herdr-remote 0.2.26 → 0.2.27

package/README.md

@@ -40,8 +40,8 @@ herdr-remote --lang zh|en
 
 On Windows, the TUI's **Keep-alive** page can register a per-user Task Scheduler broker with highest
 privileges and start it for the signed-in account. Choose **Set up admin terminal access** and
-approve the one-time Windows prompt under the same account as Herdr Remote; paired WebUI windows
-can then open a standalone elevated PowerShell without another UAC prompt. The CLI
+approve the one-time Windows prompt under the same account as Herdr Remote; the WebUI's Admin
+button then opens an elevated PowerShell as a new Herdr tab without another UAC prompt. The CLI
 `admin-broker install` and `admin-broker uninstall` commands are also available for administrators.
 Use `admin-broker status` to check the broker.
 

package/README.zh-CN.md

@@ -38,7 +38,7 @@ herdr-remote plugin link | unlink | status
 herdr-remote --lang zh|en
 ```
 
-在 Windows 上，可在 TUI 的「保活」页面注册以当前账户最高权限运行的计划任务并启动 broker。选择「设置管理员终端」，使用运行 Herdr Remote 的同一账户批准一次 Windows 提权提示；之后，已配对的 WebUI 窗口可以新建独立的管理员 PowerShell，不再重复弹出 UAC。也可以使用 `admin-broker install` 和 `admin-broker uninstall` 命令管理任务，使用 `admin-broker status` 检查 broker。
+在 Windows 上，可在 TUI 的「保活」页面注册以当前账户最高权限运行的计划任务并启动 broker。选择「设置管理员终端」，使用运行 Herdr Remote 的同一账户批准一次 Windows 提权提示；之后，WebUI 的“管理员”按钮会在 Herdr 中新建一个管理员 PowerShell 标签页，不再重复弹出 UAC。也可以使用 `admin-broker install` 和 `admin-broker uninstall` 命令管理任务，使用 `admin-broker status` 检查 broker。
 
 ## Herdr 插件
 

package/dist/cli.js

@@ -27,6 +27,7 @@ Commands:
   url                  Print browser access URL
   run [--daemon]       Run services in foreground (keep-alive)
   admin-broker install | uninstall | status (Windows)
+  admin-shell          Elevated PowerShell in this terminal (Windows)
   keepalive <action>   install | uninstall | restart | status
   plugin <action>      link | unlink | status  (Herdr plugin)
 
@@ -228,7 +229,7 @@ async function main(argv = process.argv.slice(2)) {
             const action = positional[1] || 'status';
             if (action === 'install') {
                 broker.installAdminBroker(t);
-                printJson({ installed: true, available: await broker.adminBrokerStatus() });
+                printJson({ installed: true, available: await broker.waitForAdminBroker() });
             }
             else if (action === 'uninstall') {
                 broker.uninstallAdminBroker(t);
@@ -242,6 +243,11 @@ async function main(argv = process.argv.slice(2)) {
             }
             return;
         }
+        case 'admin-shell': {
+            const { runAdminShell } = await import('./connector/admin-shell.js');
+            process.exitCode = await runAdminShell(t);
+            return;
+        }
         case 'keepalive': {
             const keepalive = await import('./keepalive/index.js');
             const action = positional[1] || 'status';

package/dist/connector/admin-broker.js

@@ -3,9 +3,11 @@ import net from 'node:net';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { PtySession } from '../pty-session.js';
-import { PACKAGE_ROOT } from '../paths.js';
-import { ADMIN_BROKER_MAX_MESSAGE_BYTES, adminBrokerPipePath, adminBrokerTaskName, sendAdminBrokerMessage, } from './adminBrokerPipe.js';
+import { PACKAGE_ROOT, stateDir } from '../paths.js';
+import { ADMIN_BROKER_MAX_MESSAGE_BYTES, adminBrokerTaskName, adminBrokerTokenMatches, connectAdminBroker, listenAdminBroker, publishAdminBrokerEndpoint, sendAdminBrokerMessage, } from './adminBrokerEndpoint.js';
 const BROKER_PING_TIMEOUT_MS = 1_000;
+const BROKER_START_TIMEOUT_MS = 5_000;
+const BROKER_START_POLL_MS = 250;
 function powershellQuote(value) {
     return `'${value.replaceAll("'", "''")}'`;
 }
@@ -30,7 +32,8 @@ export function installAdminBroker(t) {
     if (process.platform !== 'win32')
         throw new Error(t('adminBroker.windowsOnly'));
     const brokerPath = fileURLToPath(import.meta.url);
-    const brokerCommand = `& ${powershellQuote(process.execPath)} ${powershellQuote(brokerPath)}`;
+    // Pinned so the broker publishes its endpoint where this install's callers look.
