rterm-backend 3.7.3 → 3.7.4

package/bin/gybackend.cjs

@@ -77125,8 +77125,8 @@ var require_pdf = __commonJS({
               }
             }
             var fs23 = require("fs");
-            var http2 = require("http");
-            var https2 = require("https");
+            var http3 = require("http");
+            var https3 = require("https");
             var url2 = require("url");
             var PDFNodeStream = (function() {
               function PDFNodeStream2(options) {
@@ -77405,9 +77405,9 @@ var require_pdf = __commonJS({
                 };
                 _this5._request = null;
                 if (_this5._url.protocol === "http:") {
-                  _this5._request = http2.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
+                  _this5._request = http3.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
                 } else {
-                  _this5._request = https2.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
+                  _this5._request = https3.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
                 }
                 _this5._request.on("error", function(reason) {
                   _this5._errored = true;
@@ -77435,11 +77435,11 @@ var require_pdf = __commonJS({
                 _this6._httpHeaders["Range"] = "bytes=" + start + "-" + (end - 1);
                 _this6._request = null;
                 if (_this6._url.protocol === "http:") {
-                  _this6._request = http2.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
+                  _this6._request = http3.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
                     _this6._setReadableStream(response);
                   });
                 } else {
-                  _this6._request = https2.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
+                  _this6._request = https3.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
                     _this6._setReadableStream(response);
                   });
                 }
@@ -138961,8 +138961,8 @@ var require_pdf2 = __commonJS({
               }
             }
             var fs23 = require("fs");
-            var http2 = require("http");
-            var https2 = require("https");
+            var http3 = require("http");
+            var https3 = require("https");
             var url2 = require("url");
             var PDFNodeStream = (function() {
               function PDFNodeStream2(options) {
@@ -139241,9 +139241,9 @@ var require_pdf2 = __commonJS({
                 };
                 _this5._request = null;
                 if (_this5._url.protocol === "http:") {
-                  _this5._request = http2.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
+                  _this5._request = http3.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
                 } else {
-                  _this5._request = https2.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
+                  _this5._request = https3.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
                 }
                 _this5._request.on("error", function(reason) {
                   _this5._errored = true;
@@ -139271,11 +139271,11 @@ var require_pdf2 = __commonJS({
                 _this6._httpHeaders["Range"] = "bytes=" + start + "-" + (end - 1);
                 _this6._request = null;
                 if (_this6._url.protocol === "http:") {
-                  _this6._request = http2.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
+                  _this6._request = http3.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
                     _this6._setReadableStream(response);
                   });
                 } else {
-                  _this6._request = https2.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
+                  _this6._request = https3.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
                     _this6._setReadableStream(response);
                   });
                 }
@@ -185210,7 +185210,7 @@ var require_pdf3 = __commonJS({
                   this.cssStyle = null;
                   this.forceDataSchema = !!forceDataSchema;
                 }
-                var NS2 = "http://www.w3.org/2000/svg";
+                var NS3 = "http://www.w3.org/2000/svg";
                 var XML_NS = "http://www.w3.org/XML/1998/namespace";
                 var XLINK_NS = "http://www.w3.org/1999/xlink";
                 var LINE_CAP_STYLES = ["butt", "round", "square"];
@@ -185451,11 +185451,11 @@ var require_pdf3 = __commonJS({
                     this.current.x = this.current.lineX = 0;
                     this.current.y = this.current.lineY = 0;
                     current.xcoords = [];
-                    current.tspan = document.createElementNS(NS2, "svg:tspan");
+                    current.tspan = document.createElementNS(NS3, "svg:tspan");
                     current.tspan.setAttributeNS(null, "font-family", current.fontFamily);
                     current.tspan.setAttributeNS(null, "font-size", pf(current.fontSize) + "px");
                     current.tspan.setAttributeNS(null, "y", pf(-current.y));
-                    current.txtElement = document.createElementNS(NS2, "svg:text");
+                    current.txtElement = document.createElementNS(NS3, "svg:text");
                     current.txtElement.appendChild(current.tspan);
                   },
                   beginText: function SVGGraphics_beginText() {
@@ -185463,9 +185463,9 @@ var require_pdf3 = __commonJS({
                     this.current.y = this.current.lineY = 0;
                     this.current.textMatrix = _util.IDENTITY_MATRIX;
                     this.current.lineMatrix = _util.IDENTITY_MATRIX;
-                    this.current.tspan = document.createElementNS(NS2, "svg:tspan");
-                    this.current.txtElement = document.createElementNS(NS2, "svg:text");
-                    this.current.txtgrp = document.createElementNS(NS2, "svg:g");
+                    this.current.tspan = document.createElementNS(NS3, "svg:tspan");
+                    this.current.txtElement = document.createElementNS(NS3, "svg:text");
+                    this.current.txtgrp = document.createElementNS(NS3, "svg:g");
                     this.current.xcoords = [];
                   },
                   moveText: function SVGGraphics_moveText(x, y) {
@@ -185473,7 +185473,7 @@ var require_pdf3 = __commonJS({
                     this.current.x = this.current.lineX += x;
                     this.current.y = this.current.lineY += y;
                     current.xcoords = [];
-                    current.tspan = document.createElementNS(NS2, "svg:tspan");
+                    current.tspan = document.createElementNS(NS3, "svg:tspan");
                     current.tspan.setAttributeNS(null, "font-family", current.fontFamily);
                     current.tspan.setAttributeNS(null, "font-size", pf(current.fontSize) + "px");
                     current.tspan.setAttributeNS(null, "y", pf(-current.y));
@@ -185540,7 +185540,7 @@ var require_pdf3 = __commonJS({
                   },
                   addFontStyle: function SVGGraphics_addFontStyle(fontObj) {
                     if (!this.cssStyle) {
-                      this.cssStyle = document.createElementNS(NS2, "svg:style");
+                      this.cssStyle = document.createElementNS(NS3, "svg:style");
                       this.cssStyle.setAttributeNS(null, "type", "text/css");
                       this.defs.appendChild(this.cssStyle);
                     }
@@ -185569,7 +185569,7 @@ var require_pdf3 = __commonJS({
                     current.fontFamily = fontObj.loadedName;
                     current.fontWeight = bold;
                     current.fontStyle = italic;
-                    current.tspan = document.createElementNS(NS2, "svg:tspan");
+                    current.tspan = document.createElementNS(NS3, "svg:tspan");
                     current.tspan.setAttributeNS(null, "y", pf(-current.y));
                     current.xcoords = [];
                   },
@@ -185600,7 +185600,7 @@ var require_pdf3 = __commonJS({
                   setFillRGBColor: function SVGGraphics_setFillRGBColor(r, g, b) {
                     var color2 = _util.Util.makeCssRgb(r, g, b);
                     this.current.fillColor = color2;
-                    this.current.tspan = document.createElementNS(NS2, "svg:tspan");
+                    this.current.tspan = document.createElementNS(NS3, "svg:tspan");
                     this.current.xcoords = [];
                   },
                   setDash: function SVGGraphics_setDash(dashArray, dashPhase) {
@@ -185610,7 +185610,7 @@ var require_pdf3 = __commonJS({
                   constructPath: function SVGGraphics_constructPath(ops, args) {
                     var current = this.current;
                     var x = current.x, y = current.y;
-                    current.path = document.createElementNS(NS2, "svg:path");
+                    current.path = document.createElementNS(NS3, "svg:path");
                     var d = [];
                     var opLength = ops.length;
                     for (var i = 0, j = 0; i < opLength; i++) {
@@ -185670,7 +185670,7 @@ var require_pdf3 = __commonJS({
                     var current = this.current;
                     var clipId = "clippath" + clipCount;
                     clipCount++;
-                    var clipPath = document.createElementNS(NS2, "svg:clipPath");
+                    var clipPath = document.createElementNS(NS3, "svg:clipPath");
                     clipPath.setAttributeNS(null, "id", clipId);
                     clipPath.setAttributeNS(null, "transform", pm(this.transformMatrix));
                     var clipElement = current.element.cloneNode();
@@ -185784,7 +185784,7 @@ var require_pdf3 = __commonJS({
                   },
                   paintSolidColorImageMask: function SVGGraphics_paintSolidColorImageMask() {
                     var current = this.current;
-                    var rect = document.createElementNS(NS2, "svg:rect");
+                    var rect = document.createElementNS(NS3, "svg:rect");
                     rect.setAttributeNS(null, "x", "0");
                     rect.setAttributeNS(null, "y", "0");
                     rect.setAttributeNS(null, "width", "1px");
@@ -185794,7 +185794,7 @@ var require_pdf3 = __commonJS({
                   },
                   paintJpegXObject: function SVGGraphics_paintJpegXObject(objId, w, h) {
                     var imgObj = this.objs.get(objId);
-                    var imgEl = document.createElementNS(NS2, "svg:image");
+                    var imgEl = document.createElementNS(NS3, "svg:image");
