dsh-winrm 0.1.1 → 0.2.0

package/README.md

@@ -4,6 +4,8 @@
 
 仿照 [dsh-ssh](https://github.com/zhu1090093659/dsh-web-ui/tree/main/packages/dsh-ssh) 开发的 DSH 插件：用 Windows 原生的 **WinRM / PowerShell Remoting** 协议远程管理 Windows 服务器，**目标机不需要装 OpenSSH**。
 
+> **来源**：本项目是 [andyfan1094/dsh-winrm](https://github.com/andyfan1094/dsh-winrm)（Apache-2.0）的分支，把后端的 WinRM 实现从 Python + pywinrm 换成原生 Node.js 客户端（[winrm-client](https://github.com/shide1989/winrm-client)），因此**本机不再需要 Python**。GUI、Agent 工具与功能范围沿用上游设计。
+
 ## 功能
 
 | 面 | 说明 |
@@ -22,8 +24,9 @@
 - 本地账户可写 `Administrator`；域账户可写 `DOMAIN\user` 或 `user@domain`
 - 本机无需 Python —— WinRM 走纯 Node 依赖（winrm-client），随插件一起安装
 - 传输：HTTP(5985) 或 HTTPS(5986)；HTTPS 可勾选「接受自签名证书」
-- 中文输出不乱码：所有命令走 **UTF-8 base64 信封**（`-EncodedCommand` + `Out-String` 包装），绕过 WinRM 传输的代码页问题
+- 中文输出不乱码：所有命令走 **UTF-8 base64 信封**（`Out-String -Stream` 包装 + 三条带标签的信封行），绕过 WinRM 传输的代码页问题
 - 命令结果的 `stderr` 已自动剥离 PowerShell 的 CLIXML 宿主机记录；真实的进程级 stderr（如 `[Console]::Error`）原样保留
+- **脚本走 WinRS stdin，不走命令行**：WinRS 把命令行交给 `cmd.exe`，上限约 8191 字符，而 `-EncodedCommand` 会把脚本膨胀 2.67 倍 —— 命令行长脚本此前会直接报 `The command line is too long.`。现在命令行是**常量**，脚本按 UTF-8 字节数分块送到 stdin，实测 200 KB 脚本正常
 
 ## 目标机准备（一次性）
 
@@ -39,12 +42,12 @@ powershell -ExecutionPolicy Bypass -File .\scripts\enable-winrm.ps1
 
 ## 安装
 
-> 需要 DeepSeek Harness **0.1.7 系列**（`0.1.7-alpha.2` 及以后，含 `0.1.7-rc.1`）。插件的 `peerDependencies` 声明为 `^0.1.7-alpha.2`，DSH 启动时会据此校验：0.1.x 各版本可加载，`0.2.0` 起会被拒绝（确需冒险可用 `dsh plugin allow-version` 逐版本放行）。
+> 需要 DeepSeek Harness **0.1.7-alpha.2 及以后**（含 `0.1.7-rc.1`、`0.2.0-rc.*`、`0.2.x`）。插件的 `peerDependencies` 声明为 `^0.1.7-alpha.2 || ^0.2.0-rc.1`，DSH 启动时会据此校验：0.1.7 与 0.2.x 各版本可加载，`0.3.0` 起会被拒绝（确需冒险可用 `dsh plugin allow-version` 逐版本放行）。
 
 从 [Releases](https://github.com/MoRanYue/dsh-winrm/releases) 下载最新的 `dsh-winrm-*.tgz`，加入 profile：
 
 ```powershell
-dsh plugin --profile web add D:\downloads\dsh-winrm-0.1.0.tgz
+dsh plugin --profile web add D:\downloads\dsh-winrm-0.2.0.tgz
 ```
 
 也可以直接从 npm 安装：
@@ -90,7 +93,7 @@ src/
   engine.ts           WinRmEngine 门面：exec / services / processes / ls / upload / download / console / cluster / test
   store.ts            ~/.dsh/dsh-winrm.json 主机存储（原子写，0600）
   protocol.ts         宿主↔浏览器 wire 类型
-  powershell.ts       PS 片段构造器（UTF-8 信封 / 服务 / 进程 / 目录 / 分块读写）
+  powershell.ts       PS 片段构造器 + stdin 信封（outer/child 包装 / 服务 / 进程 / 目录 / 分块读写）
   routes.ts           /api/dsh-winrm 路由族 + 控制台 WebSocket（loopback 围栏）
   tools.ts            7 个 winrm_* agent 工具
   engine/client.ts    winrm-client 传输层：进程内认证（NTLM/Basic）、UTF-8 信封、分块传输
@@ -106,7 +109,7 @@ scripts/
 ## 已知限制
 
