fullcourtdefense-cli 1.22.0 → 1.22.2

package/dist/commands/autoProtect.js

@@ -39,6 +39,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const mcpGateway_1 = require("./mcpGateway");
+const daemon_1 = require("./daemon");
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
     red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
@@ -54,38 +55,40 @@ function launcherDir() {
         : path.join(os.homedir(), '.fullcourtdefense');
     return path.join(base, 'FullCourtDefense');
 }
-/** On Windows, write a hidden VBS launcher so the scheduled run doesn't flash a console window. */
-function ensureWindowsLauncher() {
-    const dir = launcherDir();
-    fs.mkdirSync(dir, { recursive: true });
-    const vbs = path.join(dir, 'auto-protect.vbs');
-    const node = process.execPath;
-    const cli = cliEntry();
-    // WScript.Shell.Run with window style 0 = hidden, wait = false. Run node
-    // directly — `cmd /c` breaks quote parsing under paths with spaces.
-    const inner = `"${node}" "${cli}" protect-all`;
-    const content = `CreateObject("WScript.Shell").Run "${inner.replace(/"/g, '""')}", 0, False\n`;
-    fs.writeFileSync(vbs, content, 'utf8');
-    return vbs;
-}
+// No VBS/wscript launcher here — Windows Defender's Commando.A!ml heuristic
+// flags "scheduled task -> wscript runs a user-writable script on an interval"
+// as script persistence. The task runs node.exe directly, hidden via task XML
+// (shared helpers in daemon.ts).
 function installWindows(intervalMinutes, onLogon) {
-    const vbs = ensureWindowsLauncher();
-    const tr = `wscript.exe "${vbs}"`;
-    const baseArgs = ['/Create', '/TN', TASK_NAME, '/TR', tr, '/F', '/RL', 'LIMITED'];
+    const trigger = onLogon
+        ? `    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${(0, daemon_1.xmlEscape)((0, daemon_1.taskUserId)())}</UserId>
+    </LogonTrigger>`
+        : `    <TimeTrigger>
+      <Enabled>true</Enabled>
+      <StartBoundary>${(0, daemon_1.taskLocalTimestamp)(new Date(Date.now() - 60_000))}</StartBoundary>
+      <Repetition>
+        <Interval>PT${Math.max(1, intervalMinutes)}M</Interval>
+        <StopAtDurationEnd>false</StopAtDurationEnd>
+      </Repetition>
+    </TimeTrigger>`;
     const schedArgs = onLogon
-        ? ['/SC', 'ONLOGON']
-        : ['/SC', 'MINUTE', '/MO', String(intervalMinutes)];
-    const result = (0, child_process_1.spawnSync)('schtasks', [...baseArgs, ...schedArgs], { stdio: 'inherit' });
-    return result.status === 0;
+        ? ['/SC', 'ONLOGON', '/RL', 'LIMITED']
+        : ['/SC', 'MINUTE', '/MO', String(Math.max(1, intervalMinutes)), '/RL', 'LIMITED'];
+    return (0, daemon_1.registerHiddenTask)(TASK_NAME, (0, daemon_1.buildTaskXmlVariants)('protect-all', trigger), 'protect-all', schedArgs);
 }
 function uninstallWindows() {
     const result = (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', TASK_NAME, '/F'], { stdio: 'inherit' });
-    const vbs = path.join(launcherDir(), 'auto-protect.vbs');
-    try {
-        if (fs.existsSync(vbs))
-            fs.unlinkSync(vbs);
+    // Legacy VBS launcher from pre-1.22.1 installs + the current task XML.
+    for (const name of ['auto-protect.vbs', `${TASK_NAME.replace(/[^A-Za-z0-9]+/g, '_')}.task.xml`]) {
+        const file = path.join(launcherDir(), name);
+        try {
+            if (fs.existsSync(file))
+                fs.unlinkSync(file);
+        }
+        catch { /* ignore */ }
     }
-    catch { /* ignore */ }
     return result.status === 0;
 }
 function statusWindows() {

package/dist/commands/daemon.d.ts

@@ -32,6 +32,47 @@ export declare function discoverSweepCredentialEnv(credentials?: {
     shieldKey?: string;
     apiUrl?: string;
 }): Record<string, string>;
+export type TaskLogonType = 'S4U' | 'InteractiveToken';
+/** Fully-qualified current user (DOMAIN\\user) for the task principal. */
+export declare function taskUserId(): string;
+/** Local wall-clock timestamp (no ms, no tz) as Task Scheduler expects. */
+export declare function taskLocalTimestamp(date: Date): string;
+/**
+ * Task Scheduler XML that runs `node.exe <cliEntry> <command>` hidden.
