fullcourtdefense-cli 1.26.0 → 1.26.2

package/dist/commands/daemon.d.ts

@@ -1,5 +1,6 @@
 import { BotGuardConfig } from '../config';
 import { ProtectAllArgs } from './mcpGateway';
+import { windowsTaskRunsInteractive, windowsTaskRunsVisibly } from '../windowsTaskState';
 export interface DaemonArgs extends ProtectAllArgs {
     install?: string;
     uninstall?: string;
@@ -83,15 +84,7 @@ export declare function registerHiddenTask(taskName: string, xml: string | strin
 /** True when an existing scheduled task's action still runs wscript/cscript
  *  (the pre-1.22.1 VBS launcher) — the migration trigger. */
 export declare function windowsTaskReferencesScriptHost(taskName: string): boolean;
-/** True when an existing task still runs with an InteractiveToken principal —
- *  the 1.22.1 window-flash bug (console window on every trigger). Migration
- *  trigger for the windowless S4U principal. */
-export declare function windowsTaskRunsInteractive(taskName: string): boolean;
-/** True when triggering the task would open a VISIBLE console window:
- *  InteractiveToken principal AND a bare console action (not wrapped in
- *  `conhost --headless`). This — not the principal alone — is the flash
- *  condition; a conhost-wrapped InteractiveToken task is fully windowless. */
-export declare function windowsTaskRunsVisibly(taskName: string): boolean;
+export { windowsTaskRunsInteractive, windowsTaskRunsVisibly };
 /** Snapshot of the resident daemon for out-of-process callers (watchdog/status). */
 export interface DaemonRuntimeState {
     alive: boolean;

