fullcourtdefense-cli 1.21.34 → 1.21.35

package/dist/commands/daemon.js

@@ -1029,6 +1029,9 @@ async function runDaemon(args, config) {
     // Self-heal autostart + watchdog tasks: machines installed by older versions
     // (or where task creation failed once) must converge without a reinstall.
     ensureWindowsAutostartHealthy(log);
+    // Converge pre-Node-updater machines onto the PowerShell-free updater task
+    // (best-effort; needs an elevated daemon to rewrite a SYSTEM task).
+    (0, selfUpdate_1.modernizeUpdaterTask)(log);
     const watched = refreshWatchTargets();
     log(`Watching ${watched} config file(s) across ${watchers.size} director${watchers.size === 1 ? 'y' : 'ies'}.`);
     // First: if this boot IS the post-upgrade relaunch, confirm the pending

package/dist/commands/shellGuard.d.ts

@@ -39,6 +39,13 @@ export declare function evaluateShellCommand(line: string, rules?: ShellGuardRul
  * No-op unless the guard is installed. Never throws.
  */
 export declare function refreshShellGuardRules(): void;
+/**
+ * The user's Documents folder from the shell-folder registry entry — the one
+ * place that knows about OneDrive/folder redirection. reg.exe is a plain
+ * system utility (not a scripting engine), so EDRs that block powershell.exe
+ * do not block this.
+ */
+export declare function resolveDocumentsFolder(): string;
 export interface ShellGuardStatus {
     supported: boolean;
     installed: boolean;

package/dist/commands/shellGuard.js

@@ -37,6 +37,7 @@ exports.writeShellGuardRules = writeShellGuardRules;
 exports.activeShellGuardRules = activeShellGuardRules;
 exports.evaluateShellCommand = evaluateShellCommand;
 exports.refreshShellGuardRules = refreshShellGuardRules;
+exports.resolveDocumentsFolder = resolveDocumentsFolder;
 exports.getShellGuardStatus = getShellGuardStatus;
 exports.isShellGuardInstalled = isShellGuardInstalled;
 exports.installShellGuardCommand = installShellGuardCommand;
@@ -510,30 +511,57 @@ function buildGuardPs1(nodePath, cliEntry) {
     ];
     return lines.join('\r\n');
 }
-/** Resolve each PowerShell engine's CurrentUserAllHosts profile path. */
-function resolveProfilePaths() {
-    const out = [];
-    for (const engine of ['powershell.exe', 'pwsh.exe']) {
-        try {
-            const result = (0, child_process_1.spawnSync)(engine, ['-NoProfile', '-NonInteractive', '-Command', 'Write-Output $PROFILE.CurrentUserAllHosts'], {
-                encoding: 'utf8', windowsHide: true, timeout: 15000,
-            });
-            const profilePath = (result.stdout || '').trim().split(/\r?\n/).pop()?.trim();
-            if (result.status === 0 && profilePath && /\.ps1$/i.test(profilePath)) {
-                out.push({ engine: engine.replace(/\.exe$/i, ''), profilePath });
-            }
+/**
+ * The user's Documents folder from the shell-folder registry entry — the one
+ * place that knows about OneDrive/folder redirection. reg.exe is a plain
+ * system utility (not a scripting engine), so EDRs that block powershell.exe
+ * do not block this.
+ */
+function resolveDocumentsFolder() {
+    try {
+        const run = (0, child_process_1.spawnSync)('reg', [
+            'query', 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders', '/v', 'Personal',
+        ], { encoding: 'utf8', windowsHide: true, timeout: 10_000 });
+        const raw = ((run.stdout || '').match(/Personal\s+REG_(?:EXPAND_)?SZ\s+(.+)/) || [])[1]?.trim();
+        if (run.status === 0 && raw) {
+            const expanded = raw.replace(/%([^%]+)%/g, (_, name) => process.env[name] ?? `%${name}%`);
+            if (!expanded.includes('%'))
+                return expanded;
         }
-        catch { /* engine not installed */ }
     }
-    // Dedupe (both engines can share a profile only if paths match — normally they differ).
-    const seen = new Set();
-    return out.filter(entry => {
-        const key = entry.profilePath.toLowerCase();
-        if (seen.has(key))
-            return false;
-        seen.add(key);
+    catch { /* registry unreadable — fall through */ }
+    return path.join(os.homedir(), 'Documents');
+}
+function pwshInstalled() {
+    const programFiles = process.env.ProgramFiles || 'C:\\Program Files';
+    if (fs.existsSync(path.join(programFiles, 'PowerShell', '7', 'pwsh.exe'))
+        || fs.existsSync(path.join(programFiles, 'PowerShell', '7-preview', 'pwsh.exe')))
         return true;
-    });
+    for (const dir of (process.env.PATH || '').split(path.delimiter)) {
+        try {
+            if (dir && fs.existsSync(path.join(dir, 'pwsh.exe')))
+                return true;
+        }
+        catch { /* keep looking */ }
+    }
+    return false;
+}
+/**
+ * Resolve each PowerShell engine's CurrentUserAllHosts profile path WITHOUT
+ * spawning PowerShell. $PROFILE.CurrentUserAllHosts is deterministic:
+ * <Documents>\WindowsPowerShell\profile.ps1 (Windows PowerShell, always
+ * present on Windows) and <Documents>\PowerShell\profile.ps1 (pwsh, when
+ * installed). Asking the engines themselves was both an EDR flag risk and
+ * wrong on machines where EDR blocks PowerShell — the guard then silently
+ * skipped profile installation on exactly the fleets that want it most.
+ */
+function resolveProfilePaths() {
+    const documents = resolveDocumentsFolder();
+    const out = [{ engine: 'powershell', profilePath: path.join(documents, 'WindowsPowerShell', 'profile.ps1') }];
+    if (pwshInstalled()) {
+        out.push({ engine: 'pwsh', profilePath: path.join(documents, 'PowerShell', 'profile.ps1') });
+    }
+    return out;
 }
 function profileSnippet() {
     return [