+ *
+ * @param command    CLI subcommand + args ('daemon' | 'watchdog' | 'discover …').
+ * @param triggers   Inner <Triggers> XML — logon for the daemon, a repeating
+ *                   time trigger for the 5-minute watchdog.
+ * @param logonType  S4U (windowless, needs elevation to register) or
+ *                   InteractiveToken (registers unelevated, may flash).
+ */
+export declare function buildTaskXml(command: string, triggers: string, logonType?: TaskLogonType): string;
+/**
+ * Windowless-first XML variants for one task: S4U (no window, needs elevation
+ * to register) first, InteractiveToken (unelevated fallback) second.
+ * registerHiddenTask() tries them in order.
+ */
+export declare function buildTaskXmlVariants(command: string, triggers: string): string[];
+/**
+ * Register a scheduled task from XML (node run directly). Tries each XML
+ * variant in order — S4U (windowless) first, then InteractiveToken — and
+ * finally falls back to a plain `/TR node …` task. The fallbacks may briefly
+ * flash a console window but still contain NO script host, so the malware
+ * fingerprint never returns. Returns true if any path succeeds.
+ *
+ * @param taskName      Scheduled-task name.
+ * @param xml           Task Scheduler XML variant(s), tried in order.
+ * @param command       CLI subcommand for the /TR fallback ('daemon'|'watchdog').
+ * @param scheduleArgs  schtasks schedule flags for the fallback (e.g. ['/SC','MINUTE','/MO','5']).
+ */
+export declare function registerHiddenTask(taskName: string, xml: string | string[], command: string, scheduleArgs: string[]): boolean;
+/** True when an existing scheduled task's action still runs wscript/cscript
+ *  (the pre-1.22.1 VBS launcher) — the migration trigger. */
+export declare function windowsTaskReferencesScriptHost(taskName: string): boolean;
+/** True when an existing task still runs with an InteractiveToken principal —
+ *  the 1.22.1 window-flash bug (console window on every trigger). Migration
+ *  trigger for the windowless S4U principal. */
+export declare function windowsTaskRunsInteractive(taskName: string): boolean;
 /** Snapshot of the resident daemon for out-of-process callers (watchdog/status). */
 export interface DaemonRuntimeState {
     alive: boolean;
@@ -45,6 +86,7 @@ export declare function spawnDetachedDaemon(): boolean;
 /** Pid-alive check shared with the watchdog (EPERM still means alive). */
 export declare function pidIsAlive(pid: number): boolean;
 export declare function macosLaunchdPath(currentPath?: string, execPath?: string): string;
+export declare function xmlEscape(value: string): string;
 /** Whether the daemon has been registered to start automatically. */
 /** Is the 5-minute watchdog scheduled task registered? (Windows-only feature.) */
 export declare function isWatchdogTaskInstalled(): boolean;

package/dist/commands/daemon.js

@@ -36,10 +36,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.daemonDiscoverSweepArgs = daemonDiscoverSweepArgs;
 exports.summarizeDiscoverStderr = summarizeDiscoverStderr;
 exports.discoverSweepCredentialEnv = discoverSweepCredentialEnv;
+exports.taskUserId = taskUserId;
+exports.taskLocalTimestamp = taskLocalTimestamp;
+exports.buildTaskXml = buildTaskXml;
+exports.buildTaskXmlVariants = buildTaskXmlVariants;
+exports.registerHiddenTask = registerHiddenTask;
+exports.windowsTaskReferencesScriptHost = windowsTaskReferencesScriptHost;
+exports.windowsTaskRunsInteractive = windowsTaskRunsInteractive;
 exports.daemonRuntimeState = daemonRuntimeState;
 exports.spawnDetachedDaemon = spawnDetachedDaemon;
 exports.pidIsAlive = pidIsAlive;
 exports.macosLaunchdPath = macosLaunchdPath;
+exports.xmlEscape = xmlEscape;
 exports.isWatchdogTaskInstalled = isWatchdogTaskInstalled;
 exports.isDaemonAutostartInstalled = isDaemonAutostartInstalled;
 exports.daemonCommand = daemonCommand;
@@ -1181,32 +1189,242 @@ async function runDaemon(args, config) {
     // Keep the process alive forever (timers alone would do it, but be explicit).
