@namzu/sandbox 23.0.1 → 25.0.0

package/dist/local-virtual-computer/setup/elevated.js

@@ -0,0 +1,548 @@
+import { randomBytes } from 'node:crypto';
+import { mkdir, readFile } from 'node:fs/promises';
+import { posix, win32 } from 'node:path';
+import { trustedWindowsDirectory } from './windows-folder.js';
+/**
+ * The one elevated process of a setup plan.
+ *
+ * Windows PowerShell (a Microsoft-signed program, so the Windows prompt names
+ * Microsoft rather than an unknown publisher) is started with
+ * `Start-Process -Verb RunAs` and runs a FIXED script handed over with
+ * `-EncodedCommand`. There is no script file anyone could edit between the
+ * prompt and the run. Values reach the script only as single-quoted PowerShell
+ * literals, after being validated here. Inside, only Microsoft tools run:
+ * dism.exe, msiexec.exe and Get-FileHash.
+ *
+ * Exit codes of the elevated script: 0 ok, 3010 restart required,
+ * 20 enabling Windows features failed, 21 installing the WSL package failed,
+ * 22 the package did not match the pinned digest. The launcher (a second,
+ * non-elevated PowerShell) prints `NAMZU_EXIT=<code>` with the child's exit
+ * code, 1223 when the person declined the prompt, or `NAMZU_LAUNCH_FAILED`,
+ * and exits 0 itself: the command runner keeps no output from a process that
+ * exits nonzero, so the code travels on stdout.
+ *
+ * The elevated child cannot be stopped from here. Aborting the signal stops
+ * waiting and stops reading progress; if the person already approved, the
+ * elevated steps run to the end.
+ */
+export const ELEVATED_EXIT = {
+    ok: 0,
+    restartRequired: 3010,
+    enableFeaturesFailed: 20,
+    installWslFailed: 21,
+    packageMismatch: 22,
+    folderFailed: 23,
+    cancelled: 1223,
+};
+const ELEVATED_STEPS = ['enable-windows-features', 'install-wsl'];
+const STANDARD_ADMIN_GROUP_SID = 'S-1-5-32-544';
+const WINDOWS_11_FIRST_BUILD = 22000;
+const POLL_MS = 250;
+/** Windows refuses a command line longer than 32,767 characters. */
+const MAX_COMMAND_LINE = 30000;
+/** Write, append, delete, delete-children, attribute and extended-attribute writes, change permissions, take ownership. */
+const WRITE_RIGHTS_MASK = 0xd0156;
+const PROGRESS_FILE = 'elevated-progress.jsonl';
+/** Quotes, line breaks and control characters, including PowerShell's typographic quotes. */
+const FORBIDDEN_QUOTES = /['"\u2018\u2019\u201A\u201B\u201C\u201D\u201E]/;
+function hasControlCharacter(value) {
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+function usesWindowsPaths(directory) {
+    return /^[A-Za-z]:[\\/]/.test(directory);
+}
+function psLiteral(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+function checkLiteralPath(label, value) {
+    if (FORBIDDEN_QUOTES.test(value) || hasControlCharacter(value)) {
+        throw new Error(`${label} contains a quote, a line break or a control character.`);
+    }
+}
+function inside(api, directory, candidate) {
+    const fold = (value) => (api === win32 ? value.toLowerCase() : value);
+    const relative = api.relative(fold(api.resolve(directory)), fold(api.resolve(candidate)));
+    return relative !== '' && !relative.startsWith('..') && !api.isAbsolute(relative);
+}
+const RUN_ID = /^[0-9a-f]{32}$/;
+const USER_SID_PLACEHOLDER = '@@USER_SID@@';
+/** The encoded elevated script must stay well under what ShellExecute accepts for a RunAs launch. */
+const MAX_INNER_ENCODED = 16000;
+function joinFor(base, ...parts) {
+    return (usesWindowsPaths(base) ? win32 : posix).join(base, ...parts);
+}
+/**
+ * Validate a request and build both scripts. Exported for tests; the public
+ * entry point is {@link runElevatedWslcSteps}. Throws on any request that
+ * could put a foreign value into a script.
