gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-26 05:29:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 2852418413 fix(web): progress portal Cloud PC hint becomes a native input tooltip Oliver Kieselbach 2026-08-30 11:37:52 +02:00
  • 268d8652f1 fix(web): progress portal serial input no longer hides its Cloud PC hint Oliver Kieselbach 2026-08-30 11:29:41 +02:00
  • 66f5543fb7 fix(security): ConsoleBypassWatcher mirrors cmd.exe first-switch-wins parsing — only a leading /c classifies as scripted; a /c inside a /k payload (cmd /k rem /c, cmd /k "title /c") no longer silences a persistent interactive console, which is surfaced as interactive_console_with_command (low) v2.0.1439 Oliver Kieselbach 2026-08-30 02:05:55 +02:00
  • 21d200a1e4 fix(security): config PUT derives its preserved system-owned fields from the PATCH deny-list (BaseDeniedFields) so ProDowngradedUtc/OnboardedAt can no longer be written by a tenant admin — a client-supplied ProDowngradedUtc refreshed the retention-downgrade grace anchor indefinitely, keeping the Pro retention cap on a Community tenant Oliver Kieselbach 2026-08-30 02:01:32 +02:00
  • 8c0cb2c423 fix(security): RemoveGlobalAdmin, RemoveTenantAdmin, DisableTenantAdmin and sub-Admin UpdateMemberPermissions now call DisconnectUserAsync(upn) so a revoked/demoted user loses already-joined global-admins / tenant-{tid} / notify / session SignalR streams instead of keeping them until the socket drops (group authz is join-time only) Oliver Kieselbach 2026-08-30 01:59:51 +02:00
  • 84d06e1cf6 fix(security): LocalAdminAnalyzer never exempts a logged-in local SAM account from the shutdown scan (CWE-807) and matches built-ins by well-known RID so localized Guest/Administrator are not flagged v2.0.1438 Oliver Kieselbach 2026-08-30 01:42:51 +02:00
  • 88dfd331dd fix(security): LocalAdminAnalyzer inventories disabled accounts and reads Administrators-group membership from the SAM (NetLocalGroupGetMembers on S-1-5-32-544); a dormant /active:no admin backdoor now surfaces as unexpected_admin_members (+40, Error), built-in Administrator enabled-state reported for evidence v2.0.1437 Oliver Kieselbach 2026-08-30 01:00:29 +02:00
  • d294415d29 fix(security): CmTraceLogParser parses in linear time (first open / last parseable trailer, timeout-backed trailer regex) instead of a greedy .* regex that backtracked quadratically on hostile lines without a timeout; agent multiline buffer gains a 1 MB char cap next to the 100-line cap, both logged at Warning, and the tail of a dropped entry is skipped instead of raw-matched v2.0.1436 Oliver Kieselbach 2026-08-30 00:48:29 +02:00
  • 76af1234ed fix(security): BlockedDevices rows are keyed by the canonicalized serial (trim + upper-invariant) so case-variant serials from a rogue agent or an admin's inventory copy still hit the block/kill row; legacy verbatim-case rows are dual-read and lazily re-keyed Oliver Kieselbach 2026-08-30 00:27:07 +02:00
  • 0515523e49 fix(security): guardrails.json values are emitted into generated TS through a complete encoder (JSON.stringify + U+2028/29) and rejected up-front if they contain control or line-terminator characters; new guardrails schema validated in combine-rules before any bot commit Oliver Kieselbach 2026-08-30 00:19:52 +02:00