     await new Promise(() => { });
 }
-// ---------------------------------------------------------------------------
-// Autostart install / uninstall / status
-// ---------------------------------------------------------------------------
-/** Hidden VBS launcher so the logon task doesn't flash a console window. */
-function writeHiddenLauncher(fileName, cliCommand) {
+/** Fully-qualified current user (DOMAIN\\user) for the task principal. */
+function taskUserId() {
+    const domain = process.env.USERDOMAIN;
+    let user = process.env.USERNAME;
+    if (!user) {
+        try {
+            user = os.userInfo().username;
+        }
+        catch {
+            user = undefined;
+        }
+    }
+    if (user && domain)
+        return `${domain}\\${user}`;
+    if (user)
+        return user;
+    return os.hostname();
+}
+/** Local wall-clock timestamp (no ms, no tz) as Task Scheduler expects. */
+function taskLocalTimestamp(date) {
+    const pad = (n) => String(n).padStart(2, '0');
+    return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}` +
+        `T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`;
+}
+/**
+ * Task Scheduler XML that runs `node.exe <cliEntry> <command>` hidden.
+ *
+ * @param command    CLI subcommand + args ('daemon' | 'watchdog' | 'discover …').
+ * @param triggers   Inner <Triggers> XML — logon for the daemon, a repeating
+ *                   time trigger for the 5-minute watchdog.
+ * @param logonType  S4U (windowless, needs elevation to register) or
+ *                   InteractiveToken (registers unelevated, may flash).
+ */
+function buildTaskXml(command, triggers, logonType = 'S4U') {
+    const userId = xmlEscape(taskUserId());
+    const nodeExe = xmlEscape(process.execPath);
+    const args = xmlEscape(`"${cliEntry()}" ${command}`);
+    return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>FullCourtDefense ${xmlEscape(command)} — runs node directly, windowless, no script host.</Description>
+  </RegistrationInfo>
+  <Triggers>
+${triggers}
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <UserId>${userId}</UserId>
+      <LogonType>${logonType}</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <Hidden>true</Hidden>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
+    <AllowHardTerminate>true</AllowHardTerminate>
+    <AllowStartOnDemand>true</AllowStartOnDemand>
+    <Enabled>true</Enabled>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <IdleSettings>
+      <StopOnIdleEnd>false</StopOnIdleEnd>
+      <RestartOnIdle>false</RestartOnIdle>
+    </IdleSettings>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>${nodeExe}</Command>
+      <Arguments>${args}</Arguments>
+    </Exec>
+  </Actions>
+</Task>
+`;
+}
+/**
+ * Windowless-first XML variants for one task: S4U (no window, needs elevation
+ * to register) first, InteractiveToken (unelevated fallback) second.
+ * registerHiddenTask() tries them in order.
+ */
+function buildTaskXmlVariants(command, triggers) {
+    return [buildTaskXml(command, triggers, 'S4U'), buildTaskXml(command, triggers, 'InteractiveToken')];
+}
+function daemonTaskTrigger() {
+    return `    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${xmlEscape(taskUserId())}</UserId>
+    </LogonTrigger>`;
+}
+/** Daemon task variants: start at logon (node run windowless, no repetition). */
+function buildDaemonTaskXml() {
+    return buildTaskXmlVariants('daemon', daemonTaskTrigger());
+}
+/**
+ * Watchdog task: run the `watchdog` command every 5 minutes (liveness beacon +
+ * daemon revival + crash post-mortem) — the beacon is what lets the console
+ * tell "daemon dead" apart from "machine off". A repeating time trigger with a
+ * past start boundary fires promptly and keeps repeating across reboots.
+ */
+function buildWatchdogTaskXml() {
+    const start = taskLocalTimestamp(new Date(Date.now() - 60_000));
+    const trigger = `    <TimeTrigger>
+      <Enabled>true</Enabled>
+      <StartBoundary>${start}</StartBoundary>
+      <Repetition>
+        <Interval>PT5M</Interval>
+        <StopAtDurationEnd>false</StopAtDurationEnd>
+      </Repetition>
+    </TimeTrigger>`;
+    return buildTaskXmlVariants('watchdog', trigger);
+}
+/**
+ * Register a scheduled task from XML (node run directly). Tries each XML
+ * variant in order — S4U (windowless) first, then InteractiveToken — and
+ * finally falls back to a plain `/TR node …` task. The fallbacks may briefly
+ * flash a console window but still contain NO script host, so the malware
+ * fingerprint never returns. Returns true if any path succeeds.