 - 控制台是命令会话，不保持 PowerShell 变量和当前目录状态；每条命令独立执行
-- WinRM 单次响应受 150KB 信封上限约束，传输按 48KB 分块，大文件较慢（每块一次往返）
+- 传输按 48KB 分块，大文件较慢（每块一次往返）；分块大小由 `TRANSFER_CHUNK` 决定，脚本本身已不再受命令行长度限制
 - 单命令默认 60s 超时，可传 `timeoutMs`
 - 目标机需已启用 WinRM（见上）；HTTP 明文 Basic 不应用于公网
 - 面板关闭再打开会回到「主机」页签：面板是 `main` 插槽的占用者，切回对话时卸载，页签状态不跨开关保留

package/README.zh.md

@@ -2,6 +2,8 @@
 
 仿照 [dsh-ssh](https://github.com/zhu1090093659/dsh-web-ui/tree/main/packages/dsh-ssh) 开发的 DSH 插件：用 Windows 原生的 **WinRM / PowerShell Remoting** 协议远程管理 Windows 服务器，**目标机不需要装 OpenSSH**。
 
+> **来源**：本项目是 [andyfan1094/dsh-winrm](https://github.com/andyfan1094/dsh-winrm)（Apache-2.0）的分支，把后端的 WinRM 实现从 Python + pywinrm 换成原生 Node.js 客户端（[winrm-client](https://github.com/shide1989/winrm-client)），因此**本机不再需要 Python**。GUI、Agent 工具与功能范围沿用上游设计。
+
 ## 功能
 
 | 面 | 说明 |
@@ -20,8 +22,9 @@
 - 本地账户可写 `Administrator`；域账户可写 `DOMAIN\\user` 或 `user@domain`
 - 本机无需 Python —— WinRM 走纯 Node 依赖（winrm-client），随插件一起安装
 - 传输：HTTP(5985) 或 HTTPS(5986)；HTTPS 可勾选「接受自签名证书」
-- 中文输出不乱码：所有命令走 **UTF-8 base64 信封**（`-EncodedCommand` + `Out-String` 包装），绕过 WinRM 传输的代码页问题
+- 中文输出不乱码：所有命令走 **UTF-8 base64 信封**（`Out-String -Stream` 包装 + 三条带标签的信封行），绕过 WinRM 传输的代码页问题
 - 命令结果的 `stderr` 已自动剥离 PowerShell 的 CLIXML 宿主机记录；真实的进程级 stderr（如 `[Console]::Error`）原样保留
+- **脚本走 WinRS stdin，不走命令行**：WinRS 把命令行交给 `cmd.exe`，上限约 8191 字符，而 `-EncodedCommand` 会把脚本膨胀 2.67 倍 —— 命令行长脚本此前会直接报 `The command line is too long.`。现在命令行是**常量**，脚本按 UTF-8 字节数分块送到 stdin，实测 200 KB 脚本正常
 
 ## 目标机准备（一次性）
 
@@ -42,12 +45,12 @@ powershell -ExecutionPolicy Bypass -File .\scripts\enable-winrm.ps1
 
 ## 安装
 
-> 需要 DeepSeek Harness **0.1.7 系列**（`0.1.7-alpha.2` 及以后，含 `0.1.7-rc.1`）。插件的 `peerDependencies` 声明为 `^0.1.7-alpha.2`，DSH 启动时会据此校验：0.1.x 各版本可加载，`0.2.0` 起会被拒绝（确需冒险可用 `dsh plugin allow-version` 逐版本放行）。
+> 需要 DeepSeek Harness **0.1.7-alpha.2 及以后**（含 `0.1.7-rc.1`、`0.2.0-rc.*`、`0.2.x`）。插件的 `peerDependencies` 声明为 `^0.1.7-alpha.2 || ^0.2.0-rc.1`，DSH 启动时会据此校验：0.1.7 与 0.2.x 各版本可加载，`0.3.0` 起会被拒绝（确需冒险可用 `dsh plugin allow-version` 逐版本放行）。
 
 从 [Releases](https://github.com/MoRanYue/dsh-winrm/releases) 下载最新的 `dsh-winrm-*.tgz`，加入 profile：
 
 ```powershell
-dsh plugin --profile web add D:\downloads\dsh-winrm-0.1.0.tgz
+dsh plugin --profile web add D:\downloads\dsh-winrm-0.2.0.tgz
 ```
 
 也可以直接从 npm 安装：
@@ -93,7 +96,7 @@ src/
   engine.ts           WinRmEngine 门面：exec / services / processes / ls / upload / download / console / cluster / test
   store.ts            ~/.dsh/dsh-winrm.json 主机存储（原子写，0600）
   protocol.ts         宿主↔浏览器 wire 类型
-  powershell.ts       PS 片段构造器（UTF-8 信封 / 服务 / 进程 / 目录 / 分块读写）
+  powershell.ts       PS 片段构造器 + stdin 信封（outer/child 包装 / 服务 / 进程 / 目录 / 分块读写）
   routes.ts           /api/dsh-winrm 路由族 + 控制台 WebSocket（loopback 围栏）
   tools.ts            7 个 winrm_* agent 工具
   engine/client.ts    winrm-client 传输层：进程内认证（NTLM/Basic）、UTF-8 信封、分块传输
@@ -109,7 +112,7 @@ scripts/
 ## 已知限制
 
