Externalized API for PowerShell #23299

Closed
opened 2026-01-31 08:38:14 +00:00 by claunia · 1 comment
Owner

Originally created by @prettydiff on GitHub (May 27, 2025).

Description of the new feature

I can see that PowerShell exposes an API in one or more of C, C#, C++ according to this article from almost 7 years ago: https://devblogs.microsoft.com/commandline/windows-command-line-introducing-the-windows-pseudo-console-conpty/

Problem

In my work organization I cannot execute untrusted binaries, so extending PowerShell via one of C, C#, or C++ is not authorized. Therefore I cannot make use of the PowerShell API.

Practical Example 1

For example the current means to access PowerShell via JavaScript is XTERM.js which creates binaries to invoke a PTY, to interfaces between the PowerShell API and the third party interface, Node.js. Since I cannot execute arbitrary binaries this is not a solution where I work.

90% There

Windows already has the proper architecture in place with ConHost and ConPTY described in the article above. The architecture works perfectly.

Making use of ConHost in JavaScript without help

I can accomplish this in Node.js by calling conhost.exe as a child process. According to the article linked above the ConHost architecture makes use of a PTY layer directly. As a result I can stream interactive input to the conhost.exe child process STDIN interface and stream out its output via STDOUT. I get full translation and interaction for complex things like VIM. It just works perfectly out of the box, but only with defaults and the default shell is the old CMD shell. If I can make this work in JavaScript with so little effort I suspect the ConHost architecture works equally well with all external applications that execute in similar ways.

If I could expose the PowerShell API directly to conhost.exe, as well as the choice of shell, via some external interface I am confident I could execute 100% compatibility of PowerShell in JavaScript without any third party code.

Proposed technical implementation details

I request a new feature, externalizing the API. I can see this work two ways:

  1. Command line arguments representing the current API. This would work for new processes at invocation. It would also allow for solving the critically important problem of associating a shell to Window's ConPTY interface without a third party binary to invoke the API.
  2. STDIN - This would work for active processes to invoke tasks such as kill or resize. A starting assumption is that connections to/from the shell are established to things like PTY or terminal interfaces otherwise there would be no means to supply API instructions to the shell via STDIN.

The most important consideration to address with API externalization is that if it can work in a localhost environment with third party applications extending it work remotely, such as via SSH, becomes largely trivial because SSH is just yet another external interface to the shell.

The largest challenge I can envision with this, aside from unconsidered security concerns, is where to put this feature. Ideally it should work against a given shell instance directly, but it must simultaneously be extended to conhost to make use of that architecture.

Current Status

I can call pwsh.exe v7.5.1, instead of conhost.exe, and get a roughly 50% solution. At this time without any third party help PowerShell will stream beautiful ANSI formatted output to a connected application, but only if the interaction is trivial. Example of trivial interaction with beautiful output is the ls command. Attempting to execute VIM or write past the column length of the shell locks the shell. Execution of control characters, such backspace or the arrow keys, performs unexpected behavior. All of these concerns are solved by making use of a PTY whether conhost.exe or XTERM.js.

Originally created by @prettydiff on GitHub (May 27, 2025). ### Description of the new feature I can see that PowerShell exposes an API in one or more of C, C#, C++ according to this article from almost 7 years ago: https://devblogs.microsoft.com/commandline/windows-command-line-introducing-the-windows-pseudo-console-conpty/ ## Problem In my work organization I cannot execute untrusted binaries, so extending PowerShell via one of C, C#, or C++ is not authorized. Therefore I cannot make use of the PowerShell API. ## Practical Example 1 For example the current means to access PowerShell via JavaScript is XTERM.js which creates binaries to invoke a PTY, to interfaces between the PowerShell API and the third party interface, Node.js. Since I cannot execute arbitrary binaries this is not a solution where I work. ## 90% There Windows already has the proper architecture in place with ConHost and ConPTY described in the article above. The architecture works perfectly. ### Making use of ConHost in JavaScript without help I can accomplish this in Node.js by calling conhost.exe as a child process. According to the article linked above the ConHost architecture makes use of a PTY layer directly. As a result I can stream interactive input to the conhost.exe child process STDIN interface and stream out its output via STDOUT. I get full translation and interaction for complex things like VIM. It just works perfectly out of the box, but only with defaults and the default shell is the old CMD shell. If I can make this work in JavaScript with so little effort I suspect the ConHost architecture works equally well with all external applications that execute in similar ways. If I could expose the PowerShell API directly to conhost.exe, as well as the choice of shell, via some external interface I am confident I could execute 100% compatibility of PowerShell in JavaScript without any third party code. ### Proposed technical implementation details I request a new feature, externalizing the API. I can see this work two ways: 1. **Command line arguments** representing the current API. This would work for new processes at invocation. It would also allow for solving the critically important problem of associating a shell to Window's ConPTY interface without a third party binary to invoke the API. 2. **STDIN** - This would work for active processes to invoke tasks such as kill or resize. A starting assumption is that connections to/from the shell are established to things like PTY or terminal interfaces otherwise there would be no means to supply API instructions to the shell via STDIN. The most important consideration to address with API externalization is that if it can work in a localhost environment with third party applications extending it work remotely, such as via SSH, becomes largely trivial because SSH is just yet another external interface to the shell. The largest challenge I can envision with this, aside from unconsidered security concerns, is where to put this feature. Ideally it should work against a given shell instance directly, but it must simultaneously be extended to conhost to make use of that architecture. ## Current Status I can call pwsh.exe v7.5.1, instead of conhost.exe, and get a roughly 50% solution. At this time without any third party help PowerShell will stream beautiful ANSI formatted output to a connected application, but only if the interaction is trivial. Example of trivial interaction with beautiful output is the *ls* command. Attempting to execute VIM or write past the column length of the shell locks the shell. Execution of control characters, such backspace or the arrow keys, performs unexpected behavior. All of these concerns are solved by making use of a PTY whether conhost.exe or XTERM.js.
claunia added the Issue-FeatureNeeds-Tag-FixResolution-Won't-Fix labels 2026-01-31 08:38:14 +00:00
Author
Owner

@DHowett commented on GitHub (May 28, 2025):

Thanks for the request! I know that we provide the console hosting subsystem, but I don't think this is something we're likely to tackle--especially not on our own, without PowerShell's help.

You might find more traction over in the powershell repository!

@DHowett commented on GitHub (May 28, 2025): Thanks for the request! I know that we provide the console hosting subsystem, but I don't think this is something we're likely to tackle--especially not on our own, without PowerShell's help. You might find more traction over in the [powershell repository](https://github.com/powershell/powershell)!
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#23299