u-chan-secrets 5.0.0 → 5.1.0

package/dist/service/update/worker-main.js

@@ -0,0 +1,116 @@
+import { readFile, lstat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { defaultProgramData } from '../../platform/windows/install.js';
+import { ServiceManager } from '../../platform/windows/service-manager.js';
+import { productionJournal, verifyUpdateActive, secureUpdateDirectory } from './native.js';
+import { idSchema, sameIdentity } from './protocol.js';
+import { artifactIntegrity, inspectRelease } from './release.js';
+import { noLinks } from './journal.js';
+import { runUpdateTransaction } from './worker.js';
+import { assertCompatibleState } from '../state.js';
+const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+const alive = (pid) => { try {
+    process.kill(pid, 0);
+    return true;
+}
+catch {
+    return false;
+} };
+async function main() {
+    if (process.platform !== 'win32' || !process.send)
+        throw new Error('unsupported_worker');
+    const home = process.env.U_CHAN_HOME ?? defaultProgramData(), id = idSchema.parse(process.argv[2]), journal = productionJournal(home), job = await journal.read(id);
+    if (job.parentPid !== process.ppid || job.phase !== 'switching')
+        throw new Error('invalid_worker_parent');
+    delete process.env.BW_SESSION;
+    process.send({ type: 'ready', id, nonce: job.nonce });
+    await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error('handoff_timeout')), 30000);
+        process.on('message', message => { const m = message; if (m?.type === 'start' && m.id === id && m.nonce === job.nonce) {
+            clearTimeout(timer);
+            resolve();
+        } });
+    });
+    const sm = new ServiceManager();
+    const waitStatus = async (status) => { const end = performance.now() + 30000; while (await sm.status('u-chan-secrets') !== status) {
+        if (performance.now() > end)
+            throw new Error('service_timeout');
+        await sleep(200);
+    } };
+    await runUpdateTransaction(journal, id, {
+        verify: async () => {
+            await verifyUpdateActive(home);
+            await assertCompatibleState(home, Number(job.target.version.split('.')[0]));
+            const dir = journal.directory(id), archive = join(dir, 'release.tgz');
+            await noLinks(archive);
+            if ((await lstat(archive)).size > 32 * 1024 * 1024)
+                throw new Error('invalid_release');
+            const bytes = await readFile(archive);
+            if (artifactIntegrity(bytes) !== job.target.integrity)
+                throw new Error('invalid_release');
+            const release = inspectRelease(bytes);
+            for (const [path, expected] of release.files) {
+                const p = join(dir, 'next', path);
+                await noLinks(p);
+                if (!(await readFile(p)).equals(expected))
+                    throw new Error('staged_release_changed');
+            }
+            await verifyUpdateActive(home, join(dir, 'next'));
+            const parent = join(home, '#0 backup');
+            await noLinks(parent);
+            try {
+                await lstat(parent);
+            }
+            catch (e) {
+                if (e.code !== 'ENOENT')
+                    throw e;
+                const fs = await import('node:fs/promises');
+                await fs.mkdir(parent, { mode: 0o700 });
+                await secureUpdateDirectory(parent);
+            }
+            if (await import('../../platform/windows/doctor.js').then(m => m.checkWindowsPermissions(parent, false)) !== 'pass')
+                throw new Error('unsafe_backup_parent');
+        },
+        handoff: async () => {
+            process.send?.({ type: 'activated', id, nonce: job.nonce });
+            const end = performance.now() + 30000;
+            while (alive(job.parentPid)) {
+                if (performance.now() > end)
+                    throw new Error('parent_exit_timeout');
+                await sleep(200);
+            }
+            if (process.connected)
+                process.disconnect?.();
+        },
+        stopForRollback: async () => { if (!alive(job.parentPid)) {
+            await sm.stop('u-chan-secrets');
+            await waitStatus('stopped');
+        } },
+        startSource: async () => { if (!alive(job.parentPid)) {
+            await sm.start('u-chan-secrets');
+            await waitStatus('running');
+        } },
+        waitReady: async (kind) => {
+            const end = performance.now() + 90000, expected = kind === 'target' ? job.target : job.source;