package/dist/commands/daemon.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.windowsTaskRunsVisibly = exports.windowsTaskRunsInteractive = void 0;
 exports.daemonDiscoverSweepArgs = daemonDiscoverSweepArgs;
 exports.summarizeDiscoverStderr = summarizeDiscoverStderr;
 exports.discoverSweepCredentialEnv = discoverSweepCredentialEnv;
@@ -44,8 +45,6 @@ exports.buildTaskXml = buildTaskXml;
 exports.buildTaskXmlVariants = buildTaskXmlVariants;
 exports.registerHiddenTask = registerHiddenTask;
 exports.windowsTaskReferencesScriptHost = windowsTaskReferencesScriptHost;
-exports.windowsTaskRunsInteractive = windowsTaskRunsInteractive;
-exports.windowsTaskRunsVisibly = windowsTaskRunsVisibly;
 exports.daemonRuntimeState = daemonRuntimeState;
 exports.spawnDetachedDaemon = spawnDetachedDaemon;
 exports.pidIsAlive = pidIsAlive;
@@ -82,6 +81,9 @@ const honeypot_1 = require("../honeypot");
 const windowsAudit_1 = require("./windowsAudit");
 const hook_1 = require("./hook");
 const verdictIpc_1 = require("../verdictIpc");
+const windowsTaskState_1 = require("../windowsTaskState");
+Object.defineProperty(exports, "windowsTaskRunsInteractive", { enumerable: true, get: function () { return windowsTaskState_1.windowsTaskRunsInteractive; } });
+Object.defineProperty(exports, "windowsTaskRunsVisibly", { enumerable: true, get: function () { return windowsTaskState_1.windowsTaskRunsVisibly; } });
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
     red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
@@ -632,10 +634,18 @@ async function runDaemon(args, config) {
                 body: JSON.stringify({ shieldId: creds.shieldId, machineId: identity.machineId, ...payload }),
                 signal: AbortSignal.timeout(15_000),
             });
+            if (!resp.ok) {
+                // Log the STATUS and the server's own words. Swallowing them turned a
+                // precise backend rejection into "network or backend rejection" in the
+                // console, which cost a Cloud Run log dig to diagnose — on the very
+                // feature whose job is to explain a machine remotely.
+                const body = await resp.text().catch(() => '');
+                log(`Diagnostics upload rejected: HTTP ${resp.status}${body ? ` — ${body.slice(0, 300).replace(/\s+/g, ' ')}` : ''}`);
+            }
             return resp.ok;
         }
-        catch {
-            log('Diagnostics upload failed (network) — the bundle stays available locally.');
+        catch (error) {
+            log(`Diagnostics upload failed (network: ${error.message}) — the bundle stays available locally.`);
             return false;
         }
     };
@@ -932,7 +942,11 @@ async function runDaemon(args, config) {
                     bundleState = { mode: bundle.mode, source: bundle.source, policyHash: bundle.policyHash };
                 }
                 catch { /* snapshot still useful without mode context */ }
-                const snapshot = (0, perfSnapshot_1.collectPerfSnapshot)({ cliVersion: cliVersion(), ...bundleState });
+                // Async collection — the benchmark spawns real hook children that ask
+                // THIS daemon for IPC verdicts, so the event loop must stay free or
+                // the snapshot measures its own blockage (2.5s IPC timeout per hook)
+                // instead of the true per-event cost.
+                const snapshot = await (0, perfSnapshot_1.collectPerfSnapshot)({ cliVersion: cliVersion(), ...bundleState });
                 const uploaded = await uploadDiagnostics({ perfSnapshot: snapshot });
