win-nice 0.1.0 → 0.2.0

package/bin/abovenormal.ps1

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MIT OR Apache-2.0
 # win-nice: managed-file
 # No param(): nothing here needs a named parameter, and $args sidesteps
-# PowerShell's parameter binder entirely - see cap.ps1 for why that matters.
+# PowerShell's parameter binder entirely - see capc.ps1 for why that matters.
 $Command = $args
 
 if (-not $Command -or $Command.Count -eq 0) {
@@ -11,7 +11,7 @@ if (-not $Command -or $Command.Count -eq 0) {
 
 # Fallback command line for when the target isn't a directly-launchable .exe (see
 # AboveNormalLauncher.Run below) - re-parsed by cmd.exe (via "cmd.exe /c"), so quoting must
-# neutralize its operators (&|<>^) and not just whitespace - see cap.ps1 for the
+# neutralize its operators (&|<>^) and not just whitespace - see capc.ps1 for the
 # same logic and its documented "%" limitation. abovenormal.bat has its own, more
 # severe "%" caveat (see there) that applies before this script ever runs.
 $commandLine = ($Command | ForEach-Object {
@@ -70,6 +70,9 @@ public static class AboveNormalLauncher
     [DllImport("kernel32.dll", SetLastError = true)]
     static extern bool GetExitCodeProcess(IntPtr hProcess, out uint lpExitCode);
 
+    [DllImport("kernel32.dll", SetLastError = true)]
+    static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode);
+
     [DllImport("kernel32.dll")]
     static extern bool CloseHandle(IntPtr hObject);
 
@@ -124,7 +127,7 @@ public static class AboveNormalLauncher
         si.cb = Marshal.SizeOf(si);
         PROCESS_INFORMATION pi = new PROCESS_INFORMATION();
 
-        // See cap.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
+        // See capc.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
         // CreateProcess silently re-invokes them through cmd.exe on its own, using
         // unescaped text, instead of failing the way a genuinely missing exe would.
         bool isBatOrCmd = argv.Length > 0 && (
@@ -146,6 +149,7 @@ public static class AboveNormalLauncher
             // across the whole command line, even across separate arguments) and
             // change what actually runs. Fail loudly here instead of silently risking
             // that - there's no reliable per-character escape for "%" at this level.
+            // No handle is held at this point, so this throw has nothing to clean up.
             foreach (var a in argv)
             {
                 if (a.IndexOf('%') >= 0)
@@ -169,15 +173,39 @@ public static class AboveNormalLauncher
                 throw new InvalidOperationException("CreateProcess failed: " + Marshal.GetLastWin32Error());
         }
 
-        WaitForSingleObject(pi.hProcess, 0xFFFFFFFF);
-
-        uint exitCode;
-        GetExitCodeProcess(pi.hProcess, out exitCode);
+        // Ownership of the child's handles starts here - CreateProcess has succeeded, so
+        // both are valid, and the finally below closes each of them exactly once on every
+        // way out: normal return, a thrown InvalidOperationException, or an unexpected
+        // managed exception.
+        IntPtr hProcess = pi.hProcess;
+        IntPtr hThread = pi.hThread;
+        try
+        {
+            if (WaitForSingleObject(hProcess, 0xFFFFFFFF) == 0xFFFFFFFF)
+            {
+                // The child's actual state is unknown here - don't just report
+                // failure and potentially leave it running unmanaged in the
+                // background. Best-effort kill before giving up.
+                int waitErr = Marshal.GetLastWin32Error();
+                string message = "WaitForSingleObject failed: " + waitErr;
+                // Report if the best-effort kill itself also failed.
+                if (!TerminateProcess(hProcess, 1))
+                    message += "; TerminateProcess also failed: " + Marshal.GetLastWin32Error();
+                throw new InvalidOperationException(message);
+            }
 
-        CloseHandle(pi.hThread);
-        CloseHandle(pi.hProcess);
+            uint exitCode;
+            if (!GetExitCodeProcess(hProcess, out exitCode))
+                throw new InvalidOperationException("GetExitCodeProcess failed: " + Marshal.GetLastWin32Error());
 
