mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-25 13:10:13 +00:00
Oliver Kieselbach
c23dc9a329
Delta-review 2026-07-02 findings: - L12: `cmd /k` leaves a fully interactive shell after running its command — it was classified as a scripted invocation and silently ignored (deliberate false-negative seam, e.g. a technician-planted `cmd /k whoami`). Now surfaced as low-confidence `interactive_console_with_command`; only /c (run-and-exit) is ignored. - L13: the WMI trace arm + startup probe ran synchronously in the orchestrator`s sequential host-start loop; a WinMgmt hang (documented OOBE failure mode) delayed every later host. Both now run on a background thread, with a dispose-race guard around the watcher arm. - L14: the desktop-arrival callback was the ONLY stop path — if the DAD never validated a real-user owner, the watcher flagged ordinary post-desktop user consoles for the agent`s whole remaining lifetime. Fallback: the host also stops on a DesktopArrived or HelloResolved signal on the decision rail. - L15: wtsErrorCount counted the routine "session has no logged-on user yet" OOBE case as an error; ProcessOwnerLookup.ViaWts now reports real API failures separately and only those are counted. - L20: WatchedProcessNames is now actually the single seam — WQL trace filter, startup probe and the emitted processName are all built from it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>