fullcourtdefense-cli 1.26.0 → 1.26.1

package/dist/commands/daemon.d.ts

@@ -1,5 +1,6 @@
 import { BotGuardConfig } from '../config';
 import { ProtectAllArgs } from './mcpGateway';
+import { windowsTaskRunsInteractive, windowsTaskRunsVisibly } from '../windowsTaskState';
 export interface DaemonArgs extends ProtectAllArgs {
     install?: string;
     uninstall?: string;
@@ -83,15 +84,7 @@ export declare function registerHiddenTask(taskName: string, xml: string | strin
 /** True when an existing scheduled task's action still runs wscript/cscript
  *  (the pre-1.22.1 VBS launcher) — the migration trigger. */
 export declare function windowsTaskReferencesScriptHost(taskName: string): boolean;
-/** True when an existing task still runs with an InteractiveToken principal —
- *  the 1.22.1 window-flash bug (console window on every trigger). Migration
- *  trigger for the windowless S4U principal. */
-export declare function windowsTaskRunsInteractive(taskName: string): boolean;
-/** True when triggering the task would open a VISIBLE console window:
- *  InteractiveToken principal AND a bare console action (not wrapped in
- *  `conhost --headless`). This — not the principal alone — is the flash
- *  condition; a conhost-wrapped InteractiveToken task is fully windowless. */
-export declare function windowsTaskRunsVisibly(taskName: string): boolean;
+export { windowsTaskRunsInteractive, windowsTaskRunsVisibly };
 /** Snapshot of the resident daemon for out-of-process callers (watchdog/status). */
 export interface DaemonRuntimeState {
     alive: boolean;

package/dist/commands/daemon.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.windowsTaskRunsVisibly = exports.windowsTaskRunsInteractive = void 0;
 exports.daemonDiscoverSweepArgs = daemonDiscoverSweepArgs;
 exports.summarizeDiscoverStderr = summarizeDiscoverStderr;
 exports.discoverSweepCredentialEnv = discoverSweepCredentialEnv;
@@ -44,8 +45,6 @@ exports.buildTaskXml = buildTaskXml;
 exports.buildTaskXmlVariants = buildTaskXmlVariants;
 exports.registerHiddenTask = registerHiddenTask;
 exports.windowsTaskReferencesScriptHost = windowsTaskReferencesScriptHost;
-exports.windowsTaskRunsInteractive = windowsTaskRunsInteractive;
-exports.windowsTaskRunsVisibly = windowsTaskRunsVisibly;
 exports.daemonRuntimeState = daemonRuntimeState;
 exports.spawnDetachedDaemon = spawnDetachedDaemon;
 exports.pidIsAlive = pidIsAlive;
@@ -82,6 +81,9 @@ const honeypot_1 = require("../honeypot");
 const windowsAudit_1 = require("./windowsAudit");
 const hook_1 = require("./hook");
 const verdictIpc_1 = require("../verdictIpc");
+const windowsTaskState_1 = require("../windowsTaskState");
+Object.defineProperty(exports, "windowsTaskRunsInteractive", { enumerable: true, get: function () { return windowsTaskState_1.windowsTaskRunsInteractive; } });
+Object.defineProperty(exports, "windowsTaskRunsVisibly", { enumerable: true, get: function () { return windowsTaskState_1.windowsTaskRunsVisibly; } });
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
     red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
@@ -632,10 +634,18 @@ async function runDaemon(args, config) {
                 body: JSON.stringify({ shieldId: creds.shieldId, machineId: identity.machineId, ...payload }),
                 signal: AbortSignal.timeout(15_000),
             });
+            if (!resp.ok) {
+                // Log the STATUS and the server's own words. Swallowing them turned a
+                // precise backend rejection into "network or backend rejection" in the
+                // console, which cost a Cloud Run log dig to diagnose — on the very
+                // feature whose job is to explain a machine remotely.
+                const body = await resp.text().catch(() => '');
+                log(`Diagnostics upload rejected: HTTP ${resp.status}${body ? ` — ${body.slice(0, 300).replace(/\s+/g, ' ')}` : ''}`);
+            }
             return resp.ok;
         }
-        catch {
-            log('Diagnostics upload failed (network) — the bundle stays available locally.');
+        catch (error) {
+            log(`Diagnostics upload failed (network: ${error.message}) — the bundle stays available locally.`);
             return false;
         }
     };
@@ -1553,36 +1563,6 @@ function windowsTaskReferencesScriptHost(taskName) {
         return false;
     }
 }
-/** True when an existing task still runs with an InteractiveToken principal —
- *  the 1.22.1 window-flash bug (console window on every trigger). Migration
- *  trigger for the windowless S4U principal. */
-function windowsTaskRunsInteractive(taskName) {
-    return windowsTaskXmlState(taskName).interactive;
-}
-/** True when triggering the task would open a VISIBLE console window:
- *  InteractiveToken principal AND a bare console action (not wrapped in
- *  `conhost --headless`). This — not the principal alone — is the flash
- *  condition; a conhost-wrapped InteractiveToken task is fully windowless. */
-function windowsTaskRunsVisibly(taskName) {
-    const state = windowsTaskXmlState(taskName);
-    return state.interactive && !state.headless;
-}
-function windowsTaskXmlState(taskName) {
-    try {
-        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
-            encoding: 'utf8', windowsHide: true, timeout: 10_000,
-        });
-        if (query.status !== 0 || typeof query.stdout !== 'string')
-            return { interactive: false, headless: false };
-        return {
-            interactive: /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout),
-            headless: /conhost(\.exe)?<\/Command>[\s\S]*?--headless/i.test(query.stdout),
-        };
-    }
-    catch {
-        return { interactive: false, headless: false };
-    }
-}
 /**
  * Upgrade an EXISTING (working) task to the windowless S4U principal. Tries
  * ONLY the S4U XML — on failure (unelevated daemon) the current task is left
@@ -1715,7 +1695,7 @@ function startDaemonNowWindows(viaTask = false) {
         }
     }
     catch { /* not running */ }
-    if (viaTask && !windowsTaskRunsVisibly(TASK_NAME)) {
+    if (viaTask && !(0, windowsTaskState_1.windowsTaskRunsVisibly)(TASK_NAME)) {
         // Start through the scheduled task so the daemon runs with the task's
         // LIMITED (non-elevated) token. Launching directly from an elevated MSI
         // custom action would leave an elevated daemon that a normal-user CLI can
@@ -1825,12 +1805,12 @@ function ensureWindowsAutostartHealthy(logFn) {
         // registration always works and is just as windowless. The updater kick
         // stays as the final backstop for machines where even that failed.
         let migrationDenied = false;
-        if (daemonTask.status === 0 && !legacyDaemon && windowsTaskRunsVisibly(TASK_NAME)) {
+        if (daemonTask.status === 0 && !legacyDaemon && (0, windowsTaskState_1.windowsTaskRunsVisibly)(TASK_NAME)) {
             const daemonXml = buildDaemonTaskXml();
             migrationDenied = !(upgradeTaskWindowless(TASK_NAME, daemonXml[0], logFn)
                 || rewrapTaskHeadless(TASK_NAME, daemonXml[1], logFn)) || migrationDenied;
         }
-        if (watchdogQuery.status === 0 && !legacyWatchdog && windowsTaskRunsVisibly(WATCHDOG_TASK_NAME)) {
+        if (watchdogQuery.status === 0 && !legacyWatchdog && (0, windowsTaskState_1.windowsTaskRunsVisibly)(WATCHDOG_TASK_NAME)) {
             const watchdogXml = buildWatchdogTaskXml();
             migrationDenied = !(upgradeTaskWindowless(WATCHDOG_TASK_NAME, watchdogXml[0], logFn)
                 || rewrapTaskHeadless(WATCHDOG_TASK_NAME, watchdogXml[1], logFn)) || migrationDenied;

package/dist/selfTest.js

@@ -9,6 +9,7 @@ const machineKeyFile_1 = require("./machineKeyFile");
 const runtimeConfig_1 = require("./runtimeConfig");
 const integrity_1 = require("./integrity");
 const selfUpdate_1 = require("./selfUpdate");
+const windowsTaskState_1 = require("./windowsTaskState");
 /** Windows scheduled-task probe: exists + (when readable) its last result code. */
 function queryScheduledTask(taskName) {
     const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/V', '/FO', 'LIST'], {
@@ -145,38 +146,49 @@ async function runDeepSelfTest(input) {
             add({ id: 'watchdog_task', label: 'Watchdog task registered', ok: false, detail: error instanceof Error ? error.message : String(error) });
         }
     }
-    // 9. Windowless task principals. FCD tasks must run with the S4U logon type:
-    // an InteractiveToken principal running console node.exe flashes a visible
-    // console window on every trigger (the "5-minute flicker" complaint class —
-    // <Hidden>true</Hidden> does NOT suppress it). Machines where the S4U
-    // migration did not converge surface here instead of a user email.
+    // 9. Windowless tasks. What users complain about is a console window flashing
+    // on every trigger (the "5-minute flicker" class); <Hidden>true</Hidden> does
+    // NOT suppress it. Two independent defences prevent it: the S4U logon type,
+    // and wrapping the action in `conhost --headless`. Either one is sufficient,
+    // so this check reports the OBSERVABLE symptom — never the principal alone,
+    // which is red on every healthy MSI install (Windows denies S4U registration
+    // even to SYSTEM, which is exactly why the conhost wrapper exists).
     if (process.platform === 'win32') {
-        const interactive = listInteractiveFcdTasks();
+        const flashing = listVisiblyFlashingFcdTasks();
+        const conhostShielded = listConhostShieldedFcdTasks();
         add({
             id: 'windowless_tasks',
-            label: 'Scheduled tasks are windowless (S4U)',
-            ok: interactive.length === 0,
-            detail: interactive.length === 0
-                ? 'no FCD task runs with an InteractiveToken principal'
-                : `InteractiveToken principal (visible console flash) on: ${interactive.join(', ')} — daemon migration to S4U has not converged`,
+            label: 'Scheduled tasks are windowless',
+            ok: flashing.length === 0,
+            detail: flashing.length === 0
+                ? conhostShielded.length === 0
+                    ? 'no FCD task can open a console window (S4U principals)'
+                    : `no FCD task can open a console window (${conhostShielded.length} still on an InteractiveToken principal, made windowless by conhost --headless)`
+                : `visible console window on every trigger of: ${flashing.join(', ')} — bare console action on an InteractiveToken principal (neither S4U nor conhost --headless)`,
         });
     }
     return { ok: checks.every(check => check.ok), checks, ranAt: new Date().toISOString() };
 }
-/** FCD per-user tasks whose XML still declares an InteractiveToken principal. */
+/** FCD per-user tasks that could flash a console window on every trigger. */
 const WINDOWED_TASK_CANDIDATES = ['FullCourtDefense Daemon', 'FullCourtDefense Daemon Watchdog', 'FullCourtDefense Auto-Protect', 'FullCourtDefenseDesktopDiscover'];
-function listInteractiveFcdTasks() {
-    const offenders = [];
-    for (const taskName of WINDOWED_TASK_CANDIDATES) {
-        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
-            encoding: 'utf8', windowsHide: true, timeout: 10_000,
-        });
-        if (query.status !== 0 || !query.stdout)
-            continue; // absent — nothing to flash
-        if (/<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout))
-            offenders.push(taskName);
-    }
-    return offenders;
+/**
+ * Tasks that would actually open a VISIBLE window. Delegates to the shared
+ * `windowsTaskRunsVisibly` so this check can never drift from the daemon's own
+ * definition of the flash condition again: an InteractiveToken principal is
+ * harmless once the action runs through `conhost --headless`, and that is the
+ * normal state of an MSI install, because current Windows builds refuse S4U
+ * registration even to SYSTEM. Reporting on the principal alone failed every
+ * healthy machine and trained operators to ignore the whole report.
+ */
+function listVisiblyFlashingFcdTasks() {
+    return WINDOWED_TASK_CANDIDATES.filter(taskName => (0, windowsTaskState_1.windowsTaskRunsVisibly)(taskName));
+}
+/** Registered tasks still on InteractiveToken but made windowless by conhost. */
+function listConhostShieldedFcdTasks() {
+    return WINDOWED_TASK_CANDIDATES.filter(taskName => {
+        const state = (0, windowsTaskState_1.windowsTaskXmlState)(taskName);
+        return state.exists && state.interactive && state.headless;
+    });
 }
 /** Compact one-line summary for the machine-action result card. */
 function summarizeSelfTest(report) {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.26.0"
+  "version": "1.26.1"
 }

package/dist/windowsTaskState.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Windows scheduled-task principal/action state — the single source of truth
+ * for "would this task flash a console window?".
+ *
+ * Why this is its own module: the daemon (which registers and self-heals the
+ * tasks) and the deep self-test (which reports on them) both need the answer,
+ * and `daemon.ts` already imports `selfTest.ts` for the health_check action, so
+ * a direct import back would be a cycle. Both now depend on this leaf instead.
+ *
+ * It also settles a correctness split. `selfTest.ts` used to carry its own copy
+ * that checked the PRINCIPAL alone, so it reported a failure on every machine
+ * whose tasks are conhost-wrapped — which is all MSI installs, because current
+ * Windows builds deny S4U registration even to SYSTEM. The flash condition is
+ * the pair of facts, never the principal by itself.
+ *
+ * Pure apart from the `schtasks /Query` read; never throws.
+ */
+export interface WindowsTaskState {
+    /** Task exists and declares an InteractiveToken principal. */
+    interactive: boolean;
+    /** Task action runs through `conhost.exe --headless` (windowless regardless of principal). */
+    headless: boolean;
+    /** Task is registered at all — absent tasks can't flash. */
+    exists: boolean;
+}
+export declare function windowsTaskXmlState(taskName: string): WindowsTaskState;
+/**
+ * True when an existing task still runs with an InteractiveToken principal —
+ * the 1.22.1 window-flash bug's principal half. Migration trigger for the
+ * windowless S4U principal. NOT the flash condition on its own: see
+ * `windowsTaskRunsVisibly`.
+ */
+export declare function windowsTaskRunsInteractive(taskName: string): boolean;
+/**
+ * True when triggering the task would open a VISIBLE console window:
+ * InteractiveToken principal AND a bare console action (not wrapped in
+ * `conhost --headless`). This — not the principal alone — is the flash
+ * condition; a conhost-wrapped InteractiveToken task is fully windowless.
+ */
+export declare function windowsTaskRunsVisibly(taskName: string): boolean;

package/dist/windowsTaskState.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.windowsTaskXmlState = windowsTaskXmlState;
+exports.windowsTaskRunsInteractive = windowsTaskRunsInteractive;
+exports.windowsTaskRunsVisibly = windowsTaskRunsVisibly;
+const child_process_1 = require("child_process");
+function windowsTaskXmlState(taskName) {
+    try {
+        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
+            encoding: 'utf8', windowsHide: true, timeout: 10_000,
+        });
+        if (query.status !== 0 || typeof query.stdout !== 'string') {
+            return { interactive: false, headless: false, exists: false };
+        }
+        return {
+            exists: true,
+            interactive: /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout),
+            headless: /conhost(\.exe)?<\/Command>[\s\S]*?--headless/i.test(query.stdout),
+        };
+    }
+    catch {
+        return { interactive: false, headless: false, exists: false };
+    }
+}
+/**
+ * True when an existing task still runs with an InteractiveToken principal —
+ * the 1.22.1 window-flash bug's principal half. Migration trigger for the
+ * windowless S4U principal. NOT the flash condition on its own: see
+ * `windowsTaskRunsVisibly`.
+ */
+function windowsTaskRunsInteractive(taskName) {
+    return windowsTaskXmlState(taskName).interactive;
+}
+/**
+ * True when triggering the task would open a VISIBLE console window:
+ * InteractiveToken principal AND a bare console action (not wrapped in
+ * `conhost --headless`). This — not the principal alone — is the flash
+ * condition; a conhost-wrapped InteractiveToken task is fully windowless.
+ */
+function windowsTaskRunsVisibly(taskName) {
+    const state = windowsTaskXmlState(taskName);
+    return state.interactive && !state.headless;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.26.0",
+  "version": "1.26.1",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {