chore: bump .claude/commands gitlink

feat(rules): allow-list folders under the signed-in user's profile (D-228, D-229)
Gather rules and admin-configured diagnostics paths could never reach a folder below a user profile. The %LOGGED_ON_USER_PROFILE% token lifts the C:\Users hard block for AppData\Local and AppData\Roaming, but lifting is not admitting: the path then fell into filePrefixes, which is matched literally against the already-expanded path, and the profile name is not known when that list is authored. The exception only ever worked in unrestricted mode, and no agent test passed a non-null userProfilePath. D-228 introduces userProfileFilePrefixes, holding entries relative to the profile root (AppData\Local\RealmJoin). Both guards resolve them against the detected profile and match segment-bounded; entries that are rooted, contain "..", or sit outside AppData\Local / AppData\Roaming are dropped at load, so configuration can only narrow the hard block's exception, never widen it. The allowlist is anchored to the detected profile, so a rule cannot reach another user's AppData. The AppData subdirectory list existed in both guard classes with the GatherRuleGuards copy unused; it is now one list and DiagnosticsPathGuards delegates. filePrefixes additionally gains C:\ProgramData\RealmJoin\choco\logs. D-229 fixes the pre-flight validators, which must only ever reject what the agent rejects: - the portal returned "allowed" on the lifted hard block without consulting the allowlist, so a rule the agent refuses passed the enable gate and then failed silently on the device with a security_warning; - the MCP validator offered logparser the diagnosticsPathPrefixes list that no collector consults (four paths reported allowed that the agent blocks); - the MCP validator did not expand environment variables at all, reporting %ProgramData% targets as blocked although the device reads them. Measured before changing the portal: no rule in any tenant used the token, so nothing that was working gets disabled. Verified: solution build 0 warnings, agent 2897 tests, web 1257 + tsc + eslint 0, MCP 779, guardrails.json validates against its schema, rules/dist regenerates without drift. The six new agent tests were green against the unchanged guard first, which is what proves the exception was inert. Takes effect on devices only after an agent release: guardrails.json is an EmbeddedResource in the agent assembly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-10-26 05:29:43 +00:00 · 2026-09-09 12:02:05 +02:00 · 2026-09-09 11:54:36 +02:00 · 2026-09-09 10:06:20 +02:00 · 2026-09-09 09:58:50 +02:00 · 2026-09-08 23:11:16 +02:00
32 changed files with 820 additions and 119 deletions
@@ -55,6 +55,10 @@ updates:
      - dependency-name: '*'
        update-types: ['version-update:semver-major']

+  # Every action is referenced by commit SHA with the version in a trailing comment;
+  # action-pins.yml fails any workflow change that reintroduces a mutable tag. Dependabot
+  # is what keeps those pins current: it rewrites the SHA and the comment together, so the
+  # pins are reviewed in a PR instead of drifting silently or being bumped by hand.
  - package-ecosystem: github-actions
    directory: /
    schedule:
@@ -0,0 +1,70 @@
+name: Action Pin Gate
+
+# Every third-party action must be referenced by a full commit SHA, never by a tag.
+# Tags are mutable: whoever controls an action repository can repoint v4 at new code,
+# and that code runs inside jobs that hold the code-signing identity, the storage
+# credentials and a token that can push to main. A SHA is the only reference an
+# upstream owner cannot change under us.
+#
+# Lives in its own workflow rather than in ci.yml: CI deliberately ignores changes to
+# the other workflow files, so a guard placed there would stay silent for exactly the
+# commits it needs to inspect.
+#
+# Like CI, this reports rather than blocks: main is deliberately unprotected, so a red
+# run is a signal to act on, not a merge barrier. Making it binding means adding
+# 'Verify action pins' as a required status check -- a branch-protection decision, not
+# something this file can assert.
+#
+# The pins are not maintained by hand — .github/dependabot.yml opens a monthly grouped
+# PR that rewrites both the SHA and the trailing version comment. The comment is
+# therefore required too: it is what makes a pinned line reviewable.
+
+on:
+  push:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  pull_request:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-pins:
+    name: Verify action pins
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Every third-party action is pinned to a SHA
+        run: |
+          set -uo pipefail
+          failed=0
+          while IFS=: read -r file line ref; do
+            # Reusable workflows from this repository move with the commit that calls
+            # them, so there is nothing to pin.
+            case "$ref" in ./*) continue ;; esac
+
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*[^[:space:]] ]]; then
+              printf 'ok  %s:%s  %s\n' "$file" "$line" "$ref"
+              continue
+            fi
+
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]*$ ]]; then
+              echo "::error file=$file,line=$line::Pinned but the version comment is missing: '$ref'. Write 'owner/action@<sha> # vN' so the line stays reviewable."
+            else
+              echo "::error file=$file,line=$line::Action '$ref' is not pinned to a commit SHA. Tags are mutable -- resolve it with: gh api repos/<owner>/<action>/git/ref/tags/<tag>"
+            fi
+            failed=1
+          # -H is load-bearing: with a single matching file grep omits the name, the
+          # fields shift by one and every diagnostic points at nothing.
+          done < <(grep -nHE '^[[:space:]]*(-[[:space:]]+)?uses:' .github/workflows/*.yml \
+                   | sed -E 's/^([^:]+):([0-9]+):[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]*/\1:\2:/')
+
+          if [ "$failed" -ne 0 ]; then
+            echo "::error::Unpinned action references found -- fix them before this reaches main."
+            exit 1
+          fi
+          echo "All action references are pinned to commit SHAs."
@@ -18,7 +18,7 @@ jobs:
    name: Bootstrap guard tests (PS 5.1)
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Install Pester 5+
        shell: powershell
@@ -72,7 +72,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      # Every released build is signed; a missing variable stops the run before a build
      # number is burnt.
@@ -122,7 +122,7 @@ jobs:

      # SDK 10 = single build toolchain (parity with local build.ps1 / global.json).
      - name: Setup .NET
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        with:
          dotnet-version: '10.0.x'

@@ -462,7 +462,7 @@ jobs:
      # Skipped on runs that publish nothing -- no log entry for bytes nobody receives.
      - name: Attest build provenance
        if: inputs.upload_blob || inputs.create_release
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
        with:
          subject-path: |
            ${{ steps.artifact.outputs.versioned_zip_release }}
@@ -470,13 +470,13 @@ jobs:
            staging/agent/AutopilotMonitor.SummaryDialog.exe

      - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}
          path: ${{ steps.artifact.outputs.versioned_zip_release }}

      - name: Upload version metadata
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: version-metadata
          path: ${{ env.MANIFEST_NAME }}
@@ -40,7 +40,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      # The loader executes as SYSTEM on every enrolling device — a parse error or
      # non-ASCII mojibake (PS 5.1 codepage roulette) must fail the build, not the fleet.
@@ -111,8 +111,11 @@ jobs:
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

+      # Exact version, not a "5.*" range: wix writes the bytes of the MSI that customers
+      # install, so a compromised or simply broken point release must not flow into a build
+      # unnoticed. Bumping is a reviewed commit.
      - name: Install WiX toolset
-        run: dotnet tool install --global wix --version "5.*"
+        run: dotnet tool install --global wix --version 5.0.2

      # Version pinned; roll-forward because the tool targets an older runtime than the SDK.
      - name: Install AzureSignTool
@@ -235,12 +238,12 @@ jobs:
      # gh attestation verify AutopilotMonitor-Bootstrap.msi --repo okieselbach/AutopilotMonitor
      - name: Attest build provenance (MSI)
        if: inputs.upload_blob
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
        with:
          subject-path: ${{ env.STABLE_MSI }}

      - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: AutopilotMonitor-Bootstrap-v${{ steps.version.outputs.version }}
          path: ${{ env.STABLE_MSI }}
@@ -35,6 +35,7 @@ on:
      # Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
      # cannot negate, so they are listed one by one; ci.yml itself stays out of the list
      # so a change to CI runs CI. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/action-pins.yml'
      - '.github/workflows/bootstrap-script-gates.yml'
      - '.github/workflows/build-agent.yml'
      - '.github/workflows/build-msi.yml'
@@ -67,6 +68,7 @@ on:
      # Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
      # cannot negate, so they are listed one by one; ci.yml itself stays out of the list
      # so a change to CI runs CI. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/action-pins.yml'
      - '.github/workflows/bootstrap-script-gates.yml'
      - '.github/workflows/build-agent.yml'
      - '.github/workflows/build-msi.yml'
@@ -94,9 +96,9 @@ jobs:
    # windows-latest is required: the agent test projects target net48.
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        with:
          dotnet-version: '10.0.x'

@@ -125,9 +127,9 @@ jobs:
      run:
        working-directory: src/Web/autopilot-monitor-web
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'
          cache: npm
@@ -159,9 +161,9 @@ jobs:
      run:
        working-directory: src/McpServer/autopilot-monitor-mcp
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'
          cache: npm
@@ -179,7 +181,7 @@ jobs:
      # (run 31252869254). Persist the model across runs instead; HF_CACHE_DIR
      # is honored by vector-search-provider.ts.
      - name: Cache embedding model
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ${{ github.workspace }}/.hf-cache
          key: hf-model-Xenova-all-MiniLM-L6-v2
@@ -193,9 +195,9 @@ jobs:
    name: Generated guardrails match rules/guardrails.json
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'

@@ -214,9 +216,9 @@ jobs:
    name: Generated wire types match shared-manifests.json
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'

@@ -102,15 +102,15 @@ jobs:
            build-mode: none

    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        if: matrix.language == 'csharp'
        with:
          dotnet-version: '10.0.x'

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.9
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
@@ -121,6 +121,6 @@ jobs:
        run: dotnet build AutopilotMonitor.sln --configuration Release

      - name: Analyze
-        uses: github/codeql-action/analyze@v4.37.9
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          category: /language:${{ matrix.language }}
@@ -24,14 +24,17 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'

+      # Exact versions and no lifecycle scripts: this job holds contents:write and pushes to
+      # main, so an install-time script from a hijacked package would run with a token that
+      # can rewrite the repository. ajv is pure JS and needs no install hooks.
      - name: Install ajv-cli
-        run: npm install -g ajv-cli ajv-formats
+        run: npm install -g --ignore-scripts ajv-cli@5.0.0 ajv-formats@3.0.1

      - name: Validate Gather Rules
        run: |
@@ -19,7 +19,7 @@ jobs:
    name: Build and Deploy Backend

    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Login to Azure (OIDC)
        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
@@ -29,7 +29,7 @@ jobs:
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Setup .NET 10
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        with:
          dotnet-version: '10.0.x'

@@ -26,7 +26,7 @@ jobs:
    name: Build and Deploy MCP Server

    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      # The published customer documentation lives in its own PUBLIC repo and is
      # baked into the image as the search_docs corpus (see the Dockerfile). No
@@ -36,7 +36,7 @@ jobs:
      # re-run actually rolls a new revision). /health reports the SHA captured
      # below so that staleness is checkable.
      - name: Check out documentation bundle
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          repository: autopilotmonitor/autopilotmonitor-docs
          path: mcp-docs
@@ -35,7 +35,7 @@ jobs:
    runs-on: ubuntu-latest
    name: Build and Deploy Job
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          lfs: false
          fetch-depth: 0  # Full history needed for git-based sitemap lastmod dates
@@ -56,7 +56,7 @@ jobs:
      # workflow runs again (push under src/Web/** or a manual dispatch); versions/web.json
      # records which docs commit is live.
      - name: Check out documentation bundle
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          repository: autopilotmonitor/autopilotmonitor-docs
          path: whats-new-docs
@@ -66,7 +66,7 @@ jobs:
        id: docs
        run: echo "sha=$(git -C whats-new-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'
          cache: npm
@@ -114,12 +114,12 @@ jobs:
      # commit, workflow file) in a public transparency log.
      # Verify: gh attestation verify portal-<sha>.tar.gz --repo okieselbach/AutopilotMonitor
      - name: Attest build provenance (portal export)
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
        with:
          subject-path: ${{ steps.package.outputs.archive }}

      - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: portal-${{ github.sha }}
          path: ${{ steps.package.outputs.archive }}
@@ -54,7 +54,7 @@ jobs:
    needs: gates
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Check code-signing configuration
        shell: pwsh
@@ -127,7 +127,7 @@ jobs:
      # when someone wants to look at the file.
      - name: Upload signed scripts
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: signed-scripts
          path: ${{ runner.temp }}/signed-scripts
@@ -94,7 +94,11 @@
    "C:\\Windows\\Panther",
    "C:\\Windows\\SetupDiag",
    "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
-    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log"
+    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
+    "C:\\ProgramData\\RealmJoin\\choco\\logs"
+  ],
+  "userProfileFilePrefixes": [
+    "AppData\\Local\\RealmJoin"
  ],
  "wmiQueryPrefixes": [
    "SELECT * FROM Win32_OperatingSystem",
@@ -8,6 +8,16 @@
    "$schema": { "type": "string" },
    "registryPrefixes": { "$ref": "#/$defs/categorizedList" },
    "filePrefixes": { "$ref": "#/$defs/stringList" },
+    "userProfileFilePrefixes": {
+      "description": "Folders under the signed-in user's profile that file collectors and diagnostics paths may read, RELATIVE to the profile root (e.g. \"AppData\\\\Local\\\\Vendor\"). Resolved against %LOGGED_ON_USER_PROFILE% at match time. Entries outside AppData\\Local / AppData\\Roaming are dropped at load: the C:\\Users hard block never admits them, so this list can only ever narrow what the block's exception already permits.",
+      "type": "array",
+      "items": {
+        "allOf": [
+          { "$ref": "#/$defs/safeString" },
+          { "pattern": "^AppData\\\\(Local|Roaming)(\\\\|$)" }
+        ]
+      }
+    },
    "wmiQueryPrefixes": { "$ref": "#/$defs/stringList" },
    "eventLogChannels": { "$ref": "#/$defs/categorizedList" },
    "blockedEventLogChannels": { "$ref": "#/$defs/stringList" },
@@ -208,6 +208,14 @@ export const ALLOWED_FILE_PREFIXES: readonly string[] = [
 ${flatArray(guardrails.filePrefixes)}
 ];

+// Folders under the signed-in user's profile, RELATIVE to the profile root. The agent
+// resolves %LOGGED_ON_USER_PROFILE% at runtime; the portal validates against a placeholder
+// profile. These cannot live in ALLOWED_FILE_PREFIXES — that list is matched literally
+// against the already-expanded path, where the user name is unknown at authoring time.
+export const USER_PROFILE_FILE_PREFIXES: readonly string[] = [
+${flatArray(guardrails.userProfileFilePrefixes ?? [])}
+];
+
 export const ALLOWED_WMI_QUERY_PREFIXES: readonly string[] = [
 ${flatArray(guardrails.wmiQueryPrefixes)}
 ];
@@ -14,6 +14,22 @@
 BeforeAll {
    . (Join-Path $PSScriptRoot 'Install-AutopilotMonitor.ps1')

+    function New-FakeSignature {
+        param([string]$Status, [string]$Subject)
+        $cert = if ($Subject) {
+            [pscustomobject]@{ Subject = $Subject; Thumbprint = '0123456789ABCDEF' }
+        } else { $null }
+        return [pscustomobject]@{ Status = $Status; SignerCertificate = $cert }
+    }
+
+    function New-FakePayload {
+        param([string[]]$Files)
+        $dir = Join-Path $TestDrive ([guid]::NewGuid().ToString())
+        New-Item -ItemType Directory -Path $dir -Force | Out-Null
+        foreach ($f in $Files) { Set-Content -Path (Join-Path $dir $f) -Value 'x' }
+        return $dir
+    }
+
    function New-FakeProfile {
        param([string]$Name, [double]$AgeMinutes)
        $p = Join-Path $TestDrive $Name
@@ -305,3 +321,93 @@ Describe 'logging purity' {
        Get-Content $LogFile -Raw | Should -Match 'SKIP: Agent was previously deployed'
    }
 }
+
+Describe 'Get-UnverifiedAgentBinaries' {
+    # The publisher gate on the extracted payload. What matters is the DECISION: which
+    # payload is accepted, which is refused, and which files are looked at at all.
+    BeforeEach {
+        Mock Write-Log { }
+        $script:ours = 'CN=glueckkanja AG, O=glueckkanja AG, C=DE'
+    }
+
+    It 'accepts a payload where every binary of ours is validly signed by us' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject $script:ours }
+        Get-UnverifiedAgentBinaries -Path $dir | Should -BeNullOrEmpty
+    }
+
+    It 'checks the binaries we author and leaves third-party assemblies alone' {
+        $dir = New-FakePayload -Files @(
+            'AutopilotMonitor.Agent.exe',
+            'AutopilotMonitor.Agent.exe.config',
+            'AutopilotMonitor.Shared.dll',
+            'Newtonsoft.Json.dll',
+            'System.Management.Automation.dll'
+        )
+        $script:checked = @()
+        Mock Get-AuthenticodeSignature {
+            $script:checked += (Split-Path $FilePath -Leaf)
+            New-FakeSignature -Status 'Valid' -Subject $script:ours
+        }
+
+        Get-UnverifiedAgentBinaries -Path $dir | Should -BeNullOrEmpty
+        $script:checked | Should -Be @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+    }
+
+    It 'refuses an unsigned agent executable' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'NotSigned' -Subject $null }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a tampered binary (hash mismatch)' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'HashMismatch' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a signature whose chain does not validate' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'UnknownError' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a validly signed binary from a different publisher' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US' }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses the whole payload when a single DLL of ours is swapped' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+        Mock Get-AuthenticodeSignature {
+            if ((Split-Path $FilePath -Leaf) -eq 'AutopilotMonitor.Shared.dll') {
+                New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US'
+            } else {
+                New-FakeSignature -Status 'Valid' -Subject $script:ours
+            }
+        }
+        $rejected = Get-UnverifiedAgentBinaries -Path $dir
+        $rejected.Count | Should -Be 1
+        $rejected[0] | Should -BeLike 'AutopilotMonitor.Shared.dll*'
+    }
+
+    It 'refuses when the signature check itself throws' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { throw 'access denied' }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses an empty payload instead of passing it' {
+        $dir = New-FakePayload -Files @('Newtonsoft.Json.dll')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+}
+
+Describe 'publisher pin' {
+    It 'pins the expected publisher by subject, not by thumbprint' {
+        $ExpectedPublisher | Should -Be '*O=glueckkanja AG*'
+        $ExpectedPublisher | Should -Not -Match '^[0-9A-Fa-f]{40}$'
+    }
+}
@@ -12,8 +12,9 @@
      2. Downloads the monitoring agent ZIP from Azure Blob Storage
      3. Verifies integrity via SHA-256 hash from the version manifest (mandatory)
      4. Extracts the agent into %ProgramData%\AutopilotMonitor\Agent
-      5. Runs the agent in --install mode (registers Scheduled Task, spawns the runtime)
-      6. Verifies the runtime process actually launched
+      5. Verifies the Authenticode signature and publisher of every binary we author
+      6. Runs the agent in --install mode (registers Scheduled Task, spawns the runtime)
+      7. Verifies the runtime process actually launched
    Agent self-destructs when enrollment completes.

    Relax flow (guards 2+3): a real user profile (or a real LastLoggedOnUser)
@@ -76,6 +77,11 @@
      PowerShell 5.1 (IME) reads scripts without BOM as ANSI, corrupting multi-byte chars.

 .CHANGELOG
+    2026-09-08  v2.5  Publisher gate: every AutopilotMonitor binary in the extracted
+                      payload must carry a valid Authenticode signature from the
+                      expected publisher before --install runs. The SHA-256 manifest
+                      check stays and is unchanged; it proves the bytes, the signature
+                      proves the author.
    2026-08-08  v2.3  Windows 365 Cloud PC support: a positively identified Cloud PC
                      (Windows365 registry key AND CloudManagedDesktopExtension
                      service) now triggers the guard 2+3 relax alongside OOBE
@@ -128,7 +134,12 @@ param(
 )

 # Script version (bump on meaningful changes; see .CHANGELOG above)
-$ScriptVersion = "2.4"
+$ScriptVersion = "2.5"
+
+# The publisher every binary we author must carry. A -like pattern on the subject, NOT a
+# thumbprint: certificates are renewed, deployed copies of this script are not. Same value
+# the loader pins for this script.
+$ExpectedPublisher = "*O=glueckkanja AG*"

 # Configuration - Everything in ProgramData for easy cleanup
 $AgentBasePath = "$env:ProgramData\AutopilotMonitor"
@@ -329,6 +340,56 @@ function Get-BootstrapDecision {
    return [pscustomobject]@{ Install = $true; ReasonCode = $null; RelaxActive = $relax.Active }
 }

+# Returns the list of reasons why the extracted payload is not ours; an empty result means
+# every binary we author carries a valid Authenticode signature from the expected publisher.
+# Third-party assemblies keep their own publisher's signature and are not checked here.
+# Any error is a rejection: an unreadable signature is an unverified binary.
+function Get-UnverifiedAgentBinaries {
+    param([string]$Path)
+
+    $rejected = @()
+    $ourBinaries = @(
+        Get-ChildItem -Path $Path -Filter 'AutopilotMonitor.*' -File -ErrorAction SilentlyContinue |
+            Where-Object { $_.Extension -in @('.exe', '.dll') }
+    )
+
+    # An empty set is a rejection, not a pass: it means the extraction produced nothing we
+    # recognise, and the alternative would be a gate that silently approves an empty folder.
+    # The comma keeps a single rejection an ARRAY: PowerShell unrolls a one-element result to
+    # a bare string, and the caller reads .Count and indexes into it.
+    if ($ourBinaries.Count -eq 0) {
+        return , @("no AutopilotMonitor binaries found in $Path")
+    }
+
+    foreach ($binary in $ourBinaries) {
+        try {
+            $sig = Get-AuthenticodeSignature -FilePath $binary.FullName -ErrorAction Stop
+        }
+        catch {
+            $rejected += "$($binary.Name): signature check failed to run ($($_.Exception.Message))"
+            continue
+        }
+
+        if ($null -eq $sig) {
+            $rejected += "$($binary.Name): signature check returned nothing"
+            continue
+        }
+
+        $subject = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { '<unsigned>' }
+
+        if ($sig.Status -ne 'Valid') {
+            $rejected += "$($binary.Name): signature status $($sig.Status)"
+            continue
+        }
+        if ($subject -notlike $ExpectedPublisher) {
+            $rejected += "$($binary.Name): unexpected publisher $subject"
+            continue
+        }
+    }
+
+    return , $rejected
+}
+
 # Main bootstrap flow. Only invoked when the script is run directly (see entry guard
 # at the bottom); never on dot-source.
 function Invoke-Bootstrap {
@@ -445,6 +506,20 @@ function Invoke-Bootstrap {
            }
        }

+        # Publisher gate. The SHA-256 above proves the ZIP is the one the manifest names, but
+        # that manifest lives in the same container as the ZIP and cannot outlive a compromise
+        # of the download host. The expected publisher travels inside THIS script, which the
+        # loader verified before running it, so the chain from the file an administrator
+        # assigns to the process that starts here stays publisher-anchored end to end.
+        # Fail-closed, exactly like the hash check: running unverified code as SYSTEM is the
+        # risk being removed.
+        Write-Log "Verifying Authenticode signatures of the agent binaries..."
+        $unverified = Get-UnverifiedAgentBinaries -Path $AgentBinPath
+        if ($unverified.Count -gt 0) {
+            throw "Authenticode verification FAILED ($($unverified -join '; ')). Refusing to run an agent that is not signed by the expected publisher."
+        }
+        Write-Log "Authenticode verification passed (publisher pin: $ExpectedPublisher)"
+
        Write-Log "Calling agent install mode (--install)..."
        & $agentExePath --install
        $installExitCode = $LASTEXITCODE
@@ -456,5 +456,124 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather

            SingleSecurityWarning();
        }
+
+        // -------------------------------------------------------------------
+        // %LOGGED_ON_USER_PROFILE% exception (userProfilePath overload)
+        //
+        // The token lifts the C:\Users hard block for AppData\Local and
+        // AppData\Roaming — and nothing more. The allowlist still decides,
+        // which is what the cases below pin down: the exception is a gate the
+        // allowlist has to open, never an allowance of its own.
+        // -------------------------------------------------------------------
+
+        private const string TestProfile = @"C:\Users\TestUser";
+
+        [Fact]
+        public void UserProfile_AppDataPath_WithoutAllowlistEntry_IsStillBlocked()
+        {
+            // The lifted hard block alone admits nothing: without a matching
+            // userProfileFilePrefixes entry the path falls through to the
+            // allowlist and is refused there.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_OutsideAppData_IsBlockedByTheHardBlock()
+        {
+            foreach (var target in new[] { @"\Desktop\secret.txt", @"\Documents\notes.txt", @"\ntuser.dat" })
+            {
+                Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                    TestProfile + target, unrestrictedMode: false, userProfilePath: TestProfile));
+            }
+        }
+
+        [Fact]
+        public void UserProfile_NullProfile_KeepsTheUsersHardBlock()
+        {
+            // No interactive user detected — the exception cannot apply and the
+            // path stays under the plain C:\Users block.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\TestUser\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: null));
+        }
+
+        [Fact]
+        public void UserProfile_TraversalOutOfAppData_IsBlocked()
+        {
+            // Spelling Documents as a traversal out of AppData must not survive
+            // Path.GetFullPath normalisation.
+            const string traversal = @"C:\Users\TestUser\AppData\Local\..\..\Documents\secret.txt";
+
+            Assert.Equal(@"C:\Users\TestUser\Documents\secret.txt", Path.GetFullPath(traversal));
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                traversal, unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_ForeignProfile_IsBlockedEvenUnderAppData()
+        {
+            // The exception is scoped to the DETECTED profile — a rule must not
+            // reach a second user's AppData by spelling the path out.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\OtherUser\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_IsAllowed()
+        {
+            // AppData\Local\RealmJoin is on userProfileFilePrefixes: the file itself, a
+            // subfolder below it, and the folder itself all pass.
+            foreach (var target in new[] { @"\tray.log", @"\Logs\rj.log", "" })
+            {
+                Assert.True(GatherRuleGuards.IsFilePathAllowed(
+                    TestProfile + @"\AppData\Local\RealmJoin" + target,
+                    unrestrictedMode: false, userProfilePath: TestProfile),
+                    $"expected allowed: ...\\RealmJoin{target}");
+            }
+        }
+
+        [Fact]
+        public void UserProfile_SiblingOfAnAllowlistedVendorFolder_IsBlocked()
+        {
+            // Segment-bounded: "RealmJoin" must not admit "RealmJoinSomethingElse".
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\RealmJoinSomethingElse\tray.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_InAForeignProfile_IsBlocked()
+        {
+            // The allowlist is anchored to the DETECTED profile, not to C:\Users\*.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\OtherUser\AppData\Local\RealmJoin\tray.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_WithoutADetectedUser_IsBlocked()
+        {
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\TestUser\AppData\Local\RealmJoin\tray.log",
+                unrestrictedMode: false, userProfilePath: null));
+        }
+
+        [Fact]
+        public void UserProfile_AppDataPath_IsAllowedInUnrestrictedMode()
+        {
+            // Where the exception does bite today: unrestricted mode returns
+            // before the allowlist, so the lifted hard block is the whole story.
+            Assert.True(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: true, userProfilePath: TestProfile));
+
+            // ...but only under AppData — Documents stays blocked even there.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\Documents\secret.txt",
+                unrestrictedMode: true, userProfilePath: TestProfile));
+        }
    }
 }
@@ -56,6 +56,31 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Telemetry.Gather
                LoadEmbeddedGuardrails()["maxCommandLength"]!.Value<int>());
        }

+        [Fact]
+        public void User_profile_prefixes_are_all_accepted_by_the_loader()
+        {
+            // The loader drops entries outside AppData\Local / AppData\Roaming (the hard block
+            // would never release them anyway). A dropped entry is invisible at runtime — it
+            // just never matches — so a typo in the JSON must fail here instead.
+            var json = LoadEmbeddedGuardrails()["userProfileFilePrefixes"]?.ToObject<string[]>()
+                       ?? new string[0];
+
+            Assert.Equal(
+                json.Select(p => p.Trim().TrimEnd('\\')).OrderBy(p => p),
+                GatherRuleGuards.AllowedUserProfileFilePrefixes.OrderBy(p => p));
+        }
+
+        [Fact]
+        public void User_profile_prefixes_stay_under_the_hard_blocks_exception()
+        {
+            Assert.All(
+                GatherRuleGuards.AllowedUserProfileFilePrefixes,
+                prefix => Assert.Contains(
+                    GatherRuleGuards.AllowedUserProfileSubdirs,
+                    subdir => prefix.StartsWith(subdir, System.StringComparison.OrdinalIgnoreCase) &&
+                              (prefix.Length == subdir.Length || prefix[subdir.Length] == '\\')));
+        }
+
        [Fact]
        public void Blocked_event_log_channels_match_code_constants()
        {
@@ -70,12 +70,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
            @"C:\Windows\System32\config",  // SAM, SECURITY, SYSTEM hives
        };

-        // Allowed subdirectories under a user profile (used with %LOGGED_ON_USER_PROFILE% token)
-        private static readonly string[] AllowedUserProfileSubdirs = new[]
-        {
-            @"AppData\Local",
-            @"AppData\Roaming",
-        };
+        // The allowed user-profile subdirectories and the vendor allowlist under them live in
+        // GatherRuleGuards, which owns the embedded guardrails.json — one copy for both guards.

        /// <summary>
        /// Returns true if the given path is allowed for diagnostics collection.
@@ -135,7 +131,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
                    (normalizedDir.Length == BlockedUsersPrefix.Length ||
                     normalizedDir[BlockedUsersPrefix.Length] == Path.DirectorySeparatorChar))
                {
-                    if (!IsUserProfileSubpathAllowed(normalizedDir, userProfilePath))
+                    if (!GatherRuleGuards.IsUserProfileSubpathAllowed(normalizedDir, userProfilePath))
                        return false;
                }

@@ -169,7 +165,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
                    }
                }

-                return false;
+                // Vendor folders under the signed-in user's profile — same allowlist the file
+                // collectors use, since it answers the same question: which folders below a
+                // profile carry enrollment-relevant logs rather than the user's own data.
+                return GatherRuleGuards.IsUserProfilePathOnAllowlist(normalizedDir, userProfilePath);
            }
            catch
            {
@@ -178,38 +177,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
            }
        }

-        /// <summary>
-        /// Returns true if the normalized path falls under one of the allowed subdirectories
-        /// of the detected user profile (AppData\Local, AppData\Roaming).
-        /// Only applies when %LOGGED_ON_USER_PROFILE% was used to resolve the path.
-        /// </summary>
-        internal static bool IsUserProfileSubpathAllowed(string normalizedPath, string userProfilePath)
-        {
-            if (string.IsNullOrEmpty(userProfilePath))
-                return false;
-
-            try
-            {
-                var normalizedProfile = Path.GetFullPath(userProfilePath);
-                foreach (var subdir in AllowedUserProfileSubdirs)
-                {
-                    var allowedPrefix = Path.GetFullPath(Path.Combine(normalizedProfile, subdir));
-                    if (normalizedPath.StartsWith(allowedPrefix, StringComparison.OrdinalIgnoreCase) &&
-                        (normalizedPath.Length == allowedPrefix.Length ||
-                         normalizedPath[allowedPrefix.Length] == Path.DirectorySeparatorChar))
-                    {
-                        return true;
-                    }
-                }
-            }
-            catch
-            {
-                // Path normalization failure — deny
-            }
-
-            return false;
-        }
-
        /// <summary>
        /// Checks whether any component of the path (directories or file) is a symlink,
        /// junction, or other reparse point. Returns true if a reparse point is detected.
@@ -32,6 +32,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
        // -----------------------------------------------------------------------
        public static readonly IReadOnlyList<string> AllowedRegistryPrefixes;
        public static readonly IReadOnlyList<string> AllowedFilePrefixes;
+
+        /// <summary>
+        /// Folders under the signed-in user's profile that file collectors and
+        /// admin-configured diagnostics paths may read, RELATIVE to the profile root
+        /// (e.g. <c>AppData\Local\Vendor</c>). Resolved against the path
+        /// %LOGGED_ON_USER_PROFILE% produced, at match time — the profile name is not
+        /// known when the list is authored, which is why these entries cannot live in
+        /// <see cref="AllowedFilePrefixes"/> (matched literally against the expanded path).
+        /// </summary>
+        public static readonly IReadOnlyList<string> AllowedUserProfileFilePrefixes;
        public static readonly IReadOnlyList<string> AllowedWmiQueryPrefixes;
        public static readonly IReadOnlyCollection<string> AllowedCommands;
        public static readonly IReadOnlyList<string> AllowedEventLogChannels;
@@ -63,8 +73,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
            Path.GetFullPath(@"C:\Windows\System32\config"),  // SAM, SECURITY, SYSTEM hives
        };

-        // Allowed subdirectories under a user profile (used with %LOGGED_ON_USER_PROFILE% token)
-        private static readonly string[] AllowedUserProfileSubdirs = new[]
+        // The only subdirectories of a user profile the C:\Users hard block will ever
+        // release (used with %LOGGED_ON_USER_PROFILE%). Single copy for both guards —
+        // DiagnosticsPathGuards delegates here.
+        internal static readonly string[] AllowedUserProfileSubdirs = new[]
        {
            @"AppData\Local",
            @"AppData\Roaming",
@@ -118,6 +130,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather

                    AllowedRegistryPrefixes = FlattenCategorized(obj, "registryPrefixes", "prefixes");
                    AllowedFilePrefixes = obj["filePrefixes"]?.ToObject<List<string>>() ?? new List<string>();
+                    AllowedUserProfileFilePrefixes = LoadUserProfilePrefixes(obj);
                    AllowedWmiQueryPrefixes = obj["wmiQueryPrefixes"]?.ToObject<List<string>>() ?? new List<string>();

                    var commands = FlattenCategorized(obj, "allowedCommands", "commands");
@@ -136,6 +149,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather

            AllowedRegistryPrefixes = new List<string>();
            AllowedFilePrefixes = new List<string>();
+            AllowedUserProfileFilePrefixes = new List<string>();
            AllowedWmiQueryPrefixes = new List<string>();
            AllowedCommands = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
            AllowedEventLogChannels = new List<string>();
@@ -143,6 +157,43 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
            ResidualWmiPrefixes = new List<string>();
        }

+        /// <summary>
+        /// Reads <c>userProfileFilePrefixes</c> and drops every entry that is rooted, carries a
+        /// traversal, or does not sit under one of <see cref="AllowedUserProfileSubdirs"/>.
+        /// The C:\Users hard block releases nothing outside AppData, so such an entry could only
+        /// ever be dead text — dropping it at load keeps the list honest instead of silently
+        /// ineffective, and no configuration can widen the hard block's exception.
+        /// </summary>
+        private static List<string> LoadUserProfilePrefixes(JObject obj)
+        {
+            var raw = obj["userProfileFilePrefixes"]?.ToObject<List<string>>() ?? new List<string>();
+            var result = new List<string>();
+
+            foreach (var entry in raw)
+            {
+                if (string.IsNullOrWhiteSpace(entry))
+                    continue;
+
+                var trimmed = entry.Trim().TrimEnd('\\');
+                if (Path.IsPathRooted(trimmed))
+                    continue;
+                if (trimmed.IndexOf("..", StringComparison.Ordinal) >= 0)
+                    continue;
+
+                foreach (var subdir in AllowedUserProfileSubdirs)
+                {
+                    if (trimmed.StartsWith(subdir, StringComparison.OrdinalIgnoreCase) &&
+                        (trimmed.Length == subdir.Length || trimmed[subdir.Length] == '\\'))
+                    {
+                        result.Add(trimmed);
+                        break;
+                    }
+                }
+            }
+
+            return result;
+        }
+
        private static void DeriveWmiClassAllowlist(
            IReadOnlyList<string> entries,
            out HashSet<string> classes,
@@ -265,12 +316,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather

            // C:\Users block always applies (even in unrestricted mode)
            // Exception: paths under <userProfilePath>\AppData\Local or AppData\Roaming
-            // are allowed when the %LOGGED_ON_USER_PROFILE% token was used.
+            // are allowed when the %LOGGED_ON_USER_PROFILE% token was used. The exception
+            // only LIFTS the block — in restricted mode the allowlist below still decides.
            if (normalizedPath.StartsWith(BlockedUsersPrefix, StringComparison.OrdinalIgnoreCase) &&
                (normalizedPath.Length == BlockedUsersPrefix.Length ||
                 normalizedPath[BlockedUsersPrefix.Length] == Path.DirectorySeparatorChar))
            {
-                if (!DiagnosticsPathGuards.IsUserProfileSubpathAllowed(normalizedPath, userProfilePath))
+                if (!IsUserProfileSubpathAllowed(normalizedPath, userProfilePath))
                    return false;
            }

@@ -288,9 +340,61 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
            if (unrestrictedMode)
                return true;

-            return AllowedFilePrefixes.Any(prefix =>
+            if (AllowedFilePrefixes.Any(prefix =>
                normalizedPath.StartsWith(prefix, StringComparison.OrdinalIgnoreCase) &&
-                (normalizedPath.Length == prefix.Length || normalizedPath[prefix.Length] == '\\'));
+                (normalizedPath.Length == prefix.Length || normalizedPath[prefix.Length] == '\\')))
+            {
+                return true;
+            }
+
+            // Vendor folders under the signed-in user's profile. Only reachable when the rule
+            // spelled %LOGGED_ON_USER_PROFILE% and the resolver found an interactive user —
+            // a null profile denies, so a machine with nobody signed in cannot widen anything.
+            return IsUserProfilePathOnAllowlist(normalizedPath, userProfilePath);
+        }
+
+        /// <summary>
+        /// True when the normalized path sits under one of <see cref="AllowedUserProfileSubdirs"/>
+        /// of the detected user profile. This is the C:\Users hard block's only exception; it
+        /// releases the block and nothing else. A null profile denies.
+        /// </summary>
+        internal static bool IsUserProfileSubpathAllowed(string normalizedPath, string userProfilePath)
+            => AllowedUserProfileSubdirs.Any(subdir =>
+                   MatchesProfileRelativePrefix(normalizedPath, userProfilePath, subdir));
+
+        /// <summary>
+        /// True when the normalized path is admitted by an entry of
+        /// <see cref="AllowedUserProfileFilePrefixes"/> under the detected user profile.
+        /// </summary>
+        internal static bool IsUserProfilePathOnAllowlist(string normalizedPath, string userProfilePath)
+            => AllowedUserProfileFilePrefixes.Any(prefix =>
+                   MatchesProfileRelativePrefix(normalizedPath, userProfilePath, prefix));
+
+        /// <summary>
+        /// Segment-bounded match of <paramref name="normalizedPath"/> against
+        /// &lt;profile&gt;\&lt;relativePrefix&gt;. Both sides go through Path.GetFullPath, so a
+        /// traversal spelled into either one cannot slip past the boundary check.
+        /// </summary>
+        private static bool MatchesProfileRelativePrefix(
+            string normalizedPath, string userProfilePath, string relativePrefix)
+        {
+            if (string.IsNullOrEmpty(normalizedPath) || string.IsNullOrEmpty(userProfilePath))
+                return false;
+
+            try
+            {
+                var allowedPrefix = Path.GetFullPath(
+                    Path.Combine(Path.GetFullPath(userProfilePath), relativePrefix));
+
+                return normalizedPath.StartsWith(allowedPrefix, StringComparison.OrdinalIgnoreCase) &&
+                       (normalizedPath.Length == allowedPrefix.Length ||
+                        normalizedPath[allowedPrefix.Length] == Path.DirectorySeparatorChar);
+            }
+            catch
+            {
+                // Path normalization failure — deny.
+                return false;
+            }
        }

        /// <summary>
@@ -113,6 +113,58 @@ describe('gather guardrails (agent matching semantics)', () => {
    expect(errors(validateRuleDraft(bad).findings).some((m) => m.includes('hard-blocked'))).toBe(true);
  });

+  // %LOGGED_ON_USER_PROFILE% releases the C:\Users hard block for AppData\Local and
+  // AppData\Roaming — and only releases it. The allowlist still decides, which is what
+  // the agent does (GatherRuleGuards.IsFilePathAllowed) and what the portal shows.
+  it('accepts a userProfileFilePrefixes folder below %LOGGED_ON_USER_PROFILE%', () => {
+    const ok = validGather();
+    ok.collectorType = 'logparser';
+    ok.target = '%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\RealmJoin\\tray*.log';
+    ok.parameters = { pattern: '(?<msg>SSO)', format: 'text' };
+    expect(errors(validateRuleDraft(ok).findings).some((m) => m.includes('guardrails'))).toBe(false);
+  });
+
+  it('rejects an unlisted vendor folder below %LOGGED_ON_USER_PROFILE%\\AppData', () => {
+    const bad = validGather();
+    bad.collectorType = 'file';
+    bad.target = '%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\SomeApp\\data.json';
+    expect(errors(validateRuleDraft(bad).findings).some((m) => m.includes('not under any allowed file prefix'))).toBe(true);
+  });
+
+  it('rejects %LOGGED_ON_USER_PROFILE% outside AppData as hard-blocked', () => {
+    const bad = validGather();
+    bad.collectorType = 'file';
+    bad.target = '%LOGGED_ON_USER_PROFILE%\\Documents\\secret.txt';
+    expect(errors(validateRuleDraft(bad).findings).some((m) => m.includes('hard-blocked'))).toBe(true);
+  });
+
+  it('rejects a sibling of a userProfileFilePrefixes folder (segment boundary)', () => {
+    const bad = validGather();
+    bad.collectorType = 'file';
+    bad.target = '%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\RealmJoinEvil\\tray.log';
+    expect(validateRuleDraft(bad).valid).toBe(false);
+  });
+
+  // The agent expands environment variables before guarding, so a target spelled with
+  // %ProgramData% must not be reported as blocked — there are live rules doing this.
+  it('accepts an allow-listed path spelled with %ProgramData%', () => {
+    const ok = validGather();
+    ok.collectorType = 'logparser';
+    ok.target = '%ProgramData%\\Microsoft\\IntuneManagementExtension\\Logs\\HPReports\\HP Image Assistant.log';
+    ok.parameters = { pattern: '(?<msg>x)', format: 'text' };
+    expect(errors(validateRuleDraft(ok).findings).some((m) => m.includes('guardrails'))).toBe(false);
+  });
+
+  // diagnosticsPathPrefixes governs admin-configured diagnostics paths, not collectors:
+  // the agent guards logparser against filePrefixes alone.
+  it('rejects a logparser target that only diagnosticsPathPrefixes would allow', () => {
+    const bad = validGather();
+    bad.collectorType = 'logparser';
+    bad.target = 'C:\\Install\\Log\\setup.log';
+    bad.parameters = { pattern: '(?<msg>x)', format: 'text' };
+    expect(errors(validateRuleDraft(bad).findings).some((m) => m.includes('not under any allowed file prefix'))).toBe(true);
+  });
+
  it('rejects the registry-hive store path (System32\\config) as hard-blocked', () => {
    const bad = validGather();
    bad.collectorType = 'file';
@@ -870,7 +870,11 @@ export const RULE_GUARDRAILS = {
    "C:\\Windows\\Panther",
    "C:\\Windows\\SetupDiag",
    "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
-    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log"
+    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
+    "C:\\ProgramData\\RealmJoin\\choco\\logs"
+  ],
+  "userProfileFilePrefixes": [
+    "AppData\\Local\\RealmJoin"
  ],
  "wmiQueryPrefixes": [
    "SELECT * FROM Win32_OperatingSystem",
@@ -103,6 +103,52 @@ function pathPrefixAllowed(target: string, prefixes: readonly string[]): boolean
  });
 }

