agenshield 2026.8.2-beta.5083739 → 2026.8.2

package/bin/agenshield

@@ -225,14 +225,34 @@ macos_residue_uninstall() {
     kill -9 "$_deact" 2>/dev/null || true
   fi
 
-  # 3. Remove the AgenShield CA from the System keychain (sweep by CN, delete by
-  #    SHA-1) — mirrors the CLI's removeInstalledCaTrust.
-  $SUDO /usr/bin/security find-certificate -a -Z -c "AgenShield" /Library/Keychains/System.keychain 2>/dev/null |
+  # 3. Remove the AgenShield CA from the System keychain (select by SUBJECT,
+  #    delete by SHA-1) — mirrors the CLI's removeInstalledCaTrust.
+  #
+  #    `find-certificate -c "AgenShield"` is a SUBSTRING match on the cert's
+  #    NAME, so the previous version of this loop deleted every trusted root
+  #    that merely mentioned the product: the local-CDN development CA, and any
+  #    customer/MDM root called something like "AgenShield Corp Root". Deleting
+  #    a root we did not issue is damage, not cleanup. Enumerate PEMs instead
+  #    and keep only the subjects AgenShield's own CA builder emits — the same
+  #    set as `isAgenShieldIssuedCaCn` in @agenshield/utils.
+  _pem=""
+  $SUDO /usr/bin/security find-certificate -a -p /Library/Keychains/System.keychain 2>/dev/null |
     while IFS= read -r _line; do
+      _pem="$_pem$_line
+"
       case "$_line" in
-        "SHA-1 hash: "*)
-          _sha1="${_line#SHA-1 hash: }"
-          $SUDO /usr/bin/security delete-certificate -Z "$_sha1" /Library/Keychains/System.keychain >/dev/null 2>&1 || true
+        "-----END CERTIFICATE-----")
+          _subj="$(printf '%s' "$_pem" | openssl x509 -noout -subject 2>/dev/null || true)"
+          _cn="${_subj##*CN=}"
+          _cn="${_cn%%,*}"
+          _cn="${_cn%"${_cn##*[![:space:]]}"}"
+          case "$_cn" in
+            "AgenShield CA"|"AgenShield Dev CA"|"AgenShield MITM CA"*)
+              _sha1="$(printf '%s' "$_pem" | openssl x509 -noout -fingerprint -sha1 2>/dev/null | cut -d= -f2 | tr -d ':')"
+              [ -n "$_sha1" ] && $SUDO /usr/bin/security delete-certificate -Z "$_sha1" /Library/Keychains/System.keychain >/dev/null 2>&1 || true
+              ;;
+          esac
+          _pem=""
           ;;
       esac
     done

package/bin/install.ps1

@@ -0,0 +1,1037 @@
+<#
+.SYNOPSIS
+  AgenShield Installer (Windows) - the canonical, versioned installer shipped
+  in the npm package and served (per-campaign) by agencloud.
+
+.DESCRIPTION
+  Resolves the latest (or a pinned) AgenShield release from the release
+  manifest, downloads and verifies the signed MSI, stages machine-scope
+  enrollment, installs it silently, and waits for the service to come up.
+  This is the Windows sibling of tools/sea/install.sh - same environment
+  contract, same baked CDN supply-chain guard, same "never block the base
+  install on enrollment plumbing" posture.
+
+  Mirror set: the version-resolution + download logic here is deliberately
+  kept in sync with tools/sea/install.sh (macOS/Linux) and
+  libs/cli/src/utils/github-releases.ts's win32 support. Windows has no
+  GitHub-Releases fallback - every asset is served from the first-party CDN
+  (see tools/build/cdn/cdn-update-manifests.sh for the versions.json shape
+  this script parses). Also mirrored, in the agenshield-service repo:
+  apps/service/src/modules/campaigns/templates/install-script-windows.template.ts
+  (the per-campaign served copy, with CloudUrl/Token/Org/Version baked into
+  the source text - there is no shared build step across the two repos, so
+  a change to manifest resolution, ACL hardening, the checksum gate, or the
+  PSEdition-branched atomic file create below must be re-applied there BY
+  HAND, and vice versa). This asymmetry is exactly how the two sides
+  independently carried the SAME broken 7-argument FileStream constructor
+  under .NET Core / PowerShell 7 for a time - update the OTHER side's Mirror
+  set note when you edit either one.
+
+  AGENSHIELD_TOKEN / AGENSHIELD_CLOUD_URL / AGENSHIELD_ORG are deliberately
+  ENVIRONMENT-ONLY - there is no -Token/-CloudUrl/-Org parameter. Windows
+  PowerShell 5.1's Start-Transcript writes a "Host Application:" header
+  containing the FULL launch command line of the process into the transcript
+  file, which lives under %ProgramData%\AgenShield\logs (inherits
+  BUILTIN\Users: Read, and must, since the non-elevated parent tails it). A
+  documented "-Token <value>" invocation would therefore persist the bearer
+  campaign token in plaintext to a world-readable log on every run. Env vars
+  are not part of the command line, so they do not appear in that header; the
+  internal -HandoffFile mechanism carries them across the self-elevation
+  boundary instead of argv, for the same reason (Win32_Process makes a
+  process's own command line readable by any local user).
+
+.PARAMETER Version
+  Install a specific version instead of resolving the latest for the channel.
+  Env: AGENSHIELD_VERSION.
+
+.PARAMETER AssetsBase
+  Override the release-asset base URL (dev/test only - a production install
+  uses the baked first-party CDN base, never a host-controlled override; the
+  override is honored only when the baked value is absent, i.e. an unbaked
+  checkout). Env: AGENSHIELD_ASSETS_BASE.
+
+.PARAMETER Channel
+  Explicit release channel: stable | rc | beta | alpha. Takes precedence over
+  ClientAlpha/ClientBeta, matching install.sh's AGENSHIELD_CHANNEL. Env:
+  AGENSHIELD_CHANNEL.
+
+.PARAMETER ClientAlpha
+.PARAMETER ClientBeta
+  Select the alpha/beta release channel when Channel is not given (stable is
+  the default). Env: AGENSHIELD_CLIENT_ALPHA / AGENSHIELD_CLIENT_BETA = "true".
+
+.EXAMPLE
+  .\install.ps1
+  irm '<cloudUrl>/resources/campaigns/v1/<token>/install.ps1' | iex
+    (the per-campaign copy served by agencloud, pre-filled with the
+     enrollment token via environment variables; Task 6's served variant
+     re-fetches itself from a SELF_URL to re-invoke elevated, since a piped
+     script has no file on disk)
+#>
+[CmdletBinding()]
+param(
+  [string]$Version = $env:AGENSHIELD_VERSION,
+  [string]$AssetsBase = $env:AGENSHIELD_ASSETS_BASE,
+  [string]$Channel = $env:AGENSHIELD_CHANNEL,
+  [switch]$ClientAlpha = ($env:AGENSHIELD_CLIENT_ALPHA -eq 'true'),
+  [switch]$ClientBeta = ($env:AGENSHIELD_CLIENT_BETA -eq 'true'),
+  # Internal - set only by this script's own elevated self-relaunch, never by
+  # a caller. RunId lets the parent and the elevated child agree on the
+  # transcript filename; HandoffFile is the short-lived file carrying
+  # Token/CloudUrl/Org across the elevation boundary (see the DESCRIPTION).
+  # ElevatedChild marks "this invocation IS ITSELF the product of a
+  # -Verb RunAs relaunch" - it is what stops the elevation gate from
+  # relaunching a SECOND time (and raising another UAC prompt, forever) if
+  # the relaunched process somehow still isn't elevated.