package/dist/selfUpdate.d.ts

@@ -26,6 +26,28 @@ export interface SelfUpdateResult {
     detail: string;
 }
 export declare function resolveNpmCommand(platform?: NodeJS.Platform, execPath?: string, exists?: typeof fs.existsSync): string;
+/**
+ * The updater task command for an install root. Prefers the Node updater
+ * (runs on the MSI's own bundled runtime — no powershell.exe spawn, which
+ * EDR/AppLocker block on hardened fleets); the PowerShell script remains the
+ * command only for old payloads that predate the Node updater. Escaped for
+ * `schtasks /TR` (embedded quotes as \").
+ */
+export declare function buildUpdaterTaskCommand(root: string, exists?: (p: string) => boolean): string | undefined;
+/**
+ * True when a registered task command still points at the PowerShell updater
+ * while this install carries the Node updater — i.e. the task predates the
+ * PowerShell-free updater and should be re-registered.
+ */
+export declare function updaterTaskNeedsModernization(taskToRun: string, root: string, exists?: (p: string) => boolean): boolean;
+/**
+ * Upgrade an EXISTING updater task from the PowerShell command to the Node
+ * command. Machines that upgraded from a pre-Node-updater MSI keep their old
+ * task definition (the MSI re-registers it, but registration can be denied);
+ * this converges them whenever a daemon runs elevated. Best-effort: needs an
+ * elevated token to re-register a SYSTEM task, silent no-op otherwise.
+ */
+export declare function modernizeUpdaterTask(log: (message: string) => void): void;
 /**
  * Updater script log (%ProgramData%\FullCourtDefense\updater.log) — the
  * elevated task's own words. Read by the diagnostics bundle and the update-