+ */
+export function buildElevatedScripts(request, options = {}) {
+    const { steps, wslPackage, host } = request;
+    if (host.platform !== 'win32')
+        throw new Error('Elevated setup runs only on Windows.');
+    if (!Array.isArray(steps) || steps.length === 0) {
+        throw new Error('No elevated step was requested.');
+    }
+    const wanted = new Set(steps);
+    if (wanted.size !== steps.length)
+        throw new Error('An elevated step was listed twice.');
+    for (const step of steps) {
+        if (!ELEVATED_STEPS.includes(step))
+            throw new Error(`"${String(step)}" is not an elevated step.`);
+    }
+    if (host.windowsBuild === undefined ||
+        !Number.isInteger(host.windowsBuild) ||
+        host.windowsBuild < 1) {
+        throw new Error('The Windows build is unknown.');
+    }
+    const isWindows11 = host.windowsBuild >= WINDOWS_11_FIRST_BUILD;
+    const stateDirectory = host.stateDirectory;
+    const api = usesWindowsPaths(stateDirectory) ? win32 : posix;
+    if (!api.isAbsolute(stateDirectory))
+        throw new Error('The setup directory is not an absolute path.');
+    checkLiteralPath('The setup directory', stateDirectory);
+    const runId = options.runId ?? randomBytes(16).toString('hex');
+    if (!RUN_ID.test(runId))
+        throw new Error('The run id is not 32 hex characters.');
+    const windowsDirectory = options.windowsDirectory ?? trustedWindowsDirectory(host.env);
+    const progressFile = joinFor(windowsDirectory, 'Temp', `namzu-wsl-${runId}`, PROGRESS_FILE);
+    let installBlock = '';
+    if (wanted.has('install-wsl')) {
+        if (!wslPackage)
+            throw new Error('Installing WSL needs the downloaded package.');
+        const { path, sha256 } = wslPackage;
+        if (!api.isAbsolute(path))
+            throw new Error('The WSL package path is not absolute.');
+        checkLiteralPath('The WSL package path', path);
+        if (!path.toLowerCase().endsWith('.msi'))
+            throw new Error('The WSL package is not an .msi file.');
+        if (path.split(/[\\/]/).some((segment) => segment === '..' || segment === '.')) {
+            throw new Error('The WSL package path is not normalised.');
+        }
+        if (!inside(api, stateDirectory, path)) {
+            throw new Error('The WSL package is not inside the setup directory.');
+        }
+        if (!/^[0-9a-fA-F]{64}$/.test(sha256))
+            throw new Error('The WSL package digest is not a SHA-256.');
+        installBlock = installBlockFor(path, sha256.toLowerCase());
+    }
+    else if (wslPackage !== undefined) {
+        throw new Error('A WSL package was given but install-wsl was not requested.');
+    }
+    const inner = innerScript({
+        runId,
+        enable: wanted.has('enable-windows-features'),
+        install: wanted.has('install-wsl'),
+        isWindows11,
+        installBlock,
+    });
+    // A real SID is at most 184 characters; budget for the longest.
+    const sample = inner.replace(USER_SID_PLACEHOLDER, 'S-1-5-21'.padEnd(184, '1'));
+    if (encodeCommand(sample).length > MAX_INNER_ENCODED) {
+        throw new Error('The elevated script is too long.');
+    }
+    const launcher = launcherScript(inner);
+    const launcherArgs = [
+        '-NoProfile',
+        '-NonInteractive',
+        '-ExecutionPolicy',
+        'Bypass',
+        '-EncodedCommand',
+        encodeCommand(launcher),
+    ];
+    if (launcherArgs.join(' ').length > MAX_COMMAND_LINE) {
+        throw new Error('The elevated script is too long for one command line.');
+    }
+    return { inner, launcher, launcherArgs, progressFile, isWindows11 };
+}
+export function encodeCommand(script) {
+    return Buffer.from(script, 'utf16le').toString('base64');
+}
+function installBlockFor(msi, sha256) {
+    return [
+        "$cur = 'install-wsl'",
+        "Note $cur 'started'",
+        `$src = ${psLiteral(msi)}`,
+        `$want = ${psLiteral(sha256)}`,
+        // The package is copied into a folder only administrators can enter, then
+        // hashed and installed from there, so nothing can swap it after the check.
+        "$pkg = Join-Path $dir 'pkg'",
+        'if (Test-Path -LiteralPath $pkg) { throw "pkg exists" }',
+        'try {',
+        '  $item = Get-Item -LiteralPath $src -Force',
+        '  if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw "link" }',
+        '  New-Item -ItemType Directory -Path $pkg | Out-Null',
+        '  $pacl = New-Object Security.AccessControl.DirectorySecurity',
+        '  $pacl.SetAccessRuleProtection($true, $false)',
+        '  foreach ($sid in $adminSids) { $pacl.AddAccessRule((Rule $sid "FullControl" "ContainerInherit,ObjectInherit")) }',
+        '  Set-Acl -LiteralPath $pkg -AclObject $pacl',
+        '  Test-Folder $pkg $false',
+        "  $msi = Join-Path $pkg 'wsl.msi'",
+        '  Copy-Item -LiteralPath $src -Destination $msi',
+        '  $got = (Get-FileHash -LiteralPath $msi -Algorithm SHA256).Hash',
+        '  if ($got -ine $want) {',
+        "    Note $cur 'failed' @{ exitCode = 22 }",
+        `    $code = ${ELEVATED_EXIT.packageMismatch}`,
+        '  } else {',
+        "    $msilog = Join-Path $dir 'wsl-install.log'",
+        '    if (Test-Path -LiteralPath $msilog) { throw "log exists" }',
+        "    $args2 = @('/i', ('\"' + $msi + '\"'), '/qn', '/norestart', '/l*v', ('\"' + $msilog + '\"'))",
+        "    $p = Start-Process -FilePath (Join-Path $sys 'msiexec.exe') -ArgumentList $args2 -Wait -PassThru",
+        '    $c = $p.ExitCode',
+        '    if ($c -eq 0) {',
+        "      Note $cur 'finished' @{ result = 'ok' }",
+        '    } elseif ($c -eq 3010 -or $c -eq 1641) {',
+        '      $restart = $true',
+        "      Note $cur 'finished' @{ result = 'restart-required' }",
+        '    } else {',
+        "      Note $cur 'failed' @{ exitCode = $c }",
+        `      $code = ${ELEVATED_EXIT.installWslFailed}`,
+        '    }',
+        '  }',
+        '} finally {',
+        '  Remove-Item -LiteralPath $pkg -Recurse -Force -ErrorAction SilentlyContinue',
+        '}',
+    ].join('\n');
+}
+function innerScript(parts) {
+    const features = parts.isWindows11
+        ? ["'VirtualMachinePlatform'"]
+        : ["'VirtualMachinePlatform'", "'Microsoft-Windows-Subsystem-Linux'"];
+    const lines = [
+        "$ErrorActionPreference = 'Stop'",
+        // Tools and modules come from the operating system, never from the environment.
+        '$sys = [Environment]::SystemDirectory',
+        '$win = [Environment]::GetFolderPath([Environment+SpecialFolder]::Windows)',
+        '$env:PATH = $sys',
+        "$env:PSModulePath = Join-Path $sys 'WindowsPowerShell\\v1.0\\Modules'",
+        `$userSid = '${USER_SID_PLACEHOLDER}'`,
+        "$adminSids = @('S-1-5-32-544', 'S-1-5-18')",
+        'function Rule($sid, $rights, $inherit) {',
+        '  $id = New-Object Security.Principal.SecurityIdentifier $sid',
+        "  New-Object Security.AccessControl.FileSystemAccessRule($id, $rights, $inherit, 'None', 'Allow')",
+        '}',
+        'function Test-Folder($path, $allowUser) {',
+        '  $item = Get-Item -LiteralPath $path -Force',
+        '  if (-not $item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw "link" }',
+        '  $a = Get-Acl -LiteralPath $path',
+        '  $owner = $a.GetOwner([Security.Principal.SecurityIdentifier]).Value',
+        '  if ($adminSids -notcontains $owner) { throw "owner" }',
+        '  if (-not $a.AreAccessRulesProtected) { throw "inherited" }',
+        '  foreach ($r in $a.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {',
+        '    $who = $r.IdentityReference.Value',
+        '    if ($adminSids -contains $who) { continue }',
+        `    if ($allowUser -and $who -eq $userSid -and $r.AccessControlType -eq 'Allow' -and (([int]$r.FileSystemRights -band ${WRITE_RIGHTS_MASK}) -eq 0)) { continue }`,
+        '    throw "access"',
+        '  }',
+        '}',
+        '$code = 0',
+        '$restart = $false',
+        "$cur = ''",
+        '$log = $null',
+        'function Note($step, $phase, $extra) {',
+        '  try {',
+        '    $o = [ordered]@{ step = $step; phase = $phase }',
+        '    if ($extra) { foreach ($k in $extra.Keys) { $o[$k] = $extra[$k] } }',
+        '    $line = (ConvertTo-Json -InputObject $o -Compress) + "`n"',
+        '    [IO.File]::AppendAllText($log, $line, (New-Object Text.UTF8Encoding $false))',
+        '  } catch {}',
+        '}',
+        'try {',
+        // The folder for progress and logs: new, owned by administrators, readable
+        // (not writable) by the person who started setup. Elevated code writes
+        // nowhere a standard user can write.
+        `  $dir = Join-Path $win ('Temp\\namzu-wsl-${parts.runId}')`,
+        // Exclusive creation: New-Item without -Force fails when the name exists,
+        // so a folder someone else prepared is never adopted. The ACL is applied
+        // and then READ BACK: the owner must be an administrator account, the
+        // access list must be protected, and nobody but administrators may hold
+        // more than read.
+        '  New-Item -ItemType Directory -Path $dir | Out-Null',
+        '  $acl = New-Object Security.AccessControl.DirectorySecurity',
+        '  $acl.SetAccessRuleProtection($true, $false)',
+        '  foreach ($sid in $adminSids) { $acl.AddAccessRule((Rule $sid "FullControl" "ContainerInherit,ObjectInherit")) }',
+        '  $acl.AddAccessRule((Rule $userSid "Read" "ContainerInherit,ObjectInherit"))',
+        '  Set-Acl -LiteralPath $dir -AclObject $acl',
+        '  Test-Folder $dir $true',
+        "  $log = Join-Path $dir 'elevated-progress.jsonl'",
+        '  if (Test-Path -LiteralPath $log) { throw "log exists" }',
+    ];
+    if (parts.enable) {
+        lines.push("  $cur = 'enable-windows-features'", "  Note $cur 'started'", '  $dismRestart = $false', `  foreach ($name in @(${features.join(', ')})) {`, '    & (Join-Path $sys \'dism.exe\') /online /enable-feature "/featurename:$name" /all /norestart | Out-Null', '    $c = $LASTEXITCODE', '    if ($c -eq 3010) { $dismRestart = $true }', "    elseif ($c -ne 0) { Note $cur 'failed' @{ exitCode = $c }; $code = " +
+            `${ELEVATED_EXIT.enableFeaturesFailed}; break }`, '  }', '  if ($code -eq 0) {', "    if ($dismRestart) { $restart = $true; Note $cur 'finished' @{ result = 'restart-required' } }", "    else { Note $cur 'finished' @{ result = 'ok' } }", '  }');
+    }
+    if (parts.install) {
+        lines.push(`  if ($code -eq 0) {\n${parts.installBlock
+            .split('\n')
+            .map((line) => `    ${line}`)
+            .join('\n')}\n  }`);
+    }
+    lines.push('} catch {', `  if ($cur -eq 'install-wsl') { $code = ${ELEVATED_EXIT.installWslFailed} } elseif ($cur -eq '') { $code = ${ELEVATED_EXIT.folderFailed} } else { $code = ${ELEVATED_EXIT.enableFeaturesFailed} }`, "  Note $cur 'failed' @{ exitCode = 1 }", '}', `if ($code -eq 0 -and $restart) { $code = ${ELEVATED_EXIT.restartRequired} }`, 'exit $code');
+    return lines.join('\n');
+}
+function launcherScript(inner) {
+    return [
+        "$ErrorActionPreference = 'Stop'",
+        '$sys = [Environment]::SystemDirectory',
+        '$env:PATH = $sys',
+        "$env:PSModulePath = Join-Path $sys 'WindowsPowerShell\\v1.0\\Modules'",
+        'try {',
+        "  $ps = Join-Path $sys 'WindowsPowerShell\\v1.0\\powershell.exe'",
+        '  $sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value',
+        `  $inner = ${psLiteral(inner)}.Replace('${USER_SID_PLACEHOLDER}', $sid)`,
+        '  $enc = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($inner))',
+        '  $psi = New-Object Diagnostics.ProcessStartInfo',
+        '  $psi.FileName = $ps',
+        "  $psi.Arguments = '-NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ' + $enc",
+        // Windows looks for DLLs in the working directory before the system ones;
+        // never let that be a folder the person can write to.
