fullcourtdefense-cli 1.21.34 → 1.21.36

package/dist/commands/cmdGuard.d.ts

@@ -19,11 +19,17 @@ export declare function uninstallCmdGuardCommand(): Promise<void>;
 /** Refresh shared rules JSON when cmd guard is installed. */
 export declare function refreshCmdGuardRules(): void;
 /**
- * Self-heal a stale cmd-guard AutoRun: if the registry still references our
- * autorun script but the file was deleted (manual cleanup, interrupted
- * uninstall), EVERY cmd.exe on the machine errors on startup and — worse —
- * poisons `cmd /c` exit codes to 1, making healthy installs/commands look
- * failed. Strips only OUR fragment; a customer's own AutoRun entries survive.
- * Returns true when a repair was applied.
+ * Self-heal a stale/broken cmd-guard AutoRun. Two failure shapes are covered:
+ *
+ *  1. Registry references our autorun bat but the FILE was deleted (manual
+ *     cleanup, interrupted uninstall) — every cmd.exe errors on startup and
+ *     poisons `cmd /c` exit codes to 1.
+ *  2. The bat EXISTS but its doskey macros point at a node.exe or checker
+ *     script that no longer exists (uninstall/upgrade removed the install
+ *     root but left the per-user bat) — every wrapped command (docker, git,
+ *     kubectl, …) fails with "cannot find the path specified".
+ *
+ * In both cases: strip OUR fragment from AutoRun (a customer's own entries
+ * survive) and delete our orphaned guard files. Returns true when repaired.
  */
 export declare function repairStaleCmdAutorun(): boolean;

package/dist/commands/cmdGuard.js

@@ -142,6 +142,11 @@ function buildAutorunBat(nodePath) {
         'REM Remove permanently: fullcourtdefense uninstall-cmd-guard',
         'if defined FCD_CMD_AUTORUN_DONE goto :eof',
         'set FCD_CMD_AUTORUN_DONE=1',
+        // FAIL OPEN: if the runtime or checker is gone (uninstall/upgrade left this
+        // bat behind), register NO macros — wrapped commands (docker, git, kubectl…)
+        // must keep working natively. Never break the customer's tools.
+        `if not exist ${node} goto :eof`,
+        `if not exist ${guardJs} goto :eof`,
         ...doskeyLines,
         '',
     ].join('\r\n');
@@ -266,12 +271,26 @@ function refreshCmdGuardRules() {
     catch { /* best-effort */ }
 }
 /**
- * Self-heal a stale cmd-guard AutoRun: if the registry still references our
- * autorun script but the file was deleted (manual cleanup, interrupted
- * uninstall), EVERY cmd.exe on the machine errors on startup and — worse —
- * poisons `cmd /c` exit codes to 1, making healthy installs/commands look
- * failed. Strips only OUR fragment; a customer's own AutoRun entries survive.
- * Returns true when a repair was applied.
+ * The node.exe path baked into an installed autorun bat's doskey macros.
+ * Format written by buildAutorunBat: `doskey <cmd>="<node>" "<guardJs>" <cmd> $*`.
+ */
+function autorunBatNodePath(batContent) {
+    const match = batContent.match(/^doskey\s+\S+="([^"]+)"\s/m);
+    return match ? match[1] : undefined;
+}
+/**
+ * Self-heal a stale/broken cmd-guard AutoRun. Two failure shapes are covered:
+ *
+ *  1. Registry references our autorun bat but the FILE was deleted (manual
+ *     cleanup, interrupted uninstall) — every cmd.exe errors on startup and
+ *     poisons `cmd /c` exit codes to 1.
+ *  2. The bat EXISTS but its doskey macros point at a node.exe or checker
+ *     script that no longer exists (uninstall/upgrade removed the install
+ *     root but left the per-user bat) — every wrapped command (docker, git,
+ *     kubectl, …) fails with "cannot find the path specified".
+ *
+ * In both cases: strip OUR fragment from AutoRun (a customer's own entries
+ * survive) and delete our orphaned guard files. Returns true when repaired.
  */
 function repairStaleCmdAutorun() {
     try {
@@ -280,8 +299,20 @@ function repairStaleCmdAutorun() {
         const current = readCurrentAutorun();
         if (!current.includes(AUTORUN_MARKER))
             return false;
-        if (fs.existsSync(AUTORUN_BAT_PATH))
-            return false;
+        if (fs.existsSync(AUTORUN_BAT_PATH)) {
+            // Bat present — only stale when its macro targets are gone.
+            let bat = '';
+            try {
+                bat = fs.readFileSync(AUTORUN_BAT_PATH, 'utf8');
+            }
+            catch {
+                return false;
+            }
+            const nodePath = autorunBatNodePath(bat);
+            const runtimeAlive = (!nodePath || fs.existsSync(nodePath)) && fs.existsSync(GUARD_JS_PATH);
+            if (runtimeAlive)
+                return false;
+        }
         const next = stripAutorunValue(current);
         if (next) {
             setRegString(CMD_AUTORUN_KEY, AUTORUN_VALUE, next);
@@ -291,6 +322,14 @@ function repairStaleCmdAutorun() {
                 windowsHide: true, timeout: 10000, stdio: ['ignore', 'pipe', 'ignore'],
             });
         }
+        try {
+            fs.unlinkSync(AUTORUN_BAT_PATH);
+        }
+        catch { /* already gone */ }
+        try {
+            fs.unlinkSync(GUARD_JS_PATH);
+        }
+        catch { /* already gone */ }
         return true;
     }
     catch {

package/dist/commands/daemon.js

@@ -63,6 +63,7 @@ const integrity_1 = require("../integrity");
 const machineIdentity_1 = require("../machineIdentity");
 const discoveryMarker_1 = require("../discoveryMarker");
 const selfUpdate_1 = require("../selfUpdate");
+const cmdGuard_1 = require("./cmdGuard");
 const machineActionVerify_1 = require("../machineActionVerify");
 const desktopChatGuard_1 = require("./desktopChatGuard");
 const honeypot_1 = require("../honeypot");
@@ -1029,6 +1030,14 @@ async function runDaemon(args, config) {
     // Self-heal autostart + watchdog tasks: machines installed by older versions
     // (or where task creation failed once) must converge without a reinstall.
     ensureWindowsAutostartHealthy(log);
+    // Converge pre-Node-updater machines onto the PowerShell-free updater task
+    // (best-effort; needs an elevated daemon to rewrite a SYSTEM task).
+    (0, selfUpdate_1.modernizeUpdaterTask)(log);
+    // Heal a stale/broken cmd-guard AutoRun (bat deleted, or macros pointing at
+    // a dead node.exe) so wrapped commands (docker, git, …) never stay broken.
+    if ((0, cmdGuard_1.repairStaleCmdAutorun)()) {
+        log('Repaired a stale cmd.exe AutoRun / doskey guard left by an earlier install.');
+    }
     const watched = refreshWatchTargets();
     log(`Watching ${watched} config file(s) across ${watchers.size} director${watchers.size === 1 ? 'y' : 'ies'}.`);
     // First: if this boot IS the post-upgrade relaunch, confirm the pending

package/dist/commands/shellGuard.d.ts

@@ -39,6 +39,13 @@ export declare function evaluateShellCommand(line: string, rules?: ShellGuardRul
  * No-op unless the guard is installed. Never throws.
  */
 export declare function refreshShellGuardRules(): void;
+/**
+ * The user's Documents folder from the shell-folder registry entry — the one
+ * place that knows about OneDrive/folder redirection. reg.exe is a plain
+ * system utility (not a scripting engine), so EDRs that block powershell.exe
+ * do not block this.
+ */
+export declare function resolveDocumentsFolder(): string;
 export interface ShellGuardStatus {
     supported: boolean;
     installed: boolean;

