Add daily scans and Ninja burst mode

installer/install-ocsentinel.ps1

@@ -32,6 +32,7 @@ if (Test-Path (Join-Path $packageRoot "config\ocsentinel-client.dev.example.json
 Copy-Item -Path (Join-Path $packageRoot "samples\ninja-vulnerability-export.example.csv") -Destination (Join-Path $samplesRoot "ninja-vulnerability-export.example.csv") -Force
 Copy-Item -Path (Join-Path $packageRoot "scripts\run-ocsentinel.ps1") -Destination $scriptRoot -Force
 Copy-Item -Path (Join-Path $packageRoot "scripts\run-ocsentinel-monitor.ps1") -Destination $scriptRoot -Force
+Copy-Item -Path (Join-Path $packageRoot "scripts\run-ocsentinel-scheduled.ps1") -Destination $scriptRoot -Force
 if (Test-Path (Join-Path $packageRoot "scripts\protect-ocsentinel-secret.ps1")) {
     Copy-Item -Path (Join-Path $packageRoot "scripts\protect-ocsentinel-secret.ps1") -Destination $scriptRoot -Force
 }
@@ -69,8 +70,21 @@ Set-ItemProperty -Path $uninstallKey -Name "QuietUninstallString" -Value $uninst
 Set-ItemProperty -Path $uninstallKey -Name "NoModify" -Value 1 -Type DWord
 Set-ItemProperty -Path $uninstallKey -Name "NoRepair" -Value 1 -Type DWord
 
+$scheduledScript = Join-Path $scriptRoot "run-ocsentinel-scheduled.ps1"
+$taskPrincipal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
+$taskSettings = New-ScheduledTaskSettingsSet -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Minutes 30) -MultipleInstances IgnoreNew
+
+$dailyAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$scheduledScript`" -Kind daily" -WorkingDirectory $scriptRoot
+$dailyTrigger = New-ScheduledTaskTrigger -Daily -At 08:00
+Register-ScheduledTask -TaskName "OCSentinel Daily Scan" -Action $dailyAction -Trigger $dailyTrigger -Principal $taskPrincipal -Settings $taskSettings -Description "OfficeCom Sentinel daily signed scan and upload." -Force | Out-Null
+
+$burstAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$scheduledScript`" -Kind burst" -WorkingDirectory $scriptRoot
+$burstTrigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(2) -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 3650)
+Register-ScheduledTask -TaskName "OCSentinel Burst Check" -Action $burstAction -Trigger $burstTrigger -Principal $taskPrincipal -Settings $taskSettings -Description "OfficeCom Sentinel burst check; scans only when Ninja field ocsentinelburst is enabled." -Force | Out-Null
+
 Write-Host "Installation complete."
 Write-Host "Main path: $installRoot"
 Write-Host "Runner:    $(Join-Path $scriptRoot 'run-ocsentinel.ps1')"
 Write-Host "Monitor:   $(Join-Path $scriptRoot 'run-ocsentinel-monitor.ps1')"
 Write-Host "Updater:   $(Join-Path $scriptRoot 'update-ocsentinel.ps1')"
+Write-Host "Schedule:  Daily scan at 08:00; burst check every 5 minutes."

installer/runtime-run-ocsentinel-monitor.ps1

@@ -9,6 +9,7 @@ param(
     [string]$UploadMode = "auto",
     [string]$VulnerabilityCsvPath = "",
     [string]$MirrorRoot = "",
+    [switch]$SuppressTriggerExit,
     [ValidateSet("status", "attack-only", "cve-critical", "attack-plus-cve")]
     [string]$Mode = "status"
 )
@@ -227,8 +228,8 @@ Write-Host "Total CVEs: $totalCves"
 Write-Host "Report: $outputFullPath"
 Write-Host "Runner exit code: $runnerExitCode"
 
-if ($monitorTriggered) {
+if ($monitorTriggered -and -not $SuppressTriggerExit) {
     exit 1
 }
 
-exit 0
+exit $runnerExitCode

installer/runtime-run-ocsentinel-scheduled.ps1

@@ -0,0 +1,50 @@
+[CmdletBinding()]
+param(
+    [ValidateSet("daily", "burst")]
+    [string]$Kind = "daily"
+)
+
+$ErrorActionPreference = "Stop"
+
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$monitorScript = Join-Path $scriptDir "run-ocsentinel-monitor.ps1"
+$secretPath = "C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat"
+$mutexName = "Global\OfficeComSentinelScan"
+
+function Get-NinjaBurstEnabled {
+    if (Get-Command -Name "Get-NinjaProperty" -ErrorAction SilentlyContinue) {
+        return [bool](Get-NinjaProperty -Name "ocsentinelburst" -Type "Checkbox")
+    }
+
+    if (Get-Command -Name "Ninja-Property-Get" -ErrorAction SilentlyContinue) {
+        $value = Ninja-Property-Get -Name "ocsentinelburst"
+        return [string]$value -match "^(1|true|yes)$"
+    }
+
+    Write-Warning "Ninja custom-field reader is unavailable; burst scan skipped."
+    return $false
+}
+
+if ($Kind -eq "burst" -and -not (Get-NinjaBurstEnabled)) {
+    Write-Host "OfficeCom Sentinel burst check: disabled."
+    exit 0
+}
+
+$createdNew = $false
+$mutex = [Threading.Mutex]::new($false, $mutexName, [ref]$createdNew)
+try {
+    if (-not $mutex.WaitOne(0)) {
+        Write-Host "OfficeCom Sentinel scan skipped: another scan is already running."
+        exit 0
+    }
+
+    Write-Host "OfficeCom Sentinel scheduled $Kind scan started."
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $monitorScript -Mode status -UploadMode required -SecretPath $secretPath -SuppressTriggerExit
+    exit $LASTEXITCODE
+}
+finally {
+    if ($null -ne $mutex) {
+        try { $mutex.ReleaseMutex() } catch { }
+        $mutex.Dispose()
+    }
+}

installer/uninstall-ocsentinel.ps1

@@ -5,6 +5,12 @@ $ErrorActionPreference = "Stop"
 $installRoot = Join-Path ${env:ProgramFiles} "OCSentinel"
 $uninstallKey = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\OCSentinel"
 
+foreach ($taskName in @("OCSentinel Daily Scan", "OCSentinel Burst Check")) {
+    if (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue) {
+        Unregister-ScheduledTask -TaskName $taskName -Confirm:$false
+    }
+}
+
 if (Test-Path $uninstallKey) {
     Remove-Item -Path $uninstallKey -Force -Recurse
 }