                 if (!uploaded)
                     throw new Error('Perf snapshot could not be uploaded (network or backend rejection).');
@@ -1553,36 +1567,6 @@ function windowsTaskReferencesScriptHost(taskName) {
         return false;
     }
 }
-/** True when an existing task still runs with an InteractiveToken principal —
- *  the 1.22.1 window-flash bug (console window on every trigger). Migration
- *  trigger for the windowless S4U principal. */
-function windowsTaskRunsInteractive(taskName) {
-    return windowsTaskXmlState(taskName).interactive;
-}
-/** True when triggering the task would open a VISIBLE console window:
- *  InteractiveToken principal AND a bare console action (not wrapped in
- *  `conhost --headless`). This — not the principal alone — is the flash
- *  condition; a conhost-wrapped InteractiveToken task is fully windowless. */
-function windowsTaskRunsVisibly(taskName) {
-    const state = windowsTaskXmlState(taskName);
-    return state.interactive && !state.headless;
-}
-function windowsTaskXmlState(taskName) {
-    try {
-        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
-            encoding: 'utf8', windowsHide: true, timeout: 10_000,
-        });
-        if (query.status !== 0 || typeof query.stdout !== 'string')
-            return { interactive: false, headless: false };
-        return {
-            interactive: /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout),
-            headless: /conhost(\.exe)?<\/Command>[\s\S]*?--headless/i.test(query.stdout),
-        };
-    }
-    catch {
-        return { interactive: false, headless: false };
-    }
-}
 /**
  * Upgrade an EXISTING (working) task to the windowless S4U principal. Tries
  * ONLY the S4U XML — on failure (unelevated daemon) the current task is left
@@ -1715,7 +1699,7 @@ function startDaemonNowWindows(viaTask = false) {
         }
     }
     catch { /* not running */ }
-    if (viaTask && !windowsTaskRunsVisibly(TASK_NAME)) {
+    if (viaTask && !(0, windowsTaskState_1.windowsTaskRunsVisibly)(TASK_NAME)) {
         // Start through the scheduled task so the daemon runs with the task's
         // LIMITED (non-elevated) token. Launching directly from an elevated MSI
         // custom action would leave an elevated daemon that a normal-user CLI can
@@ -1825,12 +1809,12 @@ function ensureWindowsAutostartHealthy(logFn) {
         // registration always works and is just as windowless. The updater kick
         // stays as the final backstop for machines where even that failed.
         let migrationDenied = false;
-        if (daemonTask.status === 0 && !legacyDaemon && windowsTaskRunsVisibly(TASK_NAME)) {
+        if (daemonTask.status === 0 && !legacyDaemon && (0, windowsTaskState_1.windowsTaskRunsVisibly)(TASK_NAME)) {
             const daemonXml = buildDaemonTaskXml();
             migrationDenied = !(upgradeTaskWindowless(TASK_NAME, daemonXml[0], logFn)
                 || rewrapTaskHeadless(TASK_NAME, daemonXml[1], logFn)) || migrationDenied;
         }
-        if (watchdogQuery.status === 0 && !legacyWatchdog && windowsTaskRunsVisibly(WATCHDOG_TASK_NAME)) {
+        if (watchdogQuery.status === 0 && !legacyWatchdog && (0, windowsTaskState_1.windowsTaskRunsVisibly)(WATCHDOG_TASK_NAME)) {
             const watchdogXml = buildWatchdogTaskXml();
             migrationDenied = !(upgradeTaskWindowless(WATCHDOG_TASK_NAME, watchdogXml[0], logFn)
                 || rewrapTaskHeadless(WATCHDOG_TASK_NAME, watchdogXml[1], logFn)) || migrationDenied;