+            let stable = 0, lastPid = 0;
+            while (performance.now() < end) {
+                const m = await journal.marker(id);
+                if (m && m.id === id && m.nonce === job.nonce && m.kind === kind && sameIdentity(m.boot, expected) && alive(m.pid)) {
+                    stable = m.pid === lastPid ? stable + 1 : 1;
+                    lastPid = m.pid;
+                    if (stable >= 2)
+                        return true;
+                }
+                else {
+                    stable = 0;
+                    lastPid = 0;
+                }
+                await sleep(500);
+            }
+            return false;
+        },
+    });
+}
+main().catch(() => { process.exitCode = 1; }).finally(() => { if (process.connected)
+    process.disconnect?.(); });

package/dist/service/update/worker.js

@@ -0,0 +1,58 @@
+import { mkdir, readFile, readdir, rename, lstat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { noLinks } from './journal.js';
+export async function runUpdateTransaction(journal, id, deps) {
+    const job = await journal.read(id);
+    if (job.phase !== 'switching')
+        throw new Error('invalid_update_transition');
+    const program = join(journal.home, 'program'), next = join(journal.directory(id), 'next');
+    const parent = join(journal.home, '#0 backup'), backup = join(parent, 'update-' + id), failed = join(journal.directory(id), 'failed-program');
+    let backedUp = false, activated = false;
+    try {
+        await deps.verify();
+        for (const path of [program, next, parent, backup, failed])
+            await noLinks(path);
+        await mkdir(parent, { recursive: true, mode: 0o700 });
+        for (const path of [backup, failed]) {
+            try {
+                await lstat(path);
+                throw new Error('recovery_path_exists');
+            }
+            catch (e) {
+                if (e.code !== 'ENOENT')
+                    throw e;
+            }
+        }
+        const names = await readdir(program), pkg = await readFile(join(program, 'package.json'));
+        await rename(program, backup);
+        backedUp = true;
+        const moved = await readdir(backup);
+        if (moved.length !== names.length || names.some(n => !moved.includes(n)) || !(await readFile(join(backup, 'package.json'))).equals(pkg))
+            throw new Error('backup_mismatch');
+        await rename(next, program);
+        activated = true;
+        await journal.transition(id, 'waiting_for_service');
+        await deps.handoff();
+        if (!await deps.waitReady('target'))
+            throw new Error('startup_failed');
+        return await journal.transition(id, 'service_ready');
+    }
+    catch {
+        if (!backedUp)
+            return journal.transition(id, 'failed', 'worker_failed');
+        try {
+            await journal.transition(id, 'rolling_back', 'startup_failed');
+            await deps.stopForRollback();
+            if (activated)
+                await rename(program, failed);
+            await rename(backup, program);
+            await deps.startSource();
+            if (!await deps.waitReady('source'))
+                throw new Error('rollback_start_failed');
+            return await journal.transition(id, 'rolled_back', 'startup_failed');
+        }
+        catch {
+            return journal.transition(id, 'recovery_required', 'rollback_failed');
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u-chan-secrets",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "U-Chan Secrets: local MCP server for Bitwarden-backed logins",
   "license": "MIT",
   "type": "module",

package/scripts/debug-install.bat

@@ -1,69 +1,69 @@
-@echo off
-setlocal
-set ROOT=%~dp0..
-
-fltmc.exe >nul 2>&1
-if %errorlevel% neq 0 (
-    echo [*] Requesting Administrator elevation...
-    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
-    exit /b
-)
-
-cd /d "%ROOT%"
-echo ========================================================
-echo       U-Chan Secrets V2 Installation & Setup
-echo ========================================================
-echo.
-echo [*] Step 1: Stopping previous service (if any)...
-taskkill /F /IM prompt-helper.exe >nul 2>&1
-taskkill /F /IM auth-helper.exe >nul 2>&1
-call node dist\cli.js uninstall
-echo.
-echo [*] Step 2: Installing U-Chan Windows Service...
-call node dist\cli.js install
-if %errorlevel% neq 0 (
-    echo.
-    echo [X] Installation failed with exit code %errorlevel%.
