fullcourtdefense-cli 1.21.32 → 1.21.34

package/dist/commands/daemon.js

@@ -48,6 +48,8 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const config_1 = require("../config");
+const distress_1 = require("../distress");
+const selfTest_1 = require("../selfTest");
 const daemonForensics_1 = require("../daemonForensics");
 const securityAgents_1 = require("../securityAgents");
 const mcpGateway_1 = require("./mcpGateway");
@@ -345,9 +347,13 @@ async function runDaemon(args, config) {
     // that would restart a crashed process instantly.
     process.on('uncaughtException', error => {
         log(`Uncaught exception (daemon continues): ${error?.stack || String(error)}`);
+        // Ledger the unknown: failures nobody predicted still become structured,
+        // fleet-visible telemetry (code unexpected_error) on the next heartbeat.
+        (0, distress_1.reportUnexpected)('daemon', error);
     });
     process.on('unhandledRejection', reason => {
         log(`Unhandled rejection (daemon continues): ${reason?.stack || String(reason)}`);
+        (0, distress_1.reportUnexpected)('daemon', reason);
     });
     const creds = (0, config_1.resolveCliCredentials)(config, {
         shieldId: args.shieldId,
@@ -536,7 +542,9 @@ async function runDaemon(args, config) {
             return;
         try {
             const raw = fs.readFileSync(logFile(), 'utf8');
-            const lines = raw.split(/\r?\n/).filter(line => line.trim()).slice(-80);
+            // 200 lines (~half a day of routine ticks): enough context to diagnose a
+            // failure loop remotely without asking the customer to paste anything.
+            const lines = raw.split(/\r?\n/).filter(line => line.trim()).slice(-200);
             const identity = (0, machineIdentity_1.getMachineIdentity)();
             await fetch(`${creds.apiUrl}/api/cli/machines/log`, {
                 method: 'POST',
@@ -550,6 +558,64 @@ async function runDaemon(args, config) {
         }
         catch { /* log shipping is best-effort */ }
     };
+    // Ship a structured diagnostics payload (support bundle / self-test report)
+    // to the machine record. Works key-less too — a machine whose credential
+    // store is broken is EXACTLY the one whose diagnostics we need (the backend
+    // verifies the machine binding and flags the reduced trust level).
+    const uploadDiagnostics = async (payload) => {
+        if (!creds.shieldId)
+            return false;
+        try {
+            const identity = (0, machineIdentity_1.getMachineIdentity)();
+            const resp = await fetch(`${creds.apiUrl}/api/cli/machines/diagnostics`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(creds.shieldKey ? { 'x-shield-key': creds.shieldKey } : {}),
+                },
+                body: JSON.stringify({ shieldId: creds.shieldId, machineId: identity.machineId, ...payload }),
+                signal: AbortSignal.timeout(15_000),
+            });
+            return resp.ok;
+        }
+        catch {
+            log('Diagnostics upload failed (network) — the bundle stays available locally.');
+            return false;
+        }
+    };
+    // The complete remote support bundle: everything we asked Alex and Alin to
+    // paste by hand during the lptx1110 incident, collected in one action.
+    // Metadata + our own logs only — never customer files, prompts, or secrets.
+    const buildSupportBundle = () => {
+        const powershell = (0, config_1.getPowershellHealth)();
+        let integrity;
+        try {
+            integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
+        }
+        catch (error) {
+            integrity = { error: error.message };
+        }
+        let daemonLogTail = [];
+        try {
+            daemonLogTail = fs.readFileSync(logFile(), 'utf8')
+                .split(/\r?\n/).map(line => line.trim()).filter(Boolean).slice(-200).map(line => line.slice(0, 400));
+        }
+        catch { /* log unreadable — the bundle reports everything else */ }
+        return {
+            cliVersion: cliVersion(),
+            platform: process.platform,
+            collectedAt: new Date().toISOString(),
+            daemonLogTail,
+            updaterLogTail: (0, selfUpdate_1.readUpdaterLogTail)(60),
+            distress: (0, distress_1.readDistressLedger)(),
+            credentialTrace: (0, config_1.getCredentialResolutionTrace)(),
+            powershell,
+            securityAgents: (0, securityAgents_1.getSecurityAgentsReport)()?.products,
+            integrity,
+            lastCrash: (0, daemonForensics_1.readPostmortem)(),
+            watchdogTaskInstalled: isWatchdogTaskInstalled(),
+        };
+    };
     const reportMachineAction = async (actionId, status, detail) => {
         if (!creds.shieldId)
             return;
@@ -664,18 +730,37 @@ async function runDaemon(args, config) {
         try {
             let resultSummary = '';
             if (action.type === 'health_check') {
-                log('Health check: verifying daemon + protection surfaces…');
+                // Deep self-test: actively EXERCISE every subsystem (DPAPI roundtrip,
+                // PowerShell mode, API reachability, authenticated fetch, hooks,
+                // updater task) instead of passively reporting. ~30s from the console
+                // to a per-subsystem pass/fail table.
+                log('Health check: running deep self-test across all subsystems…');
                 await uploadLogTail();
-                const integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
-                log(integrity.ok
-                    ? `Health check: all protection points healthy (${integrity.protectedMcpConfigs}/${integrity.discoveredMcpConfigs} MCP configs wrapped).`
-                    : `Health check: issues found — ${integrity.reasons.join(', ')}.`);
-                resultSummary = integrity.ok
-                    ? 'Daemon and required AgentGuard protection points are healthy.'
-                    : `Health check found: ${integrity.reasons.join(', ')}`;
-                if (!integrity.ok)
+                const identity = (0, machineIdentity_1.getMachineIdentity)();
+                const report = await (0, selfTest_1.runDeepSelfTest)({
+                    creds,
+                    developerName: identity.developerName,
+                    machineName: identity.hostname,
+                    machineId: identity.machineId,
+                    isWatchdogTaskInstalled,
+                    log,
+                });
+                await uploadDiagnostics({ selfTest: report });
+                resultSummary = (0, selfTest_1.summarizeSelfTest)(report);
+                log(`Health check: ${resultSummary}`);
+                if (!report.ok)
                     throw new Error(resultSummary);
             }
+            else if (action.type === 'collect_diagnostics') {
+                log('Collect diagnostics: assembling support bundle (logs + distress ledger + environment — metadata only)…');
+                await uploadLogTail();
+                const bundle = buildSupportBundle();
+                const uploaded = await uploadDiagnostics({ bundle });
+                if (!uploaded)
+                    throw new Error('Support bundle could not be uploaded (network or backend rejection).');
+                log(`Collect diagnostics: bundle uploaded (${bundle.daemonLogTail.length} log lines, ${bundle.distress.length} distress entries).`);
+                resultSummary = `Support bundle uploaded: ${bundle.daemonLogTail.length} daemon log lines, ${bundle.updaterLogTail.length} updater log lines, ${bundle.distress.length} distress signal(s), credential trace, environment health.`;
+            }
             else if (action.type === 'policy_refresh') {
                 if (!creds.shieldId)
                     throw new Error('Shield not configured on this machine.');
@@ -777,9 +862,41 @@ async function runDaemon(args, config) {
             await uploadLogTail();
         }
     };
+    // Distress channel: a machine whose credential store is broken cannot fetch
+    // the authenticated bundle — which is how remote actions are delivered — so
+    // the one machine an admin most needs to reach is unreachable. This key-less
+    // poll returns SIGNED actions only; safety comes from the Ed25519 signature
+    // + org/machine binding verified in executeMachineAction (the transport was
+    // never the trust anchor). Rescue path: queue upgrade_cli / collect_diagnostics
+    // from the console and the bricked machine still receives it.
+    const pollDistressActions = async () => {
+        if (!creds.shieldId || creds.shieldKey)
+            return;
+        try {
+            const identity = (0, machineIdentity_1.getMachineIdentity)();
+            const params = new URLSearchParams({ shieldId: creds.shieldId, machineId: identity.machineId });
+            const resp = await fetch(`${creds.apiUrl}/api/cli/machine-actions/pending?${params.toString()}`, {
+                method: 'GET',
+                signal: AbortSignal.timeout(8_000),
+            });
+            if (!resp.ok)
+                return;
+            const body = await resp.json().catch(() => ({}));
+            if (body.data?.machineAction) {
+                log(`Distress channel: received action ${body.data.machineAction.type} key-less — Ed25519 verification gates execution.`);
+                void executeMachineAction(body.data.machineAction);
+            }
+        }
+        catch { /* offline — next poll retries */ }
+    };
     const pollBundle = async () => {
         if (!creds.shieldId)
             return;
+        if (!creds.shieldKey) {
+            // Credential-broken machine: stay reachable via the key-less signed-
+            // action channel while credential recovery keeps retrying.
+            await pollDistressActions();
+        }
         const identity = (0, machineIdentity_1.getMachineIdentity)();
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
@@ -882,6 +999,9 @@ async function runDaemon(args, config) {
                 securityAgents: (0, securityAgents_1.getSecurityAgentsReport)()?.products,
                 powershellSpawnOk: powershell?.spawnOk,
                 powershellDecryptOk: powershell?.decryptOk,
+                powershellLanguageMode: powershell?.languageMode,
+                shieldKeySource: (0, config_1.getCredentialResolutionTrace)()?.shieldKeySource,
+                distress: (0, distress_1.readDistressSnapshot)(),
                 lastCrash: unreportedCrash
                     ? {
                         version: unreportedCrash.version,