package/dist/commands/doctor.js

@@ -105,7 +105,7 @@ async function perfCheck(apiUrl, config) {
     else {
         console.log('mode: not enrolled (local defaults, monitor-first)');
     }
-    const snapshot = (0, perfSnapshot_1.collectPerfSnapshot)({ mode, source, policyHash });
+    const snapshot = await (0, perfSnapshot_1.collectPerfSnapshot)({ mode, source, policyHash });
     const hp = snapshot.hotPath;
     console.log(`node spawn floor:      ${hp.nodeSpawnFloorMs}ms median — OS+AV cost of any per-event process`);
     console.log(`hook end-to-end:       ${hp.hookMedianMs}ms median, ${hp.hookMinMs}-${hp.hookMaxMs}ms range — per IDE event (shell/MCP/file)`);

package/dist/perfSnapshot.d.ts

@@ -7,6 +7,17 @@
  * only. Nothing here installs a profiler, starts a timer, or samples in the
  * background — every number is collected in one shot, in a few seconds, and
  * the process that collected it exits.
+ *
+ * NON-BLOCKING BY CONTRACT: everything here uses async `spawn`, never
+ * `spawnSync`. The remote action runs INSIDE the daemon — the same process
+ * that answers verdict IPC for every live hook. A spawnSync benchmark froze
+ * the daemon's event loop, so each benchmarked hook child asked the daemon,
+ * got silence, waited out the full IPC response timeout (~2.5s) and fell back
+ * to local evaluation: the snapshot reported "hook median 2605ms" on a machine
+ * whose real per-event cost was milliseconds — the measurement was poisoning
+ * itself. Async spawns keep the daemon answering during the benchmark, so the
+ * number is the true production path (and real developer hooks keep their
+ * fast path while a snapshot is being collected).
  */
 export interface PerfProcessInfo {
     pid: number;
@@ -67,13 +78,13 @@ export interface PerfSnapshot {
     distress: unknown[];
 }
 /** Micro-bench of the per-event hot path: node spawn floor, hook end-to-end, cmd guard. */
-export declare function benchHotPath(entryJs?: string): PerfHotPathBench;
+export declare function benchHotPath(entryJs?: string): Promise<PerfHotPathBench>;
 /**
  * Per-process footprint of every FullCourtDefense-owned process (daemon, MCP
  * gateways, desktop chat watcher, watchdog): working set, cumulative CPU,
  * uptime, handle count. On-demand only — this spawns ONE OS query and exits.
  */
-export declare function collectProcessFootprint(): PerfProcessInfo[];
+export declare function collectProcessFootprint(): Promise<PerfProcessInfo[]>;
 /** Disk footprint: our logs/spool sizes, spool backlog, update-attempt markers. */
 export declare function collectDiskState(): PerfDiskState;
 export interface CollectPerfSnapshotInput {
@@ -86,6 +97,6 @@ export interface CollectPerfSnapshotInput {
     entryJs?: string;
 }
 /** One-shot collection of the full snapshot. Completes in a few seconds. */
-export declare function collectPerfSnapshot(input?: CollectPerfSnapshotInput): PerfSnapshot;
+export declare function collectPerfSnapshot(input?: CollectPerfSnapshotInput): Promise<PerfSnapshot>;
 /** One-line human summary for machine-action result reporting. */
 export declare function summarizePerfSnapshot(s: PerfSnapshot): string;

package/dist/perfSnapshot.js

@@ -55,23 +55,61 @@ function fileSizeKB(p) {
         return undefined;
     }
 }
+/**
+ * Run one child to completion WITHOUT blocking the event loop, returning
+ * elapsed wall time and captured stdout. The event loop staying free is the
+ * whole point (see the header): the daemon must keep answering verdict IPC
+ * while these children run. Never throws — a spawn failure or timeout still
+ * resolves with whatever elapsed/output there is.
+ */
+function runTimed(cmd, args, opts) {
+    return new Promise((resolve) => {
+        const t0 = Date.now();
+        let stdout = '';
+        let settled = false;
+        let killTimer;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            if (killTimer)
+                clearTimeout(killTimer);
+            resolve({ elapsedMs: Date.now() - t0, stdout });
+        };
+        let child;
+        try {
+            child = (0, child_process_1.spawn)(cmd, args, { windowsHide: true, stdio: ['pipe', 'pipe', 'ignore'] });
+        }
+        catch {
+            finish();
+            return;
+        }
+        killTimer = setTimeout(() => { try {
+            child.kill();
+        }
+        catch { /* already gone */ } }, opts.timeoutMs);
+        child.on('error', finish);
+        child.on('close', finish);
+        child.stdout?.on('data', (chunk) => { stdout += String(chunk); });
+        child.stdin?.on('error', () => { });
+        if (opts.input !== undefined)
+            child.stdin?.write(opts.input);
+        child.stdin?.end();
+    });
+}
 /** Micro-bench of the per-event hot path: node spawn floor, hook end-to-end, cmd guard. */
-function benchHotPath(entryJs) {
+async function benchHotPath(entryJs) {
     const entry = entryJs || process.argv[1] || '';
+    // Sequential on purpose: overlapping children would contend for CPU and
+    // inflate each other's numbers.
     const spawnTimes = [];
     for (let i = 0; i < 5; i++) {
-        const t0 = Date.now();
-        (0, child_process_1.spawnSync)(process.execPath, ['-e', '0'], { windowsHide: true, timeout: 30_000 });
-        spawnTimes.push(Date.now() - t0);
+        spawnTimes.push((await runTimed(process.execPath, ['-e', '0'], { timeoutMs: 30_000 })).elapsedMs);
     }
     const hookEvent = JSON.stringify({ hook_event_name: 'beforeShellExecution', command: 'echo fcd-perf-probe' });
     const hookTimes = [];
     for (let i = 0; i < 5; i++) {
-        const t0 = Date.now();
-        (0, child_process_1.spawnSync)(process.execPath, [entry, 'hook', '--event', 'shell', '--fcd-managed', 'true'], {
-            input: hookEvent, encoding: 'utf8', windowsHide: true, timeout: 60_000,
-        });
-        hookTimes.push(Date.now() - t0);
+        hookTimes.push((await runTimed(process.execPath, [entry, 'hook', '--event', 'shell', '--fcd-managed', 'true'], { input: hookEvent, timeoutMs: 60_000 })).elapsedMs);
     }
     let cmdGuardOverheadMs;
     const guardJs = path.join(os.homedir(), '.fullcourtdefense-cmd-guard.js');
@@ -79,12 +117,8 @@ function benchHotPath(entryJs) {
         const direct = [];
         const guarded = [];
         for (let i = 0; i < 4; i++) {
-            let t0 = Date.now();
-            (0, child_process_1.spawnSync)(process.env.ComSpec || 'cmd.exe', ['/d', '/c', 'echo', 'fcd-perf'], { windowsHide: true, timeout: 30_000 });
-            direct.push(Date.now() - t0);
-            t0 = Date.now();
-            (0, child_process_1.spawnSync)(process.execPath, [guardJs, 'echo', 'fcd-perf'], { windowsHide: true, timeout: 30_000 });
-            guarded.push(Date.now() - t0);
+            direct.push((await runTimed(process.env.ComSpec || 'cmd.exe', ['/d', '/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+            guarded.push((await runTimed(process.execPath, [guardJs, 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
         }
         cmdGuardOverheadMs = Math.max(0, median(guarded) - median(direct));
     }
@@ -102,11 +136,11 @@ function benchHotPath(entryJs) {
  * gateways, desktop chat watcher, watchdog): working set, cumulative CPU,
  * uptime, handle count. On-demand only — this spawns ONE OS query and exits.
  */
-function collectProcessFootprint() {
+async function collectProcessFootprint() {
     try {
         if (process.platform === 'win32') {
             // On-demand action (never a hot path), so one PowerShell query is fine.
-            const ps = (0, child_process_1.spawnSync)('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `
+            const ps = await runTimed('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `
         $now = Get-Date
         Get-CimInstance Win32_Process |
           Where-Object { $_.CommandLine -and ($_.CommandLine -match 'fullcourtdefense' -or $_.CommandLine -match 'FullCourtDefense') -and $_.CommandLine -notmatch 'Get-CimInstance' } |
@@ -121,7 +155,7 @@ function collectProcessFootprint() {
               cmd = if ($_.CommandLine.Length -gt 160) { $_.CommandLine.Substring(0,160) } else { $_.CommandLine }
             }
           } | ConvertTo-Json -Compress
-      `], { encoding: 'utf8', windowsHide: true, timeout: 20_000 });
+      `], { timeoutMs: 20_000 });
             const raw = (ps.stdout || '').trim();
             if (!raw)
                 return [];
@@ -138,7 +172,7 @@ function collectProcessFootprint() {
             }));
         }
         // POSIX: rss (KB), cumulative cpu time, elapsed, args.
-        const ps = (0, child_process_1.spawnSync)('ps', ['-eo', 'pid=,rss=,time=,etimes=,args='], { encoding: 'utf8', timeout: 20_000 });
+        const ps = await runTimed('ps', ['-eo', 'pid=,rss=,time=,etimes=,args='], { timeoutMs: 20_000 });
         const lines = (ps.stdout || '').split('\n').filter(l => /fullcourtdefense/i.test(l) && !/ps -eo/.test(l));
         const result = [];
         for (const line of lines) {
@@ -190,8 +224,8 @@ function collectDiskState() {
     };
 }
 /** One-shot collection of the full snapshot. Completes in a few seconds. */
-function collectPerfSnapshot(input = {}) {
-    const processes = collectProcessFootprint();
+async function collectPerfSnapshot(input = {}) {
+    const processes = await collectProcessFootprint();
     return {
         collectedAt: new Date().toISOString(),
         cliVersion: input.cliVersion,
@@ -203,7 +237,7 @@ function collectPerfSnapshot(input = {}) {
             node: process.version,
         },
         enforcement: { mode: input.mode, source: input.source, policyHash: input.policyHash },
-        hotPath: benchHotPath(input.entryJs),
+        hotPath: await benchHotPath(input.entryJs),
         processes,
         totalWorkingSetMB: Math.round(processes.reduce((sum, p) => sum + p.workingSetMB, 0) * 10) / 10,
         disk: collectDiskState(),

package/dist/selfTest.js

@@ -9,6 +9,7 @@ const machineKeyFile_1 = require("./machineKeyFile");
 const runtimeConfig_1 = require("./runtimeConfig");
 const integrity_1 = require("./integrity");
 const selfUpdate_1 = require("./selfUpdate");
+const windowsTaskState_1 = require("./windowsTaskState");
 /** Windows scheduled-task probe: exists + (when readable) its last result code. */
 function queryScheduledTask(taskName) {
     const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/V', '/FO', 'LIST'], {
@@ -145,38 +146,49 @@ async function runDeepSelfTest(input) {
             add({ id: 'watchdog_task', label: 'Watchdog task registered', ok: false, detail: error instanceof Error ? error.message : String(error) });
         }
     }
-    // 9. Windowless task principals. FCD tasks must run with the S4U logon type:
-    // an InteractiveToken principal running console node.exe flashes a visible
-    // console window on every trigger (the "5-minute flicker" complaint class —
-    // <Hidden>true</Hidden> does NOT suppress it). Machines where the S4U
-    // migration did not converge surface here instead of a user email.
+    // 9. Windowless tasks. What users complain about is a console window flashing
+    // on every trigger (the "5-minute flicker" class); <Hidden>true</Hidden> does
+    // NOT suppress it. Two independent defences prevent it: the S4U logon type,
+    // and wrapping the action in `conhost --headless`. Either one is sufficient,
+    // so this check reports the OBSERVABLE symptom — never the principal alone,
+    // which is red on every healthy MSI install (Windows denies S4U registration
+    // even to SYSTEM, which is exactly why the conhost wrapper exists).
     if (process.platform === 'win32') {
-        const interactive = listInteractiveFcdTasks();
+        const flashing = listVisiblyFlashingFcdTasks();
+        const conhostShielded = listConhostShieldedFcdTasks();
         add({
             id: 'windowless_tasks',
-            label: 'Scheduled tasks are windowless (S4U)',
-            ok: interactive.length === 0,
-            detail: interactive.length === 0
-                ? 'no FCD task runs with an InteractiveToken principal'
-                : `InteractiveToken principal (visible console flash) on: ${interactive.join(', ')} — daemon migration to S4U has not converged`,
+            label: 'Scheduled tasks are windowless',
+            ok: flashing.length === 0,
+            detail: flashing.length === 0
+                ? conhostShielded.length === 0
+                    ? 'no FCD task can open a console window (S4U principals)'
+                    : `no FCD task can open a console window (${conhostShielded.length} still on an InteractiveToken principal, made windowless by conhost --headless)`
+                : `visible console window on every trigger of: ${flashing.join(', ')} — bare console action on an InteractiveToken principal (neither S4U nor conhost --headless)`,
         });
     }
     return { ok: checks.every(check => check.ok), checks, ranAt: new Date().toISOString() };
 }
-/** FCD per-user tasks whose XML still declares an InteractiveToken principal. */
+/** FCD per-user tasks that could flash a console window on every trigger. */
 const WINDOWED_TASK_CANDIDATES = ['FullCourtDefense Daemon', 'FullCourtDefense Daemon Watchdog', 'FullCourtDefense Auto-Protect', 'FullCourtDefenseDesktopDiscover'];
-function listInteractiveFcdTasks() {
-    const offenders = [];
-    for (const taskName of WINDOWED_TASK_CANDIDATES) {
-        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
-            encoding: 'utf8', windowsHide: true, timeout: 10_000,
-        });
-        if (query.status !== 0 || !query.stdout)
-            continue; // absent — nothing to flash
-        if (/<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout))
-            offenders.push(taskName);
-    }
-    return offenders;
+/**
+ * Tasks that would actually open a VISIBLE window. Delegates to the shared
+ * `windowsTaskRunsVisibly` so this check can never drift from the daemon's own
+ * definition of the flash condition again: an InteractiveToken principal is
+ * harmless once the action runs through `conhost --headless`, and that is the
+ * normal state of an MSI install, because current Windows builds refuse S4U
+ * registration even to SYSTEM. Reporting on the principal alone failed every
+ * healthy machine and trained operators to ignore the whole report.
+ */
+function listVisiblyFlashingFcdTasks() {
+    return WINDOWED_TASK_CANDIDATES.filter(taskName => (0, windowsTaskState_1.windowsTaskRunsVisibly)(taskName));
+}
+/** Registered tasks still on InteractiveToken but made windowless by conhost. */
+function listConhostShieldedFcdTasks() {
+    return WINDOWED_TASK_CANDIDATES.filter(taskName => {
+        const state = (0, windowsTaskState_1.windowsTaskXmlState)(taskName);
+        return state.exists && state.interactive && state.headless;
+    });
 }
 /** Compact one-line summary for the machine-action result card. */
 function summarizeSelfTest(report) {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.26.0"
+  "version": "1.26.2"
 }

package/dist/windowsTaskState.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Windows scheduled-task principal/action state — the single source of truth
+ * for "would this task flash a console window?".
+ *
+ * Why this is its own module: the daemon (which registers and self-heals the
+ * tasks) and the deep self-test (which reports on them) both need the answer,
+ * and `daemon.ts` already imports `selfTest.ts` for the health_check action, so
+ * a direct import back would be a cycle. Both now depend on this leaf instead.
+ *
+ * It also settles a correctness split. `selfTest.ts` used to carry its own copy
+ * that checked the PRINCIPAL alone, so it reported a failure on every machine
+ * whose tasks are conhost-wrapped — which is all MSI installs, because current
+ * Windows builds deny S4U registration even to SYSTEM. The flash condition is
+ * the pair of facts, never the principal by itself.
+ *
+ * Pure apart from the `schtasks /Query` read; never throws.
+ */
+export interface WindowsTaskState {
+    /** Task exists and declares an InteractiveToken principal. */
+    interactive: boolean;
+    /** Task action runs through `conhost.exe --headless` (windowless regardless of principal). */
+    headless: boolean;
+    /** Task is registered at all — absent tasks can't flash. */
+    exists: boolean;
+}
+export declare function windowsTaskXmlState(taskName: string): WindowsTaskState;
+/**
+ * True when an existing task still runs with an InteractiveToken principal —
+ * the 1.22.1 window-flash bug's principal half. Migration trigger for the
+ * windowless S4U principal. NOT the flash condition on its own: see
+ * `windowsTaskRunsVisibly`.
+ */
+export declare function windowsTaskRunsInteractive(taskName: string): boolean;
+/**
+ * True when triggering the task would open a VISIBLE console window:
+ * InteractiveToken principal AND a bare console action (not wrapped in
+ * `conhost --headless`). This — not the principal alone — is the flash
+ * condition; a conhost-wrapped InteractiveToken task is fully windowless.
+ */
+export declare function windowsTaskRunsVisibly(taskName: string): boolean;

package/dist/windowsTaskState.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.windowsTaskXmlState = windowsTaskXmlState;
+exports.windowsTaskRunsInteractive = windowsTaskRunsInteractive;
+exports.windowsTaskRunsVisibly = windowsTaskRunsVisibly;
+const child_process_1 = require("child_process");
+function windowsTaskXmlState(taskName) {
+    try {
+        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
+            encoding: 'utf8', windowsHide: true, timeout: 10_000,
+        });
+        if (query.status !== 0 || typeof query.stdout !== 'string') {
+            return { interactive: false, headless: false, exists: false };
+        }
+        return {
+            exists: true,
+            interactive: /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout),
+            headless: /conhost(\.exe)?<\/Command>[\s\S]*?--headless/i.test(query.stdout),
+        };
+    }
+    catch {
+        return { interactive: false, headless: false, exists: false };
+    }
+}
+/**
+ * True when an existing task still runs with an InteractiveToken principal —
+ * the 1.22.1 window-flash bug's principal half. Migration trigger for the
+ * windowless S4U principal. NOT the flash condition on its own: see
+ * `windowsTaskRunsVisibly`.
+ */
+function windowsTaskRunsInteractive(taskName) {
+    return windowsTaskXmlState(taskName).interactive;
+}
+/**
+ * True when triggering the task would open a VISIBLE console window:
+ * InteractiveToken principal AND a bare console action (not wrapped in
+ * `conhost --headless`). This — not the principal alone — is the flash
+ * condition; a conhost-wrapped InteractiveToken task is fully windowless.
+ */
+function windowsTaskRunsVisibly(taskName) {
+    const state = windowsTaskXmlState(taskName);
+    return state.interactive && !state.headless;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.26.0",
+  "version": "1.26.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {