fullcourtdefense-cli 1.21.29 → 1.21.30

package/dist/commands/daemon.d.ts

@@ -46,5 +46,7 @@ export declare function spawnDetachedDaemon(): boolean;
 export declare function pidIsAlive(pid: number): boolean;
 export declare function macosLaunchdPath(currentPath?: string, execPath?: string): string;
 /** Whether the daemon has been registered to start automatically. */
+/** Is the 5-minute watchdog scheduled task registered? (Windows-only feature.) */
+export declare function isWatchdogTaskInstalled(): boolean;
 export declare function isDaemonAutostartInstalled(): boolean;
 export declare function daemonCommand(args: DaemonArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/daemon.js

@@ -40,6 +40,7 @@ exports.daemonRuntimeState = daemonRuntimeState;
 exports.spawnDetachedDaemon = spawnDetachedDaemon;
 exports.pidIsAlive = pidIsAlive;
 exports.macosLaunchdPath = macosLaunchdPath;
+exports.isWatchdogTaskInstalled = isWatchdogTaskInstalled;
 exports.isDaemonAutostartInstalled = isDaemonAutostartInstalled;
 exports.daemonCommand = daemonCommand;
 const fs = __importStar(require("fs"));
@@ -1290,6 +1291,17 @@ function systemdUnitPath() {
     return path.join(base, 'systemd', 'user', SYSTEMD_UNIT);
 }
 /** Whether the daemon has been registered to start automatically. */
+/** Is the 5-minute watchdog scheduled task registered? (Windows-only feature.) */
+function isWatchdogTaskInstalled() {
+    if (process.platform !== 'win32')
+        return false;
+    const result = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', WATCHDOG_TASK_NAME], {
+        stdio: 'ignore',
+        timeout: 5_000,
+        windowsHide: true,
+    });
+    return result.status === 0;
+}
 function isDaemonAutostartInstalled() {
     if (process.platform === 'win32') {
         const result = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME], {

