fullcourtdefense-cli 1.21.32 → 1.21.35

package/dist/commands/daemon.js

@@ -48,6 +48,8 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const config_1 = require("../config");
+const distress_1 = require("../distress");
+const selfTest_1 = require("../selfTest");
 const daemonForensics_1 = require("../daemonForensics");
 const securityAgents_1 = require("../securityAgents");
 const mcpGateway_1 = require("./mcpGateway");
@@ -345,9 +347,13 @@ async function runDaemon(args, config) {
     // that would restart a crashed process instantly.
     process.on('uncaughtException', error => {
         log(`Uncaught exception (daemon continues): ${error?.stack || String(error)}`);
+        // Ledger the unknown: failures nobody predicted still become structured,
+        // fleet-visible telemetry (code unexpected_error) on the next heartbeat.
+        (0, distress_1.reportUnexpected)('daemon', error);
     });
     process.on('unhandledRejection', reason => {
         log(`Unhandled rejection (daemon continues): ${reason?.stack || String(reason)}`);
+        (0, distress_1.reportUnexpected)('daemon', reason);
     });
     const creds = (0, config_1.resolveCliCredentials)(config, {
         shieldId: args.shieldId,
@@ -536,7 +542,9 @@ async function runDaemon(args, config) {
             return;
         try {
             const raw = fs.readFileSync(logFile(), 'utf8');
-            const lines = raw.split(/\r?\n/).filter(line => line.trim()).slice(-80);
+            // 200 lines (~half a day of routine ticks): enough context to diagnose a
+            // failure loop remotely without asking the customer to paste anything.
+            const lines = raw.split(/\r?\n/).filter(line => line.trim()).slice(-200);
             const identity = (0, machineIdentity_1.getMachineIdentity)();
             await fetch(`${creds.apiUrl}/api/cli/machines/log`, {
                 method: 'POST',
@@ -550,6 +558,64 @@ async function runDaemon(args, config) {
         }
         catch { /* log shipping is best-effort */ }
     };
+    // Ship a structured diagnostics payload (support bundle / self-test report)
+    // to the machine record. Works key-less too — a machine whose credential
+    // store is broken is EXACTLY the one whose diagnostics we need (the backend
+    // verifies the machine binding and flags the reduced trust level).
+    const uploadDiagnostics = async (payload) => {
+        if (!creds.shieldId)
+            return false;
+        try {
+            const identity = (0, machineIdentity_1.getMachineIdentity)();
+            const resp = await fetch(`${creds.apiUrl}/api/cli/machines/diagnostics`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(creds.shieldKey ? { 'x-shield-key': creds.shieldKey } : {}),
+                },
+                body: JSON.stringify({ shieldId: creds.shieldId, machineId: identity.machineId, ...payload }),
+                signal: AbortSignal.timeout(15_000),
+            });
+            return resp.ok;
+        }
+        catch {
+            log('Diagnostics upload failed (network) — the bundle stays available locally.');
+            return false;
+        }
+    };
+    // The complete remote support bundle: everything we asked Alex and Alin to
+    // paste by hand during the lptx1110 incident, collected in one action.
+    // Metadata + our own logs only — never customer files, prompts, or secrets.
