@technomoron/agent-run 0.99.39 → 0.99.40

package/CHANGES

@@ -1,6 +1,17 @@
 CHANGES
 =======
 
+Version 0.99.40 (2026-09-24)
+----------------------------
+* Add native Windows agent-brain service and MCP bridging over per-user named
+  pipes, with owner/ACL checks and a hidden sign-in scheduled task installer.
+* Fix recursive Windows command guard resolution after argument scanning and
+  normalize CRLF when checking generated profiles.
+* Preserve the complete generated compression prompt through Windows npm shims
+  and exercise the integration fixtures with native Windows paths.
+* Load Gemini profile settings from its private user home on Windows, retaining
+  shared preferences without requiring administrator-owned system settings.
+
 Version 0.99.39 (2026-09-11)
 ----------------------------
 * Fix the AI tools updater failing under sudo or a root shell with inherited

package/README.md

@@ -334,9 +334,13 @@ Gemini runs from the real project directory with a private
 `GEMINI_CLI_HOME`. Its generated system settings configure `AGENTS.md` as the
 context filename and add the private runtime plus project memory as context
 directories. Generated skills use Gemini's `.agents/skills` alias. Existing
-Gemini user settings, login credentials, commands, and user skills are linked
-into the private home when present; generated system settings remain the
-highest-priority project layer.
+Gemini login credentials, commands, and user skills are linked into the private
+home when present. On Windows, shared user preferences and generated settings
+are merged into the private home's `.gemini/settings.json`; shared settings
+remain untouched. This avoids Gemini's administrator-only system-settings ACL
+requirement. On other platforms, user settings are linked and generated system
+settings remain the highest-priority project layer. Gemini's normal folder-trust
+and sign-in requirements still apply.
 
 Grok runs from the real project directory with `GROK_HOME` set to
 `live/grok/`. Grok natively reads the generated home-level `AGENTS.md`,
@@ -510,7 +514,8 @@ command stages moves but never commits them.
 
 `agent-brain` gives the native agents the same project knowledge, skills, and
 tasks through MCP. It uses the official Node MCP SDK. The persistent
-service runs under `@technomoron/apicore-server` on a private Unix socket.
+service runs under `@technomoron/apicore-server` on a private Unix socket or a
+Windows named pipe restricted to the current user, SYSTEM, and administrators.
 Node 24 or newer is required; SQLite and FTS come from Node, with no database
 package to compile.
 
@@ -978,8 +983,8 @@ not performed; the service can optionally pull at startup as described below.
 
 ### Persistent service under apicore-server
 
-All native agents connect to the same long-lived service for the Unix user.
-Start it on Linux or macOS:
+All native agents connect to the same long-lived service for the current user.
+Start it on Linux, macOS, or Windows:
 
 ```sh
 agent-brain serve
@@ -1005,7 +1010,27 @@ for a particular service. The bridge verifies the socket's ownership and private
 permissions. A missing or unreachable socket is an error; start the service
 before connecting. There is no standalone stdio server or TCP fallback. Apicore
 supports Unix sockets directly, so localhost binding is unnecessary. The brain
-service currently requires Linux or macOS.
+service supports Linux, macOS, and native Windows.
+
+On Windows the default endpoint is `\\.\pipe\agent-brain-<hash>`, derived from
+the user's home and configuration root. No TCP port is opened. Windows
+PowerShell applies a private pipe ACL before requests are accepted; each bridge
+checks the pipe owner and ACL before connecting. `--socket` can select another
+local named pipe. Windows removes the pipe automatically when its server exits.
+
+To start it automatically at Windows sign-in, initialize the desired config root
+and run the packaged installer in PowerShell:
+
+```powershell
+agent-brain init --configdir "$env:USERPROFILE\.agent-run"
+$prefix = npm.cmd prefix -g
+& "$prefix\node_modules\@technomoron\agent-run\scripts\install-windows-brain.ps1" -ConfigRoot "$env:USERPROFILE\.agent-run"
+```
+
+The `Agent Brain` scheduled task runs hidden as the signed-in user, without
+elevation, and retries failures. Its log is `<config-root>/runtime/service.log`.
