env)
             currentVersion = safeVersion(JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version) ?? 'unknown';
         }
         catch { }
-        const verifier = new NpmPackageVerifier();
-        const restarter = {
-            restart: async () => {
-                process.exit(0);
-            },
-        };
-        const updater = new ServiceUpdater({
-            verifier,
-            restarter,
-            programDir: cfg.programDir,
-            stagingDir: cfg.stagingDir,
-            currentVersion,
-        });
-        const diagnose = async () => ({ ...await diagnoseService(cfg.home, vault, platform, loadConfig(env, platform).cdpEndpoint), serviceVersion: safeVersion(currentVersion) });
-        const control = new ControlService({ vault, approver, limiter, settings, allowlist, grants, audit, platform, updater, diagnose, serviceVersion: safeVersion(currentVersion), manage: () => manager.open() });
+        const updateBoot = await readBootIdentity(cfg.programDir), updateGate = new UpdateGate();
+        const coordinator = new UpdateCoordinator({ home: cfg.home, boot: updateBoot, platform, verifier: new NpmPackageVerifier({ fetcher: boundedRegistryFetch }), journal: productionJournal(cfg.home), gate: updateGate,
+            secure: secureUpdateDirectory, verifyActive: path => verifyUpdateActive(cfg.home, path), launch: job => launchUpdateWorker(cfg.home, job), audit: result => audit.record({ action: 'update', domain: '', result }) });
+        await coordinator.refreshGate();
+        const updater = { update: async () => ({ ok: false, message: 'Use a coordinated-update desktop client; legacy service-only update is disabled' }) };
+        const diagnose = async () => ({ ...await diagnoseService(cfg.home, vault, platform, loadConfig(env, platform).cdpEndpoint), serviceVersion: safeVersion(currentVersion), discordPolicy: await discordStore.list().then(() => 'pass', () => 'fail'), discordBroker: platform === 'win32' ? 'available' : 'unsupported' });
+        const control = new ControlService({ vault, approver, limiter, settings, allowlist, grants, audit, platform, updater, diagnose, serviceVersion: safeVersion(currentVersion), manage: () => manager.open(), discordSupported: platform === 'win32', githubSupported: platform === 'win32', updateBoot });
         const manager = new ManagementService({
             store: allowlist, grants, vault, audit, diagnose, phrase: async () => (await settings.get()).phrase,
             show: req => adapters.prompt.manage ? adapters.prompt.manage(req) : Promise.reject(new Error('unsupported')),
             lock: () => control.lock(), unlock: () => control.unlock(), revoke: domain => core.revoke(domain),
+            discordStore, discordRevoke: alias => discord.discordRevoke(alias),
         });
         const api = {
+            requestUnlock: () => control.requestUnlock(), githubRequestAllow: proposal => github.githubRequestAllow(proposal), githubListAllowed: () => github.githubListAllowed(), githubRead: (alias, request) => github.githubRead(alias, request), githubCreate: (alias, operation) => github.githubCreate(alias, operation), githubRevoke: alias => github.githubRevoke(alias),
+            planUpdate: () => coordinator.planUpdate(), beginUpdate: target => coordinator.beginUpdate(target), updateStatus: id => coordinator.updateStatus(id), activateUpdate: id => coordinator.activateUpdate(id), confirmUpdateReady: id => coordinator.confirmUpdateReady(id),
+            discordRequestAllow: proposal => discord.discordRequestAllow(proposal),
+            discordListAllowed: () => discord.discordListAllowed(),
+            discordInspect: (alias, memberId, page) => discord.discordInspect(alias, memberId, page),
+            discordApply: (alias, operations) => discord.discordApply(alias, operations),
+            discordRevoke: alias => discord.discordRevoke(alias),
             capabilities: () => control.capabilities(),
             diagnose: () => control.diagnose(),
             manage: () => control.manage(),
@@ -112,7 +129,7 @@ export async function runService(platform = process.platform, env = process.env)
