fullcourtdefense-cli 1.21.28 → 1.21.30

package/dist/commands/daemon.d.ts

@@ -32,7 +32,21 @@ export declare function discoverSweepCredentialEnv(credentials?: {
     shieldKey?: string;
     apiUrl?: string;
 }): Record<string, string>;
+/** Snapshot of the resident daemon for out-of-process callers (watchdog/status). */
+export interface DaemonRuntimeState {
+    alive: boolean;
+    pid?: number;
+    version?: string;
+    startedAt?: string;
+}
+export declare function daemonRuntimeState(): DaemonRuntimeState;
+/** Relaunch the daemon outside our process tree (plain node — no shells). */
+export declare function spawnDetachedDaemon(): boolean;
+/** Pid-alive check shared with the watchdog (EPERM still means alive). */
+export declare function pidIsAlive(pid: number): boolean;
 export declare function macosLaunchdPath(currentPath?: string, execPath?: string): string;
 /** Whether the daemon has been registered to start automatically. */
+/** Is the 5-minute watchdog scheduled task registered? (Windows-only feature.) */
+export declare function isWatchdogTaskInstalled(): boolean;
 export declare function isDaemonAutostartInstalled(): boolean;
 export declare function daemonCommand(args: DaemonArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/daemon.js

@@ -36,7 +36,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.daemonDiscoverSweepArgs = daemonDiscoverSweepArgs;
 exports.summarizeDiscoverStderr = summarizeDiscoverStderr;
 exports.discoverSweepCredentialEnv = discoverSweepCredentialEnv;
+exports.daemonRuntimeState = daemonRuntimeState;
+exports.spawnDetachedDaemon = spawnDetachedDaemon;
+exports.pidIsAlive = pidIsAlive;
 exports.macosLaunchdPath = macosLaunchdPath;
+exports.isWatchdogTaskInstalled = isWatchdogTaskInstalled;
 exports.isDaemonAutostartInstalled = isDaemonAutostartInstalled;
 exports.daemonCommand = daemonCommand;
 const fs = __importStar(require("fs"));
@@ -44,6 +48,8 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const config_1 = require("../config");
+const daemonForensics_1 = require("../daemonForensics");
+const securityAgents_1 = require("../securityAgents");
 const mcpGateway_1 = require("./mcpGateway");
 const protectionRepair_1 = require("./protectionRepair");
 const runtimeConfig_1 = require("../runtimeConfig");
@@ -351,6 +357,18 @@ async function runDaemon(args, config) {
     const quiet = args.quiet === 'true';
     log(`Daemon started (pid ${process.pid}, platform ${process.platform}).`);
     log(`Shield: ${creds.shieldId || '(none — protect-only mode, telemetry disabled)'}  API: ${creds.apiUrl}`);
+    // A machine enrolled with a DPAPI key whose decrypt fails (blocked
+    // PowerShell) lands here: shieldId readable, key not. Say so LOUDLY — this
+    // state looks identical to "machine off" on the dashboard otherwise.
+    if (creds.shieldId && !creds.shieldKey) {
+        const ph = (0, config_1.getPowershellHealth)();
+        log(`Shield key UNAVAILABLE${ph && !ph.spawnOk ? ' — powershell.exe could not start (EDR/policy block?), so the DPAPI-protected key cannot be decrypted' : ''}. Telemetry/control-plane sync disabled; retrying periodically.`);
+    }
+    // Crash forensics: was the previous daemon killed without a clean shutdown?
+    const postmortem = (0, daemonForensics_1.recordDaemonStart)({ version: cliVersion(), isPidAlive });
+    if (postmortem) {
+        log(`Previous daemon (v${postmortem.version || '?'}) died UNCLEANLY — last alive ${postmortem.lastAliveAt || 'unknown'}, no shutdown recorded. Likely killed externally (EDR/AV, OOM, or forced termination). Post-mortem recorded; reporting upstream.`);
+    }
     // --- state ---------------------------------------------------------------
     const watchers = new Map(); // directory -> watcher
     const rootWatchers = new Map(); // admin protection roots -> recursive watcher
@@ -363,6 +381,34 @@ async function runDaemon(args, config) {
     const executingActionIds = new Set();
     /** Latest org auto-update policy seen on a bundle poll. */
     let autoUpdatePolicy;
+    /** Heartbeat ticks spent without full credentials (drives recovery cadence). */
+    let credRecoveryTicks = 0;
+    /**
+     * A daemon that starts without a usable shield key (DPAPI decrypt blocked,
+     * config written after start by `login`) must NOT stay credential-less
+     * forever — that silences telemetry AND auto-update, stranding the machine.
+     * Retry quickly right after start, then hourly (each retry may spawn
+     * PowerShell for DPAPI, which we keep rare on machines that block it).
+     */
+    const recoverCredentialsIfMissing = () => {
+        if (creds.shieldId && creds.shieldKey)
+            return;
+        credRecoveryTicks += 1;
+        if (credRecoveryTicks > 3 && credRecoveryTicks % 12 !== 0)
+            return;
+        try {
+            const fresh = (0, config_1.resolveCliCredentials)((0, config_1.loadConfig)(args.config), {
+                shieldId: args.shieldId,
+                shieldKey: args.shieldKey,
+                apiUrl: args.apiUrl,
+            });
+            if (fresh.shieldId && fresh.shieldKey) {
+                Object.assign(creds, fresh);
+                log('Credentials recovered — telemetry and control-plane sync restored.');
+            }
+        }
+        catch { /* next tick */ }
+    };
     const reprotect = async (reasonPaths) => {
         if (reprotecting || stopped)
             return;
@@ -812,10 +858,16 @@ async function runDaemon(args, config) {