+        '  $psi.WorkingDirectory = $sys',
+        "  $psi.Verb = 'runas'",
+        '  $psi.UseShellExecute = $true',
+        "  $psi.WindowStyle = 'Hidden'",
+        // ShellExecute raises a Win32Exception straight from the declined prompt.
+        '  $p = [Diagnostics.Process]::Start($psi)',
+        '  $p.WaitForExit()',
+        "  Write-Output ('NAMZU_EXIT=' + $p.ExitCode)",
+        '} catch {',
+        '  $e = $_.Exception',
+        '  $declined = $false',
+        '  while ($e -ne $null) {',
+        `    if (($e -is [ComponentModel.Win32Exception] -and $e.NativeErrorCode -eq ${ELEVATED_EXIT.cancelled}) -or $e.Message -match 'cancel+ed by the user') { $declined = $true }`,
+        '    $e = $e.InnerException',
+        '  }',
+        `  if ($declined) { Write-Output 'NAMZU_EXIT=${ELEVATED_EXIT.cancelled}'; exit 0 }`,
+        "  Write-Output 'NAMZU_LAUNCH_FAILED'",
+        '}',
+    ].join('\n');
+}
+/** What `whoami /groups` lists for an account: an administrator, even with a filtered token, has the group. */
+export function isAdministratorAccount(whoamiGroupsOutput) {
+    for (const row of whoamiGroupsOutput.split(/\r?\n/)) {
+        const cells = [...row.matchAll(/"((?:[^"]|"")*)"/g)].map((m) => m[1] ?? '');
+        if (cells[2] === STANDARD_ADMIN_GROUP_SID)
+            return true;
+    }
+    return false;
+}
+function isGroupListing(output) {
+    return output.split(/\r?\n/).some((row) => /^"[^"]*","[^"]*","S-1-[0-9-]+",/.test(row));
+}
+export function parseProgressLine(line) {
+    let value;
+    try {
+        value = JSON.parse(line.replace(/^\uFEFF/, ''));
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const record = value;
+    const step = record.step;
+    const phase = record.phase;
+    if (step !== 'enable-windows-features' && step !== 'install-wsl')
+        return undefined;
+    if (phase !== 'started' && phase !== 'finished' && phase !== 'failed')
+        return undefined;
+    const result = record.result === 'ok' || record.result === 'restart-required' ? record.result : undefined;
+    const exitCode = typeof record.exitCode === 'number' ? record.exitCode : undefined;
+    return { step, phase, result, exitCode };
+}
+/** Map the launcher's answer to an outcome. `standardUser` is only consulted when needed. */
+export function mapElevatedExit(code, steps, failure) {
+    switch (code) {
+        case ELEVATED_EXIT.ok:
+            return { outcome: 'ok' };
+        case ELEVATED_EXIT.restartRequired:
+            return { outcome: 'restart-required' };
+        case ELEVATED_EXIT.cancelled:
+            return 'cancelled';
+        case ELEVATED_EXIT.enableFeaturesFailed:
+            return {
+                outcome: 'failed',
+                step: 'enable-windows-features',
+                code: 'feature-enable-failed',
+                exitCode: failure.exitCode ?? code,
+            };
+        case ELEVATED_EXIT.installWslFailed:
+        case ELEVATED_EXIT.packageMismatch:
+            return {
+                outcome: 'failed',
+                step: 'install-wsl',
+                code: 'wsl-install-failed',
+                exitCode: failure.exitCode ?? code,
+            };
+        default:
+            return {
+                outcome: 'failed',
+                step: failure.step ?? steps[0] ?? 'enable-windows-features',
+                code: 'elevation-failed',
+                exitCode: code,
+            };
+    }
+}
+function progressEvent(line) {
+    if (line.phase === 'started')
+        return { step: line.step, phase: 'started' };
+    if (line.phase === 'finished' && line.result) {
+        return { step: line.step, phase: 'finished', result: line.result };
+    }
+    return undefined;
+}
+function sleepUnlessSettled(ms, settled, signal) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(done, ms);
+        function done() {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', done);
+            resolve();
+        }
+        signal?.addEventListener('abort', done, { once: true });
+        settled.then(done, done);
+    });
+}
+class ProgressTail {
+    file;
+    onProgress;
+    seen = 0;
+    failures = [];
+    constructor(file, onProgress) {
+        this.file = file;
+        this.onProgress = onProgress;
+    }
+    async poll() {
+        let text;
+        try {
+            text = await readFile(this.file, 'utf8');
+        }
+        catch {
+            return;
+        }
+        const lines = text.split('\n');
+        lines.pop(); // the last piece is empty or a line still being written
+        for (; this.seen < lines.length; this.seen++) {
+            const parsed = parseProgressLine(lines[this.seen]?.trim() ?? '');
+            if (!parsed)
+                continue;
+            if (parsed.phase === 'failed')
+                this.failures.push(parsed);
+            const event = progressEvent(parsed);
+            if (event)
+                this.onProgress?.(event);
+        }
+    }
+}
+/**
+ * Names the launcher may inherit. Everything else (runtime hooks such as the
+ * profiler, startup-hook and compatibility-layer variables, PATHEXT, module
+ * paths, anything a caller or a registry value added) is dropped, because the
+ * elevated copy of Windows PowerShell inherits what the launcher has.
+ * Values set for the person in the registry (`HKCU\Environment`) reach every
+ * process they start and cannot be defended against from here.
+ */
+const LAUNCHER_ENV_ALLOW = /^(ComSpec|USERNAME|USERDOMAIN|USERPROFILE|APPDATA|LOCALAPPDATA|ProgramData|ProgramFiles(\(x86\)|W6432)?|CommonProgramFiles(\(x86\)|W6432)?|PROCESSOR_[A-Z]+|NUMBER_OF_PROCESSORS|OS)$/i;
+function underProfile(profile, value) {
+    if (!profile || !/^[A-Za-z]:\\/.test(profile))
+        return false;
+    const fold = (text) => text.replace(/[\\/]+$/, '').toLowerCase();
+    return fold(value).startsWith(`${fold(profile)}\\`);
+}
+function launcherEnvironment(host, windowsDirectory) {
+    const env = {};
+    let profile;
+    for (const [name, value] of Object.entries(host.env)) {
+        if (/^USERPROFILE$/i.test(name))
+            profile = value;
+    }
+    for (const [name, value] of Object.entries(host.env)) {
+        if (value === undefined)
+            continue;
+        if (LAUNCHER_ENV_ALLOW.test(name))
+            env[name] = value;
+        else if (/^(TEMP|TMP)$/i.test(name) && underProfile(profile, value))
+            env[name] = value;
+    }
+    return {
+        ...env,
+        SystemRoot: windowsDirectory,
+        windir: windowsDirectory,
+        PATH: `${windowsDirectory}\\System32`,
+    };
+}
+export const runElevatedWslcSteps = (request) => runElevatedWith(request, {});
+/** {@link runElevatedWslcSteps} with the run id and Windows folder a test pins. */
+export async function runElevatedWith(request, options) {
+    const { host, signal, onProgress } = request;
+    const scripts = buildElevatedScripts(request, options);
+    const steps = request.steps;
+    signal?.throwIfAborted();
+    await mkdir(host.stateDirectory, { recursive: true });
+    const windowsDirectory = options.windowsDirectory ?? trustedWindowsDirectory(host.env);
+    const powershell = `${windowsDirectory}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
+    const tail = new ProgressTail(scripts.progressFile, onProgress);
+    let finished = false;
+    const launched = host.runner
+        .run(powershell, scripts.launcherArgs, {
+        signal,
+        env: launcherEnvironment(host, windowsDirectory),
+        cwd: `${windowsDirectory}\\System32`,
+    })
+        .then((output) => ({ ok: true, output }), () => ({ ok: false }))
+        .finally(() => {
+        finished = true;
+    });
+    while (!finished) {
+        await sleepUnlessSettled(POLL_MS, launched, signal);
+        if (signal?.aborted)
+            throw signal.reason;
+        await tail.poll();
+    }
+    const settled = await launched;
+    if (signal?.aborted)
+        throw signal.reason;
+    await tail.poll();
+    const lastFailure = tail.failures[tail.failures.length - 1] ?? {};
+    const fallbackStep = steps[0] ?? 'enable-windows-features';
+    const failed = (exitCode) => ({
+        outcome: 'failed',
+        step: fallbackStep,
+        code: 'elevation-failed',
+        exitCode,
+    });
+    let mapped;
+    const match = settled.ok ? /NAMZU_EXIT=(-?\d+)/.exec(settled.output) : null;
+    if (match?.[1] !== undefined) {
+        mapped = mapElevatedExit(Number(match[1]), steps, lastFailure);
+    }
+    else {
+        mapped = 'launch-failed';
+    }
+    if (mapped === 'cancelled' || mapped === 'launch-failed') {
+        // A standard user who cannot supply an administrator's approval reads
+        // differently from an administrator who said no.
+        const standard = await isStandardUser(host, windowsDirectory, signal);
+        if (standard)
+            return { outcome: 'needs-administrator' };
+        return mapped === 'cancelled' ? { outcome: 'cancelled' } : failed();
+    }
+    return mapped;
+}
+async function isStandardUser(host, root, signal) {
+    try {
+        const output = await host.runner.run(`${root}\\System32\\whoami.exe`, ['/groups', '/fo', 'csv', '/nh'], { signal, env: launcherEnvironment(host, root), cwd: `${root}\\System32` });
+        // Only a listing that parses and lacks the group shows a standard user;
+        // empty or garbled output shows nothing.
+        return isGroupListing(output) && !isAdministratorAccount(output);
+    }
+    catch {
+        // Not knowing is not a reason to tell an administrator they are not one.
+        return false;
+    }
+}
+//# sourceMappingURL=elevated.js.map

package/dist/local-virtual-computer/setup/elevated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elevated.js","sourceRoot":"","sources":["../../../src/local-virtual-computer/setup/elevated.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAOxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAE7D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC5B,EAAE,EAAE,CAAC;IACL,eAAe,EAAE,IAAI;IACrB,oBAAoB,EAAE,EAAE;IACxB,gBAAgB,EAAE,EAAE;IACpB,eAAe,EAAE,EAAE;IACnB,YAAY,EAAE,EAAE;IAChB,SAAS,EAAE,IAAI;CACN,CAAA;AAIV,MAAM,cAAc,GAA4B,CAAC,yBAAyB,EAAE,aAAa,CAAC,CAAA;AAC1F,MAAM,wBAAwB,GAAG,cAAc,CAAA;AAC/C,MAAM,sBAAsB,GAAG,KAAK,CAAA;AACpC,MAAM,OAAO,GAAG,GAAG,CAAA;AACnB,oEAAoE;AACpE,MAAM,gBAAgB,GAAG,KAAK,CAAA;AAC9B,2HAA2H;AAC3H,MAAM,iBAAiB,GAAG,OAAO,CAAA;AACjC,MAAM,aAAa,GAAG,yBAAyB,CAAA;AAK/C,6FAA6F;AAC7F,MAAM,gBAAgB,GAAG,gDAAgD,CAAA;AAEzE,SAAS,mBAAmB,CAAC,KAAa;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAChC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;IAC9C,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IAC1C,OAAO,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;AACxC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yDAAyD,CAAC,CAAA;IACnF,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,GAAY,EAAE,SAAiB,EAAE,SAAiB;IACjE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IACzF,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;AAClF,CAAC;AAqBD,MAAM,MAAM,GAAG,gBAAgB,CAAA;AAC/B,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAC3C,qGAAqG;AACrG,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAE/B,SAAS,OAAO,CAAC,IAAY,EAAE,GAAG,KAAe;IAChD,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAA;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAgB,EAChB,UAAgC,EAAE;IAElC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IAC3C,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;IAC/D,CAAC;IACD,IACC,IAAI,CAAC,YAAY,KAAK,SAAS;QAC/B,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,CAAC,EACpB,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAA;IAE/D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;IAC1C,MAAM,GAAG,GAAY,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;IACrE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IAChE,gBAAgB,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAA;IAEvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IAChF,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtF,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,aAAa,KAAK,EAAE,EAAE,aAAa,CAAC,CAAA;IAE3F,IAAI,YAAY,GAAG,EAAE,CAAA;IACrB,IAAI,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QAChF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAA;QACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QACnF,gBAAgB,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACxD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC3D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACtE,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC5D,YAAY,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC3D,CAAC;SAAM,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC;QACzB,KAAK;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAC7C,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;QAClC,WAAW;QACX,YAAY;KACZ,CAAC,CAAA;IACF,gEAAgE;IAChE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/E,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,YAAY,GAAG;QACpB,YAAY;QACZ,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ;QACR,iBAAiB;QACjB,aAAa,CAAC,QAAQ,CAAC;KACvB,CAAA;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,MAAc;IACnD,OAAO;QACN,sBAAsB;QACtB,qBAAqB;QACrB,UAAU,SAAS,CAAC,GAAG,CAAC,EAAE;QAC1B,WAAW,SAAS,CAAC,MAAM,CAAC,EAAE;QAC9B,0EAA0E;QAC1E,2EAA2E;QAC3E,6BAA6B;QAC7B,yDAAyD;QACzD,OAAO;QACP,6CAA6C;QAC7C,kFAAkF;QAClF,sDAAsD;QACtD,+DAA+D;QAC/D,gDAAgD;QAChD,oHAAoH;QACpH,8CAA8C;QAC9C,2BAA2B;QAC3B,mCAAmC;QACnC,iDAAiD;QACjD,kEAAkE;QAClE,0BAA0B;QAC1B,2CAA2C;QAC3C,eAAe,aAAa,CAAC,eAAe,EAAE;QAC9C,YAAY;QACZ,gDAAgD;QAChD,gEAAgE;QAChE,kGAAkG;QAClG,sGAAsG;QACtG,sBAAsB;QACtB,qBAAqB;QACrB,+CAA+C;QAC/C,8CAA8C;QAC9C,wBAAwB;QACxB,6DAA6D;QAC7D,cAAc;QACd,6CAA6C;QAC7C,iBAAiB,aAAa,CAAC,gBAAgB,EAAE;QACjD,OAAO;QACP,KAAK;QACL,aAAa;QACb,+EAA+E;QAC/E,GAAG;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACb,CAAC;AAED,SAAS,WAAW,CAAC,KAMpB;IACA,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW;QACjC,CAAC,CAAC,CAAC,0BAA0B,CAAC;QAC9B,CAAC,CAAC,CAAC,0BAA0B,EAAE,qCAAqC,CAAC,CAAA;IACtE,MAAM,KAAK,GAAa;QACvB,iCAAiC;QACjC,gFAAgF;QAChF,uCAAuC;QACvC,2EAA2E;QAC3E,kBAAkB;QAClB,uEAAuE;QACvE,eAAe,oBAAoB,GAAG;QACtC,4CAA4C;QAC5C,0CAA0C;QAC1C,+DAA+D;QAC/D,mGAAmG;QACnG,GAAG;QACH,2CAA2C;QAC3C,8CAA8C;QAC9C,iHAAiH;QACjH,mCAAmC;QACnC,uEAAuE;QACvE,yDAAyD;QACzD,8DAA8D;QAC9D,8FAA8F;QAC9F,uCAAuC;QACvC,iDAAiD;QACjD,yHAAyH,iBAAiB,wBAAwB;QAClK,oBAAoB;QACpB,KAAK;QACL,GAAG;QACH,WAAW;QACX,mBAAmB;QACnB,WAAW;QACX,cAAc;QACd,wCAAwC;QACxC,SAAS;QACT,qDAAqD;QACrD,yEAAyE;QACzE,+DAA+D;QAC/D,kFAAkF;QAClF,cAAc;QACd,GAAG;QACH,OAAO;QACP,2EAA2E;QAC3E,uEAAuE;QACvE,qCAAqC;QACrC,6CAA6C,KAAK,CAAC,KAAK,IAAI;QAC5D,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,kBAAkB;QAClB,sDAAsD;QACtD,8DAA8D;QAC9D,+CAA+C;QAC/C,mHAAmH;QACnH,+EAA+E;QAC/E,6CAA6C;QAC7C,0BAA0B;QAC1B,mDAAmD;QACnD,2DAA2D;KAC3D,CAAA;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CACT,oCAAoC,EACpC,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAClD,6GAA6G,EAC7G,wBAAwB,EACxB,+CAA+C,EAC/C,yEAAyE;YACxE,GAAG,aAAa,CAAC,oBAAoB,WAAW,EACjD,KAAK,EACL,sBAAsB,EACtB,mGAAmG,EACnG,sDAAsD,EACtD,KAAK,CACL,CAAA;IACF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CACT,yBAAyB,KAAK,CAAC,YAAY;aACzC,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;aAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CACnB,CAAA;IACF,CAAC;IACD,KAAK,CAAC,IAAI,CACT,WAAW,EACX,2CAA2C,aAAa,CAAC,gBAAgB,qCAAqC,aAAa,CAAC,YAAY,qBAAqB,aAAa,CAAC,oBAAoB,IAAI,EACnM,wCAAwC,EACxC,GAAG,EACH,4CAA4C,aAAa,CAAC,eAAe,IAAI,EAC7E,YAAY,CACZ,CAAA;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACpC,OAAO;QACN,iCAAiC;QACjC,uCAAuC;QACvC,kBAAkB;QAClB,uEAAuE;QACvE,OAAO;QACP,kEAAkE;QAClE,wEAAwE;QACxE,cAAc,SAAS,CAAC,KAAK,CAAC,aAAa,oBAAoB,UAAU;QACzE,+EAA+E;QAC/E,kDAAkD;QAClD,uBAAuB;QACvB,iGAAiG;QACjG,0EAA0E;QAC1E,sDAAsD;QACtD,gCAAgC;QAChC,uBAAuB;QACvB,gCAAgC;QAChC,+BAA+B;QAC/B,0EAA0E;QAC1E,2CAA2C;QAC3C,oBAAoB;QACpB,8CAA8C;QAC9C,WAAW;QACX,qBAAqB;QACrB,sBAAsB;QACtB,0BAA0B;QAC1B,+EAA+E,aAAa,CAAC,SAAS,wEAAwE;QAC9K,4BAA4B;QAC5B,KAAK;QACL,+CAA+C,aAAa,CAAC,SAAS,aAAa;QACnF,sCAAsC;QACtC,GAAG;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACb,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,sBAAsB,CAAC,kBAA0B;IAChE,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3E,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,wBAAwB;YAAE,OAAO,IAAI,CAAA;IACvD,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AACxF,CAAC;AASD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC7C,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAA;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACjE,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;IAC1B,IAAI,IAAI,KAAK,yBAAyB,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,SAAS,CAAA;IAClF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACvF,MAAM,MAAM,GACX,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3F,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IAClF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AACzC,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAC9B,IAAY,EACZ,KAA8B,EAC9B,OAAqE;IAErE,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,aAAa,CAAC,EAAE;YACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACzB,KAAK,aAAa,CAAC,eAAe;YACjC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAA;QACvC,KAAK,aAAa,CAAC,SAAS;YAC3B,OAAO,WAAW,CAAA;QACnB,KAAK,aAAa,CAAC,oBAAoB;YACtC,OAAO;gBACN,OAAO,EAAE,QAAQ;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;aAClC,CAAA;QACF,KAAK,aAAa,CAAC,gBAAgB,CAAC;QACpC,KAAK,aAAa,CAAC,eAAe;YACjC,OAAO;gBACN,OAAO,EAAE,QAAQ;gBACjB,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;aAClC,CAAA;QACF;YACC,OAAO;gBACN,OAAO,EAAE,QAAQ;gBACjB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,yBAAyB;gBAC3D,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,IAAI;aACd,CAAA;IACH,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAkB;IACxC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAC1E,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;IACnE,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,SAAS,kBAAkB,CAC1B,EAAU,EACV,OAAyB,EACzB,MAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAClC,SAAS,IAAI;YACZ,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,OAAO,EAAE,CAAA;QACV,CAAC;QACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,YAAY;IAIC;IACA;IAJV,IAAI,GAAG,CAAC,CAAA;IACP,QAAQ,GAAmB,EAAE,CAAA;IACtC,YACkB,IAAY,EACZ,UAAkD;QADlD,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAwC;IACjE,CAAC;IAEJ,KAAK,CAAC,IAAI;QACT,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACR,OAAM;QACP,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,KAAK,CAAC,GAAG,EAAE,CAAA,CAAC,wDAAwD;QACpE,OAAO,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAChE,IAAI,CAAC,MAAM;gBAAE,SAAQ;YACrB,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACzD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;YACnC,IAAI,KAAK;gBAAE,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;IACF,CAAC;CACD;AAED;;;;;;;GAOG;AACH,MAAM,kBAAkB,GACvB,wLAAwL,CAAA;AAEzL,SAAS,YAAY,CAAC,OAA2B,EAAE,KAAa;IAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACxE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;AACpD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAmB,EAAE,gBAAwB;IACzE,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,IAAI,OAA2B,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,KAAK,CAAA;IACjD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;aAC/C,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IACvF,CAAC;IACD,OAAO;QACN,GAAG,GAAG;QACN,UAAU,EAAE,gBAAgB;QAC5B,MAAM,EAAE,gBAAgB;QACxB,IAAI,EAAE,GAAG,gBAAgB,YAAY;KACrC,CAAA;AACF,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAyB,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AAEnG,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,OAAgB,EAChB,OAA6B;IAE7B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IAC5C,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAA;IACtD,MAAM,EAAE,cAAc,EAAE,CAAA;IAExB,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAErD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtF,MAAM,UAAU,GAAG,GAAG,gBAAgB,qDAAqD,CAAA;IAC3F,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAG/D,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,QAAQ,GAAqB,IAAI,CAAC,MAAM;SAC5C,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QACtC,MAAM;QACN,GAAG,EAAE,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAChD,GAAG,EAAE,GAAG,gBAAgB,YAAY;KACpC,CAAC;SACD,IAAI,CACJ,CAAC,MAAM,EAAW,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAC3C,GAAY,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAC9B;SACA,OAAO,CAAC,GAAG,EAAE;QACb,QAAQ,GAAG,IAAI,CAAA;IAChB,CAAC,CAAC,CAAA;IAEH,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QACnD,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAA;QACxC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAA;IAC9B,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,MAAM,CAAC,MAAM,CAAA;IACxC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;IAEjB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACjE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAA;IAC1D,MAAM,MAAM,GAAG,CAAC,QAAiB,EAAuB,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,kBAAkB;QACxB,QAAQ;KACR,CAAC,CAAA;IAEF,IAAI,MAA2D,CAAA;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;IAC/D,CAAC;SAAM,CAAC;QACP,MAAM,GAAG,eAAe,CAAA;IACzB,CAAC;IAED,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC1D,sEAAsE;QACtE,iDAAiD;QACjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAA;QACrE,IAAI,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAA;QACvD,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;IACpE,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,IAAmB,EACnB,IAAY,EACZ,MAAoB;IAEpB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CACnC,GAAG,IAAI,wBAAwB,EAC/B,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAChC,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,YAAY,EAAE,CAC1E,CAAA;QACD,wEAAwE;QACxE,yCAAyC;QACzC,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,yEAAyE;QACzE,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC"}

package/dist/local-virtual-computer/setup/host.d.ts

@@ -0,0 +1,12 @@
+import { type CreateWslcSetupHost } from './contract.js';
+/**
+ * The processor type of the PC. On Windows a 32-bit process sees its own
+ * type in `PROCESSOR_ARCHITECTURE`; the PC's is in `PROCESSOR_ARCHITEW6432`.
+ * Neither is `process.arch`, which names the Node build, not the machine.
+ */
+export declare function windowsArchitectureOf(env: NodeJS.ProcessEnv): string;
+/** `REG_DWORD    0x1f` becomes 31; anything else is undefined. */
+export declare function parseRegDword(output: string): number | undefined;
+/** The real Windows host, with `overrides` applied. */
+export declare const createWslcSetupHost: CreateWslcSetupHost;
+//# sourceMappingURL=host.d.ts.map

package/dist/local-virtual-computer/setup/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../../src/local-virtual-computer/setup/host.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,mBAAmB,EAAyB,MAAM,eAAe,CAAA;AAW/E;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAKpE;AAUD,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGhE;AAED,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAE,mBA0DjC,CAAA"}