                     imgEl.setAttributeNS(XLINK_NS, "xlink:href", imgObj.src);
                     imgEl.setAttributeNS(null, "width", pf(w));
                     imgEl.setAttributeNS(null, "height", pf(h));
@@ -185815,14 +185815,14 @@ var require_pdf3 = __commonJS({
                     var width = imgData.width;
                     var height = imgData.height;
                     var imgSrc = convertImgDataToPng(imgData, this.forceDataSchema);
-                    var cliprect = document.createElementNS(NS2, "svg:rect");
+                    var cliprect = document.createElementNS(NS3, "svg:rect");
                     cliprect.setAttributeNS(null, "x", "0");
                     cliprect.setAttributeNS(null, "y", "0");
                     cliprect.setAttributeNS(null, "width", pf(width));
                     cliprect.setAttributeNS(null, "height", pf(height));
                     this.current.element = cliprect;
                     this.clip("nonzero");
-                    var imgEl = document.createElementNS(NS2, "svg:image");
+                    var imgEl = document.createElementNS(NS3, "svg:image");
                     imgEl.setAttributeNS(XLINK_NS, "xlink:href", imgSrc);
                     imgEl.setAttributeNS(null, "x", "0");
                     imgEl.setAttributeNS(null, "y", pf(-height));
@@ -185841,9 +185841,9 @@ var require_pdf3 = __commonJS({
                     var height = imgData.height;
                     var fillColor = current.fillColor;
                     current.maskId = "mask" + maskCount++;
-                    var mask = document.createElementNS(NS2, "svg:mask");
+                    var mask = document.createElementNS(NS3, "svg:mask");
                     mask.setAttributeNS(null, "id", current.maskId);
-                    var rect = document.createElementNS(NS2, "svg:rect");
+                    var rect = document.createElementNS(NS3, "svg:rect");
                     rect.setAttributeNS(null, "x", "0");
                     rect.setAttributeNS(null, "y", "0");
                     rect.setAttributeNS(null, "width", pf(width));
@@ -185861,7 +185861,7 @@ var require_pdf3 = __commonJS({
                     if ((0, _util.isArray)(bbox) && bbox.length === 4) {
                       var width = bbox[2] - bbox[0];
                       var height = bbox[3] - bbox[1];
-                      var cliprect = document.createElementNS(NS2, "svg:rect");
+                      var cliprect = document.createElementNS(NS3, "svg:rect");
                       cliprect.setAttributeNS(null, "x", bbox[0]);
                       cliprect.setAttributeNS(null, "y", bbox[1]);
                       cliprect.setAttributeNS(null, "width", pf(width));
@@ -185874,16 +185874,16 @@ var require_pdf3 = __commonJS({
                   paintFormXObjectEnd: function SVGGraphics_paintFormXObjectEnd() {
                   },
                   _initialize: function SVGGraphics_initialize(viewport) {
-                    var svg = document.createElementNS(NS2, "svg:svg");
+                    var svg = document.createElementNS(NS3, "svg:svg");
                     svg.setAttributeNS(null, "version", "1.1");
                     svg.setAttributeNS(null, "width", viewport.width + "px");
                     svg.setAttributeNS(null, "height", viewport.height + "px");
                     svg.setAttributeNS(null, "preserveAspectRatio", "none");
                     svg.setAttributeNS(null, "viewBox", "0 0 " + viewport.width + " " + viewport.height);
-                    var definitions = document.createElementNS(NS2, "svg:defs");
+                    var definitions = document.createElementNS(NS3, "svg:defs");
                     svg.appendChild(definitions);
                     this.defs = definitions;
-                    var rootGroup = document.createElementNS(NS2, "svg:g");
+                    var rootGroup = document.createElementNS(NS3, "svg:g");
                     rootGroup.setAttributeNS(null, "transform", pm(viewport.transform));
                     svg.appendChild(rootGroup);
                     this.svg = rootGroup;
@@ -185891,7 +185891,7 @@ var require_pdf3 = __commonJS({
                   },
                   _ensureClipGroup: function SVGGraphics_ensureClipGroup() {
                     if (!this.current.clipGroup) {
-                      var clipGroup = document.createElementNS(NS2, "svg:g");
+                      var clipGroup = document.createElementNS(NS3, "svg:g");
                       clipGroup.setAttributeNS(null, "clip-path", this.current.activeClipUrl);
                       this.svg.appendChild(clipGroup);
                       this.current.clipGroup = clipGroup;
@@ -185900,7 +185900,7 @@ var require_pdf3 = __commonJS({
                   },
                   _ensureTransformGroup: function SVGGraphics_ensureTransformGroup() {
                     if (!this.tgrp) {
-                      this.tgrp = document.createElementNS(NS2, "svg:g");
+                      this.tgrp = document.createElementNS(NS3, "svg:g");
                       this.tgrp.setAttributeNS(null, "transform", pm(this.transformMatrix));
                       if (this.current.activeClipUrl) {
                         this._ensureClipGroup().appendChild(this.tgrp);
@@ -253971,8 +253971,8 @@ var require_pdf4 = __commonJS({
               }
             }
             var fs23 = require("fs");
-            var http2 = require("http");
-            var https2 = require("https");
+            var http3 = require("http");
+            var https3 = require("https");
             var url2 = require("url");
             var fileUriRegex = /^file:\/\/\/[a-zA-Z]:\//;
             function parseUrl(sourceUrl) {
@@ -254272,9 +254272,9 @@ var require_pdf4 = __commonJS({
                 };
                 _this5._request = null;
                 if (_this5._url.protocol === "http:") {
-                  _this5._request = http2.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
+                  _this5._request = http3.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
                 } else {
-                  _this5._request = https2.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
+                  _this5._request = https3.request(createRequestOptions(_this5._url, stream.httpHeaders), handleResponse);
                 }
                 _this5._request.on("error", function(reason) {
                   _this5._errored = true;
@@ -254302,11 +254302,11 @@ var require_pdf4 = __commonJS({
                 _this6._httpHeaders["Range"] = "bytes=" + start + "-" + (end - 1);
                 _this6._request = null;
                 if (_this6._url.protocol === "http:") {
-                  _this6._request = http2.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
+                  _this6._request = http3.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
                     _this6._setReadableStream(response);
                   });
                 } else {
-                  _this6._request = https2.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
+                  _this6._request = https3.request(createRequestOptions(_this6._url, _this6._httpHeaders), function(response) {
                     _this6._setReadableStream(response);
                   });
                 }
@@ -260836,8 +260836,8 @@ var require_websocket = __commonJS({
   "../../node_modules/ws/lib/websocket.js"(exports2, module2) {
     "use strict";
     var EventEmitter4 = require("events");
-    var https2 = require("https");
-    var http2 = require("http");
+    var https3 = require("https");
+    var http3 = require("http");
     var net2 = require("net");
     var tls = require("tls");
     var { randomBytes: randomBytes3, createHash: createHash7 } = require("crypto");
@@ -261371,7 +261371,7 @@ var require_websocket = __commonJS({
       }
       const defaultPort = isSecure ? 443 : 80;
       const key = randomBytes3(16).toString("base64");
-      const request = isSecure ? https2.request : http2.request;
+      const request = isSecure ? https3.request : http3.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
       opts.createConnection = opts.createConnection || (isSecure ? tlsConnect : netConnect);
@@ -261865,7 +261865,7 @@ var require_websocket_server = __commonJS({
   "../../node_modules/ws/lib/websocket-server.js"(exports2, module2) {
     "use strict";
     var EventEmitter4 = require("events");
-    var http2 = require("http");
+    var http3 = require("http");
     var { Duplex } = require("stream");
     var { createHash: createHash7 } = require("crypto");
     var extension = require_extension();
@@ -261940,8 +261940,8 @@ var require_websocket_server = __commonJS({
           );
         }
         if (options.port != null) {
-          this._server = http2.createServer((req, res) => {
-            const body = http2.STATUS_CODES[426];
+          this._server = http3.createServer((req, res) => {
+            const body = http3.STATUS_CODES[426];
             res.writeHead(426, {
               "Content-Length": body.length,
               "Content-Type": "text/plain"
@@ -262228,7 +262228,7 @@ var require_websocket_server = __commonJS({
       this.destroy();
     }
     function abortHandshake(socket, code, message, headers) {
-      message = message || http2.STATUS_CODES[code];
+      message = message || http3.STATUS_CODES[code];
       headers = {
         Connection: "close",
         "Content-Type": "text/html",
@@ -262237,7 +262237,7 @@ var require_websocket_server = __commonJS({
       };
       socket.once("finish", socket.destroy);
       socket.end(
-        `HTTP/1.1 ${code} ${http2.STATUS_CODES[code]}\r
+        `HTTP/1.1 ${code} ${http3.STATUS_CODES[code]}\r
 ` + Object.keys(headers).map((h) => `${h}: ${headers[h]}`).join("\r\n") + "\r\n\r\n" + message
       );
     }
@@ -265836,7 +265836,7 @@ var require_schemes = __commonJS({
       urnComponent.nss = (uuidComponent.uuid || "").toLowerCase();
       return urnComponent;
     }
-    var http2 = (
+    var http3 = (
       /** @type {SchemeHandler} */
       {
         scheme: "http",
@@ -265845,11 +265845,11 @@ var require_schemes = __commonJS({
         serialize: httpSerialize
       }
     );
-    var https2 = (
+    var https3 = (
       /** @type {SchemeHandler} */
       {
         scheme: "https",
-        domainHost: http2.domainHost,
+        domainHost: http3.domainHost,
         parse: httpParse,
         serialize: httpSerialize
       }
@@ -265893,8 +265893,8 @@ var require_schemes = __commonJS({
     var SCHEMES = (
       /** @type {Record<SchemeName, SchemeHandler>} */
       {
-        http: http2,
-        https: https2,
+        http: http3,
+        https: https3,
         ws,
         wss,
         urn,
@@ -295120,7 +295120,7 @@ echo "__GYSHELL_READY__"
 };
 
