dsh-winrm 0.1.0 → 0.2.0

package/lib/index.js

@@ -9,6 +9,50 @@ import { homedir, tmpdir } from "node:os";
 import { WebSocket, WebSocketServer } from "ws";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 //#region src/powershell.ts
+/**
+* PowerShell snippet builders and the WinRM UTF-8 envelope.
+*
+* The user script is delivered on the WinRS **stdin** stream, not on the
+* command line. WinRS hands the command line to cmd.exe, which caps it at
+* ~8191 characters; `-EncodedCommand` inflates a script by 2.67x
+* (UTF-16LE → base64), so the command line can carry only about 1.5 KB of
+* script. That silently broke every large payload — most visibly the 48 KiB
+* transfer chunk, whose embedded base64 alone is ~65K characters.
+*
+* So the command line is now a *constant* outer script and the user script
+* rides stdin, which has no such limit (verified to 200 KB).
+*
+* The outer script reads a byte count, then that many bytes, starts a child
+* `powershell.exe` and feeds it the script on its stdin. The process boundary
+* is what makes `exit N` and an uncaught `throw` survivable: they terminate
+* the *child*, and the outer script is still alive to print the envelope.
+* `-EncodedCommand` for the child also sidesteps the execution policy
+* entirely — the policy governs `.ps1` files, not encoded commands — so no
+* temp file is written and no policy block can lose the envelope.
+*
+* The child body is `& (...) 2>&1 | Out-String -Stream`. Both halves matter:
+* `2>&1` pulls error records into the success stream, `Out-String -Stream`
+* stringifies them onto stdout *line by line*. Plain `Out-String` would also
+* stringify them but buffers the whole pipeline, discarding everything
+* produced before a mid-script `exit`; bare `2>&1` without `Out-String`
+* leaves the records to be re-serialized as CLIXML on stderr, where the
+* envelope's CLIXML stripping deletes the text outright.
+*
+* The envelope is three lines — a marker with the exit code, then one base64
+* line per stream:
+*
+*     __DSH_WINRM__<code>
+*     O:<base64 of UTF-8 stdout>
+*     E:<base64 of UTF-8 stderr>
+*
+* Every payload is ASCII, so the transport cannot corrupt it and Chinese
+* output survives losslessly. The `O:` / `E:` labels are load-bearing: the
+* WinRM client trims each response chunk, which can eat the newline between
+* two lines, and base64 never contains `:`, so the labels stay parseable
+* even when the separators vanish.
+*/
+/** Marker line prefix carrying the exit code: '__DSH_WINRM__<code>'. */
+const ENVELOPE_MARKER = "__DSH_WINRM__";
 /** PS single-quoted literal (doubles embedded quotes). */
 function sq(value) {
 	return "'" + value.replace(/'/g, "''") + "'";
@@ -18,28 +62,121 @@ function encodeCommand(script) {
 	return Buffer.from(script, "utf16le").toString("base64");
 }
 /**
-* The UTF-8 WinRM session script: runs `userScript` inside a script block,
-* merges stderr, prints the exit-code marker and base64 of UTF-8 output.
+* Outer script (constant, so the command line never grows with the payload):
+* read `<byteCount>\n<utf8 script>` from stdin, run it in a child
+* powershell.exe, then print the three-line envelope.
+*
+* The child is started with redirected streams *before* anything is written to
+* its stdin, and both readers are started before the write, so a child that
+* fills a pipe buffer cannot deadlock the outer script. Closing the writer is
+* what gives the child a real EOF — without it the child would block forever
+* on `CopyTo`.