         catch { /* offline — cached stance applies */ }
     };
     const heartbeat = async () => {
+        (0, daemonForensics_1.touchDaemonAlive)();
+        recoverCredentialsIfMissing();
         if (!creds.shieldId)
             return;
         try {
             const integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
+            // Report a previous daemon's unclean death exactly once.
+            const crash = (0, daemonForensics_1.readPostmortem)();
+            const unreportedCrash = crash && !crash.reportedAt ? crash : undefined;
+            const powershell = (0, config_1.getPowershellHealth)();
             const result = await (0, telemetry_1.flushSpool)({
                 apiUrl: creds.apiUrl,
                 shieldId: creds.shieldId,
@@ -827,7 +879,21 @@ async function runDaemon(args, config) {
                 integrityReasons: integrity.reasons,
                 integrityCheckedAt: integrity.checkedAt,
                 desktopChatGuard: (0, desktopChatGuard_1.desktopChatGuardSupported)() && (0, desktopChatGuard_1.desktopChatGuardHealthy)(),
+                securityAgents: (0, securityAgents_1.getSecurityAgentsReport)()?.products,
+                powershellSpawnOk: powershell?.spawnOk,
+                powershellDecryptOk: powershell?.decryptOk,
+                lastCrash: unreportedCrash
+                    ? {
+                        version: unreportedCrash.version,
+                        startedAt: unreportedCrash.startedAt,
+                        lastAliveAt: unreportedCrash.lastAliveAt,
+                        detectedAt: unreportedCrash.detectedAt,
+                        detectedBy: unreportedCrash.detectedBy,
+                    }
+                    : undefined,
             });
+            if (result && unreportedCrash)
+                (0, daemonForensics_1.markPostmortemReported)();
             if (result && result.accepted > 0)
                 log(`Heartbeat: flushed ${result.accepted} spooled event(s).`);
             if (!integrity.ok)
@@ -840,6 +906,9 @@ async function runDaemon(args, config) {
         await verifyPendingUpgrade();
     };
     // --- boot ---------------------------------------------------------------
+    // Self-heal autostart + watchdog tasks: machines installed by older versions
+    // (or where task creation failed once) must converge without a reinstall.
+    ensureWindowsAutostartHealthy(log);
     const watched = refreshWatchTargets();
     log(`Watching ${watched} config file(s) across ${watchers.size} director${watchers.size === 1 ? 'y' : 'ies'}.`);
     // First: if this boot IS the post-upgrade relaunch, confirm the pending
@@ -962,6 +1031,9 @@ async function runDaemon(args, config) {
             watcher.close();
         for (const watcher of rootWatchers.values())
             watcher.close();
+        // Forensics: this is an INTENTIONAL exit — without this stamp the next
+        // boot would report it as an external kill.
+        (0, daemonForensics_1.recordCleanExit)(signal);
         releasePidLock();
         process.exit(0);
     };
@@ -975,18 +1047,29 @@ async function runDaemon(args, config) {
 // Autostart install / uninstall / status
 // ---------------------------------------------------------------------------
 /** Hidden VBS launcher so the logon task doesn't flash a console window. */
-function ensureWindowsLauncher() {
+function writeHiddenLauncher(fileName, cliCommand) {
     const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
     const dir = path.join(base, 'FullCourtDefense');
     fs.mkdirSync(dir, { recursive: true });
-    const vbs = path.join(dir, 'daemon.vbs');
+    const vbs = path.join(dir, fileName);
     // Run node directly — routing through `cmd /c` breaks cmd's quote parsing
     // when node/CLI live under a path with spaces (e.g. Program Files).
-    const inner = `"${process.execPath}" "${cliEntry()}" daemon`;
+    const inner = `"${process.execPath}" "${cliEntry()}" ${cliCommand}`;
     const content = `CreateObject("WScript.Shell").Run "${inner.replace(/"/g, '""')}", 0, False\n`;
     fs.writeFileSync(vbs, content, 'utf8');
     return vbs;
 }
+function ensureWindowsLauncher() {
+    return writeHiddenLauncher('daemon.vbs', 'daemon');
+}
+/**
+ * Watchdog launcher: runs the `watchdog` command (liveness beacon + daemon
+ * revival + crash post-mortem) instead of blindly starting the daemon — the
+ * beacon is what lets the console tell "daemon dead" apart from "machine off".
+ */
+function ensureWindowsWatchdogLauncher() {
+    return writeHiddenLauncher('watchdog.vbs', 'watchdog');
+}
 const WINDOWS_RUN_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';
 const WINDOWS_RUN_VALUE = 'FullCourtDefenseDaemon';
 function isWindowsRunKeyInstalled() {
@@ -1047,28 +1130,102 @@ function installWindows() {
     }
     // Watchdog: logon triggers only START the daemon — nothing restarts it if it
     // is killed or crashes mid-session. A time-based per-user task (no elevation
-    // needed, unlike ONLOGON) re-launches the daemon every 5 minutes;
-    // acquirePidLock() makes each tick a cheap no-op while the daemon is alive,
-    // and revives it within one tick when it is not. Best-effort: a missing
-    // watchdog never fails the install.
+    // needed, unlike ONLOGON) runs the `watchdog` command every 5 minutes: it
+    // beacons daemon liveness to the console (so "daemon dead" is visible even
+    // when the daemon can't say so itself) and revives a dead daemon within one
+    // tick. Best-effort: a missing watchdog never fails the install.
     (0, child_process_1.spawnSync)('schtasks', [
-        '/Create', '/TN', WATCHDOG_TASK_NAME, '/TR', `wscript.exe "${vbs}"`,
+        '/Create', '/TN', WATCHDOG_TASK_NAME, '/TR', `wscript.exe "${ensureWindowsWatchdogLauncher()}"`,
         '/SC', 'MINUTE', '/MO', '5', '/F',
     ], { stdio: 'ignore', windowsHide: true });
     if (ok)
         startDaemonNowWindows(vbs, taskOk);
     return ok;
 }
+/**
+ * Boot-time self-heal for the Windows autostart chain. Recreates a missing
+ * daemon logon entry, refreshes the launcher scripts (paths move on upgrade),
+ * and re-points the watchdog task at the `watchdog` launcher (older versions
+ * pointed it at daemon.vbs, which restarts but never beacons). Creating
+ * per-user MINUTE tasks needs no elevation; ONLOGON does — fall back to the
+ * per-user Run key exactly like installWindows().
+ */
+function ensureWindowsAutostartHealthy(logFn) {
+    if (process.platform !== 'win32')
+        return;
+    // Kill-switch for sandboxed test daemons — a test-spawned daemon must never
+    // (re)write the developer machine's real scheduled tasks.
+    if (process.env.FCD_DAEMON_NO_TASK_SELF_HEAL === '1')
+        return;
+    try {
+        const vbs = ensureWindowsLauncher();
+        const watchdogVbs = ensureWindowsWatchdogLauncher();
+        const daemonTask = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
+        if (daemonTask.status !== 0 && !isWindowsRunKeyInstalled()) {
+            const created = (0, child_process_1.spawnSync)('schtasks', [
+                '/Create', '/TN', TASK_NAME, '/TR', `wscript.exe "${vbs}"`,
+                '/SC', 'ONLOGON', '/F', '/RL', 'LIMITED',
+            ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
+            if (created.status !== 0) {
+                (0, child_process_1.spawnSync)('reg', [
+                    'add', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/t', 'REG_SZ',
+                    '/d', `wscript.exe "${vbs}"`, '/f',
+                ], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
+            }
+            logFn('Self-heal: daemon autostart entry was missing — recreated.');
+        }
+        const watchdog = (0, child_process_1.spawnSync)('schtasks', [
+            '/Create', '/TN', WATCHDOG_TASK_NAME, '/TR', `wscript.exe "${watchdogVbs}"`,
+            '/SC', 'MINUTE', '/MO', '5', '/F',
+        ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
+        if (watchdog.status !== 0) {
+            logFn('Self-heal: could not (re)create the watchdog task — daemon revival relies on logon autostart only.');
+        }
+    }
+    catch { /* self-heal is best-effort — never blocks daemon boot */ }
+}
+function daemonRuntimeState() {
+    try {
+        const pid = Number(fs.readFileSync(pidFile(), 'utf8').trim());
+        if (Number.isFinite(pid) && pid > 0 && isPidAlive(pid)) {
+            const meta = readDaemonMeta();
+            const owned = meta?.pid === pid;
+            return { alive: true, pid, version: owned ? meta?.version : undefined, startedAt: owned ? meta?.startedAt : undefined };
+        }
+    }
+    catch { /* no pid file — not running */ }
+    return { alive: false };
+}
+/** Relaunch the daemon outside our process tree (plain node — no shells). */
+function spawnDetachedDaemon() {
+    try {
+        const child = (0, child_process_1.spawn)(process.execPath, [cliEntry(), 'daemon'], {
+            detached: true,
+            stdio: 'ignore',
+            windowsHide: true,
+        });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Pid-alive check shared with the watchdog (EPERM still means alive). */
+function pidIsAlive(pid) {
+    return isPidAlive(pid);
+}
 function uninstallWindows() {
     const task = (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', TASK_NAME, '/F'], { stdio: 'ignore', windowsHide: true });
     (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', WATCHDOG_TASK_NAME, '/F'], { stdio: 'ignore', windowsHide: true });
     const reg = (0, child_process_1.spawnSync)('reg', ['delete', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/f'], { stdio: 'ignore', windowsHide: true });
-    const vbs = path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'FullCourtDefense', 'daemon.vbs');
-    try {
-        if (fs.existsSync(vbs))
-            fs.unlinkSync(vbs);
+    const launcherDir = path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'FullCourtDefense');
+    for (const launcher of ['daemon.vbs', 'watchdog.vbs']) {
+        try {
+            fs.unlinkSync(path.join(launcherDir, launcher));
+        }
+        catch { /* ignore */ }
     }
-    catch { /* ignore */ }
     return task.status === 0 || reg.status === 0;
 }
 function launchdPlistPath() {
@@ -1134,6 +1291,17 @@ function systemdUnitPath() {
     return path.join(base, 'systemd', 'user', SYSTEMD_UNIT);
 }
 /** Whether the daemon has been registered to start automatically. */
+/** Is the 5-minute watchdog scheduled task registered? (Windows-only feature.) */
+function isWatchdogTaskInstalled() {
+    if (process.platform !== 'win32')
+        return false;
+    const result = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', WATCHDOG_TASK_NAME], {
+        stdio: 'ignore',
+        timeout: 5_000,
+        windowsHide: true,
+    });
+    return result.status === 0;
+}
 function isDaemonAutostartInstalled() {
     if (process.platform === 'win32') {
         const result = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME], {

package/dist/commands/discover.d.ts

@@ -64,6 +64,8 @@ export interface DesktopDiscoveryHost {
     probeMode: 'config' | 'deep';
     /** Windows-only: PowerShell audit coverage (ScriptBlock Logging + Transcription). */
     shellAudit?: ShellAuditReport;
+    /** Windows-only: EDR/AV products detected on this machine (read-only service probe). */
+    securityAgents?: string[];
     /** True when the scan ran on an ephemeral CI runner (GitHub Actions, GitLab, etc.) — not a user machine. */
     isCi?: boolean;
 }

package/dist/commands/discover.js

@@ -51,6 +51,7 @@ const discoverAgentFiles_1 = require("./discoverAgentFiles");
 const discoverBlastRadius_1 = require("./discoverBlastRadius");
 const discoverSecrets_1 = require("./discoverSecrets");
 const windowsAudit_1 = require("./windowsAudit");
+const securityAgents_1 = require("../securityAgents");
 const discoveryMarker_1 = require("../discoveryMarker");
 const machineIdentity_1 = require("../machineIdentity");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
@@ -126,6 +127,7 @@ function buildHostMetadata(userEmail, probeMode = 'config') {
         scannedAt: new Date().toISOString(),
         probeMode,
         shellAudit: (0, windowsAudit_1.getShellAuditReport)(),
+        securityAgents: (0, securityAgents_1.getSecurityAgentsReport)()?.products,
         isCi: isCiEnvironment() || undefined,
     };
 }

package/dist/commands/onboard.js

@@ -53,6 +53,8 @@ const machineIdentity_1 = require("../machineIdentity");
 const appDetection_1 = require("../appDetection");
 const integrity_1 = require("../integrity");
 const telemetry_1 = require("../telemetry");
+const envDiagnostics_1 = require("../envDiagnostics");
+const daemonForensics_1 = require("../daemonForensics");
 const onboardingJournal_1 = require("./onboardingJournal");
 const GREEN = '\x1b[32m';
 const RED = '\x1b[31m';
@@ -246,7 +248,7 @@ async function onboardCommand(args, config) {
     const apiUrl = creds.apiUrl;
     const token = (args.token || process.env.FCD_ENROLL_TOKEN || '').trim();
     // 1. Connectivity.
-    console.log(`${BOLD}[1/6] Checking compatibility and connectivity…${RESET}`);
+    console.log(`${BOLD}[1/7] Checking compatibility and connectivity…${RESET}`);
     mark('preflight', 'running');
     // A stale cmd-guard AutoRun (registry points at a deleted autorun script)
     // poisons every cmd.exe exit code on the machine — child spawns and the MSI's
@@ -280,7 +282,7 @@ async function onboardCommand(args, config) {
     }
     mark('preflight', 'completed');
     // 2. Enrollment.
-    console.log(`\n${BOLD}[2/6] Enrolling this machine…${RESET}`);
+    console.log(`\n${BOLD}[2/7] Enrolling this machine…${RESET}`);
     mark('enrollment', 'running');
     const alreadyEnrolled = Boolean(creds.shieldId && creds.shieldKey);
     if (dryRun) {
@@ -305,7 +307,7 @@ async function onboardCommand(args, config) {
     // Re-read config: login just wrote fresh shield credentials to ~/.fullcourtdefense.yml.
     const freshConfig = (0, config_1.loadConfig)();
     // 3. Protection.
-    console.log(`\n${BOLD}[3/6] Installing protection (install-all)…${RESET}`);
+    console.log(`\n${BOLD}[3/7] Installing protection (install-all)…${RESET}`);
     if (dryRun) {
         mark('protection', 'skipped', 'would install MCP gateways, IDE hooks, and terminal guards');
     }
@@ -334,7 +336,7 @@ async function onboardCommand(args, config) {
             return;
         }
     }
-    console.log(`\n${BOLD}[4/6] Installing background protection…${RESET}`);
+    console.log(`\n${BOLD}[4/7] Installing background protection…${RESET}`);
     if (dryRun || args.noDaemon === 'true') {
         mark('daemon', 'skipped', dryRun ? 'would register the resident daemon' : 'disabled by --no-daemon true');
     }
@@ -355,7 +357,7 @@ async function onboardCommand(args, config) {
     }
     // Discovery and scheduling are useful fleet telemetry, but must never mark a
     // device as unprotected or prevent a repair of the enforcement surfaces.
-    console.log(`\n${BOLD}[5/6] Recording optional discovery and schedule…${RESET}`);
+    console.log(`\n${BOLD}[5/7] Recording optional discovery and schedule…${RESET}`);
     if (dryRun || args.discover === 'false') {
         mark('discovery', 'skipped', dryRun ? 'would upload desktop discovery' : 'disabled by --discover false');
     }
@@ -383,8 +385,38 @@ async function onboardCommand(args, config) {
             mark('schedule', 'failed', undefined, error instanceof Error ? error.message : String(error));
         }
     }
-    // 4. Verification.
-    console.log(`\n${BOLD}[6/6] Verifying protection surfaces…${RESET}`);
+    // 4. Environment diagnostics — the "will this machine stay alive?" snapshot.
+    // Runs while we still have an interactive session on the (possibly EDR-
+    // hardened) machine: EDR/AV inventory, PowerShell/DPAPI health, daemon
+    // kill-detection (alive now AND still alive seconds later), watchdog task,
+    // and any crash post-mortem from a previous install. Never critical — the
+    // findings ship to the fleet console in the first heartbeat below.
+    console.log(`\n${BOLD}[6/7] Collecting environment diagnostics…${RESET}`);
+    let envDiag;
+    if (dryRun) {
+        mark('diagnostics', 'skipped', 'would probe EDR/AV, PowerShell health, and daemon liveness');
+    }
+    else {
+        mark('diagnostics', 'running');
+        try {
+            envDiag = await (0, envDiagnostics_1.collectEnvironmentDiagnostics)({ recheckDelayMs: args.noDaemon === 'true' ? 0 : 5_000 });
+            const summary = (0, envDiagnostics_1.summarizeEnvironmentDiagnostics)(envDiag);
+            console.log(`  ${DIM}${summary}${RESET}`);
+            if ((0, envDiagnostics_1.environmentLooksHealthy)(envDiag)) {
+                mark('diagnostics', 'completed', summary);
+            }
+            else {
+                // Non-critical: a hostile environment is REPORTED, not treated as an
+                // install failure — the protection surfaces below are what gate.
+                mark('diagnostics', 'failed', summary, summary);
+            }
+        }
+        catch (error) {
+            mark('diagnostics', 'failed', undefined, error instanceof Error ? error.message : String(error));
+        }
+    }
+    // 5. Verification.
+    console.log(`\n${BOLD}[7/7] Verifying protection surfaces…${RESET}`);
     mark('verification', 'running');
     const postCreds = (0, config_1.resolveCliCredentials)((0, config_1.loadConfig)(), { apiUrl });
     // Immediate heartbeat: the machine must appear ONLINE in the fleet console
@@ -409,9 +441,31 @@ async function onboardCommand(args, config) {
                 integrityOk: integrity.ok,
                 integrityReasons: integrity.reasons,
                 integrityCheckedAt: integrity.checkedAt,
+                // Environment diagnostics ride the FIRST heartbeat: the fleet console
+                // knows this machine's EDR/AV products, PowerShell health, and any
+                // previous crash the moment onboarding finishes — before the machine
+                // has any chance to go silent.
+                securityAgents: envDiag?.securityAgents,
+                powershellSpawnOk: envDiag?.powershellSpawnOk,
+                powershellDecryptOk: envDiag?.powershellDecryptOk,
+                lastCrash: envDiag?.lastCrash
+                    ? {
+                        version: envDiag.lastCrash.version,
+                        startedAt: envDiag.lastCrash.startedAt,
+                        lastAliveAt: envDiag.lastCrash.lastAliveAt,
+                        detectedAt: envDiag.lastCrash.detectedAt,
+                        detectedBy: envDiag.lastCrash.detectedBy,
+                    }
+                    : undefined,
                 timeoutMs: 8_000,
             });
             firstHeartbeatOk = flush !== null;
+            if (firstHeartbeatOk && envDiag?.lastCrash) {
+                try {
+                    (0, daemonForensics_1.markPostmortemReported)();
+                }
+                catch { /* best-effort */ }
+            }
         }
         catch { /* the daemon heartbeat remains the backstop */ }
     }
@@ -455,6 +509,41 @@ async function onboardCommand(args, config) {
                 ? 'this machine now shows ONLINE in the fleet console'
                 : dryRun ? 'skipped (dry run)' : 'not delivered yet — the daemon retries within 5 minutes',
         },
+        // --- environment diagnostics (informational: report, never block) -------
+        {
+            label: 'Daemon survived post-install liveness check',
+            ok: envDiag ? envDiag.daemonSurvivedRecheck !== false && envDiag.daemonAlive : true,
+            optional: true,
+            detail: !envDiag
+                ? 'skipped (dry run)'
+                : envDiag.daemonSurvivedRecheck === false
+                    ? 'daemon was KILLED seconds after starting — security software on this machine is terminating it'
+                    : envDiag.daemonAlive ? `pid ${envDiag.daemonPid}` : 'daemon not running — the watchdog will start it within 5 minutes',
+        },
+        {
+            label: 'Watchdog liveness beacon (5-minute health reports)',
+            ok: envDiag ? envDiag.watchdogTaskInstalled : true,
+            optional: true,
+            detail: envDiag && !envDiag.watchdogTaskInstalled && process.platform === 'win32'
+                ? 'task not registered — the daemon re-creates it at every start'
+                : undefined,
+        },
+        {
+            label: 'PowerShell available for secure key storage',
+            ok: envDiag ? envDiag.powershellSpawnOk !== false : true,
+            optional: true,
+            detail: envDiag?.powershellSpawnOk === false
+                ? 'PowerShell is blocked on this machine (security policy) — credentials use a PowerShell-free path'
+                : envDiag?.powershellDecryptOk === false ? 'PowerShell runs but the stored key did not decrypt' : undefined,
+        },
+        {
+            label: 'Security software inventory',
+            ok: true,
+            optional: true,
+            detail: envDiag?.securityAgents
+                ? envDiag.securityAgents.length ? envDiag.securityAgents.join(', ') : 'none detected'
+                : 'not probed (non-Windows or dry run)',
+        },
     ];
     console.log('');
     for (const check of checks)