 // ../../packages/backend/src/services/WinRMBackend.ts
-var import_node_crypto2 = require("node:crypto");
+var import_node_crypto3 = require("node:crypto");
 
 // ../../packages/backend/src/services/WinRMTransport.ts
 var import_node_http = __toESM(require("node:http"), 1);
@@ -295384,6 +295384,363 @@ var WinRMTransport = class {
   }
 };
 
+// ../../packages/backend/src/services/PSRPTransport.ts
+var import_node_http2 = __toESM(require("node:http"), 1);
+var import_node_https2 = __toESM(require("node:https"), 1);
+var import_node_buffer2 = require("node:buffer");
+var import_node_crypto2 = require("node:crypto");
+var NS2 = {
+  s: "http://www.w3.org/2003/05/soap-envelope",
+  a: "http://schemas.xmlsoap.org/ws/2004/08/addressing",
+  w: "http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd",
+  rsp: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell",
+  n: "http://schemas.xmlsoap.org/ws/2004/09/enumeration"
+};
+var PSRP_SHELL_URI = "http://schemas.microsoft.com/powershell/Microsoft.PowerShell";
+var MSG = {
+  SESSION_CAPABILITY: 65538,
+  INIT_RUNSPACEPOOL: 65540,
+  CREATE_PIPELINE: 135174,
+  RUNSPACEPOOL_STATE: 135173,
+  APPLICATION_PRIVATE_DATA: 135178,
+  PIPELINE_OUTPUT: 266244,
+  ERROR_RECORD: 266245,
+  PIPELINE_STATE: 266246
+};
+function guidLe(uuid3) {
+  const hex = uuid3.replace(/-/g, "");
+  const b = import_node_buffer2.Buffer.from(hex, "hex");
+  const out = import_node_buffer2.Buffer.alloc(16);
+  out[0] = b[3];
+  out[1] = b[2];
+  out[2] = b[1];
+  out[3] = b[0];
+  out[4] = b[5];
+  out[5] = b[4];
+  out[6] = b[7];
+  out[7] = b[6];
+  b.subarray(8).copy(out, 8);
+  return out;
+}
+function psrpMessage(messageType, rpid, pid, payload) {
+  const dest = import_node_buffer2.Buffer.alloc(4);
+  dest.writeUInt32LE(2, 0);
+  const type2 = import_node_buffer2.Buffer.alloc(4);
+  type2.writeUInt32LE(messageType, 0);
+  const body = import_node_buffer2.Buffer.from(payload, "utf8");
+  return import_node_buffer2.Buffer.concat([dest, type2, guidLe(rpid), guidLe(pid), body]);
+}
+function fragmentMessages(messages, objectIdStart, maxPayload = 32768) {
+  const out = [];
+  let objectId = objectIdStart;
+  for (const msg of messages) {
+    const maxChunk = maxPayload - 21;
+    let fragmentId = 0;
+    let offset = 0;
+    let start = true;
+    for (; ; ) {
+      const chunk2 = msg.subarray(offset, offset + maxChunk);
+      offset += chunk2.length;
+      const end = offset >= msg.length;
+      const head = import_node_buffer2.Buffer.alloc(21);
+      head.writeBigUInt64BE(BigInt(objectId), 0);
+      head.writeBigUInt64BE(BigInt(fragmentId), 8);
+      head.writeUInt8((start ? 1 : 0) | (end ? 2 : 0), 16);
+      head.writeUInt32BE(chunk2.length, 17);
+      out.push(head, chunk2);
+      fragmentId += 1;
+      start = false;
+      if (end) break;
+    }
+    objectId += 1;
+  }
+  return { blob: import_node_buffer2.Buffer.concat(out), nextObjectId: objectId };
+}
+function unfragmentMessages(data) {
+  const messages = [];
+  let i = 0;
+  let current = [];
+  let currentId = -1n;
+  while (i + 21 <= data.length) {
+    const objectId = data.readBigUInt64BE(i);
+    const startEnd = data.readUInt8(i + 16);
+    const len = data.readUInt32BE(i + 17);
+    const chunk2 = data.subarray(i + 21, i + 21 + len);
+    i += 21 + len;
+    if (currentId !== objectId) {
+      if (current.length) messages.push(import_node_buffer2.Buffer.concat(current));
+      current = [];
+      currentId = objectId;
+    }
+    current.push(chunk2);
+    if (startEnd & 2) {
+      messages.push(import_node_buffer2.Buffer.concat(current));
+      current = [];
+      currentId = -1n;
+    }
+  }
+  if (current.length) messages.push(import_node_buffer2.Buffer.concat(current));
+  return messages;
+}
+function escapeXml2(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function sessionCapabilityXml() {
+  return `<Obj RefId="0"><MS><Version N="protocolversion">2.3</Version><Version N="PSVersion">2.0</Version><Version N="SerializationVersion">1.1.0.1</Version></MS></Obj>`;
+}
+function initRunspacePoolXml() {
+  return `<Obj RefId="0"><MS><I32 N="MinRunspaces">1</I32><I32 N="MaxRunspaces">1</I32><Obj RefId="1" N="PSThreadOptions"><TN RefId="0"><T>System.Management.Automation.Runspaces.PSThreadOptions</T><T>System.Enum</T><T>System.ValueType</T><T>System.Object</T></TN><ToString>Default</ToString><I32>0</I32></Obj><Obj RefId="2" N="ApartmentState"><TN RefId="1"><T>System.Management.Automation.Runspaces.ApartmentState</T><T>System.Enum</T><T>System.ValueType</T><T>System.Object</T></TN><ToString>UNKNOWN</ToString><I32>2</I32></Obj><Obj RefId="3" N="HostInfo"><MS><B N="_isHostNull">true</B><B N="_isHostUINull">true</B><B N="_isHostRawUINull">true</B><B N="_useRunspaceHost">true</B></MS></Obj><Nil N="ApplicationArguments" /></MS></Obj>`;
+}
+function createPipelineXml(script) {
+  return `<Obj RefId="0"><MS><B N="NoInput">true</B><Obj RefId="1" N="ApartmentState"><TN RefId="0"><T>System.Management.Automation.Runspaces.ApartmentState</T><T>System.Enum</T><T>System.ValueType</T><T>System.Object</T></TN><ToString>UNKNOWN</ToString><I32>2</I32></Obj><Obj RefId="2" N="RemoteStreamOptions"><TN RefId="1"><T>System.Management.Automation.Runspaces.RemoteStreamOptions</T><T>System.Enum</T><T>System.ValueType</T><T>System.Object</T></TN><ToString>AddInvocationInfoToErrorRecord</ToString><I32>1</I32></Obj><B N="AddToHistory">false</B><Obj RefId="3" N="HostInfo"><MS><B N="_isHostNull">true</B><B N="_isHostUINull">true</B><B N="_isHostRawUINull">true</B><B N="_useRunspaceHost">true</B></MS></Obj><Obj RefId="4" N="PowerShell"><MS><B N="IsNested">false</B><Nil N="ExtraCmds" /><Obj RefId="5" N="Cmds"><TN RefId="2"><T>System.Collections.Generic.List\`1[[System.Management.Automation.PSObject, System.Management.Automation, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]]</T><T>System.Object</T></TN><LST><Obj RefId="6"><MS><S N="Cmd">${escapeXml2(script)}</S><B N="IsScript">true</B><Nil N="UseLocalScope" /><Obj RefId="7" N="MergeMyResult"><TN RefId="3"><T>System.Management.Automation.Runspaces.PipelineResultTypes</T><T>System.Enum</T><T>System.ValueType</T><T>System.Object</T></TN><ToString>None</ToString><I32>0</I32></Obj><Obj RefId="8" N="MergeToResult"><TNRef RefId="3" /><ToString>None</ToString><I32>0</I32></Obj><Obj RefId="9" N="MergePreviousResults"><TNRef RefId="3" /><ToString>None</ToString><I32>0</I32></Obj><Obj RefId="10" N="Args"><TNRef RefId="2" /><LST /></Obj><Obj RefId="11" N="MergeError"><TNRef RefId="3" /><ToString>None</ToString><I32>0</I32></Obj><Obj RefId="12" N="MergeWarning"><TNRef RefId="3" /><ToString>None</ToString><I32>0</I32></Obj><Obj RefId="13" N="MergeVerbose"><TNRef RefId="3" /><ToString>None</ToString><I32>0</I32></Obj><Obj RefId="14" N="MergeDebug"><TNRef RefId="3" /><ToString>None</ToString><I32>0</I32></Obj><Obj RefId="15" N="MergeInformation"><TNRef RefId="3" /><ToString>None</ToString><I32>0</I32></Obj></MS></Obj></LST></Obj><S N="History" /><B N="RedirectShellErrorOutputPipe">false</B></MS></Obj><B N="IsNested">false</B></MS></Obj>`;
+}
+function firstText2(xml, localName) {
+  const re = new RegExp(`<\\w*:?${localName}\\b[^>]*>([\\s\\S]*?)<\\/\\w*:?${localName}>`, "i");
+  const m2 = xml.match(re);
+  return m2 ? m2[1] : "";
+}
+function extractShellId2(xml) {
+  const re = /<\w*:?Selector\b[^>]*\bName="ShellId"[^>]*>([\s\S]*?)<\/\w*:?Selector>/i;
+  const m2 = xml.match(re);
+  if (m2) return m2[1].trim();
+  return "";
+}
+var PSRPTransport = class {
+  opts;
+  authHeader;
+  /** pypsrp WSMan.session_id — one uuid for the life of the transport. */
+  sessionId = `uuid:${(0, import_node_crypto2.randomUUID)().toUpperCase()}`;
+  /** Reuse the TCP connection. Windows' PSRP plugin binds the ShellId to the
+   * HTTP session — a new TCP socket per SOAP call is why Receive after Create
+   * returned InvalidSelectors even with a correct SelectorSet. */
+  httpAgent;
+  constructor(opts) {
+    this.opts = {
+      path: opts.path ?? "/wsman",
+      timeoutMs: opts.timeoutMs ?? 3e4,
+      rejectUnauthorized: opts.rejectUnauthorized,
+      ...opts
+    };
+    this.authHeader = "Basic " + import_node_buffer2.Buffer.from(`${opts.username}:${opts.password}`, "utf8").toString("base64");
+    this.httpAgent = this.opts.transport === "https" ? new import_node_https2.default.Agent({ keepAlive: true, maxSockets: 1, rejectUnauthorized: this.opts.rejectUnauthorized ?? true }) : new import_node_http2.default.Agent({ keepAlive: true, maxSockets: 1 });
+  }
+  endpoint() {
+    return `${this.opts.transport}://${this.opts.host}:${this.opts.port}${this.opts.path}`;
+  }
+  envelope(action, body, extraHeaders) {
+    const mid = `uuid:${(0, import_node_crypto2.randomUUID)()}`;
+    const to = this.endpoint();
+    const wsmv = "http://schemas.microsoft.com/wbem/wsman/1/wsman.xsd";
+    return `<s:Envelope xmlns:s="${NS2.s}" xmlns:wsa="${NS2.a}" xmlns:wsman="${NS2.w}" xmlns:wsmv="${wsmv}" xmlns:rsp="${NS2.rsp}" xml:lang="en-US"><s:Header><wsa:Action s:mustUnderstand="true">${action}</wsa:Action><wsmv:DataLocale s:mustUnderstand="false" xml:lang="en-US" /><wsman:Locale s:mustUnderstand="false" xml:lang="en-US" /><wsman:MaxEnvelopeSize s:mustUnderstand="true">512000</wsman:MaxEnvelopeSize><wsa:MessageID>${mid}</wsa:MessageID><wsman:OperationTimeout>PT60.000S</wsman:OperationTimeout><wsa:ReplyTo><wsa:Address s:mustUnderstand="true">${NS2.a}/role/anonymous</wsa:Address></wsa:ReplyTo><wsman:ResourceURI s:mustUnderstand="true">${PSRP_SHELL_URI}</wsman:ResourceURI><wsmv:SessionId s:mustUnderstand="false">${this.sessionId}</wsmv:SessionId><wsa:To>${to}</wsa:To>${extraHeaders}</s:Header><s:Body>${body}</s:Body></s:Envelope>`;
+  }
+  async post(action, body, extraHeaders) {
+    const envelope = this.envelope(action, body, extraHeaders);
+    const url2 = new URL(this.endpoint());
+    const isHttps = this.opts.transport === "https";
+    const lib = isHttps ? import_node_https2.default : import_node_http2.default;
+    const options = {
+      method: "POST",
+      hostname: url2.hostname,
+      port: url2.port,
+      path: url2.pathname,
+      headers: {
+        "Content-Type": "application/soap+xml;charset=UTF-8",
+        Authorization: this.authHeader,
+        "Content-Length": import_node_buffer2.Buffer.byteLength(envelope, "utf8")
+      },
+      // @ts-expect-error rejectUnauthorized is https-only
+      rejectUnauthorized: isHttps ? this.opts.rejectUnauthorized ?? true : void 0,
+      timeout: this.opts.timeoutMs,
+      agent: this.httpAgent
+    };
+    return new Promise((resolve2, reject) => {
+      const req = lib.request(options, (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => {
+          resolve2({ status: res.statusCode ?? 0, body: import_node_buffer2.Buffer.concat(chunks).toString("utf8") });
+        });
+        res.on("error", reject);
+      });
+      req.on("timeout", () => req.destroy(new Error(`PSRP request timed out after ${this.opts.timeoutMs}ms`)));
+      req.on("error", reject);
+      req.write(envelope);
+      req.end();
+    });
+  }
+  /**
+   * Run a PowerShell script end-to-end over PSRP:
+   *   Create (creationXml = SESSION_CAPABILITY + INIT_RUNSPACEPOOL) →
+   *   Command (CommandLine CommandId=PIPELINE_ID, empty Command, fragment in
+   *   Arguments carrying CREATE_PIPELINE dest=2) →
+   *   Receive loop (PIPELINE_OUTPUT / ERROR_RECORD / PIPELINE_STATE) → Delete.
+   * The script travels inside the PSRP message body — no command-line length limit.
+   */
+  async runScript(script, opts) {
+    const deadline = Date.now() + (opts?.timeoutMs ?? 12e4);
+    const rpid = (0, import_node_crypto2.randomUUID)().toUpperCase();
+    const pipelineId = (0, import_node_crypto2.randomUUID)().toUpperCase();
+    const creation = fragmentMessages([
+      psrpMessage(MSG.SESSION_CAPABILITY, rpid, "00000000-0000-0000-0000-000000000000", sessionCapabilityXml()),
+      psrpMessage(MSG.INIT_RUNSPACEPOOL, rpid, "00000000-0000-0000-0000-000000000000", initRunspacePoolXml())
+    ], 1);
+    const creationFragment = creation.blob;
+    const createBody = `<rsp:Shell ShellId="${rpid}"><rsp:InputStreams>stdin pr</rsp:InputStreams><rsp:OutputStreams>stdout</rsp:OutputStreams><creationXml xmlns="http://schemas.microsoft.com/powershell">` + creationFragment.toString("base64") + `</creationXml></rsp:Shell>`;
+    const createHeaders = `<wsman:OptionSet s:mustUnderstand="true"><wsman:Option MustComply="true" Name="protocolversion">2.3</wsman:Option></wsman:OptionSet>`;
+    const created = await this.post(
+      "http://schemas.xmlsoap.org/ws/2004/09/transfer/Create",
+      createBody,
+      createHeaders
+    );
+    this.assertOk(created, "Create");
+    const shellId = extractShellId2(created.body);
+    if (!shellId) throw new Error("PSRP Create succeeded but no ShellId returned.");
+    try {
+      await this.waitForRunspaceOpened(shellId, deadline, opts?.signal);
+      const createPipelineMsg = psrpMessage(MSG.CREATE_PIPELINE, rpid, pipelineId, createPipelineXml(script));
+      const commandBody = `<rsp:CommandLine CommandId="${pipelineId}"><rsp:Command></rsp:Command><rsp:Arguments>${fragmentMessages([createPipelineMsg], creation.nextObjectId).blob.toString("base64")}</rsp:Arguments></rsp:CommandLine>`;
+      const commandHeaders = `<wsman:OptionSet s:mustUnderstand="true"><wsman:Option Name="WINRS_SKIP_CMD_SHELL">False</wsman:Option></wsman:OptionSet>` + this.shellHeaders(shellId);
+      const commanded = await this.post(
+        "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/Command",
+        commandBody,
+        commandHeaders
+      );
+      this.assertOk(commanded, "Command");
+      const commandId = firstText2(commanded.body, "CommandId");
+      if (!commandId) throw new Error("PSRP Command succeeded but no CommandId returned.");
+      let stdout = "";
+      let stderr = "";
+      let hadErrors = false;
+      let exitCode = 0;
+      let pipelineDone = false;
+      for (; ; ) {
+        if (opts?.signal?.aborted) throw new Error("AbortError");
+        if (Date.now() > deadline) {
+          throw new Error(`PSRP command timed out after ${opts?.timeoutMs ?? 12e4}ms`);
+        }
+        const receiveBody = `<rsp:Receive><rsp:DesiredStream CommandId="${commandId}">stdout</rsp:DesiredStream></rsp:Receive>`;
+        const receiveHeaders = `<wsman:OptionSet s:mustUnderstand="true"><wsman:Option Name="WSMAN_CMDSHELL_OPTION_KEEPALIVE">True</wsman:Option></wsman:OptionSet>` + this.shellHeaders(shellId);
+        const received = await this.post(
+          "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/Receive",
+          receiveBody,
+          receiveHeaders
+        );
+        this.assertOk(received, "Receive");
+        const streamRe = /<\w*:?Stream\b[^>]*\bName="(?:stdout|stderr|pr)"[^>]*>([\s\S]*?)<\/\w*:?Stream>/gi;
+        let m2;
+        while ((m2 = streamRe.exec(received.body)) !== null) {
+          const b64 = m2[1].replace(/\s+/g, "");
+          if (!b64) continue;
+          for (const raw of unfragmentMessages(import_node_buffer2.Buffer.from(b64, "base64"))) {
+            if (raw.length < 40) continue;
+            const messageType = raw.readUInt32LE(4);
+            const payload = raw.subarray(40).toString("utf8").replace(/^\uFEFF/, "");
+            if (messageType === MSG.PIPELINE_OUTPUT) {
+              const sRe = /<S[^>]*>([\s\S]*?)<\/S>/gi;
+              let sm;
+              while ((sm = sRe.exec(payload)) !== null) stdout += sm[1];
+            } else if (messageType === MSG.ERROR_RECORD) {
+              hadErrors = true;
+              const mRe = payload.match(/<S N="Message">([\s\S]*?)<\/S>/i);
+              stderr += (mRe ? mRe[1] : payload) + "\n";
+            } else if (messageType === MSG.PIPELINE_STATE) {
+              pipelineDone = true;
+              const stateMatch = payload.match(/<I32 N="State">(\d+)<\/I32>/i);
+              if (stateMatch) {
+                if (parseInt(stateMatch[1], 10) === 5) hadErrors = true;
+              }
+              const ec = payload.match(/N="ExitCode"[^>]*>(-?\d+)</i);
+              if (ec) exitCode = parseInt(ec[1], 10);
+            }
+          }
+        }
+        const wsExit = received.body.match(/<\w*:?ExitCode>\s*(-?\d+)\s*<\/\w*:?ExitCode>/i);
+        if (wsExit) exitCode = parseInt(wsExit[1], 10);
+        if (pipelineDone) break;
+        if (/CommandState\/Done/i.test(received.body)) break;
+      }
+      if (exitCode !== 0) hadErrors = true;
+      return { stdout, stderr, exitCode, hadErrors };
+    } finally {
+      await this.deleteShell(shellId);
+    }
+  }
+  /**
+   * Drain Receive until RUNSPACEPOOL_STATE reports Opened (state=2).
+   * Must run after Create and before Command.
+   */
+  async waitForRunspaceOpened(shellId, deadline, signal) {
+    for (; ; ) {
+      if (signal?.aborted) throw new Error("AbortError");
+      if (Date.now() > deadline) throw new Error("PSRP runspace did not open in time");
+      const receiveBody = `<rsp:Receive><rsp:DesiredStream>stdout</rsp:DesiredStream></rsp:Receive>`;
+      const receiveHeaders = `<wsman:OptionSet s:mustUnderstand="true"><wsman:Option Name="WSMAN_CMDSHELL_OPTION_KEEPALIVE">True</wsman:Option></wsman:OptionSet>` + this.shellHeaders(shellId);
+      const received = await this.post(
+        "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/Receive",
+        receiveBody,
+        receiveHeaders
+      );
+      this.assertOk(received, "Receive(init)");
+      const streamRe = /<\w*:?Stream\b[^>]*>([\s\S]*?)<\/\w*:?Stream>/gi;
+      let m2;
+      while ((m2 = streamRe.exec(received.body)) !== null) {
+        const b64 = m2[1].replace(/\s+/g, "");
+        if (!b64) continue;
+        for (const raw of unfragmentMessages(import_node_buffer2.Buffer.from(b64, "base64"))) {
+          if (raw.length < 40) continue;
+          const messageType = raw.readUInt32LE(4);
+          if (messageType === MSG.RUNSPACEPOOL_STATE) {
+            const payload = raw.subarray(40).toString("utf8").replace(/^\uFEFF/, "");
+            const stateMatch = payload.match(/<I32 N="RunspaceState">(\d+)<\/I32>/i) || payload.match(/<I32 N="State">(\d+)<\/I32>/i);
+            if (stateMatch && parseInt(stateMatch[1], 10) === 2) return;
+          }
+          if (messageType === MSG.APPLICATION_PRIVATE_DATA) {
+            continue;
+          }
+        }
+      }
+      if (/CommandState\/Done/i.test(received.body)) return;
+    }
+  }
+  /** Lightweight connectivity probe: create then immediately delete a PSRP shell. */
+  async ping() {
+    const rpid = (0, import_node_crypto2.randomUUID)().toUpperCase();
+    const creationFragment = fragmentMessages([
+      psrpMessage(MSG.SESSION_CAPABILITY, rpid, "00000000-0000-0000-0000-000000000000", sessionCapabilityXml()),
+      psrpMessage(MSG.INIT_RUNSPACEPOOL, rpid, "00000000-0000-0000-0000-000000000000", initRunspacePoolXml())
+    ], 1).blob;
+    const createBody = `<rsp:Shell ShellId="${rpid}"><rsp:InputStreams>stdin pr</rsp:InputStreams><rsp:OutputStreams>stdout</rsp:OutputStreams><creationXml xmlns="http://schemas.microsoft.com/powershell">` + creationFragment.toString("base64") + `</creationXml></rsp:Shell>`;
+    const res = await this.post(
+      "http://schemas.xmlsoap.org/ws/2004/09/transfer/Create",
+      createBody,
+      `<wsman:OptionSet s:mustUnderstand="true"><wsman:Option MustComply="true" Name="protocolversion">2.3</wsman:Option></wsman:OptionSet>`
+    );
+    this.assertOk(res, "Create");
+    const shellId = extractShellId2(res.body);
+    if (shellId) await this.deleteShell(shellId);
+  }
+  async deleteShell(shellId) {
+    try {
+      await this.post(
+        "http://schemas.xmlsoap.org/ws/2004/09/transfer/Delete",
+        "",
+        this.shellHeaders(shellId)
+      );
+    } catch {
+    }
+  }
+  shellHeaders(shellId) {
