fullcourtdefense-cli 1.26.5 → 1.26.6

package/dist/commands/daemon.d.ts

@@ -8,6 +8,18 @@ export interface DaemonArgs extends ProtectAllArgs {
     /** Suppress OS toasts (still logs). */
     quiet?: string;
 }
+/** Kill a process and wait (up to ~5s) for it to actually exit. */
+/**
+ * Uncaught-exception circuit breaker: one bad tick is survivable (log and
+ * continue — no supervisor restarts a Windows process instantly), but a BURST
+ * means process state is corrupted (broken closure, poisoned cache, leaked
+ * handle storm). Limping on undermines enforcement silently; exiting lets the
+ * supervisor (watchdog task / systemd / launchd) revive us with clean state.
+ */
+export declare const UNCAUGHT_BURST_MAX = 5;
+export declare const UNCAUGHT_BURST_WINDOW_MS: number;
+/** Pure: mutates `timestamps` (drops entries outside the window), returns whether the burst bound is hit. */
+export declare function shouldExitForUncaughtBurst(timestamps: number[], nowMs: number): boolean;
 /** Arguments shared by first-boot, stale catch-up, and web-triggered scans. */
 export declare function daemonDiscoverSweepArgs(): string[];
 export interface DiscoverSweepOutcome {
@@ -97,6 +109,8 @@ export declare function daemonRuntimeState(): DaemonRuntimeState;
 export declare function spawnDetachedDaemon(): boolean;
 /** Pid-alive check shared with the watchdog (EPERM still means alive). */
 export declare function pidIsAlive(pid: number): boolean;
+/** Force-stop a pid (graceful, then taskkill/SIGKILL) — shared with the watchdog's hung-daemon recycle. */
+export declare function forceStopPid(pid: number): boolean;
 export declare function macosLaunchdPath(currentPath?: string, execPath?: string): string;
 export declare function xmlEscape(value: string): string;
 /** Whether the daemon has been registered to start automatically. */

