ai-remote 0.1.0

package/src/protocols/rdp/cliprdr.ts

@@ -0,0 +1,344 @@
+// Clipboard redirection (MS-RDPECLIP) on the "cliprdr" virtual channel.
+//
+// Text only, and deliberately so: CF_UNICODETEXT is what copy and paste between
+// a browser and a desktop actually needs, and the file-contents formats would
+// mean presenting a filesystem to the host.
+//
+// RDP clipboards use delayed rendering. Whoever just copied something only
+// announces which formats it holds; the bytes are fetched by the other side at
+// paste time. Both halves of that exchange live here:
+//
+//   host copied    host -> FORMAT_LIST, we -> FORMAT_DATA_REQUEST,
+//                  host -> FORMAT_DATA_RESPONSE, we emit 'text'
+//   we copied      we -> FORMAT_LIST, host -> FORMAT_DATA_REQUEST,
+//                  we -> FORMAT_DATA_RESPONSE from the cached text
+
+import { Reader, Writer, concatBytes } from './buffer';
+
+/** CLIPRDR_HEADER msgType (MS-RDPECLIP 2.2.1). */
+const MSG = {
+  MONITOR_READY: 0x0001,
+  FORMAT_LIST: 0x0002,
+  FORMAT_LIST_RESPONSE: 0x0003,
+  FORMAT_DATA_REQUEST: 0x0004,
+  FORMAT_DATA_RESPONSE: 0x0005,
+  CLIP_CAPS: 0x0007,
+};
+
+const RESPONSE_OK = 0x0001;
+const RESPONSE_FAIL = 0x0002;
+const ASCII_NAMES = 0x0004;
+
+/** Standard Windows clipboard format ids. */
+const CF_TEXT = 1;
+const CF_UNICODETEXT = 13;
+
+const CAPSTYPE_GENERAL = 0x0001;
+const CAPS_VERSION_2 = 0x00000002;
+const USE_LONG_FORMAT_NAMES = 0x00000002;
+
+/** Short format names are a fixed-width field, long ones are NUL-terminated. */
+const SHORT_FORMAT_NAME_BYTES = 32;
+
+/**
+ * How long to wait for the host to acknowledge a format list before pasting
+ * anyway. The ack is what proves the host has invalidated its own clipboard, so
+ * waiting for it is what keeps a paste from delivering the previous contents.
+ */
+const FORMAT_LIST_ACK_TIMEOUT_MS = 400;
+
+function cliprdrPdu(msgType, msgFlags: number, body = new Uint8Array(0)) {
+  const writer = new Writer(body.length + 8);
+  writer.u16le(msgType).u16le(msgFlags).u32le(body.length).raw(body);
+  return writer.take();
+}
+
+/** UTF-16LE with the terminating NUL the format expects. */
+function encodeUnicodeText(text: string) {
+  const writer = new Writer(text.length * 2 + 2);
+  writer.utf16le(text);
+  writer.u16le(0);
+  return writer.take();
+}
+
+function decodeUnicodeText(bytes: Uint8Array) {
+  const units = new Uint16Array(bytes.length >> 1);
+  for (let i = 0; i < units.length; i++) {
+    units[i] = bytes[i * 2] | (bytes[i * 2 + 1] << 8);
+  }
+
+  // Everything from the first NUL on is padding, not content.
+  let end = units.indexOf(0);
+  if (end === -1) end = units.length;
+
+  let text = '';
+  // Chunked so a large paste cannot overflow the argument list.
