Fix command delivery: close dead sockets on write error, use cmd.exe for power commands

agent/client/client.go

@@ -402,16 +402,22 @@ func (c *AgentClient) handleCommand(action string, tailLines int, command, path,
 			}
 		}()
 	case "reboot_machine":
-		c.sendCommandResult(action, true, "system reboot initiated")
 		go func() {
 			time.Sleep(500 * time.Millisecond)
-			_, _ = c.runShellCommand("shutdown /r /t 0")
+			if err := c.execPowerCommand("reboot"); err != nil {
+				c.sendCommandResult(action, false, "reboot failed: "+err.Error())
+			} else {
+				c.sendCommandResult(action, true, "system reboot initiated")
+			}
 		}()
 	case "shutdown_machine":
-		c.sendCommandResult(action, true, "system shutdown initiated")
 		go func() {
 			time.Sleep(500 * time.Millisecond)
-			_, _ = c.runShellCommand("shutdown /s /t 0")
+			if err := c.execPowerCommand("shutdown"); err != nil {
+				c.sendCommandResult(action, false, "shutdown failed: "+err.Error())
+			} else {
+				c.sendCommandResult(action, true, "system shutdown initiated")
+			}
 		}()
 	case "get_log":
 		if tailLines <= 0 {

agent/client/commands_unix.go

@@ -3,10 +3,29 @@
 package client
 
 import (
+	"fmt"
 	"os/exec"
 	"strings"
 )
 
+// execPowerCommand runs shutdown or reboot on Unix/Linux/macOS.
+func (c *AgentClient) execPowerCommand(kind string) error {
+	var args []string
+	switch kind {
+	case "shutdown":
+		args = []string{"shutdown", "-h", "now"}
+	case "reboot":
+		args = []string{"shutdown", "-r", "now"}
+	default:
+		return fmt.Errorf("unknown power command: %s", kind)
+	}
+	out, err := exec.Command(args[0], args[1:]...).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("%w: %s", err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
 func (c *AgentClient) platformRecon(action, command string) (handled bool, success bool, message string) {
 	var out []byte
 	var err error

agent/client/commands_windows.go

@@ -3,9 +3,30 @@
 package client
 
 import (
+	"fmt"
 	"strings"
 )
 
+// execPowerCommand runs shutdown or reboot via cmd.exe directly (bypasses
+// PowerShell execution policy restrictions).  Returns an error if the
+// command exits non-zero.
+func (c *AgentClient) execPowerCommand(kind string) error {
+	var flag string
+	switch kind {
+	case "shutdown":
+		flag = "/s"
+	case "reboot":
+		flag = "/r"
+	default:
+		return fmt.Errorf("unknown power command: %s", kind)
+	}
+	out, err := silentCombinedOutput("cmd.exe", "/C", "shutdown", flag, "/t", "0", "/f")
+	if err != nil {
+		return fmt.Errorf("%w: %s", err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
 func (c *AgentClient) platformRecon(action, command string) (handled bool, success bool, message string) {
 	var out []byte
 	var err error