             audit: (limit) => control.audit(limit),
             update: () => control.update(),
         };
-        const server = await startIpcServer(cfg.endpoint, api, { authorize: adapters.authorize });
+        const server = await startIpcServer(cfg.endpoint, api, { authorize: adapters.authorize, admission: updateGate, beforeRequest: () => coordinator.refreshGate(), afterResponse: (method, params) => coordinator.afterResponse(method, String(params.id ?? '')) });
         console.error(`U-Chan service listening on ${cfg.endpoint}`);
         return server;
     }

package/dist/service/manage.js

@@ -21,10 +21,21 @@ export class ManagementService {
                         this.d.store.list(), bounded(() => this.d.vault.status(), 'unavailable'),
                         bounded(() => this.d.audit.readTail(10), []), bounded(this.d.diagnose, null, SERVICE_DIAGNOSTIC_TIMEOUT_MS),
                     ]);
-                    const all = entries.filter(e => e.domain === normalizeDomain(e.domain));
+                    const website = entries.filter(e => e.domain === normalizeDomain(e.domain)).map(e => {
+                        let label = e.expiresAt ? 'until ' + e.expiresAt : e.remainingUses !== undefined ? e.remainingUses + ' attempts remaining' : 'permanent';
+                        try {
+                            this.d.grants.check(e);
+                        }
+                        catch {
+                            label = e.remainingUses === 0 ? 'exhausted' : 'expired';
+                        }
+                        return { target: e.domain, line: clean(e.domain) + ' — ' + label };
+                    });
+                    const discord = (await this.d.discordStore?.list() ?? []).map(e => ({ target: 'discord:' + e.alias, line: `Discord: ${e.alias} — server ${e.guildId} — metadata reads; protected approval for every write` }));
+                    const all = [...website, ...discord];
                     page = Math.min(page, Math.max(0, Math.ceil(all.length / 20) - 1));
                     const grants = all.slice(page * 20, page * 20 + 20);
-                    const lines = ['Vault: ' + status, lastAction, 'Grant page ' + (page + 1) + ': ' + grants.length + ' of ' + entries.length + ' shown. Use Previous/Next for more.'];
+                    const lines = ['Vault: ' + status, lastAction, 'Grant page ' + (page + 1) + ': ' + grants.length + ' of ' + all.length + ' shown. Use Previous/Next for more.'];
                     lines.push('Service version: ' + (safeVersion(checks?.serviceVersion) ?? 'unknown'), 'Service browser: ' + (['pass', 'fail'].includes(checks?.browser ?? '') ? checks?.browser : 'unknown'));
                     lines.push('Observed desktop browser: ' + (checks?.browserKind === 'edge' ? 'Edge' : checks?.browserKind === 'chrome' ? 'Chrome' : 'unknown'));
                     if (status === 'locked')
@@ -33,24 +44,16 @@ export class ManagementService {
                         lines.push('Next step: run u-chan doctor; repair from a trusted administrator terminal.');
                     if (checks?.browser !== 'pass')
                         lines.push('Next step: start the selected dedicated browser and run u-chan setup.');
-                    for (const e of grants) {
-                        let label = e.expiresAt ? 'until ' + e.expiresAt : e.remainingUses !== undefined ? e.remainingUses + ' attempts remaining' : 'permanent';
-                        try {
-                            this.d.grants.check(e);
-                        }
-                        catch {
-                            label = e.remainingUses === 0 ? 'exhausted' : 'expired';
-                        }
-                        lines.push(clean(e.domain) + ' — ' + label);
-                    }
+                    for (const e of grants)
+                        lines.push(e.line);
                     lines.push('Revocation stops future logins. It does not log out existing browser sessions.', 'Revocation waits for any earlier login to finish.', 'Diagnostics: assets ' + (checks?.assets ?? 'unknown') + '; permissions ' + (checks?.permissions ?? 'unknown'), 'Recent activity:');
                     for (const e of events.slice(-10)) {
                         const ts = Number.isFinite(Date.parse(e.ts)) ? new Date(e.ts).toISOString() : 'unknown time';
-                        const action = ['login', 'request_allow', 'revoke', 'unlock', 'lock', 'mode', 'import', 'update'].includes(e.action) ? e.action : 'event';
+                        const action = ['login', 'request_allow', 'revoke', 'unlock', 'lock', 'mode', 'import', 'update', 'discord_allow', 'discord_read', 'discord_write', 'discord_revoke'].includes(e.action) ? e.action : 'event';
                         const result = e.result.startsWith('failed') ? 'failed' : e.result === 'denied' ? 'denied' : e.result.startsWith('approved') ? 'approved' : 'recorded';
                         lines.push(ts + ' ' + action + ' ' + clean(e.domain).slice(0, 253) + ' ' + result);
                     }
-                    return { title: 'U-Chan Secrets — Manage', phrase: await this.d.phrase(), lines: lines.filter(Boolean), domains: grants.map(e => e.domain) };
+                    return { title: 'U-Chan Secrets — Manage', phrase: await this.d.phrase(), lines: lines.filter(Boolean), domains: grants.map(e => e.target) };
                 });
                 // Each native window closes before a protected password prompt can open.
                 const action = await this.d.show(snapshot);
@@ -71,8 +74,9 @@ export class ManagementService {
                     result = await this.d.lock();
                 else if (action.action === 'unlock')
                     result = await this.d.unlock();
-                else if (action.action === 'revoke' && typeof action.domain === 'string' && snapshot.domains?.includes(action.domain))
-                    result = await this.d.revoke(action.domain);
+                else if (action.action === 'revoke' && typeof action.domain === 'string' && snapshot.domains?.includes(action.domain)) {
+                    result = action.domain.startsWith('discord:') && this.d.discordRevoke ? await this.d.discordRevoke(action.domain.slice(8)) : await this.d.revoke(action.domain);
+                }
                 else
                     return { ok: false, message: 'invalid management action or target' };
                 lastAction = result.ok ? 'Last action completed.' : 'Last action failed. Run u-chan doctor for guidance.';

package/dist/service/state.js

@@ -1,5 +1,6 @@
 import { chmod, cp, lstat, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
 import { UserFacingError } from '../core/types.js';
 import { setAdminOnlyAcl } from '../platform/windows/acl.js';
 import { checkWindowsPermissions } from '../platform/windows/doctor.js';
@@ -86,3 +87,30 @@ export async function ensureV3State(home, secureDirectory = protect) {
     await writeFile(tmp, JSON.stringify({ schema: 3, minimumServiceMajor: 3 }), { mode: 0o600 });
     await rename(tmp, join(home, 'schema.json'));
 }
+/** A protected metadata snapshot before the broker's first state mutation in this process. */
+export async function backupDiscordState(home, secureDirectory = protect) {
+    await ensureV3State(home, secureDirectory);
+    await secureDirectory(home);
+    const parent = join(home, '#0 backup');
+    await mkdir(parent, { mode: 0o700, recursive: true });
+    await secureDirectory(parent);
+    const backup = join(parent, 'discord-before-' + randomUUID());
+    await mkdir(backup, { mode: 0o700 });
+    await secureDirectory(backup);
+    for (const name of ['discord-allowlist.json', 'allowlist.json', 'settings.json', 'schema.json']) {
+        const source = join(home, name);
+        let stat;
+        try {
+            stat = await lstat(source);
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                continue;
+            throw e;
+        }
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw new UserFacingError('protected backup refuses links and non-files');
+        await cp(source, join(backup, name), { force: false, errorOnExist: true });
+    }
+    await writeFile(join(backup, 'complete'), 'discord_broker', { mode: 0o600, flag: 'wx' });
+}