+ *
+ * @param taskName      Scheduled-task name.
+ * @param xml           Task Scheduler XML variant(s), tried in order.
+ * @param command       CLI subcommand for the /TR fallback ('daemon'|'watchdog').
+ * @param scheduleArgs  schtasks schedule flags for the fallback (e.g. ['/SC','MINUTE','/MO','5']).
+ */
+function registerHiddenTask(taskName, xml, command, scheduleArgs) {
     const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
     const dir = path.join(base, 'FullCourtDefense');
-    fs.mkdirSync(dir, { recursive: true });
-    const vbs = path.join(dir, fileName);
-    // Run node directly — routing through `cmd /c` breaks cmd's quote parsing
-    // when node/CLI live under a path with spaces (e.g. Program Files).
-    const inner = `"${process.execPath}" "${cliEntry()}" ${cliCommand}`;
-    const content = `CreateObject("WScript.Shell").Run "${inner.replace(/"/g, '""')}", 0, False\n`;
-    fs.writeFileSync(vbs, content, 'utf8');
-    return vbs;
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    catch { /* ignore */ }
+    const xmlPath = path.join(dir, `${taskName.replace(/[^A-Za-z0-9]+/g, '_')}.task.xml`);
+    for (const variant of Array.isArray(xml) ? xml : [xml]) {
+        try {
+            // schtasks /XML insists the file encoding matches the XML declaration and
+            // rejects UTF-8 ("unable to switch the encoding") — write UTF-16LE + BOM.
+            fs.writeFileSync(xmlPath, `\ufeff${variant}`, 'utf16le');
+            const created = (0, child_process_1.spawnSync)('schtasks', ['/Create', '/TN', taskName, '/XML', xmlPath, '/F'], {
+                stdio: 'ignore', windowsHide: true, timeout: 20_000,
+            });
+            if (created.status === 0)
+                return true;
+        }
+        catch { /* try next variant, then /TR */ }
+    }
+    // Fallback: node directly via /TR (no wscript, no VBS). node/CLI may live
+    // under a path with spaces (Program Files), so quote each and let schtasks
+    // pass the whole /TR string through.
+    const tr = `"${process.execPath}" "${cliEntry()}" ${command}`;
+    const fallback = (0, child_process_1.spawnSync)('schtasks', [
+        '/Create', '/TN', taskName, '/TR', tr, ...scheduleArgs, '/F',
+    ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
+    return fallback.status === 0;
 }
-function ensureWindowsLauncher() {
-    return writeHiddenLauncher('daemon.vbs', 'daemon');
+/** Remove legacy VBS launchers left by pre-1.22.1 installs. */
+function removeLegacyWindowsLaunchers() {
+    const launcherDir = path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'FullCourtDefense');
+    for (const launcher of ['daemon.vbs', 'watchdog.vbs']) {
+        try {
+            fs.unlinkSync(path.join(launcherDir, launcher));
+        }
+        catch { /* already gone */ }
+    }
+}
+/** True when an existing scheduled task's action still runs wscript/cscript
+ *  (the pre-1.22.1 VBS launcher) — the migration trigger. */
+function windowsTaskReferencesScriptHost(taskName) {
+    try {
+        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
+            encoding: 'utf8', windowsHide: true, timeout: 10_000,
+        });
+        if (query.status !== 0 || typeof query.stdout !== 'string')
+            return false;
+        return /wscript|cscript|\.vbs/i.test(query.stdout);
+    }
+    catch {
+        return false;
+    }
+}
+/** True when an existing task still runs with an InteractiveToken principal —
+ *  the 1.22.1 window-flash bug (console window on every trigger). Migration
+ *  trigger for the windowless S4U principal. */
+function windowsTaskRunsInteractive(taskName) {
+    try {
+        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
+            encoding: 'utf8', windowsHide: true, timeout: 10_000,
+        });
+        if (query.status !== 0 || typeof query.stdout !== 'string')
+            return false;
+        return /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout);
+    }
+    catch {
+        return false;
+    }
 }
 /**
- * Watchdog launcher: runs the `watchdog` command (liveness beacon + daemon
- * revival + crash post-mortem) instead of blindly starting the daemon — the
- * beacon is what lets the console tell "daemon dead" apart from "machine off".