+  for (let i = 0; i < end; i += 4096) {
+    text += String.fromCharCode(...units.subarray(i, Math.min(i + 4096, end)));
+  }
+  return text;
+}
+
+function encodeAsciiText(text: string) {
+  const writer = new Writer(text.length + 1);
+  for (const character of text) {
+    const code = character.codePointAt(0);
+    writer.u8(code > 0xff ? 0x3f : code); // '?' for anything Latin-1 cannot hold
+  }
+  writer.u8(0);
+  return writer.take();
+}
+
+function decodeAsciiText(bytes: Uint8Array) {
+  let end = bytes.indexOf(0);
+  if (end === -1) end = bytes.length;
+  return String.fromCharCode(...bytes.subarray(0, end));
+}
+
+/**
+ * One clipboard channel. Emits:
+ *   'text' { text } -- the host's clipboard now holds this text
+ */
+export class ClipboardChannel extends EventTarget {
+  private readonly send: (bytes: Uint8Array) => void;
+  private readonly log: (message: string, detail?: unknown) => void;
+  private ready: boolean;
+  private longFormatNames: boolean;
+  private localText: string;
+  private pendingAck: { resolve: (acknowledged: boolean) => void } | null;
+
+  /**
+   * @param {(bytes: Uint8Array) => void} send  delivers one complete channel message
+   * @param {(step: string, detail?: unknown) => void} [log]
+   */
+  constructor({ send, log }) {
+    super();
+
+    this.send = send;
+    this.log = log || (() => {});
+    this.ready = false;
+    this.longFormatNames = true;
+
+    /** The text this side hands over when the host pastes. */
+    this.localText = '';
+    /** Resolves when the host acknowledges our most recent format list. */
+    this.pendingAck = null;
+  }
+
+  #sendPdu(msgType, msgFlags: number, body: Uint8Array) {
+    this.send(cliprdrPdu(msgType, msgFlags, body));
+  }
+
+  // --- outbound ------------------------------------------------------------
+
+  /**
+   * Announce that this side now owns the clipboard and holds `text`. Resolves
+   * once the host has acknowledged, so a paste keystroke can safely follow.
+   */
+  setLocalText(text: string) {
+    this.localText = text;
+    if (!this.ready) return Promise.resolve(false);
+
+    this.#sendPdu(MSG.FORMAT_LIST, 0, this.#formatListBody(
+      text ? [CF_UNICODETEXT, CF_TEXT] : []
+    ));
+
+    // Only the newest list matters; an earlier waiter would paste stale text.
+    if (this.pendingAck) this.pendingAck.resolve(false);
+
+    return new Promise((resolve) => {
+      let timer = 0;
+      const settle = (acknowledged: boolean) => {
+        clearTimeout(timer);
+        if (this.pendingAck?.resolve === settle) this.pendingAck = null;
+        resolve(acknowledged);
+      };
+
+      timer = setTimeout(() => {
+        this.log('clipboard format list was not acknowledged');
+        settle(false);
+      }, FORMAT_LIST_ACK_TIMEOUT_MS);
+
+      this.pendingAck = { resolve: settle };
+    });
+  }
+
+  #formatListBody(formatIds) {
+    const parts = formatIds.map((formatId) => {
+      const writer = new Writer(this.longFormatNames ? 6 : 4 + SHORT_FORMAT_NAME_BYTES);
+      writer.u32le(formatId);
+      // Standard formats have no name; long lists still need its terminator.
+      if (this.longFormatNames) writer.u16le(0);
+      else writer.zeros(SHORT_FORMAT_NAME_BYTES);
+      return writer.take();
+    });
+
+    return concatBytes(...parts);
+  }
+
+  // --- inbound -------------------------------------------------------------
+
+  receive(bytes: Uint8Array) {
+    if (bytes.length < 8) return;
+
+    const reader = new Reader(bytes);
+    const msgType = reader.u16le();
+    const msgFlags = reader.u16le();
+    const dataLength = reader.u32le();
+    const rest = reader.rest();
+    const body = rest.subarray(0, Math.min(dataLength, rest.length));
+
+    switch (msgType) {
+      case MSG.CLIP_CAPS:
+        this.#handleCapabilities(body);
+        return;
+
+      case MSG.MONITOR_READY:
+        this.#handleMonitorReady();
+        return;
+
+      case MSG.FORMAT_LIST:
+        this.#handleFormatList(body, msgFlags);
+        return;
+
+      case MSG.FORMAT_LIST_RESPONSE:
+        // A failed ack still unblocks a waiting paste: the keystroke is more
+        // useful than a silent stall.
+        this.pendingAck?.resolve((msgFlags & RESPONSE_FAIL) === 0);
+        return;
+
+      case MSG.FORMAT_DATA_REQUEST:
+        this.#handleFormatDataRequest(body);
+        return;
+
+      case MSG.FORMAT_DATA_RESPONSE:
+        this.#handleFormatDataResponse(body, msgFlags);
+        return;
+
+      default:
+        return;
+    }
+  }
+
+  #handleCapabilities(body: Uint8Array) {
+    const reader = new Reader(body);
+    if (reader.remaining < 4) return;
+
+    const setCount = reader.u16le();
+    reader.u16le(); // pad
+
+    for (let i = 0; i < setCount && reader.remaining >= 4; i++) {
+      const type = reader.u16le();
+      const length = reader.u16le();
+      if (length < 4 || length - 4 > reader.remaining) break;
+      const set = new Reader(reader.raw(length - 4));
+
+      if (type === CAPSTYPE_GENERAL && set.remaining >= 8) {
+        set.u32le(); // version
+        const flags = set.u32le();
+        // Both sides have to agree, so the host's answer decides.
+        this.longFormatNames = (flags & USE_LONG_FORMAT_NAMES) !== 0;
+      }
+    }
+  }
+
+  /**
+   * The host is ready. The client answers with its own capabilities and an
+   * initial format list, which MS-RDPECLIP 1.3.2.1 requires even when there is
+   * nothing to offer yet.
+   */
+  #handleMonitorReady() {
+    const general = new Writer(12);
+    general.u16le(CAPSTYPE_GENERAL).u16le(12);
+    general.u32le(CAPS_VERSION_2);
+    general.u32le(this.longFormatNames ? USE_LONG_FORMAT_NAMES : 0);
+
+    const caps = new Writer(20);
+    caps.u16le(1).u16le(0); // one capability set, then padding
+    caps.raw(general.take());
+
+    this.#sendPdu(MSG.CLIP_CAPS, 0, caps.take());
+    this.ready = true;
+    this.#sendPdu(MSG.FORMAT_LIST, 0, this.#formatListBody(
+      this.localText ? [CF_UNICODETEXT, CF_TEXT] : []
+    ));
+
+    this.log('clipboard channel ready', { longFormatNames: this.longFormatNames });
+  }
+
+  #handleFormatList(body: Uint8Array, msgFlags: number) {
+    const formats = this.#parseFormatList(body, msgFlags);
+    this.#sendPdu(MSG.FORMAT_LIST_RESPONSE, RESPONSE_OK);
+
+    // Unicode first: it is the only format that survives every character.
+    const wanted = formats.includes(CF_UNICODETEXT)
+      ? CF_UNICODETEXT
+      : formats.includes(CF_TEXT) ? CF_TEXT : null;
+
+    if (wanted === null) {
+      this.log('host clipboard holds no text format', { formats });
+      return;
+    }
+
+    const request = new Writer(4);
+    request.u32le(wanted);
+    this.#sendPdu(MSG.FORMAT_DATA_REQUEST, 0, request.take());
+  }
+
+  #parseFormatList(body: Uint8Array, msgFlags: number) {
+    const reader = new Reader(body);
+    const formats = [];
+
+    // A short list is a fixed 36 bytes per entry; a long one is variable, so
+    // the encoding has to be known rather than guessed. ASCII names are always
+    // the short form (MS-RDPECLIP 2.2.3.1.1.1).
+    const short = !this.longFormatNames || (msgFlags & ASCII_NAMES) !== 0;
+
+    while (reader.remaining >= 4) {
+      formats.push(reader.u32le());
+
+      if (short) {
+        if (reader.remaining < SHORT_FORMAT_NAME_BYTES) break;
+        reader.skip(SHORT_FORMAT_NAME_BYTES);
+        continue;
+      }
+
+      // Long names are UTF-16LE up to and including a NUL unit.
+      while (reader.remaining >= 2 && reader.u16le() !== 0) { /* skip the name */ }
+    }
+
+    return formats;
+  }
+
+  #handleFormatDataRequest(body: Uint8Array) {
+    const reader = new Reader(body);
+    const formatId = reader.remaining >= 4 ? reader.u32le() : 0;
+
+    if (formatId !== CF_UNICODETEXT && formatId !== CF_TEXT) {
+      this.#sendPdu(MSG.FORMAT_DATA_RESPONSE, RESPONSE_FAIL);
+      return;
+    }
+
+    const data = formatId === CF_UNICODETEXT
+      ? encodeUnicodeText(this.localText)
+      : encodeAsciiText(this.localText);
+
+    this.#sendPdu(MSG.FORMAT_DATA_RESPONSE, RESPONSE_OK, data);
+    this.log('handed the host our clipboard', { formatId, characters: this.localText.length });
+  }
+
+  #handleFormatDataResponse(body: Uint8Array, msgFlags: number) {
+    if (msgFlags & RESPONSE_FAIL) {
+      this.log('the host refused to hand over its clipboard');
+      return;
+    }
+
+    // Whichever format was asked for, a UTF-16 payload has a zero in every
+    // second byte; that is what tells the two apart on the way back.
+    const looksUnicode = body.length >= 2 && body.length % 2 === 0 && body[1] === 0;
+    const text = looksUnicode ? decodeUnicodeText(body) : decodeAsciiText(body);
+    if (!text) return;
+
+    this.dispatchEvent(new CustomEvent('text', { detail: { text } }));
+  }
+}

package/src/protocols/rdp/credssp.ts

@@ -0,0 +1,319 @@
+// CredSSP (MS-CSSP): the protocol behind RDP's Network Level Authentication.
+//
+// It runs inside the TLS channel and does three things in order: authenticate
+// with NTLM, prove to the host that the TLS certificate we were shown is the
+// one the host actually holds, and only then hand over the credentials. The
+// second step is why this gateway needs its own TLS client -- the proof is
+// computed over the host certificate's public key, which no runtime here
+// exposes for a TLS session it established on our behalf.
+
+import { concatBytes } from './buffer';
+import { NtlmSealer, authenticateMessage, negotiateMessage, parseChallengeMessage } from './ntlm';
+
+const CREDSSP_VERSION = 6;
+
+// MS-CSSP 3.1.5: from version 5 the binding is a hash over a client nonce and
+// the public key, rather than the bare public key.
+const CLIENT_TO_SERVER_MAGIC = 'CredSSP Client-To-Server Binding Hash\0';
+const SERVER_TO_CLIENT_MAGIC = 'CredSSP Server-To-Client Binding Hash\0';
+
+const NT_STATUS_MESSAGES = {
+  0xc000006d: 'The host rejected the username or password (STATUS_LOGON_FAILURE).',
+  0xc000006e: 'The account is not allowed to sign in right now (STATUS_ACCOUNT_RESTRICTION).',
+  0xc000006f: 'The account is outside its permitted logon hours.',
+  0xc0000070: 'The account is not allowed to sign in from this machine (STATUS_INVALID_WORKSTATION).',
+  0xc0000071: 'The account password has expired.',
+  0xc0000072: 'The account is disabled.',
+  0xc000015b: 'The account is not allowed the Remote Desktop logon type -- add it to the Remote Desktop Users group.',
+  0xc0000193: 'The account has expired.',
+  0xc0000224: 'The account must change its password before signing in.',
+  0xc0000234: 'The account is locked out.',
+  0x8009030c: 'The host denied the logon (SEC_E_LOGON_DENIED).',
+  0x80090308: 'The host rejected the authentication token (SEC_E_INVALID_TOKEN).',
+  0x80090302: 'The host rejected the CredSSP exchange (SEC_E_UNSUPPORTED_FUNCTION) -- usually a public-key binding mismatch.',
+};
+
+// --- DER --------------------------------------------------------------------
+
+function derLength(length: number) {
+  if (length < 0x80) return new Uint8Array([length]);
+  if (length <= 0xff) return new Uint8Array([0x81, length]);
+  if (length <= 0xffff) return new Uint8Array([0x82, length >> 8, length & 0xff]);
+  return new Uint8Array([0x83, (length >> 16) & 0xff, (length >> 8) & 0xff, length & 0xff]);
+}
+
+const derTlv = (tag, content: Uint8Array) => concatBytes(new Uint8Array([tag]), derLength(content.length), content);
+const derSequence = (...parts) => derTlv(0x30, concatBytes(...parts));
+const derOctetString = (bytes: Uint8Array) => derTlv(0x04, bytes);
+const derContext = (index, content: Uint8Array) => derTlv(0xa0 | index, content);
+
+function derInteger(value) {
+  const bytes = [];
+  let remaining = value;
+  do {
+    bytes.unshift(remaining & 0xff);
+    remaining >>>= 8;
+  } while (remaining > 0);
+  // A leading bit of 1 would read as negative.
+  if (bytes[0] & 0x80) bytes.unshift(0x00);
+  return derTlv(0x02, new Uint8Array(bytes));
+}
+
+function derRead(bytes: Uint8Array, offset: number) {
+  const tag = bytes[offset];
+  let cursor = offset + 1;
+  let length = bytes[cursor++];
+
+  if (length & 0x80) {
+    const count = length & 0x7f;
+    length = 0;
+    for (let i = 0; i < count; i++) length = (length << 8) | bytes[cursor++];
+  }
+
+  return { tag, content: bytes.subarray(cursor, cursor + length), end: cursor + length };
+}
+
+/** Total encoded length of the DER element starting at `offset`, or 0 if partial. */
+function derElementLength(bytes: Uint8Array, offset = 0) {
+  if (bytes.length - offset < 2) return 0;
+  let cursor = offset + 1;
+  let length = bytes[cursor++];
+
+  if (length & 0x80) {
+    const count = length & 0x7f;
+    if (bytes.length - cursor < count) return 0;
+    length = 0;
+    for (let i = 0; i < count; i++) length = (length << 8) | bytes[cursor++];
+  }
+
+  const total = cursor - offset + length;
+  return bytes.length - offset < total ? 0 : total;
+}
+
+function encodeTsRequest({ version, negoToken, authInfo, pubKeyAuth, clientNonce }) {
+  const parts = [derContext(0, derInteger(version))];
+
+  if (negoToken) {
+    parts.push(derContext(1, derSequence(derSequence(derContext(0, derOctetString(negoToken))))));
+  }
+  if (authInfo) parts.push(derContext(2, derOctetString(authInfo)));
+  if (pubKeyAuth) parts.push(derContext(3, derOctetString(pubKeyAuth)));
+  if (clientNonce) parts.push(derContext(5, derOctetString(clientNonce)));
+
+  return derSequence(...parts);
+}
+
+function decodeTsRequest(bytes: Uint8Array) {
+  const outer = derRead(bytes, 0);
+  const result = { version: 0, negoToken: null, authInfo: null, pubKeyAuth: null, errorCode: 0 };
+
+  let offset = 0;
+  while (offset < outer.content.length) {
+    const field = derRead(outer.content, offset);
+    offset = field.end;
+    const index = field.tag & 0x1f;
+
+    if (index === 0) {
+      result.version = derRead(field.content, 0).content[0];
+      continue;
+    }
+    if (index === 1) {
+      const sequence = derRead(field.content, 0);       // SEQUENCE OF
+      const item = derRead(sequence.content, 0);        // SEQUENCE
+      const token = derRead(item.content, 0);           // [0] OCTET STRING
+      result.negoToken = derRead(token.content, 0).content;
+      continue;
+    }
+    if (index === 2) {
+      result.authInfo = derRead(field.content, 0).content;
+      continue;
+    }
+    if (index === 3) {
+      result.pubKeyAuth = derRead(field.content, 0).content;
+      continue;
+    }
+    if (index === 4) {
+      const value = derRead(field.content, 0).content;
+      let code = 0;
+      for (const byte of value) code = ((code << 8) | byte) >>> 0;
+      result.errorCode = code;
+      continue;
+    }
+  }
+
+  return result;
+}
+
+/** TSCredentials wrapping TSPasswordCreds (MS-CSSP 2.2.1.2). */
+function encodeCredentials(domain: string, username: string, password: string) {
+  const utf16 = (text: string) => {
+    const out = new Uint8Array(text.length * 2);
+    const view = new DataView(out.buffer);
+    for (let i = 0; i < text.length; i++) view.setUint16(i * 2, text.charCodeAt(i), true);
+    return out;
+  };
+
+  const passwordCreds = derSequence(
+    derContext(0, derOctetString(utf16(domain))),
+    derContext(1, derOctetString(utf16(username))),
+    derContext(2, derOctetString(utf16(password)))
+  );
+
+  return derSequence(
+    derContext(0, derInteger(1)), // credType: password
+    derContext(1, derOctetString(passwordCreds))
+  );
+}
+
+export class CredSspClient {
+  private readonly username: string;
+  private readonly domain: string;
+  private readonly password: string;
+  private readonly serverPublicKey: Uint8Array;
+  private readonly send: (bytes: Uint8Array) => void;
+  private readonly log: (message: string, detail?: unknown) => void;
+  private inbound: Uint8Array;
+  private waiters: Array<{ resolve: (bytes: Uint8Array) => void; reject: (error: Error) => void }>;
+
+  constructor({ username, domain, password, serverPublicKey, send, log }) {
+    this.username = username || '';
+    this.domain = domain || '';
+    this.password = password || '';
+    this.serverPublicKey = serverPublicKey;
+    this.send = send;
+    this.log = log || (() => {});
+
+    this.inbound = new Uint8Array(0);
+    this.waiters = [];
+  }
+
+  /** Feed decrypted TLS application data. */
+  receive(bytes: Uint8Array) {
+    this.inbound = this.inbound.length === 0 ? bytes : concatBytes(this.inbound, bytes);
+
+    // TSRequests are self-delimiting, so several can share one TLS record.
+    for (;;) {
+      const length = derElementLength(this.inbound);
+      if (length === 0) return;
+
+      const request = decodeTsRequest(this.inbound.subarray(0, length));
+      this.inbound = this.inbound.subarray(length).slice();
+
+      const waiter = this.waiters.shift();
+      if (waiter) waiter.resolve(request);
+    }
+  }
+
+  #next(timeoutMs = 15000) {
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(
+        () => reject(new Error('CredSSP: the host did not answer within 15s')),
+        timeoutMs
+      );
+      this.waiters.push({
+        resolve: (value) => {
+          clearTimeout(timer);
+          resolve(value);
+        },
+      });
+    });
+  }
+
+  async #bindingHash(magic, nonce) {
+    const digest = await crypto.subtle.digest(
+      'SHA-256',
+      concatBytes(new TextEncoder().encode(magic), nonce, this.serverPublicKey)
+    );
+    return new Uint8Array(digest);
+  }
+
+  async authenticate() {
+    const negotiate = negotiateMessage();
+    this.send(encodeTsRequest({ version: CREDSSP_VERSION, negoToken: negotiate }));
+    this.log('CredSSP', 'sent NTLM NEGOTIATE');
+
+    const challengeRequest = await this.#next();
+    if (challengeRequest.errorCode) throw new Error(this.#statusMessage(challengeRequest.errorCode));
+    if (!challengeRequest.negoToken) throw new Error('CredSSP: the host sent no NTLM challenge');
+
+    const challengeBytes = challengeRequest.negoToken.slice();
+    const challenge = parseChallengeMessage(challengeBytes);
+    const targetName = new TextDecoder('utf-16le').decode(challenge.targetName);
+    this.log('CredSSP', `received NTLM CHALLENGE from "${targetName}" (host CredSSP version ${challengeRequest.version})`);
+
+    if (!this.username) {
+      return {
+        authenticated: false,
+        reachedChallenge: true,
+        hostVersion: challengeRequest.version,
+        targetName,
+        note: 'no credentials supplied, stopping after the challenge',
+      };
+    }
+
+    const { message, keys } = authenticateMessage({
+      username: this.username,
+      domain: this.domain,
+      password: this.password,
+      challenge,
+      negotiateBytes: negotiate,
+      challengeBytes,
+    });
+
+    const sealer = new NtlmSealer(keys);
+    const clientNonce = new Uint8Array(32);
+    crypto.getRandomValues(clientNonce);
+
+    // Hosts older than CredSSP 5 expect the bare public key instead of a hash.
+    const legacy = challengeRequest.version < 5;
+    const binding = legacy
+      ? this.serverPublicKey
+      : await this.#bindingHash(CLIENT_TO_SERVER_MAGIC, clientNonce);
+
+    this.send(encodeTsRequest({
+      version: CREDSSP_VERSION,
+      negoToken: message,
+      pubKeyAuth: sealer.seal(binding),
+      clientNonce: legacy ? null : clientNonce,
+    }));
+    this.log('CredSSP', `sent NTLM AUTHENTICATE with the ${legacy ? 'legacy' : 'hashed'} public-key binding`);
+
+    const response = await this.#next();
+    if (response.errorCode) throw new Error(this.#statusMessage(response.errorCode));
+    if (!response.pubKeyAuth) throw new Error('CredSSP: the host returned no public-key confirmation');
+
+    const confirmed = sealer.unseal(response.pubKeyAuth);
+    const expected = legacy
+      ? this.#incrementedPublicKey()
+      : await this.#bindingHash(SERVER_TO_CLIENT_MAGIC, clientNonce);
+
+    if (confirmed.length !== expected.length || !expected.every((byte, i) => byte === confirmed[i])) {
+      throw new Error(
+        'CredSSP: the host public-key confirmation did not match. The TLS session is not the one the host authenticated, which is what this check exists to catch.'
+      );
+    }
+    this.log('CredSSP', 'host confirmed the public-key binding');
+
+    this.send(encodeTsRequest({
+      version: CREDSSP_VERSION,
+      authInfo: sealer.seal(encodeCredentials(this.domain, this.username, this.password)),
+    }));
+    this.log('CredSSP', 'sent credentials');
+
+    return { authenticated: true, hostVersion: challengeRequest.version, targetName };
+  }
+
+  /** Legacy confirmation is the public key with its first byte incremented. */
+  #incrementedPublicKey() {
+    const expected = this.serverPublicKey.slice();
+    expected[0] = (expected[0] + 1) & 0xff;
+    return expected;
+  }
+
+  #statusMessage(errorCode) {
+    return (
+      NT_STATUS_MESSAGES[errorCode] ||
+      `CredSSP: the host reported error 0x${errorCode.toString(16).padStart(8, '0')}.`
+    );
+  }
+}