+After upgrading the package, restart it with `Stop-ScheduledTask` followed by
+`Start-ScheduledTask` for task name `Agent Brain`.
 
 After a crash, remove a stale socket only after checking that its service is
 stopped. Starting a second service on an existing socket fails without replacing

package/dist/agents/gemini.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.geminiAdapter = void 0;
 const os = require("os");
 const path = require("path");
+const fs = require("fs");
 const render_mcp_1 = require("../config/render-mcp");
 const render_settings_1 = require("../config/render-settings");
 const render_skills_1 = require("../config/render-skills");
@@ -63,7 +64,7 @@ exports.geminiAdapter = {
         const sharedGeminiDir = path.join(os.homedir(), '.gemini');
         const privateGeminiDir = path.join(runtime.context.paths.geminiHomeDir, '.gemini');
         for (const name of [
-            'settings.json',
+            ...(process.platform === 'win32' ? [] : ['settings.json']),
             'oauth_creds.json',
             'google_accounts.json',
             'trustedFolders.json',
@@ -76,6 +77,19 @@ exports.geminiAdapter = {
         ]) {
             (0, shared_state_1.linkSharedEntry)(path.join(sharedGeminiDir, name), path.join(privateGeminiDir, name), `Gemini ${name}`);
         }
+        if (process.platform === 'win32') {
+            // Gemini now requires administrator-owned system settings on Windows.
+            // Keep the profile in its private user home, without modifying shared settings.
+            const settings = path.join(privateGeminiDir, 'settings.json');
+            const read = (file) => fs.existsSync(file)
+                ? (0, render_settings_1.parseJsonObject)(fs.readFileSync(file, 'utf8'), 'Gemini user settings') : {};
+            const merged = mergeSettings(mergeSettings(read(path.join(sharedGeminiDir, 'settings.json')), read(settings)), read(runtime.configFiles[0]));
+            fs.mkdirSync(privateGeminiDir, { recursive: true });
+            // Atomic replacement also detaches an older shared-settings symlink.
+            const temporary = `${settings}.${process.pid}.tmp`;
+            fs.writeFileSync(temporary, `${JSON.stringify(merged, null, 2)}\n`, { flag: 'wx' });
+            fs.renameSync(temporary, settings);
+        }
     },
     spawn(runtime, options) {
         (0, shared_1.assertRuntimeFile)('gemini', runtime.instructionFile, runtime.context.profileDir);
@@ -92,7 +106,7 @@ exports.geminiAdapter = {
             env: {
                 ...(0, environment_1.buildAgentEnvironment)(runtime.context),
                 GEMINI_CLI_HOME: runtime.context.paths.geminiHomeDir,
-                GEMINI_CLI_SYSTEM_SETTINGS_PATH: runtime.configFiles[0],
+                ...(process.platform === 'win32' ? {} : { GEMINI_CLI_SYSTEM_SETTINGS_PATH: runtime.configFiles[0] }),
                 GEMINI_CLI_TRUSTED_FOLDERS_PATH: sharedTrustedFolders
             },
             onExit: (0, shared_1.withPostflight)(runtime, options.wrapperArgs)
@@ -105,6 +119,16 @@ exports.geminiAdapter = {
         return wrapperArgs.sandboxMode === 'sandboxed' ? ['--sandbox'] : [];
     }
 };
+function mergeSettings(base, override) {
+    const result = { ...base };
+    for (const [key, value] of Object.entries(override)) {
+        if (['__proto__', 'constructor', 'prototype'].includes(key))
+            continue;
+        result[key] = value && typeof value === 'object' && !Array.isArray(value)
+            ? mergeSettings(asObject(base[key]), value) : value;
+    }
+    return result;
+}
 function asObject(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value)
         ? value

package/dist/brain/config.js

@@ -9,11 +9,17 @@ exports.registeredBrainProfile = registeredBrainProfile;
 exports.registeredBrainProject = registeredBrainProject;
 const fs = require("node:fs");
 const path = require("node:path");
+const os = require("node:os");
+const node_crypto_1 = require("node:crypto");
 const jsonc_parser_1 = require("jsonc-parser");
 const yaml_1 = require("yaml");
 const zod_1 = require("zod");
 const utils_1 = require("../utils");
 function defaultSocketPath(configRoot) {
+    if (process.platform === 'win32') {
+        const identity = `${os.homedir().toLowerCase()}\0${path.resolve(configRoot).toLowerCase()}`;
+        return `\\\\.\\pipe\\agent-brain-${(0, node_crypto_1.createHash)('sha256').update(identity).digest('hex').slice(0, 32)}`;
+    }
     return path.join(configRoot, 'runtime', 'agent-brain.sock');
 }
 exports.brainConfigSchema = zod_1.z.object({

package/dist/brain/server.js

@@ -20,6 +20,7 @@ const skills_1 = require("./skills");
 const todos_1 = require("./todos");
 const connectors_1 = require("./connectors");
 const git_1 = require("./git");
+const windows_pipe_1 = require("./windows-pipe");
 var config_1 = require("./config");
 Object.defineProperty(exports, "defaultSocketPath", { enumerable: true, get: function () { return config_1.defaultSocketPath; } });
 function createBrainServer(store) {
@@ -113,20 +114,26 @@ function createBrainServer(store) {
     return server;
 }
 function requirePrivateSocketDirectory(socketPath) {
-    if (process.platform === 'win32')
-        throw new Error('The agent-brain Unix-socket service requires Linux or macOS.');
     const stat = fs.lstatSync(path.dirname(socketPath));
     if (!stat.isDirectory() || stat.uid !== process.getuid() || (stat.mode & 0o077) !== 0)
         throw new Error('The socket directory must be owned by the current user with mode 0700.');
 }
 async function serveApiCore(configRoot, socketPath) {
-    const directory = path.dirname(socketPath);
-    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-    requirePrivateSocketDirectory(socketPath);
-    if (fs.existsSync(socketPath))
-        throw new Error(`Socket already exists: ${socketPath}. Stop the running service, or remove the socket after confirming it is stale.`);
+    if (process.platform !== 'win32') {
+        const directory = path.dirname(socketPath);
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        requirePrivateSocketDirectory(socketPath);
+        if (fs.existsSync(socketPath))
+            throw new Error(`Socket already exists: ${socketPath}. Stop the running service, or remove the socket after confirming it is stale.`);
+    }
+    else if (!/^\\\\\.\\pipe\\[a-zA-Z0-9._-]+$/.test(socketPath)) {
+        throw new Error('On Windows, --socket must be a local named pipe (\\\\.\\pipe\\name).');
+    }
+    let ready = false;
     const api = new apicore_server_1.ApiServer({ authApi: false, origins: [], devMode: false });
     api.fastify.post('/mcp', async (request, reply) => {
+        if (!ready)
+            return reply.code(503).send();
         if (request.headers.origin)
             return reply.code(403).send({ error: 'Browser requests are not supported' });
         if (request.headers['x-agent-brain-root'] !== encodeURIComponent(path.resolve(configRoot)))
@@ -158,16 +165,36 @@ async function serveApiCore(configRoot, socketPath) {
     });
     api.fastify.route({ method: ['GET', 'DELETE'], url: '/mcp', handler: async (_request, reply) => reply.code(405).send() });
     await api.fastify.listen({ path: socketPath });
-    fs.chmodSync(socketPath, 0o600);
+    try {
+        if (process.platform === 'win32')
+            await (0, windows_pipe_1.checkWindowsPipe)(socketPath, true);
+        else
+            fs.chmodSync(socketPath, 0o600);
+        ready = true;
+    }
+    catch (error) {
+        await api.fastify.close();
+        throw error;
+    }
     return { close: () => api.fastify.close() };
 }
 async function proxyStdio(socketPath, cwd, configRoot) {
-    const socket = fs.lstatSync(socketPath, { throwIfNoEntry: false });
-    if (!socket)
-        throw new Error(`Agent-brain service is not running at ${socketPath}. Start agent-brain serve with the same --configdir and --socket, or enable its systemd user service.`);
-    requirePrivateSocketDirectory(socketPath);
-    if (!socket.isSocket() || socket.uid !== process.getuid() || (socket.mode & 0o077) !== 0)
-        throw new Error('The brain socket must belong to the current user with mode 0600.');
+    if (process.platform === 'win32') {
+        try {
+            await (0, windows_pipe_1.checkWindowsPipe)(socketPath);
+        }
+        catch (error) {
+            throw new Error(`Agent-brain service is not running or its pipe is not private at ${socketPath}. Start agent-brain serve with the same --configdir and --socket. ${String(error)}`);
+        }
+    }
+    else {
+        const socket = fs.lstatSync(socketPath, { throwIfNoEntry: false });
+        if (!socket)
+            throw new Error(`Agent-brain service is not running at ${socketPath}. Start agent-brain serve with the same --configdir and --socket, or enable its systemd user service.`);
+        requirePrivateSocketDirectory(socketPath);
+        if (!socket.isSocket() || socket.uid !== process.getuid() || (socket.mode & 0o077) !== 0)
+            throw new Error('The brain socket must belong to the current user with mode 0600.');
+    }
     const stdio = new stdio_js_1.StdioServerTransport();
     let protocolVersion;
     async function send(message) {

package/dist/brain/windows-pipe.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkWindowsPipe = checkWindowsPipe;
+const path = require("node:path");
+const node_child_process_1 = require("node:child_process");
+const node_util_1 = require("node:util");
+async function checkWindowsPipe(pipePath, secure = false) {
+    if (!/^\\\\\.\\pipe\\[a-zA-Z0-9._-]+$/.test(pipePath))
+        throw new Error('Expected a local Windows named pipe (\\\\.\\pipe\\name).');
+    const powershell = path.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    const helper = path.resolve(__dirname, '../../scripts/brain-pipe-security.ps1');
+    try {
+        await (0, node_util_1.promisify)(node_child_process_1.execFile)(powershell, ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', helper,
+            '-PipePath', pipePath, ...(secure ? ['-Secure'] : [])], { encoding: 'utf8', windowsHide: true, timeout: 15000 });
+    }
+    catch (error) {
+        throw new Error(`Cannot ${secure ? 'secure' : 'verify'} the brain pipe: ${String(error)}`);
+    }
+}

package/dist/commands.js

@@ -85,6 +85,10 @@ async function runCompress(command) {
     finally {
         store.close();
     }
+    // cmd.exe terminates a .cmd launch at a literal newline, even inside quotes.
+    // Keep this generated prose prompt in one argument through Windows npm shims.
+    if (process.platform === 'win32')
+        prompt = prompt.replace(/\r?\n/g, ' ');
     // Use the normal adapters, configuration and permission modes. The prompt is one argv value.
     runTool({ command: agent, args: agent === 'gemini' ? ['-i', prompt] : [prompt], wrapperArgs: {
             none: false, create: false, local: false, show: false, generate: false, sandboxMode: null, codexNetwork: false

package/dist/guards.js

@@ -140,9 +140,10 @@ function windowsShim(name) {
     return [
         '@echo off',
         'setlocal DisableDelayedExpansion',
+        'set "AGENT_RUN_GUARD_SELF=%~f0"',
+        'for %%D in ("%~dp0.") do set "AGENT_RUN_GUARD_DIR=%%~fD"',
         ...guard,
         ':run',
-        'for %%D in ("%~dp0.") do set "AGENT_RUN_GUARD_DIR=%%~fD"',
         'if defined AGENT_RUN_REAL_PATH (',
         '  set "PATH=%AGENT_RUN_REAL_PATH%"',
         ') else (',
@@ -154,7 +155,7 @@ function windowsShim(name) {
         `  echo agent-run: cannot find the real ${name} command outside the guard directory. 1>&2`,
         '  exit /b 127',
         ')',
-        'if /I "%AGENT_RUN_COMMAND%"=="%~f0" (',
+        'if /I "%AGENT_RUN_COMMAND%"=="%AGENT_RUN_GUARD_SELF%" (',
         `  echo agent-run: refused recursive ${name} guard resolution. 1>&2`,
         '  exit /b 127',
         ')',

package/dist/renderer.js

@@ -229,7 +229,7 @@ function checkRenderedFiles(rendered, findings) {
             continue;
         }
         const actual = fs.readFileSync(file.path, 'utf8').replace(/\r\n/g, '\n');
-        if (actual !== file.content) {
+        if (actual !== file.content.replace(/\r\n/g, '\n')) {
             findings.push({ message: `generated file is out of date: ${file.path}`, severity: 'ERROR' });
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@technomoron/agent-run",
-  "version": "0.99.39",
+  "version": "0.99.40",
   "packageManager": "pnpm@10.34.5",
   "bin": {
     "agent-run": "dist/agent-run.js",
@@ -17,6 +17,10 @@
     "scripts/install-systemd-jobs.sh",
     "scripts/update-ai-tools.sh",
     "scripts/ensure-agent-brain.sh",
+    "scripts/brain-pipe-security.ps1",
+    "scripts/install-windows-brain.ps1",
+    "scripts/run-windows-brain.ps1",
+    "scripts/run-hidden.vbs",
     "README.md",
     "LICENSE",
     "CHANGES"

package/scripts/brain-pipe-security.ps1

@@ -0,0 +1,40 @@
+param(
+    [Parameter(Mandatory = $true)][string]$PipePath,
+    [switch]$Secure
+)
+$ErrorActionPreference = 'Stop'
+if ($PipePath -notmatch '^\\\\\.\\pipe\\[a-zA-Z0-9._-]+$') { throw 'Expected a local Windows named pipe.' }
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$trusted = @($identity.Value, 'S-1-5-18', 'S-1-5-32-544')
+$rights = [System.IO.Pipes.PipeAccessRights]::ReadWrite -bor [System.IO.Pipes.PipeAccessRights]::ReadPermissions
+if ($Secure) { $rights = $rights -bor [System.IO.Pipes.PipeAccessRights]::ChangePermissions }
+# Anonymous impersonation prevents a substituted server from impersonating this client.
+$pipe = [System.IO.Pipes.NamedPipeClientStream]::new('.', $PipePath.Substring(9), $rights,
+    [System.IO.Pipes.PipeOptions]::None, [System.Security.Principal.TokenImpersonationLevel]::Anonymous,
+    [System.IO.HandleInheritability]::None)
+try {
+    $pipe.Connect(5000)
+    if ($PSVersionTable.PSEdition -eq 'Desktop') { $acl = $pipe.GetAccessControl() }
+    else { $acl = [System.IO.Pipes.PipesAclExtensions]::GetAccessControl($pipe) }
+    if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $identity.Value) {
+        throw 'The brain pipe must be owned by the current Windows user.'
+    }
+    if ($Secure) {
+        $acl = [System.IO.Pipes.PipeSecurity]::new()
+        $acl.SetAccessRuleProtection($true, $false)
+        foreach ($sid in $trusted) {
+            $acl.AddAccessRule([System.IO.Pipes.PipeAccessRule]::new(
+                [System.Security.Principal.SecurityIdentifier]::new($sid),
+                [System.IO.Pipes.PipeAccessRights]::FullControl,
+                [System.Security.AccessControl.AccessControlType]::Allow))
+        }
+        if ($PSVersionTable.PSEdition -eq 'Desktop') { $pipe.SetAccessControl($acl) }
+        else { [System.IO.Pipes.PipesAclExtensions]::SetAccessControl($pipe, $acl) }
+    } else {
+        foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+            if ($rule.AccessControlType -eq 'Allow' -and $trusted -notcontains $rule.IdentityReference.Value) {
+                throw 'The brain pipe grants access to another Windows account.'
+            }
+        }
+    }
+} finally { $pipe.Dispose() }

package/scripts/install-windows-brain.ps1

@@ -0,0 +1,14 @@
+param([string]$ConfigRoot = (Join-Path $env:USERPROFILE '.agent-run'))
+$ErrorActionPreference = 'Stop'
+$ConfigRoot = [System.IO.Path]::GetFullPath($ConfigRoot)
+$runner = Join-Path $PSScriptRoot 'run-windows-brain.ps1'
+if ($ConfigRoot.Contains('"') -or $runner.Contains('"')) { throw 'Paths cannot contain quotes.' }
+$launcher = Join-Path $PSScriptRoot 'run-hidden.vbs'
+$wscript = Join-Path $env:SystemRoot 'System32\wscript.exe'
+$action = New-ScheduledTaskAction -Execute $wscript -Argument "//B //NoLogo `"$launcher`" `"$runner`" -ConfigRoot `"$ConfigRoot`"" -WorkingDirectory $env:USERPROFILE
+$principal = New-ScheduledTaskPrincipal -UserId ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name) -LogonType Interactive -RunLevel Limited
+$trigger = New-ScheduledTaskTrigger -AtLogOn -User ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name)
+$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -MultipleInstances IgnoreNew
+Register-ScheduledTask -TaskName 'Agent Brain' -Action $action -Principal $principal -Trigger $trigger -Settings $settings -Description 'Private local MCP brain server for agent-run.' -Force | Out-Null
+Start-ScheduledTask -TaskName 'Agent Brain'
+Write-Host "Agent Brain registered for sign-in and started. Log: $ConfigRoot\runtime\service.log"

package/scripts/run-hidden.vbs

@@ -0,0 +1,15 @@
+Option Explicit
+Dim shell, command, argument, i
+Set shell = CreateObject("WScript.Shell")
+If WScript.Arguments.Count < 1 Then WScript.Quit 2
+command = Quote(shell.ExpandEnvironmentStrings("%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe")) & " -NoProfile -NonInteractive -ExecutionPolicy Bypass -File"
+For i = 0 To WScript.Arguments.Count - 1
+    argument = WScript.Arguments(i)
+    If InStr(argument, Chr(34)) > 0 Then WScript.Quit 2
+    command = command & " " & Quote(argument)
+Next
+WScript.Quit shell.Run(command, 0, True)
+
+Function Quote(value)
+    Quote = Chr(34) & value & Chr(34)
+End Function

package/scripts/run-windows-brain.ps1

@@ -0,0 +1,23 @@
+param([Parameter(Mandatory = $true)][string]$ConfigRoot)
+$ErrorActionPreference = 'Stop'
+$env:Path = [Environment]::GetEnvironmentVariable('Path', 'Machine') + ';' + [Environment]::GetEnvironmentVariable('Path', 'User')
+$brain = Join-Path $PSScriptRoot '..\dist\agent-brain.js'
+$runtime = Join-Path $ConfigRoot 'runtime'
+New-Item -ItemType Directory -Path $runtime -Force | Out-Null
+$log = Join-Path $runtime 'service.log'
+$node = (Get-Command node.exe -ErrorAction Stop).Source
+# WScript prevents console flashes. Watch that launcher so stopping the task
+# also stops the server, even when Windows detaches the launcher's descendants.
+$launcherId = (Get-CimInstance Win32_Process -Filter "ProcessId=$PID").ParentProcessId
+$launcher = Get-Process -Id $launcherId -ErrorAction Stop
+$process = Start-Process -FilePath $node -ArgumentList @("`"$brain`"", 'serve', '--configdir', "`"$ConfigRoot`"") -WindowStyle Hidden -PassThru -RedirectStandardError $log -RedirectStandardOutput (Join-Path $runtime 'service-output.log')
+try {
+    while (-not $process.WaitForExit(1000)) {
+        if ($launcher.HasExited) { Stop-Process -Id $process.Id -ErrorAction SilentlyContinue; exit 0 }
+    }
+    exit $process.ExitCode
+} finally {
+    if (-not $process.HasExited) { Stop-Process -Id $process.Id -ErrorAction SilentlyContinue }
+    $process.Dispose()
+    $launcher.Dispose()
+}