+    const brokerCommand = `$env:HERDR_REMOTE_STATE_DIR = ${powershellQuote(stateDir())}; & ${powershellQuote(process.execPath)} ${powershellQuote(brokerPath)}`;
     const encodedBrokerCommand = Buffer.from(brokerCommand, 'utf16le').toString('base64');
     const powershell = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
     const script = `
@@ -58,12 +61,17 @@ Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction Silent
 `, t);
 }
 export function adminBrokerStatus() {
-    if (process.platform !== 'win32')
+    let broker;
+    try {
+        broker = connectAdminBroker();
+    }
+    catch {
         return Promise.resolve(false);
+    }
+    const { socket, token } = broker;
     return new Promise((resolve) => {
         let settled = false;
         let response = '';
-        const socket = net.createConnection(adminBrokerPipePath());
         const finish = (available) => {
             if (settled)
                 return;
@@ -73,7 +81,7 @@ export function adminBrokerStatus() {
         };
         socket.setTimeout(BROKER_PING_TIMEOUT_MS, () => finish(false));
         socket.setEncoding('utf8');
-        socket.on('connect', () => sendAdminBrokerMessage(socket, { type: 'ping' }));
+        socket.on('connect', () => sendAdminBrokerMessage(socket, { type: 'ping', token }));
         socket.on('data', (chunk) => {
             response += chunk;
             if (response.includes('\n'))
@@ -82,6 +90,16 @@ export function adminBrokerStatus() {
         socket.on('error', () => finish(false));
     });
 }
+/** The task starts the broker a moment after it is registered; wait for it to answer. */
+export async function waitForAdminBroker() {
+    const deadline = Date.now() + BROKER_START_TIMEOUT_MS;
+    while (!(await adminBrokerStatus())) {
+        if (Date.now() >= deadline)
+            return false;
+        await new Promise((resolve) => setTimeout(resolve, BROKER_START_POLL_MS));
+    }
+    return true;
+}
 function writeError(socket, error) {
     const message = error instanceof Error ? error.message : String(error);
     sendAdminBrokerMessage(socket, { type: 'error', message });
@@ -132,9 +150,9 @@ function startBrokerPty(socket, message) {
     sendAdminBrokerMessage(socket, { type: 'started', pid: pty.terminal?.pid ?? 0 });
     return pty;
 }
-function runAdminBroker() {
-    if (process.platform !== 'win32')
-        throw new Error('Administrator PTYs are only supported on Windows.');
+/** Listen on loopback and publish the endpoint; every request must carry its token. */
+export function serveAdminBroker() {
+    let token = '';
     const server = net.createServer((socket) => {
         socket.setEncoding('utf8');
         let pending = '';
@@ -162,6 +180,10 @@ function runAdminBroker() {
                 }
                 if (firstMessage) {
                     firstMessage = false;
+                    if (!adminBrokerTokenMatches(token, message.token)) {
+                        writeError(socket, new Error('Administrator terminal request was not authorized.'));
+                        return;
+                    }
                     if (message.type === 'ping') {
                         sendAdminBrokerMessage(socket, { type: 'pong' });
                         socket.end();
@@ -199,8 +221,15 @@ function runAdminBroker() {
         socket.on('close', () => pty?.kill());
         socket.on('error', () => pty?.kill());
     });
-    server.listen(adminBrokerPipePath());
-    server.on('error', (error) => {
+    listenAdminBroker(server, (port) => {
+        token = publishAdminBrokerEndpoint(port);
+    });
+    return server;
+}
+function runAdminBroker() {
+    if (process.platform !== 'win32')
+        throw new Error('Administrator PTYs are only supported on Windows.');
+    serveAdminBroker().on('error', (error) => {
         process.stderr.write(`herdr-remote administrator broker: ${error.message}\n`);
     });
 }

package/dist/connector/admin-shell.js

@@ -0,0 +1,65 @@
+// `herdr-remote admin-shell`: the administrator terminal inside a Herdr tab.
+//
+// This process runs in the tab's pane with the pane's standard rights and
+// relays its console to an elevated PowerShell that the admin broker runs. On
+// Windows, Node's raw mode reads keys as VT input and writes VT output through
+// unchanged, so the relay is byte for byte.
