fullcourtdefense-cli 1.22.1 → 1.22.3

package/dist/commands/autoProtect.js

@@ -76,7 +76,7 @@ function installWindows(intervalMinutes, onLogon) {
     const schedArgs = onLogon
         ? ['/SC', 'ONLOGON', '/RL', 'LIMITED']
         : ['/SC', 'MINUTE', '/MO', String(Math.max(1, intervalMinutes)), '/RL', 'LIMITED'];
-    return (0, daemon_1.registerHiddenTask)(TASK_NAME, (0, daemon_1.buildTaskXml)('protect-all', trigger), 'protect-all', schedArgs);
+    return (0, daemon_1.registerHiddenTask)(TASK_NAME, (0, daemon_1.buildTaskXmlVariants)('protect-all', trigger), 'protect-all', schedArgs);
 }
 function uninstallWindows() {
     const result = (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', TASK_NAME, '/F'], { stdio: 'inherit' });

package/dist/commands/daemon.d.ts

@@ -32,6 +32,7 @@ export declare function discoverSweepCredentialEnv(credentials?: {
     shieldKey?: string;
     apiUrl?: string;
 }): Record<string, string>;
+export type TaskLogonType = 'S4U' | 'InteractiveToken';
 /** Fully-qualified current user (DOMAIN\\user) for the task principal. */
 export declare function taskUserId(): string;
 /** Local wall-clock timestamp (no ms, no tz) as Task Scheduler expects. */
@@ -39,26 +40,39 @@ export declare function taskLocalTimestamp(date: Date): string;
 /**
  * Task Scheduler XML that runs `node.exe <cliEntry> <command>` hidden.
  *
- * @param command   CLI subcommand ('daemon' | 'watchdog').
- * @param triggers  Inner <Triggers> XML — logon for the daemon, a repeating
- *                  time trigger for the 5-minute watchdog.
+ * @param command    CLI subcommand + args ('daemon' | 'watchdog' | 'discover …').
+ * @param triggers   Inner <Triggers> XML — logon for the daemon, a repeating
+ *                   time trigger for the 5-minute watchdog.
+ * @param logonType  S4U (windowless, needs elevation to register) or
+ *                   InteractiveToken (registers unelevated, may flash).
  */
-export declare function buildTaskXml(command: string, triggers: string): string;
+export declare function buildTaskXml(command: string, triggers: string, logonType?: TaskLogonType): string;
 /**
- * Register a scheduled task from XML (node run directly, window hidden). Falls
- * back to a plain `/TR node …` task if XML registration fails — that variant
- * may briefly flash a console window but still contains NO script host, so the
- * malware fingerprint never returns. Returns true if either path succeeds.
+ * Windowless-first XML variants for one task: S4U (no window, needs elevation
+ * to register) first, InteractiveToken (unelevated fallback) second.
+ * registerHiddenTask() tries them in order.
+ */
+export declare function buildTaskXmlVariants(command: string, triggers: string): string[];
+/**
+ * Register a scheduled task from XML (node run directly). Tries each XML
+ * variant in order — S4U (windowless) first, then InteractiveToken — and
+ * finally falls back to a plain `/TR node …` task. The fallbacks may briefly
+ * flash a console window but still contain NO script host, so the malware
+ * fingerprint never returns. Returns true if any path succeeds.
  *
  * @param taskName      Scheduled-task name.
- * @param xml           Full Task Scheduler XML (from buildDaemon/Watchdog).
+ * @param xml           Task Scheduler XML variant(s), tried in order.
  * @param command       CLI subcommand for the /TR fallback ('daemon'|'watchdog').
  * @param scheduleArgs  schtasks schedule flags for the fallback (e.g. ['/SC','MINUTE','/MO','5']).