package/dist/selfUpdate.js

@@ -37,6 +37,9 @@ exports.MSI_UPDATER_TASK_NAME = void 0;
 exports.detectInstallKind = detectInstallKind;
 exports.compareCliVersions = compareCliVersions;
 exports.resolveNpmCommand = resolveNpmCommand;
+exports.buildUpdaterTaskCommand = buildUpdaterTaskCommand;
+exports.updaterTaskNeedsModernization = updaterTaskNeedsModernization;
+exports.modernizeUpdaterTask = modernizeUpdaterTask;
 exports.readUpdaterLogTail = readUpdaterLogTail;
 exports.maybeSelfUpdate = maybeSelfUpdate;
 exports.installedMsiVersion = installedMsiVersion;
@@ -133,7 +136,38 @@ function msiInstallRoot() {
     // dist\index.js → install root is the parent of dist.
     const dist = path.dirname(entry);
     const root = path.dirname(dist);
-    return fs.existsSync(path.join(root, 'Update-FullCourtDefense.ps1')) ? root : undefined;
+    const hasUpdater = fs.existsSync(path.join(root, 'Update-FullCourtDefense.js'))
+        || fs.existsSync(path.join(root, 'Update-FullCourtDefense.ps1'));
+    return hasUpdater ? root : undefined;
+}
+/**
+ * The updater task command for an install root. Prefers the Node updater
+ * (runs on the MSI's own bundled runtime — no powershell.exe spawn, which
+ * EDR/AppLocker block on hardened fleets); the PowerShell script remains the
+ * command only for old payloads that predate the Node updater. Escaped for
+ * `schtasks /TR` (embedded quotes as \").
+ */
+function buildUpdaterTaskCommand(root, exists = fs.existsSync) {
+    const nodeExe = path.join(root, 'runtime', 'node.exe');
+    const jsUpdater = path.join(root, 'Update-FullCourtDefense.js');
+    if (exists(nodeExe) && exists(jsUpdater)) {
+        return `\\"${nodeExe}\\" \\"${jsUpdater}\\"`;
+    }
+    const ps1Updater = path.join(root, 'Update-FullCourtDefense.ps1');
+    if (exists(ps1Updater)) {
+        return `powershell.exe -NoProfile -ExecutionPolicy Bypass -File \\"${ps1Updater}\\"`;
+    }
+    return undefined;
+}
+/**
+ * True when a registered task command still points at the PowerShell updater
+ * while this install carries the Node updater — i.e. the task predates the
+ * PowerShell-free updater and should be re-registered.
+ */
+function updaterTaskNeedsModernization(taskToRun, root, exists = fs.existsSync) {
+    if (!/powershell/i.test(taskToRun))
+        return false;
+    return exists(path.join(root, 'Update-FullCourtDefense.js')) && exists(path.join(root, 'runtime', 'node.exe'));
 }
 /**
  * Self-heal a missing updater task. Machines installed from an older MSI (or
@@ -146,8 +180,9 @@ function tryRegisterMsiUpdaterTask(log) {
     const root = msiInstallRoot();
     if (!root)
         return false;
-    const script = path.join(root, 'Update-FullCourtDefense.ps1');
-    const taskCommand = `powershell.exe -NoProfile -ExecutionPolicy Bypass -File \\"${script}\\"`;
+    const taskCommand = buildUpdaterTaskCommand(root);
+    if (!taskCommand)
+        return false;
     const create = (0, child_process_1.spawnSync)('schtasks', [
         '/Create', '/TN', exports.MSI_UPDATER_TASK_NAME, '/TR', taskCommand,
         '/SC', 'DAILY', '/ST', '03:07', '/RU', 'SYSTEM', '/RL', 'HIGHEST', '/F',
@@ -158,6 +193,34 @@ function tryRegisterMsiUpdaterTask(log) {
     }
     return false;
 }
+/**
+ * Upgrade an EXISTING updater task from the PowerShell command to the Node
+ * command. Machines that upgraded from a pre-Node-updater MSI keep their old
+ * task definition (the MSI re-registers it, but registration can be denied);
+ * this converges them whenever a daemon runs elevated. Best-effort: needs an
+ * elevated token to re-register a SYSTEM task, silent no-op otherwise.
+ */
+function modernizeUpdaterTask(log) {
+    if (process.platform !== 'win32')
+        return;
+    try {
+        const root = msiInstallRoot();
+        if (!root)
+            return;
+        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', exports.MSI_UPDATER_TASK_NAME, '/V', '/FO', 'LIST'], {
+            encoding: 'utf8', windowsHide: true, timeout: 15_000,
+        });
+        if (query.status !== 0 || !query.stdout)
+            return;
+        const taskToRun = (query.stdout.match(/^Task To Run:\s*(.*)$/m) || [])[1] || '';
+        if (!updaterTaskNeedsModernization(taskToRun, root))
+            return;
+        if (tryRegisterMsiUpdaterTask(log)) {
+            log('Self-update: updater task modernized to the PowerShell-free Node updater.');
+        }
+    }
+    catch { /* diagnostics-only convergence — never disturb the daemon */ }
+}
 function startMsiSelfUpdate(targetVersion, log) {
     const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', exports.MSI_UPDATER_TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
     if (query.status !== 0 && !tryRegisterMsiUpdaterTask(log)) {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.34"
+  "version": "1.21.35"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.34",
+  "version": "1.21.35",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -49,6 +49,7 @@
     "test:bricked-rescue": "npm run build && node scripts/test-bricked-machine-rescue.js",
     "test:native-credstore": "npm run build && node scripts/test-native-credential-store.js",
     "test:real-life": "npm run build && node scripts/test-real-life-scenarios.js",
+    "test:node-updater": "npm run build && node scripts/test-node-updater.js",
     "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
     "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",