package/dist/commands/daemon.js

@@ -33,7 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.windowsTaskRunsVisibly = exports.windowsTaskRunsInteractive = void 0;
+exports.windowsTaskRunsVisibly = exports.windowsTaskRunsInteractive = exports.UNCAUGHT_BURST_WINDOW_MS = exports.UNCAUGHT_BURST_MAX = void 0;
+exports.shouldExitForUncaughtBurst = shouldExitForUncaughtBurst;
 exports.daemonDiscoverSweepArgs = daemonDiscoverSweepArgs;
 exports.summarizeDiscoverStderr = summarizeDiscoverStderr;
 exports.discoverSweepCredentialEnv = discoverSweepCredentialEnv;
@@ -48,6 +49,7 @@ exports.windowsTaskReferencesScriptHost = windowsTaskReferencesScriptHost;
 exports.daemonRuntimeState = daemonRuntimeState;
 exports.spawnDetachedDaemon = spawnDetachedDaemon;
 exports.pidIsAlive = pidIsAlive;
+exports.forceStopPid = forceStopPid;
 exports.macosLaunchdPath = macosLaunchdPath;
 exports.xmlEscape = xmlEscape;
 exports.isWatchdogTaskInstalled = isWatchdogTaskInstalled;
@@ -62,6 +64,7 @@ const distress_1 = require("../distress");
 const pollLoop_1 = require("../pollLoop");
 const selfTest_1 = require("../selfTest");
 const daemonForensics_1 = require("../daemonForensics");
+const verdictIpcClient_1 = require("../verdictIpcClient");
 const securityAgents_1 = require("../securityAgents");
 const mcpGateway_1 = require("./mcpGateway");
 const protectionRepair_1 = require("./protectionRepair");
@@ -161,6 +164,22 @@ function writeDaemonMeta() {
     catch { /* best-effort */ }
 }
 /** Kill a process and wait (up to ~5s) for it to actually exit. */
+/**
+ * Uncaught-exception circuit breaker: one bad tick is survivable (log and
+ * continue — no supervisor restarts a Windows process instantly), but a BURST
+ * means process state is corrupted (broken closure, poisoned cache, leaked
+ * handle storm). Limping on undermines enforcement silently; exiting lets the
+ * supervisor (watchdog task / systemd / launchd) revive us with clean state.
+ */
+exports.UNCAUGHT_BURST_MAX = 5;
+exports.UNCAUGHT_BURST_WINDOW_MS = 10 * 60_000;
+/** Pure: mutates `timestamps` (drops entries outside the window), returns whether the burst bound is hit. */
+function shouldExitForUncaughtBurst(timestamps, nowMs) {
+    const cutoff = nowMs - exports.UNCAUGHT_BURST_WINDOW_MS;
+    while (timestamps.length > 0 && timestamps[0] < cutoff)
+        timestamps.shift();
+    return timestamps.length >= exports.UNCAUGHT_BURST_MAX;
+}
 function stopPid(pid) {
     try {
         process.kill(pid);
@@ -319,17 +338,52 @@ function compareVersions(a, b) {
     }
     return 0;
 }
+/**
+ * Detect the "recycled pid" trap at startup: the pid file points at a LIVE
+ * process, but that process is not our daemon — the daemon died uncleanly and
+ * the OS reused its pid. Without this check acquirePidLock would yield to the
+ * impostor forever and the machine would never run a daemon again. Evidence
+ * required before we call it recycled: the alive-marker is stale past the
+ * hung bound AND no verdict endpoint exists (the kernel frees a named pipe
+ * when its owner dies — a wedged-but-real daemon still holds the endpoint).
+ */
+async function detectRecycledPidOwner() {
+    try {
+        const pid = Number(fs.readFileSync(pidFile(), 'utf8').trim());
+        if (!Number.isFinite(pid) || pid <= 0 || pid === process.pid || !isPidAlive(pid))
+            return undefined;
+        const health = (0, daemonForensics_1.classifyDaemonHealth)({
+            pidAlive: true,
+            pid,
+            marker: (0, daemonForensics_1.readAliveMarker)(),
+            staleAfterMs: (0, daemonForensics_1.daemonHungAfterMs)(),
+            pipeProbe: await (0, verdictIpcClient_1.probeVerdictServer)(1_000),
+        });
+        return health === 'pid_reused' ? pid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Take the single-instance lock. A NEWER build supersedes a running older
  * daemon (e.g. the MSI-bundled copy kept running after an npm update): the old
  * process is stopped and this one takes over, so the fleet never keeps running
  * stale enforcement code silently. Same-or-newer versions keep the lock.
+ * `recycledPid` (from detectRecycledPidOwner) marks a pid-file owner that is
+ * NOT our daemon — take over without touching that unrelated process.
  */
-function acquirePidLock() {
+function acquirePidLock(recycledPid) {
     fs.mkdirSync(daemonDir(), { recursive: true });
     try {
         const existing = Number(fs.readFileSync(pidFile(), 'utf8').trim());
         if (Number.isFinite(existing) && existing > 0 && existing !== process.pid && isPidAlive(existing)) {
+            if (existing === recycledPid) {
+                log(`Pid file points at live pid ${existing}, but it is NOT our daemon (alive-marker stale, no verdict endpoint) — the OS recycled the pid. Taking over the lock; that process is left alone.`);
+                fs.writeFileSync(pidFile(), String(process.pid), 'utf8');
+                writeDaemonMeta();
+                return true;
+            }
             const meta = readDaemonMeta();
             const runningVersion = meta && meta.pid === existing ? meta.version : undefined;
             // No meta = pre-1.15.4 build (never wrote one) → treated as older.
@@ -377,19 +431,36 @@ function hookConfigFiles() {
 // The resident loop
 // ---------------------------------------------------------------------------
 async function runDaemon(args, config) {
-    if (!acquirePidLock()) {
+    if (!acquirePidLock(await detectRecycledPidOwner())) {
         console.log(`${COLOR.yellow}Another FullCourtDefense daemon is already running (pid file: ${pidFile()}).${COLOR.reset}`);
         return;
     }
     // The resident loop must never die silently from one bad tick (fs watcher
     // callback, fetch, timer). Log and keep running — the loop is timer-driven,
     // so surviving a failed tick is safe, and on Windows there is no supervisor
-    // that would restart a crashed process instantly.
+    // that would restart a crashed process instantly. BUT a burst of uncaught
+    // exceptions means process state is corrupted: exit so the supervisor
+    // (watchdog task / systemd / launchd) revives us with a clean slate instead
+    // of limping on with broken enforcement.
+    const uncaughtAt = [];
     process.on('uncaughtException', error => {
         log(`Uncaught exception (daemon continues): ${error?.stack || String(error)}`);
         // Ledger the unknown: failures nobody predicted still become structured,
         // fleet-visible telemetry (code unexpected_error) on the next heartbeat.
         (0, distress_1.reportUnexpected)('daemon', error);
+        uncaughtAt.push(Date.now());
+        if (shouldExitForUncaughtBurst(uncaughtAt, Date.now())) {
+            log(`${exports.UNCAUGHT_BURST_MAX} uncaught exceptions within ${Math.round(exports.UNCAUGHT_BURST_WINDOW_MS / 60_000)} min — process state is suspect. Exiting so the supervisor restarts the daemon clean.`);
+            // The distress ledger survives on disk; the fresh daemon's first
+            // heartbeat ships it, so the fleet sees WHY this daemon recycled.
+            (0, distress_1.reportDistress)('daemon', distress_1.DISTRESS.UNCAUGHT_BURST, `${exports.UNCAUGHT_BURST_MAX} uncaught exceptions in ${Math.round(exports.UNCAUGHT_BURST_WINDOW_MS / 60_000)}min — self-recycled`);
+            // Intentional exit: without the clean-exit stamp the next boot would
+            // misreport this as an external kill (EDR/AV) — the distress code above
+            // already carries the true story.
+            (0, daemonForensics_1.recordCleanExit)('uncaught-exception burst — self-recycled');
+            releasePidLock();
+            process.exit(1);
+        }
     });
     process.on('unhandledRejection', reason => {
         log(`Unhandled rejection (daemon continues): ${reason?.stack || String(reason)}`);
@@ -437,6 +508,35 @@ async function runDaemon(args, config) {
     let suspended = false;
     let stopped = false;
     const executingActionIds = new Set();
+    // ── Replay guard: persisted ledger of action ids this machine has already
+    // executed. `executingActionIds` only dedupes within ONE daemon lifetime — a
+    // signed action is valid for its whole TTL, so a daemon restart (or a
+    // replayed/cached bundle) could re-run the same action: harmless for a
+    // health check, not for upgrade_cli or repair_protection. The ledger is
+    // capped and best-effort (a lost ledger degrades to today's behavior).
+    const executedActionsFile = () => path.join(daemonDir(), 'executed-actions.json');
+    const EXECUTED_ACTIONS_CAP = 100;
+    const readExecutedActionIds = () => {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(executedActionsFile(), 'utf8'));
+            return Array.isArray(parsed) ? parsed.filter((id) => typeof id === 'string').slice(-EXECUTED_ACTIONS_CAP) : [];
+        }
+        catch {
+            return [];
+        }
+    };
+    const recordExecutedActionId = (actionId) => {
+        try {
+            const ids = readExecutedActionIds().filter(id => id !== actionId);
+            ids.push(actionId);
+            const file = executedActionsFile();
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+            const tmp = `${file}.tmp-${process.pid}`;
+            fs.writeFileSync(tmp, JSON.stringify(ids.slice(-EXECUTED_ACTIONS_CAP)), 'utf8');
+            fs.renameSync(tmp, file);
+        }
+        catch { /* best-effort — worst case an action re-runs once, as before */ }
+    };
     /** Latest org auto-update policy seen on a bundle poll. */
     let autoUpdatePolicy;
     /** Heartbeat ticks spent without full credentials (drives recovery cadence). */
@@ -701,7 +801,17 @@ async function runDaemon(args, config) {
             watchdogTaskInstalled: isWatchdogTaskInstalled(),
         };
     };
-    const reportMachineAction = async (actionId, status, detail) => {
+    const reportMachineAction = async (actionId, status, detail, 
+    /**
+     * Proof-of-possession for the KEY-LESS reporting channel: the Ed25519
+     * signature the control plane attached to this action. A credential-broken
+     * machine has no shield key, but only the machine that RECEIVED the signed
+     * action holds its signature — the backend recomputes and compares it, so
+     * nobody can spoof results onto a real action with just (shieldId,
+     * machineId, actionId). Harmless on authenticated reports (backend ignores
+     * it when a valid shield key is present).
+     */
+    signatureProof) => {
         if (!creds.shieldId)
             return;
         try {
@@ -716,6 +826,7 @@ async function runDaemon(args, config) {
                     shieldId: creds.shieldId,
                     machineId: identity.machineId,
                     status,
+                    ...(signatureProof ? { signatureProof } : {}),
                     ...detail,
                 }),
                 signal: AbortSignal.timeout(8_000),
@@ -732,13 +843,17 @@ async function runDaemon(args, config) {
     // dashboard should never show "succeeded" for a version that never arrived.
     const pendingUpgradeFile = () => path.join(daemonDir(), 'pending-upgrade.json');
     const PENDING_UPGRADE_STALE_MS = 15 * 60_000;
-    const writePendingUpgradeMarker = (actionId, target) => {
+    const writePendingUpgradeMarker = (actionId, target, signatureProof) => {
         try {
             fs.writeFileSync(pendingUpgradeFile(), JSON.stringify({
                 actionId,
                 target,
                 fromVersion: cliVersion(),
                 startedAt: new Date().toISOString(),
+                // Persisted so the freshly upgraded daemon can report the outcome even
+                // on a key-less machine (proof-of-possession channel). Optional field:
+                // markers written by older daemons simply omit it.
+                ...(signatureProof ? { signatureProof } : {}),
             }), 'utf8');
         }
         catch { /* marker is best-effort; the server TTL expires the action safely */ }
@@ -766,7 +881,7 @@ async function runDaemon(args, config) {
             catch { /* ignore */ }
             await reportMachineAction(marker.actionId, 'succeeded', {
                 resultSummary: `CLI updated to ${current} and the daemon restarted on the new build.`,
-            });
+            }, marker.signatureProof);
             log(`Upgrade verified: CLI ${marker.fromVersion || 'unknown'} -> ${current} is live (action ${marker.actionId}).`);
             await uploadLogTail();
             return;
@@ -779,7 +894,7 @@ async function runDaemon(args, config) {
             catch { /* ignore */ }
             await reportMachineAction(marker.actionId, 'failed', {
                 error: `The updater was triggered but the CLI still reports ${current || 'unknown'} after ${Math.round(PENDING_UPGRADE_STALE_MS / 60_000)} minutes (target ${marker.target}). Check %ProgramData%\\FullCourtDefense\\updater.log on the machine.`,
-            });
+            }, marker.signatureProof);
             log(`Upgrade verification failed: still on ${current || 'unknown'}, target was ${marker.target} (action ${marker.actionId}).`);
             await uploadLogTail();
         }
@@ -789,6 +904,13 @@ async function runDaemon(args, config) {
     const executeMachineAction = async (action) => {
         if (executingActionIds.has(action.id))
             return;
+        // Replay guard: an action this machine ALREADY completed must not run
+        // again while its signature/TTL is still valid (restarted daemon, cached
+        // or replayed bundle). The server was already told the outcome.
+        if (readExecutedActionIds().includes(action.id)) {
+            log(`Remote action ${action.type} (${action.id}) already executed on this machine — replay ignored.`);
+            return;
+        }
         executingActionIds.add(action.id);
         // Cryptographic gate: never execute an action the control plane didn't
         // sign — a Firestore/backend compromise must not become fleet-wide RCE.
@@ -801,14 +923,14 @@ async function runDaemon(args, config) {
         const verdict = (0, machineActionVerify_1.verifyMachineAction)(action, { localMachineId: localIdentity.machineId });
         if (!verdict.ok) {
             log(`Remote action REJECTED: ${action.type} (${action.id}) — ${verdict.reason}`);
-            await reportMachineAction(action.id, 'failed', { error: `Action verification failed: ${verdict.reason}` });
+            await reportMachineAction(action.id, 'failed', { error: `Action verification failed: ${verdict.reason}` }, action.signature?.signature);
             executingActionIds.delete(action.id);
             await uploadLogTail();
             return;
         }
         if (verdict.reason)
             log(`Remote action verification notice: ${verdict.reason}`);
-        await reportMachineAction(action.id, 'running');
+        await reportMachineAction(action.id, 'running', undefined, action.signature?.signature);
         log(`Remote action started: ${action.type} (${action.id}).`);
         await uploadLogTail();
         try {
@@ -850,13 +972,13 @@ async function runDaemon(args, config) {
                     throw new Error('Shield not configured on this machine.');
                 const shieldId = creds.shieldId;
                 const identity = (0, machineIdentity_1.getMachineIdentity)();
-                log('Policy refresh: clearing Local Safety snapshot cache…');
-                (0, localSafetySnapshot_1.clearLocalSafetySnapshotCache)({
-                    apiUrl: creds.apiUrl,
-                    shieldId,
-                    developerName: identity.developerName,
-                    machineName: identity.hostname,
-                });
+                log('Policy refresh: clearing Local Safety snapshot caches…');
+                // Clear EVERY snapshot cache file, not one derived key: the hooks key
+                // their cache by hookSnapshotIdentity() (raw username@hostname) while
+                // getMachineIdentity() normalizes both — a targeted unlink under the
+                // normalized key used to MISS the hooks' actual cache file, so
+                // "policy refresh" never actually refreshed the hot-path snapshot.
+                (0, localSafetySnapshot_1.clearAllLocalSafetySnapshotCaches)();
                 await uploadLogTail();
                 log('Policy refresh: pulling latest policy bundle from control plane…');
                 const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
@@ -900,7 +1022,7 @@ async function runDaemon(args, config) {
                 // force: bypass the auto-update retry cooldown — an explicit admin
                 // action must actually attempt and report the real outcome, not
                 // "in progress" while a broken path silently retries hourly.
-                const outcome = (0, selfUpdate_1.maybeSelfUpdate)({ currentVersion: cliVersion(), targetVersion: target, enabled: true, force: true, log });
+                const outcome = (0, selfUpdate_1.maybeSelfUpdate)({ currentVersion: cliVersion(), targetVersion: target, enabled: true, force: true, log, apiUrl: creds.apiUrl });
                 if (!outcome) {
                     resultSummary = `CLI ${cliVersion() || 'unknown'} is already at ${target}.`;
                 }
@@ -908,7 +1030,12 @@ async function runDaemon(args, config) {
                     // The install replaces this process — DON'T report success yet.
                     // Leave the action "running" with a marker; the freshly upgraded
                     // daemon confirms the new version (or the check reports failure).
-                    writePendingUpgradeMarker(action.id, target);
+                    writePendingUpgradeMarker(action.id, target, action.signature?.signature);
+                    // Recorded NOW (not on completion): the installer replaces this
+                    // process, and the freshly upgraded daemon may still see this action
+                    // in a bundle — it must verify the pending marker, never re-trigger
+                    // the installer.
+                    recordExecutedActionId(action.id);
                     log(`Upgrade CLI: installer started — success will be confirmed once the new daemon is on ${target}.`);
                     executingActionIds.delete(action.id);
                     await uploadLogTail();
@@ -962,12 +1089,17 @@ async function runDaemon(args, config) {
                 resultSummary = (0, perfSnapshot_1.summarizePerfSnapshot)(snapshot);
                 log(`Perf snapshot: ${resultSummary}`);
             }
-            await reportMachineAction(action.id, 'succeeded', { resultSummary });
+            recordExecutedActionId(action.id);
+            await reportMachineAction(action.id, 'succeeded', { resultSummary }, action.signature?.signature);
             log(`Remote action succeeded: ${action.type}.`);
         }
         catch (error) {
             const message = error.message || 'Remote action failed';
-            await reportMachineAction(action.id, 'failed', { error: message });
+            // Terminal failure is recorded too: the action reached the server as
+            // 'failed' — retrying the SAME signed action id would just repeat the
+            // failure while looking like fresh progress in the console.
+            recordExecutedActionId(action.id);
+            await reportMachineAction(action.id, 'failed', { error: message }, action.signature?.signature);
             log(`Remote action failed: ${action.type}: ${message}`);
         }
         finally {
@@ -1051,9 +1183,22 @@ async function runDaemon(args, config) {
             autoUpdatePolicy = bundle.autoUpdate;
             // Mirror the org policy for the elevated MSI updater task (it runs as
             // SYSTEM and cannot read the shield-key-authenticated bundle itself).
-            if (bundle.autoUpdate) {
+            // Only refresh the mirror when the control plane actually confirmed the
+            // bundle (200 or 304) within the last few minutes. The updater treats a
+            // FRESH mirror without a targetVersion as an authoritative staged-
+            // rollout hold — rewriting it from a network-down cache fallback would
+            // keep a stale hold looking fresh forever on a half-connected machine.
+            const bundleServerConfirmed = typeof bundle.serverValidatedAt === 'number'
+                && Date.now() - bundle.serverValidatedAt < 10 * 60_000;
+            if (bundle.autoUpdate && bundleServerConfirmed) {
                 try {
-                    fs.writeFileSync(path.join(daemonDir(), 'update-policy.json'), JSON.stringify({ ...bundle.autoUpdate, updatedAt: new Date().toISOString() }), 'utf8');
+                    // Atomic write-temp-rename: the SYSTEM updater task reads this file
+                    // and treats its freshness as proof of a live daemon relaying the
+                    // staged-rollout decision — a torn read must never be possible.
+                    const mirrorPath = path.join(daemonDir(), 'update-policy.json');
+                    const tmpPath = `${mirrorPath}.tmp-${process.pid}`;
+                    fs.writeFileSync(tmpPath, JSON.stringify({ ...bundle.autoUpdate, updatedAt: new Date().toISOString() }), 'utf8');
+                    fs.renameSync(tmpPath, mirrorPath);
                 }
                 catch { /* mirror is best-effort; the updater defaults to enabled */ }
             }
@@ -1064,6 +1209,7 @@ async function runDaemon(args, config) {
                     enabled: true,
                     busy: executingActionIds.size > 0,
                     log,
+                    apiUrl: creds.apiUrl,
                 });
             }
             // Honeypot decoys: org-controlled via fleet settings. Planting is
@@ -1166,7 +1312,7 @@ async function runDaemon(args, config) {
     ensureWindowsAutostartHealthy(log);
     // Converge pre-Node-updater machines onto the PowerShell-free updater task
     // (best-effort; needs an elevated daemon to rewrite a SYSTEM task).
-    (0, selfUpdate_1.modernizeUpdaterTask)(log);
+    (0, selfUpdate_1.modernizeUpdaterTask)(log, creds.apiUrl);
     // Heal a stale/broken cmd-guard AutoRun (bat deleted, or macros pointing at
     // a dead node.exe) so wrapped commands (docker, git, …) never stay broken.
     if ((0, cmdGuard_1.repairStaleCmdAutorun)()) {
@@ -1873,6 +2019,10 @@ function spawnDetachedDaemon() {
 function pidIsAlive(pid) {
     return isPidAlive(pid);
 }
+/** Force-stop a pid (graceful, then taskkill/SIGKILL) — shared with the watchdog's hung-daemon recycle. */
+function forceStopPid(pid) {
+    return stopPid(pid);
+}
 function uninstallWindows() {
     const task = (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', TASK_NAME, '/F'], { stdio: 'ignore', windowsHide: true });
     (0, child_process_1.spawnSync)('schtasks', ['/Delete', '/TN', WATCHDOG_TASK_NAME, '/F'], { stdio: 'ignore', windowsHide: true });
@@ -1983,10 +2133,13 @@ Description=FullCourtDefense resident daemon (config watch + heartbeat)
 [Service]
 ExecStart=${JSON.stringify(process.execPath)} ${JSON.stringify(cliEntry())} daemon
 Restart=always
-RestartSec=30
-# Crash-loop circuit breaker: a daemon that dies 8 times in 10 minutes stops
-# being restarted (no infinite 10s spawn storm eating CPU on a broken install).
-StartLimitIntervalSec=600
+RestartSec=45
+# Crash-loop damping WITHOUT a permanent stop: 8 restarts x 45s = 360s, which
+# exceeds the 300s window, so the start limit is mathematically unreachable —
+# systemd keeps restarting forever at a bounded ~45s cadence. A permanent stop
+# would strand the machine: on the systemd path there is no watchdog cron to
+# revive a daemon that systemd has given up on.
+StartLimitIntervalSec=300
 StartLimitBurst=8
 
 [Install]

package/dist/commands/desktopChatGuard.js

@@ -50,7 +50,6 @@ const deterministicGuard_1 = require("./deterministicGuard");
 const clipboardScan_1 = require("./clipboardScan");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
-const machineIdentity_1 = require("../machineIdentity");
 const discoverPaths_1 = require("./discoverPaths");
 /**
  * Claude Desktop chat guard (Windows, advisory).
@@ -448,17 +447,19 @@ function startDesktopChatGuard(runtime) {
     let findings = 0;
     const lastToastAt = new Map();
     let scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(undefined);
-    const identity = (0, machineIdentity_1.getMachineIdentity)();
     const refreshSnapshot = async () => {
         if (!runtime.shieldId)
             return;
         try {
+            // Shared hook identity → same cache file the daemon warms (the
+            // normalized getMachineIdentity() names hash to a different, cold key).
+            const snapshotIdentity = (0, localSafetySnapshot_1.hookSnapshotIdentity)();
             const snapshot = await (0, localSafetySnapshot_1.loadLocalSafetySnapshot)({
                 apiUrl: runtime.apiUrl,
                 shieldId: runtime.shieldId,
                 shieldKey: runtime.shieldKey,
-                developerName: identity.developerName,
-                machineName: identity.hostname,
+                developerName: snapshotIdentity.developerName,
+                machineName: snapshotIdentity.machineName,
             });
             scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot);
         }

package/dist/commands/deterministicGuard.d.ts

@@ -41,6 +41,14 @@ export interface LocalSafetyScanOptions {
     disabledBuiltInItemIds?: string[];
     /** Built-in items with a NON-default action (absent item = 'block'). */
     itemActions?: Record<string, LocalSafetyRuleAction>;
+    /**
+     * Whether an actual Local Safety snapshot was resolved for this scan. When
+     * explicitly `false` (cold cache / wiped file / fetch failed with nothing on
+     * disk) the guard must NOT hard-block on the catalog default — it mirrors the
+     * server's warn-first gate for unarmed machines. `undefined` preserves the
+     * legacy "absent item = block" contract for callers that don't set it.
+     */
+    snapshotPresent?: boolean;
     customBlocks?: LocalSafetyCustomBlock[];
     policyHash?: string;
     cwd?: string;

package/dist/commands/deterministicGuard.js

@@ -424,6 +424,12 @@ function actionFor(itemId, options) {
     const action = options?.itemActions?.[itemId];
     if (action === 'warn' || action === 'mask' || action === 'block')
         return action;
+    // No snapshot resolved at all: never hard-block on the catalog default —
+    // an unarmed / offline machine mirrors the server's warn-first gate rather
+    // than over-blocking (the class of failure Romania hit). A present snapshot
+    // keeps the strict "absent item = block" contract below.
+    if (options?.snapshotPresent === false)
+        return 'warn';
     return DEFAULT_WARN_BUILT_INS.has(itemId) ? 'warn' : 'block';
 }
 function builtIn(itemId, categoryId, category, ruleId, reason, findingEvidence, explanation, options) {

package/dist/commands/doctor.d.ts

@@ -3,5 +3,9 @@ export interface DoctorArgs {
     apiUrl?: string;
     /** `doctor --perf` — measure this machine's real per-event overhead. */
     perf?: string;
+    /** `doctor --health` — mdatp-health-style per-subsystem status table. */
+    health?: string;
+    /** `doctor --edr` — print the narrowest EDR/AV allowlist guidance for IT. */
+    edr?: string;
 }
 export declare function doctorCommand(args: DoctorArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/doctor.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.doctorCommand = doctorCommand;
 const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const config_1 = require("../config");
 const runtimeConfig_1 = require("../runtimeConfig");
 const perfSnapshot_1 = require("../perfSnapshot");
@@ -129,12 +130,110 @@ async function perfCheck(apiUrl, config) {
         console.log(`WARN per-event overhead above budget (${hp.hookMedianMs}ms > ${budgetMs}ms) — if the node spawn floor is also high, AV/EDR is scanning every process spawn; ask IT about an exclusion for the FullCourtDefense install folder.`);
     }
 }
+/**
+ * `doctor --health` — mdatp-health-style status: one line per subsystem with
+ * PASS/FAIL and detail. Runs the SAME deep self-test the fleet console
+ * triggers remotely (`deep_selftest` machine action), so a customer reading
+ * this table and an admin reading the console see identical facts.
+ */
+async function healthCheck(apiUrl, config) {
+    const { cliVersion, isWatchdogTaskInstalled } = await Promise.resolve().then(() => __importStar(require('./daemon')));
+    const { runDeepSelfTest, summarizeSelfTest } = await Promise.resolve().then(() => __importStar(require('../selfTest')));
+    const { getMachineIdentity } = await Promise.resolve().then(() => __importStar(require('../machineIdentity')));
+    const version = cliVersion();
+    console.log('');
+    console.log(`FullCourtDefense health${version ? ` v${version}` : ''} — ${os.hostname()} (${os.platform()} ${os.release()})`);
+    const creds = (0, config_1.resolveCliCredentials)(config, { apiUrl });
+    if (creds.shieldId) {
+        try {
+            const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
+                apiUrl, shieldId: creds.shieldId, shieldKey: creds.shieldKey,
+                developerName: `${os.userInfo().username}@${os.hostname()}`, machineName: os.hostname(),
+                hotPath: true,
+            });
+            console.log(`enrolled: yes (shield ${creds.shieldId}) | mode: ${bundle.mode} (source: ${bundle.source}${bundle.policyHash ? `, policy ${bundle.policyHash.slice(0, 12)}` : ''})`);
+        }
+        catch {
+            console.log(`enrolled: yes (shield ${creds.shieldId}) | mode: cached (policy fetch unavailable right now)`);
+        }
+    }
+    else {
+        console.log('enrolled: no (local defaults, monitor-first)');
+    }
+    console.log('');
+    const identity = getMachineIdentity();
+    const report = await runDeepSelfTest({
+        creds,
+        developerName: identity.developerName,
+        machineName: identity.hostname,
+        machineId: identity.machineId,
+        isWatchdogTaskInstalled,
+    });
+    for (const check of report.checks) {
+        const status = check.ok ? 'PASS' : (check.optional ? 'WARN' : 'FAIL');
+        console.log(`${status} ${check.label}${check.detail ? ` — ${check.detail}` : ''}`);
+    }
+    console.log('');
+    console.log(summarizeSelfTest(report));
+    if (!report.ok) {
+        console.log('For AV/EDR tuning guidance run: fullcourtdefense doctor --edr true');
+        process.exit(1);
+    }
+}
+/**
+ * `doctor --edr` — the narrowest AV/EDR allowlist guidance, printable and
+ * pasteable into an IT ticket. Mirrors docs/av-edr-coexistence.md; most
+ * fleets need none of it.
+ */
+function edrGuidance(apiUrl) {
+    const installRoot = path.resolve(__dirname, '..', '..');
+    const nodeExe = path.join(installRoot, 'runtime', 'node.exe');
+    const hostname = new URL(normalizeApiUrl(apiUrl)).hostname;
+    console.log('');
+    console.log('FullCourtDefense — AV/EDR co-existence guidance (for your IT/security team)');
+    console.log('');
+    console.log('Most fleets need NO exclusions. Add them only if `doctor --perf true` shows');
+    console.log('hook latency dominated by process start (EDR scanning every node spawn).');
+    console.log('');
+    console.log('1. Process exclusion (preferred, narrowest):');
+    console.log(`     ${nodeExe}`);
+    console.log('   Signed binary in an admin-write-only path. Removes the per-spawn scan');
+    console.log('   cost, which is the entire hot-path problem.');
+    console.log('2. File exclusions for hot state files (high write frequency, never executed):');
+    console.log('     %USERPROFILE%\\.fullcourtdefense-spool.jsonl');
+    console.log('     %USERPROFILE%\\.fullcourtdefense-hook.log');
+    console.log('     %USERPROFILE%\\.fullcourtdefense-runtime.json');
+    console.log('3. Folder exclusion (only if 1-2 are unavailable):');
+    console.log(`     ${installRoot}\\`);
+    console.log('   Do NOT exclude %USERPROFILE%\\.fullcourtdefense* wholesale and do NOT');
+    console.log('   exclude %ProgramData%\\FullCourtDefense — they are user-writable; keep them scanned.');
+    console.log('');
+    console.log('Network allowlist (proxy / TLS inspection):');
+    console.log(`     Allow outbound HTTPS (TCP 443) to: ${hostname}`);
+    console.log('   Everything (policy bundle, verdicts, telemetry, update manifest) uses that one hostname.');
+    console.log('');
+    console.log('AppLocker / WDAC:');
+    console.log('   The MSI and installer scripts are Authenticode-signed — prefer a PUBLISHER');
+    console.log('   rule over path rules. The bundled runtime\\node.exe carries the official');
+    console.log('   Node.js signature. Install/update custom actions are PowerShell-free, so');
+    console.log('   PowerShell-blocking policies do not affect install, update, or enforcement.');
+    console.log('');
+    console.log('Full guide: sdks/cli/docs/av-edr-coexistence.md (in the product repo).');
+}
 async function doctorCommand(args, config) {
     const apiUrl = normalizeApiUrl(args.apiUrl || config.apiUrl);
     if (args.perf === 'true') {
         await perfCheck(apiUrl, config);
         return;
     }
+    if (args.health === 'true') {
+        await healthCheck(apiUrl, config);
+        return;
+    }
+    if (args.edr === 'true') {
+        edrGuidance(apiUrl);
+        return;
+    }
     const pingUrl = `${apiUrl}/api/health/ping`;
     const rootUrl = `${apiUrl}/`;
     console.log('');

package/dist/commands/hook.d.ts

@@ -26,6 +26,7 @@ export interface HookArgs {
     shieldKey?: string;
     shadow?: string;
     enforce?: string;
+    fcdManaged?: string;
     failClosed?: string;
     localOnly?: string;
     timeout?: string;