  • a47e94f9a5 fix(security): diagnostics packager reads every file through a handle validated against its pinned source folder; a subdirectory swapped for a junction between enumeration and open is skipped instead of copied v2.0.1435 Oliver Kieselbach 2026-08-30 00:06:50 +02:00
  • ecfa59d049 fix(security): PUT preview/notification-email requires a member role once the tenant has members; roleless writes only in the signup window Oliver Kieselbach 2026-08-29 23:57:35 +02:00
  • 6c50a54249 fix(security): escape tenantId in metrics-summary and device-snapshot OData filters; GUID-gate tenantId query param on global metrics/search routes Oliver Kieselbach 2026-08-29 23:55:15 +02:00
  • 6e3487756a fix(security): gather-rule on_event feedback loop — timeline feed carries the event source and never dispatches on_event for gather-emitted events; per-rule on_event cap (100/session); backend rejects rules triggering on their own output type / gather_result Oliver Kieselbach 2026-08-29 23:54:44 +02:00
  • dbb154bae9 fix(security): percent-encode every path-position id in lib/api.ts; session pages gate URL-derived id on GUID before any fetch Oliver Kieselbach 2026-08-29 23:45:34 +02:00
  • c41c2327ab fix(security): validate enrollment summary branding image URL (https-only, no quotes); launcher drops unsafe URLs instead of interpolating them into the dialog command line v2.0.1434 Oliver Kieselbach 2026-08-29 23:15:07 +02:00
  • 83effea592 fix(security): hosted diagnostics upload SAS is create-only and bound to the requesting session; existing blob => 409 Oliver Kieselbach 2026-08-29 23:13:00 +02:00
  • 1a4a37b77a fix(web): hardware whitelist editor splits typed comma lists into entries ("Dell*, *" stays allow-all); only insights buttons neutralize ',' Oliver Kieselbach 2026-08-29 22:56:37 +02:00
  • f56851fc9f fix(security): hardware whitelist — one added entry is always one pattern; server rejects malformed CSV Oliver Kieselbach 2026-08-29 22:51:55 +02:00
  • cbe410cbbc fix(security): reject path-shaped sessionId/tenantId in session-report blob names; BlobNameGuard at every GetBlobClient sink Oliver Kieselbach 2026-08-29 22:51:13 +02:00
  • 43ddc60111 fix(security): enforce tenant suspension in PolicyEnforcementMiddleware, not only auth/me Oliver Kieselbach 2026-08-29 22:34:29 +02:00
  • 82b26b4ab9 fix(security): HTML-encode domain in transactional mails; freeze DomainName on config PUT, validate first-login seed Oliver Kieselbach 2026-08-29 22:33:52 +02:00
  • 1733f4fd48 fix(agent): SignalIngress worker re-entrancy — never block the single consumer on its own post v2.0.1433 Oliver Kieselbach 2026-08-29 22:11:25 +02:00
  • fc46b4c78e feat(security): session-owner binding stage 1 (shadow) + dormant agent session rotation v2.0.1432 Oliver Kieselbach 2026-08-29 21:32:24 +02:00
  • c18de5d76c fix(security): drop client-writable certificate header; bootstrap routes token-only, fail-closed Oliver Kieselbach 2026-08-29 20:04:04 +02:00
  • 250cc667dd fix(web): show full UPN in admin feedback list instead of a 200px truncation Oliver Kieselbach 2026-08-29 19:58:08 +02:00
  • d3261fb890 feat(ops): ops events for Collect Logs usage and diagnostics-upload enablement v2.0.1431 Oliver Kieselbach 2026-08-29 19:30:20 +02:00
  • b3bbcf1300 fix(agent): rotate_config applies the fetched config; diagnostics skip gates report their reason Oliver Kieselbach 2026-08-29 19:30:00 +02:00
  • a306cd9e40 feat(security): resolve admin identity bindings automatically at grant time; per-tenant bindings panel Oliver Kieselbach 2026-08-29 19:21:47 +02:00