+ * Upgrade an EXISTING (working) task to the windowless S4U principal. Tries
+ * ONLY the S4U XML — on failure (unelevated daemon) the current task is left
+ * untouched so autostart never regresses from "flashes" to "broken".
  */
-function ensureWindowsWatchdogLauncher() {
-    return writeHiddenLauncher('watchdog.vbs', 'watchdog');
+function upgradeTaskWindowless(taskName, s4uXml, logFn) {
+    const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+    const dir = path.join(base, 'FullCourtDefense');
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    catch { /* ignore */ }
+    const xmlPath = path.join(dir, `${taskName.replace(/[^A-Za-z0-9]+/g, '_')}.task.xml`);
+    try {
+        fs.writeFileSync(xmlPath, `\ufeff${s4uXml}`, 'utf16le');
+        const created = (0, child_process_1.spawnSync)('schtasks', ['/Create', '/TN', taskName, '/XML', xmlPath, '/F'], {
+            stdio: 'ignore', windowsHide: true, timeout: 20_000,
+        });
+        if (created.status === 0) {
+            logFn(`Self-heal: "${taskName}" migrated to the windowless S4U principal (no more console-window flash).`);
+        }
+        else {
+            logFn(`Self-heal: could not migrate "${taskName}" to S4U (needs elevation) — existing task kept as-is.`);
+        }
+    }
+    catch { /* keep the existing working task */ }
+}
+/** True when the per-user Run-key fallback still names wscript/a .vbs. */
+function windowsRunKeyReferencesScriptHost() {
+    try {
+        const query = (0, child_process_1.spawnSync)('reg', ['query', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE], {
+            encoding: 'utf8', windowsHide: true, timeout: 5_000,
+        });
+        if (query.status !== 0 || typeof query.stdout !== 'string')
+            return false;
+        return /wscript|cscript|\.vbs/i.test(query.stdout);
+    }
+    catch {
+        return false;
+    }
 }
 const WINDOWS_RUN_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';
 const WINDOWS_RUN_VALUE = 'FullCourtDefenseDaemon';
@@ -1219,7 +1437,7 @@ function isWindowsRunKeyInstalled() {
 /** Launch the daemon right now, outside our own process tree. WMI process
  *  creation escapes the Windows Installer job object, which would otherwise
  *  kill the daemon the moment an MSI custom action finishes. */
-function startDaemonNowWindows(vbs, viaTask = false) {
+function startDaemonNowWindows(viaTask = false) {
     try {
         const existing = Number(fs.readFileSync(pidFile(), 'utf8').trim());
         if (Number.isFinite(existing) && existing > 0 && isPidAlive(existing)) {
@@ -1242,42 +1460,41 @@ function startDaemonNowWindows(vbs, viaTask = false) {
         if (run.status === 0)
             return;
     }
-    const escaped = vbs.replace(/'/g, "''");
+    // WMI process creation escapes the MSI job object. Runs node.exe DIRECTLY —
+    // no wscript/VBS (Defender's Commando.A!ml heuristic) — with a hidden window.
+    const nodeEsc = process.execPath.replace(/'/g, "''");
+    const entryEsc = cliEntry().replace(/'/g, "''");
     (0, child_process_1.spawnSync)('powershell', [
         '-NoProfile', '-NonInteractive', '-Command',
-        `Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = ('wscript.exe \"' + '${escaped}' + '\"') } | Out-Null`,
+        `Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = ('\"' + '${nodeEsc}' + '\" \"' + '${entryEsc}' + '\" daemon') } | Out-Null`,
     ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
 }
 function installWindows() {
-    const vbs = ensureWindowsLauncher();
-    // Preferred: Scheduled Task at logon. Creating a logon-trigger task requires
-    // admin rights, so this fails for standard users and unelevated installs.
-    const task = (0, child_process_1.spawnSync)('schtasks', [
-        '/Create', '/TN', TASK_NAME, '/TR', `wscript.exe "${vbs}"`,
-        '/SC', 'ONLOGON', '/F', '/RL', 'LIMITED',
-    ], { stdio: 'ignore', windowsHide: true });
-    const taskOk = task.status === 0;
+    removeLegacyWindowsLaunchers();
+    // Preferred: Scheduled Task at logon, running node.exe directly and hidden
+    // via task XML. Creating a logon-trigger task can require rights, so this may
+    // fail for some standard-user/unelevated installs.
