fullcourtdefense-cli 1.22.4 → 1.22.6

package/dist/commands/daemon.js

@@ -399,18 +399,33 @@ async function runDaemon(args, config) {
     let autoUpdatePolicy;
     /** Heartbeat ticks spent without full credentials (drives recovery cadence). */
     let credRecoveryTicks = 0;
+    /** Enrollment-file mtime at the last recovery attempt — a change means the
+     *  user just ran login/onboard and fresh credentials are waiting. */
+    let lastEnrollmentMtimeMs = 0;
     /**
      * A daemon that starts without a usable shield key (DPAPI decrypt blocked,
      * config written after start by `login`) must NOT stay credential-less
      * forever — that silences telemetry AND auto-update, stranding the machine.
      * Retry quickly right after start, then hourly (each retry may spawn
-     * PowerShell for DPAPI, which we keep rare on machines that block it).
+     * PowerShell for DPAPI, which we keep rare on machines that block it) —
+     * EXCEPT when ~/.fullcourtdefense.yml changed, which means a re-enrollment
+     * just happened: retry on the very next tick, so a repaired machine comes
+     * back within one heartbeat instead of up to an hour later (the 8/12
+     * incident: re-enroll fixed the hooks instantly while the daemon kept
+     * 401-ing for 16 more minutes).
      */
     const recoverCredentialsIfMissing = () => {
         if (creds.shieldId && creds.shieldKey)
             return;
+        let enrollmentChanged = false;
+        try {
+            const mtime = fs.statSync((0, config_1.getHomeConfigPath)()).mtimeMs;
+            enrollmentChanged = mtime !== lastEnrollmentMtimeMs;
+            lastEnrollmentMtimeMs = mtime;
+        }
+        catch { /* no config file — the tick cadence below applies */ }
         credRecoveryTicks += 1;
-        if (credRecoveryTicks > 3 && credRecoveryTicks % 12 !== 0)
+        if (!enrollmentChanged && credRecoveryTicks > 3 && credRecoveryTicks % 12 !== 0)
             return;
         try {
             const fresh = (0, config_1.resolveCliCredentials)((0, config_1.loadConfig)(args.config), {

package/dist/commands/doctor.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.doctorCommand = doctorCommand;
+const config_1 = require("../config");
+const runtimeConfig_1 = require("../runtimeConfig");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 function withTimeout(ms) {
     return AbortSignal.timeout(ms);
@@ -8,6 +10,35 @@ function withTimeout(ms) {
 function normalizeApiUrl(url) {
     return (url || DEFAULT_API_URL).replace(/\/$/, '');
 }
+/**
+ * Credential health, printed after connectivity passes. Connectivity alone is
+ * a false comfort: the 8/12 incident machine had a green ping while the
+ * backend rejected its shield key on every call (broken local key store), so
+ * every protected action failed closed. Doctor must surface that state.
+ */
+async function checkCredentials(apiUrl, config) {
+    const creds = (0, config_1.resolveCliCredentials)(config, { apiUrl });
+    if (!creds.shieldId || !creds.shieldKey) {
+        console.log('INFO not enrolled on this machine (no saved shield credentials)');
+        console.log('     Enroll with: fullcourtdefense onboard --token <fleet-enrollment-token>');
+        return true;
+    }
+    const started = Date.now();
+    const validation = await (0, runtimeConfig_1.validateShieldCredentials)({ apiUrl, shieldId: creds.shieldId, shieldKey: creds.shieldKey });
+    const elapsed = Date.now() - started;
+    if (validation.ok) {
+        console.log(`PASS machine credentials accepted by the backend (shield ${creds.shieldId}, ${elapsed}ms)`);
+        return true;
+    }
+    if (validation.authRejected) {
+        console.log(`FAIL backend REJECTS this machine's saved credentials (${validation.detail})`);
+        console.log('     Protected actions fail-closed until the machine re-enrolls.');
+        console.log('     Fix: fullcourtdefense onboard --token <fleet-enrollment-token>');
+        return false;
+    }
+    console.log(`WARN could not verify credentials right now (${validation.detail}); cached enforcement applies`);
+    return true;
+}
 async function doctorCommand(args, config) {
     const apiUrl = normalizeApiUrl(args.apiUrl || config.apiUrl);
     const pingUrl = `${apiUrl}/api/health/ping`;
@@ -27,6 +58,9 @@ async function doctorCommand(args, config) {
         if (resp.ok) {
             console.log(`PASS outbound HTTPS open (${resp.status}, ${elapsed}ms)`);
             console.log(`Checked: ${pingUrl}`);
+            if (!(await checkCredentials(apiUrl, config))) {
+                process.exit(1);
+            }
             return;
         }
         console.log(`WARN health ping reachable but returned HTTP ${resp.status} (${elapsed}ms)`);
@@ -46,6 +80,9 @@ async function doctorCommand(args, config) {
         if (resp.ok) {
             console.log(`PASS root API reachable (${resp.status}, ${elapsed}ms)`);
             console.log(`Checked: ${rootUrl}`);
+            if (!(await checkCredentials(apiUrl, config))) {
+                process.exit(1);
+            }
             return;
         }
         console.log(`FAIL root API returned HTTP ${resp.status} (${elapsed}ms)`);

