fullcourtdefense-cli 1.22.5 → 1.22.7

package/dist/commands/daemon.js

@@ -385,6 +385,10 @@ async function runDaemon(args, config) {
     if (postmortem) {
         log(`Previous daemon (v${postmortem.version || '?'}) died UNCLEANLY — last alive ${postmortem.lastAliveAt || 'unknown'}, no shutdown recorded. Likely killed externally (EDR/AV, OOM, or forced termination). Post-mortem recorded; reporting upstream.`);
     }
+    // A fresh daemon runs right after every successful MSI update: if a
+    // previously-reported update loop has been resolved by this version, clear
+    // it so heartbeats stop shipping it as live distress.
+    (0, selfUpdate_1.clearResolvedUpdateLoop)(cliVersion(), log);
     // --- state ---------------------------------------------------------------
     const watchers = new Map(); // directory -> watcher
     const rootWatchers = new Map(); // admin protection roots -> recursive watcher
@@ -399,18 +403,33 @@ async function runDaemon(args, config) {
     let autoUpdatePolicy;
     /** Heartbeat ticks spent without full credentials (drives recovery cadence). */
     let credRecoveryTicks = 0;
+    /** Enrollment-file mtime at the last recovery attempt — a change means the
+     *  user just ran login/onboard and fresh credentials are waiting. */
+    let lastEnrollmentMtimeMs = 0;
     /**
      * A daemon that starts without a usable shield key (DPAPI decrypt blocked,
      * config written after start by `login`) must NOT stay credential-less
      * forever — that silences telemetry AND auto-update, stranding the machine.
      * Retry quickly right after start, then hourly (each retry may spawn
-     * PowerShell for DPAPI, which we keep rare on machines that block it).
+     * PowerShell for DPAPI, which we keep rare on machines that block it) —
+     * EXCEPT when ~/.fullcourtdefense.yml changed, which means a re-enrollment
+     * just happened: retry on the very next tick, so a repaired machine comes
+     * back within one heartbeat instead of up to an hour later (the 8/12
+     * incident: re-enroll fixed the hooks instantly while the daemon kept
+     * 401-ing for 16 more minutes).
      */
     const recoverCredentialsIfMissing = () => {
         if (creds.shieldId && creds.shieldKey)
             return;
+        let enrollmentChanged = false;
+        try {
+            const mtime = fs.statSync((0, config_1.getHomeConfigPath)()).mtimeMs;
+            enrollmentChanged = mtime !== lastEnrollmentMtimeMs;
+            lastEnrollmentMtimeMs = mtime;
+        }
+        catch { /* no config file — the tick cadence below applies */ }
         credRecoveryTicks += 1;
-        if (credRecoveryTicks > 3 && credRecoveryTicks % 12 !== 0)
+        if (!enrollmentChanged && credRecoveryTicks > 3 && credRecoveryTicks % 12 !== 0)
             return;
         try {
             const fresh = (0, config_1.resolveCliCredentials)((0, config_1.loadConfig)(args.config), {
@@ -1407,6 +1426,7 @@ function windowsTaskRunsInteractive(taskName) {
  * Upgrade an EXISTING (working) task to the windowless S4U principal. Tries
  * ONLY the S4U XML — on failure (unelevated daemon) the current task is left
  * untouched so autostart never regresses from "flashes" to "broken".
+ * Returns true when the task now runs S4U.
  */
 function upgradeTaskWindowless(taskName, s4uXml, logFn) {
     const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
@@ -1423,12 +1443,40 @@ function upgradeTaskWindowless(taskName, s4uXml, logFn) {
         });
         if (created.status === 0) {
             logFn(`Self-heal: "${taskName}" migrated to the windowless S4U principal (no more console-window flash).`);
+            return true;
         }
-        else {
-            logFn(`Self-heal: could not migrate "${taskName}" to S4U (needs elevation) — existing task kept as-is.`);
-        }
+        logFn(`Self-heal: could not migrate "${taskName}" to S4U (needs elevation) — asking the elevated updater task to do it.`);
+        return false;
+    }
+    catch {
+        return false; /* keep the existing working task */
+    }
+}
+/**
+ * The unelevated daemon cannot rewrite task principals — but the SYSTEM
+ * "FullCourtDefense Updater" task can, and its stage-1 repair pass migrates
+ * InteractiveToken tasks BEFORE any network work (so it succeeds even behind
+ * a blocked egress). Kick it ONCE per daemon lifetime when self-heal could
+ * not flip a task itself: same-boot windowless fix instead of waiting for
+ * the 03:07 daily run (lptx1110 flashed CMD windows for a day because the
+ * MSI's PowerShell migration was silently blocked and self-heal had no
+ * elevation). The task grants Authenticated Users read+execute, so an
+ * unelevated /Run works by design (same path as org-pushed upgrades).
+ */
+let updaterMigrationKicked = false;
+function kickUpdaterTaskForMigration(logFn) {
+    if (updaterMigrationKicked)
+        return;
+    updaterMigrationKicked = true;
+    try {
+        const run = (0, child_process_1.spawnSync)('schtasks', ['/Run', '/TN', selfUpdate_1.MSI_UPDATER_TASK_NAME], {
+            stdio: 'ignore', windowsHide: true, timeout: 20_000,
+        });
+        logFn(run.status === 0
+            ? `Self-heal: elevated updater task triggered — it migrates the tasks to S4U now (windowless within a minute).`
+            : `Self-heal: updater task unavailable for the S4U migration — its next daily run (03:07) will migrate instead.`);
     }
-    catch { /* keep the existing working task */ }
+    catch { /* best-effort — the daily schedule remains the backstop */ }
 }
 /** True when the per-user Run-key fallback still names wscript/a .vbs. */
 function windowsRunKeyReferencesScriptHost() {
@@ -1561,13 +1609,18 @@ function ensureWindowsAutostartHealthy(logFn) {
         }
         // Migration (1.22.1 -> 1.22.2): InteractiveToken tasks flash a console
         // window on every trigger. Upgrade healthy existing tasks to S4U; S4U-only
-        // attempt so a denied re-registration never breaks a working task.
+        // attempt so a denied re-registration never breaks a working task. When
+        // unelevated self-heal cannot flip them, kick the SYSTEM updater task
+        // once — its repair pass migrates with real elevation (1.22.7).
+        let migrationDenied = false;
         if (daemonTask.status === 0 && !legacyDaemon && windowsTaskRunsInteractive(TASK_NAME)) {
-            upgradeTaskWindowless(TASK_NAME, buildDaemonTaskXml()[0], logFn);
+            migrationDenied = !upgradeTaskWindowless(TASK_NAME, buildDaemonTaskXml()[0], logFn) || migrationDenied;
         }
         if (watchdogQuery.status === 0 && !legacyWatchdog && windowsTaskRunsInteractive(WATCHDOG_TASK_NAME)) {
-            upgradeTaskWindowless(WATCHDOG_TASK_NAME, buildWatchdogTaskXml()[0], logFn);
+            migrationDenied = !upgradeTaskWindowless(WATCHDOG_TASK_NAME, buildWatchdogTaskXml()[0], logFn) || migrationDenied;
         }
+        if (migrationDenied)
+            kickUpdaterTaskForMigration(logFn);
         // A stale Run-key fallback from an older install may still name wscript.
         if (windowsRunKeyReferencesScriptHost()) {
             (0, child_process_1.spawnSync)('reg', [