package/dist/commands/shellGuard.js

@@ -37,6 +37,7 @@ exports.writeShellGuardRules = writeShellGuardRules;
 exports.activeShellGuardRules = activeShellGuardRules;
 exports.evaluateShellCommand = evaluateShellCommand;
 exports.refreshShellGuardRules = refreshShellGuardRules;
+exports.resolveDocumentsFolder = resolveDocumentsFolder;
 exports.getShellGuardStatus = getShellGuardStatus;
 exports.isShellGuardInstalled = isShellGuardInstalled;
 exports.installShellGuardCommand = installShellGuardCommand;
@@ -510,30 +511,57 @@ function buildGuardPs1(nodePath, cliEntry) {
     ];
     return lines.join('\r\n');
 }
-/** Resolve each PowerShell engine's CurrentUserAllHosts profile path. */
-function resolveProfilePaths() {
-    const out = [];
-    for (const engine of ['powershell.exe', 'pwsh.exe']) {
-        try {
-            const result = (0, child_process_1.spawnSync)(engine, ['-NoProfile', '-NonInteractive', '-Command', 'Write-Output $PROFILE.CurrentUserAllHosts'], {
-                encoding: 'utf8', windowsHide: true, timeout: 15000,
-            });
-            const profilePath = (result.stdout || '').trim().split(/\r?\n/).pop()?.trim();
-            if (result.status === 0 && profilePath && /\.ps1$/i.test(profilePath)) {
-                out.push({ engine: engine.replace(/\.exe$/i, ''), profilePath });
-            }
+/**
+ * The user's Documents folder from the shell-folder registry entry — the one
+ * place that knows about OneDrive/folder redirection. reg.exe is a plain
+ * system utility (not a scripting engine), so EDRs that block powershell.exe
+ * do not block this.
+ */
+function resolveDocumentsFolder() {
+    try {
+        const run = (0, child_process_1.spawnSync)('reg', [
+            'query', 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders', '/v', 'Personal',
+        ], { encoding: 'utf8', windowsHide: true, timeout: 10_000 });
+        const raw = ((run.stdout || '').match(/Personal\s+REG_(?:EXPAND_)?SZ\s+(.+)/) || [])[1]?.trim();
+        if (run.status === 0 && raw) {
+            const expanded = raw.replace(/%([^%]+)%/g, (_, name) => process.env[name] ?? `%${name}%`);
+            if (!expanded.includes('%'))
+                return expanded;
         }
-        catch { /* engine not installed */ }
     }
-    // Dedupe (both engines can share a profile only if paths match — normally they differ).
-    const seen = new Set();
-    return out.filter(entry => {
-        const key = entry.profilePath.toLowerCase();
-        if (seen.has(key))
-            return false;
-        seen.add(key);
+    catch { /* registry unreadable — fall through */ }
+    return path.join(os.homedir(), 'Documents');
+}
+function pwshInstalled() {
+    const programFiles = process.env.ProgramFiles || 'C:\\Program Files';
+    if (fs.existsSync(path.join(programFiles, 'PowerShell', '7', 'pwsh.exe'))
+        || fs.existsSync(path.join(programFiles, 'PowerShell', '7-preview', 'pwsh.exe')))
         return true;
-    });
+    for (const dir of (process.env.PATH || '').split(path.delimiter)) {
+        try {
+            if (dir && fs.existsSync(path.join(dir, 'pwsh.exe')))
+                return true;
+        }
+        catch { /* keep looking */ }
+    }
+    return false;
+}
+/**
+ * Resolve each PowerShell engine's CurrentUserAllHosts profile path WITHOUT
+ * spawning PowerShell. $PROFILE.CurrentUserAllHosts is deterministic:
+ * <Documents>\WindowsPowerShell\profile.ps1 (Windows PowerShell, always
+ * present on Windows) and <Documents>\PowerShell\profile.ps1 (pwsh, when
+ * installed). Asking the engines themselves was both an EDR flag risk and
+ * wrong on machines where EDR blocks PowerShell — the guard then silently
+ * skipped profile installation on exactly the fleets that want it most.
+ */
+function resolveProfilePaths() {
+    const documents = resolveDocumentsFolder();
+    const out = [{ engine: 'powershell', profilePath: path.join(documents, 'WindowsPowerShell', 'profile.ps1') }];
+    if (pwshInstalled()) {
+        out.push({ engine: 'pwsh', profilePath: path.join(documents, 'PowerShell', 'profile.ps1') });
+    }
+    return out;
 }
 function profileSnippet() {
     return [