package/dist/commands/onboard.js

@@ -53,6 +53,8 @@ const machineIdentity_1 = require("../machineIdentity");
 const appDetection_1 = require("../appDetection");
 const integrity_1 = require("../integrity");
 const telemetry_1 = require("../telemetry");
+const envDiagnostics_1 = require("../envDiagnostics");
+const daemonForensics_1 = require("../daemonForensics");
 const onboardingJournal_1 = require("./onboardingJournal");
 const GREEN = '\x1b[32m';
 const RED = '\x1b[31m';
@@ -246,7 +248,7 @@ async function onboardCommand(args, config) {
     const apiUrl = creds.apiUrl;
     const token = (args.token || process.env.FCD_ENROLL_TOKEN || '').trim();
     // 1. Connectivity.
-    console.log(`${BOLD}[1/6] Checking compatibility and connectivity…${RESET}`);
+    console.log(`${BOLD}[1/7] Checking compatibility and connectivity…${RESET}`);
     mark('preflight', 'running');
     // A stale cmd-guard AutoRun (registry points at a deleted autorun script)
     // poisons every cmd.exe exit code on the machine — child spawns and the MSI's
@@ -280,7 +282,7 @@ async function onboardCommand(args, config) {
     }
     mark('preflight', 'completed');
     // 2. Enrollment.
-    console.log(`\n${BOLD}[2/6] Enrolling this machine…${RESET}`);
+    console.log(`\n${BOLD}[2/7] Enrolling this machine…${RESET}`);
     mark('enrollment', 'running');
     const alreadyEnrolled = Boolean(creds.shieldId && creds.shieldKey);
     if (dryRun) {
@@ -305,7 +307,7 @@ async function onboardCommand(args, config) {
     // Re-read config: login just wrote fresh shield credentials to ~/.fullcourtdefense.yml.
     const freshConfig = (0, config_1.loadConfig)();
     // 3. Protection.
-    console.log(`\n${BOLD}[3/6] Installing protection (install-all)…${RESET}`);
+    console.log(`\n${BOLD}[3/7] Installing protection (install-all)…${RESET}`);
     if (dryRun) {
         mark('protection', 'skipped', 'would install MCP gateways, IDE hooks, and terminal guards');
     }
@@ -334,7 +336,7 @@ async function onboardCommand(args, config) {
             return;
         }
     }
-    console.log(`\n${BOLD}[4/6] Installing background protection…${RESET}`);
+    console.log(`\n${BOLD}[4/7] Installing background protection…${RESET}`);
     if (dryRun || args.noDaemon === 'true') {
         mark('daemon', 'skipped', dryRun ? 'would register the resident daemon' : 'disabled by --no-daemon true');
     }
@@ -355,7 +357,7 @@ async function onboardCommand(args, config) {
     }
     // Discovery and scheduling are useful fleet telemetry, but must never mark a
     // device as unprotected or prevent a repair of the enforcement surfaces.
-    console.log(`\n${BOLD}[5/6] Recording optional discovery and schedule…${RESET}`);
+    console.log(`\n${BOLD}[5/7] Recording optional discovery and schedule…${RESET}`);
     if (dryRun || args.discover === 'false') {
         mark('discovery', 'skipped', dryRun ? 'would upload desktop discovery' : 'disabled by --discover false');
     }
@@ -383,8 +385,38 @@ async function onboardCommand(args, config) {
             mark('schedule', 'failed', undefined, error instanceof Error ? error.message : String(error));
         }
     }
-    // 4. Verification.
-    console.log(`\n${BOLD}[6/6] Verifying protection surfaces…${RESET}`);
+    // 4. Environment diagnostics — the "will this machine stay alive?" snapshot.
+    // Runs while we still have an interactive session on the (possibly EDR-
+    // hardened) machine: EDR/AV inventory, PowerShell/DPAPI health, daemon
+    // kill-detection (alive now AND still alive seconds later), watchdog task,
+    // and any crash post-mortem from a previous install. Never critical — the
+    // findings ship to the fleet console in the first heartbeat below.
+    console.log(`\n${BOLD}[6/7] Collecting environment diagnostics…${RESET}`);
+    let envDiag;
+    if (dryRun) {
+        mark('diagnostics', 'skipped', 'would probe EDR/AV, PowerShell health, and daemon liveness');
+    }
+    else {
+        mark('diagnostics', 'running');
+        try {
+            envDiag = await (0, envDiagnostics_1.collectEnvironmentDiagnostics)({ recheckDelayMs: args.noDaemon === 'true' ? 0 : 5_000 });
+            const summary = (0, envDiagnostics_1.summarizeEnvironmentDiagnostics)(envDiag);
+            console.log(`  ${DIM}${summary}${RESET}`);
+            if ((0, envDiagnostics_1.environmentLooksHealthy)(envDiag)) {
+                mark('diagnostics', 'completed', summary);
+            }
+            else {
+                // Non-critical: a hostile environment is REPORTED, not treated as an
+                // install failure — the protection surfaces below are what gate.
+                mark('diagnostics', 'failed', summary, summary);
+            }
+        }
+        catch (error) {
+            mark('diagnostics', 'failed', undefined, error instanceof Error ? error.message : String(error));
+        }
+    }
+    // 5. Verification.
+    console.log(`\n${BOLD}[7/7] Verifying protection surfaces…${RESET}`);
     mark('verification', 'running');
     const postCreds = (0, config_1.resolveCliCredentials)((0, config_1.loadConfig)(), { apiUrl });
     // Immediate heartbeat: the machine must appear ONLINE in the fleet console
@@ -409,9 +441,31 @@ async function onboardCommand(args, config) {
                 integrityOk: integrity.ok,
                 integrityReasons: integrity.reasons,
                 integrityCheckedAt: integrity.checkedAt,
+                // Environment diagnostics ride the FIRST heartbeat: the fleet console
+                // knows this machine's EDR/AV products, PowerShell health, and any
+                // previous crash the moment onboarding finishes — before the machine
+                // has any chance to go silent.
+                securityAgents: envDiag?.securityAgents,
+                powershellSpawnOk: envDiag?.powershellSpawnOk,
+                powershellDecryptOk: envDiag?.powershellDecryptOk,
+                lastCrash: envDiag?.lastCrash
+                    ? {
+                        version: envDiag.lastCrash.version,
+                        startedAt: envDiag.lastCrash.startedAt,
+                        lastAliveAt: envDiag.lastCrash.lastAliveAt,
+                        detectedAt: envDiag.lastCrash.detectedAt,
+                        detectedBy: envDiag.lastCrash.detectedBy,
+                    }
+                    : undefined,
                 timeoutMs: 8_000,
             });
             firstHeartbeatOk = flush !== null;
+            if (firstHeartbeatOk && envDiag?.lastCrash) {
+                try {
+                    (0, daemonForensics_1.markPostmortemReported)();
+                }
+                catch { /* best-effort */ }
+            }
         }
         catch { /* the daemon heartbeat remains the backstop */ }
     }
@@ -455,6 +509,41 @@ async function onboardCommand(args, config) {
                 ? 'this machine now shows ONLINE in the fleet console'
                 : dryRun ? 'skipped (dry run)' : 'not delivered yet — the daemon retries within 5 minutes',
         },
+        // --- environment diagnostics (informational: report, never block) -------
+        {
+            label: 'Daemon survived post-install liveness check',
+            ok: envDiag ? envDiag.daemonSurvivedRecheck !== false && envDiag.daemonAlive : true,
+            optional: true,
+            detail: !envDiag
+                ? 'skipped (dry run)'
+                : envDiag.daemonSurvivedRecheck === false
+                    ? 'daemon was KILLED seconds after starting — security software on this machine is terminating it'
+                    : envDiag.daemonAlive ? `pid ${envDiag.daemonPid}` : 'daemon not running — the watchdog will start it within 5 minutes',
+        },
+        {
+            label: 'Watchdog liveness beacon (5-minute health reports)',
+            ok: envDiag ? envDiag.watchdogTaskInstalled : true,
+            optional: true,
+            detail: envDiag && !envDiag.watchdogTaskInstalled && process.platform === 'win32'
+                ? 'task not registered — the daemon re-creates it at every start'
+                : undefined,
+        },
+        {
+            label: 'PowerShell available for secure key storage',
+            ok: envDiag ? envDiag.powershellSpawnOk !== false : true,
+            optional: true,
+            detail: envDiag?.powershellSpawnOk === false
+                ? 'PowerShell is blocked on this machine (security policy) — credentials use a PowerShell-free path'
+                : envDiag?.powershellDecryptOk === false ? 'PowerShell runs but the stored key did not decrypt' : undefined,
+        },
+        {
+            label: 'Security software inventory',
+            ok: true,
+            optional: true,
+            detail: envDiag?.securityAgents
+                ? envDiag.securityAgents.length ? envDiag.securityAgents.join(', ') : 'none detected'
+                : 'not probed (non-Windows or dry run)',
+        },
     ];
     console.log('');
     for (const check of checks)