+    const buildSupportBundle = () => {
+        const powershell = (0, config_1.getPowershellHealth)();
+        let integrity;
+        try {
+            integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
+        }
+        catch (error) {
+            integrity = { error: error.message };
+        }
+        let daemonLogTail = [];
+        try {
+            daemonLogTail = fs.readFileSync(logFile(), 'utf8')
+                .split(/\r?\n/).map(line => line.trim()).filter(Boolean).slice(-200).map(line => line.slice(0, 400));
+        }
+        catch { /* log unreadable — the bundle reports everything else */ }
+        return {
+            cliVersion: cliVersion(),
+            platform: process.platform,
+            collectedAt: new Date().toISOString(),
+            daemonLogTail,
+            updaterLogTail: (0, selfUpdate_1.readUpdaterLogTail)(60),
+            distress: (0, distress_1.readDistressLedger)(),
+            credentialTrace: (0, config_1.getCredentialResolutionTrace)(),
+            powershell,
+            securityAgents: (0, securityAgents_1.getSecurityAgentsReport)()?.products,
+            integrity,
+            lastCrash: (0, daemonForensics_1.readPostmortem)(),
+            watchdogTaskInstalled: isWatchdogTaskInstalled(),
+        };
+    };
     const reportMachineAction = async (actionId, status, detail) => {
         if (!creds.shieldId)
             return;
@@ -664,18 +730,37 @@ async function runDaemon(args, config) {
         try {
             let resultSummary = '';
             if (action.type === 'health_check') {
-                log('Health check: verifying daemon + protection surfaces…');
+                // Deep self-test: actively EXERCISE every subsystem (DPAPI roundtrip,
+                // PowerShell mode, API reachability, authenticated fetch, hooks,
+                // updater task) instead of passively reporting. ~30s from the console
+                // to a per-subsystem pass/fail table.
+                log('Health check: running deep self-test across all subsystems…');
                 await uploadLogTail();
-                const integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
-                log(integrity.ok
-                    ? `Health check: all protection points healthy (${integrity.protectedMcpConfigs}/${integrity.discoveredMcpConfigs} MCP configs wrapped).`
-                    : `Health check: issues found — ${integrity.reasons.join(', ')}.`);
-                resultSummary = integrity.ok
-                    ? 'Daemon and required AgentGuard protection points are healthy.'
-                    : `Health check found: ${integrity.reasons.join(', ')}`;
-                if (!integrity.ok)
+                const identity = (0, machineIdentity_1.getMachineIdentity)();
+                const report = await (0, selfTest_1.runDeepSelfTest)({
+                    creds,
+                    developerName: identity.developerName,
+                    machineName: identity.hostname,
+                    machineId: identity.machineId,
+                    isWatchdogTaskInstalled,
+                    log,
+                });
+                await uploadDiagnostics({ selfTest: report });
+                resultSummary = (0, selfTest_1.summarizeSelfTest)(report);
+                log(`Health check: ${resultSummary}`);
+                if (!report.ok)
                     throw new Error(resultSummary);
             }
+            else if (action.type === 'collect_diagnostics') {
+                log('Collect diagnostics: assembling support bundle (logs + distress ledger + environment — metadata only)…');
+                await uploadLogTail();
+                const bundle = buildSupportBundle();
+                const uploaded = await uploadDiagnostics({ bundle });
+                if (!uploaded)
+                    throw new Error('Support bundle could not be uploaded (network or backend rejection).');
+                log(`Collect diagnostics: bundle uploaded (${bundle.daemonLogTail.length} log lines, ${bundle.distress.length} distress entries).`);
+                resultSummary = `Support bundle uploaded: ${bundle.daemonLogTail.length} daemon log lines, ${bundle.updaterLogTail.length} updater log lines, ${bundle.distress.length} distress signal(s), credential trace, environment health.`;
+            }
             else if (action.type === 'policy_refresh') {
                 if (!creds.shieldId)
                     throw new Error('Shield not configured on this machine.');
@@ -777,9 +862,41 @@ async function runDaemon(args, config) {
             await uploadLogTail();
         }
     };
+    // Distress channel: a machine whose credential store is broken cannot fetch
+    // the authenticated bundle — which is how remote actions are delivered — so
+    // the one machine an admin most needs to reach is unreachable. This key-less
+    // poll returns SIGNED actions only; safety comes from the Ed25519 signature
+    // + org/machine binding verified in executeMachineAction (the transport was
+    // never the trust anchor). Rescue path: queue upgrade_cli / collect_diagnostics
+    // from the console and the bricked machine still receives it.