+import { requestHerdr } from '../herdr-api.js';
+import { ADMIN_TAB_ENV } from './admin-tab.js';
+import { ElevatedPty } from './elevatedPty.js';
+const BROKER_UNAVAILABLE_CODES = ['ENOENT', 'ECONNREFUSED', 'ETIMEDOUT'];
+/** Close the pane this runs in, which closes the tab `openAdminTab` made for it. */
+async function closeOwnPane() {
+    const socketPath = process.env.HERDR_SOCKET_PATH;
+    const paneId = process.env.HERDR_PANE_ID;
+    if (process.env[ADMIN_TAB_ENV] !== '1' || !socketPath || !paneId)
+        return;
+    try {
+        await requestHerdr(socketPath, 'pane.close', { pane_id: paneId });
+    }
+    catch {
+        // The shell's prompt comes back instead; the user can close the tab.
+    }
+}
+export async function runAdminShell(t) {
+    const { stdin, stdout } = process;
+    if (process.platform !== 'win32')
+        throw new Error(t('adminBroker.windowsOnly'));
+    if (!stdin.isTTY || !stdout.isTTY)
+        throw new Error(t('adminShell.needsTerminal'));
+    const pty = new ElevatedPty({
+        command: 'powershell.exe',
+        args: ['-NoLogo', '-NoProfile'],
+        cwd: process.cwd(),
+    });
+    const relayInput = (data) => pty.write(data);
+    const relayResize = () => pty.resize(stdout.columns, stdout.rows);
+    stdin.setRawMode(true);
+    stdin.on('data', relayInput);
+    stdout.on('resize', relayResize);
+    try {
+        const exitCode = await new Promise((resolve, reject) => {
+            pty.start({
+                cols: stdout.columns,
+                rows: stdout.rows,
+                onData: (data) => stdout.write(data),
+                onExit: (event) => resolve(event.exitCode),
+                onError: reject,
+            });
+        });
+        await closeOwnPane();
+        return exitCode;
+    }
+    catch (error) {
+        const { code } = error;
+        if (code && BROKER_UNAVAILABLE_CODES.includes(code))
+            throw new Error(t('adminShell.brokerUnavailable'));
+        throw error;
+    }
+    finally {
+        stdin.off('data', relayInput);
+        stdout.off('resize', relayResize);
+        stdin.setRawMode(false);
+        stdin.pause();
+    }
+}

package/dist/connector/admin-tab.js

@@ -0,0 +1,90 @@
+// An administrator terminal as a tab of the workstation's own Herdr, opened at
+// a browser's request.
+//
+// Herdr's API cannot start a tab running a command of our choosing, so the tab
+// starts with the user's shell and `herdr-remote admin-shell` is typed into it
+// once that shell is running. Nor can the API focus a tab for one client:
+// `tab.focus` moves every client attached to this Herdr, which is the price of
+// the requesting window showing the new tab at once.
+import path from 'node:path';
+import { requestHerdr } from '../herdr-api.js';
+import { createTranslator, detectLocale } from '../i18n/index.js';
+import { cliEntryPoint } from '../keepalive/environment.js';
+import { adminBrokerStatus } from './admin-broker.js';
+const SHELL_START_TIMEOUT_MS = 5_000;
+const SHELL_START_POLL_MS = 100;
+/** Marks the tab's shell, so `admin-shell` knows it may close the pane when done. */
+export const ADMIN_TAB_ENV = 'HERDR_REMOTE_ADMIN_TAB';
+function powershellQuote(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+function posixQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+/** The command line that starts `admin-shell`, in the syntax of the tab's shell. */
+export function adminShellCommand(shell, node, entry) {
+    const name = path.win32
+        .basename(shell)
+        .toLowerCase()
+        .replace(/\.exe$/, '');
+    if (name === 'powershell' || name === 'pwsh') {
+        return `& ${powershellQuote(node)} ${powershellQuote(entry)} admin-shell`;
+    }
+    if (name === 'cmd')
+        return `"${node}" "${entry}" admin-shell`;
+    // Git Bash and other POSIX shells: forward slashes, or C:\ reads as escapes.
