[ProjectZero02]

Right after installing over Remote Desktop, the PowerDeck window showed only "PowerDeck's window is only for the person signed in at this PC's screen. Over Remote Desktop, open PowerDeck as administrator."

Cause. The window's local server lets in programs in the active console session, or elevated programs. Over Remote Desktop the session isn't the console's, and the window that install.ps1 opens isn't elevated, so even the PC's administrator was refused.

Fix.

• winsvc.LocalCaller now also accepts a process whose token is an administrator's limited UAC token (TokenElevationTypeLimited). UAC doesn't keep an administrator out (they can elevate), so refusing them protected nothing.
• Standard accounts in another session (fast user switching, Remote Desktop) are still refused, and the message now says what to do.
• SECURITY.md and CHANGELOG (2.2.1) are updated.

Test. New Windows-only test TestLocalCallerFindsTheProcess:

• it opens a real loopback connection;
• it checks that owningPID finds this process in the TCP table and that LocalCaller lets an administrator in;
• it checks that a connection nobody owns is refused.

The Windows CI step now runs ./internal/winsvc/ (with -v, so a skip is visible).

---

Wake-on-LAN on Windows

After installing, the check said Wake-on-LAN is off on Ethernet, and Fix failed with the driver reports magic-packet wake as "<Objs Version="1.1.0.1" …" followed by PowerShell progress records ("Preparing modules for first use", Get-NetAdapterPowerManagement…).

Cause.

• Started with -EncodedCommand, Windows PowerShell writes its progress, warning and error streams to stderr as CLIXML.
• powershell() read stdout and stderr together (CombinedOutput) and took the last line, which was the XML.
• So the check reported "off" without knowing the setting, and Fix rejected a value it had probably set.

Fix.

• powershell() turns progress off and stops on any error.
• It returns only stdout, and an error comes back as PowerShell's own message (no XML).
• The check says it couldn't read the setting rather than calling it off.
• powercfg /deviceenablewake is best effort: Windows PowerShell turns a native program's stderr into an error under Stop, so a failure there no longer stops the fix.

Test. New Windows-only tests in internal/setup run real PowerShell, and the Windows CI step now includes the package.

• They check that output stays clean with progress and warnings present, including an argument with a quote.
• They check that throw, Write-Error and a NetAdapter cmdlet error each come back as a readable message.
• The log records PowerShell's raw combined output, to show the runner really produces CLIXML.

🤖 Generated with Claude Code