package/dist/commands/hook.js

@@ -373,21 +373,31 @@ async function fetchWithOneRetry(url, init, timeoutMs, onFailure) {
  * spooled (`offlineEnforced`) and replayed to the backend when connectivity
  * returns, and distress signals make the episode visible to org admins.
  */
-function respondDegraded(ctx, detail, toolName) {
+function respondDegraded(ctx, detail, toolName, authRejected = false) {
+    // "Unreachable" and "credentials rejected" need OPPOSITE fixes (wait vs
+    // re-enroll) and different alerts. The 8/12 incident machine showed users
+    // "restore connectivity" advice for hours while the real fix was a 30-second
+    // re-enrollment — never conflate the two again.
+    const cause = authRejected
+        ? 'the policy service rejected this machine\'s credentials'
+        : 'policy service unreachable';
+    const advice = authRejected
+        ? 'Re-enroll this machine: fullcourtdefense onboard --token <fleet-enrollment-token>.'
+        : 'Do not retry until the connection is restored.';
     if (ctx.failClosed && !ctx.shadow) {
         const health = (0, policyGateHealth_1.recordGateFailure)();
         if ((0, policyGateHealth_1.shouldFailClosed)(health)) {
             // Persistent outage on an enforcing machine: block, and raise a CRITICAL
             // distress code — the daemon heartbeat ships it and org admins get the
             // proactive alert email (fleet-alerts pipeline).
-            (0, distress_1.reportDistress)('hook', distress_1.DISTRESS.HOOK_FAIL_CLOSED, `Blocking ${ctx.event} actions: policy gate unreachable ${health.consecutiveFailures} times in a row since ${health.firstFailureAt || 'now'} (${detail})`);
+            (0, distress_1.reportDistress)('hook', authRejected ? distress_1.DISTRESS.AUTH_BROKEN : distress_1.DISTRESS.HOOK_FAIL_CLOSED, `Blocking ${ctx.event} actions: ${cause} ${health.consecutiveFailures} times in a row since ${health.firstFailureAt || 'now'} (${detail})`);
             (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, reason: `fail-closed: ${detail}`, offlineEnforced: true });
             (0, telemetry_1.triggerFlush)(true);
-            ctx.respond(true, `Blocked by FullCourtDefense — policy service unreachable (${health.consecutiveFailures}x in a row) and this machine is set to fail-closed. ${detail}`, `FullCourtDefense could not verify this ${ctx.event} against your org policies (${detail}) and the outage is persistent, so fail-closed mode is blocking. Do not retry until the connection is restored.`);
+            ctx.respond(true, `Blocked by FullCourtDefense — ${cause} (${health.consecutiveFailures}x in a row) and this machine is set to fail-closed. ${detail} ${advice}`, `FullCourtDefense could not verify this ${ctx.event} against your org policies (${detail}) and the failure is persistent, so fail-closed mode is blocking. ${advice}`);
         }
         // Grace window: transient failure on a fail-closed machine — allow this
         // action, but record distress so the episode is visible in the console.
-        (0, distress_1.reportDistress)('hook', distress_1.DISTRESS.NETWORK_DOWN, `Policy gate failure ${health.consecutiveFailures}/3 (grace window, still allowing): ${detail}`);
+        (0, distress_1.reportDistress)('hook', authRejected ? distress_1.DISTRESS.AUTH_BROKEN : distress_1.DISTRESS.NETWORK_DOWN, `Policy gate failure ${health.consecutiveFailures}/3 (grace window, still allowing): ${detail}`);
         dbg({ phase: 'policy_grace_allow', event: ctx.event, consecutiveFailures: health.consecutiveFailures, detail });
         (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, reason: `degraded (grace ${health.consecutiveFailures}/3): ${detail}`, offlineEnforced: true });
         (0, telemetry_1.triggerFlush)(false);
@@ -883,8 +893,19 @@ async function enforceActionPolicy(ctx) {
         }, timeoutMs, (attempt, err) => dbg({ phase: 'policy_retry', event, attempt, error: err }));
         if (!resp.ok) {
             dbg({ phase: 'policy_http_error', event, status: resp.status, failClosed: ctx.failClosed });
-            if (!tryLocalPolicyEnforcement(ctx, call, `Backend returned HTTP ${resp.status}.`)) {
-                respondDegraded(ctx, `Backend returned HTTP ${resp.status}.`, call.toolName);
+            const authRejected = resp.status === 401 || resp.status === 403;
+            const detail = authRejected
+                ? `The policy service rejected this machine's credentials (HTTP ${resp.status}) — the shield key saved here is broken or revoked, not a network problem.`
+                : `Backend returned HTTP ${resp.status}.`;
+            if (authRejected) {
+                // Rejected key = every future call fails identically. Cached policies
+                // (below) remain the best enforcement stance, but the distress code
+                // must say auth_broken so the org-admin alert email names the real
+                // fix (re-enroll) instead of "check connectivity".
+                (0, distress_1.reportDistress)('hook', distress_1.DISTRESS.AUTH_BROKEN, `check-tool-call HTTP ${resp.status}${shieldKey ? '' : ' (no shield key resolved)'}`);
+            }
+            if (!tryLocalPolicyEnforcement(ctx, call, detail)) {
+                respondDegraded(ctx, detail, call.toolName, authRejected);
             }
             return;
         }