+  [string]$RunId,
+  [string]$HandoffFile,
+  [switch]$ElevatedChild
+)
+
+$ErrorActionPreference = 'Stop'
+# Invoke-WebRequest's progress-bar rendering is notoriously slow under
+# Windows PowerShell 5.1 and can turn a multi-MB download into a multi-minute
+# one; SilentlyContinue disables it without affecting the actual transfer.
+$ProgressPreference = 'SilentlyContinue'
+# Windows PowerShell 5.1 does not always default to TLS 1.2, and every
+# endpoint this script talks to (the CDN, the daemon) requires it - an
+# unpatched default here fails with an opaque "Could not create SSL/TLS
+# secure channel" instead of a useful error.
+[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor [System.Net.SecurityProtocolType]::Tls12
+
+# Environment-only secrets (see the DESCRIPTION for why these are not
+# parameters). Reassigned below from the handoff file when this run is the
+# elevated child of a self-relaunch.
+$Token = $env:AGENSHIELD_TOKEN
+$CloudUrl = $env:AGENSHIELD_CLOUD_URL
+$Org = $env:AGENSHIELD_ORG
+
+if (-not $RunId) { $RunId = Get-Date -Format 'yyyyMMdd-HHmmss' }
+# Internal parameter that reaches a log path and two msiexec log arguments - reject anything outside a safe charset rather than try to sanitize a path.
+if ($RunId -notmatch '^[A-Za-z0-9_-]+$') {
+  throw "Invalid -RunId value: '$RunId'"
+}
+$script:LogDir = Join-Path $env:ProgramData 'AgenShield\logs'
+$script:TranscriptPath = Join-Path $script:LogDir "install-$RunId.log"
+
+# ---------------------------------------------------------------------------
+# Output helpers (mirror install.sh's info/ok/warn/error glyph language)
+# ---------------------------------------------------------------------------
+
+function Write-Step { param([string]$Message) Write-Host ''; Write-Host "==> $Message" -ForegroundColor Cyan }
+function Write-Info { param([string]$Message) Write-Host "  $Message" -ForegroundColor DarkGray }
+function Write-Ok { param([string]$Message) Write-Host "  [ok] $Message" -ForegroundColor Green }
+function Write-WarnLine { param([string]$Message) Write-Warning $Message }
+function Write-ErrorLine { param([string]$Message) Write-Host "  [error] $Message" -ForegroundColor Red }
+
+# ---------------------------------------------------------------------------
+# Elevation
+# ---------------------------------------------------------------------------
+
+function Test-IsAdministrator {
+  $identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+  $principal = New-Object System.Security.Principal.WindowsPrincipal($identity)
+  return $principal.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
+}
+
+# Escapes for the Win32 argv parser before quoting - a bare wrap lets an embedded quote inject a parameter into the elevated child.
+function ConvertTo-QuotedArg {
+  param([string]$Value)
+  if ($null -eq $Value) { $Value = '' }
+  $escaped = ''
+  $backslashRun = 0
+  for ($i = 0; $i -lt $Value.Length; $i++) {
+    $char = $Value[$i]
+    if ($char -eq '\') {
+      $backslashRun++
+    } elseif ($char -eq '"') {
+      $escaped += ('\' * (($backslashRun * 2) + 1)) + '"'
+      $backslashRun = 0
+    } else {
+      $escaped += ('\' * $backslashRun) + $char
+      $backslashRun = 0
+    }
+  }
+  $escaped += '\' * ($backslashRun * 2)
+  return '"' + $escaped + '"'
+}
+
+# System32 resolved via GetSystemDirectory(), NOT $env:SystemRoot: an env var
+# is caller-controlled (a non-admin can set SystemRoot=C:\evil before running
+# this script), so building an "absolute path" out of it is not actually
+# absolute - it is the same PATH/CWD-planting class Task 3's review fixed for
+# reg.exe/wmic/powershell.exe, one level up. [System.Environment]::SystemDirectory
+# is a native GetSystemDirectory() call, not an environment read.
+function Get-System32Path {
+  param([Parameter(Mandatory)][string]$RelativePath)
+  return Join-Path ([System.Environment]::SystemDirectory) $RelativePath
+}
+
+# ---------------------------------------------------------------------------
+# Release-manifest resolution (pure - testable against fixture JSON; see
+# tools/build/windows/check-install-ps1.mjs, which hand-ports this exact
+# function and runs it against fixtures with mutation checks in CI)
+# ---------------------------------------------------------------------------
+
+# Plain PSCustomObject property access breaks on hyphenated keys like
+# "win32-x64" ($obj.win32-x64 parses as a subtraction), so every manifest
+# field read goes through this indexer instead of dot/quoted-dot syntax.
+function Get-ManifestProperty {
+  param($InputObject, [string]$Name)
+  if ($null -eq $InputObject) { return $null }
+  $prop = $InputObject.PSObject.Properties[$Name]
+  if ($null -eq $prop) { return $null }
+  return $prop.Value
+}
+
+function Get-Win32InstallerDescriptor {
+  param($VersionEntry)
+  $platforms = Get-ManifestProperty $VersionEntry 'platforms'
+  $win32 = Get-ManifestProperty $platforms 'win32-x64'
+  return Get-ManifestProperty $win32 'installer'
+}
+
+# Resolution order - NEVER the top-level latest/channels (those are the
+# darwin-arm64 view; a Windows-only release does not advance them):
+#   1. a pinned version, if given - hard-fail if it lacks a win32-x64 installer
+#   2. platformChannels."win32-x64"[channel] - the fast path
+#   3. walk versions[] (already published newest-first) for the first entry
+#      on this channel that actually carries platforms."win32-x64".installer
+# Step 3 is not redundant with step 2: platformChannels can point at a version
+# whose win32-x64 role was bootstrap-only (no full installer published that
+# release) - independent macOS/Windows cadences mean the newest entry for a
+# platform is not always the newest one that shipped an installer for it.
+function Resolve-InstallerVersionEntry {
+  param($Manifest, [string]$PinnedVersion, [string]$Channel)
+
+  $versions = Get-ManifestProperty $Manifest 'versions'
+  if ($null -eq $versions) { $versions = @() }
+
+  if ($PinnedVersion) {
+    $entry = $versions | Where-Object { (Get-ManifestProperty $_ 'version') -eq $PinnedVersion } | Select-Object -First 1
+    if (-not $entry -or -not (Get-Win32InstallerDescriptor $entry)) {
+      throw "Pinned version '$PinnedVersion' has no win32-x64 installer in the release manifest."
+    }
+    return $entry
+  }
+
+  $platformChannels = Get-ManifestProperty $Manifest 'platformChannels'
+  $win32Channels = Get-ManifestProperty $platformChannels 'win32-x64'
+  $candidateVersion = Get-ManifestProperty $win32Channels $Channel
+  if ($candidateVersion) {
+    $entry = $versions | Where-Object { (Get-ManifestProperty $_ 'version') -eq $candidateVersion } | Select-Object -First 1
+    if ($entry -and (Get-Win32InstallerDescriptor $entry)) {
+      return $entry
+    }
+  }
+
+  foreach ($entry in $versions) {
+    if ((Get-ManifestProperty $entry 'channel') -eq $Channel -and (Get-Win32InstallerDescriptor $entry)) {
+      return $entry
+    }
+  }
+
+  throw "No win32-x64 installer found for channel '$Channel' in the release manifest."
+}
+
+# AGENSHIELD_CHANNEL (explicit) wins over CLIENT_ALPHA/CLIENT_BETA, matching
+# install.sh's resolve_channel precedence; 'rc' is additionally accepted here
+# (install.sh's own resolve_channel does not parse it, but
+# platformChannels."win32-x64".rc IS published and would otherwise be
+# unreachable from this script).
+function Resolve-Channel {
+  $explicit = if ($Channel) { $Channel.Trim().ToLowerInvariant() } else { '' }
+  if ($explicit -eq 'stable' -or $explicit -eq 'rc' -or $explicit -eq 'beta' -or $explicit -eq 'alpha') {
+    return $explicit
+  }
+  if ($ClientAlpha) { return 'alpha' }
+  if ($ClientBeta) { return 'beta' }
+  return 'stable'
+}
+
+# ---------------------------------------------------------------------------
+# Download + verify
+# ---------------------------------------------------------------------------
+
+function Invoke-DownloadWithRetry {
+  param([Parameter(Mandatory)][string]$Uri, [Parameter(Mandatory)][string]$OutFile, [int]$MaxAttempts = 3)
+  for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
+    try {
+      Invoke-WebRequest -Uri $Uri -OutFile $OutFile -UseBasicParsing -TimeoutSec 300
+      return
+    } catch {
+      if ($attempt -eq $MaxAttempts) { throw }
+      Write-WarnLine "Download attempt $attempt of $MaxAttempts failed - retrying: $($_.Exception.Message)"
+      Start-Sleep -Seconds (2 * $attempt)
+    }
+  }
+}
+
+# Baked at build/publish time exactly like install.sh's CDN_BASE_URL: a
+# deliberate constant, never a runtime env read on a production install - a
+# host-controlled override would let anyone who can set an env var redirect
+# the signed-MSI download to an attacker host. CdnPlaceholder is split so the
+# substitution that bakes CdnBaseUrl below can't also rewrite THIS comparison
+# - an unsubstituted copy (raw repo checkout) falls back to the hardcoded
+# production default rather than silently comparing a baked value to itself.
+# The baked value MUST outrank -AssetsBase/AGENSHIELD_ASSETS_BASE (see the
+# effective-base resolution near Main) - an override that wins over the guard
+# it is supposed to be an exception to defeats the guard entirely.
+$script:CdnBaseUrl = 'https://assets.frontegg.com/agenshield'
+$script:CdnPlaceholder = '__AGENSHIELD_' + 'CDN_BASE_URL__'
+if ($script:CdnBaseUrl -eq $script:CdnPlaceholder) { $script:CdnBaseUrl = '' }
+$script:CdnBaseUrl = $script:CdnBaseUrl.TrimEnd('/')
+$script:DefaultCdnBaseUrl = 'https://assets.frontegg.com/agenshield'
+
+# Ship FALSE - no Authenticode certificate is provisioned yet. Flipping this
+# to $true is meant to be a one-line change once one is; the SHA-256 checksum
+# gate above is hard regardless of this flag.
+$script:RequireSignature = $false
+# Filled in once a signing certificate exists; unused while RequireSignature
+# is $false (an unsigned MSI takes the NotSigned branch below, not this one).
+$script:ExpectedSignerThumbprint = ''
+$script:ExpectedSignerSubject = ''
+
+function Test-InstallerSignature {
+  param([Parameter(Mandatory)][string]$Path)
+  $sig = Get-AuthenticodeSignature -LiteralPath $Path
+  $signerOk = ($sig.Status -eq 'Valid') -and $sig.SignerCertificate -and
+    ($sig.SignerCertificate.Thumbprint -eq $script:ExpectedSignerThumbprint) -and
+    ($sig.SignerCertificate.Subject -eq $script:ExpectedSignerSubject)
+
+  if ($sig.Status -eq 'NotSigned') {
+    if ($script:RequireSignature) { throw 'The downloaded installer is not Authenticode-signed.' }
+    Write-WarnLine 'The downloaded installer is not Authenticode-signed (no signing certificate is provisioned yet). The SHA-256 checksum against the release manifest is still verified as a hard gate.'
+    return
+  }
+  if (-not $signerOk) {
+    if ($script:RequireSignature) { throw "The downloaded installer's Authenticode signature did not verify (status: $($sig.Status))." }
+    Write-WarnLine "The downloaded installer's Authenticode signature did not match the expected signer (status: $($sig.Status)). Continuing because RequireSignature is `$false - the SHA-256 checksum against the release manifest is still a hard gate."
+    return
+  }
+  Write-Ok "Authenticode signature verified ($($sig.SignerCertificate.Subject))"
+}
+
+# ---------------------------------------------------------------------------
+# %ProgramData%\AgenShield\config hardening + enrollment handoff
+#
+# Two traps a prior task's review proved the hard way, both closed here:
+#   - icacls /grant:r (and the .NET equivalent of touching an EXISTING ACL)
+#     only ever adds/replaces grants for the principals it is given - a THIRD
+#     principal's explicit ACE (e.g. a low-privileged user who pre-created
+#     this directory, since C:\ProgramData's default DACL lets any local user
+#     create a subdirectory) survives untouched, and would keep permanent
+#     WRITE_DAC via ownership. So verification here is an ALLOWLIST (refuse
+#     any principal other than SYSTEM/Administrators, and any inherited ACE),
+#     never a denylist ("not Users").
+#   - Account-name literals are locale-dependent (icacls only ever prints
+#     resolved, localized names). Get-Acl/Set-Acl let this run entirely on
+#     SecurityIdentifier objects - SIDs are compared directly, no name
+#     resolution anywhere, in BOTH the grant and the verify half. That is
+#     strictly better than icacls can do: icacls's SID-form /grant is already
+#     locale-proof, but its listing output has no display-as-SID switch, so
+#     its VERIFY half stays English-only. Preferring Get-Acl/Set-Acl over
+#     icacls here removes that limitation entirely instead of accepting it.
+#
+# Ownership target is Administrators, not SYSTEM: SetSecurityInfo can only
+# set the owner to the caller's own token SID/owner-capable group, or to any
+# SID at all when SeRestorePrivilege is enabled - an elevated Administrator's
+# token does not carry NT AUTHORITY\SYSTEM and does not have
+# SeRestorePrivilege enabled by default, so SetOwner(SYSTEM) from this script
+# throws ERROR_INVALID_OWNER. Administrators is always reachable from an
+# elevated admin token, and Test-AllowlistedAcl already accepts either
+# principal as owner. The MSI's own hardening action (which DOES run as
+# LocalSystem) will re-set ownership to SYSTEM on the next install with no
+# conflict - both writers already agree on "hardened" independent of which of
+# the two owns it.
+# ---------------------------------------------------------------------------
+
+$script:SystemSid = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-18')
+$script:AdministratorsSid = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-544')
+$script:CurrentUserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+
+function New-LockedDownSecurity {
+  param([switch]$IsContainer)
+  $security = if ($IsContainer) { New-Object System.Security.AccessControl.DirectorySecurity } else { New-Object System.Security.AccessControl.FileSecurity }
+  $security.SetOwner($script:AdministratorsSid)
+  $security.SetAccessRuleProtection($true, $false)
+  $inheritance = if ($IsContainer) {
+    [System.Security.AccessControl.InheritanceFlags]([System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit)
+  } else {
+    [System.Security.AccessControl.InheritanceFlags]::None
+  }
+  foreach ($sid in @($script:SystemSid, $script:AdministratorsSid)) {
+    $rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList @(
+      $sid,
+      [System.Security.AccessControl.FileSystemRights]::FullControl,
+      $inheritance,
+      [System.Security.AccessControl.PropagationFlags]::None,
+      [System.Security.AccessControl.AccessControlType]::Allow
+    )
+    $security.AddAccessRule($rule)
+  }
+  return $security
+}
+
+# Owner + a protected DACL are written in ONE Set-Acl call (one security
+# descriptor, one syscall) rather than icacls's separate /setowner then
+# /grant:r invocations - there is no window between "ownership changes" and
+# "the DACL changes" for a pre-creating owner to race, because there is
+# nothing sequential to race between.