  */
-export declare function registerHiddenTask(taskName: string, xml: string, command: string, scheduleArgs: string[]): boolean;
+export declare function registerHiddenTask(taskName: string, xml: string | string[], command: string, scheduleArgs: string[]): boolean;
 /** True when an existing scheduled task's action still runs wscript/cscript
  *  (the pre-1.22.1 VBS launcher) — the migration trigger. */
 export declare function windowsTaskReferencesScriptHost(taskName: string): boolean;
+/** True when an existing task still runs with an InteractiveToken principal —
+ *  the 1.22.1 window-flash bug (console window on every trigger). Migration
+ *  trigger for the windowless S4U principal. */
+export declare function windowsTaskRunsInteractive(taskName: string): boolean;
 /** Snapshot of the resident daemon for out-of-process callers (watchdog/status). */
 export interface DaemonRuntimeState {
     alive: boolean;

package/dist/commands/daemon.js

@@ -39,8 +39,10 @@ exports.discoverSweepCredentialEnv = discoverSweepCredentialEnv;
 exports.taskUserId = taskUserId;
 exports.taskLocalTimestamp = taskLocalTimestamp;
 exports.buildTaskXml = buildTaskXml;
+exports.buildTaskXmlVariants = buildTaskXmlVariants;
 exports.registerHiddenTask = registerHiddenTask;
 exports.windowsTaskReferencesScriptHost = windowsTaskReferencesScriptHost;
+exports.windowsTaskRunsInteractive = windowsTaskRunsInteractive;
 exports.daemonRuntimeState = daemonRuntimeState;
 exports.spawnDetachedDaemon = spawnDetachedDaemon;
 exports.pidIsAlive = pidIsAlive;
@@ -1187,23 +1189,6 @@ async function runDaemon(args, config) {
     // Keep the process alive forever (timers alone would do it, but be explicit).
     await new Promise(() => { });
 }
-// ---------------------------------------------------------------------------
-// Autostart install / uninstall / status
-// ---------------------------------------------------------------------------
-// ---------------------------------------------------------------------------
-// Windows autostart launchers
-//
-// HISTORY: we used to run `wscript.exe <script>.vbs` from the scheduled tasks
-// to launch node with no console-window flash. Windows Defender's ML heuristic
-// (`Trojan:Win32/Commando.A!ml`) flags "schtasks task -> wscript runs a script
-// from a user-writable dir on a short recurring interval" as script-based
-// persistence — a textbook malware pattern — and quarantined our own watchdog.
-//
-// FIX: no VBS, no wscript, no PowerShell anywhere in the autostart chain. The
-// scheduled tasks run the bundled `node.exe` DIRECTLY, and the console window
-// is suppressed the supported way — Task Scheduler XML `<Hidden>true</Hidden>`
-// with an InteractiveToken principal (needs no password, no elevation).
-// ---------------------------------------------------------------------------
 /** Fully-qualified current user (DOMAIN\\user) for the task principal. */
 function taskUserId() {
     const domain = process.env.USERDOMAIN;
@@ -1231,18 +1216,20 @@ function taskLocalTimestamp(date) {
 /**
  * Task Scheduler XML that runs `node.exe <cliEntry> <command>` hidden.
  *
- * @param command   CLI subcommand ('daemon' | 'watchdog').
- * @param triggers  Inner <Triggers> XML — logon for the daemon, a repeating
- *                  time trigger for the 5-minute watchdog.
+ * @param command    CLI subcommand + args ('daemon' | 'watchdog' | 'discover …').
+ * @param triggers   Inner <Triggers> XML — logon for the daemon, a repeating
+ *                   time trigger for the 5-minute watchdog.
+ * @param logonType  S4U (windowless, needs elevation to register) or
+ *                   InteractiveToken (registers unelevated, may flash).
  */
-function buildTaskXml(command, triggers) {
+function buildTaskXml(command, triggers, logonType = 'S4U') {
     const userId = xmlEscape(taskUserId());
     const nodeExe = xmlEscape(process.execPath);
     const args = xmlEscape(`"${cliEntry()}" ${command}`);
     return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
-    <Description>FullCourtDefense ${command} — runs node directly, hidden, no script host.</Description>
+    <Description>FullCourtDefense ${xmlEscape(command)} — runs node directly, windowless, no script host.</Description>
   </RegistrationInfo>
   <Triggers>
 ${triggers}
@@ -1250,7 +1237,7 @@ ${triggers}
   <Principals>
     <Principal id="Author">
       <UserId>${userId}</UserId>
-      <LogonType>InteractiveToken</LogonType>
+      <LogonType>${logonType}</LogonType>
       <RunLevel>LeastPrivilege</RunLevel>
     </Principal>
   </Principals>
@@ -1279,13 +1266,23 @@ ${triggers}
 </Task>
 `;
 }
-/** Daemon task: start at logon (node run hidden, no repetition). */
-function buildDaemonTaskXml() {
-    const trigger = `    <LogonTrigger>
+/**
+ * Windowless-first XML variants for one task: S4U (no window, needs elevation
+ * to register) first, InteractiveToken (unelevated fallback) second.