package/dist/commands/mcpGateway.js

@@ -587,6 +587,18 @@ class HttpMcpClient {
         }
     }
 }
+/**
+ * The backend ANSWERED and rejected the machine's shield key (401/403).
+ * Deliberately a distinct type: the offline-fallback catch must report
+ * auth_broken (fix: re-enroll) instead of network_down (fix: wait) — the
+ * 8/12 incident hid a broken key store behind "unreachable" advice.
+ */
+class CredentialsRejectedError extends Error {
+    constructor(status) {
+        super(`the policy service rejected this machine's credentials (HTTP ${status}) — re-enroll with: fullcourtdefense onboard --token <fleet-enrollment-token>`);
+        this.name = 'CredentialsRejectedError';
+    }
+}
 class AgentGuardApi {
     config;
     constructor(config) {
@@ -608,6 +620,8 @@ class AgentGuardApi {
             source: 'runtime_sdk',
         });
         if (!result.success || !result.data) {
+            if (result.status === 401 || result.status === 403)
+                throw new CredentialsRejectedError(result.status);
             throw new Error(result.error || 'Tool-call policy check failed.');
         }
         return result.data;
@@ -706,7 +720,7 @@ class AgentGuardApi {
         });
         const data = await resp.json().catch(() => ({}));
         if (!resp.ok)
-            return { success: false, error: data.error || `AgentGuard API error (${resp.status})` };
+            return { success: false, status: resp.status, error: data.error || `AgentGuard API error (${resp.status})` };
         return data;
     }
     async get(pathValue, timeoutMs = 10_000) {
@@ -717,7 +731,7 @@ class AgentGuardApi {
         });
         const data = await resp.json().catch(() => ({}));
         if (!resp.ok)
-            return { success: false, error: data.error || `AgentGuard API error (${resp.status})` };
+            return { success: false, status: resp.status, error: data.error || `AgentGuard API error (${resp.status})` };
         return data;
     }
     headers() {
@@ -908,7 +922,8 @@ class McpGatewayServer {
                 // same engine the server runs — the machine keeps working (and keeps
                 // enforcing) through the outage instead of blanket fail-open/closed.
                 const detail = err instanceof Error ? err.message : String(err);
-                (0, distress_1.reportDistress)('gateway', distress_1.DISTRESS.NETWORK_DOWN, `check-tool-call unreachable: ${detail}`);
+                const authRejected = err instanceof CredentialsRejectedError;
+                (0, distress_1.reportDistress)('gateway', authRejected ? distress_1.DISTRESS.AUTH_BROKEN : distress_1.DISTRESS.NETWORK_DOWN, `check-tool-call ${authRejected ? 'credentials rejected' : 'unreachable'}: ${detail}`);
                 if (cachedPolicies && cachedPolicies.length > 0) {
                     const inferred = (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs);
                     const localOperation = operation || inferred.operation;

package/dist/commands/onboard.js

@@ -54,6 +54,7 @@ const appDetection_1 = require("../appDetection");
 const integrity_1 = require("../integrity");
 const telemetry_1 = require("../telemetry");
 const envDiagnostics_1 = require("../envDiagnostics");
+const runtimeConfig_1 = require("../runtimeConfig");
 const daemonForensics_1 = require("../daemonForensics");
 const onboardingJournal_1 = require("./onboardingJournal");
 const GREEN = '\x1b[32m';
@@ -293,8 +294,30 @@ async function onboardCommand(args, config) {
         mark('enrollment', 'completed', 'machine enrolled');
     }
     else if (alreadyEnrolled) {
-        console.log(`  ${GREEN}✓${RESET} Already enrolled ${DIM}(shield ${creds.shieldId})${RESET} — pass --token to re-enroll.`);
-        mark('enrollment', 'completed', `reused shield ${creds.shieldId}`);
+        // A locally-resolved key is NOT proof of enrollment: the 8/12 incident
+        // machine printed "Already enrolled ✓" here while the backend 401'd every
+        // hook call (broken key store). Prove the key works before saying so —
+        // and keep the two failure kinds apart: rejected => re-enroll NOW;
+        // unreachable => fine, cached stance applies, don't block onboarding.
+        const validation = await (0, runtimeConfig_1.validateShieldCredentials)({ apiUrl, shieldId: creds.shieldId, shieldKey: creds.shieldKey });
+        if (validation.ok) {
+            console.log(`  ${GREEN}✓${RESET} Already enrolled ${DIM}(shield ${creds.shieldId}, key verified against the backend)${RESET} — pass --token to re-enroll.`);
+            mark('enrollment', 'completed', `reused shield ${creds.shieldId} (key verified)`);
+        }
+        else if (validation.authRejected) {
+            console.log(`  ${RED}✗${RESET} Saved credentials exist but the backend ${BOLD}rejects them${RESET} ${DIM}(${validation.detail})${RESET}.`);
+            console.log(`    Protected actions on this machine would fail-closed until it re-enrolls.`);
+            console.log(`    Get a fleet enrollment token (AI Fleet -> Settings -> Fleet enrollment token), then run:`);
+            console.log(`  ${BOLD}fullcourtdefense onboard --token <fleet-enrollment-token>${RESET}`);
+            mark('enrollment', 'failed', undefined, `backend rejected saved credentials: ${validation.detail}`);
+            report('Re-enroll with a fresh fleet enrollment token: fullcourtdefense onboard --token <token>.');
+            process.exitCode = 1;
+            return;
+        }
+        else {
+            console.log(`  ${YELLOW}!${RESET} Already enrolled ${DIM}(shield ${creds.shieldId})${RESET} — key not verified right now (${validation.detail}); cached enforcement applies.`);
+            mark('enrollment', 'completed', `reused shield ${creds.shieldId} (verification deferred: backend unreachable)`);
+        }
     }
     else {
         console.log(`\n${RED}No fleet enrollment token.${RESET} Ask an org admin for one (AI Fleet -> Settings -> Fleet enrollment token), then run:`);

package/dist/commands/windowsAudit.js

@@ -145,12 +145,33 @@ function auditPreInstallSnapshotPath() {
 function captureAuditPreInstallSnapshot() {
     try {
         const file = auditPreInstallSnapshotPath();
-        if (fs.existsSync(file))
+        const trDir = regString(TRANSCRIPTION_KEY, 'OutputDirectory');
+        // Upgrade guard: when transcription already points at OUR folder, the
+        // current keys are FCD's own configuration written by a pre-snapshot
+        // version (<=1.22.3) — NOT a pre-install state. Recording it would make
+        // uninstall "restore" FCD's keys instead of removing them. Skip the
+        // snapshot; uninstall's conservative heuristic handles FCD-provenance
+        // keys correctly.
+        const fcdProvenance = typeof trDir === 'string' && /FullCourtDefense/i.test(trDir);
+        if (fs.existsSync(file)) {
+            // Self-heal snapshots already written by 1.22.4.0 on upgraded machines:
+            // a "pre-install" transcription directory inside an FCD folder is
+            // provably bogus (FCD did not exist before FCD was installed).
+            try {
+                const existing = JSON.parse(fs.readFileSync(file, 'utf8'));
+                const dir = existing?.transcription?.outputDirectory;
+                if (typeof dir === 'string' && /FullCourtDefense/i.test(dir))
+                    fs.unlinkSync(file);
+            }
+            catch { /* unreadable snapshot: leave it — the uninstall branch parses defensively */ }
+            if (fs.existsSync(file))
+                return;
+        }
+        if (fcdProvenance)
             return;
         const sblValue = regDword(SBL_KEY, 'EnableScriptBlockLogging');
         const trValue = regDword(TRANSCRIPTION_KEY, 'EnableTranscripting');
         const trHeader = regDword(TRANSCRIPTION_KEY, 'EnableInvocationHeader');
-        const trDir = regString(TRANSCRIPTION_KEY, 'OutputDirectory');
         const snapshot = {
             capturedAt: new Date().toISOString(),
             scriptBlockLogging: { present: sblValue !== undefined, enableValue: sblValue },

package/dist/config.d.ts

@@ -100,7 +100,7 @@ export declare function daemonHandoffShieldKey(env?: NodeJS.ProcessEnv): string
  * itself). `none_dpapi_broken` is the credential-broken state: a DPAPI blob
  * exists but would not decrypt and no fallback source was available.
  */
-export type ShieldKeySource = 'override' | 'daemon_handoff' | 'native_store' | 'dpapi' | 'plaintext_config' | 'env' | 'none' | 'none_dpapi_broken';
+export type ShieldKeySource = 'override' | 'daemon_handoff' | 'native_store' | 'machine_file' | 'dpapi' | 'plaintext_config' | 'env' | 'none' | 'none_dpapi_broken';
 export interface CredentialResolutionTrace {
     shieldKeySource: ShieldKeySource;
     dpapiAttempted: boolean;

package/dist/config.js

@@ -55,6 +55,7 @@ const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const distress_1 = require("./distress");
 const credentialStore_1 = require("./credentialStore");
+const machineKeyFile_1 = require("./machineKeyFile");
 const CONFIG_FILENAMES = [
     '.fullcourtdefense.yml',
     '.fullcourtdefense.yaml',
@@ -358,6 +359,26 @@ function maybeMigrateShieldKeyToNativeStore(shieldId, shieldKey) {
     }
     catch { /* migration is opportunistic — legacy sources keep working */ }
 }
+// Once per process, same rationale as the native migration above.
+let machineFileMirrorAttempted = false;
+/**
+ * Self-heal mirror for the S4U daemon (the 1.22.2 regression): whenever an
+ * interactive-session process resolves the key from a store the S4U daemon
+ * cannot read (Credential Manager, DPAPI, plaintext config), copy it into the
+ * ACL-protected machine key file. The very next hook invocation after this
+ * code ships repairs every already-broken machine — no re-enrollment needed.
+ */
+function maybeMirrorShieldKeyToMachineFile(shieldId, shieldKey) {
+    if (machineFileMirrorAttempted || process.platform !== 'win32')
+        return;
+    machineFileMirrorAttempted = true;
+    try {
+        if ((0, machineKeyFile_1.readShieldKeyFromMachineFile)(shieldId) === shieldKey)
+            return; // mirror current
+        (0, machineKeyFile_1.saveShieldKeyToMachineFile)(shieldId, shieldKey); // read-back verified inside
+    }
+    catch { /* mirroring is opportunistic — primary stores keep working */ }
+}
 /** Merge saved ~/.fullcourtdefense.yml + env + optional CLI flag overrides. */
 function resolveCliCredentials(config, overrides = {}, options = {}) {
     // Shield key: same precedence as the old || chain, evaluated stepwise so
@@ -388,6 +409,16 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
         if (shieldKey)
             shieldKeySource = 'native_store';
     }
+    if (!shieldKey && resolvedShieldId) {
+        // S4U/task contexts (daemon, watchdog): Credential Manager and user-scope
+        // DPAPI are both sealed by the user's password-derived master key, which
+        // S4U logon sessions do not have — the read above returns nothing there.
+        // The machine key file is protected by NTFS ACL (SID-based, which S4U
+        // does carry) and is mirrored by interactive-session processes below.
+        shieldKey = (0, machineKeyFile_1.readShieldKeyFromMachineFile)(resolvedShieldId);
+        if (shieldKey)
+            shieldKeySource = 'machine_file';
+    }
     if (!shieldKey && !options.skipDpapi && config.shieldKeyDpapi) {
         dpapiAttempted = true;
         shieldKey = unprotectShieldKeyForCurrentWindowsUser(config.shieldKeyDpapi);
@@ -417,6 +448,14 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
         && (shieldKeySource === 'dpapi' || shieldKeySource === 'plaintext_config')) {
         maybeMigrateShieldKeyToNativeStore(resolvedShieldId, shieldKey);
     }
+    // S4U mirror self-heal: any resolution through a store the S4U daemon
+    // cannot read keeps the machine key file current for it. Skipped on the
+    // shell-free path (skipDpapi): a first-time mirror write spawns
+    // whoami/icacls for the ACL, which that path must never do.
+    if (shieldKey && resolvedShieldId && !options.skipDpapi
+        && (shieldKeySource === 'native_store' || shieldKeySource === 'dpapi' || shieldKeySource === 'plaintext_config')) {
+        maybeMirrorShieldKeyToMachineFile(resolvedShieldId, shieldKey);
+    }
     return {
         apiKey: overrides.apiKey
             || config.apiKey
@@ -499,6 +538,10 @@ function writeSetupConfig(target, input) {
     // where the native binding is blocked keep their PowerShell path.
     if (input.shieldKey && input.shieldId) {
         (0, credentialStore_1.saveShieldKeyNative)(input.shieldId, input.shieldKey);
+        // S4U mirror: the daemon/watchdog tasks cannot read Credential Manager or
+        // user-scope DPAPI (S4U logon has no password-derived master key) — give
+        // them the ACL-protected file at enrollment so they are never key-less.
+        (0, machineKeyFile_1.saveShieldKeyToMachineFile)(input.shieldId, input.shieldKey);
     }
     const protectedShieldKey = input.shieldKey && process.platform === 'win32'
         ? protectShieldKeyForCurrentWindowsUser(input.shieldKey)

package/dist/distress.d.ts

@@ -42,6 +42,10 @@ export declare const DISTRESS: {
     readonly NATIVE_STORE_UNAVAILABLE: "native_store_unavailable";
     /** Native Credential Manager write/verify failed. */
     readonly NATIVE_STORE_FAILED: "native_store_failed";
+    /** S4U-safe machine key file write/verify failed (daemon may stay credential-less). */
+    readonly MACHINE_KEYFILE_FAILED: "machine_keyfile_failed";
+    /** Machine key file kept, but the owner-only ACL could not be applied. */
+    readonly MACHINE_KEYFILE_ACL_FAILED: "machine_keyfile_acl_failed";
     /** Fail-closed engaged: hook is BLOCKING user actions because the policy gate is persistently unreachable. */
     readonly HOOK_FAIL_CLOSED: "hook_fail_closed";
     /** Anything nobody predicted — reported via reportUnexpected(). */

package/dist/distress.js

@@ -86,6 +86,10 @@ exports.DISTRESS = {
     NATIVE_STORE_UNAVAILABLE: 'native_store_unavailable',
     /** Native Credential Manager write/verify failed. */
     NATIVE_STORE_FAILED: 'native_store_failed',
+    /** S4U-safe machine key file write/verify failed (daemon may stay credential-less). */
+    MACHINE_KEYFILE_FAILED: 'machine_keyfile_failed',
+    /** Machine key file kept, but the owner-only ACL could not be applied. */
+    MACHINE_KEYFILE_ACL_FAILED: 'machine_keyfile_acl_failed',
     /** Fail-closed engaged: hook is BLOCKING user actions because the policy gate is persistently unreachable. */
     HOOK_FAIL_CLOSED: 'hook_fail_closed',
     /** Anything nobody predicted — reported via reportUnexpected(). */

package/dist/machineKeyFile.d.ts

@@ -0,0 +1,25 @@
+export declare function machineKeyFilePath(): string;
+/**
+ * Read the shield key mirrored for S4U/task contexts. Plain in-process file
+ * read — safe for the shell-free resolution path. Undefined when absent,
+ * unreadable, malformed, or recorded for a different shield.
+ */
+export declare function readShieldKeyFromMachineFile(shieldId: string): string | undefined;
+/**
+ * Mirror the shield key for S4U/task contexts, read-back verified. Called
+ * from contexts that already hold the decrypted key (enrollment, and the
+ * resolution self-heal in config.ts). Returns false on any failure — the
+ * caller's primary stores are untouched either way.
+ */
+export declare function saveShieldKeyToMachineFile(shieldId: string, shieldKey: string): boolean;
+/** Remove the mirror (unenroll / re-enroll cleanup). Best-effort. */
+export declare function deleteMachineKeyFile(): void;
+/**
+ * Deep self-test probe: write + read-back + ACL inspection with the exact
+ * code paths used for the shield key. Proves the S4U fallback store works
+ * end-to-end on THIS machine.
+ */
+export declare function machineKeyFileProbe(): {
+    ok: boolean;
+    detail: string;
+};

package/dist/machineKeyFile.js

@@ -0,0 +1,226 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.machineKeyFilePath = machineKeyFilePath;
+exports.readShieldKeyFromMachineFile = readShieldKeyFromMachineFile;
+exports.saveShieldKeyToMachineFile = saveShieldKeyToMachineFile;
+exports.deleteMachineKeyFile = deleteMachineKeyFile;
+exports.machineKeyFileProbe = machineKeyFileProbe;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const distress_1 = require("./distress");
+/**
+ * Machine key file — the S4U-safe credential fallback.
+ *
+ * WHY (the 1.22.2 S4U regression): the daemon/watchdog scheduled tasks run
+ * with the S4U logon type — the only supported windowless way to run a
+ * console app from Task Scheduler (see daemon.ts). But an S4U logon session
+ * carries the user's SID WITHOUT the user's password-derived secrets, so both
+ * credential stores fail inside it: user-scope DPAPI cannot derive its master
+ * key, and Credential Manager entries (themselves DPAPI-sealed) cannot be
+ * opened. The daemon therefore resolved no shield key and every bundle poll
+ * 401'd — "auth_broken: bundle fetch HTTP 401 (no shield key available)" —
+ * on every Windows machine running 1.22.2+, silently (the same failure
+ * prevented the distress ledger from being uploaded).
+ *
+ * File ACLs, unlike DPAPI, are enforced against the token's SID — which the
+ * S4U session DOES carry. So processes in the user's interactive session
+ * (enrollment, hooks), which can read the real stores, mirror the key into a
+ * file locked to the user + SYSTEM, and the daemon reads that file where
+ * DPAPI is unavailable.
+ *
+ * SECURITY MODEL: at-rest protection is the NTFS ACL (inheritance stripped;
+ * only the owning user's SID and SYSTEM are granted). Against a same-user
+ * attacker this is equivalent to Credential Manager — CredRead is open to any
+ * process running as the user anyway — and it matches the protection level of
+ * the long-standing `shieldKey` plaintext-config fallback in
+ * ~/.fullcourtdefense.yml. Offline-disk protection comes from BitLocker, as
+ * for every other file. The key is stored base64-wrapped only to keep it out
+ * of casual text greps; that is labeling, not encryption.
+ *
+ * Windows-only: the S4U problem this solves is Windows-specific, and keeping
+ * other platforms untouched keeps the change surgical (same policy as
+ * credentialStore.ts).
+ */
+const FILE_VERSION = 1;
+function machineKeyFilePath() {
+    return path.join(os.homedir(), '.fullcourtdefense', 'machine-key.json');
+}
+/** Cached `whoami /user` SID — one child process per process lifetime, max. */
+let cachedUserSid;
+function currentUserSid() {
+    if (cachedUserSid !== undefined)
+        return cachedUserSid;
+    try {
+        // CSV row: "user","DOMAIN\name","S-1-5-21-..." — the SID is the last field.
+        const csv = (0, child_process_1.execFileSync)('whoami', ['/user', '/fo', 'csv'], {
+            encoding: 'utf8', windowsHide: true, timeout: 10_000,
+        });
+        const match = csv.match(/"(S-1-5-[\d-]+)"/);
+        cachedUserSid = match ? match[1] : null;
+    }
+    catch {
+        cachedUserSid = null;
+    }
+    return cachedUserSid;
+}
+/**
+ * Lock the file to the owning user + SYSTEM via icacls (a plain Windows
+ * executable — no PowerShell, nothing for EDR/CLM to constrain). Returns
+ * false when the ACL could not be applied; the caller decides whether the
+ * default user-profile ACL (other users already denied) is acceptable.
+ */
+function applyOwnerOnlyAcl(file) {
+    const sid = currentUserSid();
+    if (!sid)
+        return false;
+    try {
+        (0, child_process_1.execFileSync)('icacls', [file, '/inheritance:r', '/grant:r', `*${sid}:F`, '*S-1-5-18:F'], {
+            stdio: 'ignore', windowsHide: true, timeout: 10_000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Read the shield key mirrored for S4U/task contexts. Plain in-process file
+ * read — safe for the shell-free resolution path. Undefined when absent,
+ * unreadable, malformed, or recorded for a different shield.
+ */
+function readShieldKeyFromMachineFile(shieldId) {
+    if (process.platform !== 'win32' || !shieldId)
+        return undefined;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(machineKeyFilePath(), 'utf8'));
+        if (!parsed || parsed.v !== FILE_VERSION || parsed.shieldId !== shieldId || !parsed.key)
+            return undefined;
+        const key = Buffer.from(parsed.key, 'base64').toString('utf8');
+        return key || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Mirror the shield key for S4U/task contexts, read-back verified. Called
+ * from contexts that already hold the decrypted key (enrollment, and the
+ * resolution self-heal in config.ts). Returns false on any failure — the
+ * caller's primary stores are untouched either way.
+ */
+function saveShieldKeyToMachineFile(shieldId, shieldKey) {
+    if (process.platform !== 'win32' || !shieldId || !shieldKey)
+        return false;
+    const file = machineKeyFilePath();
+    try {
+        const contents = {
+            v: FILE_VERSION,
+            shieldId,
+            key: Buffer.from(shieldKey, 'utf8').toString('base64'),
+            savedAt: new Date().toISOString(),
+        };
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(contents, null, 2), 'utf8');
+        if (!applyOwnerOnlyAcl(file)) {
+            // The file lives inside the user profile, where other non-admin users
+            // are already denied — keep the mirror (a credential-less daemon is the
+            // worse failure) but surface the weaker-than-intended ACL to the fleet.
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.MACHINE_KEYFILE_ACL_FAILED, 'icacls owner-only ACL could not be applied; file kept with profile-default ACL');
+        }
+        const verified = readShieldKeyFromMachineFile(shieldId) === shieldKey;
+        if (!verified) {
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.MACHINE_KEYFILE_FAILED, 'write succeeded but read-back returned a different value');
+            try {
+                fs.unlinkSync(file);
+            }
+            catch { /* best effort */ }
+        }
+        return verified;
+    }
+    catch (error) {
+        (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.MACHINE_KEYFILE_FAILED, `write failed: ${error instanceof Error ? error.message.slice(0, 120) : String(error)}`);
+        return false;
+    }
+}
+/** Remove the mirror (unenroll / re-enroll cleanup). Best-effort. */
+function deleteMachineKeyFile() {
+    try {
+        fs.unlinkSync(machineKeyFilePath());
+    }
+    catch { /* absent — fine */ }
+}
+/**
+ * Deep self-test probe: write + read-back + ACL inspection with the exact
+ * code paths used for the shield key. Proves the S4U fallback store works
+ * end-to-end on THIS machine.
+ */
+function machineKeyFileProbe() {
+    if (process.platform !== 'win32')
+        return { ok: true, detail: 'not applicable (non-Windows)' };
+    const existing = fs.existsSync(machineKeyFilePath());
+    const probeShieldId = `selftest-${Date.now()}`;
+    const probeKey = `fcd-machinefile-probe-${Date.now()}`;
+    // Never disturb a real mirror: probe against a sibling path by swapping the
+    // real read/write helpers' target through a temp copy of the logic.
+    const probeFile = path.join(path.dirname(machineKeyFilePath()), `machine-key.selftest-${process.pid}.json`);
+    try {
+        fs.mkdirSync(path.dirname(probeFile), { recursive: true });
+        fs.writeFileSync(probeFile, JSON.stringify({
+            v: FILE_VERSION, shieldId: probeShieldId,
+            key: Buffer.from(probeKey, 'utf8').toString('base64'),
+            savedAt: new Date().toISOString(),
+        }, null, 2), 'utf8');
+        const aclOk = applyOwnerOnlyAcl(probeFile);
+        const parsed = JSON.parse(fs.readFileSync(probeFile, 'utf8'));
+        const readOk = Buffer.from(parsed.key, 'base64').toString('utf8') === probeKey;
+        if (!readOk)
+            return { ok: false, detail: 'roundtrip read returned a different value' };
+        return aclOk
+            ? { ok: true, detail: `write + owner-only ACL + read roundtrip OK${existing ? ' (live mirror present)' : ''}` }
+            : { ok: true, detail: 'roundtrip OK; owner-only ACL not applied (profile-default ACL in effect)' };
+    }
+    catch (error) {
+        return { ok: false, detail: `probe failed: ${error instanceof Error ? error.message.slice(0, 160) : String(error)}` };
+    }
+    finally {
+        try {
+            fs.unlinkSync(probeFile);
+        }
+        catch { /* best effort */ }
+    }
+}

package/dist/runtimeConfig.d.ts

@@ -86,6 +86,27 @@ export interface EffectiveBundle extends RuntimeBundle {
  * or a 'default' marker so the caller can apply its local fallback.
  */
 export declare function getRuntimeBundle(input: FetchBundleInput): Promise<EffectiveBundle>;
+export interface CredentialValidationResult {
+    ok: boolean;
+    /** true when the backend answered 401/403 — the key is WRONG, not offline. */
+    authRejected: boolean;
+    detail: string;
+}
+/**
+ * Prove the machine's credentials actually WORK against the backend — a
+ * direct, cache-bypassing bundle fetch that exposes the HTTP outcome.
+ * getRuntimeBundle() deliberately never fails (cache/default fallback keeps
+ * enforcement alive offline), which is exactly wrong for onboarding/doctor:
+ * "resolved a key locally" is not "the backend accepts it". The 8/12 incident
+ * machine printed "Already enrolled ✓" while every hook call 401'd —
+ * validation must separate rejected (re-enroll now) from unreachable (fine,
+ * cached stance applies).
+ */
+export declare function validateShieldCredentials(input: {
+    apiUrl: string;
+    shieldId: string;
+    shieldKey?: string;
+}): Promise<CredentialValidationResult>;
 /**
  * Admin scan-folder choices from the most recent cached bundle (any shield):
  * extra folders to add and default folders the admin removed. Read-only and

package/dist/runtimeConfig.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRuntimeBundle = getRuntimeBundle;
+exports.validateShieldCredentials = validateShieldCredentials;
 exports.getCachedScanRootOverrides = getCachedScanRootOverrides;
 exports.getCachedExtraScanRoots = getCachedExtraScanRoots;
 const fs = __importStar(require("fs"));
@@ -157,6 +158,44 @@ async function getRuntimeBundle(input) {
     }
     return { mode: 'block', version: '', source: 'default' };
 }
+/**
+ * Prove the machine's credentials actually WORK against the backend — a
+ * direct, cache-bypassing bundle fetch that exposes the HTTP outcome.
+ * getRuntimeBundle() deliberately never fails (cache/default fallback keeps
+ * enforcement alive offline), which is exactly wrong for onboarding/doctor:
+ * "resolved a key locally" is not "the backend accepts it". The 8/12 incident
+ * machine printed "Already enrolled ✓" while every hook call 401'd —
+ * validation must separate rejected (re-enroll now) from unreachable (fine,
+ * cached stance applies).
+ */
+async function validateShieldCredentials(input) {
+    if (!input.shieldKey) {
+        return { ok: false, authRejected: false, detail: 'no shield key resolved on this machine' };
+    }
+    try {
+        const params = new URLSearchParams({ shieldId: input.shieldId });
+        const resp = await fetch(`${input.apiUrl}/api/cli/bundle?${params.toString()}`, {
+            method: 'GET',
+            headers: { 'Content-Type': 'application/json', 'x-shield-key': input.shieldKey },
+            signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS),
+        });
+        if (resp.status === 401 || resp.status === 403) {
+            (0, distress_1.reportDistress)('bundle', distress_1.DISTRESS.AUTH_BROKEN, `credential validation HTTP ${resp.status}`);
+            return { ok: false, authRejected: true, detail: `backend rejected the shield key (HTTP ${resp.status})` };
+        }
+        if (!resp.ok) {
+            return { ok: false, authRejected: false, detail: `backend answered HTTP ${resp.status}` };
+        }
+        return { ok: true, authRejected: false, detail: 'backend accepted the shield key' };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            authRejected: false,
+            detail: `control plane unreachable: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
 /**
  * Admin scan-folder choices from the most recent cached bundle (any shield):
  * extra folders to add and default folders the admin removed. Read-only and

package/dist/selfTest.js

@@ -5,6 +5,7 @@ exports.summarizeSelfTest = summarizeSelfTest;
 const child_process_1 = require("child_process");
 const config_1 = require("./config");
 const credentialStore_1 = require("./credentialStore");
+const machineKeyFile_1 = require("./machineKeyFile");
 const runtimeConfig_1 = require("./runtimeConfig");
 const integrity_1 = require("./integrity");
 const selfUpdate_1 = require("./selfUpdate");
@@ -52,6 +53,12 @@ async function runDeepSelfTest(input) {
         // binding and the rollback path to ≤1.21.33.
         const probe = (0, config_1.dpapiRoundtripProbe)();
         add({ id: 'dpapi_roundtrip', label: 'Credential store (DPAPI) roundtrip', ok: probe.ok, detail: probe.detail });
+        // 4. Machine key file — the S4U-safe mirror the daemon/watchdog tasks
+        // read (Credential Manager and DPAPI are both sealed to S4U sessions).
+        // Without it, a daemon under the windowless S4U principal is key-less
+        // and every bundle poll 401s.
+        const keyFile = (0, machineKeyFile_1.machineKeyFileProbe)();
+        add({ id: 'machine_key_file', label: 'Machine key file (S4U mirror) roundtrip', ok: keyFile.ok, detail: keyFile.detail });
     }
     // 3. Credentials resolved on THIS machine right now.
     const trace = (() => {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.22.4"
+  "version": "1.22.6"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.22.4",
+  "version": "1.22.6",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -54,6 +54,8 @@
     "test:update-loop": "npm run build && node scripts/test-update-loop-detection.js",
     "test:bricked-rescue": "npm run build && node scripts/test-bricked-machine-rescue.js",
     "test:native-credstore": "npm run build && node scripts/test-native-credential-store.js",
+    "test:machine-key-file": "npm run build && node scripts/test-machine-key-file.js",
+    "test:auth-rejection": "npm run build && node scripts/test-auth-rejection.js",
     "test:real-life": "npm run build && node scripts/test-real-life-scenarios.js",
     "test:node-updater": "npm run build && node scripts/test-node-updater.js",
     "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",