 */
-function wrapEnvelope(userScript) {
-	return [
-		"$ErrorActionPreference = 'Continue'",
-		"$__out = & { " + userScript + " } 2>&1 | Out-String -Width 4096",
-		"$__code = 0",
-		"if ($null -ne $LASTEXITCODE) { $__code = $LASTEXITCODE }",
-		"[Console]::OutputEncoding = [System.Text.Encoding]::UTF8",
-		"'__DSH_WINRM__' + [string]$__code",
-		"[System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([string]$__out))",
+const OUTER_SCRIPT = [
+	"$ErrorActionPreference='Continue'",
+	"$z=@'",
+	[
+		"$ErrorActionPreference='Continue'",
+		"[Console]::OutputEncoding=[Text.Encoding]::UTF8",
+		"$i=[Console]::OpenStandardInput()",
+		"$m=New-Object System.IO.MemoryStream",
+		"$i.CopyTo($m)",
+		"$s=[Text.Encoding]::UTF8.GetString($m.ToArray())",
+		"if($s.Length -gt 0 -and [int]$s[0] -eq 0xFEFF){$s=$s.Substring(1)}",
+		"$c=0",
+		"try{ &([scriptblock]::Create($s)) 2>&1 | Out-String -Stream -Width 4096",
+		"if($null -ne $LASTEXITCODE){$c=$LASTEXITCODE}",
+		"}catch{ $_|Out-String; $c=1 }",
+		"exit $c",
 		""
-	].join("\r\n");
+	].join("\r\n"),
+	"'@",
+	"$a=''",
+	"$e=''",
+	"$c=0",
+	"try{",
+	"  $i=[Console]::OpenStandardInput()",
+	"  $d=''",
+	"  while($true){$b=$i.ReadByte();if($b -lt 0 -or $b -eq 10){break};if($b -ne 13){$d+=[char]$b}}",
+	"  $n=[int]$d",
+	"  $u=New-Object byte[] $n",
+	"  $r=0",
+	"  while($r -lt $n){$k=$i.Read($u,$r,$n-$r);if($k -le 0){break};$r+=$k}",
+	"  $s=[Text.Encoding]::UTF8.GetString($u,0,$r)",
+	"  $p=New-Object System.Diagnostics.ProcessStartInfo",
+	"  $p.FileName='powershell.exe'",
+	"  $p.UseShellExecute=$false",
+	"  $p.RedirectStandardOutput=$true",
+	"  $p.RedirectStandardError=$true",
+	"  $p.RedirectStandardInput=$true",
+	"  $p.StandardOutputEncoding=[Text.Encoding]::UTF8",
+	"  $p.StandardErrorEncoding=[Text.Encoding]::UTF8",
+	"  $p.CreateNoWindow=$true",
+	"  $p.Arguments='-NoProfile -NoLogo -ExecutionPolicy Bypass -EncodedCommand '+[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($z))",
+	"  $q=[System.Diagnostics.Process]::Start($p)",
+	"  $x=$q.StandardOutput.ReadToEndAsync()",
+	"  $y=$q.StandardError.ReadToEndAsync()",
+	"  $w=New-Object System.IO.StreamWriter($q.StandardInput.BaseStream,(New-Object System.Text.UTF8Encoding($false)))",
+	"  $w.Write($s)",
+	"  $w.Flush()",
+	"  $w.Close()",
+	"  $q.WaitForExit()",
+	"  $a=[string]$x.Result",
+	"  $e=[string]$y.Result",
+	"  $c=$q.ExitCode",
+	"}catch{",
+	"  $a=[string]$a+[string]($_|Out-String)",
+	"  $c=1",
+	"}",
+	sq(ENVELOPE_MARKER) + "+[string]$c",
+	"'O:'+[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes([string]$a))",
+	"'E:'+[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes([string]$e))",
+	""
+].join("\r\n");
+/**
+* The constant powershell.exe command line that runs the envelope.
+*
+* Deliberately takes no payload: keeping the command line under cmd.exe's
+* ~8191-character cap is the whole point of the stdin channel.
+*/
+function powershellCommandLine() {
+	return "powershell.exe -NoProfile -NoLogo -ExecutionPolicy Bypass -EncodedCommand " + encodeCommand(OUTER_SCRIPT);
 }
-/** One-shot script body for the PowerShell session already created by WinRM. */
-function winrmPowerShellScript(userScript) {
-	return wrapEnvelope(userScript);
+/**
+* The stdin payload for one command: the UTF-8 **byte** count, a newline, then
+* the raw script.
+*
+* The count is in bytes, not characters, because the outer script sizes its
+* receive buffer from it — a script with multi-byte characters would otherwise
+* be truncated mid-character.
+* @param userScript - the PowerShell script to run.
+* @returns the payload to send on WinRS stdin.