+    const pollDistressActions = async () => {
+        if (!creds.shieldId || creds.shieldKey)
+            return;
+        try {
+            const identity = (0, machineIdentity_1.getMachineIdentity)();
+            const params = new URLSearchParams({ shieldId: creds.shieldId, machineId: identity.machineId });
+            const resp = await fetch(`${creds.apiUrl}/api/cli/machine-actions/pending?${params.toString()}`, {
+                method: 'GET',
+                signal: AbortSignal.timeout(8_000),
+            });
+            if (!resp.ok)
+                return;
+            const body = await resp.json().catch(() => ({}));
+            if (body.data?.machineAction) {
+                log(`Distress channel: received action ${body.data.machineAction.type} key-less — Ed25519 verification gates execution.`);
+                void executeMachineAction(body.data.machineAction);
+            }
+        }
+        catch { /* offline — next poll retries */ }
+    };
     const pollBundle = async () => {
         if (!creds.shieldId)
             return;
+        if (!creds.shieldKey) {
+            // Credential-broken machine: stay reachable via the key-less signed-
+            // action channel while credential recovery keeps retrying.
+            await pollDistressActions();
+        }
         const identity = (0, machineIdentity_1.getMachineIdentity)();
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
@@ -882,6 +999,9 @@ async function runDaemon(args, config) {
                 securityAgents: (0, securityAgents_1.getSecurityAgentsReport)()?.products,
                 powershellSpawnOk: powershell?.spawnOk,
                 powershellDecryptOk: powershell?.decryptOk,
+                powershellLanguageMode: powershell?.languageMode,
+                shieldKeySource: (0, config_1.getCredentialResolutionTrace)()?.shieldKeySource,
+                distress: (0, distress_1.readDistressSnapshot)(),
                 lastCrash: unreportedCrash
                     ? {
                         version: unreportedCrash.version,
@@ -909,6 +1029,9 @@ async function runDaemon(args, config) {
     // Self-heal autostart + watchdog tasks: machines installed by older versions
     // (or where task creation failed once) must converge without a reinstall.
     ensureWindowsAutostartHealthy(log);
+    // Converge pre-Node-updater machines onto the PowerShell-free updater task
+    // (best-effort; needs an elevated daemon to rewrite a SYSTEM task).
+    (0, selfUpdate_1.modernizeUpdaterTask)(log);
     const watched = refreshWatchTargets();
     log(`Watching ${watched} config file(s) across ${watchers.size} director${watchers.size === 1 ? 'y' : 'ies'}.`);
     // First: if this boot IS the post-upgrade relaunch, confirm the pending

package/dist/commands/shellGuard.d.ts

@@ -39,6 +39,13 @@ export declare function evaluateShellCommand(line: string, rules?: ShellGuardRul
  * No-op unless the guard is installed. Never throws.
  */
 export declare function refreshShellGuardRules(): void;
+/**
+ * The user's Documents folder from the shell-folder registry entry — the one
+ * place that knows about OneDrive/folder redirection. reg.exe is a plain
+ * system utility (not a scripting engine), so EDRs that block powershell.exe
+ * do not block this.