package/dist/config.d.ts

@@ -30,8 +30,16 @@ export interface PowershellHealth {
     spawnOk: boolean;
     decryptOk: boolean;
     checkedAt: string;
+    /** FullLanguage / ConstrainedLanguage / RestrictedLanguage — captured only when a decrypt fails (extra spawn is failure-path-only). */
+    languageMode?: string;
 }
 export declare function getPowershellHealth(): PowershellHealth | undefined;
+/**
+ * PowerShell language mode — the "is this a hardened WDAC/AppLocker fleet
+ * machine?" bit that explained the lptx1110 incident. Spawned only on the
+ * DPAPI failure path (and from the deep self-test), never on healthy runs.
+ */
+export declare function capturePowershellLanguageMode(): string | undefined;
 /**
  * PSCredential.GetNetworkCredential() instead of Marshal::SecureStringToBSTR:
  * hardened fleets run PowerShell in Constrained Language Mode, where the
@@ -42,6 +50,16 @@ export declare function getPowershellHealth(): PowershellHealth | undefined;
  * regression test runs this EXACT text inside a ConstrainedLanguage session.
  */
 export declare const DPAPI_DECRYPT_SNIPPET = "$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE; (New-Object System.Management.Automation.PSCredential('fcd', $secure)).GetNetworkCredential().Password";
+/**
+ * Deep self-test probe: encrypt AND decrypt a throwaway value with the exact
+ * DPAPI snippets used for the shield key. Encryption alone can succeed on a
+ * machine that can never decrypt (the pre-v1.21.32 bricking bug) — only the
+ * full roundtrip proves the credential store works.
+ */
+export declare function dpapiRoundtripProbe(): {
+    ok: boolean;
+    detail: string;
+};
 export declare function getHomeConfigPath(): string;
 export declare function loadConfig(configPath?: string): BotGuardConfig;
 export declare function getDefaultConfigPath(): string;
@@ -76,6 +94,19 @@ export interface ResolvedCliCredentials {
  * Pure — unit-tested.
  */
 export declare function daemonHandoffShieldKey(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Which source supplied the shield key on the most recent resolution — the
+ * codes-only trace shipped in the collect_diagnostics bundle (never the key
+ * itself). `none_dpapi_broken` is the credential-broken state: a DPAPI blob
+ * exists but would not decrypt and no fallback source was available.
+ */
+export type ShieldKeySource = 'override' | 'daemon_handoff' | 'native_store' | 'dpapi' | 'plaintext_config' | 'env' | 'none' | 'none_dpapi_broken';
+export interface CredentialResolutionTrace {
+    shieldKeySource: ShieldKeySource;
+    dpapiAttempted: boolean;
+    at: string;
+}
+export declare function getCredentialResolutionTrace(): CredentialResolutionTrace | undefined;
 /** Merge saved ~/.fullcourtdefense.yml + env + optional CLI flag overrides. */
 export declare function resolveCliCredentials(config: BotGuardConfig, overrides?: Partial<ResolvedCliCredentials>, options?: {
     skipDpapi?: boolean;

package/dist/config.js

@@ -35,11 +35,14 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DPAPI_DECRYPT_SNIPPET = void 0;
 exports.getPowershellHealth = getPowershellHealth;
+exports.capturePowershellLanguageMode = capturePowershellLanguageMode;
+exports.dpapiRoundtripProbe = dpapiRoundtripProbe;
 exports.getHomeConfigPath = getHomeConfigPath;
 exports.loadConfig = loadConfig;
 exports.getDefaultConfigPath = getDefaultConfigPath;
 exports.saveShieldConfig = saveShieldConfig;
 exports.daemonHandoffShieldKey = daemonHandoffShieldKey;
+exports.getCredentialResolutionTrace = getCredentialResolutionTrace;
 exports.resolveCliCredentials = resolveCliCredentials;
 exports.resolveCliCredentialsShellFree = resolveCliCredentialsShellFree;
 exports.isCliSetupComplete = isCliSetupComplete;
@@ -50,6 +53,8 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
+const distress_1 = require("./distress");
+const credentialStore_1 = require("./credentialStore");
 const CONFIG_FILENAMES = [
     '.fullcourtdefense.yml',
     '.fullcourtdefense.yaml',
@@ -162,6 +167,30 @@ let powershellHealth;
 function getPowershellHealth() {
     return powershellHealth;
 }
+/**
+ * PowerShell language mode — the "is this a hardened WDAC/AppLocker fleet
+ * machine?" bit that explained the lptx1110 incident. Spawned only on the
+ * DPAPI failure path (and from the deep self-test), never on healthy runs.
+ */
+function capturePowershellLanguageMode() {
+    if (process.platform !== 'win32')
+        return undefined;
+    for (const shell of ['powershell.exe', 'pwsh.exe']) {
+        try {
+            const raw = (0, child_process_1.execFileSync)(shell, [
+                '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass',
+                '-Command', '$ExecutionContext.SessionState.LanguageMode',
+            ], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 15_000, windowsHide: true }).trim();
+            if (raw) {
+                if (powershellHealth)
+                    powershellHealth.languageMode = raw;
+                return raw;
+            }
+        }
+        catch { /* try the next shell */ }
+    }
+    return undefined;
+}
 function powershellDpapi(script, value) {
     if (process.platform !== 'win32' || !value)
         return undefined;
@@ -216,7 +245,44 @@ function protectShieldKeyForCurrentWindowsUser(value) {
  */
 exports.DPAPI_DECRYPT_SNIPPET = "$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE; (New-Object System.Management.Automation.PSCredential('fcd', $secure)).GetNetworkCredential().Password";
 function unprotectShieldKeyForCurrentWindowsUser(value) {
-    return powershellDpapi(exports.DPAPI_DECRYPT_SNIPPET, value);
+    const result = powershellDpapi(exports.DPAPI_DECRYPT_SNIPPET, value);
+    if (!result && value) {
+        // The machine HAS a DPAPI-protected key it cannot read — the exact
+        // credential-broken state that 401-bricked lptx1110. Emit a coded
+        // distress signal so the fleet console sees it without asking the user.
+        const health = powershellHealth;
+        if (health && !health.spawnOk) {
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.POWERSHELL_BLOCKED, 'powershell.exe and pwsh.exe both failed to start (EDR/AppLocker?)');
+        }
+        else {
+            const mode = capturePowershellLanguageMode();
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.DPAPI_DECRYPT_FAILED, mode ? `language mode: ${mode}` : 'decrypt returned nothing');
+            if (mode && mode !== 'FullLanguage') {
+                (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.POWERSHELL_CONSTRAINED, `PowerShell language mode is ${mode}`);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Deep self-test probe: encrypt AND decrypt a throwaway value with the exact
+ * DPAPI snippets used for the shield key. Encryption alone can succeed on a
+ * machine that can never decrypt (the pre-v1.21.32 bricking bug) — only the
+ * full roundtrip proves the credential store works.
+ */
+function dpapiRoundtripProbe() {
+    if (process.platform !== 'win32')
+        return { ok: true, detail: 'not applicable (non-Windows)' };
+    const probe = `fcd-selftest-${Date.now()}`;
+    const encrypted = protectShieldKeyForCurrentWindowsUser(probe);
+    if (!encrypted) {
+        const health = powershellHealth;
+        return { ok: false, detail: health && !health.spawnOk ? 'PowerShell would not start (EDR/AppLocker?)' : 'DPAPI encrypt produced nothing' };
+    }
+    const decrypted = powershellDpapi(exports.DPAPI_DECRYPT_SNIPPET, encrypted);
+    if (decrypted === probe)
+        return { ok: true, detail: 'encrypt + decrypt roundtrip OK' };
+    return { ok: false, detail: decrypted ? 'decrypt returned a different value (profile mismatch?)' : 'decrypt returned nothing (CLM/EDR block?)' };
 }
 function mergeConfig(base, override) {
     return {
@@ -274,8 +340,83 @@ const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 function daemonHandoffShieldKey(env = process.env) {
     return env.FCD_SHIELD_ID && env.FCD_SHIELD_KEY ? env.FCD_SHIELD_KEY : undefined;
 }
+let lastCredentialTrace;
+function getCredentialResolutionTrace() {
+    return lastCredentialTrace;
+}
+// Once per process: hooks are short-lived (one attempt each) and the daemon
+// long-lived (must not hammer the Credential Manager every 30s poll).
+let nativeMigrationAttempted = false;
+function maybeMigrateShieldKeyToNativeStore(shieldId, shieldKey) {
+    if (nativeMigrationAttempted || !(0, credentialStore_1.nativeCredentialStoreAvailable)())
+        return;
+    nativeMigrationAttempted = true;
+    try {
+        if ((0, credentialStore_1.readShieldKeyNative)(shieldId))
+            return; // already migrated
+        (0, credentialStore_1.saveShieldKeyNative)(shieldId, shieldKey); // read-back verified inside
+    }
+    catch { /* migration is opportunistic — legacy sources keep working */ }
+}
 /** Merge saved ~/.fullcourtdefense.yml + env + optional CLI flag overrides. */
 function resolveCliCredentials(config, overrides = {}, options = {}) {
+    // Shield key: same precedence as the old || chain, evaluated stepwise so
+    // (a) the DPAPI decrypt stays lazy — no powershell.exe spawn when an
+    // earlier source wins — and (b) the winning source is recorded for the
+    // diagnostics trace.
+    let shieldKey = overrides.shieldKey;
+    let shieldKeySource = shieldKey ? 'override' : 'none';
+    let dpapiAttempted = false;
+    const resolvedShieldId = overrides.shieldId
+        || config.shieldId
+        || process.env.FCD_SHIELD_ID
+        || process.env.FULLCOURTDEFENSE_SHIELD_ID
+        || process.env.AGENTGUARD_SHIELD_ID;
+    if (!shieldKey) {
+        // Daemon handoff BEFORE the DPAPI decrypt: no powershell.exe spawn at
+        // all during daemon-driven sweeps (see daemonHandoffShieldKey docs).
+        shieldKey = daemonHandoffShieldKey();
+        if (shieldKey)
+            shieldKeySource = 'daemon_handoff';
+    }
+    if (!shieldKey && resolvedShieldId) {
+        // Native Credential Manager BEFORE the DPAPI/PowerShell decrypt: an
+        // in-process win32 API read that EDRs don't flag and CLM can't constrain.
+        // Silently absent on machines that never migrated (see the migration
+        // below) — the DPAPI chain still stands behind it.
+        shieldKey = (0, credentialStore_1.readShieldKeyNative)(resolvedShieldId);
+        if (shieldKey)
+            shieldKeySource = 'native_store';
+    }
+    if (!shieldKey && !options.skipDpapi && config.shieldKeyDpapi) {
+        dpapiAttempted = true;
+        shieldKey = unprotectShieldKeyForCurrentWindowsUser(config.shieldKeyDpapi);
+        if (shieldKey)
+            shieldKeySource = 'dpapi';
+    }
+    if (!shieldKey && config.shieldKey) {
+        shieldKey = config.shieldKey;
+        shieldKeySource = 'plaintext_config';
+    }
+    if (!shieldKey) {
+        shieldKey = process.env.FCD_SHIELD_KEY
+            || process.env.FULLCOURTDEFENSE_SHIELD_KEY
+            || process.env.AGENTGUARD_SHIELD_KEY;
+        if (shieldKey)
+            shieldKeySource = 'env';
+    }
+    if (!shieldKey && dpapiAttempted)
+        shieldKeySource = 'none_dpapi_broken';
+    lastCredentialTrace = { shieldKeySource, dpapiAttempted, at: new Date().toISOString() };
+    // Self-healing migration: whenever the key still resolves through a legacy
+    // source (DPAPI blob or plaintext config), copy it into the Credential
+    // Manager once. On fleets like lptx1110 the daemon's context CAN decrypt
+    // while IDE-spawned hooks CANNOT — after the daemon's first resolution the
+    // native entry exists and every process reads it without PowerShell.
+    if (shieldKey && resolvedShieldId
+        && (shieldKeySource === 'dpapi' || shieldKeySource === 'plaintext_config')) {
+        maybeMigrateShieldKeyToNativeStore(resolvedShieldId, shieldKey);
+    }
     return {
         apiKey: overrides.apiKey
             || config.apiKey
@@ -292,15 +433,7 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
             || process.env.FCD_SHIELD_ID
             || process.env.FULLCOURTDEFENSE_SHIELD_ID
             || process.env.AGENTGUARD_SHIELD_ID,
-        shieldKey: overrides.shieldKey
-            // Daemon handoff BEFORE the DPAPI decrypt: no powershell.exe spawn at
-            // all during daemon-driven sweeps (see daemonHandoffShieldKey docs).
-            || daemonHandoffShieldKey()
-            || (options.skipDpapi ? undefined : unprotectShieldKeyForCurrentWindowsUser(config.shieldKeyDpapi || ''))
-            || config.shieldKey
-            || process.env.FCD_SHIELD_KEY
-            || process.env.FULLCOURTDEFENSE_SHIELD_KEY
-            || process.env.AGENTGUARD_SHIELD_KEY,
+        shieldKey,
     };
 }
 /**
@@ -360,6 +493,13 @@ function writeSetupConfig(target, input) {
     setTopLevel('apiKey', input.apiKey);
     setTopLevel('organizationId', input.organizationId);
     setTopLevel('shieldId', input.shieldId);
+    // Native Credential Manager write (read-back verified) — the store hooks
+    // read WITHOUT PowerShell. The DPAPI blob below is still written when it
+    // verifies: rolling back to a ≤1.21.33 CLI keeps working, and machines
+    // where the native binding is blocked keep their PowerShell path.
+    if (input.shieldKey && input.shieldId) {
+        (0, credentialStore_1.saveShieldKeyNative)(input.shieldId, input.shieldKey);
+    }
     const protectedShieldKey = input.shieldKey && process.platform === 'win32'
         ? protectShieldKeyForCurrentWindowsUser(input.shieldKey)
         : undefined;