+*/
+function scriptPayload(userScript) {
+	return String(Buffer.byteLength(userScript, "utf8")) + "\n" + userScript;
 }
-/** The full powershell.exe command line (ASCII-safe) for a script body. */
-function powershellCommandLine(script) {
-	return "powershell.exe -NoProfile -NoLogo -ExecutionPolicy Bypass -EncodedCommand " + encodeCommand(script);
+/**
+* Split a payload into Send-sized pieces without cutting a surrogate pair.
+*
+* `Command.doSendInput` encodes each piece to UTF-8 independently, so a lone
+* surrogate at a chunk boundary would be replaced with U+FFFD and corrupt the
+* script. Iterating with `for…of` yields whole code points, so a pair always
+* stays in one piece.
+* @param payload - the full stdin payload.
+* @returns the pieces to send in order; never empty.
+*/
+function splitScriptPayload(payload) {
+	const pieces = [];
+	let piece = "";
+	for (const ch of payload) {
+		if (piece.length + ch.length > 16384) {
+			pieces.push(piece);
+			piece = "";
+		}
+		piece += ch;
+	}
+	if (piece !== "" || pieces.length === 0) pieces.push(piece);
+	return pieces;
 }
 /** JSON: full service table (CIM). */
 function psListServices() {
@@ -128,38 +265,39 @@ function psWriteChunk(p, b64, append) {
 		""
 	].join("\r\n");
 }
+/** Decode one base64 envelope field, tolerating whitespace the transport added. */
+function decodeField(base64) {
+	return Buffer.from(base64.replace(/\s+/g, ""), "base64").toString("utf8");
+}
 /**
-* Parse the envelope output: { exitCode, text } or null when absent.
+* Parse the three-line envelope: { exitCode, stdout, stderr } or null when absent.
 *
-* The base64 body is optional and the separating newline may be missing: a
-* command that printed nothing emits the marker alone (an empty string has
-* no base64 body), and a transport that trims each response drops the
-* trailing newline. The exit code is signed because `$LASTEXITCODE` can be
-* negative.
+* Fields are located by their `O:` / `E:` labels rather than by splitting on
+* newlines, because the WinRM client trims every response chunk and can drop
+* the newline that separated two lines. base64's alphabet has no colon, so a
+* label can only ever be a delimiter and the search cannot land on payload
+* data. The exit code is signed because `$LASTEXITCODE` can be negative.
+* @param output - the raw stdout accumulated from the WinRS stdout stream.
+* @returns the decoded envelope, or null when the marker is missing.
 */
 function parseEnvelope(output) {
-	const match = /^__DSH_WINRM__(-?\d+)(?:\r?\n([\s\S]*))?$/.exec(output);
-	if (match === null) return null;
-	const exitCode = Number.parseInt(match[1], 10);
-	const payload = (match[2] ?? "").trim();
-	try {
-		return {
-			exitCode,
-			text: Buffer.from(payload, "base64").toString("utf8")
-		};
-	} catch {
-		return {
-			exitCode,
-			text: payload
-		};
-	}
+	const text = output.trim();
+	const head = (/* @__PURE__ */ new RegExp("^__DSH_WINRM__(-?\\d+)")).exec(text);
+	if (head === null) return null;
+	const stdoutAt = text.indexOf("O:");
+	const stderrAt = stdoutAt === -1 ? -1 : text.indexOf("E:", stdoutAt + 2);
+	return {
+		exitCode: Number.parseInt(head[1], 10),
+		stdout: stdoutAt === -1 ? "" : decodeField(text.slice(stdoutAt + 2, stderrAt === -1 ? void 0 : stderrAt)),
+		stderr: stderrAt === -1 ? "" : decodeField(text.slice(stderrAt + 2))
+	};
 }
 /** The `#< CLIXML` stream header PowerShell writes once before its serialized records. */
 const CLIXML_HEADER = /^#< CLIXML\r?$/gm;
 /** One serialized record block (`<Objs …>…</Objs>`) holding host progress/verbose records. */
 const CLIXML_RECORDS = /<Objs\b[^>]*>[\s\S]*?<\/Objs>\r?\n?/g;
 /**
-* Remove PowerShell's CLIXML host records from the WinRS stderr stream.
+* Remove PowerShell's CLIXML host records from a stderr stream.
 *
 * PowerShell marks its stderr stream with a `#< CLIXML` header line and
 * serializes the remote host's own progress/verbose records into `<Objs>`
@@ -168,9 +306,10 @@ const CLIXML_RECORDS = /<Objs\b[^>]*>[\s\S]*?<\/Objs>\r?\n?/g;
 * header and a record block (for example `[Console]::Error`) is real output,
 * not part of the CLIXML payload.
 *
-* The script's own error output is already merged into stdout by the
-* envelope, so this only removes transport-level noise.
-* @param stderr - raw stderr text captured from the WinRS stream.
+* The script's own PowerShell errors are already stringified into the
+* envelope's stdout by `Out-String -Stream`, so this only removes
+* transport-level noise such as module-load progress.
+* @param stderr - raw stderr text captured from the WinRS stream or the envelope.
 * @returns the stderr text without CLIXML host records.
 */
 function stripClixml(stderr) {
@@ -182,11 +321,11 @@ function stripClixml(stderr) {
 * WinRM transport bridge.
 *
 * Runs each PowerShell payload over a native Node.js WinRM client
-* (winrm-client) — no Python/pywinrm subprocess. The script rides the
-* UTF-8 base64 envelope (marker + base64 of UTF-8 output) so Chinese and
-* any codepage output survives the WinRM transport losslessly; the envelope
-* is base64-encoded with `-EncodedCommand`, keeping the command line a
-* single ASCII-safe line that WinRS/cmd.exe cannot mangle.
+* (winrm-client) — no Python/pywinrm subprocess. The script is delivered on
+* the WinRS **stdin** stream and answers on the UTF-8 base64 envelope, so
+* Chinese and any codepage output survives the transport losslessly and the
+* command line stays a constant, ASCII-safe line that WinRS/cmd.exe cannot
+* mangle. See powershell.ts for why the command line cannot carry the script.
 *
 * Auth is chosen per attempt (HTTPS: Basic first, then NTLM; HTTP: NTLM
 * first, then Basic) with fallback, so a host that only enables one scheme
@@ -245,17 +384,17 @@ function baseParams(conn, authMethod) {
 	};
 }
 /**
-* One shell lifecycle: create → run the encoded script → receive until the
-* command completes → delete. Bounded by an overall deadline; on timeout the
-* delete is fired without blocking the caller.
+* One shell lifecycle: create → run the constant envelope script → push the
+* payload on stdin → receive until the command completes → delete. Bounded by
+* an overall deadline; on timeout the delete is fired without blocking.
 * @param conn - connection parameters.
-* @param envelope - the wrapped UTF-8 envelope script (already prepared).
+* @param payload - the stdin payload (`<byteCount>\n<script>`).
 * @param timeoutMs - command execution budget measured from just after Execute.
 * @param authMethod - the auth scheme for this attempt.
 * @returns stdout/stderr captured from the WinRS streams.
 * @throws WinrmTimedOut when the deadline passes; other errors are auth/transport failures.
 */
-async function attemptOnce(conn, envelope, timeoutMs, authMethod) {
+async function attemptOnce(conn, payload, timeoutMs, authMethod) {
 	const base = baseParams(conn, authMethod);
 	const hardDeadline = Date.now() + timeoutMs + SETUP_GRACE_MS;
 	const state = {
@@ -273,11 +412,16 @@ async function attemptOnce(conn, envelope, timeoutMs, authMethod) {
 			}).catch(() => void 0);
 			throw new WinrmTimedOut();
 		}
-		const command = powershellCommandLine(envelope);
 		const commandId = await Command.doExecuteCommand({
 			...base,
 			shellId,
-			command
+			command: powershellCommandLine()
+		});
+		for (const piece of splitScriptPayload(payload)) await Command.doSendInput({
+			...base,
+			shellId,
+			commandId,
+			input: piece
 		});
 		const receive = {
 			...base,
@@ -324,16 +468,16 @@ async function attemptOnce(conn, envelope, timeoutMs, authMethod) {
 * succeeds. A timeout aborts immediately (retrying auth would waste the
 * remaining budget on a reachable-but-slow host).
 * @param conn - connection parameters.
-* @param envelope - the wrapped UTF-8 envelope script.
+* @param payload - the stdin payload (`<byteCount>\n<script>`).
 * @param timeoutMs - command execution budget.
 * @returns captured stdout/stderr.
 * @throws WinrmTimedOut on deadline; the last auth/transport error when every scheme fails.