+    return `<wsman:SelectorSet><wsman:Selector Name="ShellId">${shellId}</wsman:Selector></wsman:SelectorSet>`;
+  }
+  assertOk(res, op) {
+    if (res.status === 200 || res.status === 201) return;
+    const reason = firstText2(res.body, "Text") || firstText2(res.body, "Reason");
+    const fault = firstText2(res.body, "Subcode") || firstText2(res.body, "Value");
+    const detail = reason || fault ? `${fault ? `(${fault}) ` : ""}${reason}`.trim() : res.body.slice(0, 200);
+    throw new Error(`PSRP ${op} failed: HTTP ${res.status} \u2014 ${detail}`);
+  }
+};
+
 // ../../packages/backend/src/services/WinRMBackend.ts
 var DEFAULT_WINRM_TIMEOUT_MS = 12e4;
 var WinRMBackend = class {
@@ -295394,16 +295751,25 @@ var WinRMBackend = class {
       throw new Error("WinRMBackend only supports winrm connections");
     }
     const cfg = config2;
-    const ptyId = `winrm-${(0, import_node_crypto2.randomUUID)()}`;
+    const ptyId = `winrm-${(0, import_node_crypto3.randomUUID)()}`;
     const transport = this.buildTransport(cfg);
-    const instance = { config: cfg, transport, ready: false, failed: false, commandQueue: Promise.resolve() };
+    const instance = {
+      config: cfg,
+      transport,
+      winrm: transport instanceof WinRMTransport ? transport : void 0,
+      psrp: transport instanceof PSRPTransport ? transport : void 0,
+      ready: false,
+      failed: false,
+      commandQueue: Promise.resolve()
+    };
     this.instances.set(ptyId, instance);
     void this.probe(instance).then((ok) => {
       if (ok) {
         instance.ready = true;
+        const mode = cfg.transport === "psrp" ? "PSRP / PowerShell Remoting \u2014 no command-length limit" : "WinRM command/response \u2014 Windows Server";
         instance.dataCallback?.(
-          `\x1B[32m\u2714 WinRM session ready to ${cfg.host}:${cfg.port} (command/response mode \u2014 Windows Server).\x1B[0m\r
-Run commands with exec_command / run_fleet_command. Interactive TUI apps are not supported over WinRM.\r
+          `\x1B[32m\u2714 ${cfg.transport === "psrp" ? "PSRP" : "WinRM"} session ready to ${cfg.host}:${cfg.port} (${mode}).\x1B[0m\r
+Run commands with exec_command / run_fleet_command. Interactive TUI apps are not supported over WinRM/PSRP.\r
 `
         );
       } else {
@@ -295415,7 +295781,7 @@ Run commands with exec_command / run_fleet_command. Interactive TUI apps are not
   }
   async probe(instance) {
     try {
-      await instance.transport.ping();
+      await (instance.winrm ?? instance.transport).ping();
       return true;
     } catch (error40) {
       const message = error40 instanceof Error ? error40.message : String(error40);
@@ -295427,8 +295793,19 @@ Run commands with exec_command / run_fleet_command. Interactive TUI apps are not
     }
   }
   buildTransport(cfg) {
-    const transport = cfg.transport ?? (cfg.port === 5986 ? "https" : "http");
     const username = cfg.domain ? `${cfg.domain}\\${cfg.username}` : cfg.username;
+    if (cfg.transport === "psrp") {
+      return new PSRPTransport({
+        host: cfg.host,
+        port: cfg.port,
+        username,
+        password: cfg.password,
+        transport: cfg.port === 5986 ? "https" : "http",
+        rejectUnauthorized: cfg.rejectUnauthorized,
+        timeoutMs: 3e4
+      });
+    }
+    const transport = cfg.transport ?? (cfg.port === 5986 ? "https" : "http");
     return new WinRMTransport({
       host: cfg.host,
       port: cfg.port,
@@ -295455,19 +295832,70 @@ Run commands with exec_command / run_fleet_command. Interactive TUI apps are not
       throw new Error("WinRM session is still initializing; try again shortly.");
     }
     const run = instance.commandQueue.then(
-      () => this.executeOnPersistentShell(instance, command, options)
+      () => this.executeOnTransport(instance, command, options)
     );
     instance.commandQueue = run.catch(() => {
     });
     return run;
   }
+  /**
+   * Dispatch to the right execution path for the configured transport.
+   * - WinRM (cmd shell): persistent shell + cwd tracking + cmd echo.
+   * - PSRP (PowerShell runspace): each command runs as a fresh one-shot
+   *   script in a real PowerShell runspace (cwd is seeded per command; the
+   *   script travels in the message body — no 8191-char budget). PSRP runspaces
+   *   are heavier to keep open, so v1 runs one-shot per command.
+   */
+  async executeOnTransport(instance, command, options) {
+    if (instance.psrp) {
+      return this.executeOnPsrp(instance, command, options);
+    }
+    return this.executeOnPersistentShell(instance, command, options);
+  }
+  /** PSRP execution path: wrap the (possibly cmd-flavored) command for
+   * PowerShell, run one-shot, surface hadErrors as stderr. */
+  async executeOnPsrp(instance, command, options) {
+    const transport = instance.psrp;
+    if (!transport) {
+      throw new Error("PSRP execution path invoked without a PSRP transport");
+    }
+    instance.dataCallback?.(`\r
+\x1B[36m\u276F ${command}\x1B[0m\r
+`);
+    const ps = this.translateCmdToPowerShell(command, instance.cwd);
+    const result = await transport.runScript(ps, {
+      timeoutMs: options?.timeoutMs ?? DEFAULT_WINRM_TIMEOUT_MS,
+      signal: options?.signal
+    });
+    if (result.stdout) instance.dataCallback?.(result.stdout);
+    if (result.stderr) instance.dataCallback?.(`\x1B[33m${result.stderr}\x1B[0m`);
+    if (/^\s*(Set-Location|cd)\s+/i.test(command) && !result.hadErrors) {
+      const target = command.replace(/^\s*(Set-Location|cd)\s+/i, "").replace(/"/g, "").trim();
+      instance.cwd = this.resolveWinCwd(instance.cwd, target);
+    }
+    const exitCode = result.exitCode !== 0 ? result.exitCode : result.hadErrors ? 1 : 0;
+    return { stdout: result.stdout, stderr: result.stderr, exitCode };
+  }
+  /** Translate the common cmd.exe builtins the agent emits into PowerShell
+   * equivalents (PSRP runs a real PowerShell runspace, not cmd). */
+  translateCmdToPowerShell(command, cwd) {
+    const cdPrefix = cwd ? `Set-Location -LiteralPath '${cwd.replace(/'/g, "''")}'; ` : "";
+    let ps = command;
+    ps = ps.replace(/^\s*cd\s+\/d\s+/i, "Set-Location -LiteralPath ");
+    ps = ps.replace(/^\s*cd\s+/i, "Set-Location -LiteralPath ");
+    ps = ps.replace(/^\s*dir\s*$/i, "Get-ChildItem");
+    ps = ps.replace(/^\s*type\s+/i, "Get-Content ");
+    ps = ps.replace(/^\s*cls\s*$/i, "Clear-Host");
+    ps = ps.replace(/^\s*echo\s+/i, "Write-Output ");
+    return cdPrefix + ps;
+  }
   /** Lazily create (or recreate) the persistent runspace. */
   async ensurePersistentShell(instance) {
     if (instance.persistentShellId) return instance.persistentShellId;
-    const shellId = await instance.transport.createShell();
+    const shellId = await instance.winrm.createShell();
     instance.persistentShellId = shellId;
     try {
-      const r = await instance.transport.runCommandOnShell(shellId, "cd", { timeoutMs: 1e4 });
+      const r = await instance.winrm.runCommandOnShell(shellId, "cd", { timeoutMs: 1e4 });
       const cwd = r.stdout.trim();
       if (cwd) instance.cwd = cwd;
     } catch {
@@ -295483,7 +295911,7 @@ Run commands with exec_command / run_fleet_command. Interactive TUI apps are not
     const isCd = /^\s*(cd|chdir)\s+/i.test(command);
     try {
       const shellId = await this.ensurePersistentShell(instance);
-      result = await instance.transport.runCommandOnShell(shellId, cwdPrefix + command, {
+      result = await instance.winrm.runCommandOnShell(shellId, cwdPrefix + command, {
         timeoutMs: options?.timeoutMs ?? DEFAULT_WINRM_TIMEOUT_MS,
         signal: options?.signal,
         onChunk: (stream, text) => {
@@ -295494,14 +295922,14 @@ Run commands with exec_command / run_fleet_command. Interactive TUI apps are not
         const target = command.replace(/^\s*(cd|chdir)\s+\/?d?\s*/i, "").replace(/"/g, "").trim();
         instance.cwd = this.resolveWinCwd(instance.cwd, target);
       } else if (result.exitCode === 0) {
-        const probe = await instance.transport.runCommandOnShell(shellId, `${cwdPrefix}cd`, { timeoutMs: 1e4 }).catch(() => null);
+        const probe = await instance.winrm.runCommandOnShell(shellId, `${cwdPrefix}cd`, { timeoutMs: 1e4 }).catch(() => null);
         const probeCwd = probe?.stdout.trim().split(/\r?\n/).map((l) => l.trim()).filter((l) => /^[A-Za-z]:\\/.test(l)).pop();
         if (probeCwd) instance.cwd = probeCwd;
       }
     } catch (error40) {
       instance.persistentShellId = void 0;
       const shellId = await this.ensurePersistentShell(instance);
-      result = await instance.transport.runCommandOnShell(shellId, cwdPrefix + command, {
+      result = await instance.winrm.runCommandOnShell(shellId, cwdPrefix + command, {
         timeoutMs: options?.timeoutMs ?? DEFAULT_WINRM_TIMEOUT_MS,
         signal: options?.signal,
         onChunk: (stream, text) => {
@@ -295553,7 +295981,7 @@ Run commands with exec_command / run_fleet_command. Interactive TUI apps are not
     if (!instance) return;
     this.instances.delete(ptyId);
     if (instance.persistentShellId) {
-      void instance.transport.deleteShell(instance.persistentShellId);
+      void instance.winrm.deleteShell(instance.persistentShellId);
       instance.persistentShellId = void 0;
     }
     instance.exitCallback?.(0);
@@ -295579,7 +296007,7 @@ Run commands with exec_command / run_fleet_command. Interactive TUI apps are not
     const instance = this.instances.get(ptyId);
     if (!instance || !instance.ready && !instance.failed) return void 0;
     try {
-      const r = await instance.transport.runCommand(
+      const r = instance.psrp ? await instance.psrp.runScript("$env:COMPUTERNAME", { timeoutMs: 15e3 }) : await instance.winrm.runCommand(
         'powershell -NoProfile -Command "$env:COMPUTERNAME"',
         { timeoutMs: 15e3 }
       );
@@ -295605,7 +296033,7 @@ Run commands with exec_command / run_fleet_command. Interactive TUI apps are not
 };
 