package/dist/credentialStore.d.ts

@@ -0,0 +1,19 @@
+export declare function nativeCredentialStoreAvailable(): boolean;
+/** Read the shield key from the Credential Manager. Undefined when absent/unavailable. */
+export declare function readShieldKeyNative(shieldId: string): string | undefined;
+/**
+ * Store the shield key, read-back verified. Returns false when the native
+ * store is unavailable or the verify failed — callers keep their fallback.
+ */
+export declare function saveShieldKeyNative(shieldId: string, shieldKey: string): boolean;
+/** Remove the entry (unenroll / re-enroll cleanup). Best-effort. */
+export declare function deleteShieldKeyNative(shieldId: string): void;
+/**
+ * Deep self-test probe: write + read + delete a throwaway entry with the exact
+ * code paths used for the shield key. Proves the native store works end-to-end
+ * on THIS machine under the current EDR/policy regime.
+ */
+export declare function nativeStoreRoundtripProbe(): {
+    ok: boolean;
+    detail: string;
+};

package/dist/credentialStore.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeCredentialStoreAvailable = nativeCredentialStoreAvailable;
+exports.readShieldKeyNative = readShieldKeyNative;
+exports.saveShieldKeyNative = saveShieldKeyNative;
+exports.deleteShieldKeyNative = deleteShieldKeyNative;
+exports.nativeStoreRoundtripProbe = nativeStoreRoundtripProbe;
+const distress_1 = require("./distress");
+/**
+ * Native credential store — Windows Credential Manager via `@napi-rs/keyring`
+ * (a prebuilt N-API binding; in-process win32 API calls, no PowerShell).
+ *
+ * WHY: the lptx1110 incident class. The shield key at rest was DPAPI-protected
+ * and decrypted by spawning powershell.exe — exactly the pattern EDRs flag
+ * ("IDE process spawns PowerShell that touches credentials"). On hardened
+ * fleets PowerShell is additionally locked to Constrained Language Mode or
+ * blocked outright, so hooks resolve no key and 401 fail-closed. Credential
+ * Manager reads are ordinary in-process Windows API calls used by mainstream
+ * software — nothing to flag, nothing for CLM to constrain.
+ *
+ * SAFETY MODEL (this must never brick a machine):
+ *   - the module is REQUIRED LAZILY inside try/catch — if the .node binary is
+ *     missing, blocked, or ABI-incompatible, every call reports "unavailable"
+ *     and the caller falls through to the existing DPAPI/PowerShell chain;
+ *   - writes are read-back VERIFIED before the store is trusted;
+ *   - enrollment keeps writing the DPAPI blob alongside — rolling back to an
+ *     older CLI keeps working;
+ *   - all failures land in the distress ledger, never as thrown errors.
+ *
+ * Windows-only for now: the EDR problem this solves is Windows-specific, and
+ * keeping other platforms untouched keeps the change surgical. (`keyring`
+ * itself supports macOS Keychain / libsecret when we choose to expand.)
+ */
+const SERVICE_NAME = 'FullCourtDefense';
+/** One entry per shield: multiple enrollments on one machine never collide. */
+function accountName(shieldId) {
+    return `shield-key:${shieldId}`;
+}
+let cachedEntryCtor;
+/** Lazy, cached, never-throwing loader for the native binding. */
+function loadEntryCtor() {
+    if (cachedEntryCtor !== undefined)
+        return cachedEntryCtor;
+    if (process.platform !== 'win32') {
+        cachedEntryCtor = null;
+        return null;
+    }
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const mod = require('@napi-rs/keyring');
+        cachedEntryCtor = typeof mod.Entry === 'function' ? mod.Entry : null;
+    }
+    catch (error) {
+        // Missing/blocked native binary is an EXPECTED state (npm install layouts
+        // without optional deps, exotic ABIs) — log it once as distress detail so
+        // the fleet can see which machines lack the native store, then fall back.
+        (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.NATIVE_STORE_UNAVAILABLE, `keyring module did not load: ${error instanceof Error ? error.message.slice(0, 120) : String(error)}`);
+        cachedEntryCtor = null;
+    }
+    return cachedEntryCtor;
+}
+function nativeCredentialStoreAvailable() {
+    return loadEntryCtor() !== null;
+}
+/** Read the shield key from the Credential Manager. Undefined when absent/unavailable. */
+function readShieldKeyNative(shieldId) {
+    const Entry = loadEntryCtor();
+    if (!Entry || !shieldId)
+        return undefined;
+    try {
+        const value = new Entry(SERVICE_NAME, accountName(shieldId)).getPassword();
+        return value || undefined;
+    }
+    catch {
+        // "No entry" throws in keyring — that is the normal not-enrolled case.
+        return undefined;
+    }
+}
+/**
+ * Store the shield key, read-back verified. Returns false when the native
+ * store is unavailable or the verify failed — callers keep their fallback.
+ */
+function saveShieldKeyNative(shieldId, shieldKey) {
+    const Entry = loadEntryCtor();
+    if (!Entry || !shieldId || !shieldKey)
+        return false;
+    try {
+        const entry = new Entry(SERVICE_NAME, accountName(shieldId));
+        entry.setPassword(shieldKey);
+        const verified = new Entry(SERVICE_NAME, accountName(shieldId)).getPassword() === shieldKey;
+        if (!verified) {
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.NATIVE_STORE_FAILED, 'write succeeded but read-back returned a different value');
+        }
+        return verified;
+    }
+    catch (error) {
+        (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.NATIVE_STORE_FAILED, `write failed: ${error instanceof Error ? error.message.slice(0, 120) : String(error)}`);
+        return false;
+    }
+}
+/** Remove the entry (unenroll / re-enroll cleanup). Best-effort. */
+function deleteShieldKeyNative(shieldId) {
+    const Entry = loadEntryCtor();
+    if (!Entry || !shieldId)
+        return;
+    try {
+        new Entry(SERVICE_NAME, accountName(shieldId)).deletePassword();
+    }
+    catch { /* absent — fine */ }
+}
+/**
+ * Deep self-test probe: write + read + delete a throwaway entry with the exact
+ * code paths used for the shield key. Proves the native store works end-to-end
+ * on THIS machine under the current EDR/policy regime.
+ */
+function nativeStoreRoundtripProbe() {
+    if (process.platform !== 'win32')
+        return { ok: true, detail: 'not applicable (non-Windows)' };
+    const Entry = loadEntryCtor();
+    if (!Entry)
+        return { ok: false, detail: 'native keyring module not loaded (missing binary or blocked) — DPAPI/PowerShell fallback in use' };
+    const probeAccount = `selftest:${Date.now()}`;
+    const probeValue = `fcd-native-probe-${Date.now()}`;
+    try {
+        const entry = new Entry(SERVICE_NAME, probeAccount);
+        entry.setPassword(probeValue);
+        const read = new Entry(SERVICE_NAME, probeAccount).getPassword();
+        entry.deletePassword();
+        return read === probeValue
+            ? { ok: true, detail: 'Credential Manager write + read + delete roundtrip OK (no PowerShell involved)' }
+            : { ok: false, detail: 'roundtrip read returned a different value' };
+    }
+    catch (error) {
+        return { ok: false, detail: `roundtrip failed: ${error instanceof Error ? error.message.slice(0, 160) : String(error)}` };
+    }
+}

package/dist/distress.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Machine distress ledger — the CLI's flight recorder.
+ *
+ * Any component (credential resolution, bundle polling, self-update, hooks,
+ * daemon internals) reports a STABLE coded signal via `reportDistress()`.
+ * The ledger is:
+ *   - persisted on disk (survives process churn — hooks are short-lived),
+ *   - deduped (a failing subsystem repeats every few minutes; the ledger
+ *     stores one entry per code+component with a count, not thousands),
+ *   - shipped upstream on every daemon heartbeat (`readDistressSnapshot()`),
+ *   - included in the collect_diagnostics support bundle,
+ *   - echoed into daemon.log so the console's live log panel shows it.
+ *
+ * The code set is OPEN by design: known scenarios get named codes below,
+ * and failures nobody predicted are captured via `reportUnexpected()` —
+ * so even unknown bugs produce structured, fleet-visible telemetry instead
+ * of silence. Adding coverage for a new failure class is ONE call site.
+ *
+ * Everything here is best-effort file I/O — distress reporting must never
+ * break the component doing the reporting (same discipline as
+ * daemonForensics.ts).
+ */
+/** Known distress codes. Open set — free-form codes are allowed. */
+export declare const DISTRESS: {
+    /** DPAPI-protected shield key would not decrypt (EDR / Constrained Language Mode). */
+    readonly DPAPI_DECRYPT_FAILED: "dpapi_decrypt_failed";
+    /** powershell.exe / pwsh.exe could not even start (EDR/AppLocker block). */
+    readonly POWERSHELL_BLOCKED: "powershell_blocked";
+    /** PowerShell runs in ConstrainedLanguage/RestrictedLanguage mode. */
+    readonly POWERSHELL_CONSTRAINED: "powershell_constrained";
+    /** Control plane rejected our credentials (HTTP 401/403) — key wrong or unavailable. */
+    readonly AUTH_BROKEN: "auth_broken";
+    /** Control plane unreachable (network / DNS / proxy / timeout). */
+    readonly NETWORK_DOWN: "network_down";
+    /** Self-update triggered repeatedly for the same target without the version changing. */
+    readonly UPDATE_LOOP: "update_loop";
+    /** MSI updater scheduled task missing and could not be re-registered. */
+    readonly UPDATER_TASK_MISSING: "updater_task_missing";
+    /** Config file missing/unreadable — machine likely not enrolled or wiped. */
+    readonly CONFIG_MISSING: "config_missing";
+    /** Native Credential Manager binding did not load (missing/blocked .node) — PowerShell fallback in use. */
+    readonly NATIVE_STORE_UNAVAILABLE: "native_store_unavailable";
+    /** Native Credential Manager write/verify failed. */
+    readonly NATIVE_STORE_FAILED: "native_store_failed";
+    /** Anything nobody predicted — reported via reportUnexpected(). */
+    readonly UNEXPECTED: "unexpected_error";
+};
+export interface DistressEntry {
+    /** Stable machine-readable code (see DISTRESS, open set). */
+    code: string;
+    /** Component that reported (e.g. 'credentials', 'bundle', 'self-update', 'hook'). */
+    component: string;
+    /** Bounded human detail — never secrets, never file contents. */
+    detail?: string;
+    /** First occurrence in the current dedupe window (ISO). */
+    firstAt: string;
+    /** Most recent occurrence (ISO). */
+    lastAt: string;
+    /** Occurrences folded into this entry. */
+    count: number;
+}
+export declare function distressFile(): string;
+/**
+ * Record a distress signal. Deduped: the same code+component within the
+ * dedupe window updates count/lastAt (echoed to daemon.log only on the first
+ * occurrence and then every 10th, to keep the log readable).
+ */
+export declare function reportDistress(component: string, code: string, detail?: string): void;
+/** Structured capture for failures nobody predicted. */
+export declare function reportUnexpected(component: string, error: unknown): void;
+/**
+ * Recent distress for the heartbeat: entries seen within `windowMs`
+ * (default 24h), newest last, capped for transport.
+ */
+export declare function readDistressSnapshot(options?: {
+    windowMs?: number;
+    limit?: number;
+}): DistressEntry[];
+/** Full ledger for the collect_diagnostics support bundle. */
+export declare function readDistressLedger(): DistressEntry[];

package/dist/distress.js

@@ -0,0 +1,183 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DISTRESS = void 0;
+exports.distressFile = distressFile;
+exports.reportDistress = reportDistress;
+exports.reportUnexpected = reportUnexpected;
+exports.readDistressSnapshot = readDistressSnapshot;
+exports.readDistressLedger = readDistressLedger;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Machine distress ledger — the CLI's flight recorder.
+ *
+ * Any component (credential resolution, bundle polling, self-update, hooks,
+ * daemon internals) reports a STABLE coded signal via `reportDistress()`.
+ * The ledger is:
+ *   - persisted on disk (survives process churn — hooks are short-lived),
+ *   - deduped (a failing subsystem repeats every few minutes; the ledger
+ *     stores one entry per code+component with a count, not thousands),
+ *   - shipped upstream on every daemon heartbeat (`readDistressSnapshot()`),
+ *   - included in the collect_diagnostics support bundle,
+ *   - echoed into daemon.log so the console's live log panel shows it.
+ *
+ * The code set is OPEN by design: known scenarios get named codes below,
+ * and failures nobody predicted are captured via `reportUnexpected()` —
+ * so even unknown bugs produce structured, fleet-visible telemetry instead
+ * of silence. Adding coverage for a new failure class is ONE call site.
+ *
+ * Everything here is best-effort file I/O — distress reporting must never
+ * break the component doing the reporting (same discipline as
+ * daemonForensics.ts).
+ */
+/** Known distress codes. Open set — free-form codes are allowed. */
+exports.DISTRESS = {
+    /** DPAPI-protected shield key would not decrypt (EDR / Constrained Language Mode). */
+    DPAPI_DECRYPT_FAILED: 'dpapi_decrypt_failed',
+    /** powershell.exe / pwsh.exe could not even start (EDR/AppLocker block). */
+    POWERSHELL_BLOCKED: 'powershell_blocked',
+    /** PowerShell runs in ConstrainedLanguage/RestrictedLanguage mode. */
+    POWERSHELL_CONSTRAINED: 'powershell_constrained',
+    /** Control plane rejected our credentials (HTTP 401/403) — key wrong or unavailable. */
+    AUTH_BROKEN: 'auth_broken',
+    /** Control plane unreachable (network / DNS / proxy / timeout). */
+    NETWORK_DOWN: 'network_down',
+    /** Self-update triggered repeatedly for the same target without the version changing. */
+    UPDATE_LOOP: 'update_loop',
+    /** MSI updater scheduled task missing and could not be re-registered. */
+    UPDATER_TASK_MISSING: 'updater_task_missing',
+    /** Config file missing/unreadable — machine likely not enrolled or wiped. */
+    CONFIG_MISSING: 'config_missing',
+    /** Native Credential Manager binding did not load (missing/blocked .node) — PowerShell fallback in use. */
+    NATIVE_STORE_UNAVAILABLE: 'native_store_unavailable',
+    /** Native Credential Manager write/verify failed. */
+    NATIVE_STORE_FAILED: 'native_store_failed',
+    /** Anything nobody predicted — reported via reportUnexpected(). */
+    UNEXPECTED: 'unexpected_error',
+};
+const MAX_ENTRIES = 50;
+const MAX_DETAIL = 300;
+/** Same code+component within this window increments count instead of appending. */
+const DEDUPE_WINDOW_MS = 6 * 60 * 60_000;
+function stateDir() {
+    return path.join(os.homedir(), '.fullcourtdefense');
+}
+function distressFile() {
+    return path.join(stateDir(), 'distress.json');
+}
+function readLedger() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(distressFile(), 'utf8'));
+        return Array.isArray(parsed) ? parsed.filter(e => e && typeof e.code === 'string') : [];
+    }
+    catch {
+        return [];
+    }
+}
+function writeLedger(entries) {
+    try {
+        fs.mkdirSync(stateDir(), { recursive: true });
+        fs.writeFileSync(distressFile(), JSON.stringify(entries.slice(-MAX_ENTRIES), null, 2), 'utf8');
+    }
+    catch { /* best-effort */ }
+}
+/** Echo into daemon.log so the console's live log panel carries the signal. */
+function echoToDaemonLog(entry) {
+    try {
+        const file = path.join(stateDir(), 'daemon.log');
+        const line = `[${entry.lastAt}] DISTRESS ${entry.code} (${entry.component})${entry.detail ? `: ${entry.detail}` : ''}${entry.count > 1 ? ` [x${entry.count}]` : ''}`;
+        fs.appendFileSync(file, `${line}\n`, 'utf8');
+    }
+    catch { /* best-effort */ }
+}
+/**
+ * Record a distress signal. Deduped: the same code+component within the
+ * dedupe window updates count/lastAt (echoed to daemon.log only on the first
+ * occurrence and then every 10th, to keep the log readable).
+ */
+function reportDistress(component, code, detail) {
+    try {
+        const now = new Date().toISOString();
+        const entries = readLedger();
+        const trimmedDetail = detail ? detail.replace(/\s+/g, ' ').trim().slice(0, MAX_DETAIL) : undefined;
+        const existing = entries.find(e => e.code === code
+            && e.component === component
+            && Date.now() - Date.parse(e.lastAt) < DEDUPE_WINDOW_MS);
+        if (existing) {
+            existing.count += 1;
+            existing.lastAt = now;
+            if (trimmedDetail)
+                existing.detail = trimmedDetail;
+            writeLedger(entries);
+            if (existing.count % 10 === 0)
+                echoToDaemonLog(existing);
+            return;
+        }
+        const entry = {
+            code,
+            component,
+            detail: trimmedDetail,
+            firstAt: now,
+            lastAt: now,
+            count: 1,
+        };
+        entries.push(entry);
+        writeLedger(entries);
+        echoToDaemonLog(entry);
+    }
+    catch { /* distress reporting must never break the reporter */ }
+}
+/** Structured capture for failures nobody predicted. */
+function reportUnexpected(component, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    reportDistress(component, exports.DISTRESS.UNEXPECTED, message);
+}
+/**
+ * Recent distress for the heartbeat: entries seen within `windowMs`
+ * (default 24h), newest last, capped for transport.
+ */
+function readDistressSnapshot(options = {}) {
+    const windowMs = options.windowMs ?? 24 * 60 * 60_000;
+    const limit = options.limit ?? 20;
+    return readLedger()
+        .filter(e => Date.now() - Date.parse(e.lastAt) < windowMs)
+        .slice(-limit);
+}
+/** Full ledger for the collect_diagnostics support bundle. */
+function readDistressLedger() {
+    return readLedger();
+}

package/dist/runtimeConfig.d.ts

@@ -40,7 +40,7 @@ export interface RuntimeBundle {
     /** One constrained, auditable action queued for the resident daemon. */
     machineAction?: {
         id: string;
-        type: 'health_check' | 'policy_refresh' | 'discovery_scan' | 'repair_protection' | 'upgrade_cli';
+        type: 'health_check' | 'policy_refresh' | 'discovery_scan' | 'repair_protection' | 'upgrade_cli' | 'collect_diagnostics';
         reason: string;
         createdAt: string;
         expiresAt: string;

package/dist/runtimeConfig.js

@@ -39,6 +39,7 @@ exports.getCachedExtraScanRoots = getCachedExtraScanRoots;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const distress_1 = require("./distress");
 const CACHE_PATH = path.join(os.homedir(), '.fullcourtdefense-runtime.json');
 const DEFAULT_TTL_MS = 60_000;
 const REFRESH_TIMEOUT_MS = 1_500; // tight: the hook must stay fast
@@ -94,6 +95,11 @@ async function getRuntimeBundle(input) {
             writeCacheFile(cache);
             return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, extraScanRoots: cached.extraScanRoots, disabledScanRoots: cached.disabledScanRoots, autoUpdate: cached.autoUpdate, honeypot: cached.honeypot, machineAction: cached.machineAction, source: 'cache' };
         }
+        if (resp.status === 401 || resp.status === 403) {
+            // The backend REACHED us and rejected the key — a credential problem,
+            // not a network one. The two need opposite fixes; code them apart.
+            (0, distress_1.reportDistress)('bundle', distress_1.DISTRESS.AUTH_BROKEN, `bundle fetch HTTP ${resp.status}${input.shieldKey ? '' : ' (no shield key available)'}`);
+        }
         if (resp.ok) {
             const body = await resp.json().catch(() => ({}));
             if (body.success && body.data && isMode(body.data.mode)) {
@@ -129,7 +135,11 @@ async function getRuntimeBundle(input) {
             }
         }
     }
-    catch { /* fall through to cache / default */ }
+    catch (error) {
+        // Fetch threw — DNS/proxy/timeout, i.e. the control plane is unreachable.
+        (0, distress_1.reportDistress)('bundle', distress_1.DISTRESS.NETWORK_DOWN, error instanceof Error ? error.message : String(error));
+        /* fall through to cache / default */
+    }
     if (cached) {
         return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, extraScanRoots: cached.extraScanRoots, disabledScanRoots: cached.disabledScanRoots, autoUpdate: cached.autoUpdate, honeypot: cached.honeypot, machineAction: cached.machineAction, source: 'cache' };
     }

package/dist/selfTest.d.ts

@@ -0,0 +1,38 @@
+import { type ResolvedCliCredentials } from './config';
+/**
+ * Deep self-test — the upgraded `health_check` remote action.
+ *
+ * Instead of passively reporting state, every subsystem the fleet depends on
+ * is actively EXERCISED: DPAPI roundtrip (encrypt AND decrypt a probe value),
+ * PowerShell spawn + language mode, control-plane reachability, authenticated
+ * bundle fetch, IDE hook/gateway integrity, and the MSI updater scheduled
+ * task. One click in the console answers in ~30 seconds what the lptx1110
+ * incident took a day of customer back-and-forth to establish.
+ *
+ * Deliberate privacy boundary: metadata only — never scans customer files,
+ * never includes prompts, keys, or file contents.
+ */
+export interface SelfTestCheck {
+    /** Stable machine-readable id (console renders these as a checklist). */
+    id: string;
+    label: string;
+    ok: boolean;
+    detail: string;
+}
+export interface SelfTestReport {
+    ok: boolean;
+    checks: SelfTestCheck[];
+    ranAt: string;
+}
+export declare function runDeepSelfTest(input: {
+    creds: ResolvedCliCredentials;
+    developerName?: string;
+    machineName?: string;
+    machineId?: string;
+    /** Injected from the daemon (avoids a module cycle); omit to skip the watchdog check. */
+    isWatchdogTaskInstalled?: () => boolean;
+    /** Progress logger — each check logs as it completes so the live log tail shows movement. */
+    log?: (message: string) => void;
+}): Promise<SelfTestReport>;
+/** Compact one-line summary for the machine-action result card. */
+export declare function summarizeSelfTest(report: SelfTestReport): string;

package/dist/selfTest.js

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDeepSelfTest = runDeepSelfTest;
+exports.summarizeSelfTest = summarizeSelfTest;
+const child_process_1 = require("child_process");
+const config_1 = require("./config");
+const credentialStore_1 = require("./credentialStore");
+const runtimeConfig_1 = require("./runtimeConfig");
+const integrity_1 = require("./integrity");
+const selfUpdate_1 = require("./selfUpdate");
+/** Windows scheduled-task probe: exists + (when readable) its last result code. */
+function queryScheduledTask(taskName) {
+    const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/V', '/FO', 'LIST'], {
+        encoding: 'utf8', windowsHide: true, timeout: 10_000,
+    });
+    if (query.status !== 0)
+        return { exists: false };
+    // English-locale field; on other locales we still know the task exists.
+    const lastResult = query.stdout.split(/\r?\n/).find(line => /^Last Result:/i.test(line.trim()))?.split(':')[1]?.trim();
+    return { exists: true, lastResult };
+}
+async function runDeepSelfTest(input) {
+    const log = input.log || (() => { });
+    const checks = [];
+    const add = (check) => {
+        checks.push(check);
+        log(`Self-test: ${check.ok ? 'PASS' : 'FAIL'} ${check.label} — ${check.detail}`);
+    };
+    // 1. PowerShell spawn + language mode (Windows only).
+    if (process.platform === 'win32') {
+        const mode = (0, config_1.capturePowershellLanguageMode)();
+        if (!mode) {
+            add({ id: 'powershell', label: 'PowerShell available', ok: false, detail: 'powershell.exe/pwsh.exe did not answer (EDR/AppLocker block?)' });
+        }
+        else {
+            add({
+                id: 'powershell',
+                label: 'PowerShell available',
+                ok: true,
+                detail: `language mode: ${mode}${mode !== 'FullLanguage' ? ' (hardened — CLM-safe code paths required)' : ''}`,
+            });
+        }
+        // 2. Native Credential Manager roundtrip — the PowerShell-free primary
+        // store (CLI ≥1.21.34). A failure here is NOT fatal while DPAPI works,
+        // but the console should see which machines run on the fallback.
+        const native = (0, credentialStore_1.nativeStoreRoundtripProbe)();
+        add({ id: 'native_store', label: 'Credential Manager (native) roundtrip', ok: native.ok, detail: native.detail });
+        // 3. DPAPI roundtrip — encrypt AND decrypt a probe value with the exact
+        // snippets the CLI uses for the shield key. This is the check that would
+        // have identified the lptx1110 credential break in one click. Kept as its
+        // own check: it is the fallback store for machines without the native
+        // binding and the rollback path to ≤1.21.33.
+        const probe = (0, config_1.dpapiRoundtripProbe)();
+        add({ id: 'dpapi_roundtrip', label: 'Credential store (DPAPI) roundtrip', ok: probe.ok, detail: probe.detail });
+    }
+    // 3. Credentials resolved on THIS machine right now.
+    const trace = (() => {
+        if (input.creds.shieldId && input.creds.shieldKey)
+            return { ok: true, detail: `shield key from: ${(0, config_1.getCredentialResolutionTrace)()?.shieldKeySource || 'unknown'}` };
+        if (!input.creds.shieldId)
+            return { ok: false, detail: 'no shield ID — machine looks unenrolled' };
+        return { ok: false, detail: `no shield key (source: ${(0, config_1.getCredentialResolutionTrace)()?.shieldKeySource || 'unknown'})` };
+    })();
+    add({ id: 'credentials', label: 'Shield credentials resolve', ...trace });
+    // 4. Control plane reachable (unauthenticated ping — separates network from auth).
+    try {
+        const resp = await fetch(`${input.creds.apiUrl}/api/health/ping`, { signal: AbortSignal.timeout(8_000) });
+        add({ id: 'api_reachable', label: 'Control plane reachable', ok: resp.ok, detail: `GET /api/health/ping → HTTP ${resp.status}` });
+    }
+    catch (error) {
+        add({ id: 'api_reachable', label: 'Control plane reachable', ok: false, detail: `network error: ${error instanceof Error ? error.message : String(error)}` });
+    }
+    // 5. Authenticated bundle fetch — the credentials actually WORK against the backend.
+    if (input.creds.shieldId) {
+        try {
+            const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
+                apiUrl: input.creds.apiUrl,
+                shieldId: input.creds.shieldId,
+                shieldKey: input.creds.shieldKey,
+                developerName: input.developerName,
+                machineName: input.machineName,
+                machineId: input.machineId,
+                force: true,
+                ttlMs: 0,
+            });
+            add({
+                id: 'bundle_auth',
+                label: 'Authenticated policy fetch',
+                ok: bundle.source === 'server',
+                detail: bundle.source === 'server'
+                    ? `live bundle from server (mode ${bundle.mode}, ${bundle.policyCount ?? 0} policies)`
+                    : `no live bundle — running on ${bundle.source} (auth rejected or offline; see distress codes)`,
+            });
+        }
+        catch (error) {
+            add({ id: 'bundle_auth', label: 'Authenticated policy fetch', ok: false, detail: error instanceof Error ? error.message : String(error) });
+        }
+    }
+    // 6. Protection surfaces: IDE hooks + MCP gateway wraps + daemon.
+    try {
+        const integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
+        add({
+            id: 'protection_integrity',
+            label: 'Hooks & gateway integrity',
+            ok: integrity.ok,
+            detail: integrity.ok
+                ? `healthy (${integrity.protectedMcpConfigs}/${integrity.discoveredMcpConfigs} MCP configs wrapped)`
+                : integrity.reasons.join(', '),
+        });
+    }
+    catch (error) {
+        add({ id: 'protection_integrity', label: 'Hooks & gateway integrity', ok: false, detail: error instanceof Error ? error.message : String(error) });
+    }
+    // 7. Updater scheduled task (MSI installs only — npm installs update in place).
+    if (process.platform === 'win32' && (0, selfUpdate_1.detectInstallKind)() === 'msi') {
+        const task = queryScheduledTask(selfUpdate_1.MSI_UPDATER_TASK_NAME);
+        add({
+            id: 'updater_task',
+            label: 'Silent-update task registered',
+            ok: task.exists,
+            detail: task.exists
+                ? `"${selfUpdate_1.MSI_UPDATER_TASK_NAME}" present${task.lastResult !== undefined ? `, last result ${task.lastResult}` : ''}`
+                : `"${selfUpdate_1.MSI_UPDATER_TASK_NAME}" missing — silent updates dead until reinstall/self-heal`,
+        });
+    }
+    // 8. Watchdog liveness task (injected — daemon-owned logic).
+    if (input.isWatchdogTaskInstalled) {
+        try {
+            const installed = input.isWatchdogTaskInstalled();
+            add({
+                id: 'watchdog_task',
+                label: 'Watchdog task registered',
+                ok: installed,
+                detail: installed ? 'out-of-process liveness beacon present' : 'watchdog task missing (self-heals at next daemon boot)',
+            });
+        }
+        catch (error) {
+            add({ id: 'watchdog_task', label: 'Watchdog task registered', ok: false, detail: error instanceof Error ? error.message : String(error) });
+        }
+    }
+    return { ok: checks.every(check => check.ok), checks, ranAt: new Date().toISOString() };
+}
+/** Compact one-line summary for the machine-action result card. */
+function summarizeSelfTest(report) {
+    const failed = report.checks.filter(check => !check.ok);
+    if (failed.length === 0)
+        return `Deep self-test passed — all ${report.checks.length} subsystems healthy.`;
+    return `Deep self-test: ${report.checks.length - failed.length}/${report.checks.length} passed — FAILED: ${failed.map(check => `${check.id} (${check.detail})`).join('; ')}`;
+}

package/dist/selfUpdate.d.ts

@@ -26,6 +26,14 @@ export interface SelfUpdateResult {
     detail: string;
 }
 export declare function resolveNpmCommand(platform?: NodeJS.Platform, execPath?: string, exists?: typeof fs.existsSync): string;
+/**
+ * Updater script log (%ProgramData%\FullCourtDefense\updater.log) — the
+ * elevated task's own words. Read by the diagnostics bundle and the update-
+ * loop detector so a silently failing updater is explainable from the console
+ * (Alin's machine triggered the task every 10 minutes for hours with zero
+ * fleet-visible evidence of WHY).
+ */
+export declare function readUpdaterLogTail(maxLines?: number): string[];
 /**
  * Upgrade this machine to targetVersion if it is newer than currentVersion.
  * Cheap no-op when already current, when a kick is still pending, or when the

package/dist/selfUpdate.js

@@ -37,11 +37,14 @@ exports.MSI_UPDATER_TASK_NAME = void 0;
 exports.detectInstallKind = detectInstallKind;
 exports.compareCliVersions = compareCliVersions;
 exports.resolveNpmCommand = resolveNpmCommand;
+exports.readUpdaterLogTail = readUpdaterLogTail;
 exports.maybeSelfUpdate = maybeSelfUpdate;
 exports.installedMsiVersion = installedMsiVersion;
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
+const distress_1 = require("./distress");
 /**
  * Silent CLI self-update.
  *
@@ -159,6 +162,7 @@ function startMsiSelfUpdate(targetVersion, log) {
     const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', exports.MSI_UPDATER_TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
     if (query.status !== 0 && !tryRegisterMsiUpdaterTask(log)) {
         log('Self-update: MSI updater task is not registered on this machine — reinstall the MSI to enable silent updates.');
+        (0, distress_1.reportDistress)('self-update', distress_1.DISTRESS.UPDATER_TASK_MISSING, `"${exports.MSI_UPDATER_TASK_NAME}" scheduled task missing and self-registration failed`);
         return {
             started: false,
             kind: 'msi',
@@ -177,6 +181,55 @@ function startMsiSelfUpdate(targetVersion, log) {
         detail: `Could not trigger the "${exports.MSI_UPDATER_TASK_NAME}" task immediately; it still runs on its daily schedule.`,
     };
 }
+/**
+ * Updater script log (%ProgramData%\FullCourtDefense\updater.log) — the
+ * elevated task's own words. Read by the diagnostics bundle and the update-
+ * loop detector so a silently failing updater is explainable from the console
+ * (Alin's machine triggered the task every 10 minutes for hours with zero
+ * fleet-visible evidence of WHY).
+ */
+function readUpdaterLogTail(maxLines = 40) {
+    if (process.platform !== 'win32')
+        return [];
+    try {
+        const file = path.join(process.env.ProgramData || 'C:\\ProgramData', 'FullCourtDefense', 'updater.log');
+        return fs.readFileSync(file, 'utf8')
+            .split(/\r?\n/)
+            .map(line => line.trim())
+            .filter(Boolean)
+            .slice(-maxLines)
+            .map(line => line.slice(0, 400));
+    }
+    catch {
+        return [];
+    }
+}
+function updateAttemptsFile() {
+    return path.join(os.homedir(), '.fullcourtdefense', 'update-attempts.json');
+}
+/** Attempts to reach `target` from an unchanged installed version — persisted across daemon restarts. */
+function recordUpdateAttempt(target, fromVersion) {
+    try {
+        let record;
+        try {
+            const parsed = JSON.parse(fs.readFileSync(updateAttemptsFile(), 'utf8'));
+            if (parsed && parsed.target === target && parsed.fromVersion === fromVersion)
+                record = parsed;
+        }
+        catch { /* no prior record for this target/version pair */ }
+        const next = record
+            ? { ...record, count: record.count + 1 }
+            : { target, fromVersion, count: 1, firstAt: new Date().toISOString() };
+        fs.mkdirSync(path.dirname(updateAttemptsFile()), { recursive: true });
+        fs.writeFileSync(updateAttemptsFile(), JSON.stringify(next, null, 2), 'utf8');
+        return next.count;
+    }
+    catch {
+        return 1;
+    }
+}
+/** How many times an update to the same target was kicked without the version moving. */
+const UPDATE_LOOP_THRESHOLD = 3;
 let updateInFlightSince = 0;
 let updateInFlightTarget;
 // A normal MSI finishes in ~5 minutes. Ten minutes avoids duplicate kicks
@@ -205,6 +258,16 @@ function maybeSelfUpdate(input) {
     updateInFlightSince = Date.now();
     updateInFlightTarget = input.targetVersion;
     log(`Self-update: CLI ${input.currentVersion || 'unknown'} -> ${input.targetVersion} (org auto-update).`);
+    // Update-loop detection: kicking the updater repeatedly while the installed
+    // version never changes means the elevated task is failing silently (EDR
+    // block, download failure, msiexec denial). Surface it as coded distress —
+    // with the updater's own log line — instead of looping invisibly for hours.
+    const attempts = recordUpdateAttempt(input.targetVersion, input.currentVersion || 'unknown');
+    if (attempts >= UPDATE_LOOP_THRESHOLD) {
+        const updaterTail = readUpdaterLogTail(3);
+        (0, distress_1.reportDistress)('self-update', distress_1.DISTRESS.UPDATE_LOOP, `target ${input.targetVersion} triggered ${attempts}x, still on ${input.currentVersion || 'unknown'}`
+            + (updaterTail.length ? ` — updater.log: ${updaterTail[updaterTail.length - 1]}` : ' — updater.log unreadable (task may never have run)'));
+    }
     const kind = detectInstallKind();
     const result = kind === 'msi'
         ? startMsiSelfUpdate(input.targetVersion, log)

package/dist/telemetry.d.ts

@@ -42,6 +42,19 @@ export interface FlushInput {
     powershellSpawnOk?: boolean;
     /** Did the DPAPI-protected shield key actually decrypt? */
     powershellDecryptOk?: boolean;
+    /** PowerShell language mode (FullLanguage/ConstrainedLanguage/…) — captured on decrypt failures and self-tests. */
+    powershellLanguageMode?: string;
+    /** Which source supplied the shield key on the last resolution (codes only — see config.ts ShieldKeySource). */
+    shieldKeySource?: string;
+    /** Recent coded distress signals from the on-disk ledger (see distress.ts). */
+    distress?: Array<{
+        code: string;
+        component: string;
+        detail?: string;
+        firstAt: string;
+        lastAt: string;
+        count: number;
+    }>;
     /** Post-mortem of a previous daemon that died without a clean shutdown. */
     lastCrash?: {
         version?: string;

package/dist/telemetry.js

@@ -176,6 +176,12 @@ async function flushSpool(input) {
                         securityAgents: input.securityAgents,
                         powershellSpawnOk: input.powershellSpawnOk,
                         powershellDecryptOk: input.powershellDecryptOk,
+                        powershellLanguageMode: input.powershellLanguageMode,
+                        shieldKeySource: input.shieldKeySource,
+                        // Coded distress ledger: the machine's own explanation of WHY
+                        // something is failing (dpapi_decrypt_failed, update_loop, …) —
+                        // the console reads root causes instead of asking the customer.
+                        distress: input.distress,
                         lastCrash: input.lastCrash,
                     }
                     : undefined,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.32"
+  "version": "1.21.34"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.32",
+  "version": "1.21.34",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -43,6 +43,12 @@
     "test:posture-overhaul": "npm run build && node scripts/test-posture-overhaul.js",
     "test:scan-root-compaction": "npm run build && node scripts/test-scan-root-compaction.js",
     "test:dpapi-config": "npm run build && node scripts/test-dpapi-config.js",
+    "test:distress-ledger": "npm run build && node scripts/test-distress-ledger.js",
+    "test:deep-selftest": "npm run build && node scripts/test-deep-selftest.js",
+    "test:update-loop": "npm run build && node scripts/test-update-loop-detection.js",
+    "test:bricked-rescue": "npm run build && node scripts/test-bricked-machine-rescue.js",
+    "test:native-credstore": "npm run build && node scripts/test-native-credential-store.js",
+    "test:real-life": "npm run build && node scripts/test-real-life-scenarios.js",
     "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
     "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
@@ -69,6 +75,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
+    "@napi-rs/keyring": "^1.3.0",
     "yaml": "^2.8.4"
   }
 }