package/dist/commands/doctor.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.doctorCommand = doctorCommand;
+const config_1 = require("../config");
+const runtimeConfig_1 = require("../runtimeConfig");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 function withTimeout(ms) {
     return AbortSignal.timeout(ms);
@@ -8,6 +10,35 @@ function withTimeout(ms) {
 function normalizeApiUrl(url) {
     return (url || DEFAULT_API_URL).replace(/\/$/, '');
 }
+/**
+ * Credential health, printed after connectivity passes. Connectivity alone is
+ * a false comfort: the 8/12 incident machine had a green ping while the
+ * backend rejected its shield key on every call (broken local key store), so
+ * every protected action failed closed. Doctor must surface that state.
+ */
+async function checkCredentials(apiUrl, config) {
+    const creds = (0, config_1.resolveCliCredentials)(config, { apiUrl });
+    if (!creds.shieldId || !creds.shieldKey) {
+        console.log('INFO not enrolled on this machine (no saved shield credentials)');
+        console.log('     Enroll with: fullcourtdefense onboard --token <fleet-enrollment-token>');
+        return true;
+    }
+    const started = Date.now();
+    const validation = await (0, runtimeConfig_1.validateShieldCredentials)({ apiUrl, shieldId: creds.shieldId, shieldKey: creds.shieldKey });
+    const elapsed = Date.now() - started;
+    if (validation.ok) {
+        console.log(`PASS machine credentials accepted by the backend (shield ${creds.shieldId}, ${elapsed}ms)`);
+        return true;
+    }
+    if (validation.authRejected) {
+        console.log(`FAIL backend REJECTS this machine's saved credentials (${validation.detail})`);
+        console.log('     Protected actions fail-closed until the machine re-enrolls.');
+        console.log('     Fix: fullcourtdefense onboard --token <fleet-enrollment-token>');
+        return false;
+    }
+    console.log(`WARN could not verify credentials right now (${validation.detail}); cached enforcement applies`);
+    return true;
+}
 async function doctorCommand(args, config) {
     const apiUrl = normalizeApiUrl(args.apiUrl || config.apiUrl);
     const pingUrl = `${apiUrl}/api/health/ping`;
@@ -27,6 +58,9 @@ async function doctorCommand(args, config) {
         if (resp.ok) {
             console.log(`PASS outbound HTTPS open (${resp.status}, ${elapsed}ms)`);
             console.log(`Checked: ${pingUrl}`);
+            if (!(await checkCredentials(apiUrl, config))) {
+                process.exit(1);
+            }
             return;
         }
         console.log(`WARN health ping reachable but returned HTTP ${resp.status} (${elapsed}ms)`);
@@ -46,6 +80,9 @@ async function doctorCommand(args, config) {
         if (resp.ok) {
             console.log(`PASS root API reachable (${resp.status}, ${elapsed}ms)`);
             console.log(`Checked: ${rootUrl}`);
+            if (!(await checkCredentials(apiUrl, config))) {
+                process.exit(1);
+            }
             return;
         }
         console.log(`FAIL root API returned HTTP ${resp.status} (${elapsed}ms)`);

package/dist/commands/hook.js

@@ -373,21 +373,31 @@ async function fetchWithOneRetry(url, init, timeoutMs, onFailure) {
  * spooled (`offlineEnforced`) and replayed to the backend when connectivity
  * returns, and distress signals make the episode visible to org admins.
  */
-function respondDegraded(ctx, detail, toolName) {
+function respondDegraded(ctx, detail, toolName, authRejected = false) {
+    // "Unreachable" and "credentials rejected" need OPPOSITE fixes (wait vs
+    // re-enroll) and different alerts. The 8/12 incident machine showed users
+    // "restore connectivity" advice for hours while the real fix was a 30-second
+    // re-enrollment — never conflate the two again.
+    const cause = authRejected
+        ? 'the policy service rejected this machine\'s credentials'
+        : 'policy service unreachable';
+    const advice = authRejected
+        ? 'Re-enroll this machine: fullcourtdefense onboard --token <fleet-enrollment-token>.'
+        : 'Do not retry until the connection is restored.';
     if (ctx.failClosed && !ctx.shadow) {
         const health = (0, policyGateHealth_1.recordGateFailure)();
         if ((0, policyGateHealth_1.shouldFailClosed)(health)) {
             // Persistent outage on an enforcing machine: block, and raise a CRITICAL
             // distress code — the daemon heartbeat ships it and org admins get the
             // proactive alert email (fleet-alerts pipeline).
-            (0, distress_1.reportDistress)('hook', distress_1.DISTRESS.HOOK_FAIL_CLOSED, `Blocking ${ctx.event} actions: policy gate unreachable ${health.consecutiveFailures} times in a row since ${health.firstFailureAt || 'now'} (${detail})`);
+            (0, distress_1.reportDistress)('hook', authRejected ? distress_1.DISTRESS.AUTH_BROKEN : distress_1.DISTRESS.HOOK_FAIL_CLOSED, `Blocking ${ctx.event} actions: ${cause} ${health.consecutiveFailures} times in a row since ${health.firstFailureAt || 'now'} (${detail})`);
             (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, reason: `fail-closed: ${detail}`, offlineEnforced: true });
             (0, telemetry_1.triggerFlush)(true);
-            ctx.respond(true, `Blocked by FullCourtDefense — policy service unreachable (${health.consecutiveFailures}x in a row) and this machine is set to fail-closed. ${detail}`, `FullCourtDefense could not verify this ${ctx.event} against your org policies (${detail}) and the outage is persistent, so fail-closed mode is blocking. Do not retry until the connection is restored.`);
+            ctx.respond(true, `Blocked by FullCourtDefense — ${cause} (${health.consecutiveFailures}x in a row) and this machine is set to fail-closed. ${detail} ${advice}`, `FullCourtDefense could not verify this ${ctx.event} against your org policies (${detail}) and the failure is persistent, so fail-closed mode is blocking. ${advice}`);
         }
         // Grace window: transient failure on a fail-closed machine — allow this
         // action, but record distress so the episode is visible in the console.
-        (0, distress_1.reportDistress)('hook', distress_1.DISTRESS.NETWORK_DOWN, `Policy gate failure ${health.consecutiveFailures}/3 (grace window, still allowing): ${detail}`);
+        (0, distress_1.reportDistress)('hook', authRejected ? distress_1.DISTRESS.AUTH_BROKEN : distress_1.DISTRESS.NETWORK_DOWN, `Policy gate failure ${health.consecutiveFailures}/3 (grace window, still allowing): ${detail}`);
         dbg({ phase: 'policy_grace_allow', event: ctx.event, consecutiveFailures: health.consecutiveFailures, detail });
         (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, reason: `degraded (grace ${health.consecutiveFailures}/3): ${detail}`, offlineEnforced: true });
         (0, telemetry_1.triggerFlush)(false);
@@ -883,8 +893,19 @@ async function enforceActionPolicy(ctx) {
         }, timeoutMs, (attempt, err) => dbg({ phase: 'policy_retry', event, attempt, error: err }));
         if (!resp.ok) {
             dbg({ phase: 'policy_http_error', event, status: resp.status, failClosed: ctx.failClosed });
-            if (!tryLocalPolicyEnforcement(ctx, call, `Backend returned HTTP ${resp.status}.`)) {
-                respondDegraded(ctx, `Backend returned HTTP ${resp.status}.`, call.toolName);
+            const authRejected = resp.status === 401 || resp.status === 403;
+            const detail = authRejected
+                ? `The policy service rejected this machine's credentials (HTTP ${resp.status}) — the shield key saved here is broken or revoked, not a network problem.`
+                : `Backend returned HTTP ${resp.status}.`;
+            if (authRejected) {
+                // Rejected key = every future call fails identically. Cached policies
+                // (below) remain the best enforcement stance, but the distress code
+                // must say auth_broken so the org-admin alert email names the real
+                // fix (re-enroll) instead of "check connectivity".
+                (0, distress_1.reportDistress)('hook', distress_1.DISTRESS.AUTH_BROKEN, `check-tool-call HTTP ${resp.status}${shieldKey ? '' : ' (no shield key resolved)'}`);
+            }
+            if (!tryLocalPolicyEnforcement(ctx, call, detail)) {
+                respondDegraded(ctx, detail, call.toolName, authRejected);
             }
             return;
         }

package/dist/commands/mcpGateway.js

@@ -587,6 +587,18 @@ class HttpMcpClient {
         }
     }
 }
+/**
+ * The backend ANSWERED and rejected the machine's shield key (401/403).
+ * Deliberately a distinct type: the offline-fallback catch must report
+ * auth_broken (fix: re-enroll) instead of network_down (fix: wait) — the
+ * 8/12 incident hid a broken key store behind "unreachable" advice.
+ */
+class CredentialsRejectedError extends Error {
+    constructor(status) {
+        super(`the policy service rejected this machine's credentials (HTTP ${status}) — re-enroll with: fullcourtdefense onboard --token <fleet-enrollment-token>`);
+        this.name = 'CredentialsRejectedError';
+    }
+}
 class AgentGuardApi {
     config;
     constructor(config) {
@@ -608,6 +620,8 @@ class AgentGuardApi {
             source: 'runtime_sdk',
         });
         if (!result.success || !result.data) {
+            if (result.status === 401 || result.status === 403)
+                throw new CredentialsRejectedError(result.status);
             throw new Error(result.error || 'Tool-call policy check failed.');
         }
         return result.data;
@@ -706,7 +720,7 @@ class AgentGuardApi {
         });
         const data = await resp.json().catch(() => ({}));
         if (!resp.ok)
-            return { success: false, error: data.error || `AgentGuard API error (${resp.status})` };
+            return { success: false, status: resp.status, error: data.error || `AgentGuard API error (${resp.status})` };
         return data;
     }
     async get(pathValue, timeoutMs = 10_000) {
@@ -717,7 +731,7 @@ class AgentGuardApi {
         });
         const data = await resp.json().catch(() => ({}));
         if (!resp.ok)
-            return { success: false, error: data.error || `AgentGuard API error (${resp.status})` };
+            return { success: false, status: resp.status, error: data.error || `AgentGuard API error (${resp.status})` };
         return data;
     }
     headers() {
@@ -908,7 +922,8 @@ class McpGatewayServer {
                 // same engine the server runs — the machine keeps working (and keeps
                 // enforcing) through the outage instead of blanket fail-open/closed.
                 const detail = err instanceof Error ? err.message : String(err);
-                (0, distress_1.reportDistress)('gateway', distress_1.DISTRESS.NETWORK_DOWN, `check-tool-call unreachable: ${detail}`);
+                const authRejected = err instanceof CredentialsRejectedError;
+                (0, distress_1.reportDistress)('gateway', authRejected ? distress_1.DISTRESS.AUTH_BROKEN : distress_1.DISTRESS.NETWORK_DOWN, `check-tool-call ${authRejected ? 'credentials rejected' : 'unreachable'}: ${detail}`);
                 if (cachedPolicies && cachedPolicies.length > 0) {
                     const inferred = (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs);
                     const localOperation = operation || inferred.operation;

package/dist/commands/onboard.js

@@ -54,6 +54,7 @@ const appDetection_1 = require("../appDetection");
 const integrity_1 = require("../integrity");
 const telemetry_1 = require("../telemetry");
 const envDiagnostics_1 = require("../envDiagnostics");
+const runtimeConfig_1 = require("../runtimeConfig");
 const daemonForensics_1 = require("../daemonForensics");
 const onboardingJournal_1 = require("./onboardingJournal");
 const GREEN = '\x1b[32m';
@@ -293,8 +294,30 @@ async function onboardCommand(args, config) {
         mark('enrollment', 'completed', 'machine enrolled');
     }
     else if (alreadyEnrolled) {
-        console.log(`  ${GREEN}✓${RESET} Already enrolled ${DIM}(shield ${creds.shieldId})${RESET} — pass --token to re-enroll.`);
-        mark('enrollment', 'completed', `reused shield ${creds.shieldId}`);
+        // A locally-resolved key is NOT proof of enrollment: the 8/12 incident
+        // machine printed "Already enrolled ✓" here while the backend 401'd every
+        // hook call (broken key store). Prove the key works before saying so —
+        // and keep the two failure kinds apart: rejected => re-enroll NOW;
+        // unreachable => fine, cached stance applies, don't block onboarding.
+        const validation = await (0, runtimeConfig_1.validateShieldCredentials)({ apiUrl, shieldId: creds.shieldId, shieldKey: creds.shieldKey });
+        if (validation.ok) {
+            console.log(`  ${GREEN}✓${RESET} Already enrolled ${DIM}(shield ${creds.shieldId}, key verified against the backend)${RESET} — pass --token to re-enroll.`);
+            mark('enrollment', 'completed', `reused shield ${creds.shieldId} (key verified)`);
+        }
+        else if (validation.authRejected) {
+            console.log(`  ${RED}✗${RESET} Saved credentials exist but the backend ${BOLD}rejects them${RESET} ${DIM}(${validation.detail})${RESET}.`);
+            console.log(`    Protected actions on this machine would fail-closed until it re-enrolls.`);
+            console.log(`    Get a fleet enrollment token (AI Fleet -> Settings -> Fleet enrollment token), then run:`);
+            console.log(`  ${BOLD}fullcourtdefense onboard --token <fleet-enrollment-token>${RESET}`);
+            mark('enrollment', 'failed', undefined, `backend rejected saved credentials: ${validation.detail}`);
+            report('Re-enroll with a fresh fleet enrollment token: fullcourtdefense onboard --token <token>.');
+            process.exitCode = 1;
+            return;
+        }
+        else {
+            console.log(`  ${YELLOW}!${RESET} Already enrolled ${DIM}(shield ${creds.shieldId})${RESET} — key not verified right now (${validation.detail}); cached enforcement applies.`);
+            mark('enrollment', 'completed', `reused shield ${creds.shieldId} (verification deferred: backend unreachable)`);
+        }
     }
     else {
         console.log(`\n${RED}No fleet enrollment token.${RESET} Ask an org admin for one (AI Fleet -> Settings -> Fleet enrollment token), then run:`);

package/dist/config.d.ts

@@ -100,7 +100,7 @@ export declare function daemonHandoffShieldKey(env?: NodeJS.ProcessEnv): string
  * itself). `none_dpapi_broken` is the credential-broken state: a DPAPI blob
  * exists but would not decrypt and no fallback source was available.
  */
-export type ShieldKeySource = 'override' | 'daemon_handoff' | 'native_store' | 'dpapi' | 'plaintext_config' | 'env' | 'none' | 'none_dpapi_broken';
+export type ShieldKeySource = 'override' | 'daemon_handoff' | 'native_store' | 'machine_file' | 'dpapi' | 'plaintext_config' | 'env' | 'none' | 'none_dpapi_broken';
 export interface CredentialResolutionTrace {
     shieldKeySource: ShieldKeySource;
     dpapiAttempted: boolean;

package/dist/config.js

@@ -55,6 +55,7 @@ const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const distress_1 = require("./distress");
 const credentialStore_1 = require("./credentialStore");
+const machineKeyFile_1 = require("./machineKeyFile");
 const CONFIG_FILENAMES = [
     '.fullcourtdefense.yml',
     '.fullcourtdefense.yaml',
@@ -358,6 +359,26 @@ function maybeMigrateShieldKeyToNativeStore(shieldId, shieldKey) {
     }
     catch { /* migration is opportunistic — legacy sources keep working */ }
 }
+// Once per process, same rationale as the native migration above.
+let machineFileMirrorAttempted = false;
+/**
+ * Self-heal mirror for the S4U daemon (the 1.22.2 regression): whenever an
+ * interactive-session process resolves the key from a store the S4U daemon
+ * cannot read (Credential Manager, DPAPI, plaintext config), copy it into the
+ * ACL-protected machine key file. The very next hook invocation after this
+ * code ships repairs every already-broken machine — no re-enrollment needed.
+ */
+function maybeMirrorShieldKeyToMachineFile(shieldId, shieldKey) {
+    if (machineFileMirrorAttempted || process.platform !== 'win32')
+        return;
+    machineFileMirrorAttempted = true;
+    try {
+        if ((0, machineKeyFile_1.readShieldKeyFromMachineFile)(shieldId) === shieldKey)
+            return; // mirror current
+        (0, machineKeyFile_1.saveShieldKeyToMachineFile)(shieldId, shieldKey); // read-back verified inside
+    }
+    catch { /* mirroring is opportunistic — primary stores keep working */ }
+}
 /** Merge saved ~/.fullcourtdefense.yml + env + optional CLI flag overrides. */
 function resolveCliCredentials(config, overrides = {}, options = {}) {
     // Shield key: same precedence as the old || chain, evaluated stepwise so
@@ -388,6 +409,16 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
         if (shieldKey)
             shieldKeySource = 'native_store';
     }
+    if (!shieldKey && resolvedShieldId) {
+        // S4U/task contexts (daemon, watchdog): Credential Manager and user-scope
+        // DPAPI are both sealed by the user's password-derived master key, which
+        // S4U logon sessions do not have — the read above returns nothing there.
+        // The machine key file is protected by NTFS ACL (SID-based, which S4U
+        // does carry) and is mirrored by interactive-session processes below.
+        shieldKey = (0, machineKeyFile_1.readShieldKeyFromMachineFile)(resolvedShieldId);
+        if (shieldKey)
+            shieldKeySource = 'machine_file';
+    }
     if (!shieldKey && !options.skipDpapi && config.shieldKeyDpapi) {
         dpapiAttempted = true;
         shieldKey = unprotectShieldKeyForCurrentWindowsUser(config.shieldKeyDpapi);
@@ -417,6 +448,14 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
         && (shieldKeySource === 'dpapi' || shieldKeySource === 'plaintext_config')) {
         maybeMigrateShieldKeyToNativeStore(resolvedShieldId, shieldKey);
     }
+    // S4U mirror self-heal: any resolution through a store the S4U daemon
+    // cannot read keeps the machine key file current for it. Skipped on the
+    // shell-free path (skipDpapi): a first-time mirror write spawns
+    // whoami/icacls for the ACL, which that path must never do.
+    if (shieldKey && resolvedShieldId && !options.skipDpapi
+        && (shieldKeySource === 'native_store' || shieldKeySource === 'dpapi' || shieldKeySource === 'plaintext_config')) {
+        maybeMirrorShieldKeyToMachineFile(resolvedShieldId, shieldKey);
+    }
     return {
         apiKey: overrides.apiKey
             || config.apiKey
@@ -499,6 +538,10 @@ function writeSetupConfig(target, input) {
     // where the native binding is blocked keep their PowerShell path.
     if (input.shieldKey && input.shieldId) {
         (0, credentialStore_1.saveShieldKeyNative)(input.shieldId, input.shieldKey);
+        // S4U mirror: the daemon/watchdog tasks cannot read Credential Manager or
+        // user-scope DPAPI (S4U logon has no password-derived master key) — give
+        // them the ACL-protected file at enrollment so they are never key-less.
+        (0, machineKeyFile_1.saveShieldKeyToMachineFile)(input.shieldId, input.shieldKey);
     }
     const protectedShieldKey = input.shieldKey && process.platform === 'win32'
         ? protectShieldKeyForCurrentWindowsUser(input.shieldKey)

package/dist/distress.d.ts

@@ -42,6 +42,10 @@ export declare const DISTRESS: {
     readonly NATIVE_STORE_UNAVAILABLE: "native_store_unavailable";
     /** Native Credential Manager write/verify failed. */
     readonly NATIVE_STORE_FAILED: "native_store_failed";
+    /** S4U-safe machine key file write/verify failed (daemon may stay credential-less). */
+    readonly MACHINE_KEYFILE_FAILED: "machine_keyfile_failed";
+    /** Machine key file kept, but the owner-only ACL could not be applied. */
+    readonly MACHINE_KEYFILE_ACL_FAILED: "machine_keyfile_acl_failed";
     /** Fail-closed engaged: hook is BLOCKING user actions because the policy gate is persistently unreachable. */
     readonly HOOK_FAIL_CLOSED: "hook_fail_closed";
     /** Anything nobody predicted — reported via reportUnexpected(). */
@@ -70,6 +74,14 @@ export declare function distressFile(): string;
 export declare function reportDistress(component: string, code: string, detail?: string): void;
 /** Structured capture for failures nobody predicted. */
 export declare function reportUnexpected(component: string, error: unknown): void;
+/**
+ * Remove a code from the ledger once its condition is PROVEN resolved (e.g.
+ * update_loop after the installed version reaches the looping target). Keeps
+ * the shipped ledger truthful: resolved incidents must stop riding along in
+ * heartbeats, where they read as live problems in the console and the fleet
+ * alerter. Returns true when something was actually cleared.
+ */
+export declare function clearDistress(code: string, component?: string): boolean;
 /**
  * Recent distress for the heartbeat: entries seen within `windowMs`
  * (default 24h), newest last, capped for transport.

package/dist/distress.js

@@ -37,6 +37,7 @@ exports.DISTRESS = void 0;
 exports.distressFile = distressFile;
 exports.reportDistress = reportDistress;
 exports.reportUnexpected = reportUnexpected;
+exports.clearDistress = clearDistress;
 exports.readDistressSnapshot = readDistressSnapshot;
 exports.readDistressLedger = readDistressLedger;
 const fs = __importStar(require("fs"));
@@ -86,6 +87,10 @@ exports.DISTRESS = {
     NATIVE_STORE_UNAVAILABLE: 'native_store_unavailable',
     /** Native Credential Manager write/verify failed. */
     NATIVE_STORE_FAILED: 'native_store_failed',
+    /** S4U-safe machine key file write/verify failed (daemon may stay credential-less). */
+    MACHINE_KEYFILE_FAILED: 'machine_keyfile_failed',
+    /** Machine key file kept, but the owner-only ACL could not be applied. */
+    MACHINE_KEYFILE_ACL_FAILED: 'machine_keyfile_acl_failed',
     /** Fail-closed engaged: hook is BLOCKING user actions because the policy gate is persistently unreachable. */
     HOOK_FAIL_CLOSED: 'hook_fail_closed',
     /** Anything nobody predicted — reported via reportUnexpected(). */
@@ -168,6 +173,31 @@ function reportUnexpected(component, error) {
     const message = error instanceof Error ? error.message : String(error);
     reportDistress(component, exports.DISTRESS.UNEXPECTED, message);
 }
+/**
+ * Remove a code from the ledger once its condition is PROVEN resolved (e.g.
+ * update_loop after the installed version reaches the looping target). Keeps
+ * the shipped ledger truthful: resolved incidents must stop riding along in
+ * heartbeats, where they read as live problems in the console and the fleet
+ * alerter. Returns true when something was actually cleared.
+ */
+function clearDistress(code, component) {
+    try {
+        const entries = readLedger();
+        const remaining = entries.filter(e => !(e.code === code && (!component || e.component === component)));
+        if (remaining.length === entries.length)
+            return false;
+        writeLedger(remaining);
+        try {
+            const line = `[${new Date().toISOString()}] DISTRESS ${code} resolved — cleared from ledger\n`;
+            fs.appendFileSync(path.join(stateDir(), 'daemon.log'), line, 'utf8');
+        }
+        catch { /* best-effort */ }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Recent distress for the heartbeat: entries seen within `windowMs`
  * (default 24h), newest last, capped for transport.

package/dist/machineKeyFile.d.ts

@@ -0,0 +1,25 @@
+export declare function machineKeyFilePath(): string;
+/**
+ * Read the shield key mirrored for S4U/task contexts. Plain in-process file
+ * read — safe for the shell-free resolution path. Undefined when absent,
+ * unreadable, malformed, or recorded for a different shield.
+ */
+export declare function readShieldKeyFromMachineFile(shieldId: string): string | undefined;
+/**
+ * Mirror the shield key for S4U/task contexts, read-back verified. Called
+ * from contexts that already hold the decrypted key (enrollment, and the
+ * resolution self-heal in config.ts). Returns false on any failure — the
+ * caller's primary stores are untouched either way.
+ */
+export declare function saveShieldKeyToMachineFile(shieldId: string, shieldKey: string): boolean;
+/** Remove the mirror (unenroll / re-enroll cleanup). Best-effort. */
+export declare function deleteMachineKeyFile(): void;
+/**
+ * Deep self-test probe: write + read-back + ACL inspection with the exact
+ * code paths used for the shield key. Proves the S4U fallback store works
+ * end-to-end on THIS machine.
+ */
+export declare function machineKeyFileProbe(): {
+    ok: boolean;
+    detail: string;
+};

package/dist/machineKeyFile.js

@@ -0,0 +1,226 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.machineKeyFilePath = machineKeyFilePath;
+exports.readShieldKeyFromMachineFile = readShieldKeyFromMachineFile;
+exports.saveShieldKeyToMachineFile = saveShieldKeyToMachineFile;
+exports.deleteMachineKeyFile = deleteMachineKeyFile;
+exports.machineKeyFileProbe = machineKeyFileProbe;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const distress_1 = require("./distress");
+/**
+ * Machine key file — the S4U-safe credential fallback.
+ *
+ * WHY (the 1.22.2 S4U regression): the daemon/watchdog scheduled tasks run
+ * with the S4U logon type — the only supported windowless way to run a
+ * console app from Task Scheduler (see daemon.ts). But an S4U logon session
+ * carries the user's SID WITHOUT the user's password-derived secrets, so both
+ * credential stores fail inside it: user-scope DPAPI cannot derive its master
+ * key, and Credential Manager entries (themselves DPAPI-sealed) cannot be
+ * opened. The daemon therefore resolved no shield key and every bundle poll
+ * 401'd — "auth_broken: bundle fetch HTTP 401 (no shield key available)" —
+ * on every Windows machine running 1.22.2+, silently (the same failure
+ * prevented the distress ledger from being uploaded).
+ *
+ * File ACLs, unlike DPAPI, are enforced against the token's SID — which the
+ * S4U session DOES carry. So processes in the user's interactive session
+ * (enrollment, hooks), which can read the real stores, mirror the key into a
+ * file locked to the user + SYSTEM, and the daemon reads that file where
+ * DPAPI is unavailable.
+ *
+ * SECURITY MODEL: at-rest protection is the NTFS ACL (inheritance stripped;
+ * only the owning user's SID and SYSTEM are granted). Against a same-user
+ * attacker this is equivalent to Credential Manager — CredRead is open to any
+ * process running as the user anyway — and it matches the protection level of
+ * the long-standing `shieldKey` plaintext-config fallback in
+ * ~/.fullcourtdefense.yml. Offline-disk protection comes from BitLocker, as
+ * for every other file. The key is stored base64-wrapped only to keep it out
+ * of casual text greps; that is labeling, not encryption.
+ *
+ * Windows-only: the S4U problem this solves is Windows-specific, and keeping
+ * other platforms untouched keeps the change surgical (same policy as
+ * credentialStore.ts).
+ */
+const FILE_VERSION = 1;
+function machineKeyFilePath() {
+    return path.join(os.homedir(), '.fullcourtdefense', 'machine-key.json');
+}
+/** Cached `whoami /user` SID — one child process per process lifetime, max. */
+let cachedUserSid;
+function currentUserSid() {
+    if (cachedUserSid !== undefined)
+        return cachedUserSid;
+    try {
+        // CSV row: "user","DOMAIN\name","S-1-5-21-..." — the SID is the last field.
+        const csv = (0, child_process_1.execFileSync)('whoami', ['/user', '/fo', 'csv'], {
+            encoding: 'utf8', windowsHide: true, timeout: 10_000,
+        });
+        const match = csv.match(/"(S-1-5-[\d-]+)"/);
+        cachedUserSid = match ? match[1] : null;
+    }
+    catch {
+        cachedUserSid = null;
+    }
+    return cachedUserSid;
+}
+/**
+ * Lock the file to the owning user + SYSTEM via icacls (a plain Windows
+ * executable — no PowerShell, nothing for EDR/CLM to constrain). Returns
+ * false when the ACL could not be applied; the caller decides whether the
+ * default user-profile ACL (other users already denied) is acceptable.
+ */
+function applyOwnerOnlyAcl(file) {
+    const sid = currentUserSid();
+    if (!sid)
+        return false;
+    try {
+        (0, child_process_1.execFileSync)('icacls', [file, '/inheritance:r', '/grant:r', `*${sid}:F`, '*S-1-5-18:F'], {
+            stdio: 'ignore', windowsHide: true, timeout: 10_000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Read the shield key mirrored for S4U/task contexts. Plain in-process file
+ * read — safe for the shell-free resolution path. Undefined when absent,
+ * unreadable, malformed, or recorded for a different shield.
+ */
+function readShieldKeyFromMachineFile(shieldId) {
+    if (process.platform !== 'win32' || !shieldId)
+        return undefined;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(machineKeyFilePath(), 'utf8'));
+        if (!parsed || parsed.v !== FILE_VERSION || parsed.shieldId !== shieldId || !parsed.key)
+            return undefined;
+        const key = Buffer.from(parsed.key, 'base64').toString('utf8');
+        return key || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Mirror the shield key for S4U/task contexts, read-back verified. Called
+ * from contexts that already hold the decrypted key (enrollment, and the
+ * resolution self-heal in config.ts). Returns false on any failure — the
+ * caller's primary stores are untouched either way.
+ */
+function saveShieldKeyToMachineFile(shieldId, shieldKey) {
+    if (process.platform !== 'win32' || !shieldId || !shieldKey)
+        return false;
+    const file = machineKeyFilePath();
+    try {
+        const contents = {
+            v: FILE_VERSION,
+            shieldId,
+            key: Buffer.from(shieldKey, 'utf8').toString('base64'),
+            savedAt: new Date().toISOString(),
+        };
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(contents, null, 2), 'utf8');
+        if (!applyOwnerOnlyAcl(file)) {
+            // The file lives inside the user profile, where other non-admin users
+            // are already denied — keep the mirror (a credential-less daemon is the
+            // worse failure) but surface the weaker-than-intended ACL to the fleet.
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.MACHINE_KEYFILE_ACL_FAILED, 'icacls owner-only ACL could not be applied; file kept with profile-default ACL');
+        }
+        const verified = readShieldKeyFromMachineFile(shieldId) === shieldKey;
+        if (!verified) {
+            (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.MACHINE_KEYFILE_FAILED, 'write succeeded but read-back returned a different value');
+            try {
+                fs.unlinkSync(file);
+            }
+            catch { /* best effort */ }
+        }
+        return verified;
+    }
+    catch (error) {
+        (0, distress_1.reportDistress)('credentials', distress_1.DISTRESS.MACHINE_KEYFILE_FAILED, `write failed: ${error instanceof Error ? error.message.slice(0, 120) : String(error)}`);
+        return false;
+    }
+}
+/** Remove the mirror (unenroll / re-enroll cleanup). Best-effort. */
+function deleteMachineKeyFile() {
+    try {
+        fs.unlinkSync(machineKeyFilePath());
+    }
+    catch { /* absent — fine */ }
+}
+/**
+ * Deep self-test probe: write + read-back + ACL inspection with the exact
+ * code paths used for the shield key. Proves the S4U fallback store works
+ * end-to-end on THIS machine.
+ */
+function machineKeyFileProbe() {
+    if (process.platform !== 'win32')
+        return { ok: true, detail: 'not applicable (non-Windows)' };
+    const existing = fs.existsSync(machineKeyFilePath());
+    const probeShieldId = `selftest-${Date.now()}`;
+    const probeKey = `fcd-machinefile-probe-${Date.now()}`;
+    // Never disturb a real mirror: probe against a sibling path by swapping the
+    // real read/write helpers' target through a temp copy of the logic.
+    const probeFile = path.join(path.dirname(machineKeyFilePath()), `machine-key.selftest-${process.pid}.json`);
+    try {
+        fs.mkdirSync(path.dirname(probeFile), { recursive: true });
+        fs.writeFileSync(probeFile, JSON.stringify({
+            v: FILE_VERSION, shieldId: probeShieldId,
+            key: Buffer.from(probeKey, 'utf8').toString('base64'),
+            savedAt: new Date().toISOString(),
+        }, null, 2), 'utf8');
+        const aclOk = applyOwnerOnlyAcl(probeFile);
+        const parsed = JSON.parse(fs.readFileSync(probeFile, 'utf8'));
+        const readOk = Buffer.from(parsed.key, 'base64').toString('utf8') === probeKey;
+        if (!readOk)
+            return { ok: false, detail: 'roundtrip read returned a different value' };
+        return aclOk
+            ? { ok: true, detail: `write + owner-only ACL + read roundtrip OK${existing ? ' (live mirror present)' : ''}` }
+            : { ok: true, detail: 'roundtrip OK; owner-only ACL not applied (profile-default ACL in effect)' };
+    }
+    catch (error) {
+        return { ok: false, detail: `probe failed: ${error instanceof Error ? error.message.slice(0, 160) : String(error)}` };
+    }
+    finally {
+        try {
+            fs.unlinkSync(probeFile);
+        }
+        catch { /* best effort */ }
+    }
+}

package/dist/runtimeConfig.d.ts

@@ -86,6 +86,27 @@ export interface EffectiveBundle extends RuntimeBundle {
  * or a 'default' marker so the caller can apply its local fallback.
  */
 export declare function getRuntimeBundle(input: FetchBundleInput): Promise<EffectiveBundle>;
+export interface CredentialValidationResult {
+    ok: boolean;
+    /** true when the backend answered 401/403 — the key is WRONG, not offline. */
+    authRejected: boolean;
+    detail: string;
+}
+/**
+ * Prove the machine's credentials actually WORK against the backend — a
+ * direct, cache-bypassing bundle fetch that exposes the HTTP outcome.
+ * getRuntimeBundle() deliberately never fails (cache/default fallback keeps
+ * enforcement alive offline), which is exactly wrong for onboarding/doctor:
+ * "resolved a key locally" is not "the backend accepts it". The 8/12 incident
+ * machine printed "Already enrolled ✓" while every hook call 401'd —
+ * validation must separate rejected (re-enroll now) from unreachable (fine,
+ * cached stance applies).
+ */
+export declare function validateShieldCredentials(input: {
+    apiUrl: string;
+    shieldId: string;
+    shieldKey?: string;
+}): Promise<CredentialValidationResult>;
 /**
  * Admin scan-folder choices from the most recent cached bundle (any shield):
  * extra folders to add and default folders the admin removed. Read-only and

package/dist/runtimeConfig.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRuntimeBundle = getRuntimeBundle;
+exports.validateShieldCredentials = validateShieldCredentials;
 exports.getCachedScanRootOverrides = getCachedScanRootOverrides;
 exports.getCachedExtraScanRoots = getCachedExtraScanRoots;
 const fs = __importStar(require("fs"));
@@ -157,6 +158,44 @@ async function getRuntimeBundle(input) {
     }
     return { mode: 'block', version: '', source: 'default' };
 }
+/**
+ * Prove the machine's credentials actually WORK against the backend — a
+ * direct, cache-bypassing bundle fetch that exposes the HTTP outcome.
+ * getRuntimeBundle() deliberately never fails (cache/default fallback keeps
+ * enforcement alive offline), which is exactly wrong for onboarding/doctor:
+ * "resolved a key locally" is not "the backend accepts it". The 8/12 incident
+ * machine printed "Already enrolled ✓" while every hook call 401'd —
+ * validation must separate rejected (re-enroll now) from unreachable (fine,
+ * cached stance applies).
+ */
+async function validateShieldCredentials(input) {
+    if (!input.shieldKey) {
+        return { ok: false, authRejected: false, detail: 'no shield key resolved on this machine' };
+    }
+    try {
+        const params = new URLSearchParams({ shieldId: input.shieldId });
+        const resp = await fetch(`${input.apiUrl}/api/cli/bundle?${params.toString()}`, {
+            method: 'GET',
+            headers: { 'Content-Type': 'application/json', 'x-shield-key': input.shieldKey },
+            signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS),
+        });
+        if (resp.status === 401 || resp.status === 403) {
+            (0, distress_1.reportDistress)('bundle', distress_1.DISTRESS.AUTH_BROKEN, `credential validation HTTP ${resp.status}`);
+            return { ok: false, authRejected: true, detail: `backend rejected the shield key (HTTP ${resp.status})` };
+        }
+        if (!resp.ok) {
+            return { ok: false, authRejected: false, detail: `backend answered HTTP ${resp.status}` };
+        }
+        return { ok: true, authRejected: false, detail: 'backend accepted the shield key' };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            authRejected: false,
+            detail: `control plane unreachable: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
 /**
  * Admin scan-folder choices from the most recent cached bundle (any shield):
  * extra folders to add and default folders the admin removed. Read-only and

package/dist/selfTest.js

@@ -5,6 +5,7 @@ exports.summarizeSelfTest = summarizeSelfTest;
 const child_process_1 = require("child_process");
 const config_1 = require("./config");
 const credentialStore_1 = require("./credentialStore");
+const machineKeyFile_1 = require("./machineKeyFile");
 const runtimeConfig_1 = require("./runtimeConfig");
 const integrity_1 = require("./integrity");
 const selfUpdate_1 = require("./selfUpdate");
@@ -52,6 +53,12 @@ async function runDeepSelfTest(input) {
         // binding and the rollback path to ≤1.21.33.
         const probe = (0, config_1.dpapiRoundtripProbe)();
         add({ id: 'dpapi_roundtrip', label: 'Credential store (DPAPI) roundtrip', ok: probe.ok, detail: probe.detail });
+        // 4. Machine key file — the S4U-safe mirror the daemon/watchdog tasks
+        // read (Credential Manager and DPAPI are both sealed to S4U sessions).
+        // Without it, a daemon under the windowless S4U principal is key-less
+        // and every bundle poll 401s.
+        const keyFile = (0, machineKeyFile_1.machineKeyFileProbe)();
+        add({ id: 'machine_key_file', label: 'Machine key file (S4U mirror) roundtrip', ok: keyFile.ok, detail: keyFile.detail });
     }
     // 3. Credentials resolved on THIS machine right now.
     const trace = (() => {

package/dist/selfUpdate.d.ts

@@ -56,6 +56,16 @@ export declare function modernizeUpdaterTask(log: (message: string) => void): vo
  * fleet-visible evidence of WHY).
  */
 export declare function readUpdaterLogTail(maxLines?: number): string[];
+/**
+ * Clear update_loop distress once the machine PROVABLY moved past the loop:
+ * the installed version reached (or passed) the looping target, or the
+ * installed version changed at all since the attempts record was written.
+ * Called at daemon boot (a fresh daemon starts right after every MSI update)
+ * and when the bundle target is already satisfied. Without this, a resolved
+ * loop keeps shipping in the 24h ledger snapshot and reads as a live problem
+ * in the console. Cheap no-op when there is no attempts record.
+ */
+export declare function clearResolvedUpdateLoop(currentVersion: string | undefined, log?: (message: string) => void): void;
 /**
  * Upgrade this machine to targetVersion if it is newer than currentVersion.
  * Cheap no-op when already current, when a kick is still pending, or when the

package/dist/selfUpdate.js

@@ -41,6 +41,7 @@ exports.buildUpdaterTaskCommand = buildUpdaterTaskCommand;
 exports.updaterTaskNeedsModernization = updaterTaskNeedsModernization;
 exports.modernizeUpdaterTask = modernizeUpdaterTask;
 exports.readUpdaterLogTail = readUpdaterLogTail;
+exports.clearResolvedUpdateLoop = clearResolvedUpdateLoop;
 exports.maybeSelfUpdate = maybeSelfUpdate;
 exports.installedMsiVersion = installedMsiVersion;
 const fs = __importStar(require("fs"));
@@ -291,6 +292,42 @@ function recordUpdateAttempt(target, fromVersion) {
         return 1;
     }
 }
+/**
+ * Clear update_loop distress once the machine PROVABLY moved past the loop:
+ * the installed version reached (or passed) the looping target, or the
+ * installed version changed at all since the attempts record was written.
+ * Called at daemon boot (a fresh daemon starts right after every MSI update)
+ * and when the bundle target is already satisfied. Without this, a resolved
+ * loop keeps shipping in the 24h ledger snapshot and reads as a live problem
+ * in the console. Cheap no-op when there is no attempts record.
+ */
+function clearResolvedUpdateLoop(currentVersion, log) {
+    if (!currentVersion)
+        return;
+    try {
+        let record;
+        try {
+            record = JSON.parse(fs.readFileSync(updateAttemptsFile(), 'utf8'));
+        }
+        catch {
+            return; // nothing ever looped
+        }
+        if (!record || typeof record.target !== 'string')
+            return;
+        const reachedTarget = compareCliVersions(record.target, currentVersion) <= 0;
+        const versionMoved = typeof record.fromVersion === 'string' && record.fromVersion !== currentVersion;
+        if (!reachedTarget && !versionMoved)
+            return;
+        try {
+            fs.unlinkSync(updateAttemptsFile());
+        }
+        catch { /* best-effort */ }
+        if ((0, distress_1.clearDistress)(distress_1.DISTRESS.UPDATE_LOOP) && log) {
+            log(`Self-update: update loop resolved (installed ${currentVersion}, was looping toward ${record.target}) — distress cleared.`);
+        }
+    }
+    catch { /* resolution bookkeeping must never disturb the caller */ }
+}
 /** How many times an update to the same target was kicked without the version moving. */
 const UPDATE_LOOP_THRESHOLD = 3;
 let updateInFlightSince = 0;
@@ -310,8 +347,12 @@ function maybeSelfUpdate(input) {
         return undefined;
     if (input.busy)
         return undefined;
-    if (compareCliVersions(input.targetVersion, input.currentVersion) <= 0)
+    if (compareCliVersions(input.targetVersion, input.currentVersion) <= 0) {
+        // Already current — if a loop was previously reported toward this (or an
+        // older) target, it is resolved now: stop shipping it as live distress.
+        clearResolvedUpdateLoop(input.currentVersion, log);
         return undefined;
+    }
     // A NEW target always gets an immediate attempt. The old global cooldown
     // incorrectly suppressed 1.18.10 after a failed 1.18.9 task.
     if (!input.force

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.22.5"
+  "version": "1.22.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.22.5",
+  "version": "1.22.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -54,6 +54,8 @@
     "test:update-loop": "npm run build && node scripts/test-update-loop-detection.js",
     "test:bricked-rescue": "npm run build && node scripts/test-bricked-machine-rescue.js",
     "test:native-credstore": "npm run build && node scripts/test-native-credential-store.js",
+    "test:machine-key-file": "npm run build && node scripts/test-machine-key-file.js",
+    "test:auth-rejection": "npm run build && node scripts/test-auth-rejection.js",
     "test:real-life": "npm run build && node scripts/test-real-life-scenarios.js",
     "test:node-updater": "npm run build && node scripts/test-node-updater.js",
     "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
@@ -63,6 +65,7 @@
     "test:blocking-approval": "npm run build && node scripts/test-blocking-approval-drill.js",
     "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",
     "test:no-script-host": "npm run build && node scripts/test-no-script-host.js",
+    "test:s4u-migration": "npm run build && node scripts/test-s4u-task-migration.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
     "prepublishOnly": "npm run build"
   },