From b1ee79ca02b8c5e14ca6314ed8c83e98a6104f6b Mon Sep 17 00:00:00 2001
From: OfficeCom Codex <codex@officecom.cloud>
Date: Sat, 25 Jul 2026 02:33:02 +0200
Subject: [PATCH] Configure upload during Ninja bootstrap

---
 scripts/bootstrap-ocsentinel-ninja.ps1 | 35 +++++++++++++++++++++++++-
 scripts/run-ocsentinel-monitor.ps1     | 12 ++++++++-
 2 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/scripts/bootstrap-ocsentinel-ninja.ps1 b/scripts/bootstrap-ocsentinel-ninja.ps1
index 7bb5202..cf24198 100644
--- a/scripts/bootstrap-ocsentinel-ninja.ps1
+++ b/scripts/bootstrap-ocsentinel-ninja.ps1
@@ -1,6 +1,8 @@
 [CmdletBinding()]
 param(
     [string]$ManifestUrl = "https://gitea.officecom.cloud/officecom/oc-sentinel/raw/main/release/stable/version.json",
+    [string]$WebhookUrl = "",
+    [string]$SecretValue = "",
     [switch]$RunInitialStatusScan
 )
 
@@ -12,6 +14,9 @@ $installRoot = Join-Path $env:ProgramFiles "OCSentinel"
 $updaterPath = Join-Path $installRoot "scripts\update-ocsentinel.ps1"
 $monitorPath = Join-Path $installRoot "scripts\run-ocsentinel-monitor.ps1"
 $appPath = Join-Path $installRoot "app\OCSentinelCli.exe"
+$clientConfigPath = Join-Path $installRoot "config\ocsentinel-client.json"
+$secretScriptPath = Join-Path $installRoot "scripts\protect-ocsentinel-secret.ps1"
+$secretPath = "C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat"
 
 function Assert-ArtifactSignature {
     param([Parameter(Mandatory)][string]$ExecutablePath)
@@ -80,13 +85,41 @@ if (-not (Test-Path -LiteralPath $appPath)) {
     throw "OCSentinel installation completed, but the client executable was not found."
 }
 
+if (-not [string]::IsNullOrWhiteSpace($WebhookUrl)) {
+    if (-not (Test-Path -LiteralPath $clientConfigPath)) {
+        throw "OCSentinel client configuration was not found: $clientConfigPath"
+    }
+
+    $clientConfig = Get-Content -LiteralPath $clientConfigPath -Raw | ConvertFrom-Json
+    $clientConfig.n8nWebhookUrl = $WebhookUrl
+    $clientConfig.environment = "production"
+    $clientConfig | ConvertTo-Json -Depth 10 | Set-Content -LiteralPath $clientConfigPath -Encoding UTF8
+    Write-Host "Configured OCSentinel upload endpoint."
+}
+
+if (-not [string]::IsNullOrWhiteSpace($SecretValue)) {
+    if (-not (Test-Path -LiteralPath $secretScriptPath)) {
+        throw "OCSentinel secret bootstrap script was not found: $secretScriptPath"
+    }
+
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $secretScriptPath -SecretValue $SecretValue
+    if ($LASTEXITCODE -ne 0) {
+        throw "OCSentinel secret bootstrap failed with code $LASTEXITCODE"
+    }
+}
+
 if ($RunInitialStatusScan) {
     if (-not (Test-Path -LiteralPath $monitorPath)) {
         throw "OCSentinel was installed, but the monitor script is missing."
     }
 
     Write-Host "Running initial OCSentinel status scan."
-    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $monitorPath -Mode status -OutputPath "..\\reports\\ocsentinel-summary.json"
+    $scanArguments = @("-NoProfile", "-ExecutionPolicy", "Bypass", "-File", $monitorPath, "-Mode", "status", "-OutputPath", "..\\reports\\ocsentinel-summary.json")
+    if ((Test-Path -LiteralPath $clientConfigPath) -and (Test-Path -LiteralPath $secretPath)) {
+        $scanArguments += @("-ClientConfigPath", $clientConfigPath, "-SecretPath", $secretPath, "-UploadMode", "required")
+    }
+
+    & powershell.exe @scanArguments
     if ($LASTEXITCODE -ne 0) {
         throw "Initial OCSentinel status scan exited with code $LASTEXITCODE"
     }
diff --git a/scripts/run-ocsentinel-monitor.ps1 b/scripts/run-ocsentinel-monitor.ps1
index e88ce1d..738cf81 100644
--- a/scripts/run-ocsentinel-monitor.ps1
+++ b/scripts/run-ocsentinel-monitor.ps1
@@ -3,6 +3,10 @@ param(
     [int]$TopCount = 10,
     [string]$OutputPath = ".\reports\ocsentinel-summary.json",
     [string]$ConfigPath = ".\config\ocsentinel-settings.example.json",
+    [string]$ClientConfigPath = ".\config\ocsentinel-client.json",
+    [string]$SecretPath = "",
+    [ValidateSet("disabled", "auto", "required")]
+    [string]$UploadMode = "auto",
     [string]$VulnerabilityCsvPath = "",
     [string]$MirrorRoot = "",
     [ValidateSet("status", "attack-only", "cve-critical", "attack-plus-cve")]
@@ -142,9 +146,15 @@ $runnerArgs = @(
     "-LookbackDays", $LookbackDays,
     "-TopCount", $TopCount,
     "-OutputPath", $OutputPath,
-    "-ConfigPath", $ConfigPath
+    "-ConfigPath", $ConfigPath,
+    "-ClientConfigPath", $ClientConfigPath,
+    "-UploadMode", $UploadMode
 )
 
+if (-not [string]::IsNullOrWhiteSpace($SecretPath)) {
+    $runnerArgs += @("-SecretPath", $SecretPath)
+}
+
 if (-not [string]::IsNullOrWhiteSpace($VulnerabilityCsvPath)) {
     $runnerArgs += @("-VulnerabilityCsvPath", $VulnerabilityCsvPath)
 }