+    const taskOk = registerHiddenTask(TASK_NAME, buildDaemonTaskXml(), 'daemon', ['/SC', 'ONLOGON', '/RL', 'LIMITED']);
     let ok = taskOk;
     if (!ok) {
         // Fallback: per-user Run key — no elevation needed, runs at every logon.
+        // node.exe directly (no wscript). May flash briefly at logon in this rare
+        // fallback, but carries no script-host persistence fingerprint.
         const reg = (0, child_process_1.spawnSync)('reg', [
             'add', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/t', 'REG_SZ',
-            '/d', `wscript.exe "${vbs}"`, '/f',
+            '/d', `"${process.execPath}" "${cliEntry()}" daemon`, '/f',
         ], { stdio: 'ignore', windowsHide: true });
         ok = reg.status === 0;
     }
     // Watchdog: logon triggers only START the daemon — nothing restarts it if it
-    // is killed or crashes mid-session. A time-based per-user task (no elevation
-    // needed, unlike ONLOGON) runs the `watchdog` command every 5 minutes: it
-    // beacons daemon liveness to the console (so "daemon dead" is visible even
-    // when the daemon can't say so itself) and revives a dead daemon within one
-    // tick. Best-effort: a missing watchdog never fails the install.
-    (0, child_process_1.spawnSync)('schtasks', [
-        '/Create', '/TN', WATCHDOG_TASK_NAME, '/TR', `wscript.exe "${ensureWindowsWatchdogLauncher()}"`,
-        '/SC', 'MINUTE', '/MO', '5', '/F',
-    ], { stdio: 'ignore', windowsHide: true });
+    // is killed or crashes mid-session. A time-based task runs the `watchdog`
+    // command every 5 minutes: it beacons daemon liveness to the console (so
+    // "daemon dead" is visible even when the daemon can't say so itself) and
+    // revives a dead daemon within one tick. Best-effort: a missing watchdog
+    // never fails the install.
+    registerHiddenTask(WATCHDOG_TASK_NAME, buildWatchdogTaskXml(), 'watchdog', ['/SC', 'MINUTE', '/MO', '5']);
     if (ok)
-        startDaemonNowWindows(vbs, taskOk);
+        startDaemonNowWindows(taskOk);
     return ok;
 }
 /**
@@ -1296,29 +1513,52 @@ function ensureWindowsAutostartHealthy(logFn) {
     if (process.env.FCD_DAEMON_NO_TASK_SELF_HEAL === '1')
         return;
     try {
-        const vbs = ensureWindowsLauncher();
-        const watchdogVbs = ensureWindowsWatchdogLauncher();
+        // Migration: pre-1.22.1 installs registered wscript/VBS-based tasks that
+        // Defender flags as Trojan:Win32/Commando.A!ml. If the existing task still
+        // references a script host, force-replace it with the node-direct XML task.
+        const legacyDaemon = windowsTaskReferencesScriptHost(TASK_NAME);
+        const legacyWatchdog = windowsTaskReferencesScriptHost(WATCHDOG_TASK_NAME);
+        if (legacyDaemon || legacyWatchdog) {
+            logFn('Self-heal: replacing legacy wscript-based autostart task(s) with node-direct hidden tasks (Defender false-positive fix).');
+        }
         const daemonTask = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
-        if (daemonTask.status !== 0 && !isWindowsRunKeyInstalled()) {
-            const created = (0, child_process_1.spawnSync)('schtasks', [
-                '/Create', '/TN', TASK_NAME, '/TR', `wscript.exe "${vbs}"`,
-                '/SC', 'ONLOGON', '/F', '/RL', 'LIMITED',
-            ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
-            if (created.status !== 0) {
+        if (legacyDaemon || (daemonTask.status !== 0 && !isWindowsRunKeyInstalled())) {
+            const created = registerHiddenTask(TASK_NAME, buildDaemonTaskXml(), 'daemon', ['/SC', 'ONLOGON', '/RL', 'LIMITED']);
+            if (!created) {
                 (0, child_process_1.spawnSync)('reg', [
                     'add', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/t', 'REG_SZ',
-                    '/d', `wscript.exe "${vbs}"`, '/f',
+                    '/d', `"${process.execPath}" "${cliEntry()}" daemon`, '/f',
                 ], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
             }
-            logFn('Self-heal: daemon autostart entry was missing — recreated.');
+            if (daemonTask.status !== 0)
+                logFn('Self-heal: daemon autostart entry was missing — recreated.');
+        }
+        // Rewrite the watchdog whenever it's missing OR still script-host based.
+        const watchdogQuery = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', WATCHDOG_TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
+        if (legacyWatchdog || watchdogQuery.status !== 0) {
+            const ok = registerHiddenTask(WATCHDOG_TASK_NAME, buildWatchdogTaskXml(), 'watchdog', ['/SC', 'MINUTE', '/MO', '5']);
+            if (!ok) {
+                logFn('Self-heal: could not (re)create the watchdog task — daemon revival relies on logon autostart only.');
+            }
         }
-        const watchdog = (0, child_process_1.spawnSync)('schtasks', [
-            '/Create', '/TN', WATCHDOG_TASK_NAME, '/TR', `wscript.exe "${watchdogVbs}"`,
-            '/SC', 'MINUTE', '/MO', '5', '/F',
-        ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
-        if (watchdog.status !== 0) {
-            logFn('Self-heal: could not (re)create the watchdog task — daemon revival relies on logon autostart only.');
+        // Migration (1.22.1 -> 1.22.2): InteractiveToken tasks flash a console
+        // window on every trigger. Upgrade healthy existing tasks to S4U; S4U-only
+        // attempt so a denied re-registration never breaks a working task.
+        if (daemonTask.status === 0 && !legacyDaemon && windowsTaskRunsInteractive(TASK_NAME)) {
+            upgradeTaskWindowless(TASK_NAME, buildDaemonTaskXml()[0], logFn);
         }
+        if (watchdogQuery.status === 0 && !legacyWatchdog && windowsTaskRunsInteractive(WATCHDOG_TASK_NAME)) {
+            upgradeTaskWindowless(WATCHDOG_TASK_NAME, buildWatchdogTaskXml()[0], logFn);
+        }
+        // A stale Run-key fallback from an older install may still name wscript.
+        if (windowsRunKeyReferencesScriptHost()) {
+            (0, child_process_1.spawnSync)('reg', [
+                'add', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/t', 'REG_SZ',
+                '/d', `"${process.execPath}" "${cliEntry()}" daemon`, '/f',
+            ], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
+            logFn('Self-heal: rewrote legacy wscript Run-key entry to run node directly.');
+        }
+        removeLegacyWindowsLaunchers();
     }
     catch { /* self-heal is best-effort — never blocks daemon boot */ }
 }
@@ -1357,10 +1597,12 @@ function uninstallWindows() {
     const task = (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', TASK_NAME, '/F'], { stdio: 'ignore', windowsHide: true });
     (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', WATCHDOG_TASK_NAME, '/F'], { stdio: 'ignore', windowsHide: true });
     const reg = (0, child_process_1.spawnSync)('reg', ['delete', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/f'], { stdio: 'ignore', windowsHide: true });
+    removeLegacyWindowsLaunchers();
+    // Clean up the node-direct task XML we now drop next to the launchers.
     const launcherDir = path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'FullCourtDefense');
-    for (const launcher of ['daemon.vbs', 'watchdog.vbs']) {
+    for (const name of [TASK_NAME, WATCHDOG_TASK_NAME]) {
         try {
-            fs.unlinkSync(path.join(launcherDir, launcher));
+            fs.unlinkSync(path.join(launcherDir, `${name.replace(/[^A-Za-z0-9]+/g, '_')}.task.xml`));
         }
         catch { /* ignore */ }
     }

package/dist/commands/discoverSchedule.js

@@ -40,17 +40,17 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const daemon_1 = require("./daemon");
 const TASK_NAME = 'FullCourtDefenseDesktopDiscover';
 const STARTUP_LAUNCHER = 'FullCourtDefenseDesktopDiscover.cmd';
 function windowsStartupLauncherPath() {
     const appData = process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming');
     return path.join(appData, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', STARTUP_LAUNCHER);
 }
-function discoverCommandLine(opts = {}) {
-    const node = process.execPath;
-    const script = path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
+/** The `discover …` argument tail (no node/script prefix) for task actions. */
+function discoverCommandTail(opts = {}) {
     const q = (value) => (/\s/.test(value) ? `"${value}"` : value);
-    const parts = [q(node), q(script), 'discover', '--upload', '--deep', '--silent'];
+    const parts = ['discover', '--upload', '--deep', '--silent'];
     if (opts.surface)
         parts.push('--surface', q(opts.surface));
     if (opts.scanRoot)
@@ -61,26 +61,40 @@ function discoverCommandLine(opts = {}) {
         parts.push('--user-email', q(opts.userEmail));
     return parts.join(' ');
 }
+function discoverCommandLine(opts = {}) {
+    const node = process.execPath;
+    const script = path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
+    const q = (value) => (/\s/.test(value) ? `"${value}"` : value);
+    return [q(node), q(script), discoverCommandTail(opts)].join(' ');
+}
+// Registered through the shared windowless task helpers (daemon.ts): S4U
+// principal first (no console-window flash on the daily run), InteractiveToken
+// then plain /TR as fallbacks — never a script host.