-        return (int)exitCode;
+            return (int)exitCode;
+        }
+        finally
+        {
+            // Same order as the code this replaces: thread handle, then process handle.
+            CloseHandle(hThread);
+            CloseHandle(hProcess);
+        }
     }
 }
 "@

package/bin/admin

@@ -1,11 +1,11 @@
-#!/bin/sh
-# SPDX-License-Identifier: MIT OR Apache-2.0
-# win-nice: managed-file
-# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
-# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
-# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
-# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
-MSYS2_ARG_CONV_EXCL='*'
-export MSYS2_ARG_CONV_EXCL
-script=$(cygpath -w "$(dirname "$0")/admin.ps1" 2>/dev/null) || script="$(dirname "$0")/admin.ps1"
-exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"
+#!/bin/sh
+# SPDX-License-Identifier: MIT OR Apache-2.0
+# win-nice: managed-file
+# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
+# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
+# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
+# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
+MSYS2_ARG_CONV_EXCL='*'
+export MSYS2_ARG_CONV_EXCL
+script=$(cygpath -w "$(dirname "$0")/admin.ps1" 2>/dev/null) || script="$(dirname "$0")/admin.ps1"
+exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"

package/bin/admin.bat

@@ -5,8 +5,8 @@ if "%~1"=="" (
     echo usage: admin ^<command^> [args...] 1>&2
     exit /b 1
 )
-:: A literal "%" in any argument gets corrupted here - see cap.bat for why (a
+:: A literal "%" in any argument gets corrupted here - see capc.bat for why (a
 :: cmd.exe batch-parameter quirk, not fixable from inside a .bat). Every other
 :: cmd.exe metacharacter (&|<>^) survives this hop untouched. Invoking "admin"
 :: bare from an actual PowerShell session skips this file (admin.ps1 preferred).
-powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0admin.ps1" %*
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "%~dp0admin.ps1" %*

package/bin/admin.ps1

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MIT OR Apache-2.0
 # win-nice: managed-file
 $Command = $args
-# Deliberately no [Parameter()]/[CmdletBinding()] attributes: see cap.ps1 for why -
+# Deliberately no [Parameter()]/[CmdletBinding()] attributes: see capc.ps1 for why -
 # it would expose PowerShell's common parameters and make them ambiguously
 # prefix-match flags meant for the wrapped command.
 
@@ -13,7 +13,7 @@ if (-not $Command -or $Command.Count -eq 0) {
 # Fallback command line for the UAC (-Verb RunAs) branch, and for the inline branch
 # when the target isn't a directly-launchable .exe (see AdminLauncher.Run below) -
 # re-parsed by cmd.exe, so quoting must neutralize its operators (&|<>^) and not
-# just whitespace - see cap.ps1 for the same logic and its documented "%" limitation.
+# just whitespace - see capc.ps1 for the same logic and its documented "%" limitation.
 $commandLine = ($Command | ForEach-Object {
     $escaped = $_ -replace '"', '\"'
     if ($escaped -eq '' -or $escaped -match '[\s"&|<>^]') { '"' + $escaped + '"' } else { $escaped }
@@ -22,7 +22,7 @@ $commandLine = ($Command | ForEach-Object {
 $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 
 # AdminLauncher (embedded C#): direct-CreateProcess-first, cmd.exe-fallback launcher,
-# same strategy as cap.ps1's Capper - a direct .exe target never touches cmd.exe, so
+# same strategy as capc.ps1's Capper - a direct .exe target never touches cmd.exe, so
 # it isn't exposed to "%" expansion at all. Defined unconditionally (not only inside
 # the already-elevated branch below) because the not-yet-elevated branch also calls
 # AdminLauncher.BuildArgvCommandLine for its own direct (non-cmd.exe) -Verb RunAs launch.
@@ -77,6 +77,9 @@ public static class AdminLauncher
     [DllImport("kernel32.dll", SetLastError = true)]
     static extern bool GetExitCodeProcess(IntPtr hProcess, out uint lpExitCode);
 
+    [DllImport("kernel32.dll", SetLastError = true)]
+    static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode);
+
     [DllImport("kernel32.dll")]
     static extern bool CloseHandle(IntPtr hObject);
 