+    const posix = (file) => posixQuote(file.replaceAll('\\', '/'));
+    return `${posix(node)} ${posix(entry)} admin-shell`;
+}
+/** The new tab's shell, once Herdr reports it running. */
+async function waitForShell(request, socketPath, paneId) {
+    const deadline = Date.now() + SHELL_START_TIMEOUT_MS;
+    while (true) {
+        const info = await request(socketPath, 'pane.process_info', {
+            pane_id: paneId,
+        });
+        const shell = info.process_info?.foreground_processes?.[0]?.name;
+        if (shell)
+            return shell;
+        if (Date.now() >= deadline)
+            throw new Error('The new tab did not start a shell in time.');
+        await new Promise((resolve) => setTimeout(resolve, SHELL_START_POLL_MS));
+    }
+}
+export async function openAdminTab({ socketPath, label, request = requestHerdr, brokerReady = adminBrokerStatus, }) {
+    if (!(await brokerReady())) {
+        throw Object.assign(new Error('The administrator terminal broker is not running.'), {
+            code: 'admin_broker_unavailable',
+        });
+    }
+    const created = await request(socketPath, 'tab.create', {
+        label,
+        focus: false,
+        env: { [ADMIN_TAB_ENV]: '1' },
+    });
+    const paneId = created.root_pane.pane_id;
+    await request(socketPath, 'tab.focus', { tab_id: created.tab.tab_id });
+    const shell = await waitForShell(request, socketPath, paneId);
+    await request(socketPath, 'pane.send_input', {
+        pane_id: paneId,
+        text: adminShellCommand(shell, process.execPath, cliEntryPoint()),
+        keys: ['enter'],
+    });
+}
+/** Open the tab for a browser window, and tell that window when it could not. */
+export async function openAdminTabFor(streamId, options) {
+    const t = createTranslator(detectLocale({ preference: options.language }));
+    try {
+        await openAdminTab({ socketPath: options.socketPath, label: t('adminShell.tabLabel') });
+    }
+    catch (error) {
+        const { code, message } = error;
+        process.stderr.write(`herdr-remote host connector: could not open an admin tab: ${message}\n`);
+        options.send({
+            type: 'error',
+            clientId: streamId,
+            code: code === 'admin_broker_unavailable' ? code : 'admin_tab_failed',
+            message,
+        });
+    }
+}

package/dist/connector/adminBrokerEndpoint.js

@@ -0,0 +1,68 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import fs from 'node:fs';
+import net from 'node:net';
+import path from 'node:path';
+import { stateDir } from '../paths.js';
+const ADMIN_BROKER_TASK_NAME = 'HerdrRemoteAdminBroker';
+const ADMIN_BROKER_HOST = '127.0.0.1';
+export const ADMIN_BROKER_MAX_MESSAGE_BYTES = 2 * 1_024 * 1_024;
+function adminBrokerAccountId() {
+    const account = `${process.env.USERDOMAIN || ''}\\${process.env.USERNAME || process.env.USERPROFILE || 'default'}`;
+    return createHash('sha256').update(account.toLowerCase()).digest('hex').slice(0, 24);
+}
+export function adminBrokerTaskName() {
+    return `${ADMIN_BROKER_TASK_NAME}-${adminBrokerAccountId()}`;
+}
+// Not a named pipe: one created by an elevated process admits only
+// Administrators, so the connector's standard token gets EPERM, and opening it
+// to everyone would let any account add an instance of the same name and sit
+// in the middle. A loopback port cannot be taken over by another account, and
+// the token lives in the state directory, which only this account can read.
+function endpointPath() {
+    return path.join(stateDir(), 'admin-broker.json');
+}
+/** Record where the broker listens, with a fresh token callers must present. */
+export function publishAdminBrokerEndpoint(port) {
+    const token = randomBytes(32).toString('hex');
+    const file = endpointPath();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const temporary = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, JSON.stringify({ port, token }), { mode: 0o600 });
+    fs.renameSync(temporary, file);
+    return token;
+}
+export function adminBrokerTokenMatches(expected, received) {
+    if (!expected || typeof received !== 'string')
+        return false;
+    const want = Buffer.from(expected);
+    const got = Buffer.from(received);
+    return want.length === got.length && timingSafeEqual(want, got);
+}
+function brokerUnavailable() {
+    return Object.assign(new Error('The administrator terminal broker is not running.'), {
+        code: 'ENOENT',
+    });
+}
+/** Connect to the running broker; the token goes in the first message. */
+export function connectAdminBroker() {
+    let endpoint;
+    try {
+        endpoint = JSON.parse(fs.readFileSync(endpointPath(), 'utf8'));
+    }
+    catch {
+        // Missing or half-written: either way no broker has published itself.
