fullcourtdefense-cli 1.25.1 → 1.25.3

package/dist/commands/daemon.d.ts

@@ -38,14 +38,27 @@ export type TaskLogonType = 'S4U' | 'InteractiveToken';
 export declare function taskUserId(): string;
 /** Local wall-clock timestamp (no ms, no tz) as Task Scheduler expects. */
 export declare function taskLocalTimestamp(date: Date): string;
+/** Full path to conhost.exe — the signed Windows binary whose `--headless`
+ *  flag hosts a console child on a hidden pseudoconsole (no window, ever). */
+export declare function conhostPath(): string;
 /**
  * Task Scheduler XML that runs `node.exe <cliEntry> <command>` hidden.
  *
  * @param command    CLI subcommand + args ('daemon' | 'watchdog' | 'discover …').
  * @param triggers   Inner <Triggers> XML — logon for the daemon, a repeating
  *                   time trigger for the 5-minute watchdog.
- * @param logonType  S4U (windowless, needs elevation to register) or
- *                   InteractiveToken (registers unelevated, may flash).
+ * @param logonType  S4U (windowless by session, needs elevation to register) or
+ *                   InteractiveToken (registers unelevated — the action is
+ *                   wrapped in `conhost --headless` so it is ALSO windowless).
+ *
+ * Why the conhost wrapper: an InteractiveToken task runs console apps on the
+ * interactive desktop — a visible window on EVERY trigger (the "console flash
+ * every 5 minutes" complaint). Current Windows builds deny S4U registration to
+ * everyone except the task's own user running elevated (even SYSTEM gets
+ * Access denied — verified empirically; the updater's SYSTEM repair pass can
+ * no longer fix it). `conhost.exe --headless` sidesteps the whole fight: the
+ * child gets a hidden pseudoconsole, no window ever exists, registration
+ * stays unelevated, and no script host is involved (Defender-safe).
  */
 export declare function buildTaskXml(command: string, triggers: string, logonType?: TaskLogonType): string;
 /**
@@ -74,6 +87,11 @@ export declare function windowsTaskReferencesScriptHost(taskName: string): boole
  *  the 1.22.1 window-flash bug (console window on every trigger). Migration
  *  trigger for the windowless S4U principal. */
 export declare function windowsTaskRunsInteractive(taskName: string): boolean;
+/** True when triggering the task would open a VISIBLE console window:
+ *  InteractiveToken principal AND a bare console action (not wrapped in
+ *  `conhost --headless`). This — not the principal alone — is the flash
+ *  condition; a conhost-wrapped InteractiveToken task is fully windowless. */
+export declare function windowsTaskRunsVisibly(taskName: string): boolean;
 /** Snapshot of the resident daemon for out-of-process callers (watchdog/status). */
 export interface DaemonRuntimeState {
     alive: boolean;

package/dist/commands/daemon.js

@@ -39,11 +39,13 @@ exports.discoverSweepCredentialEnv = discoverSweepCredentialEnv;
 exports.cliVersion = cliVersion;
 exports.taskUserId = taskUserId;
 exports.taskLocalTimestamp = taskLocalTimestamp;
+exports.conhostPath = conhostPath;
 exports.buildTaskXml = buildTaskXml;
 exports.buildTaskXmlVariants = buildTaskXmlVariants;
 exports.registerHiddenTask = registerHiddenTask;
 exports.windowsTaskReferencesScriptHost = windowsTaskReferencesScriptHost;
 exports.windowsTaskRunsInteractive = windowsTaskRunsInteractive;
+exports.windowsTaskRunsVisibly = windowsTaskRunsVisibly;
 exports.daemonRuntimeState = daemonRuntimeState;
 exports.spawnDetachedDaemon = spawnDetachedDaemon;
 exports.pidIsAlive = pidIsAlive;
@@ -1261,23 +1263,41 @@ function taskLocalTimestamp(date) {
     return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}` +
         `T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`;
 }
+/** Full path to conhost.exe — the signed Windows binary whose `--headless`
+ *  flag hosts a console child on a hidden pseudoconsole (no window, ever). */
+function conhostPath() {
+    return path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'conhost.exe');
+}
 /**
  * Task Scheduler XML that runs `node.exe <cliEntry> <command>` hidden.