 - 控制台是命令会话，不保持 PowerShell 变量和当前目录状态；每条命令独立执行
-- WinRM 单次响应受 150KB 信封上限约束，传输按 48KB 分块，大文件较慢（每块一次往返）
+- 传输按 48KB 分块，大文件较慢（每块一次往返）；分块大小由 `TRANSFER_CHUNK` 决定，脚本本身已不再受命令行长度限制
 - 单命令默认 60s 超时，可传 `timeoutMs`
 - 目标机需已启用 WinRM（见上）；HTTP 明文 Basic 不应用于公网
 - 面板关闭再打开会回到「主机」页签：面板是 `main` 插槽的占用者，切回对话时卸载，页签状态不跨开关保留

package/lib/client.js

@@ -565,93 +565,93 @@ if (typeof document !== "undefined" && document.querySelector("style[data-plugin
 	document.head.appendChild(tag);
 }
 var panel_module_css_default = {
-	"progressBar": "hAbY3W_progressBar",
-	"loading": "hAbY3W_loading",
-	"termBody": "hAbY3W_termBody",
-	"cellDetails": "hAbY3W_cellDetails",
+	"modalBackdrop": "hAbY3W_modalBackdrop",
+	"panel": "hAbY3W_panel",
 	"groupCount": "hAbY3W_groupCount",
-	"groupSection": "hAbY3W_groupSection",
-	"tunnelRow": "hAbY3W_tunnelRow",
+	"tab": "hAbY3W_tab",
+	"iconButton": "hAbY3W_iconButton",
+	"banner": "hAbY3W_banner",
+	"panelHeader": "hAbY3W_panelHeader",
 	"utf8Note": "hAbY3W_utf8Note",
-	"checkRow": "hAbY3W_checkRow",
-	"fieldHint": "hAbY3W_fieldHint",
-	"linkButton": "hAbY3W_linkButton",
-	"groupToggle": "hAbY3W_groupToggle",
-	"entryIcon": "hAbY3W_entryIcon",
-	"modalTitle": "hAbY3W_modalTitle",
-	"empty": "hAbY3W_empty",
-	"hiddenFile": "hAbY3W_hiddenFile",
-	"panelTitle": "hAbY3W_panelTitle",
 	"cellPre": "hAbY3W_cellPre",
-	"dialogTitle": "hAbY3W_dialogTitle",
-	"groupBySelect": "hAbY3W_groupBySelect",
+	"dialog": "hAbY3W_dialog",
+	"hiddenFile": "hAbY3W_hiddenFile",
+	"linkButton": "hAbY3W_linkButton",
+	"tabBody": "hAbY3W_tabBody",
+	"dirName": "hAbY3W_dirName",
+	"fillBody": "hAbY3W_fillBody",
+	"backButton": "hAbY3W_backButton",
+	"mono": "hAbY3W_mono",
+	"actions": "hAbY3W_actions",
+	"tunnelRow": "hAbY3W_tunnelRow",
+	"commandInput": "hAbY3W_commandInput",
+	"ghostButton": "hAbY3W_ghostButton",
+	"dialogOverlay": "hAbY3W_dialogOverlay",
 	"table": "hAbY3W_table",
-	"clusterFilters": "hAbY3W_clusterFilters",
-	"browsePath": "hAbY3W_browsePath",
+	"termBody": "hAbY3W_termBody",
 	"browseList": "hAbY3W_browseList",
 	"radioRow": "hAbY3W_radioRow",
+	"progressBar": "hAbY3W_progressBar",
+	"dialogTitle": "hAbY3W_dialogTitle",
+	"dirRow": "hAbY3W_dirRow",
+	"groupHeader": "hAbY3W_groupHeader",
+	"consoleOutput": "hAbY3W_consoleOutput",
+	"spinner": "hAbY3W_spinner",
 	"transferBlock": "hAbY3W_transferBlock",
-	"tabBar": "hAbY3W_tabBar",
-	"termPlaceholder": "hAbY3W_termPlaceholder",
-	"search": "hAbY3W_search",
-	"progressMeta": "hAbY3W_progressMeta",
-	"consoleInputRow": "hAbY3W_consoleInputRow",
-	"mono": "hAbY3W_mono",
-	"entryLabel": "hAbY3W_entryLabel",
-	"tableWrap": "hAbY3W_tableWrap",
-	"hint": "hAbY3W_hint",
-	"tunnelLabel": "hAbY3W_tunnelLabel",
-	"fieldLabel": "hAbY3W_fieldLabel",
+	"consoleHeader": "hAbY3W_consoleHeader",
 	"progressTrack": "hAbY3W_progressTrack",
+	"termContainer": "hAbY3W_termContainer",
+	"loading": "hAbY3W_loading",
+	"tunnelList": "hAbY3W_tunnelList",
+	"cellDetails": "hAbY3W_cellDetails",
+	"consoleWrap": "hAbY3W_consoleWrap",
 	"modal": "hAbY3W_modal",
-	"dshSshSpin": "hAbY3W_dshSshSpin",