+// The agent expands environment variables and the custom %LOGGED_ON_USER_PROFILE% token
+// BEFORE it guards a path (FileCollector/LogParserCollector -> UserProfileResolver ->
+// GatherRuleGuards). Judging the raw spelling instead reported targets as blocked that the
+// device happily reads (%ProgramData%\...) and made token targets unjudgeable altogether.
+// The profile name is unknown here, so the token resolves to a placeholder profile — the
+// same device-independent stand-in the portal validator uses.
+const COMMON_ENV_VARS: Record<string, string> = {
+  '%ProgramData%': 'C:\\ProgramData',
+  '%SystemRoot%': 'C:\\Windows',
+  '%windir%': 'C:\\Windows',
+  '%SystemDrive%': 'C:',
+};
+const USER_PROFILE_TOKEN = '%LOGGED_ON_USER_PROFILE%';
+const USER_PROFILE_PLACEHOLDER = 'C:\\Users\\__AGENT_RESOLVED__';
+
+/** The only profile subdirectories the C:\Users hard block ever releases. */
+const ALLOWED_USER_PROFILE_SUBDIRS: readonly string[] = ['AppData\\Local', 'AppData\\Roaming'];
+
+/** Vendor folders below the profile, relative to its root (GatherRuleGuards.AllowedUserProfileFilePrefixes). */
+const USER_PROFILE_FILE_PREFIXES: readonly string[] = RULE_GUARDRAILS.userProfileFilePrefixes ?? [];
+
+function escapeRegExp(literal: string): string {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function expandPathTokens(target: string): string {
+  let result = target.replace(
+    new RegExp(escapeRegExp(USER_PROFILE_TOKEN), 'gi'), USER_PROFILE_PLACEHOLDER);
+  for (const [envVar, replacement] of Object.entries(COMMON_ENV_VARS)) {
+    result = result.replace(new RegExp(escapeRegExp(envVar), 'gi'), replacement);
+  }
+  return result;
+}
+
+/** True when the expanded path sits in the part of the profile the hard block releases. */
+function isUnderUserProfileException(expanded: string): boolean {
+  return ALLOWED_USER_PROFILE_SUBDIRS.some(
+    (subdir) => pathPrefixAllowed(expanded, [`${USER_PROFILE_PLACEHOLDER}\\${subdir}`]));
+}
+
+/** True when a userProfileFilePrefixes entry admits the expanded path. */
+function userProfilePrefixAllowed(expanded: string): boolean {
+  return USER_PROFILE_FILE_PREFIXES.some(
+    (prefix) => pathPrefixAllowed(expanded, [`${USER_PROFILE_PLACEHOLDER}\\${prefix}`]));
+}
+
 function stripRegistryHive(target: string): string {
  return target.replace(/^(HKLM|HKEY_LOCAL_MACHINE|HKCU|HKEY_CURRENT_USER)\\/i, '');
 }
@@ -127,19 +173,28 @@ function checkGatherTarget(collectorType: string, target: string): ValidationFin
    case 'json':
    case 'xml':
    case 'logparser': {
-      const blocked = HARD_BLOCKED_PATH_PREFIXES.find((p) => pathPrefixAllowed(target, [p]));
-      if (blocked) {
+      const expanded = expandPathTokens(target);
+
+      // C:\Users is hard-blocked; %LOGGED_ON_USER_PROFILE% releases it for AppData\Local
+      // and AppData\Roaming and nothing else. The release is not an allowance — the
+      // allowlist below still decides, exactly as GatherRuleGuards.IsFilePathAllowed does.
+      const blocked = HARD_BLOCKED_PATH_PREFIXES.find((p) => pathPrefixAllowed(expanded, [p]));
+      if (blocked && !isUnderUserProfileException(expanded)) {
        findings.push({ level: 'error', message: `guardrails: "${target}" is under the hard-blocked path ${blocked} — the agent always refuses this, it cannot be allow-listed.` });
        break;
      }
-      const allowed = collectorType === 'logparser'
-        ? [...RULE_GUARDRAILS.filePrefixes, ...RULE_GUARDRAILS.diagnosticsPathPrefixes]
-        : [...RULE_GUARDRAILS.filePrefixes];
-      // logparser targets may carry a glob suffix (*.log) — prefix matching still applies.
-      if (!pathPrefixAllowed(target, allowed) && !allowed.some((p) => target.toLowerCase().startsWith(p.toLowerCase() + '\\'))) {
+      // The agent guards EVERY file collector — logparser included — against
+      // filePrefixes alone (GatherRuleGuards.IsFilePathAllowed). diagnosticsPathPrefixes
+      // governs admin-configured diagnostics paths, a different surface the collectors
+      // never consult; offering it here reported logparser targets as allowed that the
+      // agent refuses on the device (C:\Install\Log, winevt\Logs, WER, ProgramData\AutopilotMonitor).
+      // logparser targets may carry a glob suffix (*.log) — segment-bounded prefix
+      // matching covers that, the glob sits in the last segment.
+      if (!pathPrefixAllowed(expanded, RULE_GUARDRAILS.filePrefixes) &&
+          !userProfilePrefixAllowed(expanded)) {
        findings.push({
          level: 'error',
-          message: `guardrails: ${collectorType} target "${target}" is not under any allowed file prefix (rule_guardrails → filePrefixes${collectorType === 'logparser' ? ' / diagnosticsPathPrefixes' : ''}).`,
+          message: `guardrails: ${collectorType} target "${target}" is not under any allowed file prefix (rule_guardrails → filePrefixes, or userProfileFilePrefixes below %LOGGED_ON_USER_PROFILE%).`,
        });
      }
      break;
@@ -111,7 +111,7 @@ export default function AboutPage() {
            data — into a central dashboard with intelligent analysis built in.
          </p>
          <p className="text-gray-700 leading-relaxed">
-            Deployed by assigning a bootstrapper script in Intune, the platform requires no infrastructure
+            Deployed by assigning a signed loader script in Intune, the platform requires no infrastructure
            changes and no additional certificates on end user devices. It runs entirely on
            <strong> Azure</strong>, authenticates via <strong>Microsoft Entra ID</strong>, and provides
            multi-tenant support with strict per-tenant data isolation.
@@ -239,7 +239,7 @@ export default function AboutPage() {
                items: [
                  ".NET binary — lightweight, low-overhead monitoring",
                  "Runs via scheduled task (no Windows service — easy, residue-free removal)",
-                  "Deployed via an Intune platform script (PowerShell bootstrapper); for Autopilot Device Preparation additionally as a thin MSI line-of-business app",
+                  "Deployed via a signed Intune platform script (PowerShell loader); for Autopilot Device Preparation additionally as a thin MSI line-of-business app",
                  "Mutual TLS using the existing Intune MDM device certificate",
                  "Self-destruct on enrollment completion (on by default — removes task and files)",
                ],
@@ -208,7 +208,7 @@ export default function PrivacyPage() {
            <li><strong>Encryption</strong> — HTTPS with a TLS 1.2 floor in transit, Azure Storage encryption at rest with platform-managed keys</li>
            <li><strong>Managed identity instead of storage keys</strong>, and secret-less OIDC deployment pipelines</li>
            <li><strong>Rate limiting</strong> per device, per portal user, and per MCP user</li>
-            <li><strong>Verifiable agent binaries</strong> — Sigstore build attestation plus a four-stage integrity chain through download, backend cross-check, and runtime self-verification</li>
+            <li><strong>Verifiable agent binaries</strong> — Authenticode-signed scripts and binaries whose publisher is verified on the device before anything runs, Sigstore build attestation, and SHA-256 verification at download, through an independent backend cross-check, and at runtime</li>
            <li><strong>Manifest-first deletion</strong> — what will be deleted is captured, restorably, before anything is removed</li>
          </ul>

