diff --git a/README.md b/README.md index a296cef..5a50e53 100644 --- a/README.md +++ b/README.md @@ -1,112 +1,71 @@ # IntuneCommander +![Intune Commander](docs/images/logo_small.png) + > A Windows-native control plane for **Microsoft Intune / Entra device management** — a Rust + > WinUI 3 client over a hard-forked .NET Graph engine, with a persistent, searchable **audit / drift > time-machine** and a human-gated automation layer on top. **MIT licensed.** -**Version 1.0 is a ground-up rewrite.** IntuneCommander started as a .NET 10 + React desktop app + -`ic.exe` CLI (the `v0.x` releases). v1.0 replaces that shell with a **native Rust/WinUI 3 client** and -a **.NET sidecar** — same brand, same Graph engine (hard-forked into [`service/Core/`](./service/Core/)), -plus the time-machine, diagnostics suite, and automation layers the old app never had. The legacy -.NET/React app is preserved in the `v0.x` tags and this repo's history. - -> **Status:** first public beta, **`v1.0.0-beta.1`**. It's a working application — full CRUD across -> ~42 surfaces, the time-machine, the diagnostics suite, and most of the platform layer (device -> actions, GitOps, simulator, twin, posture, fleet, ecosystem) are implemented. Grab a signed build -> from **[Releases](../../releases)**. - -> **Codename:** some build files and internal docs still use the codename **`cmProjectX`** (the repo -> directory, `CmProjectX.*` .NET namespaces, `*.slnx`). The product name is **IntuneCommander**. +**[intunecommander.com](https://intunecommander.com)** · **[Download the beta](https://github.com/adamgell/IntuneCommander/releases)** --- -## Download & install +## v1.0 is a ground-up rewrite -Signed installers (Windows 11, **ARM64** primary + **x64**) are on the -**[Releases](../../releases)** page — MSI + MSIX, code-signed with **Azure Trusted Signing**, built -with **[Master Packager Dev](https://www.masterpackager.com/)**: +IntuneCommander started as a **.NET 10 + React** desktop app plus an `ic.exe` CLI (the **`v0.x`** +releases). **v1.0** replaces that shell with a **native Rust / WinUI 3 client** and a **.NET +sidecar** — same brand, same Graph engine — plus a time-machine, a diagnostics suite, and automation +layers the old app never had. -- `IntuneCommander--.msi` — recommended (Program Files + Start-Menu shortcut) -- `IntuneCommander--.msix` — MSIX / App-Installer / managed deployment -- `IntuneCommander--win-.zip` — portable (run `Start-IntuneCommander.cmd`) +> **Where the code lives:** v1 is being finalized on the +> **[`v1` branch](https://github.com/adamgell/IntuneCommander/tree/v1)** and will become the default +> branch shortly. This `main` branch still holds the legacy v0.x .NET/React app, preserved in the +> `v0.x` tags and this repo's history. -Requires the **[Windows App SDK runtime](https://learn.microsoft.com/windows/apps/windows-app-sdk/downloads)**; -the .NET runtime is bundled. Prereqs + a smoke test are in [`docs/RUNBOOK.md`](./docs/RUNBOOK.md). - -> ⚠️ **Writes hit your live tenant — there is no sandbox.** A diff-preview → confirm gate protects -> every change, but a confirmed change is real. Start on low-risk surfaces (Scope Tags, Device -> Categories). Conditional Access is read-only by design. +> **Status:** first public beta — **`v1.0.0-beta.1`**. Full CRUD across ~42 surfaces, the +> time-machine, and the diagnostics suite are implemented. Grab a signed build from +> **[Releases](https://github.com/adamgell/IntuneCommander/releases)**. --- -## Architecture - -A **two-process desktop app**: a thin Rust/WinUI client talks to a local .NET sidecar over loopback. -All Graph/Intune coverage lives in the sidecar; the client is data-driven. - -``` - app/ Rust + WinUI 3 (Windows Reactor) ──HTTP/REST──▶ service/ .NET 10 sidecar - • Reactor reactive UI (hooks model) 127.0.0.1:5099 • Api/ minimal-API host (~280 routes) - • api_client.rs (blocking reqwest) • Core/ hard-forked Graph engine (~60 services) - • crates/api-types (shared DTOs) • Sync/ Graph delta sync + autonomy watcher - contract/openapi.yaml ────────────• Store/ SQLite + Lucene time-machine - (one schema → both sides) -``` - -- **The client owns the sidecar** — `app/src/sidecar.rs::ensure_running()` spawns (or borrows) it on - launch; `cargo run -p app` boots the whole stack. -- **`contract/openapi.yaml` is the single source of truth** for shared DTOs/endpoints (Rust + C# - types mirror it byte-for-byte over JSON). -- **Two storage layers:** an append-only **audit/drift time-machine** (`service/Store/`, SQLite + - Lucene) and a read-through **blob cache** (`service/Api/Endpoints/CachedReader.cs`, LiteDB). -- Loopback-only, single-instance mutex; no inbound HTTP auth — "auth" is per-tenant Entra sign-in - applied to the outbound Graph client. - -See [`AGENTS.md`](./AGENTS.md) (canonical operating guide) and [`CLAUDE.md`](./CLAUDE.md). - ## What it does -- **~42 Intune/Entra surfaces** with a consistent view → edit → clone → delete → assign flow - (diff-preview + confirm before every write; full CRUD on ~29 writable surfaces). +- **~42 Intune/Entra surfaces** — a consistent view → edit → clone → delete → + assign flow, with a diff-preview + confirm gate before every write (full CRUD on ~29 writable + surfaces). - **A time-machine** — audit timeline, field-level drift, full-text search, point-in-time restore. - **Bulk & lifecycle** — backup/export, gated import/restore, bulk app assignment, CIS/OIB baseline - compare, Conditional Access → PowerPoint. -- **Diagnostics** — CMTrace/IME logs, dsregcmd, Event Log, Sysmon, Secure Boot, timeline correlation, - one-click collector. All local, no sign-in. + compare, Conditional Access → PowerPoint. +- **Diagnostics** — CMTrace/IME logs, dsregcmd, Event Log, Sysmon, Secure Boot, timeline + correlation, one-click collector. All local, no sign-in. - **Platform layer** — GitOps plan/apply, a blast-radius simulator, a queryable tenant digital twin, - continuous posture scoring, multi-tenant fleet, a policy-pack/playbook ecosystem, and Maester - (CIS/SCuBA/EIDSCA) checks. + continuous posture scoring, multi-tenant fleet, and Maester (CIS/SCuBA/EIDSCA) checks. - **Human-gated automation** — proposals land in an approval inbox with the diff + blast-radius; - nothing auto-applies. (Cross-MDM is an experimental spike.) + nothing auto-applies. -## Build & run +> ⚠️ **Writes hit your live tenant — there is no sandbox.** A diff-preview → confirm gate +> protects every change, but a confirmed change is real. Start on low-risk surfaces (Scope Tags, +> Device Categories). Conditional Access is read-only by design. -Prereqs (see [`docs/RUNBOOK.md`](./docs/RUNBOOK.md)): **Windows 11 on ARM64** (primary), the **.NET 10 -SDK**, **Rust stable**, the **Windows App SDK runtime**, and the two sibling checkouts the client's -path-deps need — `../windows-rs` (Windows Reactor fork) and `../cmtraceopen` (parser). - -```powershell -cargo build --workspace -dotnet build service/CmProjectX.slnx --configuration Release -cargo run -p app # client spawns the sidecar -``` +## Architecture -## Releasing +A two-process desktop app: a thin **Rust / WinUI 3** client talks to a local **.NET 10 sidecar** over +loopback. All Graph/Intune coverage lives in the sidecar; the client is data-driven. A single +`contract/openapi.yaml` is the source of truth for the DTOs both sides share, and two storage layers +back it — an append-only audit/drift time-machine (SQLite + Lucene) and a read-through blob cache. -Push a `v` tag → the **[signed-release workflow](./.github/workflows/cmprojectx-codesign.yml)** -builds the client + self-contained sidecar (+ bundled Maester), packages a **signed MSI + MSIX** per -arch with mpdev (Azure Trusted Signing), and publishes a draft release here: +Full architecture, build, and release detail lives in the +[**`v1` branch README**](https://github.com/adamgell/IntuneCommander/tree/v1#architecture). -```powershell -git tag v1.0.0-beta.1 && git push origin v1.0.0-beta.1 -``` +## Install -Signing config lives in the `codesigning` environment secrets. Packaging is defined by -[`packaging/installer.mpdev.json`](./packaging/installer.mpdev.json) (see -[`packaging/README.md`](./packaging/README.md)). `scripts/release.ps1` is a local unsigned dev build. +Signed installers for **Windows 11** (**ARM64** primary + **x64**) — MSI + MSIX, code-signed with +Azure Trusted Signing — are on the **[Releases](https://github.com/adamgell/IntuneCommander/releases)** +page. Requires the +[Windows App SDK runtime](https://learn.microsoft.com/windows/apps/windows-app-sdk/downloads); the +.NET runtime is bundled. ## License -**MIT** — see [`LICENSE`](./LICENSE). Bundled third-party components are listed in -[`THIRD-PARTY-NOTICES.md`](./THIRD-PARTY-NOTICES.md). The forked `service/Core/` derives from the -MIT-licensed original IntuneCommander. +**MIT** — see [`LICENSE`](./LICENSE). The forked Graph engine derives from the MIT-licensed +[IntuneManagement](https://github.com/Micke-K/IntuneManagement) by Micke-K.