package/dist/selfUpdate.d.ts

@@ -26,6 +26,28 @@ export interface SelfUpdateResult {
     detail: string;
 }
 export declare function resolveNpmCommand(platform?: NodeJS.Platform, execPath?: string, exists?: typeof fs.existsSync): string;
+/**
+ * The updater task command for an install root. Prefers the Node updater
+ * (runs on the MSI's own bundled runtime — no powershell.exe spawn, which
+ * EDR/AppLocker block on hardened fleets); the PowerShell script remains the
+ * command only for old payloads that predate the Node updater. Escaped for
+ * `schtasks /TR` (embedded quotes as \").
+ */
+export declare function buildUpdaterTaskCommand(root: string, exists?: (p: string) => boolean): string | undefined;
+/**
+ * True when a registered task command still points at the PowerShell updater
+ * while this install carries the Node updater — i.e. the task predates the
+ * PowerShell-free updater and should be re-registered.
+ */
+export declare function updaterTaskNeedsModernization(taskToRun: string, root: string, exists?: (p: string) => boolean): boolean;
+/**
+ * Upgrade an EXISTING updater task from the PowerShell command to the Node
+ * command. Machines that upgraded from a pre-Node-updater MSI keep their old
+ * task definition (the MSI re-registers it, but registration can be denied);
+ * this converges them whenever a daemon runs elevated. Best-effort: needs an
+ * elevated token to re-register a SYSTEM task, silent no-op otherwise.
+ */
+export declare function modernizeUpdaterTask(log: (message: string) => void): void;
 /**
  * Updater script log (%ProgramData%\FullCourtDefense\updater.log) — the
  * elevated task's own words. Read by the diagnostics bundle and the update-