+ */
+export declare function resolveDocumentsFolder(): string;
 export interface ShellGuardStatus {
     supported: boolean;
     installed: boolean;

package/dist/commands/shellGuard.js

@@ -37,6 +37,7 @@ exports.writeShellGuardRules = writeShellGuardRules;
 exports.activeShellGuardRules = activeShellGuardRules;
 exports.evaluateShellCommand = evaluateShellCommand;
 exports.refreshShellGuardRules = refreshShellGuardRules;
+exports.resolveDocumentsFolder = resolveDocumentsFolder;
 exports.getShellGuardStatus = getShellGuardStatus;
 exports.isShellGuardInstalled = isShellGuardInstalled;
 exports.installShellGuardCommand = installShellGuardCommand;
@@ -510,30 +511,57 @@ function buildGuardPs1(nodePath, cliEntry) {
     ];
     return lines.join('\r\n');
 }
-/** Resolve each PowerShell engine's CurrentUserAllHosts profile path. */
-function resolveProfilePaths() {
-    const out = [];
-    for (const engine of ['powershell.exe', 'pwsh.exe']) {
-        try {
-            const result = (0, child_process_1.spawnSync)(engine, ['-NoProfile', '-NonInteractive', '-Command', 'Write-Output $PROFILE.CurrentUserAllHosts'], {
-                encoding: 'utf8', windowsHide: true, timeout: 15000,
-            });
-            const profilePath = (result.stdout || '').trim().split(/\r?\n/).pop()?.trim();
-            if (result.status === 0 && profilePath && /\.ps1$/i.test(profilePath)) {
-                out.push({ engine: engine.replace(/\.exe$/i, ''), profilePath });
-            }
+/**
+ * The user's Documents folder from the shell-folder registry entry — the one
+ * place that knows about OneDrive/folder redirection. reg.exe is a plain
+ * system utility (not a scripting engine), so EDRs that block powershell.exe
+ * do not block this.
+ */
+function resolveDocumentsFolder() {
+    try {
+        const run = (0, child_process_1.spawnSync)('reg', [
+            'query', 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders', '/v', 'Personal',
+        ], { encoding: 'utf8', windowsHide: true, timeout: 10_000 });
+        const raw = ((run.stdout || '').match(/Personal\s+REG_(?:EXPAND_)?SZ\s+(.+)/) || [])[1]?.trim();
+        if (run.status === 0 && raw) {
+            const expanded = raw.replace(/%([^%]+)%/g, (_, name) => process.env[name] ?? `%${name}%`);
+            if (!expanded.includes('%'))
+                return expanded;
         }
-        catch { /* engine not installed */ }
     }
-    // Dedupe (both engines can share a profile only if paths match — normally they differ).
-    const seen = new Set();
-    return out.filter(entry => {
-        const key = entry.profilePath.toLowerCase();
-        if (seen.has(key))
-            return false;
-        seen.add(key);
+    catch { /* registry unreadable — fall through */ }
+    return path.join(os.homedir(), 'Documents');
+}
+function pwshInstalled() {
+    const programFiles = process.env.ProgramFiles || 'C:\\Program Files';
+    if (fs.existsSync(path.join(programFiles, 'PowerShell', '7', 'pwsh.exe'))
+        || fs.existsSync(path.join(programFiles, 'PowerShell', '7-preview', 'pwsh.exe')))
         return true;
-    });
+    for (const dir of (process.env.PATH || '').split(path.delimiter)) {
+        try {
+            if (dir && fs.existsSync(path.join(dir, 'pwsh.exe')))
+                return true;
+        }
+        catch { /* keep looking */ }
+    }
+    return false;
+}
+/**
+ * Resolve each PowerShell engine's CurrentUserAllHosts profile path WITHOUT
+ * spawning PowerShell. $PROFILE.CurrentUserAllHosts is deterministic:
+ * <Documents>\WindowsPowerShell\profile.ps1 (Windows PowerShell, always
+ * present on Windows) and <Documents>\PowerShell\profile.ps1 (pwsh, when
+ * installed). Asking the engines themselves was both an EDR flag risk and
+ * wrong on machines where EDR blocks PowerShell — the guard then silently
+ * skipped profile installation on exactly the fleets that want it most.