@@ -6,6 +6,7 @@ import { usePathname } from "next/navigation";
 import { ModalPortal } from "./ModalPortal";
 import { useAuth } from "@/contexts/AuthContext";
 import { useWhatsNew } from "@/hooks/useWhatsNew";
+import { useLatestVersions } from "@/lib/useLatestVersions";
 import { closeWhatsNew } from "@/lib/whatsNewStore";
 import { formatInlineMarkdown } from "@/lib/formatInlineMarkdown";
 import { isPublicPath } from "@/lib/hostRouting";
@@ -107,6 +108,24 @@ function EntryRow({ entry, isNew }: { entry: WhatsNewEntry; isNew: boolean }) {
  );
 }

+/**
+ * The currently published agent version, quiet under the header line. Rendered only for
+ * signed-in portal users (the endpoint is AuthenticatedUser, and the public site has no
+ * session list to compare against), so the mount itself is the fetch gate. Same plain,
+ * monospaced string as the "Agent Version" column of the session list — that match is the
+ * whole point: the reader sees at a glance whether their fleet runs the latest agent.
+ */
+function LatestAgentVersionLine() {
+  const { getAccessToken } = useAuth();
+  const { latestAgentVersion } = useLatestVersions(getAccessToken);
+  if (!latestAgentVersion) return null;
+  return (
+    <p className="mt-1 text-xs text-[var(--lp-ink-faint)]">
+      Latest agent version <span className="font-mono">{latestAgentVersion}</span>
+    </p>
+  );
+}
+
 function SkeletonRows() {
  return (
    <ul className="animate-pulse" aria-hidden="true">
@@ -140,10 +159,12 @@ export function WhatsNewPanel({ rootClassName }: { rootClassName?: string }) {
  const [seenAtOpen] = useState<WhatsNewSeen>(() => wn.seen);
  const [openedAt] = useState(() => new Date());

-  // Only whoever can actually flip the channel toggle gets the "subscribe" link, and only on
-  // the portal — /settings/tenant/… does not exist on the public host.
+  // The portal shows things the public site cannot: /settings/tenant/… does not exist there,
+  // and the latest-agent line needs a signed-in caller plus a session list to compare against.
+  const onPortal = !isPublicPath(pathname);
+  // Only whoever can actually flip the channel toggle gets the "subscribe" link.
  const canConfigureNotifications =
-    wn.tracksUnseen && (user?.isTenantAdmin === true || user?.isGlobalAdmin === true) && !isPublicPath(pathname);
+    wn.tracksUnseen && (user?.isTenantAdmin === true || user?.isGlobalAdmin === true) && onPortal;

  const channel = wn.panelChannel;
  const entries = wn.entries(channel);
@@ -196,6 +217,7 @@ export function WhatsNewPanel({ rootClassName }: { rootClassName?: string }) {
              <div className="min-w-0 flex-1">
                <h2 id="whats-new-title" className="text-lg font-bold leading-tight text-[var(--lp-ink)]">What&apos;s new</h2>
                <p className="mt-0.5 text-sm text-[var(--lp-ink-soft)]">News and improvements from Autopilot Monitor.</p>
+                {onPortal && wn.tracksUnseen && <LatestAgentVersionLine />}
              </div>
              <button
                ref={closeRef}
@@ -143,12 +143,32 @@ describe("validateFileTarget", () => {
    expect(r.allowed).toBe(false);
  });

-  it("allows %LOGGED_ON_USER_PROFILE% with AppData\\Local in file target", () => {
+  // The token lifts the C:\Users hard block for AppData — it does not admit the path.
+  // An unlisted vendor folder therefore falls through to the allowlist and is refused,
+  // exactly as GatherRuleGuards.IsFilePathAllowed does on the device.
+  it("blocks an unlisted vendor folder under %LOGGED_ON_USER_PROFILE%\\AppData\\Local", () => {
    const r = validateFileTarget(
      "%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\SomeApp\\data.json",
      false,
    );
+    expect(r.allowed).toBe(false);
+  });
+
+  it("allows a userProfileFilePrefixes folder under %LOGGED_ON_USER_PROFILE%", () => {
+    const r = validateFileTarget(
+      "%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\RealmJoin\\tray.log",
+      false,
+    );
    expect(r.allowed).toBe(true);
+    expect(r.reason).toContain("%LOGGED_ON_USER_PROFILE%");
+  });
+
+  it("blocks a sibling of a userProfileFilePrefixes folder (segment-bounded)", () => {
+    const r = validateFileTarget(
+      "%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\RealmJoinSomethingElse\\tray.log",
+      false,
+    );
+    expect(r.allowed).toBe(false);
  });

  it("blocks %LOGGED_ON_USER_PROFILE% with Desktop in file target", () => {
@@ -348,12 +368,14 @@ describe("validateDiagnosticsPath", () => {
    expect(r.reason).toContain("%LOGGED_ON_USER_PROFILE%");
  });

-  it("allows %LOGGED_ON_USER_PROFILE% with AppData\\Roaming subpath", () => {
+  it("blocks an unlisted vendor folder under %LOGGED_ON_USER_PROFILE%\\AppData\\Roaming", () => {
+    // AppData\Roaming is inside the hard block's exception, but the folder is not on
+    // userProfileFilePrefixes — the allowlist still has the last word.
    const r = validateDiagnosticsPath(
      "%LOGGED_ON_USER_PROFILE%\\AppData\\Roaming\\SomeApp\\logs\\*.log",
      false,
    );
-    expect(r.allowed).toBe(true);
+    expect(r.allowed).toBe(false);
  });

  it("blocks %LOGGED_ON_USER_PROFILE% with non-AppData subpath", () => {
@@ -9,6 +9,7 @@
 import {
  ALLOWED_REGISTRY_PREFIXES,
  ALLOWED_FILE_PREFIXES,
+  USER_PROFILE_FILE_PREFIXES,
  ALLOWED_WMI_QUERY_PREFIXES,
  ALLOWED_COMMANDS_LIST,
  ALLOWED_DIAGNOSTICS_PATH_PREFIXES,
@@ -198,6 +199,18 @@ function isUserProfileSubpathAllowed(normalizedDir: string): boolean {
  return false;
 }

+/**
+ * Returns the userProfileFilePrefixes entry admitting the path, if any.
+ * Mirrors GatherRuleGuards.IsUserProfilePathOnAllowlist: the entries are relative to
+ * the profile root, so they are matched against the placeholder profile the token
+ * expanded to.
+ */
+function findUserProfilePrefix(normalizedDir: string): string | undefined {
+  return USER_PROFILE_FILE_PREFIXES.find((prefix) =>
+    matchesPrefix(normalizedDir, `${USER_PROFILE_PLACEHOLDER}\\${prefix}`, "\\")
+  );
+}
+
 // ---------------------------------------------------------------------------
 // Validation functions
 // ---------------------------------------------------------------------------
@@ -265,11 +278,14 @@ export function validateFileTarget(
    normalizedDir = normalizePath(expanded);
  }

-  // Hard block: C:\Users always blocked — except allowed subdirs via %LOGGED_ON_USER_PROFILE% token
-  if (matchesPrefix(normalizedDir, BLOCKED_USERS_PREFIX, "\\")) {
-    if (isUserProfileSubpathAllowed(normalizedDir)) {
-      return { allowed: true, reason: "Allowed via %LOGGED_ON_USER_PROFILE% (AppData only)", unrestricted: false };
-    }
+  // Hard block: C:\Users always blocked. The %LOGGED_ON_USER_PROFILE% token LIFTS it for
+  // AppData\Local and AppData\Roaming — it does not admit the path: the allowlist below
+  // still has to match, exactly as GatherRuleGuards.IsFilePathAllowed does. Returning
+  // "allowed" here would show a target as green that the agent refuses on the device.
+  if (
+    matchesPrefix(normalizedDir, BLOCKED_USERS_PREFIX, "\\") &&
+    !isUserProfileSubpathAllowed(normalizedDir)
+  ) {
    return { allowed: false, reason: "C:\\Users is always blocked (privacy protection)", unrestricted: false };
  }

@@ -289,6 +305,15 @@ export function validateFileTarget(
    }
  }

+  const userProfilePrefix = findUserProfilePrefix(normalizedDir);
+  if (userProfilePrefix) {
+    return {
+      allowed: true,
+      reason: `Matches: %LOGGED_ON_USER_PROFILE%\\${userProfilePrefix}`,
+      unrestricted: false,
+    };
+  }
+
  return {
    allowed: false,
    reason: "Not under any allowed file path prefix",
@@ -415,11 +440,14 @@ export function validateDiagnosticsPath(
    normalizedDir = normalizePath(expanded);
  }

