feat: Harden against tampering; add protected install and quiet SYSTEM updates (v1.5.0)

Tamper resistance:
- Relocate monitor.db and events.log to %ProgramData%\SystemHelper and have the
  GameHost watchdog lock them (deny-delete + OWNER RIGHTS cap) so a standard user
  cannot delete usage history or logs even while DeviceMon is closed.
- Keep SYSTEM-only backups and auto-restore the database / DeviceMon.exe if missing.
- Reduce watchdog check interval from 15s to 5s.

Config resilience:
- A corrupt appsettings.json no longer crashes startup or the dashboard; fall back
  to a last-known-good copy and then built-in defaults. The web host no longer
  aborts on an unparseable config file.

Protected install and updates:
- Add install.ps1 to install into C:\Program Files\DeviceMon (read-only to the
  child) and optionally configure a trusted update source.
- Add quiet, admin-level updates performed by the SYSTEM watchdog from a fixed
  trusted source, triggered from the dashboard (no UAC, remote-capable, and the
  child cannot redirect the update source).

Housekeeping:
- Bump version to 1.5.0 across all projects; add RELEASE_NOTES_v1.05.md; update README.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: geogengames-hue

Data/UsageDatabase.cs

@@ -1,5 +1,6 @@
 using Microsoft.Data.Sqlite;
 using MonitorAndControl.Models;
+using MonitorAndControl.Services;
 
 namespace MonitorAndControl.Data;
 
@@ -14,11 +15,9 @@ public UsageDatabase(string? dbPath = null)
     {
         if (string.IsNullOrWhiteSpace(dbPath))
         {
-            var folder = Path.Combine(
-                Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
-                "SystemHelper");
-            Directory.CreateDirectory(folder);
-            dbPath = Path.Combine(folder, "monitor.db");
+            // SYSTEM-protected data directory (see AppPaths) - the watchdog denies
+            // Delete on monitor.db so a standard user cannot wipe usage history.
+            dbPath = AppPaths.DatabasePath;
         }
         else
         {

MonitorAndControl.csproj

@@ -14,9 +14,9 @@
     <Product>DeviceMon</Product>
     <Description>Local parental monitoring and app limit dashboard</Description>
     <AssemblyTitle>DeviceMon</AssemblyTitle>
-    <Version>1.4.0</Version>
-    <AssemblyVersion>1.4.0.0</AssemblyVersion>
-    <FileVersion>1.4.0.0</FileVersion>
+    <Version>1.5.0</Version>
+    <AssemblyVersion>1.5.0.0</AssemblyVersion>
+    <FileVersion>1.5.0.0</FileVersion>
   </PropertyGroup>
 
   <ItemGroup>

PopupHost/PopupHost.csproj

@@ -7,9 +7,9 @@
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <UseWindowsForms>true</UseWindowsForms>
-    <Version>1.4.0</Version>
-    <AssemblyVersion>1.4.0.0</AssemblyVersion>
-    <FileVersion>1.4.0.0</FileVersion>
+    <Version>1.5.0</Version>
+    <AssemblyVersion>1.5.0.0</AssemblyVersion>
+    <FileVersion>1.5.0.0</FileVersion>
   </PropertyGroup>
 
 </Project>

Program.cs

@@ -96,17 +96,72 @@ static void Main(string[] args)
     private static AppConfig LoadConfig()
     {
         var path = GetConfigPath();
+        var lkgPath = Path.Combine(AppPaths.DataDir, "appsettings.lkg.json");
 
+        // Primary source: the on-disk appsettings.json. A corrupt or unreadable
+        // file must never crash startup - a crash here just makes the watchdog
+        // relaunch DeviceMon into the same crash, disabling monitoring entirely.
         if (File.Exists(path))
         {
-            var json = File.ReadAllText(path);
-            _cachedConfig = JsonSerializer.Deserialize<AppConfig>(json) ?? new AppConfig();
-            return _cachedConfig;
+            try
+            {
+                var json = File.ReadAllText(path);
+                var config = JsonSerializer.Deserialize<AppConfig>(json)
+                    ?? throw new InvalidOperationException("Configuration deserialized to null.");
+                _cachedConfig = config;
+                SaveLastKnownGoodConfig(lkgPath, json);
+                return _cachedConfig;
+            }
+            catch (Exception ex)
+            {
+                Logger.Instance.Error($"appsettings.json is invalid ({ex.Message}); falling back to last-known-good or defaults.");
+            }
+        }
+        else
+        {
+            Logger.Instance.Warn("appsettings.json not found; using last-known-good configuration or defaults.");
         }
+
+        // Fallback 1: the last-known-good copy saved after the most recent valid load.
+        if (File.Exists(lkgPath))
+        {
+            try
+            {
+                var config = JsonSerializer.Deserialize<AppConfig>(File.ReadAllText(lkgPath));
+                if (config != null)
+                {
+                    _cachedConfig = config;
+                    Logger.Instance.Info("Loaded configuration from last-known-good backup.");
+                    return _cachedConfig;
+                }
+            }
+            catch (Exception ex)
+            {
+                Logger.Instance.Error($"Last-known-good configuration is unusable ({ex.Message}); using defaults.");
+            }
+        }
+
+        // Fallback 2: built-in defaults. Most runtime settings live in the database
+        // (which is authoritative after first run), so DeviceMon keeps working.
         _cachedConfig = new AppConfig();
         return _cachedConfig;
     }
 
+    private static void SaveLastKnownGoodConfig(string lkgPath, string json)
+    {
+        try
+        {
+            var dir = Path.GetDirectoryName(lkgPath);
+            if (!string.IsNullOrEmpty(dir))
+                Directory.CreateDirectory(dir);
+            File.WriteAllText(lkgPath, json);
+        }
+        catch (Exception ex)
+        {
+            Logger.Instance.Error($"Failed to save last-known-good configuration: {ex.Message}");
+        }
+    }
+
     private static string GetConfigPath()
     {
         var path = Path.Combine(AppContext.BaseDirectory, "appsettings.json");

README.md

@@ -78,18 +78,28 @@ Monitor & Control consists of three executables:
 
 When you run `DeviceMon.exe`, it automatically looks for `GameHost.exe` in the same folder. If the watchdog service is not installed (or needs updating), DeviceMon silently asks for administrator privileges via a UAC prompt and installs/updates it. After that:
 - The watchdog runs as a Windows service named `GameHost`
-- It checks every 15 seconds whether `DeviceMon.exe` is still running
+- It checks every 5 seconds whether `DeviceMon.exe` is still running
 - If the monitor process is missing, the watchdog relaunches it in the active user session
 - No further UAC prompts — the service runs under the SYSTEM account
 - If you ever want to remove it, see the [Watchdog uninstall](#installing-the-watchdog-optional-requires-admin) section
 
 ### Data storage
 
-- **SQLite database** at `%LOCALAPPDATA%\SystemHelper\monitor.db` — usage records, limits, schedules, app tracking policies, settings
-- **Log file** at `%LOCALAPPDATA%\SystemHelper\monitor.log`
+- **SQLite database** at `C:\ProgramData\SystemHelper\monitor.db` — usage records, limits, schedules, app tracking policies, settings
+- **Log file** at `C:\ProgramData\SystemHelper\events.log`
 - **Watchdog log** at `C:\ProgramData\SystemHelper\watchdog.log`
 - **Configuration** at `appsettings.json` (alongside the exe)
 
+> **Tamper protection:** The GameHost watchdog (running as SYSTEM) locks `monitor.db`
+> and `events.log` so a standard (child) user can read/write them but **cannot delete
+> or rename them** — closing DeviceMon no longer lets them wipe usage history. The
+> watchdog also keeps SYSTEM-only backups under `C:\ProgramData\SystemHelper\Protected\`
+> and restores the database (and `DeviceMon.exe`) if either goes missing. This
+> protection is released automatically when GameHost is uninstalled.
+>
+> *(Older installs stored these files under `%LOCALAPPDATA%\SystemHelper\`; they are
+> migrated to the protected location automatically on first launch of this version.)*
+
 ### Usage tracking modes
 
 Tracking behavior is configured independently for every process using the **Background** and **Filter overlays** columns in the Limits table. Both options are off by default. The checkboxes save immediately and do not require the application to have a daily limit.
@@ -140,7 +150,7 @@ Usage recorded by an older release has only a total and cannot be reconstructed
 
 Existing databases are upgraded automatically. Tracking policies are also included in configuration exports and restored during import.
 
-`DefaultLimits` and `Schedule` from `appsettings.json` are imported only when the SQLite database is created for the first time. After initialization, the database is authoritative: limits or schedules removed in the dashboard remain removed after restart. Delete `%LOCALAPPDATA%\SystemHelper\monitor.db` only when you intentionally want a fresh first-start import.
+`DefaultLimits` and `Schedule` from `appsettings.json` are imported only when the SQLite database is created for the first time. After initialization, the database is authoritative: limits or schedules removed in the dashboard remain removed after restart. To force a fresh first-start import, delete `C:\ProgramData\SystemHelper\monitor.db` — but note the watchdog protects this file (see [Data storage](#data-storage)), so you must first uninstall GameHost (as admin) to release the lock.
 
 ---
 
@@ -284,11 +294,43 @@ Place this file alongside `DeviceMon.exe`. All settings are optional — default
 
 > **Security note:** When remote access is enabled, remote users cannot open the dashboard until an admin password has been created from a trusted local dashboard. After setup, remote users are redirected to the login page. Successful authentication creates an HTTP-only session cookie; use **Settings → Logout** to end that browser session. The built-in dashboard listener is HTTP only; do not expose it beyond a trusted LAN unless you put it behind a TLS reverse proxy, VPN/tunnel, or a trusted local certificate setup.
 
-### Installing the Watchdog (optional, requires admin)
+### Recommended install: protected Program Files location (requires admin)
+
+For a child's PC, install DeviceMon into `C:\Program Files\DeviceMon` so the child **cannot delete or modify the application files**. Program Files grants standard users read-and-execute only, so the child can still be forced to close DeviceMon (Windows always allows ending your own process), but they cannot delete `DeviceMon.exe`, `GameHost.exe`, the DLLs, or `appsettings.json` — and the watchdog relaunches DeviceMon within ~5 seconds.
+
+```powershell
+# Run PowerShell as Administrator from the publish folder, then:
+.\install.ps1
+
+# Or specify source/target explicitly:
+.\install.ps1 -SourceDir "C:\path\to\publish" -InstallDir "C:\Program Files\DeviceMon"
+```
+
+This copies the app to the protected folder and installs the `GameHost` watchdog pointing at it. The usage database and logs stay in `C:\ProgramData\SystemHelper` (writable so usage can be recorded, but protected against deletion — see [Data storage](#data-storage)).
+
+#### Updating a Program Files install
+
+Because the app folder is read-only to standard users, the in-dashboard updater can't write to it directly. You have two options:
+
+1. **Re-run `install.ps1`** as Administrator against the new publish folder — it stops the watchdog, replaces the files, and restarts everything.
+
+2. **Quiet updates from the dashboard** (no admin prompt, works remotely) — configure a trusted update source at install time:
+
+   ```powershell
+   # HTTPS zip (SHA-256 required):
+   .\install.ps1 -UpdateSource "https://example.com/MonitorAndControl-v1.05.zip" -UpdateSha256 "<hash>"
+
+   # …or a folder / network share:
+   .\install.ps1 -UpdateSource "\\server\share\DeviceMon" -UpdateUsername "user" -UpdatePassword "pw"
+   ```
+
+   The source is stored in a SYSTEM-only file (`C:\ProgramData\SystemHelper\Protected\update-source.json`) that the child cannot read or change. When you click **Settings → Update**, the dashboard just *triggers* an update; the `GameHost` service (running as SYSTEM) performs it silently from that fixed source and relaunches DeviceMon in the child's session. Because the source is fixed, the child cannot redirect updates to malicious files — the dashboard never gets to choose where SYSTEM pulls from.
+
+### Installing only the Watchdog (optional, requires admin)
 
-**Normally you don't need to do this manually** — when you run `DeviceMon.exe`, it auto-detects `GameHost.exe` in the same folder and offers to install the watchdog service with a single UAC prompt.
+**If you are not using `install.ps1`,** you normally don't need to do this manually either — when you run `DeviceMon.exe`, it auto-detects `GameHost.exe` in the same folder and offers to install the watchdog service with a single UAC prompt.
 
-Manual install is only needed if you want to install the watchdog separately (e.g., deploying to a different folder after the fact):
+Manual watchdog install is only needed if you want to install it separately (e.g., deploying to a different folder after the fact):
 
 ```powershell
 # Run PowerShell as Administrator, then:
@@ -405,10 +447,10 @@ A: Run PowerShell **as Administrator**. The service requires elevation to create
 A: Set `EnableRemoteDashboard` to `true` in the `appsettings.json` beside `DeviceMon.exe`, then restart DeviceMon. The app binds to all LAN interfaces when remote mode is enabled. Ensure the Windows Firewall allows port 5000.
 
 **Q: How do I reset all usage data?**
-A: Delete the SQLite database at `%LOCALAPPDATA%\SystemHelper\monitor.db` while the monitor is not running. It will be recreated on next launch.
+A: The database is tamper-protected while GameHost is installed (a standard user, and even an admin, cannot delete it). To wipe it, uninstall the GameHost watchdog as administrator (this releases the lock), then delete `C:\ProgramData\SystemHelper\monitor.db` while DeviceMon is not running. It is recreated on next launch.
 
 **Q: Where are logs stored?**
-A: `%LOCALAPPDATA%\SystemHelper\monitor.log` for the main app, and `C:\ProgramData\SystemHelper\watchdog.log` for the watchdog service.
+A: `C:\ProgramData\SystemHelper\events.log` for the main app, and `C:\ProgramData\SystemHelper\watchdog.log` for the watchdog service.
 
 **Q: Can I run it without the web dashboard?**
 A: No. The web dashboard is the primary UI.
@@ -462,7 +504,7 @@ A: The **watchdog service** (`GameHost.exe`) runs under SYSTEM account and track
 A: Yes. Click the **Pause** button on the dashboard **Live** tab or from the system tray icon context menu. Click **Resume** to continue tracking.
 
 **Q: What happens when I close DeviceMon.exe?**
-A: If the watchdog is installed, it restarts DeviceMon.exe within 15 seconds. To fully stop, uninstall the watchdog first (`GameHost.exe --uninstall` as Admin), then close DeviceMon.
+A: If the watchdog is installed, it restarts DeviceMon.exe within ~5 seconds. To fully stop, uninstall the watchdog first (`GameHost.exe --uninstall` as Admin), then close DeviceMon.
 
 **Q: Does the app work offline / without internet?**
 A: Yes. The dashboard and all monitoring features work entirely locally. Only email notifications/control require internet access.

RELEASE_NOTES_v1.05.md

@@ -0,0 +1,62 @@
+# Monitor & Control v1.05
+
+## Highlights
+
+- **Tamper-resistant data.** `monitor.db` and `events.log` now live in the
+  SYSTEM-managed `C:\ProgramData\SystemHelper\` directory and are locked by the
+  GameHost watchdog so a standard (child) user can no longer delete or rename
+  them — closing DeviceMon no longer allows wiping usage history or logs.
+- **Automatic recovery.** The watchdog keeps SYSTEM-only backups under
+  `C:\ProgramData\SystemHelper\Protected\` and restores the database (and
+  `DeviceMon.exe`) if either goes missing.
+- **Faster relaunch.** The watchdog check interval was reduced from 15s to 5s,
+  shrinking the window in which a manually closed monitor stays down.
+- **Protected install location.** New `install.ps1` installs DeviceMon into
+  `C:\Program Files\DeviceMon`, where standard users have read-and-execute only -
+  the child can close DeviceMon but cannot delete or modify the application files
+  (`.exe`s, DLLs, `appsettings.json`). Re-run `install.ps1` as admin to update.
+- **Quiet SYSTEM updates for protected installs.** When a trusted update source is
+  configured (`install.ps1 -UpdateSource ...`), the dashboard **Update** button
+  queues a silent update performed by the `GameHost` service as SYSTEM - no UAC
+  prompt, works remotely, and installs into the protected folder. The source is
+  stored in a SYSTEM-only file the child cannot read or redirect, so a standard
+  user cannot point updates at malicious files.
+- **Corrupt-config resilience.** A malformed `appsettings.json` no longer crashes
+  DeviceMon or takes down the dashboard. Configuration now falls back to a
+  last-known-good backup (and then built-in defaults), and the web host no longer
+  aborts on an unparseable config file.
+
+## Fixes and hardening
+
+- Data files are protected with an explicit deny-delete ACL plus an `OWNER RIGHTS`
+  cap, so the owning user cannot re-grant themselves delete permission.
+- "Clear log" now truncates the log in place instead of deleting the file, so it
+  works alongside the deny-delete protection.
+- Executable and data restore are skipped while an update is in progress, so an
+  update never fights the watchdog.
+- Uninstalling GameHost automatically releases the protection so an administrator
+  can reset or manage the data.
+- A valid configuration is copied to a protected last-known-good file on every
+  successful load, so a corrupted `appsettings.json` self-recovers the real
+  settings instead of silently reverting to defaults.
+
+## Upgrade notes
+
+- For a child's PC, install with `install.ps1` (as Administrator) so the app lives
+  in the protected `C:\Program Files\DeviceMon` folder. Update the same way -
+  re-run `install.ps1`. The in-dashboard update flow only applies to non-protected
+  installs, since it writes into the application folder.
+- Existing databases and logs are migrated automatically from the old
+  `%LOCALAPPDATA%\SystemHelper\` location on first launch of this version.
+- Keep `DeviceMon.exe`, `GameHost.exe`, `PopupHost.exe`, and `UpdateAgent.exe`
+  together when replacing an installation. The tamper protection only takes effect
+  once the **new `GameHost.exe`** is in place — after updating, confirm the update
+  log does not report `Skipped locked watchdog file: GameHost.exe`.
+- This framework-dependent package requires the .NET 8 Desktop Runtime on the
+  target PC.
+
+## Verification
+
+- Release build completed successfully for all four executables.
+- Full regression suite passed (28 tests).
+- Deny-delete / owner-rights ACL verified against a live file.