+ * registerHiddenTask() tries them in order.
+ */
+function buildTaskXmlVariants(command, triggers) {
+    return [buildTaskXml(command, triggers, 'S4U'), buildTaskXml(command, triggers, 'InteractiveToken')];
+}
+function daemonTaskTrigger() {
+    return `    <LogonTrigger>
       <Enabled>true</Enabled>
       <UserId>${xmlEscape(taskUserId())}</UserId>
     </LogonTrigger>`;
-    return buildTaskXml('daemon', trigger);
+}
+/** Daemon task variants: start at logon (node run windowless, no repetition). */
+function buildDaemonTaskXml() {
+    return buildTaskXmlVariants('daemon', daemonTaskTrigger());
 }
 /**
  * Watchdog task: run the `watchdog` command every 5 minutes (liveness beacon +
@@ -1303,16 +1300,17 @@ function buildWatchdogTaskXml() {
         <StopAtDurationEnd>false</StopAtDurationEnd>
       </Repetition>
     </TimeTrigger>`;
-    return buildTaskXml('watchdog', trigger);
+    return buildTaskXmlVariants('watchdog', trigger);
 }
 /**
- * Register a scheduled task from XML (node run directly, window hidden). Falls
- * back to a plain `/TR node …` task if XML registration fails — that variant
- * may briefly flash a console window but still contains NO script host, so the
- * malware fingerprint never returns. Returns true if either path succeeds.
+ * Register a scheduled task from XML (node run directly). Tries each XML
+ * variant in order — S4U (windowless) first, then InteractiveToken — and
+ * finally falls back to a plain `/TR node …` task. The fallbacks may briefly
+ * flash a console window but still contain NO script host, so the malware
+ * fingerprint never returns. Returns true if any path succeeds.
  *
  * @param taskName      Scheduled-task name.
- * @param xml           Full Task Scheduler XML (from buildDaemon/Watchdog).
+ * @param xml           Task Scheduler XML variant(s), tried in order.
  * @param command       CLI subcommand for the /TR fallback ('daemon'|'watchdog').
  * @param scheduleArgs  schtasks schedule flags for the fallback (e.g. ['/SC','MINUTE','/MO','5']).
  */
@@ -1324,17 +1322,19 @@ function registerHiddenTask(taskName, xml, command, scheduleArgs) {
     }
     catch { /* ignore */ }
     const xmlPath = path.join(dir, `${taskName.replace(/[^A-Za-z0-9]+/g, '_')}.task.xml`);
-    try {
-        // schtasks /XML insists the file encoding matches the XML declaration and
-        // rejects UTF-8 ("unable to switch the encoding") — write UTF-16LE + BOM.
-        fs.writeFileSync(xmlPath, `\ufeff${xml}`, 'utf16le');
-        const created = (0, child_process_1.spawnSync)('schtasks', ['/Create', '/TN', taskName, '/XML', xmlPath, '/F'], {
-            stdio: 'ignore', windowsHide: true, timeout: 20_000,
-        });
-        if (created.status === 0)
-            return true;
+    for (const variant of Array.isArray(xml) ? xml : [xml]) {
+        try {
+            // schtasks /XML insists the file encoding matches the XML declaration and
+            // rejects UTF-8 ("unable to switch the encoding") — write UTF-16LE + BOM.
+            fs.writeFileSync(xmlPath, `\ufeff${variant}`, 'utf16le');
+            const created = (0, child_process_1.spawnSync)('schtasks', ['/Create', '/TN', taskName, '/XML', xmlPath, '/F'], {
+                stdio: 'ignore', windowsHide: true, timeout: 20_000,
+            });
+            if (created.status === 0)
+                return true;
+        }
+        catch { /* try next variant, then /TR */ }
     }
-    catch { /* fall through to /TR */ }
     // Fallback: node directly via /TR (no wscript, no VBS). node/CLI may live
     // under a path with spaces (Program Files), so quote each and let schtasks
     // pass the whole /TR string through.
@@ -1369,6 +1369,49 @@ function windowsTaskReferencesScriptHost(taskName) {
         return false;
     }
 }
+/** True when an existing task still runs with an InteractiveToken principal —
+ *  the 1.22.1 window-flash bug (console window on every trigger). Migration
+ *  trigger for the windowless S4U principal. */
+function windowsTaskRunsInteractive(taskName) {
+    try {
+        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
+            encoding: 'utf8', windowsHide: true, timeout: 10_000,
+        });
+        if (query.status !== 0 || typeof query.stdout !== 'string')
+            return false;
+        return /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Upgrade an EXISTING (working) task to the windowless S4U principal. Tries
+ * ONLY the S4U XML — on failure (unelevated daemon) the current task is left
+ * untouched so autostart never regresses from "flashes" to "broken".
+ */
+function upgradeTaskWindowless(taskName, s4uXml, logFn) {
+    const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+    const dir = path.join(base, 'FullCourtDefense');
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    catch { /* ignore */ }
+    const xmlPath = path.join(dir, `${taskName.replace(/[^A-Za-z0-9]+/g, '_')}.task.xml`);
+    try {
+        fs.writeFileSync(xmlPath, `\ufeff${s4uXml}`, 'utf16le');
+        const created = (0, child_process_1.spawnSync)('schtasks', ['/Create', '/TN', taskName, '/XML', xmlPath, '/F'], {
+            stdio: 'ignore', windowsHide: true, timeout: 20_000,
+        });
+        if (created.status === 0) {
+            logFn(`Self-heal: "${taskName}" migrated to the windowless S4U principal (no more console-window flash).`);
+        }
+        else {
+            logFn(`Self-heal: could not migrate "${taskName}" to S4U (needs elevation) — existing task kept as-is.`);
+        }
+    }
+    catch { /* keep the existing working task */ }
+}
 /** True when the per-user Run-key fallback still names wscript/a .vbs. */
 function windowsRunKeyReferencesScriptHost() {
     try {
@@ -1498,6 +1541,15 @@ function ensureWindowsAutostartHealthy(logFn) {
                 logFn('Self-heal: could not (re)create the watchdog task — daemon revival relies on logon autostart only.');
             }
         }
+        // Migration (1.22.1 -> 1.22.2): InteractiveToken tasks flash a console
+        // window on every trigger. Upgrade healthy existing tasks to S4U; S4U-only
+        // attempt so a denied re-registration never breaks a working task.
+        if (daemonTask.status === 0 && !legacyDaemon && windowsTaskRunsInteractive(TASK_NAME)) {
+            upgradeTaskWindowless(TASK_NAME, buildDaemonTaskXml()[0], logFn);
+        }
+        if (watchdogQuery.status === 0 && !legacyWatchdog && windowsTaskRunsInteractive(WATCHDOG_TASK_NAME)) {
+            upgradeTaskWindowless(WATCHDOG_TASK_NAME, buildWatchdogTaskXml()[0], logFn);
+        }
         // A stale Run-key fallback from an older install may still name wscript.