-	"iconButton": "hAbY3W_iconButton",
-	"backButton": "hAbY3W_backButton",
-	"ghostButton": "hAbY3W_ghostButton",
-	"tabBody": "hAbY3W_tabBody",
-	"clusterForm": "hAbY3W_clusterForm",
-	"dirSize": "hAbY3W_dirSize",
-	"groupHeader": "hAbY3W_groupHeader",
-	"fillBody": "hAbY3W_fillBody",
-	"panel": "hAbY3W_panel",
-	"spinner": "hAbY3W_spinner",
-	"cellMuted": "hAbY3W_cellMuted",
-	"groupChevron": "hAbY3W_groupChevron",
-	"field": "hAbY3W_field",
 	"formRow": "hAbY3W_formRow",
-	"panelContent": "hAbY3W_panelContent",
-	"commandInput": "hAbY3W_commandInput",
-	"consoleWrap": "hAbY3W_consoleWrap",
-	"dialog": "hAbY3W_dialog",
-	"toolbarSpacer": "hAbY3W_toolbarSpacer",
-	"tunnelList": "hAbY3W_tunnelList",
+	"progressMeta": "hAbY3W_progressMeta",
+	"controls": "hAbY3W_controls",
+	"modalFooter": "hAbY3W_modalFooter",
+	"groupName": "hAbY3W_groupName",
+	"modalTitle": "hAbY3W_modalTitle",
 	"radioLabel": "hAbY3W_radioLabel",
-	"panelHeader": "hAbY3W_panelHeader",
-	"browseHeader": "hAbY3W_browseHeader",
-	"primaryButton": "hAbY3W_primaryButton",
-	"banner": "hAbY3W_banner",
+	"toolbarSpacer": "hAbY3W_toolbarSpacer",
 	"browsePanel": "hAbY3W_browsePanel",
-	"entry": "hAbY3W_entry",
-	"dirName": "hAbY3W_dirName",
-	"dirRow": "hAbY3W_dirRow",
-	"dialogOverlay": "hAbY3W_dialogOverlay",
-	"termWrap": "hAbY3W_termWrap",
-	"tab": "hAbY3W_tab",
+	"checkRow": "hAbY3W_checkRow",
+	"entryIcon": "hAbY3W_entryIcon",
+	"groupSection": "hAbY3W_groupSection",
 	"input": "hAbY3W_input",
-	"consoleHeader": "hAbY3W_consoleHeader",
-	"badge": "hAbY3W_badge",
 	"formError": "hAbY3W_formError",
-	"groupName": "hAbY3W_groupName",
-	"termContainer": "hAbY3W_termContainer",
-	"controls": "hAbY3W_controls",
+	"empty": "hAbY3W_empty",
+	"entry": "hAbY3W_entry",
+	"badge": "hAbY3W_badge",
+	"field": "hAbY3W_field",
+	"browsePath": "hAbY3W_browsePath",
+	"dshSshSpin": "hAbY3W_dshSshSpin",
 	"toolbar": "hAbY3W_toolbar",
-	"consoleOutput": "hAbY3W_consoleOutput",
+	"dirType": "hAbY3W_dirType",
+	"panelTitle": "hAbY3W_panelTitle",
 	"formCard": "hAbY3W_formCard",
-	"actions": "hAbY3W_actions",
-	"modalBackdrop": "hAbY3W_modalBackdrop",
-	"modalFooter": "hAbY3W_modalFooter",
+	"browseHeader": "hAbY3W_browseHeader",
+	"entryLabel": "hAbY3W_entryLabel",
+	"groupChevron": "hAbY3W_groupChevron",
+	"panelContent": "hAbY3W_panelContent",
+	"termWrap": "hAbY3W_termWrap",
+	"termPlaceholder": "hAbY3W_termPlaceholder",
+	"fieldHint": "hAbY3W_fieldHint",
+	"groupBySelect": "hAbY3W_groupBySelect",
+	"groupToggle": "hAbY3W_groupToggle",
+	"clusterForm": "hAbY3W_clusterForm",
+	"fieldLabel": "hAbY3W_fieldLabel",
+	"cellMuted": "hAbY3W_cellMuted",
+	"tabBar": "hAbY3W_tabBar",
+	"tableWrap": "hAbY3W_tableWrap",
+	"consoleInputRow": "hAbY3W_consoleInputRow",
+	"search": "hAbY3W_search",
 	"inlineTest": "hAbY3W_inlineTest",
-	"dirType": "hAbY3W_dirType"
+	"hint": "hAbY3W_hint",
+	"tunnelLabel": "hAbY3W_tunnelLabel",
+	"dirSize": "hAbY3W_dirSize",
+	"clusterFilters": "hAbY3W_clusterFilters",
+	"primaryButton": "hAbY3W_primaryButton"
 };
 //#endregion
 //#region src/client/panel/ConsoleTab.tsx

package/lib/index.js

@@ -9,6 +9,50 @@ import { homedir, tmpdir } from "node:os";
 import { WebSocket, WebSocketServer } from "ws";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 //#region src/powershell.ts
+/**
+* PowerShell snippet builders and the WinRM UTF-8 envelope.
+*
+* The user script is delivered on the WinRS **stdin** stream, not on the
+* command line. WinRS hands the command line to cmd.exe, which caps it at
+* ~8191 characters; `-EncodedCommand` inflates a script by 2.67x
+* (UTF-16LE → base64), so the command line can carry only about 1.5 KB of
+* script. That silently broke every large payload — most visibly the 48 KiB
+* transfer chunk, whose embedded base64 alone is ~65K characters.
+*
+* So the command line is now a *constant* outer script and the user script
+* rides stdin, which has no such limit (verified to 200 KB).
+*
+* The outer script reads a byte count, then that many bytes, starts a child
+* `powershell.exe` and feeds it the script on its stdin. The process boundary
+* is what makes `exit N` and an uncaught `throw` survivable: they terminate
+* the *child*, and the outer script is still alive to print the envelope.
+* `-EncodedCommand` for the child also sidesteps the execution policy
+* entirely — the policy governs `.ps1` files, not encoded commands — so no
+* temp file is written and no policy block can lose the envelope.
+*
+* The child body is `& (...) 2>&1 | Out-String -Stream`. Both halves matter:
+* `2>&1` pulls error records into the success stream, `Out-String -Stream`
+* stringifies them onto stdout *line by line*. Plain `Out-String` would also
+* stringify them but buffers the whole pipeline, discarding everything
+* produced before a mid-script `exit`; bare `2>&1` without `Out-String`
+* leaves the records to be re-serialized as CLIXML on stderr, where the
+* envelope's CLIXML stripping deletes the text outright.
+*
+* The envelope is three lines — a marker with the exit code, then one base64
+* line per stream:
+*
+*     __DSH_WINRM__<code>
+*     O:<base64 of UTF-8 stdout>
+*     E:<base64 of UTF-8 stderr>
+*
+* Every payload is ASCII, so the transport cannot corrupt it and Chinese
+* output survives losslessly. The `O:` / `E:` labels are load-bearing: the
+* WinRM client trims each response chunk, which can eat the newline between
+* two lines, and base64 never contains `:`, so the labels stay parseable
+* even when the separators vanish.
+*/
+/** Marker line prefix carrying the exit code: '__DSH_WINRM__<code>'. */
+const ENVELOPE_MARKER = "__DSH_WINRM__";
 /** PS single-quoted literal (doubles embedded quotes). */
 function sq(value) {
 	return "'" + value.replace(/'/g, "''") + "'";
@@ -18,28 +62,121 @@ function encodeCommand(script) {
 	return Buffer.from(script, "utf16le").toString("base64");
 }
 /**
-* The UTF-8 WinRM session script: runs `userScript` inside a script block,
-* merges stderr, prints the exit-code marker and base64 of UTF-8 output.
+* Outer script (constant, so the command line never grows with the payload):
+* read `<byteCount>\n<utf8 script>` from stdin, run it in a child
+* powershell.exe, then print the three-line envelope.
+*
+* The child is started with redirected streams *before* anything is written to
+* its stdin, and both readers are started before the write, so a child that
+* fills a pipe buffer cannot deadlock the outer script. Closing the writer is
+* what gives the child a real EOF — without it the child would block forever
+* on `CopyTo`.
 */
-function wrapEnvelope(userScript) {
-	return [
-		"$ErrorActionPreference = 'Continue'",
-		"$__out = & { " + userScript + " } 2>&1 | Out-String -Width 4096",
-		"$__code = 0",
-		"if ($null -ne $LASTEXITCODE) { $__code = $LASTEXITCODE }",
-		"[Console]::OutputEncoding = [System.Text.Encoding]::UTF8",
-		"'__DSH_WINRM__' + [string]$__code",
-		"[System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([string]$__out))",
+const OUTER_SCRIPT = [
+	"$ErrorActionPreference='Continue'",
+	"$z=@'",
+	[
+		"$ErrorActionPreference='Continue'",
+		"[Console]::OutputEncoding=[Text.Encoding]::UTF8",
+		"$i=[Console]::OpenStandardInput()",
+		"$m=New-Object System.IO.MemoryStream",
+		"$i.CopyTo($m)",
