Updates

2026-08-09 17:33:11 -05:00
1 parent d27811254d
commit 582d0e635d
@@ -64,7 +64,8 @@ const operationsArticles = [
      'Create credentials in Credential Vault first, then attach them to hosts. Secrets are encrypted using AES-256-GCM.',
      'Hosts support WinRM, SSH, local, and API transport metadata. PowerShell remoting and firewall prerequisites must be configured outside POSHManager.',
      'Each host tracks an OS type of Windows, Linux, or Other. vCenter imports infer this from VMware Tools when possible; manual hosts should set it during add/edit.',
-      'Windows hosts with an assigned username/password Credential Vault entry show an RDP icon. The icon opens a short-lived /rdp/:token URL in a new tab and renders a mstsc.js browser RDP canvas while the API keeps the real password server-side.',
+      'Windows hosts with an assigned username/password Credential Vault entry show an RDP icon. The icon asks the API for a Myrtille launch URL and opens that gateway in a new tab.',
+      'Configure myrtille_enabled and myrtille_gateway_url in Configuration / Integrations or pin them with MYRTILLE_ENABLED and MYRTILLE_GATEWAY_URL. Password-hash mode is enabled by default so the browser receives a Myrtille passwordHash instead of the plaintext vault secret.',
      'When Linux targets are selected, POSHManager checks scripts for common Windows-only PowerShell patterns such as registry providers, C:\\ paths, WMI/Win32 classes, Windows executables, and risky alias usage.'
    ]),
    section('Host Groups and VMware sources', [
@@ -96,6 +97,11 @@ const operationsArticles = [
      'Users & Groups is a dedicated administration menu item. Add users and groups through modal create flows.',
      'Scripts, RunPlans, variables, PSADT profiles, and Intune deployment plans can use personal, shared, or group visibility.'
    ]),
+    section('Profile and themes', [
+      'Open the avatar menu in the top bar to edit profile details, avatar URL, password settings, and theme preference.',
+      'Available themes include Dashtreme Pulse, Green Screen, Aurora Glass, Greyscale Pro, and macOS Desktop. The macOS mode uses desktop-style frosted chrome; Greyscale Pro uses neutral high-contrast surfaces.',
+      'Dense data tables use icon-only row actions with accessible labels and hover tooltips, while page-level create/save commands keep text labels.'
+    ]),
    section('Configuration', [
      'Config is grouped into collapsible sections for Deployment, Authentication, Execution, Runtime, and Other settings, with Microsoft Graph Intune environments managed in the Config / Intune panel.',
      'Settings can be controlled through the UI and environment variables for Docker deployment. Trusted origins, server FQDN, Entra fields, PowerShell binary, and script execution switch are key operational settings.'
@@ -108,6 +114,7 @@ const apiArticles = [
    apiExample('Post', '/api/auth/login', 'Authenticate with local credentials and receive a JWT token.', '@{ email = "admin@posh.local"; password = "change-me-now" }'),
    apiExample('Get', '/api/auth/me', 'Return the current authenticated user.'),
    apiExample('Put', '/api/auth/profile', 'Update display name, profile fields, and avatar URL.', '@{ displayName = "POSH Admin"; email = "admin@posh.local"; jobTitle = "Platform Administrator"; phone = ""; timezone = "America/Chicago"; avatarUrl = "" }'),
+    apiExample('Put', '/api/auth/theme', 'Update the current user theme. Supported values include dashtreme, terminal, aurora, greyscale, and macos.', '@{ theme = "macos" }'),
    apiExample('Get', '/api/bootstrap', 'Return dashboard summary, settings payload, and Entra status.'),
    section('Notes', [
      'Use the Bearer token returned by /api/auth/login for every protected request.',
@@ -135,7 +142,7 @@ const apiArticles = [
  article('api-hosts-credentials-runplans', 'API', 'Hosts, Credentials, RunPlans, Jobs, And Logs API', 'Manage execution targets and inspect results through the API.', [
    apiExample('Post', '/api/credentials', 'Create an encrypted username/password credential.', '@{ name = "WinRM Admin"; kind = "username_password"; username = "CONTOSO\\svc-posh"; secret = "change-me"; visibility = "personal" }'),
    apiExample('Post', '/api/hosts', 'Create a managed host.', '@{ name = "APP01"; address = "app01.contoso.local"; fqdn = "app01.contoso.local"; osFamily = "windows"; transport = "winrm"; port = 5986; credentialId = $null; tags = @("prod","web"); notes = "" }'),
-    apiExample('Post', '/api/hosts/hst_123/rdp-session', 'Create a short-lived browser RDP launch URL for a visible Windows host with an assigned visible username/password credential.', '$session = Invoke-RestMethod -Method Post -Uri "$base/api/hosts/hst_123/rdp-session" -Headers $headers\nStart-Process "$base$($session.url)"'),
+    apiExample('Post', '/api/hosts/hst_123/rdp-session', 'Create a Myrtille browser RDP launch URL for a visible Windows host with an assigned visible username/password credential.', '$session = Invoke-RestMethod -Method Post -Uri "$base/api/hosts/hst_123/rdp-session" -Headers $headers\nStart-Process $session.url'),
    apiExample('Post', '/api/scripts/scr_123/compatibility', 'Analyze a script against direct host and Host Group targets before executing against Linux hosts.', '@{ hostIds = @("hst_linux_01"); hostGroupIds = @("hg_mixed_targets") }'),
    apiExample('Get', '/api/runplans/rp_123/compatibility', 'Analyze a RunPlan script against its current target OS mix before execution.'),
    apiExample('Post', '/api/runplans', 'Create a RunPlan. hostIds should contain existing host ids.', '@{ name = "Patch Validation"; description = "Run validation script"; scriptId = "scr_123"; visibility = "shared"; parallel = $true; hostIds = @("hst_123") }'),
@@ -163,6 +170,8 @@ const apiArticles = [
    apiExample('Post', '/api/psadt/validate', 'Validate raw PSADT script content.', '@{ platform = "intune"; content = "Invoke-AppDeployToolkit.exe -DeploymentType Install" }'),
    apiExample('Post', '/api/psadt/migration/plan', 'Plan a legacy script migration to PSADT 4.2.0.', `@{ targetVersion = "4.2.0"; content = "Deploy-Application.ps1\`nExecute-Process -Path setup.exe\`n$appName = 'Legacy App'" }`),
    apiExample('Post', '/api/psadt/profiles', 'Create a reusable PSADT deployment profile.', '@{ name = "Edge Enterprise"; appVendor = "Microsoft"; appName = "Edge"; appVersion = "126.0"; appArch = "x64"; appLang = "EN"; appRevision = "01"; templateVersion = "v4"; deploymentType = "Install"; deployMode = "Auto"; requireAdmin = $true; zeroConfig = $false; suppressReboot = $false; closeProcesses = @(); installTasks = @(@{ type = "exe"; phase = "Install"; filePath = "setup.exe"; arguments = "/S"; secureArguments = $false }); uiPlan = @{ welcome = $true }; configPlan = @{}; admxPlan = @{}; visibility = "shared" }'),
+    apiExample('Post', '/api/psadt/profiles/psadt_123/package', 'Assemble a portable PSADT v4 package: render Invoke-AppDeployToolkit.ps1, lay out Files/SupportFiles/Assets from the profile\'s linked assets, zip it, and ingest the zip into the Asset Library. Pass build = $true to also produce a .intunewin from the assembled tree (Windows + IntuneWinAppUtil or INTUNEWIN_BUILD_COMMAND). Download the returned asset via /api/assets/{id}/download.', '@{ build = $true; setupFile = "Files/setup.exe" }'),
+    apiExample('Get', '/api/psadt/intune/deployments/intune_123/datasheet?format=html', 'Auto-generate a package datasheet (Markdown or self-contained HTML) for a deployment: metadata, install/uninstall commands, detection, return codes, assignments, requirements, and source/version. Use format=md or format=html; add download=1 to return it as a file attachment.'),
    apiExample('Post', '/api/psadt/intune/deployments', 'Create an Intune Publishing Wizard plan.', '@{ name = "Edge Pilot"; sourceFolder = "C:\\Packages\\Edge\\PSADT"; intunewinFile = "Edge.intunewin"; commandStyle = "v4"; installBehavior = "system"; restartBehavior = "return-code"; uiMode = "native-v4"; requirements = @{ architecture = "x64"; minOs = "Windows 10 22H2"; diskSpaceMb = 512; runAs32Bit = $false }; installCommand = "Invoke-AppDeployToolkit.exe -DeploymentType Install"; uninstallCommand = "Invoke-AppDeployToolkit.exe -DeploymentType Uninstall"; detectionType = "custom-script"; detectionRule = "Write-Output detected"; returnCodes = @(@{ code = 0; type = "success"; meaning = "OK" }, @{ code = 1602; type = "retry"; meaning = "Deferred" }, @{ code = 3010; type = "softReboot"; meaning = "Reboot" }); assignments = @(@{ ring = "Pilot"; intent = "available"; groupName = "IT Pilot"; notes = "Validate" }); status = "ready"; visibility = "shared" }')
  ], ['api', 'psadt', 'intune', 'migration'])
  ,
@@ -0,0 +1,300 @@
+// Curated application recipe library. Each entry holds the installer
+// technology, an example installer file name, silent install args, a detection
+// footprint, and (when one exists) the winget id for update tracking.
+//
+// `installerType` must match an INSTALLER_TECHNOLOGIES id.
+// `detection` is passed verbatim to detectionRuleService.buildDetectionRule.
+// Args with <angle-bracket> placeholders are intentional refine-me prompts.
+
+export const RECIPES = [
+  // --- Browsers --------------------------------------------------------------
+  {
+    id: 'google-chrome',
+    vendor: 'Google', name: 'Chrome', category: 'Browser',
+    installerType: 'msi', fileName: 'googlechromestandaloneenterprise64.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    closeProcesses: [{ name: 'chrome', description: 'Google Chrome' }],
+    detection: { type: 'file', path: '%ProgramFiles%\\Google\\Chrome\\Application\\chrome.exe' },
+    wingetId: 'Google.Chrome', homepage: 'https://chromeenterprise.google/browser/download/'
+  },
+  {
+    id: 'mozilla-firefox',
+    vendor: 'Mozilla', name: 'Firefox', category: 'Browser',
+    installerType: 'nsis', fileName: 'Firefox Setup.exe', arch: 'x64',
+    installArgs: '/S',
+    closeProcesses: [{ name: 'firefox', description: 'Mozilla Firefox' }],
+    detection: { type: 'file', path: '%ProgramFiles%\\Mozilla Firefox\\firefox.exe' },
+    wingetId: 'Mozilla.Firefox', homepage: 'https://www.mozilla.org/firefox/all/'
+  },
+  {
+    id: 'microsoft-edge',
+    vendor: 'Microsoft', name: 'Edge', category: 'Browser',
+    installerType: 'msi', fileName: 'MicrosoftEdgeEnterpriseX64.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    closeProcesses: [{ name: 'msedge', description: 'Microsoft Edge' }],
+    detection: { type: 'file', path: '%ProgramFiles(x86)%\\Microsoft\\Edge\\Application\\msedge.exe' },
+    wingetId: 'Microsoft.Edge', homepage: 'https://www.microsoft.com/edge/business/download'
+  },
+  {
+    id: 'brave',
+    vendor: 'Brave', name: 'Brave Browser', category: 'Browser',
+    installerType: 'nsis', fileName: 'BraveBrowserStandaloneSetup.exe', arch: 'x64',
+    installArgs: '/silent /install',
+    detection: { type: 'file', path: '%ProgramFiles%\\BraveSoftware\\Brave-Browser\\Application\\brave.exe' },
+    wingetId: 'Brave.Brave', homepage: 'https://brave.com/download/'
+  },
+
+  // --- Productivity & Office -------------------------------------------------
+  {
+    id: 'adobe-reader',
+    vendor: 'Adobe', name: 'Acrobat Reader', category: 'Productivity',
+    installerType: 'msi', fileName: 'AcroRead.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    closeProcesses: [{ name: 'Acrobat', description: 'Adobe Acrobat' }, { name: 'AcroRd32', description: 'Adobe Reader' }],
+    detection: { type: 'file', path: '%ProgramFiles%\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe' },
+    wingetId: 'Adobe.Acrobat.Reader.64-bit', homepage: 'https://get.adobe.com/reader/enterprise/'
+  },
+  {
+    id: 'microsoft-365-apps',
+    vendor: 'Microsoft', name: 'Microsoft 365 Apps (Word/Excel/PowerPoint)', category: 'Productivity',
+    installerType: 'exe', fileName: 'setup.exe', arch: 'x64',
+    // Office is deployed with the Office Deployment Tool + a configuration.xml.
+    installArgs: '/configure configuration.xml',
+    closeProcesses: [{ name: 'winword', description: 'Word' }, { name: 'excel', description: 'Excel' }, { name: 'powerpnt', description: 'PowerPoint' }, { name: 'outlook', description: 'Outlook' }],
+    detection: { type: 'file', path: '%ProgramFiles%\\Microsoft Office\\root\\Office16\\WINWORD.EXE' },
+    wingetId: 'Microsoft.Office', homepage: 'https://www.microsoft.com/microsoft-365/enterprise'
+  },
+  {
+    id: 'libreoffice',
+    vendor: 'The Document Foundation', name: 'LibreOffice', category: 'Productivity',
+    installerType: 'msi', fileName: 'LibreOffice.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    detection: { type: 'file', path: '%ProgramFiles%\\LibreOffice\\program\\soffice.exe' },
+    wingetId: 'TheDocumentFoundation.LibreOffice', homepage: 'https://www.libreoffice.org/download/download/'
+  },
+
+  // --- Communication ---------------------------------------------------------
+  {
+    id: 'zoom',
+    vendor: 'Zoom', name: 'Zoom Workplace', category: 'Communication',
+    installerType: 'msi', fileName: 'ZoomInstallerFull.msi', arch: 'x64',
+    installArgs: '/qn /norestart ZoomAutoUpdate=true',
+    closeProcesses: [{ name: 'Zoom', description: 'Zoom' }],
+    detection: { type: 'file', path: '%ProgramFiles%\\Zoom\\bin\\Zoom.exe' },
+    wingetId: 'Zoom.Zoom', homepage: 'https://zoom.us/download'
+  },
+  {
+    id: 'microsoft-teams',
+    vendor: 'Microsoft', name: 'Teams (new)', category: 'Communication',
+    installerType: 'msix', fileName: 'MSTeams-x64.msix', arch: 'x64',
+    installArgs: '',
+    detection: { type: 'file', path: '%ProgramFiles%\\WindowsApps\\MSTeams_*\\ms-teams.exe' },
+    wingetId: 'Microsoft.Teams', homepage: 'https://www.microsoft.com/microsoft-teams/download-app'
+  },
+  {
+    id: 'slack',
+    vendor: 'Slack', name: 'Slack', category: 'Communication',
+    installerType: 'msi', fileName: 'slack-standalone.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    closeProcesses: [{ name: 'slack', description: 'Slack' }],
+    detection: { type: 'registry', keyPath: 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{Slack}', valueName: 'DisplayName' },
+    wingetId: 'SlackTechnologies.Slack', homepage: 'https://slack.com/downloads/windows'
+  },
+  {
+    id: 'cisco-webex',
+    vendor: 'Cisco', name: 'Webex App', category: 'Communication',
+    installerType: 'msi', fileName: 'Webex.msi', arch: 'x64',
+    installArgs: '/qn /norestart ALLUSERS=1 AUTOUPGRADEENABLED=1',
+    detection: { type: 'file', path: '%ProgramFiles(x86)%\\Cisco Spark\\CiscoCollabHost.exe' },
+    wingetId: 'Cisco.Webex', homepage: 'https://www.webex.com/downloads.html'
+  },
+
+  // --- Media -----------------------------------------------------------------
+  {
+    id: 'vlc',
+    vendor: 'VideoLAN', name: 'VLC media player', category: 'Media',
+    installerType: 'nsis', fileName: 'vlc-win64.exe', arch: 'x64',
+    installArgs: '/S',
+    closeProcesses: [{ name: 'vlc', description: 'VLC media player' }],
+    detection: { type: 'file', path: '%ProgramFiles%\\VideoLAN\\VLC\\vlc.exe' },
+    wingetId: 'VideoLAN.VLC', homepage: 'https://www.videolan.org/vlc/'
+  },
+
+  // --- Utilities -------------------------------------------------------------
+  {
+    id: '7zip',
+    vendor: '7-Zip', name: '7-Zip', category: 'Utility',
+    installerType: 'msi', fileName: '7z-x64.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    detection: { type: 'file', path: '%ProgramFiles%\\7-Zip\\7z.exe' },
+    wingetId: '7zip.7zip', homepage: 'https://www.7-zip.org/download.html'
+  },
+  {
+    id: 'winrar',
+    vendor: 'RARLAB', name: 'WinRAR', category: 'Utility',
+    installerType: 'exe', fileName: 'winrar-x64.exe', arch: 'x64',
+    installArgs: '/S',
+    detection: { type: 'file', path: '%ProgramFiles%\\WinRAR\\WinRAR.exe' },
+    wingetId: 'RARLab.WinRAR', homepage: 'https://www.win-rar.com/download.html'
+  },
+  {
+    id: 'notepad-plus-plus',
+    vendor: 'Notepad++', name: 'Notepad++', category: 'Utility',
+    installerType: 'nsis', fileName: 'npp.Installer.x64.exe', arch: 'x64',
+    installArgs: '/S',
+    closeProcesses: [{ name: 'notepad++', description: 'Notepad++' }],
+    detection: { type: 'file', path: '%ProgramFiles%\\Notepad++\\notepad++.exe' },
+    wingetId: 'Notepad++.Notepad++', homepage: 'https://notepad-plus-plus.org/downloads/'
+  },
+  {
+    id: 'greenshot',
+    vendor: 'Greenshot', name: 'Greenshot', category: 'Utility',
+    installerType: 'inno', fileName: 'Greenshot-INSTALLER.exe', arch: 'x64',
+    installArgs: '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-',
+    detection: { type: 'file', path: '%ProgramFiles%\\Greenshot\\Greenshot.exe' },
+    wingetId: 'Greenshot.Greenshot', homepage: 'https://getgreenshot.org/downloads/'
+  },
+  {
+    id: 'putty',
+    vendor: 'Simon Tatham', name: 'PuTTY', category: 'Utility',
+    installerType: 'msi', fileName: 'putty-64bit-installer.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    detection: { type: 'file', path: '%ProgramFiles%\\PuTTY\\putty.exe' },
+    wingetId: 'PuTTY.PuTTY', homepage: 'https://www.putty.org/'
+  },
+  {
+    id: 'winscp',
+    vendor: 'WinSCP', name: 'WinSCP', category: 'Utility',
+    installerType: 'inno', fileName: 'WinSCP-Setup.exe', arch: 'x64',
+    installArgs: '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /ALLUSERS',
+    detection: { type: 'file', path: '%ProgramFiles(x86)%\\WinSCP\\WinSCP.exe' },
+    wingetId: 'WinSCP.WinSCP', homepage: 'https://winscp.net/eng/download.php'
+  },
+
+  // --- Developer -------------------------------------------------------------
+  {
+    id: 'git',
+    vendor: 'Git', name: 'Git for Windows', category: 'Developer',
+    installerType: 'inno', fileName: 'Git-64-bit.exe', arch: 'x64',
+    installArgs: '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-',
+    detection: { type: 'file', path: '%ProgramFiles%\\Git\\bin\\git.exe' },
+    wingetId: 'Git.Git', homepage: 'https://git-scm.com/download/win'
+  },
+  {
+    id: 'vscode',
+    vendor: 'Microsoft', name: 'Visual Studio Code', category: 'Developer',
+    installerType: 'inno', fileName: 'VSCodeSetup-x64.exe', arch: 'x64',
+    installArgs: '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /MERGETASKS=!runcode',
+    closeProcesses: [{ name: 'Code', description: 'Visual Studio Code' }],
+    detection: { type: 'file', path: '%ProgramFiles%\\Microsoft VS Code\\Code.exe' },
+    wingetId: 'Microsoft.VisualStudioCode', homepage: 'https://code.visualstudio.com/download'
+  },
+  {
+    id: 'powershell-7',
+    vendor: 'Microsoft', name: 'PowerShell 7', category: 'Developer',
+    installerType: 'msi', fileName: 'PowerShell-7-win-x64.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    detection: { type: 'file', path: '%ProgramFiles%\\PowerShell\\7\\pwsh.exe' },
+    wingetId: 'Microsoft.PowerShell', homepage: 'https://github.com/PowerShell/PowerShell/releases'
+  },
+  {
+    id: 'nodejs',
+    vendor: 'OpenJS Foundation', name: 'Node.js LTS', category: 'Developer',
+    installerType: 'msi', fileName: 'node-x64.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    detection: { type: 'file', path: '%ProgramFiles%\\nodejs\\node.exe' },
+    wingetId: 'OpenJS.NodeJS.LTS', homepage: 'https://nodejs.org/en/download'
+  },
+  {
+    id: 'python-3',
+    vendor: 'Python Software Foundation', name: 'Python 3', category: 'Developer',
+    installerType: 'exe', fileName: 'python-installer.exe', arch: 'x64',
+    installArgs: '/quiet InstallAllUsers=1 PrependPath=1 Include_test=0',
+    detection: { type: 'registry', keyPath: 'HKLM:\\SOFTWARE\\Python\\PythonCore' },
+    wingetId: 'Python.Python.3.12', homepage: 'https://www.python.org/downloads/windows/'
+  },
+  {
+    id: 'temurin-jdk',
+    vendor: 'Eclipse Adoptium', name: 'Temurin JDK 21', category: 'Developer',
+    installerType: 'msi', fileName: 'OpenJDK21-jdk_x64_windows.msi', arch: 'x64',
+    installArgs: '/qn /norestart ADDLOCAL=FeatureMain,FeatureEnvironment',
+    detection: { type: 'file', path: '%ProgramFiles%\\Eclipse Adoptium\\jdk-21\\bin\\java.exe' },
+    wingetId: 'EclipseAdoptium.Temurin.21.JDK', homepage: 'https://adoptium.net/temurin/releases/'
+  },
+
+  // --- Remote access & virtualization ---------------------------------------
+  {
+    id: 'vmware-workstation',
+    vendor: 'Broadcom (VMware)', name: 'Workstation Pro', category: 'Virtualization',
+    installerType: 'installshield', fileName: 'VMware-workstation.exe', arch: 'x64',
+    installArgs: '/s /v"/qn EULAS_AGREED=1 AUTOSOFTWAREUPDATE=0 REBOOT=ReallySuppress"',
+    detection: { type: 'file', path: '%ProgramFiles(x86)%\\VMware\\VMware Workstation\\vmware.exe' },
+    wingetId: 'VMware.WorkstationPro', homepage: 'https://www.vmware.com/products/workstation-pro.html'
+  },
+  {
+    id: 'realvnc-server',
+    vendor: 'RealVNC', name: 'VNC Server', category: 'Remote access',
+    installerType: 'msi', fileName: 'VNC-Server.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    detection: { type: 'file', path: '%ProgramFiles%\\RealVNC\\VNC Server\\vncserver.exe' },
+    wingetId: 'RealVNC.VNCServer', homepage: 'https://www.realvnc.com/en/connect/download/vnc/'
+  },
+  {
+    id: 'teamviewer-host',
+    vendor: 'TeamViewer', name: 'TeamViewer Host', category: 'Remote access',
+    installerType: 'msi', fileName: 'TeamViewer_Host.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    detection: { type: 'file', path: '%ProgramFiles%\\TeamViewer\\TeamViewer.exe' },
+    wingetId: 'TeamViewer.TeamViewer.Host', homepage: 'https://www.teamviewer.com/download/windows/'
+  },
+  {
+    id: 'anydesk',
+    vendor: 'AnyDesk', name: 'AnyDesk', category: 'Remote access',
+    installerType: 'exe', fileName: 'AnyDesk.exe', arch: 'x64',
+    installArgs: '--install "%ProgramFiles(x86)%\\AnyDesk" --start-with-win --silent',
+    detection: { type: 'file', path: '%ProgramFiles(x86)%\\AnyDesk\\AnyDesk.exe' },
+    wingetId: 'AnyDeskSoftwareGmbH.AnyDesk', homepage: 'https://anydesk.com/en/downloads/windows'
+  },
+
+  // --- Security & enterprise agents (no winget; vendor-managed updates) ------
+  {
+    id: 'crowdstrike-falcon',
+    vendor: 'CrowdStrike', name: 'Falcon Sensor', category: 'Security agent',
+    installerType: 'msi', fileName: 'WindowsSensor.exe', arch: 'x64',
+    installArgs: '/install /quiet /norestart CID=<your-falcon-cid>',
+    detection: { type: 'file', path: '%ProgramFiles%\\CrowdStrike\\CSFalconService.exe' },
+    wingetId: '', homepage: 'https://www.crowdstrike.com/'
+  },
+  {
+    id: 'cisco-umbrella',
+    vendor: 'Cisco', name: 'Umbrella Roaming Client', category: 'Security agent',
+    installerType: 'msi', fileName: 'Setup.msi', arch: 'x64',
+    installArgs: '/qn /norestart',
+    detection: { type: 'file', path: '%ProgramFiles(x86)%\\OpenDNS\\Umbrella Roaming Client\\ERAgent.exe' },
+    wingetId: '', homepage: 'https://umbrella.cisco.com/'
+  },
+  {
+    id: 'splunk-uf',
+    vendor: 'Splunk', name: 'Universal Forwarder', category: 'Monitoring agent',
+    installerType: 'msi', fileName: 'splunkforwarder-x64.msi', arch: 'x64',
+    installArgs: '/qn AGREETOLICENSE=Yes RECEIVING_INDEXER="<indexer-host>:9997" SPLUNKUSERNAME=admin',
+    detection: { type: 'file', path: '%ProgramFiles%\\SplunkUniversalForwarder\\bin\\splunk.exe' },
+    wingetId: '', homepage: 'https://www.splunk.com/en_us/download/universal-forwarder.html'
+  },
+  {
+    id: 'nessus-agent',
+    vendor: 'Tenable', name: 'Nessus Agent', category: 'Security agent',
+    installerType: 'msi', fileName: 'NessusAgent-x64.msi', arch: 'x64',
+    installArgs: '/qn NESSUS_GROUPS="<group>" NESSUS_SERVER="<manager>:8834" NESSUS_KEY="<linking-key>"',
+    detection: { type: 'file', path: '%ProgramFiles%\\Tenable\\Nessus Agent\\nessuscli.exe' },
+    wingetId: '', homepage: 'https://www.tenable.com/downloads/nessus-agents'
+  },
+  {
+    id: 'sap-gui',
+    vendor: 'SAP', name: 'SAP GUI for Windows', category: 'Enterprise',
+    installerType: 'exe', fileName: 'NwSapSetup.exe', arch: 'x64',
+    installArgs: '/silent /product="SAPGUI"',
+    detection: { type: 'file', path: '%ProgramFiles(x86)%\\SAP\\FrontEnd\\SAPGUI\\saplogon.exe' },
+    wingetId: '', homepage: 'https://support.sap.com/'
+  }
+];