+        throw brokerUnavailable();
+    }
+    const { port, token } = endpoint;
+    if (!Number.isInteger(port) || typeof token !== 'string')
+        throw brokerUnavailable();
+    return { socket: net.createConnection({ host: ADMIN_BROKER_HOST, port: port }), token };
+}
+export function listenAdminBroker(server, onListening) {
+    server.listen(0, ADMIN_BROKER_HOST, () => {
+        onListening(server.address().port);
+    });
+}
+export function sendAdminBrokerMessage(socket, message) {
+    socket.write(`${JSON.stringify(message)}\n`);
+}

package/dist/connector/elevatedPty.js

@@ -1,54 +1,46 @@
-import net from 'node:net';
-import { ADMIN_BROKER_MAX_MESSAGE_BYTES, adminBrokerPipePath, sendAdminBrokerMessage, } from './adminBrokerPipe.js';
+import { ADMIN_BROKER_MAX_MESSAGE_BYTES, connectAdminBroker, sendAdminBrokerMessage, } from './adminBrokerEndpoint.js';
 const BROKER_CONNECT_TIMEOUT_MS = 5_000;
+/** A PTY the admin broker runs elevated, driven over its loopback socket. */
 export class ElevatedPty {
-    pid = 0;
-    cols;
-    rows;
     socket = null;
     input = '';
     connected = false;
     started = false;
     finished = false;
     killed = false;
+    /** Keystrokes typed while the elevated shell was still starting. */
+    early = [];
     dataListener = null;
     exitListener = null;
-    readyListener = null;
     errorListener = null;
     options;
-    constructor(options, cols, rows) {
+    constructor(options) {
         this.options = options;
-        this.cols = cols;
-        this.rows = rows;
     }
-    onData(listener) {
-        this.dataListener = listener;
-    }
-    onExit(listener) {
-        this.exitListener = listener;
-    }
-    start({ cols, rows, onData, onExit, onReady, onError }) {
-        this.cols = cols;
-        this.rows = rows;
+    start({ cols, rows, onData, onExit, onError }) {
         this.dataListener = onData;
         this.exitListener = onExit;
-        this.readyListener = onReady || null;
-        this.errorListener = onError || null;
-        const socket = net.createConnection(adminBrokerPipePath());
+        this.errorListener = onError;
+        let broker;
+        try {
+            broker = connectAdminBroker();
+        }
+        catch (error) {
+            this.fail(error);
+            return;
+        }
+        const { socket, token } = broker;
         this.socket = socket;
         socket.setEncoding('utf8');
         socket.setTimeout(BROKER_CONNECT_TIMEOUT_MS, () => {
-            socket.destroy(new Error('Administrator terminal broker connection timed out'));
+            socket.destroy(Object.assign(new Error('Administrator terminal broker connection timed out'), {
+                code: 'ETIMEDOUT',
+            }));
         });
         socket.on('connect', () => {
             this.connected = true;
             socket.setTimeout(0);
-            sendAdminBrokerMessage(socket, {
-                type: 'start',
-                ...this.options,
-                cols: this.cols,
-                rows: this.rows,
-            });
+            sendAdminBrokerMessage(socket, { type: 'start', token, ...this.options, cols, rows });
         });
         socket.on('data', (chunk) => this.receive(chunk));
         socket.on('error', (error) => this.fail(error));
@@ -60,7 +52,13 @@ export class ElevatedPty {
         });
     }
     write(data) {
-        if (this.started && !this.finished && this.socket?.writable) {
+        if (this.finished)
+            return;
+        if (!this.started) {
+            this.early.push(Buffer.from(data));
+            return;
+        }
+        if (this.socket?.writable) {
             sendAdminBrokerMessage(this.socket, {
                 type: 'input',
                 dataBase64: Buffer.from(data).toString('base64'),
@@ -68,15 +66,12 @@ export class ElevatedPty {
         }
     }
     resize(cols, rows) {
-        this.cols = cols;
-        this.rows = rows;
         if (this.started && this.socket?.writable) {
             sendAdminBrokerMessage(this.socket, { type: 'resize', cols, rows });
         }
     }
     kill() {
         this.killed = true;
-        this.pid = 0;
         if (!this.socket)
             return;
         if (this.connected && this.socket.writable) {
@@ -109,15 +104,16 @@ export class ElevatedPty {
             }
             if (message.type === 'started') {
                 this.started = true;
-                this.pid = Number(message.pid) || 0;
-                this.readyListener?.();
+                const early = Buffer.concat(this.early);
+                this.early = [];
+                if (early.length > 0)
+                    this.write(early);
             }
             else if (message.type === 'data' && typeof message.dataBase64 === 'string') {
                 this.dataListener?.(Buffer.from(message.dataBase64, 'base64').toString('utf8'));
             }
             else if (message.type === 'exit') {
                 this.finished = true;
-                this.pid = 0;
                 this.exitListener?.({
                     exitCode: Number(message.exitCode) || 0,
                     ...(typeof message.signal === 'number' ? { signal: message.signal } : {}),

package/dist/connector/host-connector.js

@@ -13,6 +13,7 @@ import { hostWebSocketUrl, resolveHostRelayUrl } from '../relay-urls.js';
 import { resolveSocketPath } from '../socket-discovery.js';
 import { resolveHostPalette } from '../terminal-palette.js';
 import { randomToken } from 'herdr-remote-relay/state';
+import { openAdminTabFor } from './admin-tab.js';
 import { AgentWatch } from './agent-watch.js';
 import { FontServer } from './font-server.js';
 import { acquireHostLock, releaseHostLock } from './lock.js';
@@ -196,7 +197,7 @@ export class HostConnector {
                     CAPABILITY.hostHandoff,
                     CAPABILITY.idleHeartbeat,
                     CAPABILITY.binaryFrameV2,
-                    ...(process.platform === 'win32' ? [CAPABILITY.adminSessions] : []),
+                    ...(process.platform === 'win32' ? [CAPABILITY.adminTabs] : []),
                 ],
             });
             // The relay sends host_ready with the current browser count. No business
@@ -283,6 +284,12 @@ export class HostConnector {
                 return this.startSession(message);
             case 'herdr_start':
                 return this.sessions.startHerdrFor(streamOf(message));
+            case 'admin_tab_open':
+                return openAdminTabFor(streamOf(message), {
+                    socketPath: this.socketPath,
+                    language: this.config.ui?.language,
+                    send: (payload) => sendJson(this.ws, payload),
+                });
             case 'session_stop': {
                 const streamId = streamOf(message);
                 if (streamId)

package/dist/connector/sessions.js

@@ -105,10 +105,6 @@ export class Sessions {
         if (!streamId)
             return undefined;
         this.stop(streamId);
-        if (message.adminTerminal) {
-            this.spawn(message);
-            return undefined;
-        }
         const missingHerdr = this.ensureHerdrCommand();
         if (missingHerdr) {
             process.stderr.write(`herdr-remote host connector: ${missingHerdr}\n`);
@@ -204,15 +200,11 @@ export class Sessions {
     spawn(message) {
         const streamId = streamOf(message);
         const streamIndex = typeof message.streamIndex === 'number' ? message.streamIndex : null;
-        const adminTerminal = message.adminTerminal === true;
-        // The normal Herdr server keeps its original token, so admin mode needs its own shell.
         const pty = new this.Pty({
-            command: adminTerminal ? 'powershell.exe' : this.herdrCommand,
-            args: adminTerminal ? ['-NoLogo', '-NoProfile'] : this.herdrArgs,
+            command: this.herdrCommand,
+            args: this.herdrArgs,
             cwd: this.cwd,
-            socketPath: adminTerminal ? null : this.socketPath,
-            adminTerminal,
-            fastWindowsPty: adminTerminal,
+            socketPath: this.socketPath,
         });
         const session = {
             id: streamId,
@@ -243,29 +235,6 @@ export class Sessions {
                 ? packStreamFrameV2(FRAME_TYPE_OUTPUT, session.streamIndex, payload)
                 : packStreamFrame('output', streamId, payload));
         };
-        let readySent = false;
-        const reportReady = () => {
-            if (readySent || this.byStream.get(streamId) !== session)
-                return;
-            readySent = true;
-            this.link.send({ type: 'session_ready', clientId: streamId });
-        };
-        const reportStartError = (error) => {
-            if (this.byStream.get(streamId) !== session)
-                return;
-            this.forget(session);
-            session.pty.kill();
-            const code = error.code;
-            const brokerUnavailable = session.pty.adminTerminal &&
-                (code === 'ENOENT' || code === 'ECONNREFUSED' || code === 'ETIMEDOUT');
-            this.sendError(streamId, brokerUnavailable ? 'admin_broker_unavailable' : 'pty_start_failed', brokerUnavailable
-                ? 'Run herdr-remote admin-broker install once from an administrator terminal.'
-                : error.message);
-            this.link.changed();
-        };
-        this.byStream.set(streamId, session);
-        if (streamIndex !== null)
-            this.streamIndexToId.set(streamIndex, streamId);
         try {
             pty.start({
                 cols: session.cols,
@@ -291,16 +260,18 @@ export class Sessions {
                     this.reportExit(session, exitCode);
                     this.link.changed();
                 },
-                onReady: reportReady,
-                onError: reportStartError,
             });
-            if (!adminTerminal)
-                reportReady();
         }
         catch (error) {
-            reportStartError(error);
+            discardOutput(session);
+            this.sendError(streamId, 'pty_start_failed', error.message);
+            pty.kill();
             return;
         }
+        this.byStream.set(streamId, session);
+        if (streamIndex !== null)
+            this.streamIndexToId.set(streamIndex, streamId);
+        this.link.send({ type: 'session_ready', clientId: streamId });
         this.link.changed();
     }
     /**

package/dist/i18n/en.js

@@ -97,6 +97,9 @@ const en = {
     'adminBroker.elevationCancelled': 'Administrator approval was declined; no changes were made.',
     'adminBroker.setupFailed': 'Could not configure the administrator terminal broker.',
     'adminBroker.tuiHint': 'Set this up once. Windows asks for administrator approval; later WebUI admin terminals open without UAC.',
+    'adminShell.needsTerminal': 'admin-shell must run in a terminal.',
+    'adminShell.brokerUnavailable': 'The administrator terminal broker is not running. Open the herdr-remote TUI, go to Keep-alive, and choose Set up admin terminal access.',
+    'adminShell.tabLabel': 'Admin',
     'relay.title': 'Relay settings',
     'relay.settings': 'Settings',
     'relay.locked': 'fixed',

package/dist/i18n/zh.js

@@ -96,6 +96,9 @@ const zh = {
     'adminBroker.elevationCancelled': '未批准管理员权限，未进行更改。',
     'adminBroker.setupFailed': '管理员终端 broker 设置失败。',
     'adminBroker.tuiHint': '只需设置一次。Windows 会请求管理员授权；之后 WebUI 新建管理员终端不再弹出 UAC。',
+    'adminShell.needsTerminal': 'admin-shell 必须在终端中运行。',
+    'adminShell.brokerUnavailable': '管理员终端 broker 尚未运行。请打开 herdr-remote TUI，进入「保活」并选择「设置管理员终端」。',
+    'adminShell.tabLabel': '管理员',
     'relay.title': 'Relay 设置',
     'relay.settings': '设置',
     'relay.locked': '固定',

package/dist/pty-session.js

@@ -1,6 +1,5 @@
 import os from 'node:os';
 import pty from 'node-pty';
-import { ElevatedPty } from './connector/elevatedPty.js';
 class PtySession {
     static DEFAULT_COLS = 100;
     static DEFAULT_ROWS = 30;
@@ -11,12 +10,11 @@ class PtySession {
     cwd;
     socketPath;
     platform;
-    adminTerminal;
     fastWindowsPty;
     spawnPty;
     terminal;
     startedAt;
-    constructor({ command, args = [], cwd = os.homedir(), socketPath, platform = process.platform, spawn: spawnPty = pty.spawn, adminTerminal = false, fastWindowsPty = false, } = {}) {
+    constructor({ command, args = [], cwd = os.homedir(), socketPath, platform = process.platform, spawn: spawnPty = pty.spawn, fastWindowsPty = false, } = {}) {
         if (typeof command !== 'string' || command.length === 0)
             throw new TypeError('command must be a non-empty string');
         if (!Array.isArray(args) || !args.every((arg) => typeof arg === 'string'))
@@ -26,7 +24,6 @@ class PtySession {
         this.cwd = cwd;
         this.socketPath = socketPath;
         this.platform = platform;
-        this.adminTerminal = adminTerminal;
         this.fastWindowsPty = fastWindowsPty;
         this.spawnPty = spawnPty;
         this.terminal = null;
@@ -50,31 +47,9 @@ class PtySession {
             return fallback;
         return Math.min(PtySession.MAX_DIMENSION, Math.max(PtySession.MIN_DIMENSION, numeric));
     }
-    start({ cols, rows, onData, onExit, onReady, onError }) {
+    start({ cols, rows, onData, onExit }) {
         if (this.terminal)
             throw new Error('PTY session already started');
-        if (this.adminTerminal) {
-            if (this.platform !== 'win32')
-                throw new Error('Administrator PTYs are only supported on Windows');
-            const terminal = new ElevatedPty({ command: this.command, args: this.args, cwd: this.cwd, socketPath: this.socketPath }, PtySession.clampDimension(cols, PtySession.DEFAULT_COLS), PtySession.clampDimension(rows, PtySession.DEFAULT_ROWS));
-            this.terminal = terminal;
-            this.startedAt = new Date().toISOString();
-            terminal.start({
-                cols: terminal.cols,
-                rows: terminal.rows,
-                onData: onData || (() => { }),
-                onExit: (event) => {
-                    this.terminal = null;
-                    onExit?.(event);
-                },
-                onReady,
-                onError: (error) => {
-                    this.terminal = null;
-                    onError?.(error);
-                },
-            });
-            return this;
-        }
         // The Herdr UI needs the bundled ConPTY's Kitty and mouse reporting.
         this.terminal = this.spawnPty(this.command, this.args, {
             name: 'xterm-256color',
@@ -98,7 +73,6 @@ class PtySession {
                 onExit(event);
             });
         }
-        onReady?.();
         return this;
     }
     write(data) {

package/dist/tui/api.js

@@ -19,11 +19,11 @@ import * as keepalive from '../keepalive/index.js';
 import { canSelfUpdate, checkForUpdate, compareVersions, currentVersion, updateChecksEnabled, installKind, performUpdate, } from '../updater.js';
 import { checkForRelayUpdate, installedRelayVersion, performRelayUpdate, } from '../relay-updater.js';
 export { detectLocale, listReachableAddresses, MIN_HERDR_VERSION, OFFICIAL_RELAY_URL, isOfficialRelay, selectedMode, canSelfUpdate, checkForUpdate, compareVersions, currentVersion, updateChecksEnabled, installKind, performUpdate, checkForRelayUpdate, installedRelayVersion, performRelayUpdate, runsLocalRelay, bindAddress, configExists, configPath, createDraft, createTranslator, ensureRuntime, extractPairingCode, fieldsForMode, fullStatus, getField, getFieldPlaceholder, herdrVersion, keepalive, loadConfig, pair, readLogTail, regenerateHostIdentity, requiresRestart, restartAll, saveDraft, setField, setRelayPassword, startAll, stateDir, stopAll, whileServicesStopped, };
-export async function adminBrokerStatus() {
+export async function adminBrokerStatus({ waitForStart = false } = {}) {
     if (process.platform !== 'win32')
         return false;
     const broker = await import('../connector/admin-broker.js');
-    return broker.adminBrokerStatus();
+    return waitForStart ? broker.waitForAdminBroker() : broker.adminBrokerStatus();
 }
 export async function configureAdminBroker(action, t) {
     const setup = await import('../connector/admin-broker-setup.js');

package/dist/tui/screens/Keepalive.js

@@ -53,7 +53,7 @@ export function Keepalive({ ctx }) {
                 let ready = false;
                 try {
                     await configureAdminBroker(action, t);
-                    ready = action === 'install' && (await adminBrokerStatus());
+                    ready = action === 'install' && (await adminBrokerStatus({ waitForStart: true }));
                 }
                 catch (error) {
                     if (error.code === 'ELEVATION_CANCELLED') {

package/herdr-plugin.toml

@@ -1,6 +1,6 @@
 id = "herdr.remote.web"
 name = "Herdr Remote Web"
-version = "0.2.26"
+version = "0.2.27"
 min_herdr_version = "0.9.1"
 description = "Browser access to Herdr workspaces via local or self-hosted relay"
 platforms = ["linux", "macos", "windows"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herdr-remote",
-  "version": "0.2.26",
+  "version": "0.2.27",
   "description": "Browser access to Herdr workspaces: plugin, host connector, and configuration TUI",
   "license": "MIT",
   "type": "module",

package/dist/connector/adminBrokerPipe.js

@@ -1,16 +0,0 @@
-import { createHash } from 'node:crypto';
-const ADMIN_BROKER_TASK_NAME = 'HerdrRemoteAdminBroker';
-export const ADMIN_BROKER_MAX_MESSAGE_BYTES = 2 * 1_024 * 1_024;
-function adminBrokerAccountId() {
-    const account = `${process.env.USERDOMAIN || ''}\\${process.env.USERNAME || process.env.USERPROFILE || 'default'}`;
-    return createHash('sha256').update(account.toLowerCase()).digest('hex').slice(0, 24);
-}
-export function adminBrokerPipePath() {
-    return `\\\\.\\pipe\\herdr-remote-admin-${adminBrokerAccountId()}`;
-}
-export function adminBrokerTaskName() {
-    return `${ADMIN_BROKER_TASK_NAME}-${adminBrokerAccountId()}`;
-}
-export function sendAdminBrokerMessage(socket, message) {
-    socket.write(`${JSON.stringify(message)}\n`);
-}