-    pause
-    exit /b %errorlevel%
-)
-icacls C:\ProgramData\u-chan-secrets\bin /grant "Users:(OI)(CI)RX" >nul 2>&1
-echo.
-echo [*] Step 3: Checking service status...
-sc.exe query u-chan-secrets
-echo.
-
-echo [*] Step 4: Bitwarden Vault Login...
-set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
-set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
-if not exist "%BW_BIN%" (
-    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
-)
-
-if exist "%BW_BIN%" (
-    "%BW_BIN%" status > "%TEMP%\bw_stat.json" 2>&1
-    findstr /C:"\"unauthenticated\"" "%TEMP%\bw_stat.json" >nul 2>&1
-    if %errorlevel% equ 0 (
-        echo [!] Bitwarden is not logged in for the privileged service.
-        echo [*] Please log in to your Bitwarden vault below:
-        "%BW_BIN%" login
-    ) else (
-        echo [+] Bitwarden vault is already logged in.
-    )
-    del "%TEMP%\bw_stat.json" >nul 2>&1
-) else (
-    echo [!] Warning: bw.exe not found.
-)
-
-echo.
-copy /y C:\ProgramData\u-chan-secrets\service.log "%ROOT%\service-copy.log" >nul 2>&1
-copy /y C:\ProgramData\u-chan-secrets\settings.json "%ROOT%\settings-copy.json" >nul 2>&1
-echo ========================================================
-echo [+] Service and Bitwarden configuration complete!
-echo.
-echo Next: Close this window, open your normal terminal, and run:
-echo    u-chan import-v1
-echo    u-chan unlock
-echo ========================================================
-echo.
-pause
+@echo off
+setlocal
+set ROOT=%~dp0..
+
+fltmc.exe >nul 2>&1
+if %errorlevel% neq 0 (
+    echo [*] Requesting Administrator elevation...
+    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
+    exit /b
+)
+
+cd /d "%ROOT%"
+echo ========================================================
+echo       U-Chan Secrets V2 Installation & Setup
+echo ========================================================
+echo.
+echo [*] Step 1: Stopping previous service (if any)...
+taskkill /F /IM prompt-helper.exe >nul 2>&1
+taskkill /F /IM auth-helper.exe >nul 2>&1
+call node dist\cli.js uninstall
+echo.
+echo [*] Step 2: Installing U-Chan Windows Service...
+call node dist\cli.js install
+if %errorlevel% neq 0 (
+    echo.
+    echo [X] Installation failed with exit code %errorlevel%.
+    pause
+    exit /b %errorlevel%
+)
+icacls C:\ProgramData\u-chan-secrets\bin /grant "Users:(OI)(CI)RX" >nul 2>&1
+echo.
+echo [*] Step 3: Checking service status...
+sc.exe query u-chan-secrets
+echo.
+
+echo [*] Step 4: Bitwarden Vault Login...
+set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
+set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
+if not exist "%BW_BIN%" (
+    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
+)
+
+if exist "%BW_BIN%" (
+    "%BW_BIN%" status > "%TEMP%\bw_stat.json" 2>&1
+    findstr /C:"\"unauthenticated\"" "%TEMP%\bw_stat.json" >nul 2>&1
+    if %errorlevel% equ 0 (
+        echo [!] Bitwarden is not logged in for the privileged service.
+        echo [*] Please log in to your Bitwarden vault below:
+        "%BW_BIN%" login
+    ) else (
+        echo [+] Bitwarden vault is already logged in.
+    )
+    del "%TEMP%\bw_stat.json" >nul 2>&1
+) else (
+    echo [!] Warning: bw.exe not found.
+)
+
+echo.
+copy /y C:\ProgramData\u-chan-secrets\service.log "%ROOT%\service-copy.log" >nul 2>&1
+copy /y C:\ProgramData\u-chan-secrets\settings.json "%ROOT%\settings-copy.json" >nul 2>&1
+echo ========================================================
+echo [+] Service and Bitwarden configuration complete!
+echo.
+echo Next: Close this window, open your normal terminal, and run:
+echo    u-chan import-v1
+echo    u-chan unlock
+echo ========================================================
+echo.
+pause

package/scripts/desktop-browser.ps1

@@ -1,103 +1,110 @@
-# Shared user-side Chrome/Edge launcher and read-only process policy. No elevation or vault access.