package/dist/commands/onboardingJournal.d.ts

@@ -1,4 +1,4 @@
-export type OnboardingStepName = 'preflight' | 'enrollment' | 'protection' | 'daemon' | 'discovery' | 'schedule' | 'verification';
+export type OnboardingStepName = 'preflight' | 'enrollment' | 'protection' | 'daemon' | 'discovery' | 'schedule' | 'diagnostics' | 'verification';
 export type OnboardingStepStatus = 'pending' | 'running' | 'completed' | 'failed' | 'skipped';
 export interface OnboardingStep {
     status: OnboardingStepStatus;

package/dist/commands/onboardingJournal.js

@@ -48,6 +48,10 @@ const STEP_DEFINITIONS = [
     ['daemon', true],
     ['discovery', false],
     ['schedule', false],
+    // Post-install environment diagnostics (EDR/AV inventory, PowerShell
+    // health, watchdog + daemon liveness). Never critical: diagnostics report
+    // problems, they must not BE one.
+    ['diagnostics', false],
     ['verification', true],
 ];
 function onboardingJournalPath(home = os.homedir()) {

package/dist/envDiagnostics.d.ts

@@ -0,0 +1,46 @@
+import { DaemonPostmortem } from './daemonForensics';
+/**
+ * Post-install environment diagnostics — the "will this machine stay alive?"
+ * snapshot taken at the END of onboarding, while we still have an interactive
+ * session. Fleet machines are usually remote and locked-down (bank laptops,
+ * EDR); this is our best — sometimes only — chance to capture:
+ *
+ *   - which EDR/AV products run here (read-only service probe, no PowerShell)
+ *   - whether PowerShell can spawn + whether the DPAPI key decrypts
+ *   - whether the daemon that onboarding just started is alive AND SURVIVES
+ *     a re-check a few seconds later (an EDR that kills the daemon does it
+ *     within seconds — catching that at install time beats discovering a
+ *     silent machine a day later)
+ *   - whether the watchdog liveness-beacon task actually registered
+ *   - any crash post-mortem left by a previous install's daemon
+ *
+ * Contract: NEVER throws, never blocks onboarding for more than the re-check
+ * delay, every field is optional/best-effort. Diagnostics report problems —
+ * they must never BE one.
+ */
+export interface EnvironmentDiagnostics {
+    /** EDR/AV product names detected (Windows service probe). */
+    securityAgents?: string[];
+    powershellSpawnOk?: boolean;
+    powershellDecryptOk?: boolean;
+    daemonAlive: boolean;
+    daemonPid?: number;
+    /** Did the daemon still exist recheckDelayMs later? (false = killed within seconds — EDR signature) */
+    daemonSurvivedRecheck?: boolean;
+    watchdogTaskInstalled: boolean;
+    /** Unreported crash record from a previous daemon on this machine. */
+    lastCrash?: DaemonPostmortem;
+    collectedAt: string;
+}
+export declare function collectEnvironmentDiagnostics(options?: {
+    recheckDelayMs?: number;
+}): Promise<EnvironmentDiagnostics>;
+/** One-line human summary for the onboarding journal / MSI screen / daemon log. */
+export declare function summarizeEnvironmentDiagnostics(diag: EnvironmentDiagnostics): string;
+/**
+ * Verdict for the onboarding journal: healthy unless something on this
+ * machine is actively interfering (daemon killed, PowerShell blocked, or a
+ * fresh unexplained crash). Missing watchdog alone is a warning, not
+ * interference — the daemon self-heals it at every boot.
+ */
+export declare function environmentLooksHealthy(diag: EnvironmentDiagnostics): boolean;

package/dist/envDiagnostics.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectEnvironmentDiagnostics = collectEnvironmentDiagnostics;
+exports.summarizeEnvironmentDiagnostics = summarizeEnvironmentDiagnostics;
+exports.environmentLooksHealthy = environmentLooksHealthy;
+const config_1 = require("./config");
+const daemon_1 = require("./commands/daemon");
+const securityAgents_1 = require("./securityAgents");
+const daemonForensics_1 = require("./daemonForensics");
+const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+async function collectEnvironmentDiagnostics(options = {}) {
+    const recheckDelayMs = options.recheckDelayMs ?? 5_000;
+    const diag = {
+        daemonAlive: false,
+        watchdogTaskInstalled: false,
+        collectedAt: new Date().toISOString(),
+    };
+    try {
+        const agents = (0, securityAgents_1.getSecurityAgentsReport)();
+        if (agents)
+            diag.securityAgents = agents.products;
+    }
+    catch { /* best-effort */ }
+    // Exercise the real credential path once so PowerShell health reflects THIS
+    // machine's DPAPI reality (spawn blocked vs blob undecryptable). Onboarding
+    // is interactive and already ran PowerShell to store the key, so one more
+    // spawn here is safe — and it's the exact operation the daemon depends on.
+    try {
+        if (process.platform === 'win32') {
+            (0, config_1.resolveCliCredentials)((0, config_1.loadConfig)());
+            const health = (0, config_1.getPowershellHealth)();
+            if (health) {
+                diag.powershellSpawnOk = health.spawnOk;
+                diag.powershellDecryptOk = health.decryptOk;
+            }
+        }
+    }
+    catch { /* health stays unknown */ }
+    try {
+        const state = (0, daemon_1.daemonRuntimeState)();
+        diag.daemonAlive = state.alive;
+        diag.daemonPid = state.pid;
+        if (state.alive && recheckDelayMs > 0) {
+            // The EDR-kill signature: process starts, then dies within seconds.
+            await sleep(recheckDelayMs);
+            diag.daemonSurvivedRecheck = (0, daemon_1.daemonRuntimeState)().alive;
+        }
+    }
+    catch { /* daemon state unknown */ }
+    try {
+        diag.watchdogTaskInstalled = (0, daemon_1.isWatchdogTaskInstalled)();
+    }
+    catch { /* stays false */ }
+    try {
+        const crash = (0, daemonForensics_1.readPostmortem)();
+        if (crash && !crash.reportedAt)
+            diag.lastCrash = crash;
+    }
+    catch { /* best-effort */ }
+    return diag;
+}
+/** One-line human summary for the onboarding journal / MSI screen / daemon log. */
+function summarizeEnvironmentDiagnostics(diag) {
+    const parts = [];
+    if (diag.securityAgents) {
+        parts.push(diag.securityAgents.length ? `EDR/AV: ${diag.securityAgents.join(', ')}` : 'EDR/AV: none detected');
+    }
+    if (diag.powershellSpawnOk !== undefined) {
+        parts.push(diag.powershellSpawnOk
+            ? `PowerShell OK${diag.powershellDecryptOk === false ? ' (key decrypt FAILED)' : ''}`
+            : 'PowerShell BLOCKED');
+    }
+    if (diag.daemonSurvivedRecheck === false) {
+        parts.push(`daemon KILLED seconds after start (pid ${diag.daemonPid ?? '?'})`);
+    }
+    else {
+        parts.push(diag.daemonAlive ? 'daemon alive' : 'daemon not running');
+    }
+    parts.push(diag.watchdogTaskInstalled ? 'watchdog installed' : 'watchdog task missing');
+    if (diag.lastCrash)
+        parts.push(`previous daemon died uncleanly at ${diag.lastCrash.lastAliveAt || 'unknown time'}`);
+    return parts.join('; ');
+}
+/**
+ * Verdict for the onboarding journal: healthy unless something on this
+ * machine is actively interfering (daemon killed, PowerShell blocked, or a
+ * fresh unexplained crash). Missing watchdog alone is a warning, not
+ * interference — the daemon self-heals it at every boot.
+ */
+function environmentLooksHealthy(diag) {
+    if (diag.daemonSurvivedRecheck === false)
+        return false;
+    if (diag.powershellSpawnOk === false)
+        return false;
+    if (diag.lastCrash)
+        return false;
+    return true;
+}

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.29"
+  "version": "1.21.30"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.29",
+  "version": "1.21.30",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {