# Blizzfull Connect — Mac pilot setup

This package prepares a MacBook client. It is not a production-ready replacement for the existing VPN or remote desktop service. The office server still needs VPN forwarding/NAT, enforced-MFA, desktop authorization, clipboard, revocation, leak and audit acceptance checks. **Finish with the new VPN disconnected and automatic connection disabled.** Do not change the Mac's default route or existing remote access during this installation.

## Scope and completion

Install the signed Defguard and RustDesk clients, build the included Blizzfull Connect launcher locally, and enroll this MacBook through `https://access.blizzfull.com` using the owner's approved `blizzfull.com` Google Workspace account. Completion means installed, signature-checked, enrolled where possible, and disconnected; it does not mean the VPN or desktop service works end to end.

Do the work directly using available local tools. Read applicable local AGENTS.md guidance. Ask the user only for credentials, native authentication/consent or an approval your tools require. Open the exact flow first; do not hand them shell commands. Do not put passwords, MFA codes, enrollment URLs/tokens or VPN private keys in chat, source control or reports. Preserve existing applications, settings and connections.

## Verify and install vendor clients

1. Verify the downloaded package SHA-256 against the value in the user's handoff prompt before extracting it. Reject archive traversal, links and unexpected paths. Read this document and the included scripts before running them.
2. Inspect the Mac's architecture, macOS version, installed clients and current connections. The launcher requires macOS 13 or later. Use the native architecture, accounting for a shell running under Rosetta.
3. `config/clients.lock.json` pins the official vendor downloads for Apple silicon and Intel. `scripts/fetch-clients.py --platform macos-arm64` or `--platform macos-x64` downloads and verifies them without installation. Use existing suitable Python or equivalent standard tools; do not pipe downloaded scripts directly into a shell.
4. Mount each verified DMG read-only. Before copying its app, require strict code-signature verification and a successful Gatekeeper assessment. Expected identities are in `config/vendor-identities.json`: Defguard `net.defguard`, Team ID `82GZ7KN29J`; RustDesk `com.carriez.rustdesk`, Team ID `HZF9JMC8YN`. Recheck installed bundles afterward. Never remove quarantine attributes, disable Gatekeeper, change trust settings, or bypass a warning. A verification failure is a blocker.
5. Install in `/Applications` using the normal vendor layout. Preserve any previous version/configuration; do not downgrade or overwrite a running client silently. Open Defguard to finish its normal background-service installation, requesting only unavoidable native administrator approval. Do not enable incoming access to this MacBook through RustDesk or grant screen recording, accessibility or full disk access for this client-only setup. Stage RustDesk without launching its public rendezvous workflow.

## Build the custom launcher

The source under `client/` is a small Rust/Tauri launcher; it is not a VPN implementation. There is deliberately no downloaded unsigned app to bypass Gatekeeper for.

Reuse installed build tools where possible. The project uses Node 24, Rust 1.98.0 and the macOS SDK/command-line tools. If a prerequisite is missing, install it through its official mechanism without changing unrelated global project defaults. Keep `package-lock.json` and `src-tauri/Cargo.lock` unchanged.

From `client/`, install locked npm dependencies with `npm ci`, run `npm test`, and build with `npm run bundle -- --bundles app`. Verify the local app's code signature, then install the locally built `Blizzfull Connect.app` in `/Applications` without replacing an existing app without a recoverable backup. Verify it opens and sees the installed vendor clients. Record the build as local/ad-hoc, not Apple-notarized or approved for team distribution.

## Enroll, then leave disconnected

Use the official Defguard client and the HTTPS enrollment site above. Keep auto-connect off and do not press Connect. Let the owner complete Google authentication/MFA directly in its normal interface when required. Use a device name that identifies this MacBook uniquely; never import another machine's private key or reuse its device record.

Read the installed client's help before using its CLI. Report only sanitized metadata from its inventory/status. The expected instance name is `Blizzfull`, location `Office`, and the location must require external OIDC MFA. Advertised full-tunnel routes are `0.0.0.0/0` and `::/0`; those settings alone do not prove a kill switch or safe IPv6 handling.

For the launcher, use only a verified HTTPS company origin that exactly matches the enrolled Defguard instance. The enrollment site is not proof of the client's stored instance URL. If the client reports HTTP, localhost, an unreachable admin URL or a different origin, leave the launcher unconfigured and report the mismatch; do not weaken its checks or invent an address. Leave the desktop list empty until the server operator supplies a verified private VPN address and desktop authorization.

Do not contact public RustDesk IDs/relays, add remote desktop credentials or test clipboard transfer yet. Once the server is ready, a separate authorized test will cover real VPN MFA, office internet egress, DNS/IPv6 leaks, disconnect/kill-switch/revocation behavior and an authenticated desktop session with bidirectional clipboard.

## Report

Return a short report with architecture/macOS, installed versions and signature/Team-ID checks, local launcher build/test results, enrollment outcome, sanitized instance URL/location/MFA mode, and confirmation that the new tunnel is disconnected and existing access still works. Separate completed work from any native approval or server-side blocker. Do not claim overall security or production readiness from installation success.