  *
  * @param command    CLI subcommand + args ('daemon' | 'watchdog' | 'discover …').
  * @param triggers   Inner <Triggers> XML — logon for the daemon, a repeating
  *                   time trigger for the 5-minute watchdog.
- * @param logonType  S4U (windowless, needs elevation to register) or
- *                   InteractiveToken (registers unelevated, may flash).
+ * @param logonType  S4U (windowless by session, needs elevation to register) or
+ *                   InteractiveToken (registers unelevated — the action is
+ *                   wrapped in `conhost --headless` so it is ALSO windowless).
+ *
+ * Why the conhost wrapper: an InteractiveToken task runs console apps on the
+ * interactive desktop — a visible window on EVERY trigger (the "console flash
+ * every 5 minutes" complaint). Current Windows builds deny S4U registration to
+ * everyone except the task's own user running elevated (even SYSTEM gets
+ * Access denied — verified empirically; the updater's SYSTEM repair pass can
+ * no longer fix it). `conhost.exe --headless` sidesteps the whole fight: the
+ * child gets a hidden pseudoconsole, no window ever exists, registration
+ * stays unelevated, and no script host is involved (Defender-safe).
  */
 function buildTaskXml(command, triggers, logonType = 'S4U') {
     const userId = xmlEscape(taskUserId());
-    const nodeExe = xmlEscape(process.execPath);
-    const args = xmlEscape(`"${cliEntry()}" ${command}`);
+    const headless = logonType === 'InteractiveToken';
+    const execCommand = headless ? xmlEscape(conhostPath()) : xmlEscape(process.execPath);
+    const args = headless
+        ? xmlEscape(`--headless "${process.execPath}" "${cliEntry()}" ${command}`)
+        : xmlEscape(`"${cliEntry()}" ${command}`);
     return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
-    <Description>FullCourtDefense ${xmlEscape(command)} — runs node directly, windowless, no script host.</Description>
+    <Description>FullCourtDefense ${xmlEscape(command)} — runs node ${headless ? 'under conhost --headless' : 'directly'}, windowless, no script host.</Description>
   </RegistrationInfo>
   <Triggers>
 ${triggers}
@@ -1307,7 +1327,7 @@ ${triggers}
   </Settings>
   <Actions Context="Author">
     <Exec>
-      <Command>${nodeExe}</Command>
+      <Command>${execCommand}</Command>
       <Arguments>${args}</Arguments>
     </Exec>
   </Actions>
@@ -1383,10 +1403,10 @@ function registerHiddenTask(taskName, xml, command, scheduleArgs) {
         }
         catch { /* try next variant, then /TR */ }
     }
-    // Fallback: node directly via /TR (no wscript, no VBS). node/CLI may live
-    // under a path with spaces (Program Files), so quote each and let schtasks
-    // pass the whole /TR string through.
-    const tr = `"${process.execPath}" "${cliEntry()}" ${command}`;
+    // Fallback: node via /TR under conhost --headless (no wscript, no VBS, no
+    // window). node/CLI may live under a path with spaces (Program Files), so
+    // quote each and let schtasks pass the whole /TR string through.
+    const tr = `${conhostPath()} --headless "${process.execPath}" "${cliEntry()}" ${command}`;
     const fallback = (0, child_process_1.spawnSync)('schtasks', [
         '/Create', '/TN', taskName, '/TR', tr, ...scheduleArgs, '/F',
     ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
@@ -1421,16 +1441,30 @@ function windowsTaskReferencesScriptHost(taskName) {
  *  the 1.22.1 window-flash bug (console window on every trigger). Migration
  *  trigger for the windowless S4U principal. */
 function windowsTaskRunsInteractive(taskName) {
+    return windowsTaskXmlState(taskName).interactive;
+}
+/** True when triggering the task would open a VISIBLE console window:
+ *  InteractiveToken principal AND a bare console action (not wrapped in
+ *  `conhost --headless`). This — not the principal alone — is the flash
+ *  condition; a conhost-wrapped InteractiveToken task is fully windowless. */
+function windowsTaskRunsVisibly(taskName) {
+    const state = windowsTaskXmlState(taskName);
+    return state.interactive && !state.headless;
+}
+function windowsTaskXmlState(taskName) {
     try {
         const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
             encoding: 'utf8', windowsHide: true, timeout: 10_000,
         });
         if (query.status !== 0 || typeof query.stdout !== 'string')
-            return false;
-        return /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout);
+            return { interactive: false, headless: false };
+        return {
+            interactive: /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout),
+            headless: /conhost(\.exe)?<\/Command>[\s\S]*?--headless/i.test(query.stdout),
+        };
     }
     catch {
-        return false;
+        return { interactive: false, headless: false };
     }
 }
 /**
@@ -1456,7 +1490,38 @@ function upgradeTaskWindowless(taskName, s4uXml, logFn) {
             logFn(`Self-heal: "${taskName}" migrated to the windowless S4U principal (no more console-window flash).`);
             return true;
         }
-        logFn(`Self-heal: could not migrate "${taskName}" to S4U (needs elevation) — asking the elevated updater task to do it.`);
+        logFn(`Self-heal: could not migrate "${taskName}" to S4U (needs same-user elevation) — re-registering it headless instead.`);
+        return false;
+    }
+    catch {
+        return false; /* keep the existing working task */
+    }
+}
+/**
+ * Re-register an InteractiveToken task with its action wrapped in
+ * `conhost --headless` — windowless without touching the principal, so the
+ * SAME user can do it unelevated (unlike S4U, which current Windows only
+ * grants to the task's own user running elevated — even SYSTEM is denied).
+ * Returns true when the task no longer opens a window on trigger.
+ */
+function rewrapTaskHeadless(taskName, interactiveHeadlessXml, logFn) {
+    const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+    const dir = path.join(base, 'FullCourtDefense');
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    catch { /* ignore */ }
+    const xmlPath = path.join(dir, `${taskName.replace(/[^A-Za-z0-9]+/g, '_')}.task.xml`);
+    try {
+        fs.writeFileSync(xmlPath, `\ufeff${interactiveHeadlessXml}`, 'utf16le');
+        const created = (0, child_process_1.spawnSync)('schtasks', ['/Create', '/TN', taskName, '/XML', xmlPath, '/F'], {
+            stdio: 'ignore', windowsHide: true, timeout: 20_000,
+        });
+        if (created.status === 0) {
+            logFn(`Self-heal: "${taskName}" re-registered with a conhost --headless action (windowless from its next trigger).`);
+            return true;
+        }
+        logFn(`Self-heal: could not re-register "${taskName}" headless — asking the elevated updater task to migrate it.`);
         return false;
     }
     catch {
@@ -1478,14 +1543,20 @@ let updaterMigrationKicked = false;
 function kickUpdaterTaskForMigration(logFn) {
     if (updaterMigrationKicked)
         return;
-    updaterMigrationKicked = true;
     try {
         const run = (0, child_process_1.spawnSync)('schtasks', ['/Run', '/TN', selfUpdate_1.MSI_UPDATER_TASK_NAME], {
             stdio: 'ignore', windowsHide: true, timeout: 20_000,
         });
-        logFn(run.status === 0
-            ? `Self-heal: elevated updater task triggered — it migrates the tasks to S4U now (windowless within a minute).`
-            : `Self-heal: updater task unavailable for the S4U migration — its next daily run (03:07) will migrate instead.`);
+        // Latch ONLY on a successful kick. On a fresh MSI install the daemon can
+        // boot before the SYSTEM updater task exists — burning the one-shot latch
+        // on that failure left the machine flashing until the 03:07 daily run.
+        if (run.status === 0) {
+            updaterMigrationKicked = true;
+            logFn(`Self-heal: elevated updater task triggered — its repair pass migrates the tasks now.`);
+        }
+        else {
+            logFn(`Self-heal: updater task unavailable for the task migration — will retry on a later self-heal; the daily run (03:07) is the backstop.`);
+        }
     }
     catch { /* best-effort — the daily schedule remains the backstop */ }
 }
@@ -1528,22 +1599,33 @@ function startDaemonNowWindows(viaTask = false) {
         }
     }
     catch { /* not running */ }
-    if (viaTask) {
+    if (viaTask && !windowsTaskRunsVisibly(TASK_NAME)) {
         // Start through the scheduled task so the daemon runs with the task's
         // LIMITED (non-elevated) token. Launching directly from an elevated MSI
         // custom action would leave an elevated daemon that a normal-user CLI can
         // never stop or supersede.
+        //
+        // ONLY when the task cannot open a window (S4U principal, or an
+        // InteractiveToken action wrapped in conhost --headless): starting a
+        // bare-console InteractiveToken task runs node.exe on the interactive
+        // desktop, and since the daemon never exits, that console window stays
+        // OPEN on the user's screen — the "open console at the end of
+        // installation" customer complaint. A visibly-registered task takes the
+        // hidden WMI path below instead; self-heal re-registers it headless on
+        // the next daemon boot.
         const run = (0, child_process_1.spawnSync)('schtasks', ['/Run', '/TN', TASK_NAME], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
         if (run.status === 0)
             return;
     }
     // WMI process creation escapes the MSI job object. Runs node.exe DIRECTLY —
-    // no wscript/VBS (Defender's Commando.A!ml heuristic) — with a hidden window.
+    // no wscript/VBS (Defender's Commando.A!ml heuristic). Win32_ProcessStartup
+    // ShowWindow=0 (SW_HIDE) is REQUIRED: without it Win32_Process.Create gives
+    // the console app a visible window on the interactive desktop.
     const nodeEsc = process.execPath.replace(/'/g, "''");
     const entryEsc = cliEntry().replace(/'/g, "''");
     (0, child_process_1.spawnSync)('powershell', [
         '-NoProfile', '-NonInteractive', '-Command',
-        `Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = ('\"' + '${nodeEsc}' + '\" \"' + '${entryEsc}' + '\" daemon') } | Out-Null`,
+        `$si = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{ ShowWindow = [uint16]0 }; Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = ('\"' + '${nodeEsc}' + '\" \"' + '${entryEsc}' + '\" daemon'); ProcessStartupInformation = $si } | Out-Null`,
     ], { stdio: 'ignore', windowsHide: true, timeout: 20_000 });
 }
 function installWindows() {
@@ -1555,11 +1637,11 @@ function installWindows() {
     let ok = taskOk;
     if (!ok) {
         // Fallback: per-user Run key — no elevation needed, runs at every logon.
-        // node.exe directly (no wscript). May flash briefly at logon in this rare
-        // fallback, but carries no script-host persistence fingerprint.
+        // conhost --headless keeps the logon launch windowless (no wscript, no
+        // script-host persistence fingerprint).
         const reg = (0, child_process_1.spawnSync)('reg', [
             'add', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/t', 'REG_SZ',
-            '/d', `"${process.execPath}" "${cliEntry()}" daemon`, '/f',
+            '/d', `"${conhostPath()}" --headless "${process.execPath}" "${cliEntry()}" daemon`, '/f',
         ], { stdio: 'ignore', windowsHide: true });
         ok = reg.status === 0;
     }
@@ -1604,7 +1686,7 @@ function ensureWindowsAutostartHealthy(logFn) {
             if (!created) {
                 (0, child_process_1.spawnSync)('reg', [
                     'add', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/t', 'REG_SZ',
-                    '/d', `"${process.execPath}" "${cliEntry()}" daemon`, '/f',
+                    '/d', `"${conhostPath()}" --headless "${process.execPath}" "${cliEntry()}" daemon`, '/f',
                 ], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
             }
             if (daemonTask.status !== 0)
@@ -1618,17 +1700,24 @@ function ensureWindowsAutostartHealthy(logFn) {
                 logFn('Self-heal: could not (re)create the watchdog task — daemon revival relies on logon autostart only.');
             }
         }
-        // Migration (1.22.1 -> 1.22.2): InteractiveToken tasks flash a console
-        // window on every trigger. Upgrade healthy existing tasks to S4U; S4U-only
-        // attempt so a denied re-registration never breaks a working task. When
-        // unelevated self-heal cannot flip them, kick the SYSTEM updater task
-        // once — its repair pass migrates with real elevation (1.22.7).
+        // Migration: an InteractiveToken task with a bare console action flashes a
+        // window on every trigger. Try the S4U principal first (works when this
+        // daemon happens to be elevated — current Windows denies S4U registration
+        // to everyone else, INCLUDING SYSTEM, so the updater usually cannot help).
+        // When S4U is denied, re-register the task as InteractiveToken with the
+        // action wrapped in `conhost --headless` — same-user unelevated
+        // registration always works and is just as windowless. The updater kick
+        // stays as the final backstop for machines where even that failed.
         let migrationDenied = false;
-        if (daemonTask.status === 0 && !legacyDaemon && windowsTaskRunsInteractive(TASK_NAME)) {
-            migrationDenied = !upgradeTaskWindowless(TASK_NAME, buildDaemonTaskXml()[0], logFn) || migrationDenied;
+        if (daemonTask.status === 0 && !legacyDaemon && windowsTaskRunsVisibly(TASK_NAME)) {
+            const daemonXml = buildDaemonTaskXml();
+            migrationDenied = !(upgradeTaskWindowless(TASK_NAME, daemonXml[0], logFn)
+                || rewrapTaskHeadless(TASK_NAME, daemonXml[1], logFn)) || migrationDenied;
         }
-        if (watchdogQuery.status === 0 && !legacyWatchdog && windowsTaskRunsInteractive(WATCHDOG_TASK_NAME)) {
-            migrationDenied = !upgradeTaskWindowless(WATCHDOG_TASK_NAME, buildWatchdogTaskXml()[0], logFn) || migrationDenied;
+        if (watchdogQuery.status === 0 && !legacyWatchdog && windowsTaskRunsVisibly(WATCHDOG_TASK_NAME)) {
+            const watchdogXml = buildWatchdogTaskXml();
+            migrationDenied = !(upgradeTaskWindowless(WATCHDOG_TASK_NAME, watchdogXml[0], logFn)
+                || rewrapTaskHeadless(WATCHDOG_TASK_NAME, watchdogXml[1], logFn)) || migrationDenied;
         }
         if (migrationDenied)
             kickUpdaterTaskForMigration(logFn);
@@ -1636,9 +1725,9 @@ function ensureWindowsAutostartHealthy(logFn) {
         if (windowsRunKeyReferencesScriptHost()) {
             (0, child_process_1.spawnSync)('reg', [
                 'add', WINDOWS_RUN_KEY, '/v', WINDOWS_RUN_VALUE, '/t', 'REG_SZ',
-                '/d', `"${process.execPath}" "${cliEntry()}" daemon`, '/f',
+                '/d', `"${conhostPath()}" --headless "${process.execPath}" "${cliEntry()}" daemon`, '/f',
             ], { stdio: 'ignore', windowsHide: true, timeout: 10_000 });
-            logFn('Self-heal: rewrote legacy wscript Run-key entry to run node directly.');
+            logFn('Self-heal: rewrote legacy wscript Run-key entry to run node headless.');
         }
         removeLegacyWindowsLaunchers();
     }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.25.1"
+  "version": "1.25.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.25.1",
+  "version": "1.25.3",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {