fullcourtdefense-cli 1.22.6 → 1.22.7

package/dist/commands/daemon.js

@@ -385,6 +385,10 @@ async function runDaemon(args, config) {
     if (postmortem) {
         log(`Previous daemon (v${postmortem.version || '?'}) died UNCLEANLY — last alive ${postmortem.lastAliveAt || 'unknown'}, no shutdown recorded. Likely killed externally (EDR/AV, OOM, or forced termination). Post-mortem recorded; reporting upstream.`);
     }
+    // A fresh daemon runs right after every successful MSI update: if a
+    // previously-reported update loop has been resolved by this version, clear
+    // it so heartbeats stop shipping it as live distress.
+    (0, selfUpdate_1.clearResolvedUpdateLoop)(cliVersion(), log);
     // --- state ---------------------------------------------------------------
     const watchers = new Map(); // directory -> watcher
     const rootWatchers = new Map(); // admin protection roots -> recursive watcher
@@ -1422,6 +1426,7 @@ function windowsTaskRunsInteractive(taskName) {
  * Upgrade an EXISTING (working) task to the windowless S4U principal. Tries
  * ONLY the S4U XML — on failure (unelevated daemon) the current task is left
  * untouched so autostart never regresses from "flashes" to "broken".
+ * Returns true when the task now runs S4U.
  */
 function upgradeTaskWindowless(taskName, s4uXml, logFn) {
     const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
@@ -1438,12 +1443,40 @@ function upgradeTaskWindowless(taskName, s4uXml, logFn) {
         });
         if (created.status === 0) {
             logFn(`Self-heal: "${taskName}" migrated to the windowless S4U principal (no more console-window flash).`);
+            return true;
         }
-        else {
-            logFn(`Self-heal: could not migrate "${taskName}" to S4U (needs elevation) — existing task kept as-is.`);
-        }
+        logFn(`Self-heal: could not migrate "${taskName}" to S4U (needs elevation) — asking the elevated updater task to do it.`);
+        return false;
+    }
+    catch {
+        return false; /* keep the existing working task */
+    }
+}
+/**
+ * The unelevated daemon cannot rewrite task principals — but the SYSTEM
+ * "FullCourtDefense Updater" task can, and its stage-1 repair pass migrates
+ * InteractiveToken tasks BEFORE any network work (so it succeeds even behind
+ * a blocked egress). Kick it ONCE per daemon lifetime when self-heal could
+ * not flip a task itself: same-boot windowless fix instead of waiting for
+ * the 03:07 daily run (lptx1110 flashed CMD windows for a day because the
+ * MSI's PowerShell migration was silently blocked and self-heal had no
+ * elevation). The task grants Authenticated Users read+execute, so an
+ * unelevated /Run works by design (same path as org-pushed upgrades).
+ */
+let updaterMigrationKicked = false;
+function kickUpdaterTaskForMigration(logFn) {
+    if (updaterMigrationKicked)
+        return;
+    updaterMigrationKicked = true;
+    try {
+        const run = (0, child_process_1.spawnSync)('schtasks', ['/Run', '/TN', selfUpdate_1.MSI_UPDATER_TASK_NAME], {
+            stdio: 'ignore', windowsHide: true, timeout: 20_000,
+        });
+        logFn(run.status === 0
+            ? `Self-heal: elevated updater task triggered — it migrates the tasks to S4U now (windowless within a minute).`
+            : `Self-heal: updater task unavailable for the S4U migration — its next daily run (03:07) will migrate instead.`);
     }
-    catch { /* keep the existing working task */ }
+    catch { /* best-effort — the daily schedule remains the backstop */ }
 }
 /** True when the per-user Run-key fallback still names wscript/a .vbs. */
 function windowsRunKeyReferencesScriptHost() {
@@ -1576,13 +1609,18 @@ function ensureWindowsAutostartHealthy(logFn) {
         }
         // Migration (1.22.1 -> 1.22.2): InteractiveToken tasks flash a console
         // window on every trigger. Upgrade healthy existing tasks to S4U; S4U-only
-        // attempt so a denied re-registration never breaks a working task.
+        // attempt so a denied re-registration never breaks a working task. When
+        // unelevated self-heal cannot flip them, kick the SYSTEM updater task
+        // once — its repair pass migrates with real elevation (1.22.7).
+        let migrationDenied = false;
         if (daemonTask.status === 0 && !legacyDaemon && windowsTaskRunsInteractive(TASK_NAME)) {
-            upgradeTaskWindowless(TASK_NAME, buildDaemonTaskXml()[0], logFn);
+            migrationDenied = !upgradeTaskWindowless(TASK_NAME, buildDaemonTaskXml()[0], logFn) || migrationDenied;
         }
         if (watchdogQuery.status === 0 && !legacyWatchdog && windowsTaskRunsInteractive(WATCHDOG_TASK_NAME)) {
-            upgradeTaskWindowless(WATCHDOG_TASK_NAME, buildWatchdogTaskXml()[0], logFn);
+            migrationDenied = !upgradeTaskWindowless(WATCHDOG_TASK_NAME, buildWatchdogTaskXml()[0], logFn) || migrationDenied;
         }
+        if (migrationDenied)
+            kickUpdaterTaskForMigration(logFn);
         // A stale Run-key fallback from an older install may still name wscript.
         if (windowsRunKeyReferencesScriptHost()) {
             (0, child_process_1.spawnSync)('reg', [

package/dist/distress.d.ts

@@ -74,6 +74,14 @@ export declare function distressFile(): string;
 export declare function reportDistress(component: string, code: string, detail?: string): void;
 /** Structured capture for failures nobody predicted. */
 export declare function reportUnexpected(component: string, error: unknown): void;
+/**
+ * Remove a code from the ledger once its condition is PROVEN resolved (e.g.
+ * update_loop after the installed version reaches the looping target). Keeps
+ * the shipped ledger truthful: resolved incidents must stop riding along in
+ * heartbeats, where they read as live problems in the console and the fleet
+ * alerter. Returns true when something was actually cleared.
+ */
+export declare function clearDistress(code: string, component?: string): boolean;
 /**
  * Recent distress for the heartbeat: entries seen within `windowMs`
  * (default 24h), newest last, capped for transport.

package/dist/distress.js

@@ -37,6 +37,7 @@ exports.DISTRESS = void 0;
 exports.distressFile = distressFile;
 exports.reportDistress = reportDistress;
 exports.reportUnexpected = reportUnexpected;
+exports.clearDistress = clearDistress;
 exports.readDistressSnapshot = readDistressSnapshot;
 exports.readDistressLedger = readDistressLedger;
 const fs = __importStar(require("fs"));
@@ -172,6 +173,31 @@ function reportUnexpected(component, error) {
     const message = error instanceof Error ? error.message : String(error);
     reportDistress(component, exports.DISTRESS.UNEXPECTED, message);
 }
+/**
+ * Remove a code from the ledger once its condition is PROVEN resolved (e.g.
+ * update_loop after the installed version reaches the looping target). Keeps
+ * the shipped ledger truthful: resolved incidents must stop riding along in
+ * heartbeats, where they read as live problems in the console and the fleet
+ * alerter. Returns true when something was actually cleared.
+ */
+function clearDistress(code, component) {
+    try {
+        const entries = readLedger();
+        const remaining = entries.filter(e => !(e.code === code && (!component || e.component === component)));
+        if (remaining.length === entries.length)
+            return false;
+        writeLedger(remaining);
+        try {
+            const line = `[${new Date().toISOString()}] DISTRESS ${code} resolved — cleared from ledger\n`;
+            fs.appendFileSync(path.join(stateDir(), 'daemon.log'), line, 'utf8');
+        }
+        catch { /* best-effort */ }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Recent distress for the heartbeat: entries seen within `windowMs`
  * (default 24h), newest last, capped for transport.

package/dist/selfUpdate.d.ts

@@ -56,6 +56,16 @@ export declare function modernizeUpdaterTask(log: (message: string) => void): vo
  * fleet-visible evidence of WHY).
  */
 export declare function readUpdaterLogTail(maxLines?: number): string[];
+/**
+ * Clear update_loop distress once the machine PROVABLY moved past the loop:
+ * the installed version reached (or passed) the looping target, or the
+ * installed version changed at all since the attempts record was written.
+ * Called at daemon boot (a fresh daemon starts right after every MSI update)
+ * and when the bundle target is already satisfied. Without this, a resolved
+ * loop keeps shipping in the 24h ledger snapshot and reads as a live problem
+ * in the console. Cheap no-op when there is no attempts record.
+ */
+export declare function clearResolvedUpdateLoop(currentVersion: string | undefined, log?: (message: string) => void): void;
 /**
  * Upgrade this machine to targetVersion if it is newer than currentVersion.
  * Cheap no-op when already current, when a kick is still pending, or when the

package/dist/selfUpdate.js

@@ -41,6 +41,7 @@ exports.buildUpdaterTaskCommand = buildUpdaterTaskCommand;
 exports.updaterTaskNeedsModernization = updaterTaskNeedsModernization;
 exports.modernizeUpdaterTask = modernizeUpdaterTask;
 exports.readUpdaterLogTail = readUpdaterLogTail;
+exports.clearResolvedUpdateLoop = clearResolvedUpdateLoop;
 exports.maybeSelfUpdate = maybeSelfUpdate;
 exports.installedMsiVersion = installedMsiVersion;
 const fs = __importStar(require("fs"));
@@ -291,6 +292,42 @@ function recordUpdateAttempt(target, fromVersion) {
         return 1;
     }
 }
+/**
+ * Clear update_loop distress once the machine PROVABLY moved past the loop:
+ * the installed version reached (or passed) the looping target, or the
+ * installed version changed at all since the attempts record was written.
+ * Called at daemon boot (a fresh daemon starts right after every MSI update)
+ * and when the bundle target is already satisfied. Without this, a resolved
+ * loop keeps shipping in the 24h ledger snapshot and reads as a live problem
+ * in the console. Cheap no-op when there is no attempts record.
+ */
+function clearResolvedUpdateLoop(currentVersion, log) {
+    if (!currentVersion)
+        return;
+    try {
+        let record;
+        try {
+            record = JSON.parse(fs.readFileSync(updateAttemptsFile(), 'utf8'));
+        }
+        catch {
+            return; // nothing ever looped
+        }
+        if (!record || typeof record.target !== 'string')
+            return;
+        const reachedTarget = compareCliVersions(record.target, currentVersion) <= 0;
+        const versionMoved = typeof record.fromVersion === 'string' && record.fromVersion !== currentVersion;
+        if (!reachedTarget && !versionMoved)
+            return;
+        try {
+            fs.unlinkSync(updateAttemptsFile());
+        }
+        catch { /* best-effort */ }
+        if ((0, distress_1.clearDistress)(distress_1.DISTRESS.UPDATE_LOOP) && log) {
+            log(`Self-update: update loop resolved (installed ${currentVersion}, was looping toward ${record.target}) — distress cleared.`);
+        }
+    }
+    catch { /* resolution bookkeeping must never disturb the caller */ }
+}
 /** How many times an update to the same target was kicked without the version moving. */
 const UPDATE_LOOP_THRESHOLD = 3;
 let updateInFlightSince = 0;
@@ -310,8 +347,12 @@ function maybeSelfUpdate(input) {
         return undefined;
     if (input.busy)
         return undefined;
-    if (compareCliVersions(input.targetVersion, input.currentVersion) <= 0)
+    if (compareCliVersions(input.targetVersion, input.currentVersion) <= 0) {
+        // Already current — if a loop was previously reported toward this (or an
+        // older) target, it is resolved now: stop shipping it as live distress.
+        clearResolvedUpdateLoop(input.currentVersion, log);
         return undefined;
+    }
     // A NEW target always gets an immediate attempt. The old global cooldown
     // incorrectly suppressed 1.18.10 after a failed 1.18.9 task.
     if (!input.force

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.22.6"
+  "version": "1.22.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.22.6",
+  "version": "1.22.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -65,6 +65,7 @@
     "test:blocking-approval": "npm run build && node scripts/test-blocking-approval-drill.js",
     "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",
     "test:no-script-host": "npm run build && node scripts/test-no-script-host.js",
+    "test:s4u-migration": "npm run build && node scripts/test-s4u-task-migration.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
     "prepublishOnly": "npm run build"
   },