package/dist/commands/onboardingJournal.d.ts

@@ -1,4 +1,4 @@
-export type OnboardingStepName = 'preflight' | 'enrollment' | 'protection' | 'daemon' | 'discovery' | 'schedule' | 'verification';
+export type OnboardingStepName = 'preflight' | 'enrollment' | 'protection' | 'daemon' | 'discovery' | 'schedule' | 'diagnostics' | 'verification';
 export type OnboardingStepStatus = 'pending' | 'running' | 'completed' | 'failed' | 'skipped';
 export interface OnboardingStep {
     status: OnboardingStepStatus;

package/dist/commands/onboardingJournal.js

@@ -48,6 +48,10 @@ const STEP_DEFINITIONS = [
     ['daemon', true],
     ['discovery', false],
     ['schedule', false],
+    // Post-install environment diagnostics (EDR/AV inventory, PowerShell
+    // health, watchdog + daemon liveness). Never critical: diagnostics report
+    // problems, they must not BE one.
+    ['diagnostics', false],
     ['verification', true],
 ];
 function onboardingJournalPath(home = os.homedir()) {

package/dist/commands/watchdog.d.ts

@@ -0,0 +1,25 @@
+import { BotGuardConfig } from '../config';
+/**
+ * Watchdog tick — runs OUTSIDE the daemon (Windows scheduled task, every
+ * 5 minutes) so machine health stays observable even when the daemon itself
+ * is dead. Three jobs, all best-effort, never throws, exits 0:
+ *
+ *   1. Liveness: is the daemon running? If not, detect + persist the unclean
+ *      death post-mortem (the daemon can no longer say how it died).
+ *   2. Revival: relaunch a dead daemon (plain detached node — no shells).
+ *   3. Beacon: report daemon state to the console so the dashboard can tell
+ *      "daemon dead since 11:02" apart from "machine off".
+ *
+ * Shell-quiet by design: credential resolution NEVER attempts the DPAPI/
+ * PowerShell decrypt here (this runs every 5 minutes — exactly the hourly-
+ * PowerShell pattern that made EDRs kill us). On DPAPI-enrolled machines the
+ * beacon goes out WITHOUT a shield key; the backend accepts it on a
+ * constrained, rate-limited path that can only update watchdog liveness
+ * fields of an already-enrolled machine.
+ */
+export interface WatchdogArgs {
+    apiUrl?: string;
+    shieldId?: string;
+    shieldKey?: string;
+}
+export declare function watchdogCommand(args: WatchdogArgs, config: BotGuardConfig): Promise<void>;