-  // Hard block: C:\Users always blocked — except allowed subdirs via %LOGGED_ON_USER_PROFILE% token
-  if (matchesPrefix(normalizedDir, BLOCKED_USERS_PREFIX, "\\")) {
-    if (isUserProfileSubpathAllowed(normalizedDir)) {
-      return { allowed: true, reason: "Allowed via %LOGGED_ON_USER_PROFILE% (AppData only)", unrestricted: false };
-    }
+  // Hard block: C:\Users always blocked. As in validateFileTarget, the
+  // %LOGGED_ON_USER_PROFILE% token only lifts the block for AppData\Local and
+  // AppData\Roaming — DiagnosticsPathGuards.IsDiagnosticsPathAllowed then still
+  // requires an allowlist match below.
+  if (
+    matchesPrefix(normalizedDir, BLOCKED_USERS_PREFIX, "\\") &&
+    !isUserProfileSubpathAllowed(normalizedDir)
+  ) {
    return { allowed: false, reason: "C:\\Users is always blocked (privacy protection)", unrestricted: false };
  }

@@ -439,6 +467,15 @@ export function validateDiagnosticsPath(
    }
  }

+  const userProfilePrefix = findUserProfilePrefix(normalizedDir);
+  if (userProfilePrefix) {
+    return {
+      allowed: true,
+      reason: `Matches: %LOGGED_ON_USER_PROFILE%\\${userProfilePrefix}`,
+      unrestricted: false,
+    };
+  }
+
  return {
    allowed: false,
    reason: "Not under any allowed diagnostics path prefix",
@@ -263,6 +263,15 @@ export const ALLOWED_FILE_PREFIXES: readonly string[] = [
  "C:\\Windows\\SetupDiag",
  "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
  "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
+  "C:\\ProgramData\\RealmJoin\\choco\\logs",
+];
+
+// Folders under the signed-in user's profile, RELATIVE to the profile root. The agent
+// resolves %LOGGED_ON_USER_PROFILE% at runtime; the portal validates against a placeholder
+// profile. These cannot live in ALLOWED_FILE_PREFIXES — that list is matched literally
+// against the already-expanded path, where the user name is unknown at authoring time.
+export const USER_PROFILE_FILE_PREFIXES: readonly string[] = [
+  "AppData\\Local\\RealmJoin",
 ];

 export const ALLOWED_WMI_QUERY_PREFIXES: readonly string[] = [
Author	SHA1	Message	Date
Oliver Kieselbach	f1457d823d	chore: bump .claude/commands gitlink	2026-09-09 12:02:05 +02:00
Oliver Kieselbach	12e66299e6	feat(rules): allow-list folders under the signed-in user's profile (D-228, D-229) Gather rules and admin-configured diagnostics paths could never reach a folder below a user profile. The %LOGGED_ON_USER_PROFILE% token lifts the C:\Users hard block for AppData\Local and AppData\Roaming, but lifting is not admitting: the path then fell into filePrefixes, which is matched literally against the already-expanded path, and the profile name is not known when that list is authored. The exception only ever worked in unrestricted mode, and no agent test passed a non-null userProfilePath. D-228 introduces userProfileFilePrefixes, holding entries relative to the profile root (AppData\Local\RealmJoin). Both guards resolve them against the detected profile and match segment-bounded; entries that are rooted, contain "..", or sit outside AppData\Local / AppData\Roaming are dropped at load, so configuration can only narrow the hard block's exception, never widen it. The allowlist is anchored to the detected profile, so a rule cannot reach another user's AppData. The AppData subdirectory list existed in both guard classes with the GatherRuleGuards copy unused; it is now one list and DiagnosticsPathGuards delegates. filePrefixes additionally gains C:\ProgramData\RealmJoin\choco\logs. D-229 fixes the pre-flight validators, which must only ever reject what the agent rejects: - the portal returned "allowed" on the lifted hard block without consulting the allowlist, so a rule the agent refuses passed the enable gate and then failed silently on the device with a security_warning; - the MCP validator offered logparser the diagnosticsPathPrefixes list that no collector consults (four paths reported allowed that the agent blocks); - the MCP validator did not expand environment variables at all, reporting %ProgramData% targets as blocked although the device reads them. Measured before changing the portal: no rule in any tenant used the token, so nothing that was working gets disabled. Verified: solution build 0 warnings, agent 2897 tests, web 1257 + tsc + eslint 0, MCP 779, guardrails.json validates against its schema, rules/dist regenerates without drift. The six new agent tests were green against the unchanged guard first, which is what proves the exception was inert. Takes effect on devices only after an agent release: guardrails.json is an EmbeddedResource in the agent assembly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 11:54:36 +02:00
Oliver Kieselbach	e9a01de9da	chore: bump .claude/commands gitlink Event reference in /ux-insights completed and live-verified. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 10:06:20 +02:00
Oliver Kieselbach	5f793ea01a	chore: bump .claude/commands gitlink Marker-catalog rows for the What's new panel events and the digest timer. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 09:58:50 +02:00
Oliver Kieselbach	e86f7efed3	feat(bootstrap): verify the publisher of the extracted agent binaries before --install (D-227) The SHA-256 check proves the ZIP is the one version.json names, but that manifest lives in the same container as the ZIP: it cannot outlive a compromise of the download host. The expected publisher travels inside this script, which the loader verified before running it, so the chain from the file an administrator assigns to the process that starts is publisher-anchored end to end. Install-AutopilotMonitor.ps1 v2.4 -> v2.5: - Get-UnverifiedAgentBinaries checks every AutopilotMonitor.*.exe/.dll in the extracted payload for status Valid and the same subject pin the loader carries; the gate runs immediately before --install and throws on any rejection, exactly like the hash check. - Third-party assemblies keep their own publisher's signature and are not checked: System.Management.Automation.dll ships unsigned, so a gate over all files would refuse the live payload. - An extracted folder with no binary of ours is a rejection, not a pass. - The SHA-256 manifest check is unchanged and still runs first: it proves the bytes, the signature proves the author. Verified against the live payload 2.0.1454 (all five of our PEs Valid and glueckkanja AG, gate passes); appending one byte to AutopilotMonitor.Shared.dll makes it reject. Pester 55/55. The portal privacy and about pages carried the pre-signing wording and are corrected in the same change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-08 23:11:16 +02:00
Oliver Kieselbach	78bfad0ec6	web: the portal What's new panel names the currently published agent version A quiet third line in the panel header ("Latest agent version 2.0.1452", faint, the number monospaced) reads from the existing config/latest-versions endpoint. The monospaced string is the same one the session list shows in its "Agent Version" column, so a reader can tell at a glance whether their fleet runs the latest agent. Portal and signed-in only: the endpoint is AuthenticatedUser, and the public site has no session list to compare against. The gate sits on the mount of the small component, so the landing page never even issues the request; a missing version renders nothing.	2026-09-08 22:37:29 +02:00
Oliver Kieselbach	f5efadfd07	ci: pin every third-party action to a commit SHA, gated and Dependabot-maintained (D-226) A tag is a mutable pointer owned by the action's publisher. These jobs are not ordinary CI: they hold the code-signing Key Vault token (D-223), the federated storage credentials (D-222), and combine-rules.yml holds a contents:write token that pushes to main. Whoever could repoint v7 would run code with all of that. azure/login and Azure/functions-action were already pinned; the actions/* and github/codeql-action references were not, on the usual argument that GitHub owns them and shares the runner's trust boundary. That argument does not survive the fact that they run in the same jobs as the signing identity. All seven are now pinned by SHA with the version in a trailing comment -- the comment is what keeps the line reviewable, and Dependabot rewrites both together. action-pins.yml is the guard: pins nobody enforces rot, and no review reliably catches one @v4 added to a 200-line workflow. It lives in its own workflow because ci.yml deliberately ignores changes to the other workflow files, so a job placed there would stay silent for exactly the commits it must inspect. Like CI it reports rather than blocks -- main is unprotected; making it binding would mean adding it as a required status check, which is a branch-protection decision. Verified both directions: 49 references pass against the repo, and a fixture with @v7, @main and a bare SHA fails with three annotations while the local reusable workflow refs are skipped. Two floating tool versions closed while here. wix went from the range 5.* to 5.0.2 -- it writes the bytes of the MSI customers install, where AzureSignTool only signs them. ajv was the worse one: unpinned, and npm runs lifecycle scripts at install, so a hijacked release would have executed with the push token before a single rule was validated; now exact versions with --ignore-scripts. Line endings: sed -i rewrote the workflow files as LF. Git normalises on commit, so the content diff is unaffected and indexnow-notify.yml carries no change at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-08 22:14:15 +02:00