- run.bat / open-firewall.bat: UTF-8 (no BOM) + chcp 65001 instead of cp866/chcp 866.
- scripts/set-vnc-password.bat: removed (run.bat syncs the UltraVNC password via ensure-vnc-password.ps1).
- scripts/ensure-vnc-password.ps1: use a real RFB VNC-Auth probe to 127.0.0.1:5900
to decide if the password already matches (no UAC when it does); set via
createpassword/setpasswd + service restart only when it differs. Works for
any password length (no stored-password encoding assumptions).
- AGENTS.md: .bat encoding convention updated to UTF-8/chcp 65001; drop set-vnc-password refs.
- run.bat: call scripts/ensure-vnc-password.ps1 so the password typed once
also sets the UltraVNC service VNC password (UAC only when it differs);
skip --spawn when 5900 is already taken (don't launch a 2nd winvnc).
- scripts/ensure-vnc-password.ps1: new - compares the password against
%ProgramData%\UltraVNC\ultravnc.ini (reverse-engineered UltraVNC DES
obfuscation) and only writes+restarts the service when it differs.
- scripts/set-vnc-password.bat: set UltraVNC service VNC password as admin
(createpassword/setpasswd + verify, GUI fallback). Manual fallback.
- internal/server/static/vnc.html: don't let the generic 'disconnect'
banner overwrite the specific 'securityfailure' reason (noVNC's
disconnect event has no reason field, so it always said 'unknown').
- AGENTS.md: document the above (scripts, run.bat, UltraVNC service note).
Add a maintenance note: AGENTS.md is a living document and must be
updated in the same commit whenever code/flags/structure/scripts change,
and reconciled first whenever it diverges from the code.
Codex