+function Set-HardenedAcl {
+  param([Parameter(Mandatory)][string]$Path, [switch]$IsContainer)
+  $security = New-LockedDownSecurity -IsContainer:$IsContainer
+  Set-Acl -LiteralPath $Path -AclObject $security
+}
+
+# True when $Path's OWN final path component is a reparse point (junction or
+# symlink). Deliberately queries $Path as a standalone path rather than as
+# part of a longer one: an intermediate reparse-point component in a longer
+# path is transparently resolved through by the filesystem before Get-Item
+# ever sees it, so this only tells the truth when $Path itself is the last
+# segment being resolved. Callers must check every directory level they
+# create-or-trust individually, in order, top-down (see
+# Set-PendingEnrollmentIfRequested) - there is no ResolveLinkTarget in
+# PowerShell 5.1 to ask "what does this chain actually point at" in one call.
+#
+# FAILS CLOSED: Test-Path returns $false for a junction whose target is
+# missing (a "dangling" junction), so a caller's own not-exists check lets
+# New-Item run, and Get-Item -Force on that same dangling junction then
+# raises ItemNotFoundException - which, under $ErrorActionPreference='Stop',
+# would otherwise terminate the whole script (including the base MSI
+# install this check has nothing to do with) rather than just refuse to
+# harden one directory. Catching it and returning $true treats "cannot even
+# confirm this is a normal directory" the same as "it's a reparse point" -
+# refuse to proceed, exactly what a real reparse point would already do
+# here, so this can never be the reason the install itself fails.
+function Test-IsReparsePoint {
+  param([Parameter(Mandatory)][string]$Path)
+  try {
+    $info = Get-Item -LiteralPath $Path -Force
+    return [bool]($info.Attributes -band [System.IO.FileAttributes]::ReparsePoint)
+  } catch {
+    return $true
+  }
+}
+
+function Test-AllowlistedAcl {
+  param([Parameter(Mandatory)][string]$Path)
+  $acl = Get-Acl -LiteralPath $Path
+  if (-not $acl.AreAccessRulesProtected) { return $false }
+  # Ownership grants WRITE_DAC implicitly, regardless of the DACL's own
+  # contents - an owner can always reopen a DACL that doesn't even mention
+  # them. Set-HardenedAcl sets owner+DACL in one call, but this check does not
+  # assume that call is atomic on every filesystem/Windows build; it verifies
+  # the CURRENT owner directly rather than trusting the prior write. Either
+  # SYSTEM or Administrators is an acceptable owner (see the note above
+  # New-LockedDownSecurity on why install.ps1 sets Administrators, not SYSTEM).
+  $ownerSid = $acl.GetOwner([System.Security.Principal.SecurityIdentifier])
+  if ($ownerSid.Value -ne $script:SystemSid.Value -and $ownerSid.Value -ne $script:AdministratorsSid.Value) {
+    return $false
+  }
+  $rules = $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])
+  $sawSystem = $false
+  $sawAdministrators = $false
+  foreach ($rule in $rules) {
+    if ($rule.IsInherited) { return $false }
+    # Deny ACEs and partial-rights grants are not "hardened" just because the SID matches (mirrors config-dir-acl-repair.ts's isAllowlistedConfigDirAcl).
+    if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { return $false }
+    if ($rule.FileSystemRights -ne [System.Security.AccessControl.FileSystemRights]::FullControl) { return $false }
+    $sidValue = $rule.IdentityReference.Value
+    if ($sidValue -eq $script:SystemSid.Value) { $sawSystem = $true }
+    elseif ($sidValue -eq $script:AdministratorsSid.Value) { $sawAdministrators = $true }
+    else { return $false }
+  }
+  return $sawSystem -and $sawAdministrators
+}
+
+# Creates the %TEMP%-scoped Token/CloudUrl/Org handoff file WITH its final
+# ACL applied ATOMICALLY - not create-then-Set-Acl. A separate create, then a
+# later Set-Acl call, leaves a window where the file exists under whatever
+# DACL %TEMP% happens to inherit; %TEMP% is a per-user env var the SAME
+# caller could point somewhere looser than the default per-user profile temp
+# dir (e.g. a shared C:\Temp), so another local user could read the
+# plaintext token in that window. FileMode.CreateNew both makes the create
+# atomic with the ACL and fails loudly if the GUID-named path were ever
+# somehow already occupied, rather than silently overwriting something.
+#
+# EDITION-BRANCHED: the FileSecurity-accepting FileStream constructor is
+# .NET-Framework-only. A later review found this the hard way - Windows
+# PowerShell 5.1 (PSEdition 'Desktop') runs on .NET Framework, where it is
+# the sole 7-parameter FileStream constructor; PowerShell 7 (PSEdition
+# 'Core') runs on .NET Core, which REMOVES it entirely -
+# [System.IO.FileStream].GetConstructors() there yields zero 7-arg
+# candidates, confirmed empirically under pwsh 7.6.5, where the unconditional
+# call this function used to make fails with "Cannot find an overload for
+# FileStream and the argument count: 7". A PS7 user with enrollment env vars
+# set would hit that on every install. .NET Core's atomic-create-with-ACL
+# equivalent is [System.IO.FileSystemAclExtensions]::Create (an extension
+# method on FileInfo, not a constructor) - same atomicity guarantee, same
+# argument shape, different type to call it through.
+#
+# A NARROWER threat model than Test-AllowlistedAcl's config-dir allowlist:
+# this file only needs to resist OTHER non-admin local users, so it
+# explicitly grants the CURRENT user full control too - the parent process
+# (not elevated) must retain delete rights for its own cleanup. Owner is set
+# to the current user (a no-op in practice, since NTFS already assigns the
+# creator as owner - no SeRestorePrivilege question here, unlike
+# New-LockedDownSecurity's SYSTEM/Administrators case).
+function New-ProtectedHandoffFile {
+  param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Content)
+  $security = New-Object System.Security.AccessControl.FileSecurity
+  $security.SetOwner($script:CurrentUserSid)
+  $security.SetAccessRuleProtection($true, $false)
+  foreach ($sid in @($script:CurrentUserSid, $script:SystemSid, $script:AdministratorsSid)) {
+    $rule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList @(
+      $sid,
+      [System.Security.AccessControl.FileSystemRights]::FullControl,
+      [System.Security.AccessControl.InheritanceFlags]::None,
+      [System.Security.AccessControl.PropagationFlags]::None,
+      [System.Security.AccessControl.AccessControlType]::Allow
+    )
+    $security.AddAccessRule($rule)
+  }
+  $bytes = (New-Object System.Text.UTF8Encoding($false)).GetBytes($Content)
+  if ($PSVersionTable.PSEdition -eq 'Core') {
+    $fileInfo = New-Object System.IO.FileInfo($Path)
+    $stream = [System.IO.FileSystemAclExtensions]::Create(
+      $fileInfo,
+      [System.IO.FileMode]::CreateNew,
+      [System.Security.AccessControl.FileSystemRights]::Write,
+      [System.IO.FileShare]::None,
+      4096,
+      [System.IO.FileOptions]::None,
+      $security
+    )
+  } else {
+    $stream = New-Object -TypeName System.IO.FileStream -ArgumentList @(
+      $Path,
+      [System.IO.FileMode]::CreateNew,
+      [System.Security.AccessControl.FileSystemRights]::Write,
+      [System.IO.FileShare]::None,
+      4096,
+      [System.IO.FileOptions]::None,
+      $security
+    )
+  }
+  try {
+    $stream.Write($bytes, 0, $bytes.Length)
+  } finally {
+    $stream.Dispose()
+  }
+}
+
+function Set-PendingEnrollmentIfRequested {
+  param([string]$Token, [string]$CloudUrl, [string]$Org)
+  if (-not $Token -or -not $CloudUrl) {
+    Write-Info 'No enrollment token/cloud URL provided - skipping pending-enrollment.json (sign in from the tray, or use the registry/MDM channel).'
+    return
+  }
+
+  # Any local user can create a subdirectory under C:\ProgramData, including a
+  # directory junction (`mklink /J`, no privilege required) pointing anywhere
+  # - and this applies to EVERY level we create or trust, not just the config
+  # leaf: C:\ProgramData\AgenShield itself does not exist on a first install,
+  # so a non-admin can pre-plant it as a junction (e.g. at C:\Windows\System32)
+  # before this script ever runs. Checking only the leaf misses this: querying
+  # attributes on a path where the suspect component is an INTERMEDIATE
+  # segment (not the path's own final component) transparently resolves
+  # through it at the filesystem level - Get-Item on
+  # "...\AgenShield\config" would report the TARGET's attributes, not
+  # AgenShield's own, so the leaf looks like an ordinary directory even
+  # though it is a junction one level up. PowerShell 5.1 has no
+  # ResolveLinkTarget/.ResolvedTarget to ask "what does this actually point
+  # at", so the only correct check is per-component: verify EACH directory we
+  # are about to create-or-trust while it is still the FINAL component of the
+  # path being queried, before ever constructing a longer path through it.
+  #
+  # NOT ATOMIC: this is a check, not a lock. Between this Test-IsReparsePoint
+  # call returning "safe" and Set-HardenedAcl/WriteAllText actually touching
+  # the path a few lines below, a sufficiently fast attacker could still
+  # delete the real directory and drop a junction in its place - a
+  # create-check-use race PowerShell 5.1 cannot close without P/Invoking a
+  # handle-based open (e.g. CreateFile with FILE_FLAG_OPEN_REPARSE_POINT
+  # held across the whole operation). This walk closes the window the round-2
+  # review named (the PARENT directory not being checked at all) - it is a
+  # real narrowing of the attack surface, not proof the surface is zero.
+  $agenShieldRoot = Join-Path $env:ProgramData 'AgenShield'
+  if (-not (Test-Path -LiteralPath $agenShieldRoot)) {
+    New-Item -ItemType Directory -Path $agenShieldRoot -Force | Out-Null
+  }
+  if (Test-IsReparsePoint -Path $agenShieldRoot) {
+    Write-WarnLine "$agenShieldRoot is a reparse point (junction/symlink) - refusing to harden or write under it. Remove it and re-run, or use the registry/MDM channel instead."
+    return
+  }
+
+  # This root's OWNER is set to Administrators unconditionally in the elevated top-level block below - never gated on a token; see the WHY block there.
+  $configDir = Join-Path $agenShieldRoot 'config'
+  if (-not (Test-Path -LiteralPath $configDir)) {
+    New-Item -ItemType Directory -Path $configDir -Force | Out-Null
+  }
+  # Set-Acl and [System.IO.File]::WriteAllText both follow a junction
+  # transparently, so without this check (now that AgenShieldRoot is
+  # confirmed real) a non-admin who plants the junction AT THIS level
+  # instead could redirect this ELEVATED process into rewriting an
+  # arbitrary directory's owner/DACL to SYSTEM+Administrators-only - a
+  # denial-of-service against the box via an elevated installer, not merely
+  # against this one directory.
+  if (Test-IsReparsePoint -Path $configDir) {
+    Write-WarnLine "$configDir is a reparse point (junction/symlink) - refusing to harden or write into it. Remove it and re-run, or use the registry/MDM channel instead."
+    return
+  }
+
+  try {
+    Set-HardenedAcl -Path $configDir -IsContainer
+  } catch {
+    Write-WarnLine "Failed to harden $configDir : $($_.Exception.Message)"
+  }
+
+  if (-not (Test-AllowlistedAcl -Path $configDir)) {
+    # Not necessarily a locale problem (unlike the MSI's icacls-based reader,
+    # this check is SID-based and locale-independent) - most often means
+    # hardening above failed (e.g. a privilege issue) or the directory is
+    # owned/ACL'd by something other than SYSTEM/Administrators.
+    Write-WarnLine "$configDir is not verified SYSTEM+Administrators-only - skipping pending-enrollment.json write. Enroll via the registry/MDM channel instead."
+    return
+  }
+
+  $payload = [ordered]@{ token = $Token; cloudUrl = $CloudUrl }
+  if ($Org) { $payload['org'] = $Org }
+  # ConvertTo-Json handles escaping; the write below uses a BOM-less UTF8
+  # encoder explicitly - PowerShell 5.1's -Encoding UTF8 on Set-Content/
+  # Out-File emits a UTF-8 BOM, which breaks the reader's plain JSON.parse()
+  # (libs/cloud/src/pending-enrollment.ts) with no error, just silent
+  # non-enrollment.
+  $json = $payload | ConvertTo-Json -Compress
+
+  $pendingPath = Join-Path $configDir 'pending-enrollment.json'
+  if (Test-Path -LiteralPath $pendingPath) {
+    Remove-Item -LiteralPath $pendingPath -Force
+  }
+  [System.IO.File]::WriteAllText($pendingPath, $json, (New-Object System.Text.UTF8Encoding($false)))
+
+  try {
+    Set-HardenedAcl -Path $pendingPath
+  } catch {
+    Remove-Item -LiteralPath $pendingPath -Force -ErrorAction SilentlyContinue
+    Write-WarnLine "Failed to lock down pending-enrollment.json - deleted it rather than leave a bearer token under an unverified ACL: $($_.Exception.Message)"
+    return
+  }
+
+  if (-not (Test-AllowlistedAcl -Path $pendingPath)) {
+    Remove-Item -LiteralPath $pendingPath -Force -ErrorAction SilentlyContinue
+    Write-WarnLine 'pending-enrollment.json ACL did not verify after hardening - deleted it rather than leave a bearer token under an unverified ACL.'
+    return
+  }
+
+  Write-Ok 'Wrote pending-enrollment.json'
+}
+
+# ---------------------------------------------------------------------------
+# Install (lifted from tools/build/windows/install-agenshield.ps1, which
+# already avoids Win32_Product - it triggers a repair on every enumeration -
+# and already handles the tray holding resources\app.asar open)
+# ---------------------------------------------------------------------------
+
+function Get-InstalledProductCode {
+  param([string]$DisplayName = 'AgenShield')
+  $roots = @(
+    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
+    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall'
+  )
+  foreach ($root in $roots) {
+    $found = Get-ChildItem $root -ErrorAction SilentlyContinue | ForEach-Object {
+      $p = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
+      if ($p.DisplayName -eq $DisplayName -and $_.PSChildName -match '^\{[0-9A-Fa-f-]+\}$') {
+        $_.PSChildName
+      }
+    } | Select-Object -First 1
+    if ($found) { return $found }
+  }
+  return $null
+}
+
+function Stop-AgenShieldTray {
+  Get-Process AgenShield -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
+  Start-Sleep -Seconds 1
+}
+
+function Uninstall-AgenShield {
+  $code = Get-InstalledProductCode
+  if (-not $code) { return }
+  Write-Info "Removing the existing AgenShield installation ($code)..."
+  $msiexecPath = Get-System32Path 'msiexec.exe'
+  $uninstallLog = Join-Path $script:LogDir "install-$RunId-uninstall.log"
+  $proc = Start-Process -FilePath $msiexecPath -ArgumentList "/x $code /qn /norestart /l*v `"$uninstallLog`"" -Wait -PassThru
+  if ($proc.ExitCode -ne 0 -and $proc.ExitCode -ne 3010) {
+    Write-WarnLine "Uninstalling the existing AgenShield installation exited with code $($proc.ExitCode) - continuing with install."
