sync: auto-sync from HOWARD-HOME at 2026-07-07 13:55:03

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-07 13:55:03

.claude/memory/MEMORY.md

@@ -120,6 +120,7 @@
 - [Python on Windows — use py launcher](feedback_python_windows.md) — Windows Store python/python3 aliases disabled; always use py or jq on DESKTOP-0O8A1RL.
 - [Memory tooling may delete now — additive-only constraint dropped](feedback_memory_sync_destructive_ok.md) — As of 2026-06-02, memory-dream and sync-memory.sh are sanctioned to perform destructive ops (apply proposed merges/dedups, propagate repo deletions back to harness profile stores). Onboarding-phase safety net now fights deliberate consolidation (e.g. 2026-06-01's 39 deletions resurrected on the next sync). Script updates pending.
 - [Unsaved sessions are recoverable from transcripts](feedback_session_recovery.md) — Crashed/closed-before-save sessions live in `~/.claude/projects/<slug>/*.jsonl`; the detector auto-recovers orphans, `/recover <uuid>` does it manually. Ollama prose + Python verbatim. See `.claude/RECOVERY.md`.
+- [Scheduled tasks must not flash a console](feedback_scheduled_task_no_console_flash.md) — A task action running bash.exe/py.exe/python.exe with Hidden=False draws a console window every fire (the recurring "command prompt opening/closing"). Wrap bash via a wscript VBS (style 0), use pythonw.exe for python, always add `-Hidden`. Fixed installers: register-edr-watcher.ps1, register-orphan-detector.ps1.
 - [agy review is not read-only](feedback_agy_review_not_readonly.md) — agy review/review-files CAN write files + run npm despite docs claiming plan-mode; always git diff after and treat Gemini's output as a proposal to validate, not trusted/finished work.
 - [Don't present inferred topology as fact](feedback_no_inferred_topology_as_fact.md) — Private-IP overlap (172.16.x on both sides) is NOT proof of a site-to-site link; I fabricated a VWP<->office VPN. State observations vs inferences; a failed reachability test disproves a link, don't explain it away; test "can reach RMM" against the EXTERNAL endpoint, not internal 172.16.3.30.
 
@@ -223,4 +224,4 @@
 - [Backup targets never guessed](feedback_backup_targets_never_guessed.md) — billed-vs-running mismatches are billing questions for Mike/Winter; never infer/deploy backup targets
 - [Fire #dev-alerts for client/RMM work](feedback_fire_dev_alerts_for_client_work.md) — Howard+Mike watch #dev-alerts Discord for live visibility into what techs/sessions touch. Fire post-bot-alert.sh ([DEV]/[RMM]/[DEPLOY]/[GURURMM] prefix -> #dev-alerts) at the START of any RMM/Dev or active-client-machine action. No CLAUDE.md rule yet — this memory is the rule.
 - [M365 app: SharePoint needs CERT](reference_m365_app_sharepoint_rest_vs_graph.md) — SP app-only works via the CERT (get-token.sh <tenant> sharepoint); the secret gives "Unsupported app only token". Graph app-only uses the secret.
-- [EDR auto-isolates GuruRMM PowerShell](project_edr_rmm_autoisolation_fp.md) — Datto "Exfiltration Over HTTP" rule auto-isolates benign GuruRMM scripts fleet-wide (vwp-qbs 4h outage); watcher + narrow suppression deployed, policy fix pending Mike
+- [EDR auto-isolates GuruRMM PowerShell](project_edr_rmm_autoisolation_fp.md) — Datto "Exfiltration Over HTTP" rule auto-isolates benign GuruRMM scripts fleet-wide (vwp-qbs 4h outage); watcher + narrow suppression deployed, policy fix pending Mike

.claude/memory/feedback_scheduled_task_no_console_flash.md

@@ -0,0 +1,29 @@
+---
+name: feedback_scheduled_task_no_console_flash
+description: Windows scheduled tasks must launch console apps windowless (wscript VBS for bash, pythonw + -Hidden for python) or they flash a console window on the desktop every run
+metadata:
+  type: feedback
+---
+
+A Windows scheduled task whose action runs a **console-subsystem** program — `bash.exe`,
+`py.exe`, `python.exe`, `cmd.exe` — with `LogonType=Interactive` and `Settings.Hidden=False`
+draws a visible console window on the desktop **every time it fires**. On short repetition
+intervals (the EDR watcher fires every 10 min) this reads to the user as a command prompt
+"opening and closing" constantly. It is the single most reported harness annoyance and it
+keeps recurring because the *installer scripts* recreate the flashing task.
+
+**Why:** wscript.exe is a GUI-subsystem host and pythonw.exe is the windowless Python host;
+neither allocates a console. bash.exe / py.exe / python.exe do.
+
+**How to apply:** whenever you register (or find) a ClaudeTools scheduled task:
+- **bash target** -> point the action at `C:\Windows\System32\wscript.exe` with a one-line VBS
+  wrapper that does `CreateObject("WScript.Shell").Run "...bash.exe -lc ...", 0, False`
+  (window style `0` = hidden). Pattern files: `gps-rmm-progress-hidden.vbs`,
+  `edr-isolation-watch-hidden.vbs`.
+- **python target** -> use `pythonw.exe` (next to the active interpreter), never `py.exe`/`python.exe`.
+- **Always** add `-Hidden` to `New-ScheduledTaskSettingsSet` as belt-and-suspenders.
+- Verify: `Start-ScheduledTask`, then confirm no visible bash/wscript/conhost MainWindow.
+
+Fixed installers: `register-edr-watcher.ps1`, `register-orphan-detector.ps1`. The scheduled
+tasks themselves are per-machine (not in the repo) — re-run the fixed installer, or repoint
+the existing task's action, on every box that runs it. Related: [[feedback_session_recovery]].

.claude/scripts/edr-isolation-watch-hidden.vbs

@@ -0,0 +1,6 @@
+' edr-isolation-watch-hidden.vbs — launch the EDR isolation watcher with no visible window.
+' Run via the "ClaudeTools - EDR Isolation Watcher" scheduled task through wscript.exe (a GUI
+' host, no console), which starts bash with window style 0 (hidden) so the every-10-min watch
+' no longer flashes a console window on the desktop. Runtime env is identical to a direct bash
+' launch. Mirrors gps-rmm-progress-hidden.vbs.
+CreateObject("WScript.Shell").Run """C:\Program Files\Git\bin\bash.exe"" -lc ""/c/claudetools/.claude/scripts/edr-isolation-watch.sh""", 0, False

.claude/scripts/register-edr-watcher.ps1

@@ -13,15 +13,21 @@
 $ErrorActionPreference = "Stop"
 $TaskName = "ClaudeTools - EDR Isolation Watcher"
 
-# Bash launcher (mirrors the GPS-RMM-AutoEnroll task action)
+# Launch via a wscript.exe VBS wrapper (GUI-subsystem host) so bash starts hidden and
+# NO console window flashes on the desktop every 10 min. Launching bash.exe directly is
+# a console-subsystem app with LogonType=Interactive + Hidden=False -> visible flash.
+# Mirrors the gps-rmm-progress-hidden.vbs fix. Do NOT revert to a raw bash.exe action.
 $BashExe = "C:\Program Files\Git\bin\bash.exe"
 if (-not (Test-Path $BashExe)) { Write-Host "[ERROR] Git bash not found at $BashExe" -ForegroundColor Red; exit 1 }
 
-$ScriptPosix = "/c/claudetools/.claude/scripts/edr-isolation-watch.sh"
-$ScriptWin   = "C:\claudetools\.claude\scripts\edr-isolation-watch.sh"
+$ScriptWin = "C:\claudetools\.claude\scripts\edr-isolation-watch.sh"
 if (-not (Test-Path $ScriptWin)) { Write-Host "[ERROR] Watcher not found at $ScriptWin" -ForegroundColor Red; exit 1 }
 
-$Action = New-ScheduledTaskAction -Execute $BashExe -Argument "-lc $ScriptPosix"
+$WScript = "C:\Windows\System32\wscript.exe"
+$Vbs     = "C:\claudetools\.claude\scripts\edr-isolation-watch-hidden.vbs"
+if (-not (Test-Path $Vbs)) { Write-Host "[ERROR] Hidden wrapper not found at $Vbs" -ForegroundColor Red; exit 1 }
+
+$Action = New-ScheduledTaskAction -Execute $WScript -Argument "`"$Vbs`""
 
 # Every 10 minutes, indefinitely (10-year duration avoids the MaxValue quirk).
 $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).Date `
@@ -35,7 +41,7 @@ $Principal = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\$env:USERNAME"
 $Settings = New-ScheduledTaskSettingsSet `
     -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries `
     -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Minutes 5) `
-    -MultipleInstances IgnoreNew
+    -MultipleInstances IgnoreNew -Hidden
 
 Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger `
     -Principal $Principal -Settings $Settings `

.claude/scripts/register-orphan-detector.ps1

@@ -47,14 +47,26 @@ if (-not (Test-Path $Script)) {
     exit 1
 }
 
-# Resolve the py launcher's full path (the action's Execute wants an absolute
-# path; "py" alone usually resolves but we pin it for reliability under the
-# Task Scheduler's environment).
-$PyCmd = Get-Command py -ErrorAction SilentlyContinue
+# Resolve pythonW.exe (the GUI-subsystem Python host) so the detector runs with NO
+# console window flashing on the desktop at logon / every 4h. Using py.exe or
+# python.exe (console subsystem) draws a visible window each run. Prefer pythonw next
+# to the active interpreter; fall back to a PATH lookup, then py.exe as a last resort.
+$PyPath = $null
+$PyCmd  = Get-Command py -ErrorAction SilentlyContinue
 if ($null -ne $PyCmd) {
-    $PyPath = $PyCmd.Source
-} else {
-    $PyPath = "py"  # fall back to PATH resolution at run time
+    try {
+        $exe   = (& py -c "import sys;print(sys.executable)").Trim()
+        $wexe  = Join-Path (Split-Path $exe) "pythonw.exe"
+        if (Test-Path $wexe) { $PyPath = $wexe }
+    } catch { }
+}
+if ($null -eq $PyPath) {
+    $PwCmd = Get-Command pythonw -ErrorAction SilentlyContinue
+    if ($null -ne $PwCmd) { $PyPath = $PwCmd.Source }
+}
+if ($null -eq $PyPath) {
+    if ($null -ne $PyCmd) { $PyPath = $PyCmd.Source } else { $PyPath = "py" }
+    Write-Host "[WARNING] pythonw.exe not found; task may flash a console window." -ForegroundColor Yellow
 }
 
 $Action = New-ScheduledTaskAction `
@@ -76,7 +88,8 @@ $Settings = New-ScheduledTaskSettingsSet `
     -ExecutionTimeLimit (New-TimeSpan -Minutes 30) `
     -MultipleInstances IgnoreNew `
     -StartWhenAvailable `
-    -DontStopOnIdleEnd
+    -DontStopOnIdleEnd `
+    -Hidden
 
 Register-ScheduledTask `
     -TaskName $TaskName `

.gitignore

@@ -6,6 +6,8 @@ backups/
 .find*
 .ews_*.xml
 .x.json
+.rmm*
+.vwp*
 
 # Remediation-tool cache (live Graph API responses — may contain user data)
 .cache-remediation/

.rmm-key-probe.ps1

@@ -1,20 +0,0 @@
-$os=Get-CimInstance Win32_OperatingSystem
-$cur=Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
-Write-Host "== CURRENT =="
-Write-Host ("Edition: {0} | EditionID: {1} | Build {2}" -f $os.Caption,$cur.EditionID,$os.BuildNumber)
-$lic=Get-CimInstance SoftwareLicensingProduct -Filter "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL"
-foreach($l in $lic){Write-Host ("Lic: {0} | Partial {1} | Status {2}(1=OK)" -f $l.Name,$l.PartialProductKey,$l.LicenseStatus)}
-$oem=(Get-CimInstance SoftwareLicensingService).OA3xOriginalProductKey
-Write-Host ("FirmwareKey: {0}" -f $(if($oem){$oem}else{"(none)"}))
-Write-Host "== WINDOWS.OLD =="
-$hive="C:\Windows.old\Windows\System32\config\SOFTWARE"
-if(Test-Path $hive){
-  reg load "HKLM\OLDSW" "$hive" | Out-Null
-  try{
-    $spp=Get-ItemProperty "HKLM:\OLDSW\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"
-    $old=Get-ItemProperty "HKLM:\OLDSW\Microsoft\Windows NT\CurrentVersion"
-    Write-Host ("BackupProductKeyDefault: {0}" -f $spp.BackupProductKeyDefault)
-    Write-Host ("Old: {0} | EditionID {1}" -f $old.ProductName,$old.EditionID)
-  }catch{Write-Host ("hive err: {0}" -f $_.Exception.Message)}
-  finally{[gc]::Collect();Start-Sleep -Milliseconds 300;reg unload "HKLM\OLDSW" | Out-Null}
-}else{Write-Host "no C:\Windows.old SOFTWARE hive"}

.rmm-scan.ps1

@@ -1,15 +0,0 @@
-Write-Host "== drives =="
-Get-CimInstance Win32_LogicalDisk -Filter "DriveType=3" | ForEach-Object { Write-Host ("{0} free {1}GB / {2}GB" -f $_.DeviceID,[math]::Round($_.FreeSpace/1GB),[math]::Round($_.Size/1GB)) }
-Write-Host "== Windows.old* on all fixed drives =="
-$found=$false
-Get-CimInstance Win32_LogicalDisk -Filter "DriveType=3" | ForEach-Object {
-  $root="$($_.DeviceID)\"
-  Get-ChildItem $root -Filter "Windows.old*" -Directory -Force -ErrorAction SilentlyContinue | ForEach-Object {
-    $found=$true
-    $sw=Join-Path $_.FullName "Windows\System32\config\SOFTWARE"
-    Write-Host ("FOUND: {0} | SOFTWARE hive exists: {1}" -f $_.FullName,(Test-Path $sw))
-  }
-}
-if(-not $found){Write-Host "none found on any drive"}
-Write-Host "== Pro digital license probe (dlv all) =="
-cscript //nologo "$env:windir\System32\slmgr.vbs" /dlv all 2>&1 | Select-String -Pattern "Name:|Description:|License Status:|Partial Product Key:" | ForEach-Object { $_.Line.Trim() }

.rmm_b64_localadmin

@@ -1 +0,0 @@
-JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAEMAbwBuAHQAaQBuAHUAZQAnAAoACgAjACAAMQAuACAAQgBsAGEAbgBrACAAdABoAGUAIABMAG8AYwBhAGwAYQBkAG0AaQBuACAAYQBjAGMAbwB1AG4AdAAgAHAAYQBzAHMAdwBvAHIAZAAKAG4AZQB0ACAAdQBzAGUAcgAgAEwAbwBjAGEAbABhAGQAbQBpAG4AIAAiACIACgBXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgA9AD0APQAgAGEAZgB0AGUAcgAgAGIAbABhAG4AawA6ACAAbgBlAHQAIAB1AHMAZQByACAATABvAGMAYQBsAGEAZABtAGkAbgAgAD0APQA9ACIACgBuAGUAdAAgAHUAcwBlAHIAIABMAG8AYwBhAGwAYQBkAG0AaQBuAAoACgAjACAAMgAuACAAUwBlAHQAIABwAGEAcwBzAHcAbwByAGQAIAB0AG8AIABuAGUAdgBlAHIAIABlAHgAcABpAHIAZQAgACgAYQB2AG8AaQBkACAAdABoAGUAIAA0ADIALQBkAGEAeQAgAG0AYQB4AC0AYQBnAGUAIABwAHIAbwBtAHAAdAAgAGIAcgBlAGEAawBpAG4AZwAgAGEAdQB0AG8ALQBsAG8AZwBpAG4AKQAKAFMAZQB0AC0ATABvAGMAYQBsAFUAcwBlAHIAIAAtAE4AYQBtAGUAIAAiAEwAbwBjAGEAbABhAGQAbQBpAG4AIgAgAC0AUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACAAJAB0AHIAdQBlAAoAVwByAGkAdABlAC0ASABvAHMAdAAgACIAPQA9AD0AIABQAGEAcwBzAHcAbwByAGQATgBlAHYAZQByAEUAeABwAGkAcgBlAHMAIABmAGwAYQBnACAAPQA9AD0AIgAKAEcAZQB0AC0ATABvAGMAYQBsAFUAcwBlAHIAIAAtAE4AYQBtAGUAIAAiAEwAbwBjAGEAbABhAGQAbQBpAG4AIgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAARQBuAGEAYgBsAGUAZAAsACAAUABhAHMAcwB3AG8AcgBkAEUAeABwAGkAcgBlAHMALAAgAFAAYQBzAHMAdwBvAHIAZABSAGUAcQB1AGkAcgBlAGQAIAB8ACAARgBvAHIAbQBhAHQALQBMAGkAcwB0AAoACgAjACAAMwAuACAASwBlAGUAcAAgAGMAbwBuAHMAbwBsAGUAIABhAHUAdABvAC0AbABvAGcAaQBuACAAdwBvAHIAawBpAG4AZwAgAHcAaQB0AGgAIAB0AGgAZQAgAG4AbwB3AC0AYgBsAGEAbgBrACAAcABhAHMAcwB3AG8AcgBkAAoAJAB3AGwAIAA9ACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABOAFQAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABXAGkAbgBsAG8AZwBvAG4AIgAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHcAbAAgAC0ATgBhAG0AZQAgAEEAdQB0AG8AQQBkAG0AaQBuAEwAbwBnAG8AbgAgACAALQBWAGEAbAB1AGUAIAAiADEAIgAgACAAIAAgACAAIAAgACAAIAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHcAbAAgAC0ATgBhAG0AZQAgAEQAZQBmAGEAdQBsAHQAVQBzAGUAcgBOAGEAbQBlACAALQBWAGEAbAB1AGUAIAAiAEwAbwBjAGEAbABhAGQAbQBpAG4AIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHcAbAAgAC0ATgBhAG0AZQAgAEQAZQBmAGEAdQBsAHQAUABhAHMAcwB3AG8AcgBkACAALQBWAGEAbAB1AGUAIAAiACIAIAAgACAAIAAgACAAIAAgACAAIAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAAoAVwByAGkAdABlAC0ASABvAHMAdAAgACIAPQA9AD0AIABXAGkAbgBsAG8AZwBvAG4AIABhAHUAdABvAC0AbABvAGcAaQBuACAAdgBhAGwAdQBlAHMAIAA9AD0APQAiAAoARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAdwBsACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABBAHUAdABvAEEAZABtAGkAbgBMAG8AZwBvAG4ALAAgAEQAZQBmAGEAdQBsAHQAVQBzAGUAcgBOAGEAbQBlACwAIABEAGUAZgBhAHUAbAB0AFAAYQBzAHMAdwBvAHIAZAAgAHwAIABGAG8AcgBtAGEAdAAtAEwAaQBzAHQACgAKAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAD0APQA9ACAARABPAE4ARQAgAD0APQA9ACIACgA=

.rmm_change_cmd

@@ -1 +0,0 @@
-3f0cbd20-4e70-4b04-a3ff-d566dcc7deba

.rmm_cmds

@@ -1 +0,0 @@
-a95922a6-6707-4f4b-91d1-70c237167b36 a9b34757-b6e8-411f-a67e-979cc8f07a26

.rmm_desktop_cmd

@@ -1 +0,0 @@
-3576a31c-2309-488c-bf45-fb0a3652d9f2

.rmm_server_cmd

@@ -1 +0,0 @@
-f59a4c5e-f37a-44c3-b373-f728770f7200

.rmm_station2_cmd

@@ -1 +0,0 @@
-7bcc12b7-cf7d-4251-9b61-93a551c8f320

.rmm_token

@@ -1 +0,0 @@
-eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI0ZDc1NGYzNi0wNzYzLTRmMzUtOWFhMi0wYjk4YmJjZGIzMDkiLCJyb2xlIjoiYWRtaW4iLCJvcmdzIjpbXSwidHYiOjAsImV4cCI6MTc4MzMxOTMyMSwiaWF0IjoxNzgzMjMyOTIxfQ.XwIBBj4-C1eg4a8Wr_a5g_b1HfSBJz_b2L8wt8gvbCE

errorlog.md

@@ -19,6 +19,10 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
 
 <!-- Append entries below this line -->
 
+2026-07-07 | Howard-Home | windows/scheduled-task | [friction] EDR Isolation Watcher task launched bash.exe directly (Hidden=False, every 10min) -> console window flashed on desktop; recurring class also hit GPS-RMM-Progress today. FIX: wscript VBS wrapper (style 0) for bash, pythonw+-Hidden for python; fixed both installers [ctx: ref=feedback_scheduled_task_no_console_flash host=Howard-Home task='ClaudeTools - EDR Isolation Watcher']
+
+2026-07-07 | Howard-Home | datto-edr | Datto EDR request failed: <urlopen error [WinError 10060] A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond> [ctx: cmd=detections]
+
 2026-07-07 | Howard-Home | ps-encoded | encode produced empty output [ctx: src=/c/Users/Howard/AppData/Local/Temp/claude/C--claudetools/23870231-fa32-4370-8531-14f3aa498add/scratchpad/fourpaws-localadmin-blank.ps1]
 
 2026-07-07 | GURU-BEAST-ROG | syncro | add_line_item and update_line_item both ignored user_id override - line item attributed to API key owner (1735) despite user_id 1750 in payload; needed GUI fix [ctx: ticket=32509 line=43169157]