 function installWindowsSchedule(hour, opts, trigger = 'daily') {
-    const tr = discoverCommandLine(opts);
-    try {
-        (0, child_process_1.execSync)(`schtasks /Delete /TN "${TASK_NAME}" /F`, { stdio: 'ignore' });
-    }
-    catch {
-        // task may not exist
-    }
-    const schedule = trigger === 'logon'
-        ? '/SC ONLOGON'
-        : `/SC DAILY /ST ${String(hour).padStart(2, '0')}:00`;
-    try {
-        (0, child_process_1.execSync)(`schtasks /Create /F /TN "${TASK_NAME}" ${schedule} /RL LIMITED /TR "${tr.replace(/"/g, '\\"')}"`, { stdio: 'inherit' });
-    }
-    catch (error) {
+    const tail = discoverCommandTail(opts);
+    const startBoundary = `${new Date().getFullYear()}-${String(new Date().getMonth() + 1).padStart(2, '0')}-${String(new Date().getDate()).padStart(2, '0')}T${String(hour).padStart(2, '0')}:00:00`;
+    const triggerXml = trigger === 'logon'
+        ? `    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${(0, daemon_1.xmlEscape)((0, daemon_1.taskUserId)())}</UserId>
+    </LogonTrigger>`
+        : `    <CalendarTrigger>
+      <Enabled>true</Enabled>
+      <StartBoundary>${startBoundary}</StartBoundary>
+      <ScheduleByDay>
+        <DaysInterval>1</DaysInterval>
+      </ScheduleByDay>
+    </CalendarTrigger>`;
+    const schedArgs = trigger === 'logon'
+        ? ['/SC', 'ONLOGON', '/RL', 'LIMITED']
+        : ['/SC', 'DAILY', '/ST', `${String(hour).padStart(2, '0')}:00`, '/RL', 'LIMITED'];
+    const ok = (0, daemon_1.registerHiddenTask)(TASK_NAME, (0, daemon_1.buildTaskXmlVariants)(tail, triggerXml), tail, schedArgs);
+    if (!ok) {
         if (trigger !== 'logon')
-            throw error;
+            throw new Error(`Could not register scheduled task "${TASK_NAME}" (Task Scheduler denied all variants).`);
         const launcher = windowsStartupLauncherPath();
         fs.mkdirSync(path.dirname(launcher), { recursive: true });
-        fs.writeFileSync(launcher, `@echo off\r\n${tr} > "%USERPROFILE%\\.fullcourtdefense-discover.log" 2>&1\r\n`, 'utf8');
+        fs.writeFileSync(launcher, `@echo off\r\n${discoverCommandLine(opts)} > "%USERPROFILE%\\.fullcourtdefense-discover.log" 2>&1\r\n`, 'utf8');
         console.log(`Task Scheduler denied access; installed user logon launcher instead: ${launcher}`);
     }
 }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.22.0"
+  "version": "1.22.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.22.0",
+  "version": "1.22.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -60,6 +60,7 @@
     "test:real-scenario": "npm run build && node scripts/test-real-scenario-drill.js",
     "test:blocking-approval": "npm run build && node scripts/test-blocking-approval-drill.js",
     "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",
+    "test:no-script-host": "npm run build && node scripts/test-no-script-host.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
     "prepublishOnly": "npm run build"
   },