 // ../../packages/backend/src/services/SerialBackend.ts
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 var injectedSerial = null;
 var lazySerial;
 function constructPort(Ctor, path32, opts) {
@@ -295647,7 +296075,7 @@ var SerialBackend = class {
         "Serial port support requires the `serialport` npm package, which is not installed. Install it in RTerm to use serial console connections."
       );
     }
-    const ptyId = `serial-${(0, import_node_crypto3.randomUUID)()}`;
+    const ptyId = `serial-${(0, import_node_crypto4.randomUUID)()}`;
     const port = constructPort(createPort, cfg.path, {
       baudRate: cfg.baudRate,
       dataBits: cfg.dataBits ?? 8,
@@ -302634,12 +303062,12 @@ function unsafeStringify2(arr3, offset = 0) {
 }
 
 // ../../node_modules/@langchain/core/node_modules/uuid/dist/esm-node/rng.js
-var import_node_crypto4 = __toESM(require("node:crypto"));
+var import_node_crypto5 = __toESM(require("node:crypto"));
 var rnds8Pool2 = new Uint8Array(256);
 var poolPtr2 = rnds8Pool2.length;
 function rng2() {
   if (poolPtr2 > rnds8Pool2.length - 16) {
-    import_node_crypto4.default.randomFillSync(rnds8Pool2);
+    import_node_crypto5.default.randomFillSync(rnds8Pool2);
     poolPtr2 = 0;
   }
   return rnds8Pool2.slice(poolPtr2, poolPtr2 += 16);
@@ -302693,9 +303121,9 @@ function v35(name, version2, hashfunc) {
 }
 
 // ../../node_modules/@langchain/core/node_modules/uuid/dist/esm-node/native.js
-var import_node_crypto5 = __toESM(require("node:crypto"));
+var import_node_crypto6 = __toESM(require("node:crypto"));
 var native_default2 = {
-  randomUUID: import_node_crypto5.default.randomUUID
+  randomUUID: import_node_crypto6.default.randomUUID
 };
 
 // ../../node_modules/@langchain/core/node_modules/uuid/dist/esm-node/v4.js
@@ -302719,14 +303147,14 @@ function v42(options, buf, offset) {
 var v4_default2 = v42;
 
 // ../../node_modules/@langchain/core/node_modules/uuid/dist/esm-node/sha1.js
-var import_node_crypto6 = __toESM(require("node:crypto"));
+var import_node_crypto7 = __toESM(require("node:crypto"));
 function sha1(bytes) {
   if (Array.isArray(bytes)) {
     bytes = Buffer.from(bytes);
   } else if (typeof bytes === "string") {
     bytes = Buffer.from(bytes, "utf8");
   }
-  return import_node_crypto6.default.createHash("sha1").update(bytes).digest();
+  return import_node_crypto7.default.createHash("sha1").update(bytes).digest();
 }
 var sha1_default = sha1;
 
@@ -302941,12 +303369,12 @@ function unsafeStringify3(arr3, offset = 0) {
 }
 
 // ../../node_modules/langsmith/node_modules/uuid/dist/esm-node/rng.js
-var import_node_crypto7 = __toESM(require("node:crypto"));
+var import_node_crypto8 = __toESM(require("node:crypto"));
 var rnds8Pool3 = new Uint8Array(256);
 var poolPtr3 = rnds8Pool3.length;
 function rng3() {
   if (poolPtr3 > rnds8Pool3.length - 16) {
-    import_node_crypto7.default.randomFillSync(rnds8Pool3);
+    import_node_crypto8.default.randomFillSync(rnds8Pool3);
     poolPtr3 = 0;
   }
   return rnds8Pool3.slice(poolPtr3, poolPtr3 += 16);
@@ -303000,9 +303428,9 @@ function v352(name, version2, hashfunc) {
 }
 
 // ../../node_modules/langsmith/node_modules/uuid/dist/esm-node/native.js
-var import_node_crypto8 = __toESM(require("node:crypto"));
+var import_node_crypto9 = __toESM(require("node:crypto"));
 var native_default3 = {
-  randomUUID: import_node_crypto8.default.randomUUID
+  randomUUID: import_node_crypto9.default.randomUUID
 };
 
 // ../../node_modules/langsmith/node_modules/uuid/dist/esm-node/v4.js
@@ -303026,14 +303454,14 @@ function v43(options, buf, offset) {
 var v4_default3 = v43;
 
 // ../../node_modules/langsmith/node_modules/uuid/dist/esm-node/sha1.js
-var import_node_crypto9 = __toESM(require("node:crypto"));
+var import_node_crypto10 = __toESM(require("node:crypto"));
 function sha12(bytes) {
   if (Array.isArray(bytes)) {
     bytes = Buffer.from(bytes);
   } else if (typeof bytes === "string") {
     bytes = Buffer.from(bytes, "utf8");
   }
-  return import_node_crypto9.default.createHash("sha1").update(bytes).digest();
+  return import_node_crypto10.default.createHash("sha1").update(bytes).digest();
 }
 var sha1_default2 = sha12;
 
@@ -327147,12 +327575,12 @@ function unsafeStringify4(arr3, offset = 0) {
 }
 
 // ../../node_modules/@langchain/langgraph-checkpoint/node_modules/uuid/dist/esm-node/rng.js
-var import_node_crypto10 = __toESM(require("node:crypto"));
+var import_node_crypto11 = __toESM(require("node:crypto"));
 var rnds8Pool4 = new Uint8Array(256);
 var poolPtr4 = rnds8Pool4.length;
 function rng4() {
   if (poolPtr4 > rnds8Pool4.length - 16) {
-    import_node_crypto10.default.randomFillSync(rnds8Pool4);
+    import_node_crypto11.default.randomFillSync(rnds8Pool4);
     poolPtr4 = 0;
   }
   return rnds8Pool4.slice(poolPtr4, poolPtr4 += 16);
@@ -327286,14 +327714,14 @@ function v353(name, version2, hashfunc) {
 }
 
 // ../../node_modules/@langchain/langgraph-checkpoint/node_modules/uuid/dist/esm-node/sha1.js
-var import_node_crypto11 = __toESM(require("node:crypto"));
+var import_node_crypto12 = __toESM(require("node:crypto"));
 function sha13(bytes) {
   if (Array.isArray(bytes)) {
     bytes = Buffer.from(bytes);
   } else if (typeof bytes === "string") {
     bytes = Buffer.from(bytes, "utf8");
   }
-  return import_node_crypto11.default.createHash("sha1").update(bytes).digest();
+  return import_node_crypto12.default.createHash("sha1").update(bytes).digest();
 }
 var sha1_default3 = sha13;
 
@@ -342705,21 +343133,21 @@ function unsafeStringify5(arr3, offset = 0) {
 }
 
 // ../../node_modules/@langchain/langgraph/node_modules/uuid/dist/esm-node/rng.js
-var import_node_crypto12 = __toESM(require("node:crypto"));
+var import_node_crypto13 = __toESM(require("node:crypto"));
 var rnds8Pool5 = new Uint8Array(256);
 var poolPtr5 = rnds8Pool5.length;
 function rng5() {
   if (poolPtr5 > rnds8Pool5.length - 16) {
-    import_node_crypto12.default.randomFillSync(rnds8Pool5);
+    import_node_crypto13.default.randomFillSync(rnds8Pool5);
     poolPtr5 = 0;
   }
   return rnds8Pool5.slice(poolPtr5, poolPtr5 += 16);
 }
 