  • 8ec8524252 fix(security): bind platform and delegated roles to the immutable Entra tid+oid, not the UPN string v2.0.1430 Oliver Kieselbach 2026-08-29 18:35:47 +02:00
  • c4be6d4169 fix(security): block javascript:/data: URLs in analyze-rule relatedDocs (stored XSS) Oliver Kieselbach 2026-08-29 17:55:50 +02:00
  • d558b94cf6 updated commands Oliver Kieselbach 2026-08-29 17:24:45 +02:00
  • 9b4222e729 fix(ime-archive): verify MSI ProductVersion and walk primary/secondary/hotfix hosts before archiving Oliver Kieselbach 2026-08-29 17:23:05 +02:00
  • cf76c4338f feat(vuln): manual "Refresh NVD Cache" and "Sync EPSS" with their own last-sync lines Oliver Kieselbach 2026-08-29 11:57:55 +02:00
  • a6184f165b feat(vuln): FIRST EPSS as fourth source, act/attend/track priority, CVSS vector; never cache a refused NVD answer Oliver Kieselbach 2026-08-29 11:07:31 +02:00
  • d3918cb740 feat(mcp): log the protocol era per request (mcp_request line, MCP_TOOL_LOGGING-gated) Oliver Kieselbach 2026-08-29 09:13:00 +02:00
  • 15722a3885 fix(mcp): log the CIMD success path so metadata-document logins are positively visible Oliver Kieselbach 2026-08-29 09:06:09 +02:00
  • 1a4e13f0e9 feat(mcp): implement MCP spec 2026-07-28 (SDK v2 dual-era handler) and Client ID Metadata Documents Oliver Kieselbach 2026-08-29 08:43:58 +02:00
  • c39092bf72 ci(mcp): image tag unique per run so docs-only redeploys roll a new revision Oliver Kieselbach 2026-08-29 00:17:04 +02:00
  • 494744ad3f feat(web): progress portal follows Windows 365 Cloud PC first-connect enrollments Oliver Kieselbach 2026-08-29 00:05:59 +02:00
  • a68c096a26 feat(web): progress portal follows every enrollment scenario (Device Preparation, self-deploying, pre-provisioning) Oliver Kieselbach 2026-08-28 21:30:04 +02:00
  • bf156cf862 fix(backend): CMTrace skew tripwire ignores backlog-replay bursts via per-sample grid conformity Oliver Kieselbach 2026-08-28 16:42:51 +02:00
  • 0eaa3527f9 feat(validation,web): device association validator generally available Oliver Kieselbach 2026-08-27 21:20:57 +02:00
  • 5055db2de1 feat(rules): detect installer-mutex app failures (0x80070652) and SWG-blocked diagnostics uploads Oliver Kieselbach 2026-08-27 19:40:17 +02:00
  • 040e411958 feat(classification,calibration): rule 5a completed-assumed, max-lifetime grace skip, drift-radar floors Oliver Kieselbach 2026-08-27 18:10:19 +02:00
  • 42c45cf567 feat(admin,backend): find a tenant by its notification or contact email Oliver Kieselbach 2026-08-27 15:41:05 +02:00
  • b31256c748 fix(activation): capture the welcome-mail address instead of redirecting past it Oliver Kieselbach 2026-08-26 14:32:52 +02:00
  • 51f2dabc8c feat(web): explain the blank WiFi signal in the network timeline v2.0.1429 Oliver Kieselbach 2026-08-26 14:06:49 +02:00
  • 0f9a77c848 feat(agent,web,mcp): surface the 24H2 location gate instead of only logging it Oliver Kieselbach 2026-08-26 13:58:31 +02:00
  • d89e3f0b48 fix(backend): cap vulnerability_report severity at Warning Oliver Kieselbach 2026-08-26 13:54:58 +02:00
  • 058248d95c fix(agent): read WiFi SSID via ungated WinRT API — 24H2 location gate Oliver Kieselbach 2026-08-26 13:27:36 +02:00
  • aab0a0c52c feat(admin): make report ID one-click copyable in report details Oliver Kieselbach 2026-08-26 12:45:41 +02:00
  • f22feb71ff feat(web): exclude events from the session timeline search Oliver Kieselbach 2026-08-25 14:33:05 +02:00
  • c92fe7c2a0 commands: bump to 3061dca (cert tenant binding queries in backend-logs + session-debug) Oliver Kieselbach 2026-08-25 12:56:29 +02:00
  • b7cb75e442 Merge branch 'main' of https://github.com/okieselbach/Autopilot-Monitor Oliver Kieselbach 2026-08-25 12:50:12 +02:00
  • d6895f2c7e feat(security): enforce cert tenant binding — reject cross-tenant certificates Oliver Kieselbach 2026-08-25 12:45:21 +02:00
  • beac51720f build(deps): bump the web group (#135) v2.0.1428 dependabot[bot] 2026-08-25 12:32:44 +02:00
  • 32268ba245 build(deps-dev): bump vitest (#134) dependabot[bot] 2026-08-25 12:32:17 +02:00
  • c91d8d4501 fix(agent): complete enrollments with zero user-targeted apps instead of failing them Oliver Kieselbach 2026-08-25 12:27:42 +02:00
  • bf6850dedc perf(security): log DevPrep association shadow once per lookup, not per request Oliver Kieselbach 2026-08-24 20:18:57 +02:00
  • 35a3ed0cfb perf(security): log device binding once per Graph lookup, not per request Oliver Kieselbach 2026-08-24 19:18:37 +02:00
  • ea6a375c4b feat(security): cert-to-device binding, stage 3 GA-gated shadow Oliver Kieselbach 2026-08-24 18:26:33 +02:00
  • fb79c7711c fix(security): carry cert tenant binding on the request row, not a dead log line v2.0.1427 Oliver Kieselbach 2026-08-24 16:40:04 +02:00
  • 249e39bc68 feat(security): cert tenant binding, stage 1 shadow mode v2.0.1426 v2.0.1425 Oliver Kieselbach 2026-08-24 16:03:05 +02:00
  • 6bd9139869 fix(agent): cert GUID parser accepts bare 16-byte extension values Oliver Kieselbach 2026-08-24 14:41:00 +02:00
  • 73373a2c9e feat(agent): compiled-in fallback rule catalogs for the no-config default v2.0.1424 Oliver Kieselbach 2026-08-24 12:14:30 +02:00
  • 6d607c9045 fix(agent): network-link gate before initial config fetch + post-registration recovery Oliver Kieselbach 2026-08-24 11:49:37 +02:00
  • c26867ced8 fix(agent): network-link gate before initial config fetch + post-registration recovery v2.0.1423 Oliver Kieselbach 2026-08-24 11:49:37 +02:00
  • 3af94d9dcd infra(telemetry): DCR also drops host-emitted successful SignalR dependencies Oliver Kieselbach 2026-08-23 19:15:41 +02:00
  • 0d5e2572aa perf(telemetry): one canonical request record; drop expected storage outcomes and SignalR success deps Oliver Kieselbach 2026-08-23 18:31:32 +02:00
  • 793e907e60 fix(cveindex): merge findings per CVE before upsert; bounded parallelism Oliver Kieselbach 2026-08-23 17:52:02 +02:00
  • 8e8bb66371 test(agent): thread-safe FakeSignalIngressSink (parked-tripwire CI flake) v2.0.1422 Oliver Kieselbach 2026-08-23 16:28:58 +02:00
  • 7e1389cf32 fix(ratelimit): keep history and lock in one cache entry; drop leaking per-key lock map Oliver Kieselbach 2026-08-23 16:26:44 +02:00
  • 3a89319472 feat(telemetry): startup duration metrics for backend and MCP Oliver Kieselbach 2026-08-23 16:04:31 +02:00
  • b37e6f975c perf(startup): table schema sentinel gates CreateTableIfNotExists pass Oliver Kieselbach 2026-08-23 15:33:45 +02:00
  • cacbd24667 feat(mcp): get_verdict_calibration response shaping (explicit nulls, minSharePct/top, omitted report) Oliver Kieselbach 2026-08-23 12:51:17 +02:00
  • a157d98a40 fix(radar): verdict share regression only for backend-decided paths Oliver Kieselbach 2026-08-23 12:32:00 +02:00
  • 7fa50d09c1 perf(maintenance): one projected 35d Sessions scan shared by all rolling sweeps Oliver Kieselbach 2026-08-23 12:19:41 +02:00
  • 94afc02e62 docs(okf): verdict calibration concept (VerdictPath, prior verdicts, aggregate, radar) Oliver Kieselbach 2026-08-23 11:40:34 +02:00
  • 5e4c5e80be feat: verdict calibration drift radar (share / silence / evidence-gap) with ops events Oliver Kieselbach 2026-08-23 11:39:06 +02:00
  • b535973531 feat: verdict calibration aggregate, GA endpoint, MCP tool and operator matrix Oliver Kieselbach 2026-08-23 11:22:17 +02:00
  • 7e0c578a59 feat(backend): VerdictPath + PriorStatus/PriorVerdictPath on every session status write Oliver Kieselbach 2026-08-23 11:06:37 +02:00
  • 1257e0d195 Merge branch 'main' of https://github.com/okieselbach/Autopilot-Monitor v2.0.1421 Oliver Kieselbach 2026-08-23 09:57:39 +02:00
  • 98f8114d90 fix(classification): self-deploying profiles reconcile to Succeeded after Device Setup, never AwaitingUser Oliver Kieselbach 2026-08-23 09:55:06 +02:00
  • 7b3230d507 fix(web): mobile wrapping for App Details header, Software tables and SLA banner (#133) Oliver Kieselbach 2026-08-23 05:19:20 +02:00
  • 87b7a20223 fix(web): diagnostics path rows wrap the full path on narrow screens Oliver Kieselbach 2026-08-23 04:30:10 +02:00
  • 4c19be1de4 feat(web): drop Experimental/Pre-Release badges from Software Inventory & Vulnerability Analyzer Oliver Kieselbach 2026-08-23 04:26:55 +02:00
  • 93de130cd1 feat(diagnostics): built-in collection catalog visible in the portal, RealmJoin + Device Preparation sections gated v2.0.1420 Oliver Kieselbach 2026-08-23 04:09:50 +02:00
  • b8b95c7e76 refactor(web): move RealmJoin Watcher and Keep Awake from Agent Analyzers to Agent Settings Oliver Kieselbach 2026-08-23 04:06:39 +02:00
  • e57e081cec docs(web): Discord in notification-provider copy on about, privacy, settings and rule card Oliver Kieselbach 2026-08-23 02:47:52 +02:00
  • 3a60186824 revert(email): drop the gradient slant row and corner cell — solid fallbacks made non-gradient clients worse Oliver Kieselbach 2026-08-23 02:30:40 +02:00
  • c35595503f feat(email): header slant and light corner facet without clip-path — gradients Outlook can draw Oliver Kieselbach 2026-08-23 02:22:44 +02:00
  • 838da4cc8a fix(email): single Outlook-safe facet gradient, no bgcolor inside the brand mark Oliver Kieselbach 2026-08-23 02:11:17 +02:00
  • a9937e0f5d fix(email): brand mark as three non-overlapping rows — Outlook ignores negative margins Oliver Kieselbach 2026-08-23 02:02:14 +02:00
  • 1dc2cc9a54 fix(email): header rebuilt 1:1 from the approved banner — faceted gradients and four-edge brand mark Oliver Kieselbach 2026-08-23 01:44:26 +02:00
  • dd7ae299a8 fix(email): header restored to the approved rendering (e1de5a89 geometry) Oliver Kieselbach 2026-08-23 01:23:22 +02:00
  • d96d10ccec fix(email): header matches the reference banner — mark 12/21/0 trapezoid, stripes thin/wide/thin in the proven 8-stop gradient form Oliver Kieselbach 2026-08-23 01:05:12 +02:00
  • 457fff65f5 fix(email): brand mark back to the div border trick (Outlook paints transparent td borders white) Oliver Kieselbach 2026-08-23 00:56:09 +02:00
  • dc45694611 docs(okf): email template overrides and image-free mail header Oliver Kieselbach 2026-08-23 00:50:41 +02:00
  • 7569061983 feat(admin): editable email templates — preview, test send and HTML override in Settings Oliver Kieselbach 2026-08-23 00:50:10 +02:00