@@ -146,6 +149,7 @@ public static class AdminLauncher
             // across the whole command line, even across separate arguments) and
             // change what actually runs. Fail loudly here instead of silently risking
             // that - there's no reliable per-character escape for "%" at this level.
+            // No handle is held at this point, so this throw has nothing to clean up.
             foreach (var a in argv)
             {
                 if (a.IndexOf('%') >= 0)
@@ -174,15 +178,39 @@ public static class AdminLauncher
                 throw new InvalidOperationException("CreateProcess failed: " + Marshal.GetLastWin32Error());
         }
 
-        WaitForSingleObject(pi.hProcess, 0xFFFFFFFF);
-
-        uint exitCode;
-        GetExitCodeProcess(pi.hProcess, out exitCode);
+        // Ownership of the child's handles starts here - CreateProcess has succeeded, so
+        // both are valid, and the finally below closes each of them exactly once on every
+        // way out: normal return, a thrown InvalidOperationException, or an unexpected
+        // managed exception.
+        IntPtr hProcess = pi.hProcess;
+        IntPtr hThread = pi.hThread;
+        try
+        {
+            if (WaitForSingleObject(hProcess, 0xFFFFFFFF) == 0xFFFFFFFF)
+            {
+                // The child's actual state is unknown here - don't just report
+                // failure and potentially leave it running unmanaged in the
+                // background. Best-effort kill before giving up.
+                int waitErr = Marshal.GetLastWin32Error();
+                string message = "WaitForSingleObject failed: " + waitErr;
+                // Report if the best-effort kill itself also failed.
+                if (!TerminateProcess(hProcess, 1))
+                    message += "; TerminateProcess also failed: " + Marshal.GetLastWin32Error();
+                throw new InvalidOperationException(message);
+            }
 
-        CloseHandle(pi.hThread);
-        CloseHandle(pi.hProcess);
+            uint exitCode;
+            if (!GetExitCodeProcess(hProcess, out exitCode))
+                throw new InvalidOperationException("GetExitCodeProcess failed: " + Marshal.GetLastWin32Error());
 
-        return (int)exitCode;
+            return (int)exitCode;
+        }
+        finally
+        {
+            // Same order as the code this replaces: thread handle, then process handle.
+            CloseHandle(hThread);
+            CloseHandle(hProcess);
+        }
     }
 }
 "@
@@ -214,11 +242,21 @@ if ($isAdmin) {
 # aliases/functions (dir, echo, start) are invisible to it, which routes them to the
 # fallback, while real executables resolve. Standalone function so the routing
 # decision is testable without ever reaching -Verb RunAs (a real UAC prompt).
+# The resolver also records the path used by the direct route. Keep the routing
+# function self-contained: the test suite AST-extracts it without the rest of this
+# script, so it must not depend on a second helper function.
+$script:AdminLaunchPath = $null
 function Get-AdminLaunchRoute {
     param([Parameter(Mandatory = $true)][string]$Target)
+    $script:AdminLaunchPath = $null
     if ($Target -match '\.(bat|cmd)$') { return 'CmdFallback' }
     $resolved = Get-Command -Name ([System.Management.Automation.WildcardPattern]::Escape($Target)) -CommandType Application -ErrorAction SilentlyContinue
-    if ($resolved -and $resolved.Path -and $resolved.Path -notmatch '\.(bat|cmd)$') { return 'Direct' }
+    if ($resolved -and $resolved.Path -and $resolved.Path -notmatch '\.(bat|cmd)$') {
+        # ShellExecute must receive the resolved absolute path. Passing a bare name
+        # here lets the elevated process search the current directory first.
+        $script:AdminLaunchPath = [System.IO.Path]::GetFullPath($resolved.Path)
+        return 'Direct'
+    }
     return 'CmdFallback'
 }
 