-function Split-UChanWindowsCommandLine([string]$CommandLine) {
-    if (-not ('UChanWindowsCommandLine' -as [type])) {
-        Add-Type -TypeDefinition @'
-using System;
-using System.Runtime.InteropServices;
-public static class UChanWindowsCommandLine {
-    [DllImport("shell32.dll", SetLastError=true, CharSet=CharSet.Unicode)] static extern IntPtr CommandLineToArgvW(string value, out int count);
-    [DllImport("kernel32.dll")] static extern IntPtr LocalFree(IntPtr value);
-    public static string[] Split(string value) {
-        int count; IntPtr memory=CommandLineToArgvW(value,out count);
-        if(memory==IntPtr.Zero) throw new InvalidOperationException("Command line is unavailable");
-        try { string[] result=new string[count]; for(int i=0;i<count;i++)result[i]=Marshal.PtrToStringUni(Marshal.ReadIntPtr(memory,i*IntPtr.Size)); return result; }
-        finally { LocalFree(memory); }
-    }
-}
-'@
-    }
-    return [UChanWindowsCommandLine]::Split($CommandLine)
-}
-function Test-UChanBrowserProcess($Observation, [string]$Executable, [string]$Profile, [string]$OwnerSid, [int]$Port) {
-    if (-not $Observation.ExecutablePath -or -not $Observation.OwnerSid -or -not $Observation.CommandLine -or -not $Observation.Addresses) { return 'unknown' }
-    if ($Observation.ExecutablePath -ine $Executable -or $Observation.OwnerSid -ne $OwnerSid) { return 'fail' }
-    foreach ($address in $Observation.Addresses) { if ($address -notin @('127.0.0.1','::1')) { return 'fail' } }
-    try { $tokens = @(Split-UChanWindowsCommandLine $Observation.CommandLine) } catch { return 'unknown' }
-    if ($tokens.Count -lt 1 -or $tokens[0] -ine $Executable) { return 'fail' }
-    $profiles = @($tokens | Where-Object { $_ -imatch '^--user-data-dir(?:=|$)' })
-    if ($profiles.Count -ne 1 -or $profiles[0] -inotmatch '^--user-data-dir=.+$') { return 'fail' }
-    $actual = $profiles[0].Substring('--user-data-dir='.Length)
-    try { if ([IO.Path]::GetFullPath($actual).TrimEnd('\') -ine [IO.Path]::GetFullPath($Profile).TrimEnd('\')) { return 'fail' } } catch { return 'fail' }
-    $ports = @($tokens | Where-Object { $_ -imatch '^--remote-debugging-port(?:=|$)' })
-    if ($ports.Count -ne 1 -or $ports[0] -inotmatch '^--remote-debugging-port=[0-9]+$' -or $ports[0].Substring('--remote-debugging-port='.Length) -ne [string]$Port) { return 'fail' }
-    return 'pass'
-}
-
-function Get-UChanBrowserConfiguration([string]$Browser, [string]$HomeOverride, [string]$OwnerOverride, [string]$LocalOverride) {
-    $userHome = if ($HomeOverride) { $HomeOverride } elseif ($env:U_CHAN_HOME) { $env:U_CHAN_HOME } else { Join-Path $env:APPDATA 'u-chan-secrets' }
-    if (-not $Browser) { $Browser = $env:U_CHAN_BROWSER }
-    if (-not $Browser) {
-        $choice = Join-Path $userHome 'browser.json'
-        if (Test-Path -LiteralPath $choice) {
-            $item = Get-Item -LiteralPath $choice -Force
-            if ($item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Browser preference path is redirected.' }
-            $saved = Get-Content -LiteralPath $choice -Raw | ConvertFrom-Json
-            if (@($saved.PSObject.Properties).Count -ne 1) { throw 'Invalid browser preference.' }
-            $Browser = $saved.browser
-            if (-not $Browser) { throw 'Invalid browser preference.' }
-        } else { $Browser = 'chrome' }
-    }
-    if ($Browser -cnotin @('chrome','edge')) { throw 'Choose chrome or edge.' }
-    $profile = Join-Path $userHome ($Browser + '-profile')