 // ../../node_modules/@langchain/langgraph/node_modules/uuid/dist/esm-node/native.js
-var import_node_crypto13 = __toESM(require("node:crypto"));
+var import_node_crypto14 = __toESM(require("node:crypto"));
 var native_default4 = {
-  randomUUID: import_node_crypto13.default.randomUUID
+  randomUUID: import_node_crypto14.default.randomUUID
 };
 
 // ../../node_modules/@langchain/langgraph/node_modules/uuid/dist/esm-node/v4.js
@@ -346856,7 +347284,7 @@ function buildUnfinishedFileTransferContinueInstruction(transfers) {
 }
 
 // ../../packages/backend/src/services/AgentHelper/tools/terminal_tools.ts
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 var execCommandSchema = external_exports.object({
   tabIdOrName: external_exports.string().describe("The ID or Name of the terminal tab"),
   command: external_exports.string().describe("The shell command to execute"),
@@ -346908,7 +347336,7 @@ function sshEntryToTerminalConfig(entry, opts) {
   const jumpHost = entry.jumpHost;
   return {
     type: "ssh",
-    id: `ssh-${(0, import_node_crypto14.randomUUID)()}`,
+    id: `ssh-${(0, import_node_crypto15.randomUUID)()}`,
     title: opts.title,
     cols: 80,
     rows: 24,
@@ -346938,7 +347366,7 @@ function resolveSavedWinrmConnection(context2, nameOrId) {
 function winrmEntryToTerminalConfig(entry, opts) {
   return {
     type: "winrm",
-    id: `winrm-${(0, import_node_crypto14.randomUUID)()}`,
+    id: `winrm-${(0, import_node_crypto15.randomUUID)()}`,
     title: opts.title,
     cols: 80,
     rows: 24,
@@ -346963,7 +347391,7 @@ function resolveSavedSerialConnection(context2, nameOrId) {
 function serialEntryToTerminalConfig(entry, opts) {
   return {
     type: "serial",
-    id: `serial-${(0, import_node_crypto14.randomUUID)()}`,
+    id: `serial-${(0, import_node_crypto15.randomUUID)()}`,
     title: opts.title,
     cols: 80,
     rows: 24,
@@ -348488,7 +348916,9 @@ var winrmConnectionFieldsSchema = external_exports.object({
   port: external_exports.number().int().min(1).max(65535).default(5985),
   username: external_exports.string().min(1).describe("Windows admin username."),
   password: external_exports.string().min(1).describe("Windows password (Basic auth)."),
-  transport: external_exports.enum(["http", "https"]).optional().describe("http (5985) or https (5986). Defaults from port."),
+  transport: external_exports.enum(["http", "https", "psrp"]).optional().describe(
+    "http (5985), https (5986), or psrp (PowerShell Remoting over the same port \u2014 scripts travel in the message body, no command-length limit). Defaults from port."
+  ),
   auth: external_exports.enum(["basic", "negotiate"]).optional().describe("Auth scheme. v1 implements basic (lab/non-domain)."),
   domain: external_exports.string().optional().describe("Active Directory domain (sent as DOMAIN\\user)."),
   rejectUnauthorized: external_exports.boolean().optional().describe("For https with self-signed certs, set false to skip cert verification."),
@@ -364918,7 +365348,7 @@ var import_node_fs4 = __toESM(require("node:fs"), 1);
 var import_promises6 = __toESM(require("node:fs/promises"), 1);
 var import_node_os2 = __toESM(require("node:os"), 1);
 var import_node_path6 = __toESM(require("node:path"), 1);
-var import_node_crypto15 = __toESM(require("node:crypto"), 1);
+var import_node_crypto16 = __toESM(require("node:crypto"), 1);
 var DEFAULT_MAX_FILES = 50;
 var PassChatTempExportService = class {
   baseDir;
@@ -365045,7 +365475,7 @@ ${input.markdown}`
     return import_node_path6.default.join(this.baseDir, `pass-chat_${sessionHash}_${hash2}.md`);
   }
   hashText(input) {
-    return import_node_crypto15.default.createHash("sha256").update(input).digest("hex");
+    return import_node_crypto16.default.createHash("sha256").update(input).digest("hex");
   }
   async ensurePrivateBaseDir() {
     await import_promises6.default.mkdir(this.baseDir, { recursive: true, mode: 448 });
@@ -371358,8 +371788,8 @@ function createDefaultWebSocketServerFactory(httpRoutes) {
     }
     const wss = new import_websocket_server.default({ noServer: true });
     const routes = httpRoutes;
-    const http2 = nodeRequire("node:http");
-    const httpServer = http2.createServer(
+    const http3 = nodeRequire("node:http");
+    const httpServer = http3.createServer(
       (req, res) => {
         void (async () => {
           let pathname = "/";
@@ -381104,8 +381534,8 @@ var import_node_path20 = __toESM(require("node:path"), 1);
 var import_promises11 = __toESM(require("node:fs/promises"), 1);
 var import_node_path19 = __toESM(require("node:path"), 1);
 var import_node_util = require("node:util");
-var import_node_crypto16 = require("node:crypto");
-var scrypt = (0, import_node_util.promisify)(import_node_crypto16.scrypt);
+var import_node_crypto17 = require("node:crypto");
+var scrypt = (0, import_node_util.promisify)(import_node_crypto17.scrypt);
 var FILE_SCHEMA_VERSION = 1;
 var HASH_KEY_LENGTH = 32;
 var TOKEN_NAME_MAX_LENGTH = 64;
@@ -381119,10 +381549,10 @@ function makeDefaultPayload() {
   };
 }
 function randomTokenId() {
-  return `atk_${(0, import_node_crypto16.randomBytes)(12).toString("base64url")}`;
+  return `atk_${(0, import_node_crypto17.randomBytes)(12).toString("base64url")}`;
 }
 function randomAccessTokenValue() {
-  return `gys_at_${(0, import_node_crypto16.randomBytes)(24).toString("base64url")}`;
+  return `gys_at_${(0, import_node_crypto17.randomBytes)(24).toString("base64url")}`;
 }
 async function deriveTokenHash(token, tokenSaltBase64) {
   const tokenSalt = Buffer.from(tokenSaltBase64, "base64");
@@ -381184,7 +381614,7 @@ var FileAccessTokenStore = class {
         throw new Error(`Token name already exists: ${normalizedName}`);
       }
       const token = randomAccessTokenValue();
-      const tokenSalt = (0, import_node_crypto16.randomBytes)(16).toString("base64");
+      const tokenSalt = (0, import_node_crypto17.randomBytes)(16).toString("base64");
       const tokenHash = (await deriveTokenHash(token, tokenSalt)).toString("base64");
       const createdAt = Date.now();
       const record2 = {
@@ -381231,7 +381661,7 @@ var FileAccessTokenStore = class {
       try {
         const expected = Buffer.from(record2.tokenHash, "base64");
         const actual = await deriveTokenHash(token, record2.tokenSalt);
-        if (expected.length === actual.length && (0, import_node_crypto16.timingSafeEqual)(expected, actual)) {
+        if (expected.length === actual.length && (0, import_node_crypto17.timingSafeEqual)(expected, actual)) {
           return true;
         }
       } catch {
@@ -381733,7 +382163,7 @@ function buildBuiltInToolStatusSummary(enabledMap) {
 // ../../packages/backend/src/services/ImageAttachmentService.ts
 var import_promises12 = __toESM(require("node:fs/promises"), 1);
 var import_node_path21 = __toESM(require("node:path"), 1);
-var import_node_crypto17 = __toESM(require("node:crypto"), 1);
+var import_node_crypto18 = __toESM(require("node:crypto"), 1);
 var DEFAULT_INDEX = {
   records: {}
 };
@@ -381757,7 +382187,7 @@ var ImageAttachmentService = class {
     const normalizedMimeType = this.resolveMimeType(payload.mimeType, image.mimeType);
     const extension = this.resolveImageExtension(payload.fileName, normalizedMimeType);
     const safeName = this.safeFileName(payload.fileName);
-    const sha2562 = import_node_crypto17.default.createHash("sha256").update(bytes).digest("hex");
+    const sha2562 = import_node_crypto18.default.createHash("sha256").update(bytes).digest("hex");
     const attachmentId = `img_${sha2562.slice(0, 24)}`;
     const filePath = import_node_path21.default.join(this.attachmentsDir, `${attachmentId}${extension}`);
     const existing = this.records[attachmentId];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rterm-backend",
-  "version": "3.7.3",
+  "version": "3.7.4",
   "description": "AI-native terminal & agentic-AI operations platform for Forward Deployed Engineers & SREs: AIOps closed-loop remediation, AI SRE, self-healing infrastructure, runbook automation, ChatOps; executes over SSH/WinRM/serial under policy with tamper-evident audit.",
   "keywords": [
     "forward-deployed-engineer",