@@ -237,10 +275,11 @@ try {
     if ($route -eq 'CmdFallback') {
         # Same /d /s /v:off + outer-quote-wrap fix as AdminLauncher.Run's cmd.exe
         # fallback, and for the same reason: cmd.exe's /C quote-stripping.
-        $p = Start-Process -FilePath 'cmd.exe' -ArgumentList @('/d', '/s', '/v:off', '/c', ('"' + $commandLine + '"')) -Verb RunAs -Wait -PassThru
+        $cmdExePath = [Environment]::SystemDirectory + '\cmd.exe'
+        $p = Start-Process -FilePath $cmdExePath -ArgumentList @('/d', '/s', '/v:off', '/c', ('"' + $commandLine + '"')) -Verb RunAs -Wait -PassThru
     } else {
         $startArgs = @{
-            FilePath = $Command[0]
+            FilePath = $script:AdminLaunchPath
             Verb = 'RunAs'
             Wait = $true
             PassThru = $true

package/bin/belownormal

@@ -1,11 +1,11 @@
-#!/bin/sh
-# SPDX-License-Identifier: MIT OR Apache-2.0
-# win-nice: managed-file
-# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
-# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
-# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
-# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
-MSYS2_ARG_CONV_EXCL='*'
-export MSYS2_ARG_CONV_EXCL
-script=$(cygpath -w "$(dirname "$0")/belownormal.ps1" 2>/dev/null) || script="$(dirname "$0")/belownormal.ps1"
-exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"
+#!/bin/sh
+# SPDX-License-Identifier: MIT OR Apache-2.0
+# win-nice: managed-file
+# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
+# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
+# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
+# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
+MSYS2_ARG_CONV_EXCL='*'
+export MSYS2_ARG_CONV_EXCL
+script=$(cygpath -w "$(dirname "$0")/belownormal.ps1" 2>/dev/null) || script="$(dirname "$0")/belownormal.ps1"
+exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"

package/bin/belownormal.bat

@@ -5,9 +5,9 @@ if "%~1"=="" (
     echo usage: belownormal ^<command^> [args...] 1>&2
     exit /b 1
 )
-:: A literal "%" in any argument gets corrupted here - see cap.bat for why (a
+:: A literal "%" in any argument gets corrupted here - see capc.bat for why (a
 :: cmd.exe batch-parameter quirk, not fixable from inside a .bat). Every other
 :: cmd.exe metacharacter (&|<>^) survives this hop untouched. Invoking
 :: "belownormal" bare from an actual PowerShell session skips this file
 :: (belownormal.ps1 preferred).
-powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0belownormal.ps1" %*
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "%~dp0belownormal.ps1" %*

package/bin/belownormal.ps1

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MIT OR Apache-2.0
 # win-nice: managed-file
 # No param(): nothing here needs a named parameter, and $args sidesteps
-# PowerShell's parameter binder entirely - see cap.ps1 for why that matters.
+# PowerShell's parameter binder entirely - see capc.ps1 for why that matters.
 $Command = $args
 
 if (-not $Command -or $Command.Count -eq 0) {
@@ -11,7 +11,7 @@ if (-not $Command -or $Command.Count -eq 0) {
 
 # Fallback command line for when the target isn't a directly-launchable .exe (see
 # BelowNormalLauncher.Run below) - re-parsed by cmd.exe (via "cmd.exe /c"), so quoting must
-# neutralize its operators (&|<>^) and not just whitespace - see cap.ps1 for the
+# neutralize its operators (&|<>^) and not just whitespace - see capc.ps1 for the
 # same logic and its documented "%" limitation. belownormal.bat has its own, more
 # severe "%" caveat (see there) that applies before this script ever runs.
 $commandLine = ($Command | ForEach-Object {
@@ -70,6 +70,9 @@ public static class BelowNormalLauncher
     [DllImport("kernel32.dll", SetLastError = true)]
     static extern bool GetExitCodeProcess(IntPtr hProcess, out uint lpExitCode);
 
+    [DllImport("kernel32.dll", SetLastError = true)]
+    static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode);
+
     [DllImport("kernel32.dll")]
     static extern bool CloseHandle(IntPtr hObject);
 
@@ -123,7 +126,7 @@ public static class BelowNormalLauncher
         si.cb = Marshal.SizeOf(si);
         PROCESS_INFORMATION pi = new PROCESS_INFORMATION();
 
