fullcourtdefense-cli 1.21.31 → 1.21.34

package/dist/commands/daemon.js

@@ -48,6 +48,8 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const config_1 = require("../config");
+const distress_1 = require("../distress");
+const selfTest_1 = require("../selfTest");
 const daemonForensics_1 = require("../daemonForensics");
 const securityAgents_1 = require("../securityAgents");
 const mcpGateway_1 = require("./mcpGateway");
@@ -345,9 +347,13 @@ async function runDaemon(args, config) {
     // that would restart a crashed process instantly.
     process.on('uncaughtException', error => {
         log(`Uncaught exception (daemon continues): ${error?.stack || String(error)}`);
+        // Ledger the unknown: failures nobody predicted still become structured,
+        // fleet-visible telemetry (code unexpected_error) on the next heartbeat.
+        (0, distress_1.reportUnexpected)('daemon', error);
     });
     process.on('unhandledRejection', reason => {
         log(`Unhandled rejection (daemon continues): ${reason?.stack || String(reason)}`);
+        (0, distress_1.reportUnexpected)('daemon', reason);
     });
     const creds = (0, config_1.resolveCliCredentials)(config, {
         shieldId: args.shieldId,
@@ -536,7 +542,9 @@ async function runDaemon(args, config) {
             return;
         try {
             const raw = fs.readFileSync(logFile(), 'utf8');
-            const lines = raw.split(/\r?\n/).filter(line => line.trim()).slice(-80);
+            // 200 lines (~half a day of routine ticks): enough context to diagnose a
+            // failure loop remotely without asking the customer to paste anything.
+            const lines = raw.split(/\r?\n/).filter(line => line.trim()).slice(-200);
             const identity = (0, machineIdentity_1.getMachineIdentity)();
             await fetch(`${creds.apiUrl}/api/cli/machines/log`, {
                 method: 'POST',
@@ -550,6 +558,64 @@ async function runDaemon(args, config) {
         }
         catch { /* log shipping is best-effort */ }
     };
+    // Ship a structured diagnostics payload (support bundle / self-test report)
+    // to the machine record. Works key-less too — a machine whose credential
+    // store is broken is EXACTLY the one whose diagnostics we need (the backend
+    // verifies the machine binding and flags the reduced trust level).
+    const uploadDiagnostics = async (payload) => {
+        if (!creds.shieldId)
+            return false;
+        try {
+            const identity = (0, machineIdentity_1.getMachineIdentity)();
+            const resp = await fetch(`${creds.apiUrl}/api/cli/machines/diagnostics`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(creds.shieldKey ? { 'x-shield-key': creds.shieldKey } : {}),
+                },
+                body: JSON.stringify({ shieldId: creds.shieldId, machineId: identity.machineId, ...payload }),
+                signal: AbortSignal.timeout(15_000),
+            });
+            return resp.ok;
+        }
+        catch {
+            log('Diagnostics upload failed (network) — the bundle stays available locally.');
+            return false;
+        }
+    };
+    // The complete remote support bundle: everything we asked Alex and Alin to
+    // paste by hand during the lptx1110 incident, collected in one action.
+    // Metadata + our own logs only — never customer files, prompts, or secrets.
+    const buildSupportBundle = () => {
+        const powershell = (0, config_1.getPowershellHealth)();
+        let integrity;
+        try {
+            integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
+        }
+        catch (error) {
+            integrity = { error: error.message };
+        }
+        let daemonLogTail = [];
+        try {
+            daemonLogTail = fs.readFileSync(logFile(), 'utf8')
+                .split(/\r?\n/).map(line => line.trim()).filter(Boolean).slice(-200).map(line => line.slice(0, 400));
+        }
+        catch { /* log unreadable — the bundle reports everything else */ }
+        return {
+            cliVersion: cliVersion(),
+            platform: process.platform,
+            collectedAt: new Date().toISOString(),
+            daemonLogTail,
+            updaterLogTail: (0, selfUpdate_1.readUpdaterLogTail)(60),
+            distress: (0, distress_1.readDistressLedger)(),
+            credentialTrace: (0, config_1.getCredentialResolutionTrace)(),
+            powershell,
+            securityAgents: (0, securityAgents_1.getSecurityAgentsReport)()?.products,
+            integrity,
+            lastCrash: (0, daemonForensics_1.readPostmortem)(),
+            watchdogTaskInstalled: isWatchdogTaskInstalled(),
+        };
+    };
     const reportMachineAction = async (actionId, status, detail) => {
         if (!creds.shieldId)
             return;
@@ -664,18 +730,37 @@ async function runDaemon(args, config) {
         try {
             let resultSummary = '';
             if (action.type === 'health_check') {
-                log('Health check: verifying daemon + protection surfaces…');
+                // Deep self-test: actively EXERCISE every subsystem (DPAPI roundtrip,
+                // PowerShell mode, API reachability, authenticated fetch, hooks,
+                // updater task) instead of passively reporting. ~30s from the console
+                // to a per-subsystem pass/fail table.
+                log('Health check: running deep self-test across all subsystems…');
                 await uploadLogTail();
-                const integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
-                log(integrity.ok
-                    ? `Health check: all protection points healthy (${integrity.protectedMcpConfigs}/${integrity.discoveredMcpConfigs} MCP configs wrapped).`
-                    : `Health check: issues found — ${integrity.reasons.join(', ')}.`);
-                resultSummary = integrity.ok
-                    ? 'Daemon and required AgentGuard protection points are healthy.'
-                    : `Health check found: ${integrity.reasons.join(', ')}`;
-                if (!integrity.ok)
+                const identity = (0, machineIdentity_1.getMachineIdentity)();
+                const report = await (0, selfTest_1.runDeepSelfTest)({
+                    creds,
+                    developerName: identity.developerName,
+                    machineName: identity.hostname,
+                    machineId: identity.machineId,
+                    isWatchdogTaskInstalled,
+                    log,
+                });
+                await uploadDiagnostics({ selfTest: report });
+                resultSummary = (0, selfTest_1.summarizeSelfTest)(report);
+                log(`Health check: ${resultSummary}`);
+                if (!report.ok)
                     throw new Error(resultSummary);
             }
+            else if (action.type === 'collect_diagnostics') {
+                log('Collect diagnostics: assembling support bundle (logs + distress ledger + environment — metadata only)…');
+                await uploadLogTail();
+                const bundle = buildSupportBundle();
+                const uploaded = await uploadDiagnostics({ bundle });
+                if (!uploaded)
+                    throw new Error('Support bundle could not be uploaded (network or backend rejection).');
+                log(`Collect diagnostics: bundle uploaded (${bundle.daemonLogTail.length} log lines, ${bundle.distress.length} distress entries).`);
+                resultSummary = `Support bundle uploaded: ${bundle.daemonLogTail.length} daemon log lines, ${bundle.updaterLogTail.length} updater log lines, ${bundle.distress.length} distress signal(s), credential trace, environment health.`;
+            }
             else if (action.type === 'policy_refresh') {
                 if (!creds.shieldId)
                     throw new Error('Shield not configured on this machine.');
@@ -777,9 +862,41 @@ async function runDaemon(args, config) {
             await uploadLogTail();
         }
     };
+    // Distress channel: a machine whose credential store is broken cannot fetch
+    // the authenticated bundle — which is how remote actions are delivered — so
+    // the one machine an admin most needs to reach is unreachable. This key-less
+    // poll returns SIGNED actions only; safety comes from the Ed25519 signature
+    // + org/machine binding verified in executeMachineAction (the transport was
+    // never the trust anchor). Rescue path: queue upgrade_cli / collect_diagnostics
+    // from the console and the bricked machine still receives it.
+    const pollDistressActions = async () => {
+        if (!creds.shieldId || creds.shieldKey)
+            return;
+        try {
+            const identity = (0, machineIdentity_1.getMachineIdentity)();
+            const params = new URLSearchParams({ shieldId: creds.shieldId, machineId: identity.machineId });
+            const resp = await fetch(`${creds.apiUrl}/api/cli/machine-actions/pending?${params.toString()}`, {
+                method: 'GET',
+                signal: AbortSignal.timeout(8_000),
+            });
+            if (!resp.ok)
+                return;
+            const body = await resp.json().catch(() => ({}));
+            if (body.data?.machineAction) {
+                log(`Distress channel: received action ${body.data.machineAction.type} key-less — Ed25519 verification gates execution.`);
+                void executeMachineAction(body.data.machineAction);
+            }
+        }
+        catch { /* offline — next poll retries */ }
+    };
     const pollBundle = async () => {
         if (!creds.shieldId)
             return;
+        if (!creds.shieldKey) {
+            // Credential-broken machine: stay reachable via the key-less signed-
+            // action channel while credential recovery keeps retrying.