+  }
+}
+
+# ---------------------------------------------------------------------------
+# Health gate
+# ---------------------------------------------------------------------------
+
+function Wait-DaemonHealthy {
+  param([int]$Attempts = 5, [int]$DelaySeconds = 2)
+  $lastError = $null
+  for ($i = 1; $i -le $Attempts; $i++) {
+    try {
+      $resp = Invoke-WebRequest -Uri 'http://127.0.0.1:5200/api/health' -UseBasicParsing -TimeoutSec 5
+      if ($resp.StatusCode -eq 200) { return $true }
+    } catch {
+      $lastError = $_.Exception.Message
+    }
+    if ($i -lt $Attempts) { Start-Sleep -Seconds $DelaySeconds }
+  }
+  if ($lastError) { Write-WarnLine "Last health-check error: $lastError" }
+  return $false
+}
+
+# Bounded poll of GET /api/status for data.cloudEnrolled - the same
+# unauthenticated call libs/cli/src/commands/start.ts makes. Never blocks
+# indefinitely: on expiry the daemon keeps retrying enrollment in the
+# background on its own, same as install.sh's non-blocking posture.
+function Wait-EnrollmentComplete {
+  param([int]$Attempts = 30, [int]$DelaySeconds = 2)
+  $lastError = $null
+  for ($i = 1; $i -le $Attempts; $i++) {
+    try {
+      $resp = Invoke-RestMethod -Uri 'http://127.0.0.1:5200/api/status' -TimeoutSec 5
+      if ($resp.data.cloudEnrolled -eq $true) { return $true }
+    } catch {
+      $lastError = $_.Exception.Message
+    }
+    Start-Sleep -Seconds $DelaySeconds
+  }
+  if ($lastError) { Write-WarnLine "Last enrollment-status error: $lastError" }
+  return $false
+}
+
+# ---------------------------------------------------------------------------
+# Elevation gate - relaunch elevated if needed, then wait and tail
+# ---------------------------------------------------------------------------
+
+if (-not (Test-IsAdministrator)) {
+  # $ElevatedChild is set ONLY on the relaunch this same gate below performs
+  # - so a non-elevated process reaching this point with it already set
+  # means the -Verb RunAs relaunch completed but the resulting process is
+  # STILL not elevated (an unusual token/policy edge case, not the normal
+  # path). Without this guard, that child would relaunch itself AGAIN,
+  # raising another UAC prompt, forever - refuse instead of looping.
+  if ($ElevatedChild) {
+    Write-ErrorLine 'Elevation did not succeed - this process still lacks Administrator rights after a self-relaunch. Refusing to relaunch again (that would prompt UAC indefinitely).'
+    exit 1
+  }
+
+  Write-Step 'AgenShield - Install'
+  Write-Info 'Administrator privileges are required - requesting elevation...'
+
+  # Resolved via Get-System32Path (GetSystemDirectory(), not $env:SystemRoot):
+  # Start-Process/ShellExecute can search the CURRENT WORKING DIRECTORY before
+  # PATH, and this script is meant to be run from wherever a user downloaded
+  # it - the same binary-planting class this codebase already fixed for
+  # reg.exe/wmic/icacls on the daemon/CA side, closed here without depending
+  # on an environment variable the caller controls.
+  $powershellPath = Get-System32Path 'WindowsPowerShell\v1.0\powershell.exe'
+
+  $relaunchArgs = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', (ConvertTo-QuotedArg $PSCommandPath), '-RunId', (ConvertTo-QuotedArg $RunId), '-ElevatedChild')
+  if ($Version) { $relaunchArgs += @('-Version', (ConvertTo-QuotedArg $Version)) }
+  if ($AssetsBase) { $relaunchArgs += @('-AssetsBase', (ConvertTo-QuotedArg $AssetsBase)) }
+  if ($Channel) { $relaunchArgs += @('-Channel', (ConvertTo-QuotedArg $Channel)) }
+  if ($ClientAlpha) { $relaunchArgs += '-ClientAlpha' }
+  if ($ClientBeta) { $relaunchArgs += '-ClientBeta' }
+
+  # Environment variables set only in THIS (non-elevated) process are not
+  # reliably inherited by a `-Verb RunAs` relaunch - UAC's elevation broker
+  # builds the elevated process's environment from the user's persisted
+  # profile, not from this process's in-memory block, so $env:AGENSHIELD_TOKEN
+  # set only here could silently vanish across the boundary. Passing the
+  # token as a plain -Token argv value instead would recreate the exact bug
+  # class a prior task fixed for the MSI custom action (a process command
+  # line is readable by any local user via Win32_Process). A short-lived
+  # handoff file under the CURRENT user's own %TEMP% carries the secrets
+  # instead; only its path ever crosses the boundary, and
+  # New-ProtectedHandoffFile creates it with its final ACL already applied -
+  # atomically, not create-then-Set-Acl - rather than trusting whatever
+  # %TEMP% happens to inherit even for the brief window before a separate
+  # Set-Acl call would land. Everything below is inside one try/finally so a
+  # Ctrl-C (or any other terminating error) during the potentially long
+  # -Wait still deletes the handoff file rather than leaving a plaintext
+  # bearer token on disk.
+  $handoffPath = $null
+  $exitCode = 1
+  try {
+    if ($Token -or $CloudUrl -or $Org) {
+      $handoffPath = Join-Path $env:TEMP ('agenshield-install-' + [guid]::NewGuid().ToString('N') + '.json')
+      $handoffPayload = [ordered]@{ token = $Token; cloudUrl = $CloudUrl; org = $Org }
+      New-ProtectedHandoffFile -Path $handoffPath -Content ($handoffPayload | ConvertTo-Json -Compress)
+      $relaunchArgs += @('-HandoffFile', (ConvertTo-QuotedArg $handoffPath))
+    }
+
+    try {
+      $proc = Start-Process -FilePath $powershellPath -Verb RunAs -Wait -PassThru -ArgumentList ($relaunchArgs -join ' ')
+      # -Verb RunAs -PassThru populating .ExitCode is undocumented behavior;
+      # guard BOTH $proc itself and $proc.ExitCode being $null - `exit $null`
+      # exits 0, which would report a failed elevated install as success to
+      # an MDM wrapper watching this script's own exit code.
+      $exitCode = if ($null -eq $proc -or $null -eq $proc.ExitCode) { 1 } else { $proc.ExitCode }
+    } catch {
+      Write-ErrorLine "Elevated relaunch failed: $($_.Exception.Message)"
+      $exitCode = 1
+    }
+  } finally {
+    if ($handoffPath -and (Test-Path -LiteralPath $handoffPath)) {
+      Remove-Item -LiteralPath $handoffPath -Force -ErrorAction SilentlyContinue
+    }
+  }
+
+  # The parent WAITED (above), THEN tails the elevated run's transcript - the
+  # analogue of macOS's `sudo -n tail -F /var/log/agenshield-install.log`,
+  # adapted for -Verb RunAs's synchronous semantics (there is no live
+  # concurrent tail across an elevation boundary the way a backgrounded sudo
+  # command allows) so output still lands back in the caller's own window.
+  if (Test-Path -LiteralPath $script:TranscriptPath) {
+    Get-Content -LiteralPath $script:TranscriptPath | ForEach-Object { Write-Host "  | $_" }
+  }
+  exit $exitCode
+}
+
+if ($HandoffFile -and (Test-Path -LiteralPath $HandoffFile)) {
+  # A truncated or tampered handoff file must not abort the base install (same posture as the enrollment-staging catch below).
+  try {
+    $handoff = Get-Content -LiteralPath $HandoffFile -Raw | ConvertFrom-Json
+    if ($handoff.token) { $Token = $handoff.token }
+    if ($handoff.cloudUrl) { $CloudUrl = $handoff.cloudUrl }
+    if ($handoff.org) { $Org = $handoff.org }
+  } catch {
+    Write-WarnLine "Failed to read the enrollment handoff file - continuing without it: $($_.Exception.Message)"
+  } finally {
+    Remove-Item -LiteralPath $HandoffFile -Force -ErrorAction SilentlyContinue
+  }
+}
+
+# Validated BEFORE this (elevated) process writes ANYTHING under
+# %ProgramData%\AgenShield - Set-PendingEnrollmentIfRequested's own
+# reparse-point check runs much later in Main, well after $script:LogDir
+# would already have been created here. A non-admin junction planted at
+# %ProgramData%\AgenShield (the round-2 I6 finding) would otherwise redirect
+# this New-Item/Start-Transcript pair into the junction's target first.
