Integration guide
Installation prerequisites and the secure integration contract for the future Windows scanning engine.
File metadata, SHA-256 hashing, schema validation, localized management screens, and authenticated integration requests.
Malware detection, real-time monitoring, filesystem access, quarantine, Windows diagnostics, updates, and scheduled execution.
Connect in four steps
Install a trusted Windows service
No native installer is included in this milestone. Build or supply a signed agent implementing contract v1. Do not install an unknown executable or weaken Windows safeguards.
Configure a trusted loopback endpoint
Bind HTTPS to localhost / 127.0.0.1 on port 17443 only. Use a trusted certificate, an exact client-origin allowlist, and explicit browser local-network permission where required.
Pair through the native agent
The agent authenticates the Windows user and issues a short-lived, scoped session token after explicit consent. Paste it into Connect engine. The browser never persists it.
Verify status, then scan
Refresh diagnostics. Submit explicitly selected files or use agent-defined scan scopes. Treat all unknown, stale, and failed responses as unverified—not healthy.
Service security requirements
Server validation and authorization are mandatory. Reject raw paths, traversal, network paths, alternate streams, and unsafe reparse-point traversal. Resolve file identity by handle within granted roots, recheck before mutation, recompute hashes, bound archives/resources, and never execute content. Store quarantine with restrictive ACLs and transactional audit records. Privileged mutations require independently verified signature evidence and explicit consent.
Integration contract v1
Typed schemas live in src/scanner/models.ts; the client implementation is in src/scanner/client.ts. Every endpoint requires a scoped session, strict validation, safe errors, and a 10-second client timeout. Full installation, authorization, and acceptance requirements are in docs/AGENT_INTEGRATION.md.
GET /v1/status GET /v1/scans POST /v1/scans POST /v1/scans/uploads POST /v1/picker/folder POST /v1/scans/:id/cancel GET /v1/quarantine POST /v1/quarantine POST /v1/quarantine/:id/restore POST /v1/quarantine/:id/delete GET /v1/schedule PUT /v1/schedule POST /v1/updates
What this milestone does not do
No native scanner, signature database, installer, or real-time driver is bundled. Agent responses are schema-validated, not independently malware-certified. The client cannot prove an arbitrary agent is trustworthy. Connection credentials are session-only; security records stay with the agent.
Integration questions
Does DZ Shield scan my Windows system from the browser?
No. Quick, full, and folder scans are requests to an authenticated local Windows service. Browser-selected files can be hashed locally, but that is not malware detection.
Will it disable Microsoft Defender?
No. The security center is read-only. The integration must not disable antivirus software, tamper protection, firewalls, or other Windows safeguards.
Can suspicious files be quarantined automatically?
No. Suspicious indicators are distinct from confirmed signature matches. Quarantine requires service-verified evidence, authorization, and explicit confirmation.