+ */
+function resolveProfilePaths() {
+    const documents = resolveDocumentsFolder();
+    const out = [{ engine: 'powershell', profilePath: path.join(documents, 'WindowsPowerShell', 'profile.ps1') }];
+    if (pwshInstalled()) {
+        out.push({ engine: 'pwsh', profilePath: path.join(documents, 'PowerShell', 'profile.ps1') });
+    }
+    return out;
 }
 function profileSnippet() {
     return [

package/dist/config.d.ts

@@ -30,8 +30,16 @@ export interface PowershellHealth {
     spawnOk: boolean;
     decryptOk: boolean;
     checkedAt: string;
+    /** FullLanguage / ConstrainedLanguage / RestrictedLanguage — captured only when a decrypt fails (extra spawn is failure-path-only). */
+    languageMode?: string;
 }
 export declare function getPowershellHealth(): PowershellHealth | undefined;
+/**
+ * PowerShell language mode — the "is this a hardened WDAC/AppLocker fleet
+ * machine?" bit that explained the lptx1110 incident. Spawned only on the
+ * DPAPI failure path (and from the deep self-test), never on healthy runs.
+ */
+export declare function capturePowershellLanguageMode(): string | undefined;
 /**
  * PSCredential.GetNetworkCredential() instead of Marshal::SecureStringToBSTR:
  * hardened fleets run PowerShell in Constrained Language Mode, where the
@@ -42,6 +50,16 @@ export declare function getPowershellHealth(): PowershellHealth | undefined;
  * regression test runs this EXACT text inside a ConstrainedLanguage session.
  */
 export declare const DPAPI_DECRYPT_SNIPPET = "$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE; (New-Object System.Management.Automation.PSCredential('fcd', $secure)).GetNetworkCredential().Password";
+/**
+ * Deep self-test probe: encrypt AND decrypt a throwaway value with the exact
+ * DPAPI snippets used for the shield key. Encryption alone can succeed on a
+ * machine that can never decrypt (the pre-v1.21.32 bricking bug) — only the
+ * full roundtrip proves the credential store works.
+ */
+export declare function dpapiRoundtripProbe(): {
+    ok: boolean;
+    detail: string;
+};
 export declare function getHomeConfigPath(): string;
 export declare function loadConfig(configPath?: string): BotGuardConfig;
 export declare function getDefaultConfigPath(): string;
@@ -76,6 +94,19 @@ export interface ResolvedCliCredentials {
  * Pure — unit-tested.
  */
 export declare function daemonHandoffShieldKey(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Which source supplied the shield key on the most recent resolution — the
+ * codes-only trace shipped in the collect_diagnostics bundle (never the key
+ * itself). `none_dpapi_broken` is the credential-broken state: a DPAPI blob
+ * exists but would not decrypt and no fallback source was available.
+ */
+export type ShieldKeySource = 'override' | 'daemon_handoff' | 'native_store' | 'dpapi' | 'plaintext_config' | 'env' | 'none' | 'none_dpapi_broken';
+export interface CredentialResolutionTrace {
+    shieldKeySource: ShieldKeySource;
+    dpapiAttempted: boolean;
+    at: string;
+}
+export declare function getCredentialResolutionTrace(): CredentialResolutionTrace | undefined;
 /** Merge saved ~/.fullcourtdefense.yml + env + optional CLI flag overrides. */
 export declare function resolveCliCredentials(config: BotGuardConfig, overrides?: Partial<ResolvedCliCredentials>, options?: {
     skipDpapi?: boolean;

package/dist/config.js

@@ -35,11 +35,14 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DPAPI_DECRYPT_SNIPPET = void 0;
 exports.getPowershellHealth = getPowershellHealth;
+exports.capturePowershellLanguageMode = capturePowershellLanguageMode;
+exports.dpapiRoundtripProbe = dpapiRoundtripProbe;
 exports.getHomeConfigPath = getHomeConfigPath;
 exports.loadConfig = loadConfig;
 exports.getDefaultConfigPath = getDefaultConfigPath;
 exports.saveShieldConfig = saveShieldConfig;
 exports.daemonHandoffShieldKey = daemonHandoffShieldKey;
+exports.getCredentialResolutionTrace = getCredentialResolutionTrace;
 exports.resolveCliCredentials = resolveCliCredentials;
 exports.resolveCliCredentialsShellFree = resolveCliCredentialsShellFree;
 exports.isCliSetupComplete = isCliSetupComplete;
@@ -50,6 +53,8 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
+const distress_1 = require("./distress");
+const credentialStore_1 = require("./credentialStore");
 const CONFIG_FILENAMES = [
     '.fullcourtdefense.yml',
     '.fullcourtdefense.yaml',
@@ -162,6 +167,30 @@ let powershellHealth;
 function getPowershellHealth() {
     return powershellHealth;
 }
+/**
+ * PowerShell language mode — the "is this a hardened WDAC/AppLocker fleet
+ * machine?" bit that explained the lptx1110 incident. Spawned only on the
+ * DPAPI failure path (and from the deep self-test), never on healthy runs.
+ */
+function capturePowershellLanguageMode() {
+    if (process.platform !== 'win32')
+        return undefined;
+    for (const shell of ['powershell.exe', 'pwsh.exe']) {
+        try {
+            const raw = (0, child_process_1.execFileSync)(shell, [
+                '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass',
+                '-Command', '$ExecutionContext.SessionState.LanguageMode',
+            ], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 15_000, windowsHide: true }).trim();
+            if (raw) {
+                if (powershellHealth)
+                    powershellHealth.languageMode = raw;
+                return raw;
+            }
+        }
+        catch { /* try the next shell */ }
+    }
+    return undefined;
+}
 function powershellDpapi(script, value) {
     if (process.platform !== 'win32' || !value)
         return undefined;
@@ -216,7 +245,44 @@ function protectShieldKeyForCurrentWindowsUser(value) {
  */
 exports.DPAPI_DECRYPT_SNIPPET = "$secure=ConvertTo-SecureString -String $env:FCD_DPAPI_VALUE; (New-Object System.Management.Automation.PSCredential('fcd', $secure)).GetNetworkCredential().Password";
 function unprotectShieldKeyForCurrentWindowsUser(value) {
-    return powershellDpapi(exports.DPAPI_DECRYPT_SNIPPET, value);
+    const result = powershellDpapi(exports.DPAPI_DECRYPT_SNIPPET, value);
+    if (!result && value) {
+        // The machine HAS a DPAPI-protected key it cannot read — the exact
+        // credential-broken state that 401-bricked lptx1110. Emit a coded
+        // distress signal so the fleet console sees it without asking the user.
+        const health = powershellHealth;
+        if (health && !health.spawnOk) {
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.POWERSHELL_BLOCKED, 'powershell.exe and pwsh.exe both failed to start (EDR/AppLocker?)');
+        }
+        else {
+            const mode = capturePowershellLanguageMode();
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.DPAPI_DECRYPT_FAILED, mode ? `language mode: ${mode}` : 'decrypt returned nothing');
+            if (mode && mode !== 'FullLanguage') {
+                (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.POWERSHELL_CONSTRAINED, `PowerShell language mode is ${mode}`);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Deep self-test probe: encrypt AND decrypt a throwaway value with the exact
+ * DPAPI snippets used for the shield key. Encryption alone can succeed on a
+ * machine that can never decrypt (the pre-v1.21.32 bricking bug) — only the
+ * full roundtrip proves the credential store works.