-        // See cap.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
+        // See capc.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
         // CreateProcess silently re-invokes them through cmd.exe on its own, using
         // unescaped text, instead of failing the way a genuinely missing exe would.
         bool isBatOrCmd = argv.Length > 0 && (
@@ -145,6 +148,7 @@ public static class BelowNormalLauncher
             // across the whole command line, even across separate arguments) and
             // change what actually runs. Fail loudly here instead of silently risking
             // that - there's no reliable per-character escape for "%" at this level.
+            // No handle is held at this point, so this throw has nothing to clean up.
             foreach (var a in argv)
             {
                 if (a.IndexOf('%') >= 0)
@@ -168,15 +172,39 @@ public static class BelowNormalLauncher
                 throw new InvalidOperationException("CreateProcess failed: " + Marshal.GetLastWin32Error());
         }
 
-        WaitForSingleObject(pi.hProcess, 0xFFFFFFFF);
-
-        uint exitCode;
-        GetExitCodeProcess(pi.hProcess, out exitCode);
+        // Ownership of the child's handles starts here - CreateProcess has succeeded, so
+        // both are valid, and the finally below closes each of them exactly once on every
+        // way out: normal return, a thrown InvalidOperationException, or an unexpected
+        // managed exception.
+        IntPtr hProcess = pi.hProcess;
+        IntPtr hThread = pi.hThread;
+        try
+        {
+            if (WaitForSingleObject(hProcess, 0xFFFFFFFF) == 0xFFFFFFFF)
+            {
+                // The child's actual state is unknown here - don't just report
+                // failure and potentially leave it running unmanaged in the
+                // background. Best-effort kill before giving up.
+                int waitErr = Marshal.GetLastWin32Error();
+                string message = "WaitForSingleObject failed: " + waitErr;
+                // Report if the best-effort kill itself also failed.
+                if (!TerminateProcess(hProcess, 1))
+                    message += "; TerminateProcess also failed: " + Marshal.GetLastWin32Error();
+                throw new InvalidOperationException(message);
+            }
 
-        CloseHandle(pi.hThread);
-        CloseHandle(pi.hProcess);
+            uint exitCode;
+            if (!GetExitCodeProcess(hProcess, out exitCode))
+                throw new InvalidOperationException("GetExitCodeProcess failed: " + Marshal.GetLastWin32Error());
 
-        return (int)exitCode;
+            return (int)exitCode;
+        }
+        finally
+        {
+            // Same order as the code this replaces: thread handle, then process handle.
+            CloseHandle(hThread);
+            CloseHandle(hProcess);
+        }
     }
 }
 "@

package/bin/{cap → capc}

@@ -1,11 +1,11 @@
-#!/bin/sh
-# SPDX-License-Identifier: MIT OR Apache-2.0
-# win-nice: managed-file
-# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
-# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
-# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
-# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
-MSYS2_ARG_CONV_EXCL='*'
-export MSYS2_ARG_CONV_EXCL
-script=$(cygpath -w "$(dirname "$0")/cap.ps1" 2>/dev/null) || script="$(dirname "$0")/cap.ps1"
-exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"
+#!/bin/sh
+# SPDX-License-Identifier: MIT OR Apache-2.0
+# win-nice: managed-file
+# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
+# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
+# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
+# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
+MSYS2_ARG_CONV_EXCL='*'
+export MSYS2_ARG_CONV_EXCL
+script=$(cygpath -w "$(dirname "$0")/capc.ps1" 2>/dev/null) || script="$(dirname "$0")/capc.ps1"
+exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"

package/bin/{cap.bat → capc.bat}

@@ -5,6 +5,6 @@
 :: %...% patterns the moment a batch file reads them - confirmed with nothing more
 :: than a bare "echo %1", no forwarding involved; there's no per-character escape
 :: for this from inside a .bat). Every other cmd.exe metacharacter (&|<>^) survives
-:: this hop untouched. Invoking "cap" bare from an actual PowerShell session skips
-:: this file entirely (PowerShell prefers cap.ps1) and has no "%" problem at all.
-powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0cap.ps1" %*
+:: this hop untouched. Invoking "capc" bare from an actual PowerShell session skips
+:: this file entirely (PowerShell prefers capc.ps1) and has no "%" problem at all.
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "%~dp0capc.ps1" %*