-    $check = [IO.Path]::GetFullPath($profile)
-    while ($check) {
-        if ((Test-Path -LiteralPath $check) -and ((Get-Item -LiteralPath $check -Force).Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Dedicated browser profile is redirected.' }
-        $check = [IO.Path]::GetDirectoryName($check)
-    }
-    $cdp = [Uri]$(if ($env:U_CHAN_CDP) { $env:U_CHAN_CDP } else { 'http://127.0.0.1:9222' })
-    if ($cdp.Scheme -ne 'http' -or $cdp.Host -notin @('127.0.0.1','localhost','[::1]','::1') -or $cdp.UserInfo -or $cdp.AbsolutePath -ne '/' -or $cdp.Query -or $cdp.Fragment) { throw 'Use an HTTP loopback CDP origin without credentials, path, query or fragment.' }
-    $suffix = if ($Browser -eq 'edge') { 'Microsoft\Edge\Application\msedge.exe' } else { 'Google\Chrome\Application\chrome.exe' }
-    $local = if ($LocalOverride) { $LocalOverride } else { $env:LOCALAPPDATA }
-    $candidates = @(foreach ($base in @($env:ProgramFiles, ${env:ProgramFiles(x86)}, $local)) { if ($base) { Join-Path $base $suffix } })
-    $executables = @($candidates | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf })
-    $owner = if ($OwnerOverride) { $OwnerOverride } else { [Security.Principal.WindowsIdentity]::GetCurrent().User.Value }
-    return @{ Browser=$Browser; Profile=$profile; Endpoint=$cdp; Executables=$executables; OwnerSid=$owner }
-}
-
-# Privileged checks derive the desktop home from the installed owner's SID, never SYSTEM's APPDATA or user preference files.
-function Get-UChanOwnerBrowserConfiguration([string]$OwnerSid, [string]$Browser) {
-    if ($OwnerSid -notmatch '^S-1-5-21-(?:[0-9]+-){3}[0-9]+$') { throw 'Installed desktop owner is invalid.' }
-    $profile = (Get-ItemProperty -LiteralPath ('HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\'+$OwnerSid) -ErrorAction Stop).ProfileImagePath
-    if (-not $profile) { throw 'Installed desktop owner profile is unavailable.' }
-    $profile = [Environment]::ExpandEnvironmentVariables($profile)
-    $roaming = Join-Path $profile 'AppData\Roaming'
-    $local = Join-Path $profile 'AppData\Local'
-    $shell = Get-ItemProperty -LiteralPath ('Registry::HKEY_USERS\'+$OwnerSid+'\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders') -ErrorAction SilentlyContinue
-    if ($shell.AppData) { $roaming = [Environment]::ExpandEnvironmentVariables(($shell.AppData -ireplace '%USERPROFILE%', $profile)) }
-    if ($shell.'Local AppData') { $local = [Environment]::ExpandEnvironmentVariables(($shell.'Local AppData' -ireplace '%USERPROFILE%', $profile)) }
-    $desktopHome = if ($env:U_CHAN_DESKTOP_HOME) { $env:U_CHAN_DESKTOP_HOME } else { Join-Path $roaming 'u-chan-secrets' }
-    return Get-UChanBrowserConfiguration $Browser $desktopHome $OwnerSid $local
-}
-
-function Get-UChanBrowserState($Configuration) {
-    try {
-        $listeners = @(Get-NetTCPConnection -State Listen -ErrorAction Stop | Where-Object LocalPort -eq $Configuration.Endpoint.Port)
-        if ($listeners.Count -eq 0) { return 'missing' }
-        $owners = @($listeners.OwningProcess | Select-Object -Unique)
-        if ($owners.Count -ne 1) { return 'fail' }
-        $process = Get-CimInstance Win32_Process -Filter ("ProcessId=" + $owners[0]) -ErrorAction Stop
-        if (-not $process) { return 'unknown' }
-        $owner = Invoke-CimMethod -InputObject $process -MethodName GetOwnerSid -ErrorAction Stop
-        $observation = @{ ExecutablePath=$process.ExecutablePath; OwnerSid=$owner.Sid; CommandLine=$process.CommandLine; Addresses=@($listeners.LocalAddress) }
-        if (-not $process.ExecutablePath) { return 'unknown' }
-        if ($process.ExecutablePath -notin $Configuration.Executables) { return 'fail' }
-        $policy = Test-UChanBrowserProcess $observation $process.ExecutablePath $Configuration.Profile $Configuration.OwnerSid $Configuration.Endpoint.Port
-        if ($policy -ne 'pass') { return $policy }
-        $version = Invoke-RestMethod -Uri ([Uri]::new($Configuration.Endpoint,'/json/version')) -TimeoutSec 2 -ErrorAction Stop
-        $socket = [Uri]$version.webSocketDebuggerUrl
-        if ($socket.Scheme -ne 'ws' -or $socket.Host -notin @('127.0.0.1','localhost','[::1]','::1') -or $socket.Port -ne $Configuration.Endpoint.Port -or $socket.UserInfo) { return 'fail' }
-        $edge = $version.'User-Agent' -match '(?:Edg|Edge)/'
-        if (($Configuration.Browser -eq 'edge') -ne $edge) { return 'fail' }
-        return 'pass'
-    } catch { return 'unknown' }
-}
+# Shared user-side Chrome/Edge launcher and read-only process policy. No elevation or vault access.
+function Split-UChanWindowsCommandLine([string]$CommandLine) {
+    if (-not ('UChanWindowsCommandLine' -as [type])) {
+        Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class UChanWindowsCommandLine {
+    [DllImport("shell32.dll", SetLastError=true, CharSet=CharSet.Unicode)] static extern IntPtr CommandLineToArgvW(string value, out int count);
+    [DllImport("kernel32.dll")] static extern IntPtr LocalFree(IntPtr value);
+    public static string[] Split(string value) {
+        int count; IntPtr memory=CommandLineToArgvW(value,out count);
+        if(memory==IntPtr.Zero) throw new InvalidOperationException("Command line is unavailable");
+        try { string[] result=new string[count]; for(int i=0;i<count;i++)result[i]=Marshal.PtrToStringUni(Marshal.ReadIntPtr(memory,i*IntPtr.Size)); return result; }
+        finally { LocalFree(memory); }
+    }
+}
+'@
+    }
+    return [UChanWindowsCommandLine]::Split($CommandLine)
+}
+function Test-UChanBrowserProcess($Observation, [string]$Executable, [string]$Profile, [string]$OwnerSid, [int]$Port) {
+    if (-not $Observation.ExecutablePath -or -not $Observation.OwnerSid -or -not $Observation.CommandLine -or -not $Observation.Addresses) { return 'unknown' }
+    if ($Observation.ExecutablePath -ine $Executable -or $Observation.OwnerSid -ne $OwnerSid) { return 'fail' }
+    foreach ($address in $Observation.Addresses) { if ($address -notin @('127.0.0.1','::1')) { return 'fail' } }
+    try { $tokens = @(Split-UChanWindowsCommandLine $Observation.CommandLine) } catch { return 'unknown' }
+    if ($tokens.Count -lt 1 -or $tokens[0] -ine $Executable) { return 'fail' }
+    $profiles = @($tokens | Where-Object { $_ -imatch '^--user-data-dir(?:=|$)' })
+    if ($profiles.Count -ne 1 -or $profiles[0] -inotmatch '^--user-data-dir=.+$') { return 'fail' }
+    $actual = $profiles[0].Substring('--user-data-dir='.Length)
+    try { if ([IO.Path]::GetFullPath($actual).TrimEnd('\') -ine [IO.Path]::GetFullPath($Profile).TrimEnd('\')) { return 'fail' } } catch { return 'fail' }
+    $ports = @($tokens | Where-Object { $_ -imatch '^--remote-debugging-port(?:=|$)' })
+    if ($ports.Count -ne 1 -or $ports[0] -inotmatch '^--remote-debugging-port=[0-9]+$' -or $ports[0].Substring('--remote-debugging-port='.Length) -ne [string]$Port) { return 'fail' }
+    return 'pass'
+}
+
+function Get-UChanBrowserConfiguration([string]$Browser, [string]$HomeOverride, [string]$OwnerOverride, [string]$LocalOverride) {
+    $userHome = if ($HomeOverride) { $HomeOverride } elseif ($env:U_CHAN_HOME) { $env:U_CHAN_HOME } else { Join-Path $env:APPDATA 'u-chan-secrets' }
+    if (-not $Browser) { $Browser = $env:U_CHAN_BROWSER }
+    if (-not $Browser) {
+        $choice = Join-Path $userHome 'browser.json'
+        if (Test-Path -LiteralPath $choice) {
+            $item = Get-Item -LiteralPath $choice -Force
+            if ($item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Browser preference path is redirected.' }
+            $saved = Get-Content -LiteralPath $choice -Raw | ConvertFrom-Json
+            if (@($saved.PSObject.Properties).Count -ne 1) { throw 'Invalid browser preference.' }
+            $Browser = $saved.browser
+            if (-not $Browser) { throw 'Invalid browser preference.' }
+        } else { $Browser = 'chrome' }
+    }
+    if ($Browser -cnotin @('chrome','edge')) { throw 'Choose chrome or edge.' }
+    $profile = Join-Path $userHome ($Browser + '-profile')
+    $check = [IO.Path]::GetFullPath($profile)
+    while ($check) {
+        if ((Test-Path -LiteralPath $check) -and ((Get-Item -LiteralPath $check -Force).Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Dedicated browser profile is redirected.' }
+        $check = [IO.Path]::GetDirectoryName($check)
+    }
+    $cdp = [Uri]$(if ($env:U_CHAN_CDP) { $env:U_CHAN_CDP } else { 'http://127.0.0.1:9222' })
+    if ($cdp.Scheme -ne 'http' -or $cdp.Host -notin @('127.0.0.1','localhost','[::1]','::1') -or $cdp.UserInfo -or $cdp.AbsolutePath -ne '/' -or $cdp.Query -or $cdp.Fragment) { throw 'Use an HTTP loopback CDP origin without credentials, path, query or fragment.' }
+    $suffix = if ($Browser -eq 'edge') { 'Microsoft\Edge\Application\msedge.exe' } else { 'Google\Chrome\Application\chrome.exe' }
+    $local = if ($LocalOverride) { $LocalOverride } else { $env:LOCALAPPDATA }
+    $candidates = @(foreach ($base in @($env:ProgramFiles, ${env:ProgramFiles(x86)}, $local)) { if ($base) { Join-Path $base $suffix } })
+    $executables = @($candidates | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf })
+    $owner = if ($OwnerOverride) { $OwnerOverride } else { [Security.Principal.WindowsIdentity]::GetCurrent().User.Value }
+    return @{ Browser=$Browser; Profile=$profile; Endpoint=$cdp; Executables=$executables; OwnerSid=$owner }
+}
+
+# Privileged checks derive the desktop home from the installed owner's SID, never SYSTEM's APPDATA or user preference files.
+function Get-UChanOwnerBrowserConfiguration([string]$OwnerSid, [string]$Browser) {
+    if ($OwnerSid -notmatch '^S-1-5-21-(?:[0-9]+-){3}[0-9]+$') { throw 'Installed desktop owner is invalid.' }
+    $profile = (Get-ItemProperty -LiteralPath ('HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\'+$OwnerSid) -ErrorAction Stop).ProfileImagePath
+    if (-not $profile) { throw 'Installed desktop owner profile is unavailable.' }
+    $profile = [Environment]::ExpandEnvironmentVariables($profile)
+    $roaming = Join-Path $profile 'AppData\Roaming'
+    $local = Join-Path $profile 'AppData\Local'
+    $shell = Get-Item -LiteralPath ('Registry::HKEY_USERS\'+$OwnerSid+'\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders') -ErrorAction SilentlyContinue
+    if ($shell) {
+        # Read REG_EXPAND_SZ literally; Registry providers otherwise expand USERPROFILE as SYSTEM before substitution.
+        try {
+            $rawRoaming = $shell.GetValue('AppData', $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
+            $rawLocal = $shell.GetValue('Local AppData', $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
+        } finally { $shell.Close() }
+        if ($rawRoaming) { $roaming = [Environment]::ExpandEnvironmentVariables(($rawRoaming -ireplace '%USERPROFILE%', $profile)) }
+        if ($rawLocal) { $local = [Environment]::ExpandEnvironmentVariables(($rawLocal -ireplace '%USERPROFILE%', $profile)) }
+    }
+    $desktopHome = if ($env:U_CHAN_DESKTOP_HOME) { $env:U_CHAN_DESKTOP_HOME } else { Join-Path $roaming 'u-chan-secrets' }
+    return Get-UChanBrowserConfiguration $Browser $desktopHome $OwnerSid $local
+}
+
+function Get-UChanBrowserState($Configuration) {
+    try {
+        $listeners = @(Get-NetTCPConnection -State Listen -ErrorAction Stop | Where-Object LocalPort -eq $Configuration.Endpoint.Port)
+        if ($listeners.Count -eq 0) { return 'missing' }
+        $owners = @($listeners.OwningProcess | Select-Object -Unique)
+        if ($owners.Count -ne 1) { return 'fail' }
+        $process = Get-CimInstance Win32_Process -Filter ("ProcessId=" + $owners[0]) -ErrorAction Stop
+        if (-not $process) { return 'unknown' }
+        $owner = Invoke-CimMethod -InputObject $process -MethodName GetOwnerSid -ErrorAction Stop
+        $observation = @{ ExecutablePath=$process.ExecutablePath; OwnerSid=$owner.Sid; CommandLine=$process.CommandLine; Addresses=@($listeners.LocalAddress) }
+        if (-not $process.ExecutablePath) { return 'unknown' }
+        if ($process.ExecutablePath -notin $Configuration.Executables) { return 'fail' }
+        $policy = Test-UChanBrowserProcess $observation $process.ExecutablePath $Configuration.Profile $Configuration.OwnerSid $Configuration.Endpoint.Port
+        if ($policy -ne 'pass') { return $policy }
+        $version = Invoke-RestMethod -Uri ([Uri]::new($Configuration.Endpoint,'/json/version')) -TimeoutSec 2 -ErrorAction Stop
+        $socket = [Uri]$version.webSocketDebuggerUrl
+        if ($socket.Scheme -ne 'ws' -or $socket.Host -notin @('127.0.0.1','localhost','[::1]','::1') -or $socket.Port -ne $Configuration.Endpoint.Port -or $socket.UserInfo) { return 'fail' }
+        $edge = $version.'User-Agent' -match '(?:Edg|Edge)/'
+        if (($Configuration.Browser -eq 'edge') -ne $edge) { return 'fail' }
+        return 'pass'
+    } catch { return 'unknown' }
+}

package/scripts/login-bw.bat

@@ -1,21 +1,21 @@
-@echo off
-setlocal
-set ROOT=%~dp0..
-
-fltmc.exe >nul 2>&1
-if %errorlevel% neq 0 (
-    echo [*] Requesting Administrator elevation...
-    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
-    exit /b
-)
-
-set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
-set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
-if not exist "%BW_BIN%" (
-    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
-)
-
-echo [*] Logging in to Bitwarden for U-Chan Service Store...
-"%BW_BIN%" login
-echo.
-pause
+@echo off
+setlocal
+set ROOT=%~dp0..
+
+fltmc.exe >nul 2>&1
+if %errorlevel% neq 0 (
+    echo [*] Requesting Administrator elevation...
+    powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
+    exit /b
+)
+
+set BITWARDENCLI_APPDATA_DIR=C:\ProgramData\u-chan-secrets\bw-data
+set BW_BIN=C:\ProgramData\u-chan-secrets\bin\bw.exe
+if not exist "%BW_BIN%" (
+    for /f "delims=" %%i in ('where.exe bw.exe 2^>nul') do set BW_BIN=%%i
+)
+
+echo [*] Logging in to Bitwarden for U-Chan Service Store...
+"%BW_BIN%" login
+echo.
+pause

package/scripts/migrate.bat

@@ -1,4 +1,4 @@
-@echo off
-setlocal
-call "%~dp0debug-install.bat" %*
-
+@echo off
+setlocal
+call "%~dp0debug-install.bat" %*
+