+# Bounded blast radius for that pair even so - a directory create and a .log
+# write, and the new directory inherits the TARGET's own DACL rather than
+# gaining anything - but validated regardless, so no elevated write of any
+# kind precedes it. The stakes are higher now than when this check was added:
+# the ownership Set-Acl below would rewrite the junction TARGET's owner, so it
+# lives inside the validated branch and never runs on a reparse point. Skips
+# the transcript and the ownership fix (falling back to console-only output)
+# rather than aborting the install if the root is compromised, matching
+# Start-Transcript's own already-non-fatal failure handling below.
+$agenShieldRoot = Join-Path $env:ProgramData 'AgenShield'
+if (-not (Test-Path -LiteralPath $agenShieldRoot)) {
+  New-Item -ItemType Directory -Path $agenShieldRoot -Force | Out-Null
+}
+if (Test-IsReparsePoint -Path $agenShieldRoot) {
+  Write-WarnLine "$agenShieldRoot is a reparse point (junction/symlink) - skipping the install transcript to avoid writing under it."
+} else {
+  New-Item -ItemType Directory -Path $script:LogDir -Force | Out-Null
+  try {
+    Start-Transcript -Path $script:TranscriptPath -Force | Out-Null
+  } catch {
+    Write-WarnLine "Could not start the install transcript: $($_.Exception.Message)"
+  }
+
+  # OWNERSHIP ONLY - never the leaf's restrictive protected DACL, and
+  # deliberately OUT here rather than inside Set-PendingEnrollmentIfRequested.
+  # On stock Windows, "System objects: Default owner for objects created by
+  # members of the Administrators group" defaults to Object Creator, so the
+  # New-Item above (running under an elevated ADMINISTRATOR token, not SYSTEM)
+  # leaves this root owned by that admin's own user SID - neither SYSTEM nor
+  # the Administrators GROUP. The daemon's own boot-time ACL repair
+  # (libs/shield-daemon) gates its write on the CURRENT OWNER of BOTH this
+  # root AND the config leaf being SYSTEM or Administrators (a non-admin who
+  # pre-creates the root keeps FILE_DELETE_CHILD via the default CREATOR OWNER
+  # ACE and could delete-and-replace even a hardened leaf otherwise) - so
+  # leaving this root owned by an arbitrary admin user permanently refuses that
+  # repair with harden-refused-owner on every boot, even though this script
+  # itself never hit an error. This block previously lived inside
+  # Set-PendingEnrollmentIfRequested, which returns early when no enrollment
+  # token was supplied - so the plain no-token one-liner install (the very
+  # install the public docs describe) never reached it, while the create above
+  # runs on EVERY elevated run and always wins the race to create the root.
+  # That left the backstop permanently disabled on exactly the WDAC/AppLocker
+  # estates it exists for, where the MSI's own hardening action is blocked and
+  # silently ignored. It therefore runs here: unconditionally, before Main, and
+  # so still ahead of the $configDir create/harden in
+  # Set-PendingEnrollmentIfRequested, leaving no window where an attacker-owned
+  # root contains an already-hardened child. Placed just after Start-Transcript
+  # so a failure is captured in the transcript the non-elevated parent tails
+  # rather than vanishing with the elevated child's console. Set OWNER only,
+  # preserving the current DACL exactly as read: other AgenShield components
+  # legitimately live under this root (agent homes, and the desktop's
+  # non-elevated upgrade-log reader under logs\), so applying the leaf's own
+  # restrictive DACL here would break them.
+  try {
+    $rootAcl = Get-Acl -LiteralPath $agenShieldRoot
+    $rootAcl.SetOwner($script:AdministratorsSid)
+    Set-Acl -LiteralPath $agenShieldRoot -AclObject $rootAcl
+  } catch {
+    Write-WarnLine "Failed to set ownership of $agenShieldRoot to Administrators: $($_.Exception.Message)"
+  }
+}
+
+# ---------------------------------------------------------------------------
+# Main
+# ---------------------------------------------------------------------------
+
+$script:ExitCode = 0
+try {
+  Write-Step 'AgenShield - Install'
+
+  if ($Org -and -not $CloudUrl) {
+    throw 'AGENSHIELD_ORG requires AGENSHIELD_CLOUD_URL to be specified.'
+  }
+
+  # ARM64 Windows and a 32-bit process report x86-ish values in
+  # PROCESSOR_ARCHITECTURE; PROCESSOR_ARCHITEW6432 carries the TRUE host
+  # architecture whenever the current process is running under WOW64, so
+  # checking it first is what makes this WOW64-proof rather than trusting
+  # whichever powershell.exe happened to be invoked.
+  $trueArch = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
+  if ($trueArch -ne 'AMD64') {
+    throw "AgenShield for Windows currently supports x64 only - detected '$trueArch'. ARM64/x86 Windows is not yet supported."
+  }
+  Write-Ok 'Architecture: x64'
+
+  # The baked CDN base MUST outrank -AssetsBase/AGENSHIELD_ASSETS_BASE - an
+  # env override that wins over the guard it's an exception to is not a
+  # guard. The override is honored only when the baked placeholder was never
+  # substituted (an unbaked checkout); DefaultCdnBaseUrl is the final
+  # fallback for that same unbaked case when no override is given either.
+  $effectiveAssetsBase = if ($script:CdnBaseUrl) { $script:CdnBaseUrl } elseif ($AssetsBase) { $AssetsBase.TrimEnd('/') } else { $script:DefaultCdnBaseUrl }
+  # Named distinctly from the $Channel PARAMETER on purpose - PowerShell
+  # variable names are case-insensitive, so a local $channel here would be
+  # the SAME variable as $Channel and silently overwrite the caller's raw
+  # input with the resolved value. Harmless today (nothing reads $Channel
+  # again afterward), but a trap for the next edit that assumes otherwise.
+  $channelName = Resolve-Channel
+  Write-Info "Resolving version (channel: $channelName)..."
+  $manifest = Invoke-RestMethod -Uri "$effectiveAssetsBase/versions.json" -TimeoutSec 30
+  $entry = Resolve-InstallerVersionEntry -Manifest $manifest -PinnedVersion $Version -Channel $channelName
+  $installer = Get-Win32InstallerDescriptor $entry
+  $resolvedVersion = Get-ManifestProperty $entry 'version'
+  $entryPath = Get-ManifestProperty $entry 'path'
+  if (-not $entryPath) { $entryPath = "v$resolvedVersion" }
+  $installerName = Get-ManifestProperty $installer 'name'
+  if (-not $installerName) { $installerName = "AgenShield-$resolvedVersion-win32-x64.msi" }
+  $expectedSha256 = Get-ManifestProperty $installer 'sha256'
+
+  # Defense in depth: $entryPath/$installerName came from the release manifest
+  # and are about to become a URL segment, a local file path, and part of a
+  # quoted msiexec command line. A well-formed manifest never produces
+  # anything outside this charset, so rejecting anything else costs nothing
+  # and closes off quote/backslash-based argument injection if the manifest
+  # itself were ever the compromised link in the chain. ".." is rejected
+  # explicitly - the charset alone allows it (dots are legal in a version
+  # string), and a path-traversal segment is exactly the shape a directory
+  # escape needs.