 */
-async function runWinrm(conn, envelope, timeoutMs) {
+async function runWinrm(conn, payload, timeoutMs) {
 	const candidates = conn.useHttps ? ["basic", "ntlm"] : ["ntlm", "basic"];
 	let lastError;
 	for (const authMethod of candidates) try {
-		return await attemptOnce(conn, envelope, timeoutMs, authMethod);
+		return await attemptOnce(conn, payload, timeoutMs, authMethod);
 	} catch (error) {
 		if (error instanceof WinrmTimedOut) throw error;
 		lastError = error;
@@ -343,10 +487,10 @@ async function runWinrm(conn, envelope, timeoutMs) {
 async function runScript(conn, script, options = {}) {
 	const started = Date.now();
 	const timeoutMs = options.timeoutMs ?? 6e4;
-	const envelope = winrmPowerShellScript(script);
+	const payload = scriptPayload(script);
 	let outcome;
 	try {
-		outcome = await runWinrm(conn, envelope, timeoutMs);
+		outcome = await runWinrm(conn, payload, timeoutMs);
 	} catch (error) {
 		if (error instanceof WinrmTimedOut) return {
 			stdout: "",
@@ -360,13 +504,13 @@ async function runScript(conn, script, options = {}) {
 	const raw = outcome.stdout;
 	const parsed = parseEnvelope(raw);
 	const exitCode = parsed !== null ? parsed.exitCode : 1;
-	const stderr = parsed !== null ? stripClixml(outcome.stderr) : outcome.stderr;
+	const stderr = parsed !== null ? stripClixml(parsed.stderr) : outcome.stderr;
 	options.onChunk?.({
 		output: raw,
 		stderr
 	});
 	return {
-		stdout: parsed !== null ? parsed.text : raw,
+		stdout: parsed !== null ? parsed.stdout : raw,
 		stderr,
 		exitCode,
 		timedOut: false,
@@ -1839,6 +1983,7 @@ function winrmListTool(engine) {
 								enum: ["http", "https"],
 								required: true
 							},
+							rejectUnauthorized: { type: "boolean" },
 							description: { type: "string" },
 							environment: { type: "string" },
 							tags: {

package/lib/types/engine/client.d.ts

@@ -2,11 +2,11 @@
  * WinRM transport bridge.
  *
  * Runs each PowerShell payload over a native Node.js WinRM client
- * (winrm-client) — no Python/pywinrm subprocess. The script rides the
- * UTF-8 base64 envelope (marker + base64 of UTF-8 output) so Chinese and
- * any codepage output survives the WinRM transport losslessly; the envelope
- * is base64-encoded with `-EncodedCommand`, keeping the command line a
- * single ASCII-safe line that WinRS/cmd.exe cannot mangle.
+ * (winrm-client) — no Python/pywinrm subprocess. The script is delivered on
+ * the WinRS **stdin** stream and answers on the UTF-8 base64 envelope, so
+ * Chinese and any codepage output survives the transport losslessly and the
+ * command line stays a constant, ASCII-safe line that WinRS/cmd.exe cannot
+ * mangle. See powershell.ts for why the command line cannot carry the script.
  *
  * Auth is chosen per attempt (HTTPS: Basic first, then NTLM; HTTP: NTLM
  * first, then Basic) with fallback, so a host that only enables one scheme

package/lib/types/powershell.d.ts

@@ -1,28 +1,82 @@
 /**
- * PowerShell snippet builders. Every payload rides the UTF-8 base64
- * envelope: the WinRM host prints only ASCII (marker + base64 of UTF-8 text)
- * so Chinese / any codepage output survives the transport losslessly. One-shot
- * commands execute directly in the PowerShell session created by WinRM.
+ * PowerShell snippet builders and the WinRM UTF-8 envelope.
+ *
+ * The user script is delivered on the WinRS **stdin** stream, not on the
+ * command line. WinRS hands the command line to cmd.exe, which caps it at
+ * ~8191 characters; `-EncodedCommand` inflates a script by 2.67x
+ * (UTF-16LE → base64), so the command line can carry only about 1.5 KB of
+ * script. That silently broke every large payload — most visibly the 48 KiB
+ * transfer chunk, whose embedded base64 alone is ~65K characters.
+ *
+ * So the command line is now a *constant* outer script and the user script
+ * rides stdin, which has no such limit (verified to 200 KB).