+            await pollDistressActions();
+        }
         const identity = (0, machineIdentity_1.getMachineIdentity)();
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
@@ -882,6 +999,9 @@ async function runDaemon(args, config) {
                 securityAgents: (0, securityAgents_1.getSecurityAgentsReport)()?.products,
                 powershellSpawnOk: powershell?.spawnOk,
                 powershellDecryptOk: powershell?.decryptOk,
+                powershellLanguageMode: powershell?.languageMode,
+                shieldKeySource: (0, config_1.getCredentialResolutionTrace)()?.shieldKeySource,
+                distress: (0, distress_1.readDistressSnapshot)(),
                 lastCrash: unreportedCrash
                     ? {
                         version: unreportedCrash.version,

package/dist/config.d.ts

@@ -30,8 +30,36 @@ export interface PowershellHealth {
     spawnOk: boolean;
     decryptOk: boolean;
     checkedAt: string;
+    /** FullLanguage / ConstrainedLanguage / RestrictedLanguage — captured only when a decrypt fails (extra spawn is failure-path-only). */
+    languageMode?: string;
 }
 export declare function getPowershellHealth(): PowershellHealth | undefined;
+/**
+ * PowerShell language mode — the "is this a hardened WDAC/AppLocker fleet
+ * machine?" bit that explained the lptx1110 incident. Spawned only on the
+ * DPAPI failure path (and from the deep self-test), never on healthy runs.
+ */
+export declare function capturePowershellLanguageMode(): string | undefined;
+/**
+ * PSCredential.GetNetworkCredential() instead of Marshal::SecureStringToBSTR:
+ * hardened fleets run PowerShell in Constrained Language Mode, where the
+ * [Runtime.InteropServices.Marshal] calls are forbidden (script fails ->
+ * exit 1 -> "Shield key not available" -> every hook 401s fail-closed). The
+ * PSCredential technique is on CLM's approved-type list and decrypts the same
+ * DPAPI-protected SecureString in every language mode. Exported so the CLM
+ * regression test runs this EXACT text inside a ConstrainedLanguage session.
+ */
+export declare const DPAPI_DECRYPT_SNIPPET = "$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE; (New-Object System.Management.Automation.PSCredential('fcd', $secure)).GetNetworkCredential().Password";
+/**
+ * Deep self-test probe: encrypt AND decrypt a throwaway value with the exact
+ * DPAPI snippets used for the shield key. Encryption alone can succeed on a
+ * machine that can never decrypt (the pre-v1.21.32 bricking bug) — only the
+ * full roundtrip proves the credential store works.
+ */
+export declare function dpapiRoundtripProbe(): {
+    ok: boolean;
+    detail: string;
+};
 export declare function getHomeConfigPath(): string;
 export declare function loadConfig(configPath?: string): BotGuardConfig;
 export declare function getDefaultConfigPath(): string;
@@ -66,6 +94,19 @@ export interface ResolvedCliCredentials {
  * Pure — unit-tested.
  */
 export declare function daemonHandoffShieldKey(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Which source supplied the shield key on the most recent resolution — the
+ * codes-only trace shipped in the collect_diagnostics bundle (never the key
+ * itself). `none_dpapi_broken` is the credential-broken state: a DPAPI blob
+ * exists but would not decrypt and no fallback source was available.
+ */
+export type ShieldKeySource = 'override' | 'daemon_handoff' | 'native_store' | 'dpapi' | 'plaintext_config' | 'env' | 'none' | 'none_dpapi_broken';
+export interface CredentialResolutionTrace {
+    shieldKeySource: ShieldKeySource;
+    dpapiAttempted: boolean;
+    at: string;
+}
+export declare function getCredentialResolutionTrace(): CredentialResolutionTrace | undefined;
 /** Merge saved ~/.fullcourtdefense.yml + env + optional CLI flag overrides. */
 export declare function resolveCliCredentials(config: BotGuardConfig, overrides?: Partial<ResolvedCliCredentials>, options?: {
     skipDpapi?: boolean;

package/dist/config.js

@@ -33,12 +33,16 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DPAPI_DECRYPT_SNIPPET = void 0;
 exports.getPowershellHealth = getPowershellHealth;
+exports.capturePowershellLanguageMode = capturePowershellLanguageMode;
+exports.dpapiRoundtripProbe = dpapiRoundtripProbe;
 exports.getHomeConfigPath = getHomeConfigPath;
 exports.loadConfig = loadConfig;
 exports.getDefaultConfigPath = getDefaultConfigPath;
 exports.saveShieldConfig = saveShieldConfig;
 exports.daemonHandoffShieldKey = daemonHandoffShieldKey;
+exports.getCredentialResolutionTrace = getCredentialResolutionTrace;
 exports.resolveCliCredentials = resolveCliCredentials;
 exports.resolveCliCredentialsShellFree = resolveCliCredentialsShellFree;
 exports.isCliSetupComplete = isCliSetupComplete;
@@ -49,6 +53,8 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
+const distress_1 = require("./distress");
+const credentialStore_1 = require("./credentialStore");
 const CONFIG_FILENAMES = [
     '.fullcourtdefense.yml',
     '.fullcourtdefense.yaml',
@@ -161,6 +167,30 @@ let powershellHealth;
 function getPowershellHealth() {
     return powershellHealth;
 }
+/**
+ * PowerShell language mode — the "is this a hardened WDAC/AppLocker fleet
+ * machine?" bit that explained the lptx1110 incident. Spawned only on the
+ * DPAPI failure path (and from the deep self-test), never on healthy runs.
+ */
+function capturePowershellLanguageMode() {
+    if (process.platform !== 'win32')
+        return undefined;
+    for (const shell of ['powershell.exe', 'pwsh.exe']) {
+        try {
+            const raw = (0, child_process_1.execFileSync)(shell, [
+                '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass',
+                '-Command', '$ExecutionContext.SessionState.LanguageMode',
+            ], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 15_000, windowsHide: true }).trim();
+            if (raw) {
+                if (powershellHealth)
+                    powershellHealth.languageMode = raw;
+                return raw;
+            }
+        }
+        catch { /* try the next shell */ }
+    }
+    return undefined;
+}
 function powershellDpapi(script, value) {
     if (process.platform !== 'win32' || !value)
         return undefined;
@@ -204,8 +234,55 @@ function powershellDpapi(script, value) {
 function protectShieldKeyForCurrentWindowsUser(value) {
     return powershellDpapi('$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE -AsPlainText -Force; ConvertFrom-SecureString -SecureString $secure', value);
 }
+/**
+ * PSCredential.GetNetworkCredential() instead of Marshal::SecureStringToBSTR:
+ * hardened fleets run PowerShell in Constrained Language Mode, where the
+ * [Runtime.InteropServices.Marshal] calls are forbidden (script fails ->
+ * exit 1 -> "Shield key not available" -> every hook 401s fail-closed). The
+ * PSCredential technique is on CLM's approved-type list and decrypts the same
+ * DPAPI-protected SecureString in every language mode. Exported so the CLM
+ * regression test runs this EXACT text inside a ConstrainedLanguage session.
+ */
+exports.DPAPI_DECRYPT_SNIPPET = "$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE; (New-Object System.Management.Automation.PSCredential('fcd', $secure)).GetNetworkCredential().Password";
 function unprotectShieldKeyForCurrentWindowsUser(value) {
-    return powershellDpapi('$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE; $ptr=[Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure); try {[Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)} finally {[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr)}', value);
+    const result = powershellDpapi(exports.DPAPI_DECRYPT_SNIPPET, value);
+    if (!result && value) {
+        // The machine HAS a DPAPI-protected key it cannot read — the exact
+        // credential-broken state that 401-bricked lptx1110. Emit a coded
+        // distress signal so the fleet console sees it without asking the user.
+        const health = powershellHealth;
+        if (health && !health.spawnOk) {
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.POWERSHELL_BLOCKED, 'powershell.exe and pwsh.exe both failed to start (EDR/AppLocker?)');
+        }
+        else {
+            const mode = capturePowershellLanguageMode();
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.DPAPI_DECRYPT_FAILED, mode ? `language mode: ${mode}` : 'decrypt returned nothing');
+            if (mode && mode !== 'FullLanguage') {
+                (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.POWERSHELL_CONSTRAINED, `PowerShell language mode is ${mode}`);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Deep self-test probe: encrypt AND decrypt a throwaway value with the exact
+ * DPAPI snippets used for the shield key. Encryption alone can succeed on a
+ * machine that can never decrypt (the pre-v1.21.32 bricking bug) — only the
+ * full roundtrip proves the credential store works.
+ */
+function dpapiRoundtripProbe() {
+    if (process.platform !== 'win32')
+        return { ok: true, detail: 'not applicable (non-Windows)' };
+    const probe = `fcd-selftest-${Date.now()}`;
+    const encrypted = protectShieldKeyForCurrentWindowsUser(probe);
+    if (!encrypted) {
+        const health = powershellHealth;
+        return { ok: false, detail: health && !health.spawnOk ? 'PowerShell would not start (EDR/AppLocker?)' : 'DPAPI encrypt produced nothing' };
+    }
+    const decrypted = powershellDpapi(exports.DPAPI_DECRYPT_SNIPPET, encrypted);
+    if (decrypted === probe)
+        return { ok: true, detail: 'encrypt + decrypt roundtrip OK' };
+    return { ok: false, detail: decrypted ? 'decrypt returned a different value (profile mismatch?)' : 'decrypt returned nothing (CLM/EDR block?)' };
 }
 function mergeConfig(base, override) {
     return {
@@ -263,8 +340,83 @@ const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 function daemonHandoffShieldKey(env = process.env) {
     return env.FCD_SHIELD_ID && env.FCD_SHIELD_KEY ? env.FCD_SHIELD_KEY : undefined;
 }
+let lastCredentialTrace;
+function getCredentialResolutionTrace() {
+    return lastCredentialTrace;
+}
+// Once per process: hooks are short-lived (one attempt each) and the daemon
+// long-lived (must not hammer the Credential Manager every 30s poll).
+let nativeMigrationAttempted = false;
+function maybeMigrateShieldKeyToNativeStore(shieldId, shieldKey) {
+    if (nativeMigrationAttempted || !(0, credentialStore_1.nativeCredentialStoreAvailable)())
+        return;
+    nativeMigrationAttempted = true;
+    try {
+        if ((0, credentialStore_1.readShieldKeyNative)(shieldId))
+            return; // already migrated
+        (0, credentialStore_1.saveShieldKeyNative)(shieldId, shieldKey); // read-back verified inside
+    }
+    catch { /* migration is opportunistic — legacy sources keep working */ }
+}
 /** Merge saved ~/.fullcourtdefense.yml + env + optional CLI flag overrides. */
 function resolveCliCredentials(config, overrides = {}, options = {}) {
+    // Shield key: same precedence as the old || chain, evaluated stepwise so
+    // (a) the DPAPI decrypt stays lazy — no powershell.exe spawn when an
+    // earlier source wins — and (b) the winning source is recorded for the
+    // diagnostics trace.
+    let shieldKey = overrides.shieldKey;
+    let shieldKeySource = shieldKey ? 'override' : 'none';
+    let dpapiAttempted = false;
+    const resolvedShieldId = overrides.shieldId
+        || config.shieldId
+        || process.env.FCD_SHIELD_ID
+        || process.env.FULLCOURTDEFENSE_SHIELD_ID
+        || process.env.AGENTGUARD_SHIELD_ID;
+    if (!shieldKey) {
+        // Daemon handoff BEFORE the DPAPI decrypt: no powershell.exe spawn at
+        // all during daemon-driven sweeps (see daemonHandoffShieldKey docs).
+        shieldKey = daemonHandoffShieldKey();
+        if (shieldKey)
+            shieldKeySource = 'daemon_handoff';
+    }
+    if (!shieldKey && resolvedShieldId) {
+        // Native Credential Manager BEFORE the DPAPI/PowerShell decrypt: an
+        // in-process win32 API read that EDRs don't flag and CLM can't constrain.
+        // Silently absent on machines that never migrated (see the migration
+        // below) — the DPAPI chain still stands behind it.
+        shieldKey = (0, credentialStore_1.readShieldKeyNative)(resolvedShieldId);
+        if (shieldKey)
+            shieldKeySource = 'native_store';
+    }
+    if (!shieldKey && !options.skipDpapi && config.shieldKeyDpapi) {
+        dpapiAttempted = true;
+        shieldKey = unprotectShieldKeyForCurrentWindowsUser(config.shieldKeyDpapi);
+        if (shieldKey)
+            shieldKeySource = 'dpapi';
+    }
+    if (!shieldKey && config.shieldKey) {
+        shieldKey = config.shieldKey;
+        shieldKeySource = 'plaintext_config';
+    }
+    if (!shieldKey) {
+        shieldKey = process.env.FCD_SHIELD_KEY
+            || process.env.FULLCOURTDEFENSE_SHIELD_KEY
+            || process.env.AGENTGUARD_SHIELD_KEY;
+        if (shieldKey)
+            shieldKeySource = 'env';
+    }
+    if (!shieldKey && dpapiAttempted)
+        shieldKeySource = 'none_dpapi_broken';
+    lastCredentialTrace = { shieldKeySource, dpapiAttempted, at: new Date().toISOString() };
+    // Self-healing migration: whenever the key still resolves through a legacy
+    // source (DPAPI blob or plaintext config), copy it into the Credential
+    // Manager once. On fleets like lptx1110 the daemon's context CAN decrypt
+    // while IDE-spawned hooks CANNOT — after the daemon's first resolution the
+    // native entry exists and every process reads it without PowerShell.
+    if (shieldKey && resolvedShieldId
+        && (shieldKeySource === 'dpapi' || shieldKeySource === 'plaintext_config')) {
+        maybeMigrateShieldKeyToNativeStore(resolvedShieldId, shieldKey);
+    }
     return {
         apiKey: overrides.apiKey
             || config.apiKey
@@ -281,15 +433,7 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
             || process.env.FCD_SHIELD_ID
             || process.env.FULLCOURTDEFENSE_SHIELD_ID
             || process.env.AGENTGUARD_SHIELD_ID,
-        shieldKey: overrides.shieldKey
-            // Daemon handoff BEFORE the DPAPI decrypt: no powershell.exe spawn at
-            // all during daemon-driven sweeps (see daemonHandoffShieldKey docs).
-            || daemonHandoffShieldKey()
-            || (options.skipDpapi ? undefined : unprotectShieldKeyForCurrentWindowsUser(config.shieldKeyDpapi || ''))
-            || config.shieldKey
-            || process.env.FCD_SHIELD_KEY
-            || process.env.FULLCOURTDEFENSE_SHIELD_KEY
-            || process.env.AGENTGUARD_SHIELD_KEY,
+        shieldKey,
     };
 }
 /**
@@ -349,12 +493,25 @@ function writeSetupConfig(target, input) {
     setTopLevel('apiKey', input.apiKey);
     setTopLevel('organizationId', input.organizationId);
     setTopLevel('shieldId', input.shieldId);
+    // Native Credential Manager write (read-back verified) — the store hooks
+    // read WITHOUT PowerShell. The DPAPI blob below is still written when it
+    // verifies: rolling back to a ≤1.21.33 CLI keeps working, and machines
+    // where the native binding is blocked keep their PowerShell path.
+    if (input.shieldKey && input.shieldId) {
+        (0, credentialStore_1.saveShieldKeyNative)(input.shieldId, input.shieldKey);
+    }
     const protectedShieldKey = input.shieldKey && process.platform === 'win32'
         ? protectShieldKeyForCurrentWindowsUser(input.shieldKey)
         : undefined;
-    if (protectedShieldKey) {
+    // Roundtrip-verify before trusting DPAPI: encryption is cmdlet-only and
+    // succeeds even where decryption is blocked (Constrained Language Mode /
+    // EDR), which used to delete the plaintext key on a machine that could
+    // never read the encrypted one back — every hook then 401'd fail-closed.
+    const dpapiVerified = !!protectedShieldKey
+        && unprotectShieldKeyForCurrentWindowsUser(protectedShieldKey) === input.shieldKey;
+    if (protectedShieldKey && dpapiVerified) {
         setTopLevel('shieldKeyDpapi', protectedShieldKey);
-        // Remove legacy plaintext key on a successful Windows DPAPI migration.
+        // Remove legacy plaintext key on a VERIFIED Windows DPAPI migration.
         const plaintextIndex = lines.findIndex(line => /^shieldKey:/.test(line.trim()));
         if (plaintextIndex >= 0)
             lines.splice(plaintextIndex, 1);

package/dist/credentialStore.d.ts

@@ -0,0 +1,19 @@
+export declare function nativeCredentialStoreAvailable(): boolean;
+/** Read the shield key from the Credential Manager. Undefined when absent/unavailable. */
+export declare function readShieldKeyNative(shieldId: string): string | undefined;
+/**
+ * Store the shield key, read-back verified. Returns false when the native
+ * store is unavailable or the verify failed — callers keep their fallback.
+ */
+export declare function saveShieldKeyNative(shieldId: string, shieldKey: string): boolean;
+/** Remove the entry (unenroll / re-enroll cleanup). Best-effort. */
+export declare function deleteShieldKeyNative(shieldId: string): void;
+/**
+ * Deep self-test probe: write + read + delete a throwaway entry with the exact
+ * code paths used for the shield key. Proves the native store works end-to-end
+ * on THIS machine under the current EDR/policy regime.
+ */
+export declare function nativeStoreRoundtripProbe(): {
+    ok: boolean;
+    detail: string;
+};

package/dist/credentialStore.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeCredentialStoreAvailable = nativeCredentialStoreAvailable;
+exports.readShieldKeyNative = readShieldKeyNative;
+exports.saveShieldKeyNative = saveShieldKeyNative;
+exports.deleteShieldKeyNative = deleteShieldKeyNative;
+exports.nativeStoreRoundtripProbe = nativeStoreRoundtripProbe;
+const distress_1 = require("./distress");
+/**
+ * Native credential store — Windows Credential Manager via `@napi-rs/keyring`
+ * (a prebuilt N-API binding; in-process win32 API calls, no PowerShell).
+ *
+ * WHY: the lptx1110 incident class. The shield key at rest was DPAPI-protected
+ * and decrypted by spawning powershell.exe — exactly the pattern EDRs flag
+ * ("IDE process spawns PowerShell that touches credentials"). On hardened
+ * fleets PowerShell is additionally locked to Constrained Language Mode or
+ * blocked outright, so hooks resolve no key and 401 fail-closed. Credential
+ * Manager reads are ordinary in-process Windows API calls used by mainstream
+ * software — nothing to flag, nothing for CLM to constrain.
+ *
+ * SAFETY MODEL (this must never brick a machine):
+ *   - the module is REQUIRED LAZILY inside try/catch — if the .node binary is
+ *     missing, blocked, or ABI-incompatible, every call reports "unavailable"
+ *     and the caller falls through to the existing DPAPI/PowerShell chain;
+ *   - writes are read-back VERIFIED before the store is trusted;
+ *   - enrollment keeps writing the DPAPI blob alongside — rolling back to an
+ *     older CLI keeps working;
+ *   - all failures land in the distress ledger, never as thrown errors.
+ *
+ * Windows-only for now: the EDR problem this solves is Windows-specific, and
+ * keeping other platforms untouched keeps the change surgical. (`keyring`
+ * itself supports macOS Keychain / libsecret when we choose to expand.)
+ */
+const SERVICE_NAME = 'FullCourtDefense';
+/** One entry per shield: multiple enrollments on one machine never collide. */
+function accountName(shieldId) {
+    return `shield-key:${shieldId}`;
+}
+let cachedEntryCtor;
+/** Lazy, cached, never-throwing loader for the native binding. */
+function loadEntryCtor() {
+    if (cachedEntryCtor !== undefined)
+        return cachedEntryCtor;
+    if (process.platform !== 'win32') {
+        cachedEntryCtor = null;
+        return null;
+    }
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const mod = require('@napi-rs/keyring');
+        cachedEntryCtor = typeof mod.Entry === 'function' ? mod.Entry : null;
+    }
+    catch (error) {
+        // Missing/blocked native binary is an EXPECTED state (npm install layouts
+        // without optional deps, exotic ABIs) — log it once as distress detail so
+        // the fleet can see which machines lack the native store, then fall back.
+        (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.NATIVE_STORE_UNAVAILABLE, `keyring module did not load: ${error instanceof Error ? error.message.slice(0, 120) : String(error)}`);
+        cachedEntryCtor = null;
+    }
+    return cachedEntryCtor;
+}
+function nativeCredentialStoreAvailable() {
+    return loadEntryCtor() !== null;
+}
+/** Read the shield key from the Credential Manager. Undefined when absent/unavailable. */
+function readShieldKeyNative(shieldId) {
+    const Entry = loadEntryCtor();
+    if (!Entry || !shieldId)
+        return undefined;
+    try {
+        const value = new Entry(SERVICE_NAME, accountName(shieldId)).getPassword();
+        return value || undefined;
+    }
+    catch {
+        // "No entry" throws in keyring — that is the normal not-enrolled case.
+        return undefined;
+    }
+}
+/**
+ * Store the shield key, read-back verified. Returns false when the native
+ * store is unavailable or the verify failed — callers keep their fallback.
+ */
+function saveShieldKeyNative(shieldId, shieldKey) {
+    const Entry = loadEntryCtor();
+    if (!Entry || !shieldId || !shieldKey)
+        return false;
+    try {
+        const entry = new Entry(SERVICE_NAME, accountName(shieldId));
+        entry.setPassword(shieldKey);
+        const verified = new Entry(SERVICE_NAME, accountName(shieldId)).getPassword() === shieldKey;
+        if (!verified) {
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.NATIVE_STORE_FAILED, 'write succeeded but read-back returned a different value');
+        }
+        return verified;
+    }
+    catch (error) {
+        (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.NATIVE_STORE_FAILED, `write failed: ${error instanceof Error ? error.message.slice(0, 120) : String(error)}`);
+        return false;
+    }
+}
+/** Remove the entry (unenroll / re-enroll cleanup). Best-effort. */
+function deleteShieldKeyNative(shieldId) {
+    const Entry = loadEntryCtor();
+    if (!Entry || !shieldId)
+        return;
+    try {
+        new Entry(SERVICE_NAME, accountName(shieldId)).deletePassword();
+    }
+    catch { /* absent — fine */ }
+}
+/**
+ * Deep self-test probe: write + read + delete a throwaway entry with the exact
+ * code paths used for the shield key. Proves the native store works end-to-end
+ * on THIS machine under the current EDR/policy regime.
+ */
+function nativeStoreRoundtripProbe() {
+    if (process.platform !== 'win32')
+        return { ok: true, detail: 'not applicable (non-Windows)' };
+    const Entry = loadEntryCtor();
+    if (!Entry)
+        return { ok: false, detail: 'native keyring module not loaded (missing binary or blocked) — DPAPI/PowerShell fallback in use' };
+    const probeAccount = `selftest:${Date.now()}`;
+    const probeValue = `fcd-native-probe-${Date.now()}`;
+    try {
+        const entry = new Entry(SERVICE_NAME, probeAccount);
+        entry.setPassword(probeValue);
+        const read = new Entry(SERVICE_NAME, probeAccount).getPassword();
+        entry.deletePassword();
+        return read === probeValue
+            ? { ok: true, detail: 'Credential Manager write + read + delete roundtrip OK (no PowerShell involved)' }
+            : { ok: false, detail: 'roundtrip read returned a different value' };
+    }
+    catch (error) {
+        return { ok: false, detail: `roundtrip failed: ${error instanceof Error ? error.message.slice(0, 160) : String(error)}` };
+    }
+}