+  if ($entryPath -notmatch '^[A-Za-z0-9._-]+$' -or $entryPath.Contains('..')) {
+    throw "Refusing to use an unsafe release path from the manifest: '$entryPath'"
+  }
+  if ($installerName -notmatch '^[A-Za-z0-9._-]+\.msi$' -or $installerName.Contains('..')) {
+    throw "Refusing to use an unsafe installer filename from the manifest: '$installerName'"
+  }
+  Write-Ok "Resolved version $resolvedVersion"
+
+  $downloadUrl = "$effectiveAssetsBase/$entryPath/$installerName"
+  $tempDir = Join-Path $env:TEMP ('agenshield-install-' + [guid]::NewGuid().ToString('N'))
+  New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
+  $msiPath = Join-Path $tempDir $installerName
+
+  try {
+    Write-Step "Downloading AgenShield $resolvedVersion"
+    Invoke-DownloadWithRetry -Uri $downloadUrl -OutFile $msiPath
+    Write-Ok "Downloaded $installerName"
+
+    # An ABSENT sha256 is a hard gate too, not just a mismatch: it is
+    # attacker-selectable (anyone who can serve versions.json simply omits
+    # the key), and cdn-update-manifests.sh refuses to publish an asset that
+    # is not in checksums.sha256 - a well-formed manifest always carries it,
+    # so leniency here protects nothing real. Windows has no Developer-ID-style
+    # backstop the way macOS's installer(8) does, and $RequireSignature is
+    # $false, so this is the only integrity check that is guaranteed to run.
+    if (-not $expectedSha256) {
+      throw "No sha256 listed for $installerName in the release manifest - refusing to install an unverified artifact."
+    }
+    $actualSha256 = (Get-FileHash -LiteralPath $msiPath -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($actualSha256 -ne $expectedSha256.ToLowerInvariant()) {
+      throw "Checksum mismatch for $installerName (expected $expectedSha256, got $actualSha256)."
+    }
+    Write-Ok 'Checksum verified'
+
+    Test-InstallerSignature -Path $msiPath
+
+    Write-Step 'Staging enrollment'
+    # Enrollment plumbing must never be the reason the base install aborts
+    # (the header's own "never block the base install on enrollment
+    # plumbing" posture) - belt-and-suspenders alongside Test-IsReparsePoint
+    # now failing closed instead of throwing: anything else unexpected in
+    # here (permissions, a locked file, ...) degrades to a warning, not a
+    # skipped MSI install.
+    try {
+      Set-PendingEnrollmentIfRequested -Token $Token -CloudUrl $CloudUrl -Org $Org
+    } catch {
+      Write-WarnLine "Enrollment staging failed - continuing with the base install: $($_.Exception.Message)"
+    }
+
+    Write-Step "Installing AgenShield $resolvedVersion"
+    Stop-AgenShieldTray
+    Uninstall-AgenShield
+    $msiexecPath = Get-System32Path 'msiexec.exe'
+    $msiLogPath = Join-Path $script:LogDir "install-$RunId-msiexec.log"
+    $installProc = Start-Process -FilePath $msiexecPath -ArgumentList "/i `"$msiPath`" /qn /norestart /l*v `"$msiLogPath`"" -Wait -PassThru
+    if ($installProc.ExitCode -eq 0) {
+      Write-Ok "Installed AgenShield $resolvedVersion"
+    } elseif ($installProc.ExitCode -eq 3010) {
+      Write-Ok "Installed AgenShield $resolvedVersion (a reboot is required to finish)"
+    } else {
+      Write-ErrorLine "msiexec failed (exit $($installProc.ExitCode)) - last 25 lines of $msiLogPath`:"
+      if (Test-Path -LiteralPath $msiLogPath) {
+        Get-Content -LiteralPath $msiLogPath -Tail 25 | ForEach-Object { Write-Host "  | $_" }
+      }
+      throw "AgenShield installation failed (msiexec exit $($installProc.ExitCode))."
+    }
+  } finally {
+    Remove-Item -LiteralPath $tempDir -Recurse -Force -ErrorAction SilentlyContinue
+  }
+
+  Write-Step 'Waiting for the AgenShield service'
+  if (Wait-DaemonHealthy) {
+    Write-Ok 'Daemon is running'
+    if ($Token -and $CloudUrl) {
+      Write-Info 'Waiting for enrollment to complete...'
+      if (Wait-EnrollmentComplete) {
+        Write-Ok 'Device enrolled'
+      } else {
+        Write-WarnLine 'Enrollment did not complete in time - the service will keep retrying in the background.'
+      }
+    }
+  } else {
+    Write-WarnLine 'The AgenShield service did not become healthy in time - it may still be starting.'
+  }
+
+  # No sign-in: installation must not require or trigger an OAuth browser
+  # flow. The device is enrolled (campaign token) or waits to be, and a user
+  # signs in LATER from the tray to attach their account - same rule as
+  # macOS's install.sh.
+  Write-Host ''
+  Write-Host 'AgenShield installed.' -ForegroundColor Green
+  Write-Host '  Dashboard: http://localhost:5200'
+  Write-Host '  Sign in any time from the AgenShield tray to link your account.'
+  Write-Host ''
+} catch {
+  Write-ErrorLine $_.Exception.Message
+  $script:ExitCode = 1
+} finally {
+  try { Stop-Transcript | Out-Null } catch { }
+}
+exit $script:ExitCode

package/bin/install.sh

@@ -4,8 +4,10 @@
 # Downloads and installs the AgenShield SEA binaries for the current platform.
 #
 # Mirror set: the version-resolution + download logic here is deliberately
-# kept in sync with libs/cli/src/utils/github-releases.ts (CLI) and
-# tools/build/pkg/bootstrap/scripts/postinstall (MDM bootstrap pkg).
+# kept in sync with libs/cli/src/utils/github-releases.ts (CLI),
+# tools/build/pkg/bootstrap/scripts/postinstall (MDM bootstrap pkg), and
+# tools/sea/install.ps1 (the Windows sibling — same environment contract and
+# baked CDN supply-chain guard, CDN-only with no GitHub-Releases fallback).
 #
 # Multi-binary layout:
 #   ~/.agenshield/bin/agenshield              (CLI — on PATH)
@@ -620,11 +622,22 @@ TAILEOF
         AGENSHIELD_CLI="/usr/local/bin/agenshield"
         command -v "$AGENSHIELD_CLI" >/dev/null 2>&1 || AGENSHIELD_CLI="agenshield"
         # Reattach the controlling terminal as stdin so the CLI's readline +
-        # isTTY work even though our own stdin is the curl pipe. An older
-        # pinned CLI without --post-install falls back to plain `activate`.
-        "$AGENSHIELD_CLI" activate --post-install </dev/tty || \
+        # isTTY work even though our own stdin is the curl pipe.
+        #
+        # The fallback is chosen by CAPABILITY, not by failure. It used to be
+        # `activate --post-install || activate || warn`, which re-ran the ENTIRE
+        # stepper on any non-zero exit — including Ctrl-C, so interrupting the
+        # approvals restarted them and the only way out was to interrupt twice.
+        # Worse, the retry dropped --post-install, which is what opens the app
+        # and the dashboard once approvals finish: an interrupted install ended
+        # with no window at all. Only an older pinned CLI needs the plain form.
+        if "$AGENSHIELD_CLI" activate --help 2>/dev/null | grep -q -- '--post-install'; then
+          "$AGENSHIELD_CLI" activate --post-install </dev/tty || \
+            warn "You can finish approvals any time with: agenshield activate"
+        else
           "$AGENSHIELD_CLI" activate </dev/tty || \
-          warn "You can finish approvals any time with: agenshield activate"
+            warn "You can finish approvals any time with: agenshield activate"
+        fi
         exit 0
       else
         # Non-interactive (MDM/scripted): use command-line installer

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenshield",
-  "version": "2026.8.2-beta.5083739",
+  "version": "2026.8.2",
   "description": "AgenShield — AI Agent Security Platform",
   "bin": {
     "agenshield": "bin/agenshield"