+ *
+ * The outer script reads a byte count, then that many bytes, starts a child
+ * `powershell.exe` and feeds it the script on its stdin. The process boundary
+ * is what makes `exit N` and an uncaught `throw` survivable: they terminate
+ * the *child*, and the outer script is still alive to print the envelope.
+ * `-EncodedCommand` for the child also sidesteps the execution policy
+ * entirely — the policy governs `.ps1` files, not encoded commands — so no
+ * temp file is written and no policy block can lose the envelope.
+ *
+ * The child body is `& (...) 2>&1 | Out-String -Stream`. Both halves matter:
+ * `2>&1` pulls error records into the success stream, `Out-String -Stream`
+ * stringifies them onto stdout *line by line*. Plain `Out-String` would also
+ * stringify them but buffers the whole pipeline, discarding everything
+ * produced before a mid-script `exit`; bare `2>&1` without `Out-String`
+ * leaves the records to be re-serialized as CLIXML on stderr, where the
+ * envelope's CLIXML stripping deletes the text outright.
+ *
+ * The envelope is three lines — a marker with the exit code, then one base64
+ * line per stream:
+ *
+ *     __DSH_WINRM__<code>
+ *     O:<base64 of UTF-8 stdout>
+ *     E:<base64 of UTF-8 stderr>
+ *
+ * Every payload is ASCII, so the transport cannot corrupt it and Chinese
+ * output survives losslessly. The `O:` / `E:` labels are load-bearing: the
+ * WinRM client trims each response chunk, which can eat the newline between
+ * two lines, and base64 never contains `:`, so the labels stay parseable
+ * even when the separators vanish.
  */
 /** Marker line prefix carrying the exit code: '__DSH_WINRM__<code>'. */
 export declare const ENVELOPE_MARKER = "__DSH_WINRM__";
+/** Max characters per stdin Send; split on code points, never mid-surrogate-pair. */
+export declare const STDIN_CHUNK_CHARS = 16384;
 /** PS single-quoted literal (doubles embedded quotes). */
 export declare function sq(value: string): string;
 /** Base64 of a UTF-16LE PowerShell script, for -EncodedCommand. */
 export declare function encodeCommand(script: string): string;
 /**
- * The UTF-8 WinRM session script: runs `userScript` inside a script block,
- * merges stderr, prints the exit-code marker and base64 of UTF-8 output.
+ * The constant powershell.exe command line that runs the envelope.
+ *
+ * Deliberately takes no payload: keeping the command line under cmd.exe's
+ * ~8191-character cap is the whole point of the stdin channel.
+ */
+export declare function powershellCommandLine(): string;
+/**
+ * The stdin payload for one command: the UTF-8 **byte** count, a newline, then
+ * the raw script.
+ *
+ * The count is in bytes, not characters, because the outer script sizes its
+ * receive buffer from it — a script with multi-byte characters would otherwise
+ * be truncated mid-character.
+ * @param userScript - the PowerShell script to run.
+ * @returns the payload to send on WinRS stdin.
+ */
+export declare function scriptPayload(userScript: string): string;
+/**
+ * Split a payload into Send-sized pieces without cutting a surrogate pair.
+ *
+ * `Command.doSendInput` encodes each piece to UTF-8 independently, so a lone
+ * surrogate at a chunk boundary would be replaced with U+FFFD and corrupt the
+ * script. Iterating with `for…of` yields whole code points, so a pair always
+ * stays in one piece.
+ * @param payload - the full stdin payload.
+ * @returns the pieces to send in order; never empty.
  */
-export declare function wrapEnvelope(userScript: string): string;
-/** One-shot script body for the PowerShell session already created by WinRM. */
-export declare function winrmPowerShellScript(userScript: string): string;
-/** The full powershell.exe command line (ASCII-safe) for a script body. */
-export declare function powershellCommandLine(script: string): string;
-/** One-shot non-interactive PowerShell command line (envelope-wrapped). */
-export declare function execCommandLine(userScript: string): string;
-/** Interactive bootstrap for the streaming console (keeps the shell alive). */
-export declare function consoleCommandLine(): string;
+export declare function splitScriptPayload(payload: string): string[];
 /** JSON: full service table (CIM). */
 export declare function psListServices(): string;
 /** JSON: one service after an action. */
@@ -43,20 +97,23 @@ export declare function psReadChunk(p: string, offset: number, count: number): s
  */
 export declare function psWriteChunk(p: string, b64: string, append: boolean): string;
 /**
- * Parse the envelope output: { exitCode, text } or null when absent.
+ * Parse the three-line envelope: { exitCode, stdout, stderr } or null when absent.
  *
- * The base64 body is optional and the separating newline may be missing: a
- * command that printed nothing emits the marker alone (an empty string has
- * no base64 body), and a transport that trims each response drops the
- * trailing newline. The exit code is signed because `$LASTEXITCODE` can be
- * negative.
+ * Fields are located by their `O:` / `E:` labels rather than by splitting on
+ * newlines, because the WinRM client trims every response chunk and can drop
+ * the newline that separated two lines. base64's alphabet has no colon, so a
+ * label can only ever be a delimiter and the search cannot land on payload
+ * data. The exit code is signed because `$LASTEXITCODE` can be negative.
+ * @param output - the raw stdout accumulated from the WinRS stdout stream.
+ * @returns the decoded envelope, or null when the marker is missing.
  */
 export declare function parseEnvelope(output: string): {
     exitCode: number;
-    text: string;
+    stdout: string;
+    stderr: string;
 } | null;
 /**
- * Remove PowerShell's CLIXML host records from the WinRS stderr stream.
+ * Remove PowerShell's CLIXML host records from a stderr stream.
  *
  * PowerShell marks its stderr stream with a `#< CLIXML` header line and
  * serializes the remote host's own progress/verbose records into `<Objs>`
@@ -65,9 +122,10 @@ export declare function parseEnvelope(output: string): {
  * header and a record block (for example `[Console]::Error`) is real output,
  * not part of the CLIXML payload.
  *
- * The script's own error output is already merged into stdout by the
- * envelope, so this only removes transport-level noise.
- * @param stderr - raw stderr text captured from the WinRS stream.
+ * The script's own PowerShell errors are already stringified into the
+ * envelope's stdout by `Out-String -Stream`, so this only removes
+ * transport-level noise such as module-load progress.
+ * @param stderr - raw stderr text captured from the WinRS stream or the envelope.
  * @returns the stderr text without CLIXML host records.
  */
 export declare function stripClixml(stderr: string): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-winrm",
   "description": "Remote Windows administration for the dsh web GUI: WinRM/PowerShell Remoting host config store (~/.dsh/dsh-winrm.json), PowerShell exec / streaming console / service & process management / base64-chunked file transfer / cluster execution, plus agent tools (winrm_list, winrm_exec, winrm_service, winrm_process, winrm_upload, winrm_download, winrm_cluster). Runs entirely on a native Node.js WinRM client (winrm-client) — no Python/pywinrm required. Standalone Cordis plugin — mounted via cordis.patch.yml + a profile node_modules link, no dsh source changes.",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "packageManager": "pnpm@11.7.0",
   "engines": {
@@ -44,25 +44,25 @@
     "ws": "^8.18.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-host-webserver": "^0.1.7-alpha.2",
-    "@deepseek-ai/dsh-llm": "^0.1.7-alpha.2",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.7-alpha.2",
-    "@deepseek-ai/dsh-tools": "^0.1.7-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-alpha.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.7-alpha.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.7-alpha.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.1.7-alpha.2 || ^0.2.0-rc.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",
     "@deepseek-ai/cordis-plugin-loader": "^1.0.5",
-    "@deepseek-ai/dsh-client-locale": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-layout": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-tools": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-locale": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-layout": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-llm": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.2.0-rc.2",
     "@deepseek-ai/schemastery": "^3.18.4",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",
@@ -89,7 +89,8 @@
     "build": "tsc -p tsconfig.build.json && tsdown && node scripts/postbuild.mjs",
     "bundle": "tsdown",
     "watch": "tsdown --watch",
-    "test": "node --experimental-strip-types --test tests/*.test.ts tests/*.test.mjs",
+    "test": "node --experimental-strip-types --test tests/*.test.ts",
+    "verify:live": "node --experimental-strip-types scripts/verify-live.mts",
     "check": "npm run typecheck && npm run build && npm test",
     "pack:check": "npm pack --dry-run --json",
     "prepack": "npm run check",