Oliver Kieselbach 44dd8161df fix(agent): ImeProcessWatcher verifies process identity before attaching and re-arms discovery after an exit — it attached to the first IntuneManagementExtension name match, so a standard user starting a renamed binary during AccountSetup could forge an ime_process_exited Warning and mute the real signal for the rest of the session (CWE-807), and even a legitimate IME service restart was never watched again; ImeProcessIdentity requires session 0 + image under the IME install root (QueryFullProcessImageName, cross-bitness), prefers the oldest trusted candidate, logs untrusted matches once per PID, and OnImeExited restarts the discovery timer (ReferenceEquals guard against duplicate events) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-30 17:07:18 +02:00

..

AutopilotMonitor.Agent.V2

fix(security): IME log-pattern pack is anchored and linear (all 90 patterns start with ^, IME-APP-VERSION spells the report-delta JSON out instead of a chained [^}]*? scan) and the ImeLogTracker read loop is bounded — BoundedLineReader (32 MB per line, evidence: real 5.6 MB "Get policies" lines; exact byte bookmarks, no decoder read-ahead loss on cancel), 2 s per-line matching budget across all patterns, held-back unterminated EOF tails (≤1 MB, 1 s settle) instead of dropping them and raw-matching fragments, a complete entry after a dropped one is no longer swallowed as its close, one Warning per pass (oversizedLines/regexTimeouts/lineBudgetBreaks) instead of silent Debug timeouts; unanchored PS-SCRIPT-CONTEXT false positives on [Win32App] SideCarScript… lines (which overwrote the pending platform script's RunContext) are gone; --run-ime-matching assembles multiline entries like the tracker

2026-08-30 14:03:50 +02:00

AutopilotMonitor.Agent.V2.Core

fix(agent): ImeProcessWatcher verifies process identity before attaching and re-arms discovery after an exit — it attached to the first IntuneManagementExtension name match, so a standard user starting a renamed binary during AccountSetup could forge an ime_process_exited Warning and mute the real signal for the rest of the session (CWE-807), and even a legitimate IME service restart was never watched again; ImeProcessIdentity requires session 0 + image under the IME install root (QueryFullProcessImageName, cross-bitness), prefers the oldest trusted candidate, logs untrusted matches once per PID, and OnImeExited restarts the discovery timer (ReferenceEquals guard against duplicate events)

2026-08-30 17:07:18 +02:00

AutopilotMonitor.Agent.V2.Core.Tests

fix(agent): ImeProcessWatcher verifies process identity before attaching and re-arms discovery after an exit — it attached to the first IntuneManagementExtension name match, so a standard user starting a renamed binary during AccountSetup could forge an ime_process_exited Warning and mute the real signal for the rest of the session (CWE-807), and even a legitimate IME service restart was never watched again; ImeProcessIdentity requires session 0 + image under the IME install root (QueryFullProcessImageName, cross-bitness), prefers the oldest trusted candidate, logs untrusted matches once per PID, and OnImeExited restarts the discovery timer (ReferenceEquals guard against duplicate events)

2026-08-30 17:07:18 +02:00

AutopilotMonitor.BootstrapMsi

ci: Bootstrap-MSI build workflow - blob publish behind the download alias

2026-08-18 03:07:08 +02:00

AutopilotMonitor.DecisionCore.Tests

fix(agent): complete enrollments with zero user-targeted apps instead of failing them

2026-08-25 12:27:42 +02:00

AutopilotMonitor.SummaryDialog

fix: close live catalog/type drift across web, backend and agent (audit P1)

2026-08-13 17:17:51 +02:00

AutopilotMonitor.SummaryDialog.Tests

feat(v2): WG Part-2 architectural cleanup + install-mode handoff fix

2026-05-04 18:36:37 +02:00

LICENSE

update license

2026-03-26 07:02:33 +01:00