+ */
+function dpapiRoundtripProbe() {
+    if (process.platform !== 'win32')
+        return { ok: true, detail: 'not applicable (non-Windows)' };
+    const probe = `fcd-selftest-${Date.now()}`;
+    const encrypted = protectShieldKeyForCurrentWindowsUser(probe);
+    if (!encrypted) {
+        const health = powershellHealth;
+        return { ok: false, detail: health && !health.spawnOk ? 'PowerShell would not start (EDR/AppLocker?)' : 'DPAPI encrypt produced nothing' };
+    }
+    const decrypted = powershellDpapi(exports.DPAPI_DECRYPT_SNIPPET, encrypted);
+    if (decrypted === probe)
+        return { ok: true, detail: 'encrypt + decrypt roundtrip OK' };
+    return { ok: false, detail: decrypted ? 'decrypt returned a different value (profile mismatch?)' : 'decrypt returned nothing (CLM/EDR block?)' };
 }
 function mergeConfig(base, override) {
     return {
@@ -274,8 +340,83 @@ const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 function daemonHandoffShieldKey(env = process.env) {
     return env.FCD_SHIELD_ID && env.FCD_SHIELD_KEY ? env.FCD_SHIELD_KEY : undefined;
 }
+let lastCredentialTrace;
+function getCredentialResolutionTrace() {
+    return lastCredentialTrace;
+}
+// Once per process: hooks are short-lived (one attempt each) and the daemon
+// long-lived (must not hammer the Credential Manager every 30s poll).
+let nativeMigrationAttempted = false;
+function maybeMigrateShieldKeyToNativeStore(shieldId, shieldKey) {
+    if (nativeMigrationAttempted || !(0, credentialStore_1.nativeCredentialStoreAvailable)())
+        return;
+    nativeMigrationAttempted = true;
+    try {
+        if ((0, credentialStore_1.readShieldKeyNative)(shieldId))
+            return; // already migrated
+        (0, credentialStore_1.saveShieldKeyNative)(shieldId, shieldKey); // read-back verified inside
+    }
+    catch { /* migration is opportunistic — legacy sources keep working */ }
+}
 /** Merge saved ~/.fullcourtdefense.yml + env + optional CLI flag overrides. */
 function resolveCliCredentials(config, overrides = {}, options = {}) {
+    // Shield key: same precedence as the old || chain, evaluated stepwise so
+    // (a) the DPAPI decrypt stays lazy — no powershell.exe spawn when an
+    // earlier source wins — and (b) the winning source is recorded for the
+    // diagnostics trace.
+    let shieldKey = overrides.shieldKey;
+    let shieldKeySource = shieldKey ? 'override' : 'none';
+    let dpapiAttempted = false;
+    const resolvedShieldId = overrides.shieldId
+        || config.shieldId
+        || process.env.FCD_SHIELD_ID
+        || process.env.FULLCOURTDEFENSE_SHIELD_ID
+        || process.env.AGENTGUARD_SHIELD_ID;
+    if (!shieldKey) {
+        // Daemon handoff BEFORE the DPAPI decrypt: no powershell.exe spawn at
+        // all during daemon-driven sweeps (see daemonHandoffShieldKey docs).
+        shieldKey = daemonHandoffShieldKey();
+        if (shieldKey)
+            shieldKeySource = 'daemon_handoff';
+    }
+    if (!shieldKey && resolvedShieldId) {
+        // Native Credential Manager BEFORE the DPAPI/PowerShell decrypt: an
+        // in-process win32 API read that EDRs don't flag and CLM can't constrain.
+        // Silently absent on machines that never migrated (see the migration
+        // below) — the DPAPI chain still stands behind it.
+        shieldKey = (0, credentialStore_1.readShieldKeyNative)(resolvedShieldId);
+        if (shieldKey)
+            shieldKeySource = 'native_store';
+    }
+    if (!shieldKey && !options.skipDpapi && config.shieldKeyDpapi) {
+        dpapiAttempted = true;
+        shieldKey = unprotectShieldKeyForCurrentWindowsUser(config.shieldKeyDpapi);
+        if (shieldKey)
+            shieldKeySource = 'dpapi';
+    }
+    if (!shieldKey && config.shieldKey) {
+        shieldKey = config.shieldKey;
+        shieldKeySource = 'plaintext_config';
+    }
+    if (!shieldKey) {
+        shieldKey = process.env.FCD_SHIELD_KEY
+            || process.env.FULLCOURTDEFENSE_SHIELD_KEY
+            || process.env.AGENTGUARD_SHIELD_KEY;
+        if (shieldKey)
+            shieldKeySource = 'env';
+    }
+    if (!shieldKey && dpapiAttempted)
+        shieldKeySource = 'none_dpapi_broken';
+    lastCredentialTrace = { shieldKeySource, dpapiAttempted, at: new Date().toISOString() };
+    // Self-healing migration: whenever the key still resolves through a legacy
+    // source (DPAPI blob or plaintext config), copy it into the Credential
+    // Manager once. On fleets like lptx1110 the daemon's context CAN decrypt
+    // while IDE-spawned hooks CANNOT — after the daemon's first resolution the
+    // native entry exists and every process reads it without PowerShell.
+    if (shieldKey && resolvedShieldId
+        && (shieldKeySource === 'dpapi' || shieldKeySource === 'plaintext_config')) {
+        maybeMigrateShieldKeyToNativeStore(resolvedShieldId, shieldKey);
+    }
     return {
         apiKey: overrides.apiKey
             || config.apiKey
@@ -292,15 +433,7 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
             || process.env.FCD_SHIELD_ID
             || process.env.FULLCOURTDEFENSE_SHIELD_ID
             || process.env.AGENTGUARD_SHIELD_ID,
-        shieldKey: overrides.shieldKey
-            // Daemon handoff BEFORE the DPAPI decrypt: no powershell.exe spawn at
-            // all during daemon-driven sweeps (see daemonHandoffShieldKey docs).
-            || daemonHandoffShieldKey()
-            || (options.skipDpapi ? undefined : unprotectShieldKeyForCurrentWindowsUser(config.shieldKeyDpapi || ''))
-            || config.shieldKey
-            || process.env.FCD_SHIELD_KEY
-            || process.env.FULLCOURTDEFENSE_SHIELD_KEY
-            || process.env.AGENTGUARD_SHIELD_KEY,
+        shieldKey,
     };
 }
 /**
@@ -360,6 +493,13 @@ function writeSetupConfig(target, input) {
     setTopLevel('apiKey', input.apiKey);
     setTopLevel('organizationId', input.organizationId);
     setTopLevel('shieldId', input.shieldId);
+    // Native Credential Manager write (read-back verified) — the store hooks
+    // read WITHOUT PowerShell. The DPAPI blob below is still written when it
+    // verifies: rolling back to a ≤1.21.33 CLI keeps working, and machines
+    // where the native binding is blocked keep their PowerShell path.
+    if (input.shieldKey && input.shieldId) {
+        (0, credentialStore_1.saveShieldKeyNative)(input.shieldId, input.shieldKey);
+    }
     const protectedShieldKey = input.shieldKey && process.platform === 'win32'
         ? protectShieldKeyForCurrentWindowsUser(input.shieldKey)
         : undefined;

package/dist/credentialStore.d.ts

@@ -0,0 +1,19 @@
+export declare function nativeCredentialStoreAvailable(): boolean;
+/** Read the shield key from the Credential Manager. Undefined when absent/unavailable. */
+export declare function readShieldKeyNative(shieldId: string): string | undefined;
+/**
+ * Store the shield key, read-back verified. Returns false when the native
+ * store is unavailable or the verify failed — callers keep their fallback.
+ */
+export declare function saveShieldKeyNative(shieldId: string, shieldKey: string): boolean;
+/** Remove the entry (unenroll / re-enroll cleanup). Best-effort. */
+export declare function deleteShieldKeyNative(shieldId: string): void;
+/**
+ * Deep self-test probe: write + read + delete a throwaway entry with the exact
+ * code paths used for the shield key. Proves the native store works end-to-end
+ * on THIS machine under the current EDR/policy regime.
+ */
+export declare function nativeStoreRoundtripProbe(): {
+    ok: boolean;
+    detail: string;
+};