chore: merge main into PR #17

Sync_from_git.sh

@@ -1,5 +1,4 @@
 #!/bin/sh
-# shellcheck disable=SC1007
 set -eu
 
 REPO_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

Sync_to_git.sh

@@ -1,5 +1,4 @@
 #!/bin/sh
-# shellcheck disable=SC1007
 set -eu
 
 REPO_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

aw-server/aw-worktime-ui-bridge.py

@@ -3,7 +3,7 @@ import json
 import os
 import urllib.error
 import urllib.request
-from datetime import datetime, timedelta, timezone
+from datetime import datetime, timezone
 
 
 AW_URL = os.environ.get("AW_SERVER_URL", "http://127.0.0.1:5600")
@@ -70,48 +70,25 @@ def to_iso_utc(ts):
     return ts.replace("+00:00", "Z")
 
 
-def parse_iso_utc(ts: str):
-    if ts.endswith("Z"):
-        ts = ts[:-1] + "+00:00"
-    return datetime.fromisoformat(ts).astimezone(timezone.utc)
-
-
 def build_window_title(users, active_count):
     if not users:
         return "RDP idle"
     return f"RDP active ({active_count}): " + ", ".join(users)
 
 
-def _is_session_active(row_data):
-    if isinstance(row_data.get("active"), bool):
-        return row_data.get("active")
-    state = str(row_data.get("state", "")).strip().lower()
-    return state in {"active", "активно"}
-
-
 def transform(events):
     out_afk = []
     out_win = []
     last_ts = None
 
-    grouped = {}
     for e in events:
         ts = e.get("timestamp")
         if not ts:
             continue
-        grouped.setdefault(ts, []).append(e)
+        duration = float(e.get("duration", 0.0))
-
+        data = e.get("data") or {}
-    for ts in sorted(grouped.keys()):
+        active_users = data.get("activeUsers") or []
-        rows = grouped[ts]
+        active_count = int(data.get("activeCount", len(active_users)))
-        duration = max(float(r.get("duration", 0.0)) for r in rows)
-        active_users = []
-        for r in rows:
-            data = r.get("data") or {}
-            user = str(data.get("username", "")).strip()
-            if user and _is_session_active(data):
-                active_users.append(user)
-        active_users = sorted(set(active_users))
-        active_count = len(active_users)
         is_active = active_count > 0
 
         afk_data = {"status": "not-afk" if is_active else "afk", "source": "aw-worktime-ui-bridge"}
@@ -135,29 +112,18 @@ def main():
     ensure_bucket(AFK_BUCKET, "afkstatus", "aw-worktime-ui-bridge")
     ensure_bucket(WINDOW_BUCKET, "currentwindow", "aw-worktime-ui-bridge")
 
-    now_utc = datetime.now(timezone.utc)
+    query = {
-    recent = _req("GET", f"/api/0/buckets/{SESSIONS_BUCKET}/events?limit=5000") or []
+        "query": [
-    if not recent:
+            "events = query_bucket(find_bucket($bid));",
-        return
+            "RETURN = sort_by_timestamp(events);",
-
+        ],
-    try:
+        "timeperiods": [[last_ts, to_iso_utc(datetime.now(timezone.utc).isoformat())]],
-        last_dt = parse_iso_utc(last_ts)
+    }
-    except Exception:
+    rows = _req("POST", f"/api/0/query/?bid={SESSIONS_BUCKET}", query) or []
-        last_dt = datetime(1970, 1, 1, tzinfo=timezone.utc)
+    if not rows or not rows[0]:
-
-    events = []
-    for e in recent:
-        ts = e.get("timestamp")
-        if not ts:
-            continue
-        try:
-            if parse_iso_utc(ts) > last_dt:
-                events.append(e)
-        except Exception:
-            continue
-    if not events:
         return
 
+    events = rows[0]
     afk_events, win_events, new_last_ts = transform(events)
     if not afk_events or not win_events or not new_last_ts:
         return

check-aw-data.sh

@@ -18,7 +18,7 @@ echo "=== ActivityWatch Data Check: $HOSTNAME_FILTER ==="
 echo ""
 echo -n "Server connectivity... "
 RESP=$(no_proxy=10.10.10.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/info" 2>&1)
-if echo "$RESP" | jq -e '.version' > /dev/null 2>&1; then
+if [ $? -eq 0 ] && echo "$RESP" | jq -e '.version' > /dev/null 2>&1; then
     VERSION=$(echo "$RESP" | jq -r '.version')
     echo -e "${GREEN}OK${NC} (aw-server v$VERSION)"
 else

check-aw-full.sh

@@ -22,7 +22,7 @@ echo ""
 echo -e "${CYAN}--- 1. AW Server ($SERVER) ---${NC}"
 echo -n "  Connectivity... "
 RESP=$(no_proxy=10.10.10.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/info" 2>&1)
-if echo "$RESP" | jq -e '.version' > /dev/null 2>&1; then
+if [ $? -eq 0 ] && echo "$RESP" | jq -e '.version' > /dev/null 2>&1; then
     VERSION=$(echo "$RESP" | jq -r '.version')
     echo -e "  ${GREEN}OK${NC} (aw-server $VERSION)"
 else

dlp-reliability-roadmap.md

@@ -0,0 +1,151 @@
+# DLP Reliability Roadmap
+
+## Scope
+Roadmap for improving runtime reliability of:
+- `windows/dlp-endpoint-signals-collector.ps1`
+- `windows/file-operations-collector.ps1`
+
+Date: 2026-05-04
+
+---
+
+## Stage 1 (1-2 days): Quick wins
+
+### 1) Disk queue + sender loop + retry/backoff/jitter
+
+**Goal:** no data loss on temporary network/server outages.
+
+**Tasks**
+- Add local append-only queue file per collector (`*.jsonl`) under ProgramData logs/artifacts root.
+- Write events to queue first, then send asynchronously.
+- Implement sender loop:
+  - reads oldest unsent records,
+  - sends in small batches,
+  - marks sent records,
+  - compacts queue periodically.
+- Implement retry policy with exponential backoff + jitter.
+
+**Acceptance criteria**
+- When API is unavailable, queue grows and collector keeps running.
+- When API recovers, queued events are flushed automatically.
+- No collector crash during repeated network failures.
+
+### 2) `eventId` + dedupe contract
+
+**Goal:** at-least-once delivery without logical duplicates.
+
+**Tasks**
+- Add `eventId` (UUID), `eventCreatedAt`, `collectorType`, `hostname` to every payload.
+- Define server dedupe contract:
+  - dedupe key = `eventId`,
+  - TTL for dedupe cache,
+  - idempotent processing semantics.
+
+**Acceptance criteria**
+- Retried sends do not create duplicate incidents/events in downstream storage.
+- Payload schema documentation updated.
+
+### 3) Basic metrics/logging
+
+**Goal:** visibility into health and data delivery.
+
+**Tasks**
+- Emit counters/gauges to log and heartbeat:
+  - `queueDepth`,
+  - `oldestUnsentAgeSec`,
+  - `eventsEnqueued`,
+  - `eventsSent`,
+  - `sendFailures`,
+  - `lastSendStatus`.
+
+**Acceptance criteria**
+- Operators can identify stuck queue and send failures from logs only.
+
+---
+
+## Stage 2: Hardening
+
+### 1) Circuit breaker + health probes
+
+**Tasks**
+- Add transport circuit breaker (Closed/Open/HalfOpen).
+- Open breaker after N consecutive failures.
+- In Open state perform probe every M seconds.
+- Close breaker on successful probe.
+
+**Acceptance criteria**
+- Reduced request storm during outage.
+- Deterministic recovery behavior after outage.
+
+### 2) Watcher auto-recreate
+
+**Tasks**
+- Handle `FileSystemWatcher` error/overflow events.
+- Recreate watcher and subscriptions automatically.
+- Keep watchdog timer to ensure watcher health.
+
+**Acceptance criteria**
+- Watcher resumes after overflow without manual restart.
+
+### 3) Last-known-good policy
+
+**Tasks**
+- Validate new policy before apply.
+- Cache last valid policy with checksum/version.
+- Rollback to cached policy on parse/validation errors.
+
+**Acceptance criteria**
+- Broken policy cannot stop detection loop.
+
+---
+
+## Stage 3: Reliability operations
+
+### 1) Chaos tests
+
+Scenarios:
+- network disconnect,
+- API 5xx bursts,
+- slow disk / queue write delay,
+- headless UI context,
+- forced collector restart.
+
+**Acceptance criteria**
+- For each scenario, documented expected behavior and observed result.
+- No silent data loss in tested outage windows.
+
+### 2) SLO + error budget process
+
+**Initial SLO proposals**
+- Event delivery latency P95 < 120s under normal conditions.
+- Data loss = 0 for outages shorter than 30 minutes (with available disk).
+- Collector liveness heartbeat every `pollSeconds * 3` max.
+
+**Process**
+- Define SLI dashboards.
+- Define release gates tied to error budget burn.
+- Freeze risky changes when budget exhausted.
+
+---
+
+## Suggested implementation order inside repository
+
+1. `file-operations-collector.ps1`: queue + sender + metrics (simpler flow).
+2. `dlp-endpoint-signals-collector.ps1`: queue + sender + metrics.
+3. Shared helper module extraction (`windows/lib/aw-transport.psm1`) for queue, retry, breaker.
+4. Policy cache and validation.
+5. Chaos test scripts and runbook.
+
+---
+
+## Deliverables checklist
+
+- [ ] Transport queue implementation in both collectors.
+- [ ] Payload schema update with `eventId`.
+- [ ] Dedupe contract documented for server side.
+- [ ] Metrics fields added to heartbeat/logs.
+- [ ] Circuit breaker implemented.
+- [ ] Watcher auto-recreate implemented.
+- [ ] Last-known-good policy implemented.
+- [ ] Chaos test runbook and results.
+- [ ] SLO/error budget document adopted.

install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1

@@ -1,4 +1,4 @@
-[CmdletBinding()]
+[CmdletBinding()]
 param(
     [string]$ConfigPath = 'C:\ProgramData\AWatch-rus\deployment-config.json',
     [string]$ServerHost,
@@ -516,6 +516,35 @@ function Test-LooksLikeMojibakeQuestionMarks {
     return $Value -match '\?{2,}'
 }
 
+function Test-IsGenericDocumentName {
+    param([AllowNull()][string]$Value)
+    if ([string]::IsNullOrWhiteSpace($Value)) { return $true }
+    $generic = @(
+        '^\s*Печать документа\s*$',
+        '^\s*Print Document\s*$',
+        '^\s*Document\s*$',
+        '^\s*Документ\s*$',
+        '^\s*Remote Downlevel Document\s*$',
+        '^\s*Local Downlevel Document\s*$',
+        '^\s*Untitled\s*$',
+        '^\s*Без имени\s*$',
+        '^\s*Без названия\s*$'
+    )
+    foreach ($pattern in $generic) {
+        if ($Value -match $pattern) { return $true }
+    }
+    return $false
+}
+
+function Test-NeedsBetterDocumentName {
+    param([AllowNull()][string]$Value)
+    if ([string]::IsNullOrWhiteSpace($Value)) { return $true }
+    if (Test-LooksLikeMojibakeQuestionMarks -Value $Value) { return $true }
+    if (Test-IsGenericDocumentName -Value $Value) { return $true }
+    if ($Value -match '^[0-9]+$') { return $true }
+    return $false
+}
+
 function Normalize-OwnerForMatch {
     param([AllowNull()][string]$Value)
     if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
@@ -602,7 +631,7 @@ function Get-PrintServiceDocumentFallback {
     )
 
     $preferred = [string]$EventSummary.DocumentName
-    if (-not (Test-LooksLikeMojibakeQuestionMarks -Value $preferred) -and $preferred -notmatch '^[0-9]+$') {
+    if (-not (Test-NeedsBetterDocumentName -Value $preferred)) {
         return $preferred
     }
 
@@ -615,17 +644,13 @@ function Get-PrintServiceDocumentFallback {
         if ($candidate -eq $preferred) { continue }
         if ($Owner -and $candidate -like "*$Owner*") { continue }
         if ($PrinterName -and $candidate -like "*$PrinterName*") { continue }
-        if (Test-LooksLikeMojibakeQuestionMarks -Value $candidate) { continue }
+        if (Test-NeedsBetterDocumentName -Value $candidate) { continue }
 
         if ($candidate -match '[\\/:]' -and $candidate -match '\.[A-Za-z0-9]{1,8}$') {
             $pathCandidates.Add($candidate)
             continue
         }
 
-        if ($candidate -match '^[0-9]+$') {
-            continue
-        }
-
         $textCandidates.Add($candidate)
     }
 
@@ -755,8 +780,6 @@ $script:SeenPrintJob = @{}
 $script:SeenPrintEvent = @{}
 $script:LastClipboardHash = $null
 $script:PulseSeconds = [Math]::Max($resolvedPollSeconds * 3, 30)
-$script:SelfTestIntervalSeconds = [Math]::Max($resolvedPollSeconds * 10, 60)
-$script:LastSelfTestAt = [datetime]::MinValue
 $script:LocalAgentLogsEnabled = $resolvedLocalAgentLogsEnabled
 $script:LogPath = $resolvedLogPath
 $script:IncidentArtifactsRoot = $resolvedIncidentArtifactsRoot
@@ -768,15 +791,6 @@ Write-EndpointLog ("endpoint collector started against {0}" -f $script:ApiBase)
 
 while ($true) {
     try {
-        $nowUtc = (Get-Date).ToUniversalTime()
-        if (($nowUtc - $script:LastSelfTestAt).TotalSeconds -ge $script:SelfTestIntervalSeconds) {
-            Send-EndpointSignalHeartbeat -SignalType 'self_test' -Data @{
-                collector = 'dlp-endpoint-signals'
-                policyEnabled = [bool]$script:Policy.defaults.enabled
-            }
-            $script:LastSelfTestAt = $nowUtc
-        }
-
         if (-not $script:Policy.defaults.enabled) {
             Start-Sleep -Seconds $resolvedPollSeconds
             continue
@@ -834,12 +848,12 @@ while ($true) {
                 if ($script:SeenPrintJob.ContainsKey($jobId)) { continue }
                 $script:SeenPrintJob[$jobId] = (Get-Date).ToUniversalTime()
 
-                $printerName = [string]$job.Name
+                $printerName = Normalize-PrinterForMatch -Value ([string]$job.Name)
                 $documentName = [string]$job.Document
                 $owner = [string]$job.Owner
                 $documentNameOriginal = $documentName
 
-                if (Test-LooksLikeMojibakeQuestionMarks -Value $documentName) {
+                if (Test-NeedsBetterDocumentName -Value $documentName) {
                     $eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -Owner $owner -PrinterName $printerName
                     if ($eventDocumentName) {
                         $documentName = $eventDocumentName

install-kit-awindows-20260427-211240/windows/worktime-session-collector.ps1

@@ -98,13 +98,6 @@ function Get-SessionRecords {
     return $records
 }
 
-function Test-SessionIsActive {
-    param([AllowNull()][string]$State)
-    if ([string]::IsNullOrWhiteSpace($State)) { return $false }
-    $s = $State.Trim().ToLowerInvariant()
-    return ($s -eq 'active') -or ($s -like 'актив*')
-}
-
 $cfg = Get-Config -Path $ConfigPath
 $hostValue = if ($Hostname) { $Hostname } else { [string]$env:COMPUTERNAME }
 $apiBase = '{0}://{1}:{2}/api/0' -f [string]$cfg.server.scheme, [string]$cfg.server.host, [string]$cfg.server.port
@@ -144,7 +137,7 @@ while ($true) {
                 sessionId   = [int]$rec.sessionId
                 sessionName = [string]$rec.sessionName
                 state       = [string]$rec.state
-                active      = (Test-SessionIsActive -State ([string]$rec.state))
+                active      = ($rec.state -match 'Active')
                 hostname    = $hostValue
                 source      = 'worktime-session-collector'
             }

proxmox/create-ct.sh

@@ -1,5 +1,4 @@
 #!/bin/sh
-# shellcheck disable=SC1007
 set -eu
 
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

proxmox/push-aw-artifacts.sh

@@ -1,5 +1,4 @@
 #!/bin/sh
-# shellcheck disable=SC1007
 set -eu
 
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

scripts/check_install_kit_vs_repo.sh

@@ -4,7 +4,6 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT_DIR"
 
-# shellcheck disable=SC2034
 KIT_DIR="install-kit-awindows-20260427-211240"
 
 python - <<'PY'

scripts/install_aw_linux_remote_worker.sh

@@ -49,7 +49,6 @@ while [ "$#" -gt 0 ]; do
     esac
 done
 
-# shellcheck disable=SC1007
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 
 sh "${SCRIPT_DIR}/install_aw_linux_client.sh" \

scripts/prod_rollout.sh

@@ -21,11 +21,9 @@ prompt_secret() {
   if [[ -n "${!var_name:-}" ]]; then
     return 0
   fi
-  local _val
+  read -r -s -p "${prompt}: " "$var_name"
-  read -r -s -p "${prompt}: " _val
   echo
-  printf -v "$var_name" '%s' "$_val"
+  export "$var_name"
-  declare -gx "$var_name"
 }
 
 require_cmd git

scripts/validate_install_kit.sh

@@ -6,10 +6,7 @@ cd "$ROOT_DIR"
 
 KIT_DIR="install-kit-awindows-20260427-211240"
 MANIFEST="$KIT_DIR/MANIFEST.txt"
-# ZIP/TAR variables are declared for archive checks in this script; keep them for clarity
-# shellcheck disable=SC2034
 ZIP_ARCHIVE="install-kit-awindows-20260427-211240.zip"
-# shellcheck disable=SC2034
 TAR_ARCHIVE="install-kit-awindows-20260427-211240.tar.gz"
 
 required_files=(

windows/dlp-endpoint-signals-collector.ps1

@@ -1,4 +1,4 @@
-[CmdletBinding()]
+[CmdletBinding()]
 param(
     [string]$ConfigPath = 'C:\ProgramData\AWatch-rus\deployment-config.json',
     [string]$ServerHost,
@@ -33,6 +33,66 @@ function Write-EndpointLog {
     }
 }
 
+
+function Get-NewEventId { return ([guid]::NewGuid().ToString()) }
+
+function Initialize-TransportQueue {
+    param([Parameter(Mandatory = $true)][string]$QueuePath)
+    $script:QueuePath = $QueuePath
+    try {
+        $dir = Split-Path -Path $QueuePath -Parent
+        if ($dir -and -not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
+        if (-not (Test-Path -LiteralPath $QueuePath)) { New-Item -ItemType File -Path $QueuePath -Force | Out-Null }
+    }
+    catch {
+        Write-EndpointLog ("Queue init error: {0}" -f $_.Exception.Message)
+    }
+}
+
+function Add-TransportQueueRecord {
+    param([string]$Uri,[string]$Json)
+    if (-not $script:QueuePath) { return }
+    $record = @{ id = (Get-NewEventId); createdAt = (Get-Date).ToUniversalTime().ToString('o'); uri = $Uri; payload = $Json }
+    Add-Content -LiteralPath $script:QueuePath -Value ($record | ConvertTo-Json -Compress)
+    $script:TransportStats.eventsEnqueued++
+}
+
+function Get-QueueDepth {
+    if (-not $script:QueuePath -or -not (Test-Path -LiteralPath $script:QueuePath)) { return 0 }
+    return @((Get-Content -LiteralPath $script:QueuePath)).Count
+}
+
+function Send-WithQueue {
+    param([string]$Uri,[string]$Json)
+    Add-TransportQueueRecord -Uri $Uri -Json $Json
+    Try-FlushTransportQueue -MaxItems 20
+}
+
+function Try-FlushTransportQueue {
+    param([int]$MaxItems = 20)
+    if (-not $script:QueuePath -or -not (Test-Path -LiteralPath $script:QueuePath)) { return }
+    $lines = @(Get-Content -LiteralPath $script:QueuePath)
+    if ($lines.Count -eq 0) { return }
+    $remaining = New-Object System.Collections.Generic.List[string]
+    $sent = 0
+    foreach ($line in $lines) {
+        if ($sent -ge $MaxItems) { $remaining.Add($line); continue }
+        try { $rec = $line | ConvertFrom-Json } catch { $remaining.Add($line); continue }
+        if (Invoke-AwJsonPost -Uri ([string]$rec.uri) -Json ([string]$rec.payload)) {
+            $script:TransportStats.eventsSent++
+            $script:TransportStats.lastSendStatus = 'ok'
+            $sent++
+        }
+        else {
+            $script:TransportStats.sendFailures++
+            $script:TransportStats.lastSendStatus = 'failed'
+            $remaining.Add($line)
+            break
+        }
+    }
+    Set-Content -LiteralPath $script:QueuePath -Value $remaining
+}
+
 function Invoke-AwJsonPost {
     param(
         [Parameter(Mandatory = $true)][string]$Uri,
@@ -40,7 +100,14 @@ function Invoke-AwJsonPost {
     )
 
     $bytes = [Text.Encoding]::UTF8.GetBytes($Json)
-    Invoke-RestMethod -Method Post -Uri $Uri -ContentType 'application/json; charset=utf-8' -Body $bytes -TimeoutSec 15 -DisableKeepAlive | Out-Null
+    try {
+        Invoke-RestMethod -Method Post -Uri $Uri -ContentType 'application/json; charset=utf-8' -Body $bytes | Out-Null
+        return $true
+    }
+    catch {
+        Write-EndpointLog ("POST Error: {0}" -f $_.Exception.Message)
+        return $false
+    }
 }
 
 function Ensure-Bucket {
@@ -54,13 +121,21 @@ function Ensure-Bucket {
         return
     }
 
+    try {
+        Invoke-RestMethod -Method Get -Uri "$($script:ApiBase)/buckets/$BucketId" | Out-Null
+        $script:KnownBuckets[$BucketId] = $true
+        return
+    }
+    catch {
+    }
+
     $body = @{
         client   = $ClientName
         type     = $BucketType
         hostname = $script:Hostname
     } | ConvertTo-Json -Compress
 
-    Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$BucketId" -Json $body
+    Send-WithQueue -Uri "$($script:ApiBase)/buckets/$BucketId" -Json $body
     $script:KnownBuckets[$BucketId] = $true
 }
 
@@ -77,6 +152,8 @@ function Send-EndpointSignalHeartbeat {
         timestamp = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
         duration  = 0
         data      = @{
+            eventId    = (Get-NewEventId)
+            eventCreatedAt = (Get-Date).ToUniversalTime().ToString('o')
             signalType = $SignalType
             username   = $env:USERNAME
             sessionId  = $script:SessionId
@@ -85,7 +162,7 @@ function Send-EndpointSignalHeartbeat {
         } + $Data
     } | ConvertTo-Json -Depth 6 -Compress
 
-    Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$script:PulseSeconds" -Json $payload
+    Send-WithQueue -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$script:PulseSeconds" -Json $payload
 }
 
 function Send-DlpIncidentHeartbeat {
@@ -114,6 +191,8 @@ function Send-DlpIncidentHeartbeat {
         timestamp = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
         duration  = 0
         data      = @{
+            eventId   = (Get-NewEventId)
+            eventCreatedAt = (Get-Date).ToUniversalTime().ToString('o')
             ruleId    = $RuleId
             action    = $Action
             severity  = $Severity
@@ -126,7 +205,7 @@ function Send-DlpIncidentHeartbeat {
         } + $Data + $captureData
     } | ConvertTo-Json -Depth 7 -Compress
 
-    Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$script:PulseSeconds" -Json $payload
+    Send-WithQueue -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=$script:PulseSeconds" -Json $payload
 }
 
 function Get-FileSha256Hex {
@@ -224,6 +303,10 @@ function Show-EnforcementNotification {
         [Parameter(Mandatory = $true)][string]$Title,
         [Parameter(Mandatory = $true)][string]$Body
     )
+    if ($script:HeadlessMode) {
+        Write-EndpointLog ("headless mode: skip notification title={0}" -f $Title)
+        return $false
+    }
     try {
         Add-Type -AssemblyName System.Windows.Forms -ErrorAction SilentlyContinue
         $icon = New-Object System.Windows.Forms.NotifyIcon
@@ -235,9 +318,11 @@ function Show-EnforcementNotification {
         $icon.ShowBalloonTip(5000)
         Start-Sleep -Milliseconds 200
         $icon.Dispose()
+        return $true
     }
     catch {
         Write-EndpointLog ("notification failed: {0}" -f $_.Exception.Message)
+        return $false
     }
 }
 
@@ -424,6 +509,9 @@ function Evaluate-ClipboardRules {
         [string]$ClipboardText,
         [string]$ClipboardHash
     )
+    if ([string]::IsNullOrEmpty($ClipboardText) -or [string]::IsNullOrEmpty($ClipboardHash)) {
+        return
+    }
 
     foreach ($rule in @($script:Policy.endpoint.clipboard)) {
         if (-not $rule) { continue }
@@ -454,8 +542,13 @@ function Evaluate-ClipboardRules {
 
         $enforced = $false
         if ($action -eq 'block') {
-            $enforced = Invoke-ClipboardEnforcement
+            if ($script:HeadlessMode) {
-            Show-EnforcementNotification -Title 'DLP: буфер обмена очищен' -Body $message
+                Write-EndpointLog ("headless fallback: clipboard rule={0} requires block, skipped interactive enforcement" -f $ruleId)
+            }
+            else {
+                $enforced = Invoke-ClipboardEnforcement
+                [void](Show-EnforcementNotification -Title 'DLP: буфер обмена очищен' -Body $message)
+            }
         }
 
         Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'clipboard' -Data @{
@@ -489,8 +582,13 @@ function Evaluate-UsbRules {
 
         $enforced = $false
         if ($action -eq 'block') {
-            $enforced = Invoke-UsbWriteBlockEnforcement -DriveLetter $DriveLetter
+            if ($script:HeadlessMode) {
-            Show-EnforcementNotification -Title 'DLP: USB заблокирован для записи' -Body $message
+                Write-EndpointLog ("headless fallback: usb rule={0} requires block, skipped interactive enforcement drive={1}" -f $ruleId, $DriveLetter)
+            }
+            else {
+                $enforced = Invoke-UsbWriteBlockEnforcement -DriveLetter $DriveLetter
+                [void](Show-EnforcementNotification -Title 'DLP: USB заблокирован для записи' -Body $message)
+            }
         }
 
         Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'usb_insert' -Data @{
@@ -534,8 +632,13 @@ function Evaluate-PrintRules {
 
         $enforced = $false
         if ($action -eq 'block') {
-            $enforced = Invoke-PrintJobEnforcement -PrinterName $PrinterName -DocumentName $DocumentName -Owner $Owner
+            if ($script:HeadlessMode) {
-            Show-EnforcementNotification -Title 'DLP: печать заблокирована' -Body $message
+                Write-EndpointLog ("headless fallback: print rule={0} requires block, skipped interactive enforcement printer={1}" -f $ruleId, $PrinterName)
+            }
+            else {
+                $enforced = Invoke-PrintJobEnforcement -PrinterName $PrinterName -DocumentName $DocumentName -Owner $Owner
+                [void](Show-EnforcementNotification -Title 'DLP: печать заблокирована' -Body $message)
+            }
         }
 
         Send-DlpIncidentHeartbeat -RuleId $ruleId -Action $action -Severity $severity -Message $message -SignalType 'print_job' -Data @{
@@ -554,6 +657,35 @@ function Test-LooksLikeMojibakeQuestionMarks {
     return $Value -match '\?{2,}'
 }
 
+function Test-IsGenericDocumentName {
+    param([AllowNull()][string]$Value)
+    if ([string]::IsNullOrWhiteSpace($Value)) { return $true }
+    $generic = @(
+        '^\s*Печать документа\s*$',
+        '^\s*Print Document\s*$',
+        '^\s*Document\s*$',
+        '^\s*Документ\s*$',
+        '^\s*Remote Downlevel Document\s*$',
+        '^\s*Local Downlevel Document\s*$',
+        '^\s*Untitled\s*$',
+        '^\s*Без имени\s*$',
+        '^\s*Без названия\s*$'
+    )
+    foreach ($pattern in $generic) {
+        if ($Value -match $pattern) { return $true }
+    }
+    return $false
+}
+
+function Test-NeedsBetterDocumentName {
+    param([AllowNull()][string]$Value)
+    if ([string]::IsNullOrWhiteSpace($Value)) { return $true }
+    if (Test-LooksLikeMojibakeQuestionMarks -Value $Value) { return $true }
+    if (Test-IsGenericDocumentName -Value $Value) { return $true }
+    if ($Value -match '^[0-9]+$') { return $true }
+    return $false
+}
+
 function Normalize-OwnerForMatch {
     param([AllowNull()][string]$Value)
     if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
@@ -640,7 +772,7 @@ function Get-PrintServiceDocumentFallback {
     )
 
     $preferred = [string]$EventSummary.DocumentName
-    if (-not (Test-LooksLikeMojibakeQuestionMarks -Value $preferred) -and $preferred -notmatch '^[0-9]+$') {
+    if (-not (Test-NeedsBetterDocumentName -Value $preferred)) {
         return $preferred
     }
 
@@ -653,17 +785,13 @@ function Get-PrintServiceDocumentFallback {
         if ($candidate -eq $preferred) { continue }
         if ($Owner -and $candidate -like "*$Owner*") { continue }
         if ($PrinterName -and $candidate -like "*$PrinterName*") { continue }
-        if (Test-LooksLikeMojibakeQuestionMarks -Value $candidate) { continue }
+        if (Test-NeedsBetterDocumentName -Value $candidate) { continue }
 
         if ($candidate -match '[\\/:]' -and $candidate -match '\.[A-Za-z0-9]{1,8}$') {
             $pathCandidates.Add($candidate)
             continue
         }
 
-        if ($candidate -match '^[0-9]+$') {
-            continue
-        }
-
         $textCandidates.Add($candidate)
     }
 
@@ -762,6 +890,7 @@ function Get-BetterDocumentNameFromPrintServiceEvents {
         }
     }
     catch {
+        Write-EndpointLog ("printservice fallback failed: {0}" -f $_.Exception.Message)
     }
 
     return $null
@@ -793,28 +922,25 @@ $script:SeenPrintJob = @{}
 $script:SeenPrintEvent = @{}
 $script:LastClipboardHash = $null
 $script:PulseSeconds = [Math]::Max($resolvedPollSeconds * 3, 30)
-$script:SelfTestIntervalSeconds = [Math]::Max($resolvedPollSeconds * 10, 60)
-$script:LastSelfTestAt = [datetime]::MinValue
 $script:LocalAgentLogsEnabled = $resolvedLocalAgentLogsEnabled
 $script:LogPath = $resolvedLogPath
 $script:IncidentArtifactsRoot = $resolvedIncidentArtifactsRoot
 $script:IncidentScreenshotEnabled = $resolvedIncidentScreenshotEnabled
 $script:ScreenshotTypesLoaded = $false
+$script:TransportStats = @{ eventsEnqueued = 0; eventsSent = 0; sendFailures = 0; lastSendStatus = 'init' }
+$script:QueuePath = $null
+
+$queueFile = Join-Path $resolvedLogsRoot ("endpoint-queue-{0}.jsonl" -f $env:USERNAME)
+Initialize-TransportQueue -QueuePath $queueFile
 
 Load-DlpPolicy -Path $resolvedPolicyPath
 Write-EndpointLog ("endpoint collector started against {0}" -f $script:ApiBase)
+if ($script:HeadlessMode) {
+    Write-EndpointLog "headless mode enabled: enforcement UI is disabled, incident heartbeat and logs only"
+}
 
 while ($true) {
     try {
-        $nowUtc = (Get-Date).ToUniversalTime()
-        if (($nowUtc - $script:LastSelfTestAt).TotalSeconds -ge $script:SelfTestIntervalSeconds) {
-            Send-EndpointSignalHeartbeat -SignalType 'self_test' -Data @{
-                collector = 'dlp-endpoint-signals'
-                policyEnabled = [bool]$script:Policy.defaults.enabled
-            }
-            $script:LastSelfTestAt = $nowUtc
-        }
-
         if (-not $script:Policy.defaults.enabled) {
             Start-Sleep -Seconds $resolvedPollSeconds
             continue
@@ -835,6 +961,7 @@ while ($true) {
             }
         }
         catch {
+            Write-EndpointLog ("clipboard poll failed: {0}" -f $_.Exception.Message)
         }
 
         try {
@@ -862,6 +989,7 @@ while ($true) {
             }
         }
         catch {
+            Write-EndpointLog ("usb poll failed: {0}" -f $_.Exception.Message)
         }
 
         try {
@@ -872,23 +1000,33 @@ while ($true) {
                 if ($script:SeenPrintJob.ContainsKey($jobId)) { continue }
                 $script:SeenPrintJob[$jobId] = (Get-Date).ToUniversalTime()
 
-                $printerName = [string]$job.Name
+                $printerName = Normalize-PrinterForMatch -Value ([string]$job.Name)
                 $documentName = [string]$job.Document
                 $owner = [string]$job.Owner
                 $documentNameOriginal = $documentName
 
-                if (Test-LooksLikeMojibakeQuestionMarks -Value $documentName) {
+                if (Test-NeedsBetterDocumentName -Value $documentName) {
                     $eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -Owner $owner -PrinterName $printerName
                     if ($eventDocumentName) {
                         $documentName = $eventDocumentName
                     }
                 }
+                $printDocumentNorm = if ($documentName) { [string]$documentName } else { '' }
+                $printSignalKey = ('{0}|{1}|{2}|{3}' -f
+                    (Normalize-PrinterForMatch -Value $printerName),
+                    (Normalize-OwnerForMatch -Value $owner),
+                    $printDocumentNorm.ToLowerInvariant(),
+                    'print_job')
+                if (-not (Should-EmitByCooldown -Fingerprint $printSignalKey -CooldownSeconds 90)) {
+                    continue
+                }
 
                 Send-EndpointSignalHeartbeat -SignalType 'print_job' -Data @{
                     printerName  = $printerName
                     documentName = $documentName
                     documentNameOriginal = $documentNameOriginal
                     owner        = $owner
+                    eventSource  = 'win32_printjob'
                 }
                 Evaluate-PrintRules -PrinterName $printerName -DocumentName $documentName -Owner $owner
             }
@@ -902,6 +1040,7 @@ while ($true) {
             }
         }
         catch {
+            Write-EndpointLog ("printjob poll failed: {0}" -f $_.Exception.Message)
         }
 
         try {
@@ -929,6 +1068,17 @@ while ($true) {
                     continue
                 }
 
+                $effectiveDocument = if ($resolvedDocument) { [string]$resolvedDocument } else { [string]$documentName }
+                $printSignalKey = ('{0}|{1}|{2}|{3}' -f
+                    (Normalize-PrinterForMatch -Value $printerName),
+                    (Normalize-OwnerForMatch -Value $owner),
+                    $effectiveDocument.ToLowerInvariant(),
+                    'print_job')
+                if (-not (Should-EmitByCooldown -Fingerprint $printSignalKey -CooldownSeconds 90)) {
+                    Write-PrintServiceEventTrace -EventSummary $summary -Phase 'skip' -MatchReason 'dedupe-recent-printjob' -ResolvedDocument $resolvedDocument
+                    continue
+                }
+
                 Send-EndpointSignalHeartbeat -SignalType 'print_job' -Data @{
                     printerName  = $printerName
                     documentName = if ($resolvedDocument) { $resolvedDocument } else { $documentName }
@@ -949,11 +1099,14 @@ while ($true) {
             }
         }
         catch {
+            Write-EndpointLog ("printservice poll failed: {0}" -f $_.Exception.Message)
         }
     }
     catch {
         Write-EndpointLog ("collector error: {0}" -f $_.Exception.Message)
     }
 
+    Try-FlushTransportQueue -MaxItems 50
+    Write-EndpointLog ("transport metrics queueDepth={0} enqueued={1} sent={2} failures={3} lastStatus={4}" -f (Get-QueueDepth), $script:TransportStats.eventsEnqueued, $script:TransportStats.eventsSent, $script:TransportStats.sendFailures, $script:TransportStats.lastSendStatus)
     Start-Sleep -Seconds $resolvedPollSeconds
 }

windows/file-operations-collector.ps1

@@ -26,6 +26,8 @@ $script:SessionId = [System.Diagnostics.Process]::GetCurrentProcess().SessionId
 # Настройка логирования
 $script:LogPath = $LogPath
 $script:LocalAgentLogsEnabled = [bool]$LogPath
+$script:TransportStats = @{ eventsEnqueued = 0; eventsSent = 0; sendFailures = 0; lastSendStatus = 'init' }
+$script:QueuePath = $null
 
 function Get-DeploymentConfig {
     param([string]$Path)
@@ -43,29 +45,89 @@ function Write-FileCollectorLog {
     } catch {}
 }
 
+
+function Get-NewEventId { return ([guid]::NewGuid().ToString()) }
+
+function Initialize-TransportQueue {
+    param([Parameter(Mandatory = $true)][string]$QueuePath)
+    $script:QueuePath = $QueuePath
+    try {
+        $dir = Split-Path -Path $QueuePath -Parent
+        if ($dir -and -not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
+        if (-not (Test-Path -LiteralPath $QueuePath)) { New-Item -ItemType File -Path $QueuePath -Force | Out-Null }
+    } catch {
+        Write-FileCollectorLog "Queue init error: $($_.Exception.Message)"
+    }
+}
+
+function Add-TransportQueueRecord {
+    param([string]$Uri,[string]$Json)
+    if (-not $script:QueuePath) { return }
+    $record = @{ id = (Get-NewEventId); createdAt = (Get-Date).ToUniversalTime().ToString('o'); uri = $Uri; payload = $Json }
+    Add-Content -LiteralPath $script:QueuePath -Value ($record | ConvertTo-Json -Compress)
+    $script:TransportStats.eventsEnqueued++
+}
+
+function Get-QueueDepth {
+    if (-not $script:QueuePath -or -not (Test-Path -LiteralPath $script:QueuePath)) { return 0 }
+    return @((Get-Content -LiteralPath $script:QueuePath)).Count
+}
+
+function Try-FlushTransportQueue {
+    param([int]$MaxItems = 20)
+    if (-not $script:QueuePath -or -not (Test-Path -LiteralPath $script:QueuePath)) { return }
+    $lines = @(Get-Content -LiteralPath $script:QueuePath)
+    if ($lines.Count -eq 0) { return }
+    $remaining = New-Object System.Collections.Generic.List[string]
+    $sentInRun = 0
+    foreach ($line in $lines) {
+        if ($sentInRun -ge $MaxItems) { $remaining.Add($line); continue }
+        try { $rec = $line | ConvertFrom-Json } catch { $remaining.Add($line); continue }
+        if (Invoke-AwJsonPost -Uri ([string]$rec.uri) -Json ([string]$rec.payload)) {
+            $script:TransportStats.eventsSent++
+            $script:TransportStats.lastSendStatus = 'ok'
+            $sentInRun++
+        } else {
+            $script:TransportStats.sendFailures++
+            $script:TransportStats.lastSendStatus = 'failed'
+            $remaining.Add($line)
+            break
+        }
+    }
+    if ($sentInRun -lt $lines.Count) {
+        for ($i=$sentInRun+($lines.Count-$remaining.Count); $i -lt $lines.Count; $i++) { }
+    }
+    Set-Content -LiteralPath $script:QueuePath -Value $remaining
+}
+
+function Send-WithQueue {
+    param([string]$Uri,[string]$Json)
+    Add-TransportQueueRecord -Uri $Uri -Json $Json
+    Try-FlushTransportQueue -MaxItems 10
+}
+
 function Invoke-AwJsonPost {
     param(
         [Parameter(Mandatory = $true)][string]$Uri,
         [Parameter(Mandatory = $true)][string]$Json
     )
-    $httpClient = $null
+    $httpClient = New-Object System.Net.Http.HttpClient
     try {
-        $httpClient = New-Object System.Net.Http.HttpClient
         $content = New-Object System.Net.Http.StringContent($Json, [System.Text.Encoding]::UTF8, "application/json")
         $response = $httpClient.PostAsync($Uri, $content).Result
         if (-not $response.IsSuccessStatusCode) {
-            $status = [int]$response.StatusCode
+            $statusCode = [int]$response.StatusCode
             $reason = [string]$response.ReasonPhrase
-            $body = $response.Content.ReadAsStringAsync().Result
+            $responseBody = $response.Content.ReadAsStringAsync().Result
-            Write-FileCollectorLog ("POST failed: uri={0} status={1} reason={2} body={3}" -f $Uri, $status, $reason, $body)
+            Write-FileCollectorLog ("POST failed uri={0} status={1} reason={2} body={3}" -f $Uri, $statusCode, $reason, $responseBody)
         }
     } catch {
         Write-FileCollectorLog "POST Error: $($_.Exception.Message)"
+        return $false
     } finally {
-        if ($null -ne $httpClient) {
+        $httpClient.Dispose()
-            $httpClient.Dispose()
-        }
     }
+    return $response.IsSuccessStatusCode
 }
 
 function Ensure-Bucket {
@@ -92,19 +154,7 @@ function Ensure-Bucket {
         type     = $BucketType
         hostname = $script:Hostname
     } | ConvertTo-Json -Compress
-
+    Send-WithQueue -Uri "$($script:ApiBase)/buckets/$BucketId" -Json $body
-    try {
-        Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$BucketId" -Json $body
-    }
-    catch {
-        try {
-            Invoke-RestMethod -Method Get -Uri "$($script:ApiBase)/buckets/$BucketId" | Out-Null
-        }
-        catch {
-            Write-FileCollectorLog "Bucket create/check failed for ${BucketId}: $($_.Exception.Message)"
-            throw
-        }
-    }
     $script:KnownBuckets[$BucketId] = $true
 }
 
@@ -120,6 +170,9 @@ function Send-FileOperationEvent {
     Ensure-Bucket -BucketId $bucketId -ClientName 'aw-file-operations' -BucketType 'aw.file.operation'
 
     $data = @{
+        eventId   = (Get-NewEventId)
+        eventCreatedAt = (Get-Date).ToUniversalTime().ToString('o')
+
         operation = $Operation
         path      = $FilePath
         extension = [System.IO.Path]::GetExtension($FilePath)
@@ -140,7 +193,7 @@ function Send-FileOperationEvent {
         data      = $data
     } | ConvertTo-Json -Depth 5 -Compress
 
-    Invoke-AwJsonPost -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=15" -Json $payload
+    Send-WithQueue -Uri "$($script:ApiBase)/buckets/$bucketId/heartbeat?pulsetime=15" -Json $payload
 }
 
 $config = Get-DeploymentConfig -Path $ConfigPath
@@ -151,6 +204,9 @@ $hostName = if ($ServerHost) { $ServerHost } elseif ($config.server.host) { $con
 $port = if ($ServerPort) { $ServerPort } elseif ($config.server.port) { $config.server.port } else { 5600 }
 $script:ApiBase = "{0}://{1}:{2}/api/0" -f $scheme, $hostName, $port
 
+$queueFile = Join-Path ([System.IO.Path]::GetDirectoryName($script:LogPath)) ("file-collector-queue-{0}.jsonl" -f $env:USERNAME)
+Initialize-TransportQueue -QueuePath $queueFile
+
 $bucketId = 'aw-file-operations_' + $script:Hostname
 Ensure-Bucket -BucketId $bucketId -ClientName 'aw-file-operations' -BucketType 'aw.file.operation'
 
@@ -197,7 +253,7 @@ foreach ($path in $resolvedPaths) {
     $onRenamed = Register-ObjectEvent $watcher "Renamed" -Action {
         Send-FileOperationEvent -Operation 'Renamed' -FilePath $Event.SourceEventArgs.FullPath -OldFilePath $Event.SourceEventArgs.OldFullPath
     }
-    
+    $subscriptions += @($onChanged, $onDeleted, $onRenamed)
     $watchers += $watcher
     $subscriptions += @($onChanged, $onDeleted, $onRenamed)
 }
@@ -206,18 +262,18 @@ Write-FileCollectorLog "Collector started. Waiting for events..."
 
 try {
     while ($true) {
+        Try-FlushTransportQueue -MaxItems 50
+        Write-FileCollectorLog ("transport metrics queueDepth={0} enqueued={1} sent={2} failures={3} lastStatus={4}" -f (Get-QueueDepth), $script:TransportStats.eventsEnqueued, $script:TransportStats.eventsSent, $script:TransportStats.sendFailures, $script:TransportStats.lastSendStatus)
         Start-Sleep -Seconds $PollSeconds
     }
 }
 finally {
     Write-FileCollectorLog "Stopping collector..."
     foreach ($sub in @($subscriptions)) {
-        try {
+        if ($null -ne $sub) {
-            if ($sub -and $sub.Id) {
+            try { Unregister-Event -SubscriptionId $sub.Id -ErrorAction SilentlyContinue } catch {}
-                Unregister-Event -SubscriptionId $sub.Id -ErrorAction SilentlyContinue
+            try { Remove-Job -Id $sub.Id -Force -ErrorAction SilentlyContinue } catch {}
-                Remove-Job -Id $sub.Id -Force -ErrorAction SilentlyContinue
+        }
-            }
-        } catch {}
     }
     foreach ($w in $watchers) {
         $w.EnableRaisingEvents = $false

windows/worktime-session-collector.ps1

@@ -103,13 +103,6 @@ function Get-SessionRecords {
     return $records
 }
 
-function Test-SessionIsActive {
-    param([AllowNull()][string]$State)
-    if ([string]::IsNullOrWhiteSpace($State)) { return $false }
-    $s = $State.Trim().ToLowerInvariant()
-    return ($s -eq 'active') -or ($s -like 'актив*')
-}
-
 $cfg = Get-Config -Path $ConfigPath
 $hostValue = if ($Hostname) { $Hostname } else { [string]$env:COMPUTERNAME }
 $apiBase = '{0}://{1}:{2}/api/0' -f [string]$cfg.server.scheme, [string]$cfg.server.host, [string]$cfg.server.port
@@ -149,7 +142,7 @@ while ($true) {
                 sessionId   = [int]$rec.sessionId
                 sessionName = [string]$rec.sessionName
                 state       = [string]$rec.state
-                active      = (Test-SessionIsActive -State ([string]$rec.state))
+                active      = ($rec.state -match 'Active')
                 hostname    = $hostValue
                 source      = 'worktime-session-collector'
             }