package/dist/selfUpdate.js

@@ -37,6 +37,9 @@ exports.MSI_UPDATER_TASK_NAME = void 0;
 exports.detectInstallKind = detectInstallKind;
 exports.compareCliVersions = compareCliVersions;
 exports.resolveNpmCommand = resolveNpmCommand;
+exports.buildUpdaterTaskCommand = buildUpdaterTaskCommand;
+exports.updaterTaskNeedsModernization = updaterTaskNeedsModernization;
+exports.modernizeUpdaterTask = modernizeUpdaterTask;
 exports.readUpdaterLogTail = readUpdaterLogTail;
 exports.maybeSelfUpdate = maybeSelfUpdate;
 exports.installedMsiVersion = installedMsiVersion;
@@ -133,7 +136,38 @@ function msiInstallRoot() {
     // dist\index.js → install root is the parent of dist.
     const dist = path.dirname(entry);
     const root = path.dirname(dist);
-    return fs.existsSync(path.join(root, 'Update-FullCourtDefense.ps1')) ? root : undefined;
+    const hasUpdater = fs.existsSync(path.join(root, 'Update-FullCourtDefense.js'))
+        || fs.existsSync(path.join(root, 'Update-FullCourtDefense.ps1'));
+    return hasUpdater ? root : undefined;
+}
+/**
+ * The updater task command for an install root. Prefers the Node updater
+ * (runs on the MSI's own bundled runtime — no powershell.exe spawn, which
+ * EDR/AppLocker block on hardened fleets); the PowerShell script remains the
+ * command only for old payloads that predate the Node updater. Escaped for
+ * `schtasks /TR` (embedded quotes as \").
+ */
+function buildUpdaterTaskCommand(root, exists = fs.existsSync) {
+    const nodeExe = path.join(root, 'runtime', 'node.exe');
+    const jsUpdater = path.join(root, 'Update-FullCourtDefense.js');
+    if (exists(nodeExe) && exists(jsUpdater)) {
+        return `\\"${nodeExe}\\" \\"${jsUpdater}\\"`;
+    }
+    const ps1Updater = path.join(root, 'Update-FullCourtDefense.ps1');
+    if (exists(ps1Updater)) {
+        return `powershell.exe -NoProfile -ExecutionPolicy Bypass -File \\"${ps1Updater}\\"`;
+    }
+    return undefined;
+}
+/**
+ * True when a registered task command still points at the PowerShell updater
+ * while this install carries the Node updater — i.e. the task predates the
+ * PowerShell-free updater and should be re-registered.
+ */
+function updaterTaskNeedsModernization(taskToRun, root, exists = fs.existsSync) {
+    if (!/powershell/i.test(taskToRun))
+        return false;
+    return exists(path.join(root, 'Update-FullCourtDefense.js')) && exists(path.join(root, 'runtime', 'node.exe'));
 }
 /**
  * Self-heal a missing updater task. Machines installed from an older MSI (or
@@ -146,8 +180,9 @@ function tryRegisterMsiUpdaterTask(log) {
     const root = msiInstallRoot();
     if (!root)
         return false;
-    const script = path.join(root, 'Update-FullCourtDefense.ps1');
-    const taskCommand = `powershell.exe -NoProfile -ExecutionPolicy Bypass -File \\"${script}\\"`;
+    const taskCommand = buildUpdaterTaskCommand(root);
+    if (!taskCommand)
+        return false;
     const create = (0, child_process_1.spawnSync)('schtasks', [
         '/Create', '/TN', exports.MSI_UPDATER_TASK_NAME, '/TR', taskCommand,
         '/SC', 'DAILY', '/ST', '03:07', '/RU', 'SYSTEM', '/RL', 'HIGHEST', '/F',
@@ -158,6 +193,34 @@ function tryRegisterMsiUpdaterTask(log) {
     }
     return false;
 }
+/**
+ * Upgrade an EXISTING updater task from the PowerShell command to the Node
+ * command. Machines that upgraded from a pre-Node-updater MSI keep their old
+ * task definition (the MSI re-registers it, but registration can be denied);
+ * this converges them whenever a daemon runs elevated. Best-effort: needs an
+ * elevated token to re-register a SYSTEM task, silent no-op otherwise.
+ */
+function modernizeUpdaterTask(log) {
+    if (process.platform !== 'win32')
+        return;
+    try {
+        const root = msiInstallRoot();
+        if (!root)
+            return;
+        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', exports.MSI_UPDATER_TASK_NAME, '/V', '/FO', 'LIST'], {
+            encoding: 'utf8', windowsHide: true, timeout: 15_000,
+        });
+        if (query.status !== 0 || !query.stdout)
+            return;
+        const taskToRun = (query.stdout.match(/^Task To Run:\s*(.*)$/m) || [])[1] || '';
+        if (!updaterTaskNeedsModernization(taskToRun, root))
+            return;
+        if (tryRegisterMsiUpdaterTask(log)) {
+            log('Self-update: updater task modernized to the PowerShell-free Node updater.');
+        }
+    }
+    catch { /* diagnostics-only convergence — never disturb the daemon */ }
+}
 function startMsiSelfUpdate(targetVersion, log) {
     const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', exports.MSI_UPDATER_TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
     if (query.status !== 0 && !tryRegisterMsiUpdaterTask(log)) {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.34"
+  "version": "1.21.36"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.34",
+  "version": "1.21.36",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -49,6 +49,7 @@
     "test:bricked-rescue": "npm run build && node scripts/test-bricked-machine-rescue.js",
     "test:native-credstore": "npm run build && node scripts/test-native-credential-store.js",
     "test:real-life": "npm run build && node scripts/test-real-life-scenarios.js",
+    "test:node-updater": "npm run build && node scripts/test-node-updater.js",
     "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
     "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",