         if (windowsRunKeyReferencesScriptHost()) {
             (0, child_process_1.spawnSync)('reg', [

package/dist/commands/discoverSchedule.js

@@ -40,17 +40,17 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const daemon_1 = require("./daemon");
 const TASK_NAME = 'FullCourtDefenseDesktopDiscover';
 const STARTUP_LAUNCHER = 'FullCourtDefenseDesktopDiscover.cmd';
 function windowsStartupLauncherPath() {
     const appData = process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming');
     return path.join(appData, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', STARTUP_LAUNCHER);
 }
-function discoverCommandLine(opts = {}) {
-    const node = process.execPath;
-    const script = path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
+/** The `discover …` argument tail (no node/script prefix) for task actions. */
+function discoverCommandTail(opts = {}) {
     const q = (value) => (/\s/.test(value) ? `"${value}"` : value);
-    const parts = [q(node), q(script), 'discover', '--upload', '--deep', '--silent'];
+    const parts = ['discover', '--upload', '--deep', '--silent'];
     if (opts.surface)
         parts.push('--surface', q(opts.surface));
     if (opts.scanRoot)
@@ -61,26 +61,40 @@ function discoverCommandLine(opts = {}) {
         parts.push('--user-email', q(opts.userEmail));
     return parts.join(' ');
 }
+function discoverCommandLine(opts = {}) {
+    const node = process.execPath;
+    const script = path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
+    const q = (value) => (/\s/.test(value) ? `"${value}"` : value);
+    return [q(node), q(script), discoverCommandTail(opts)].join(' ');
+}
+// Registered through the shared windowless task helpers (daemon.ts): S4U
+// principal first (no console-window flash on the daily run), InteractiveToken
+// then plain /TR as fallbacks — never a script host.
 function installWindowsSchedule(hour, opts, trigger = 'daily') {
-    const tr = discoverCommandLine(opts);
-    try {
-        (0, child_process_1.execSync)(`schtasks /Delete /TN "${TASK_NAME}" /F`, { stdio: 'ignore' });
-    }
-    catch {
-        // task may not exist
-    }
-    const schedule = trigger === 'logon'
-        ? '/SC ONLOGON'
-        : `/SC DAILY /ST ${String(hour).padStart(2, '0')}:00`;
-    try {
-        (0, child_process_1.execSync)(`schtasks /Create /F /TN "${TASK_NAME}" ${schedule} /RL LIMITED /TR "${tr.replace(/"/g, '\\"')}"`, { stdio: 'inherit' });
-    }
-    catch (error) {
+    const tail = discoverCommandTail(opts);
+    const startBoundary = `${new Date().getFullYear()}-${String(new Date().getMonth() + 1).padStart(2, '0')}-${String(new Date().getDate()).padStart(2, '0')}T${String(hour).padStart(2, '0')}:00:00`;
+    const triggerXml = trigger === 'logon'
+        ? `    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${(0, daemon_1.xmlEscape)((0, daemon_1.taskUserId)())}</UserId>
+    </LogonTrigger>`
+        : `    <CalendarTrigger>
+      <Enabled>true</Enabled>
+      <StartBoundary>${startBoundary}</StartBoundary>
+      <ScheduleByDay>
+        <DaysInterval>1</DaysInterval>
+      </ScheduleByDay>
+    </CalendarTrigger>`;
+    const schedArgs = trigger === 'logon'
+        ? ['/SC', 'ONLOGON', '/RL', 'LIMITED']
+        : ['/SC', 'DAILY', '/ST', `${String(hour).padStart(2, '0')}:00`, '/RL', 'LIMITED'];
+    const ok = (0, daemon_1.registerHiddenTask)(TASK_NAME, (0, daemon_1.buildTaskXmlVariants)(tail, triggerXml), tail, schedArgs);
+    if (!ok) {
         if (trigger !== 'logon')
-            throw error;
+            throw new Error(`Could not register scheduled task "${TASK_NAME}" (Task Scheduler denied all variants).`);
         const launcher = windowsStartupLauncherPath();
         fs.mkdirSync(path.dirname(launcher), { recursive: true });
-        fs.writeFileSync(launcher, `@echo off\r\n${tr} > "%USERPROFILE%\\.fullcourtdefense-discover.log" 2>&1\r\n`, 'utf8');
+        fs.writeFileSync(launcher, `@echo off\r\n${discoverCommandLine(opts)} > "%USERPROFILE%\\.fullcourtdefense-discover.log" 2>&1\r\n`, 'utf8');
         console.log(`Task Scheduler denied access; installed user logon launcher instead: ${launcher}`);
     }
 }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.22.1"
+  "version": "1.22.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.22.1",
+  "version": "1.22.3",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {