Fuse fuzzy matching was too loose for structured event data (matched
"app_tracking_summary" instead of "app_install_failed"). Vector embeddings
didn't scale (timeout on 1000+ events even with 2 vCPU).
New approach: prefix-aware keyword matching with weighted field scoring.
EventType matches score 3x, message 2x, source 1.5x, data 0.5x.
Prefix matching handles morphological variants (install↔installation).
Knowledge base search_knowledge still uses vector (pre-indexed at startup).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The post-config binary integrity check was comparing the running EXE's
SHA-256 against LatestAgentSha256 which is the hash of the ZIP package —
these can never match. Introduces LatestAgentExeSha256 as a separate hash
computed from AutopilotMonitor.Agent.exe at build time, flowing through
AdminConfiguration → AgentConfigResponse → MonitoringService.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Separates registry identification confidence (high/medium/low) from CPE
mapping status (mapped/unmapped) so users can see at a glance which
software is checked against the CVE database and which is not.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The CI/CD pipeline correctly writes these fields via REST Merge, but
ConvertFromAdminTableEntity never read them back — causing the agent to
always skip the post-config binary integrity check.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When the IME pattern fires, the agent now checks ESP provisioning category
status from the registry before completing. If categories are still unresolved
(e.g. agent started late), it waits up to 30s for Windows to finalize the
outcomes. The ESP provisioning snapshot (category outcomes + subcategory states)
is included in every enrollment_complete event for observability.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The backend already reads errorCode from event data for FailureCode and
failure reason formatting, but the agent never populated it. This change
extracts error codes (exit codes, HRESULT) from named regex capture groups
in IME log error patterns and sends them as structured errorCode fields.
Also fixes a pre-existing bug where ErrorPatternId/ErrorDetail were not
persisted across agent restarts.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
On first run (no cached config), the self-updater only has the version.json
hash from the same blob storage as the ZIP — a single point of compromise.
After config fetch, the agent now verifies the running binary against the
backend-provided LatestAgentSha256 hash (separate trust channel). On mismatch,
logs an ERROR and sends an IntegrityCheckFailed emergency report.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Browse button now adds files incrementally instead of replacing the
previous selection. Each file shows name, size, and an x-button to
remove it. Duplicate files (same name+size) are silently skipped.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The input already supports multiple files but the label didn't indicate
it, unlike the screenshots field.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Hard kills and reboot kills are expected during enrollment (reboots, process
termination) and should not inflate the crash rate. Only exception crashes
represent actual failures. UI updated to visually separate expected exits.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
MapToEnrollmentEvent was returning the composite PartitionKey ({TenantId}_{SessionId})
as TenantId instead of extracting the actual tenant ID. Now prefers the stored TenantId
property with fallback extraction from the composite key.
Also adds a Vitest-based integration test suite (39 tests) covering all MCP tool endpoints:
- Session tools (search, get, events, analysis, CVE, blocked devices)
- Admin tools (metrics, geographic, platform, usage, audit, ops, reports)
- Raw data tools (tables, raw sessions/events, backend logs)
- Read-only verification (PUT/DELETE rejection)
- Error handling (404, 400, empty results)
Run with: AUTOPILOT_API_TOKEN="eyJ..." npm test
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
GetSessionEventsFunction, GetRuleResultsFunction, and GetVulnerabilityReportFunction
were missing the FindSessionTenantIdAsync fallback that GetSessionFunction already had.
When a Global Admin queried a cross-tenant session without explicit tenantId, the
middleware defaulted to the JWT tenant, causing partition key mismatch and empty results.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
First 3 attempts use default desktop (""), then alternate with explicit
"WinSta0\Default" to handle post-Hello desktop access issues. Log tags
[default desktop]/[explicit desktop] for traceability.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Oliver Kieselbach