+		"$s=[Text.Encoding]::UTF8.GetString($m.ToArray())",
+		"if($s.Length -gt 0 -and [int]$s[0] -eq 0xFEFF){$s=$s.Substring(1)}",
+		"$c=0",
+		"try{ &([scriptblock]::Create($s)) 2>&1 | Out-String -Stream -Width 4096",
+		"if($null -ne $LASTEXITCODE){$c=$LASTEXITCODE}",
+		"}catch{ $_|Out-String; $c=1 }",
+		"exit $c",
 		""
-	].join("\r\n");
+	].join("\r\n"),
+	"'@",
+	"$a=''",
+	"$e=''",
+	"$c=0",
+	"try{",
+	"  $i=[Console]::OpenStandardInput()",
+	"  $d=''",
+	"  while($true){$b=$i.ReadByte();if($b -lt 0 -or $b -eq 10){break};if($b -ne 13){$d+=[char]$b}}",
+	"  $n=[int]$d",
+	"  $u=New-Object byte[] $n",
+	"  $r=0",
+	"  while($r -lt $n){$k=$i.Read($u,$r,$n-$r);if($k -le 0){break};$r+=$k}",
+	"  $s=[Text.Encoding]::UTF8.GetString($u,0,$r)",
+	"  $p=New-Object System.Diagnostics.ProcessStartInfo",
+	"  $p.FileName='powershell.exe'",
+	"  $p.UseShellExecute=$false",
+	"  $p.RedirectStandardOutput=$true",
+	"  $p.RedirectStandardError=$true",
+	"  $p.RedirectStandardInput=$true",
+	"  $p.StandardOutputEncoding=[Text.Encoding]::UTF8",
+	"  $p.StandardErrorEncoding=[Text.Encoding]::UTF8",
+	"  $p.CreateNoWindow=$true",
+	"  $p.Arguments='-NoProfile -NoLogo -ExecutionPolicy Bypass -EncodedCommand '+[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($z))",
+	"  $q=[System.Diagnostics.Process]::Start($p)",
+	"  $x=$q.StandardOutput.ReadToEndAsync()",
+	"  $y=$q.StandardError.ReadToEndAsync()",
+	"  $w=New-Object System.IO.StreamWriter($q.StandardInput.BaseStream,(New-Object System.Text.UTF8Encoding($false)))",
+	"  $w.Write($s)",
+	"  $w.Flush()",
+	"  $w.Close()",
+	"  $q.WaitForExit()",
+	"  $a=[string]$x.Result",
+	"  $e=[string]$y.Result",
+	"  $c=$q.ExitCode",
+	"}catch{",
+	"  $a=[string]$a+[string]($_|Out-String)",
+	"  $c=1",
+	"}",
+	sq(ENVELOPE_MARKER) + "+[string]$c",
+	"'O:'+[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes([string]$a))",
+	"'E:'+[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes([string]$e))",
+	""
+].join("\r\n");
+/**
+* The constant powershell.exe command line that runs the envelope.
+*
+* Deliberately takes no payload: keeping the command line under cmd.exe's
+* ~8191-character cap is the whole point of the stdin channel.
+*/
+function powershellCommandLine() {
+	return "powershell.exe -NoProfile -NoLogo -ExecutionPolicy Bypass -EncodedCommand " + encodeCommand(OUTER_SCRIPT);
 }
-/** One-shot script body for the PowerShell session already created by WinRM. */
-function winrmPowerShellScript(userScript) {
-	return wrapEnvelope(userScript);
+/**
+* The stdin payload for one command: the UTF-8 **byte** count, a newline, then
+* the raw script.
+*
+* The count is in bytes, not characters, because the outer script sizes its
+* receive buffer from it — a script with multi-byte characters would otherwise
+* be truncated mid-character.
+* @param userScript - the PowerShell script to run.
+* @returns the payload to send on WinRS stdin.
+*/
+function scriptPayload(userScript) {
+	return String(Buffer.byteLength(userScript, "utf8")) + "\n" + userScript;
 }
-/** The full powershell.exe command line (ASCII-safe) for a script body. */
-function powershellCommandLine(script) {
-	return "powershell.exe -NoProfile -NoLogo -ExecutionPolicy Bypass -EncodedCommand " + encodeCommand(script);
+/**
+* Split a payload into Send-sized pieces without cutting a surrogate pair.
+*
+* `Command.doSendInput` encodes each piece to UTF-8 independently, so a lone
+* surrogate at a chunk boundary would be replaced with U+FFFD and corrupt the
+* script. Iterating with `for…of` yields whole code points, so a pair always
+* stays in one piece.
+* @param payload - the full stdin payload.
+* @returns the pieces to send in order; never empty.
+*/
+function splitScriptPayload(payload) {
+	const pieces = [];
+	let piece = "";
+	for (const ch of payload) {
+		if (piece.length + ch.length > 16384) {
+			pieces.push(piece);
+			piece = "";
+		}
+		piece += ch;
+	}
+	if (piece !== "" || pieces.length === 0) pieces.push(piece);
+	return pieces;
 }
 /** JSON: full service table (CIM). */
 function psListServices() {
@@ -128,38 +265,39 @@ function psWriteChunk(p, b64, append) {
 		""
 	].join("\r\n");
 }
+/** Decode one base64 envelope field, tolerating whitespace the transport added. */
+function decodeField(base64) {
+	return Buffer.from(base64.replace(/\s+/g, ""), "base64").toString("utf8");
+}
 /**
-* Parse the envelope output: { exitCode, text } or null when absent.
+* Parse the three-line envelope: { exitCode, stdout, stderr } or null when absent.
 *
-* The base64 body is optional and the separating newline may be missing: a
-* command that printed nothing emits the marker alone (an empty string has
-* no base64 body), and a transport that trims each response drops the
-* trailing newline. The exit code is signed because `$LASTEXITCODE` can be
-* negative.
+* Fields are located by their `O:` / `E:` labels rather than by splitting on
+* newlines, because the WinRM client trims every response chunk and can drop
+* the newline that separated two lines. base64's alphabet has no colon, so a
+* label can only ever be a delimiter and the search cannot land on payload
+* data. The exit code is signed because `$LASTEXITCODE` can be negative.
+* @param output - the raw stdout accumulated from the WinRS stdout stream.
+* @returns the decoded envelope, or null when the marker is missing.
 */
 function parseEnvelope(output) {
-	const match = /^__DSH_WINRM__(-?\d+)(?:\r?\n([\s\S]*))?$/.exec(output);
-	if (match === null) return null;
-	const exitCode = Number.parseInt(match[1], 10);
-	const payload = (match[2] ?? "").trim();
-	try {
-		return {
-			exitCode,
-			text: Buffer.from(payload, "base64").toString("utf8")
-		};
-	} catch {
-		return {
-			exitCode,
-			text: payload
-		};
-	}
+	const text = output.trim();
+	const head = (/* @__PURE__ */ new RegExp("^__DSH_WINRM__(-?\\d+)")).exec(text);
+	if (head === null) return null;
+	const stdoutAt = text.indexOf("O:");
+	const stderrAt = stdoutAt === -1 ? -1 : text.indexOf("E:", stdoutAt + 2);
+	return {
+		exitCode: Number.parseInt(head[1], 10),
+		stdout: stdoutAt === -1 ? "" : decodeField(text.slice(stdoutAt + 2, stderrAt === -1 ? void 0 : stderrAt)),
+		stderr: stderrAt === -1 ? "" : decodeField(text.slice(stderrAt + 2))
+	};
 }
 /** The `#< CLIXML` stream header PowerShell writes once before its serialized records. */
 const CLIXML_HEADER = /^#< CLIXML\r?$/gm;
 /** One serialized record block (`<Objs …>…</Objs>`) holding host progress/verbose records. */
 const CLIXML_RECORDS = /<Objs\b[^>]*>[\s\S]*?<\/Objs>\r?\n?/g;
 /**
-* Remove PowerShell's CLIXML host records from the WinRS stderr stream.
+* Remove PowerShell's CLIXML host records from a stderr stream.
 *
 * PowerShell marks its stderr stream with a `#< CLIXML` header line and
 * serializes the remote host's own progress/verbose records into `<Objs>`
@@ -168,9 +306,10 @@ const CLIXML_RECORDS = /<Objs\b[^>]*>[\s\S]*?<\/Objs>\r?\n?/g;
 * header and a record block (for example `[Console]::Error`) is real output,
 * not part of the CLIXML payload.
 *
-* The script's own error output is already merged into stdout by the
-* envelope, so this only removes transport-level noise.
-* @param stderr - raw stderr text captured from the WinRS stream.
+* The script's own PowerShell errors are already stringified into the
+* envelope's stdout by `Out-String -Stream`, so this only removes
+* transport-level noise such as module-load progress.
+* @param stderr - raw stderr text captured from the WinRS stream or the envelope.
 * @returns the stderr text without CLIXML host records.
 */
 function stripClixml(stderr) {
@@ -182,11 +321,11 @@ function stripClixml(stderr) {
 * WinRM transport bridge.
 *
 * Runs each PowerShell payload over a native Node.js WinRM client
-* (winrm-client) — no Python/pywinrm subprocess. The script rides the
-* UTF-8 base64 envelope (marker + base64 of UTF-8 output) so Chinese and
-* any codepage output survives the WinRM transport losslessly; the envelope
-* is base64-encoded with `-EncodedCommand`, keeping the command line a
-* single ASCII-safe line that WinRS/cmd.exe cannot mangle.
+* (winrm-client) — no Python/pywinrm subprocess. The script is delivered on
+* the WinRS **stdin** stream and answers on the UTF-8 base64 envelope, so
+* Chinese and any codepage output survives the transport losslessly and the
+* command line stays a constant, ASCII-safe line that WinRS/cmd.exe cannot
+* mangle. See powershell.ts for why the command line cannot carry the script.
 *
 * Auth is chosen per attempt (HTTPS: Basic first, then NTLM; HTTP: NTLM
 * first, then Basic) with fallback, so a host that only enables one scheme
@@ -245,17 +384,17 @@ function baseParams(conn, authMethod) {
 	};
 }
 /**
-* One shell lifecycle: create → run the encoded script → receive until the
-* command completes → delete. Bounded by an overall deadline; on timeout the
-* delete is fired without blocking the caller.
+* One shell lifecycle: create → run the constant envelope script → push the
+* payload on stdin → receive until the command completes → delete. Bounded by
+* an overall deadline; on timeout the delete is fired without blocking.
 * @param conn - connection parameters.
-* @param envelope - the wrapped UTF-8 envelope script (already prepared).
+* @param payload - the stdin payload (`<byteCount>\n<script>`).
 * @param timeoutMs - command execution budget measured from just after Execute.
 * @param authMethod - the auth scheme for this attempt.
 * @returns stdout/stderr captured from the WinRS streams.
 * @throws WinrmTimedOut when the deadline passes; other errors are auth/transport failures.
 */
-async function attemptOnce(conn, envelope, timeoutMs, authMethod) {
+async function attemptOnce(conn, payload, timeoutMs, authMethod) {
 	const base = baseParams(conn, authMethod);
 	const hardDeadline = Date.now() + timeoutMs + SETUP_GRACE_MS;
 	const state = {
@@ -273,11 +412,16 @@ async function attemptOnce(conn, envelope, timeoutMs, authMethod) {
 			}).catch(() => void 0);
 			throw new WinrmTimedOut();
 		}
-		const command = powershellCommandLine(envelope);
 		const commandId = await Command.doExecuteCommand({
 			...base,
 			shellId,
-			command
+			command: powershellCommandLine()
+		});
+		for (const piece of splitScriptPayload(payload)) await Command.doSendInput({
+			...base,
+			shellId,
+			commandId,
+			input: piece
 		});
 		const receive = {
 			...base,
@@ -324,16 +468,16 @@ async function attemptOnce(conn, envelope, timeoutMs, authMethod) {
 * succeeds. A timeout aborts immediately (retrying auth would waste the
 * remaining budget on a reachable-but-slow host).
 * @param conn - connection parameters.
-* @param envelope - the wrapped UTF-8 envelope script.
+* @param payload - the stdin payload (`<byteCount>\n<script>`).
 * @param timeoutMs - command execution budget.
 * @returns captured stdout/stderr.
 * @throws WinrmTimedOut on deadline; the last auth/transport error when every scheme fails.
 */
-async function runWinrm(conn, envelope, timeoutMs) {
+async function runWinrm(conn, payload, timeoutMs) {
 	const candidates = conn.useHttps ? ["basic", "ntlm"] : ["ntlm", "basic"];
 	let lastError;
 	for (const authMethod of candidates) try {
-		return await attemptOnce(conn, envelope, timeoutMs, authMethod);
+		return await attemptOnce(conn, payload, timeoutMs, authMethod);
 	} catch (error) {
 		if (error instanceof WinrmTimedOut) throw error;
 		lastError = error;
@@ -343,10 +487,10 @@ async function runWinrm(conn, envelope, timeoutMs) {
 async function runScript(conn, script, options = {}) {
 	const started = Date.now();
 	const timeoutMs = options.timeoutMs ?? 6e4;
-	const envelope = winrmPowerShellScript(script);
+	const payload = scriptPayload(script);
 	let outcome;
 	try {
-		outcome = await runWinrm(conn, envelope, timeoutMs);
+		outcome = await runWinrm(conn, payload, timeoutMs);
 	} catch (error) {
 		if (error instanceof WinrmTimedOut) return {
 			stdout: "",
@@ -360,13 +504,13 @@ async function runScript(conn, script, options = {}) {
 	const raw = outcome.stdout;
 	const parsed = parseEnvelope(raw);
 	const exitCode = parsed !== null ? parsed.exitCode : 1;
-	const stderr = parsed !== null ? stripClixml(outcome.stderr) : outcome.stderr;
+	const stderr = parsed !== null ? stripClixml(parsed.stderr) : outcome.stderr;
 	options.onChunk?.({
 		output: raw,
 		stderr
 	});
 	return {
-		stdout: parsed !== null ? parsed.text : raw,
+		stdout: parsed !== null ? parsed.stdout : raw,
 		stderr,
 		exitCode,
 		timedOut: false,