v10.4 - Production-hardened (code review response)

v10.4 — Production-hardened installer (responds to code review)

This release addresses every issue raised during external review of v10.2–v10.3 drafts.

For reviewers: see docs/CODE_REVIEW.md — full Q&A table, architecture, and verification commands.

Install / upgrade

Set-ExecutionPolicy Bypass -Scope Process -Force
.\\install.ps1

Re-running the installer upgrades an existing C:\\WireGuard\\ install in place.

---

Bugs fixed (reviewer-reported)

Issue	Fix
Test-Internet false positive	EndConnect must succeed, not just async WaitOne
*monitor.ps1* matched service-monitor.ps1	Strict regex for monitor.ps1 path everywhere + WMI WQL
Repair schtasks path escaping	$taskRun = '\\' + $TASK_MONITOR
Monitor heredoc line-continuation bugs	Single-line netsh in generated monitor.ps1
Double Cloudflare API call	$serverIPs cached once; shared by firewall + monitor + registry
NSSM zip null entry crash	Path normalize + null-guard before extract
DNS leak via TCP/53	KS-DNS-Block-TCP rule
IPv6 / NAT64 leaks	Extended block ranges + adapter binding disable
wireguard.exe blocked	KS-WireGuard-EXE allow rule
Duplicate monitors	Global\\WGMainMonitorMutex single instance
Task Scheduler P9999D failure	RepetitionDuration = 3650 days

---

Hardening kept from v10.2–v10.3

• Design philosophy header in install.ps1 (lines 11–26)
• PowerShell splatting (readability)
• Repair script single-quoted heredoc refactor
• Registry stores resolved WARP server IPs (ServerIP)

---

Verify after install

Get-ItemProperty "HKLM:\\SOFTWARE\\WGKillSwitch" | Select Version, ServerIP
Get-NetFirewallRule -DisplayName "KS-DNS-Block*"
Select-String -Path C:\\WireGuard\\monitor.ps1 -Pattern "EndConnect"

---

Recovery layers (unchanged — 8 layers)

monitor.ps1 → repair.ps1 → WG-KillSwitch → WG-RepairTask → WGKillSwitchSvc → WMI → Run key → GPO boot script

Why WMI? Intentional — only native zero-dependency way to respawn monitor if killed. See CODE_REVIEW.md.

MIT licensed — no keys or personal configs in repo.