win-nice 0.1.0 → 0.2.0

package/bin/cy.ps1

@@ -1,12 +1,12 @@
 # SPDX-License-Identifier: MIT OR Apache-2.0
 # win-nice: managed-file
 # No param(): $args sidesteps PowerShell's parameter binder entirely - see
-# cap.ps1 for why that matters (claude's own flags shouldn't get bound here).
+# capc.ps1 for why that matters (claude's own flags shouldn't get bound here).
 $Command = @('claude', '--dangerously-skip-permissions') + @($args)
 
 # Fallback command line for when claude isn't a directly-launchable .exe (it's
 # typically an npm-installed .cmd shim on Windows) - see CyLauncher.Run below and
-# cap.ps1 for the same logic and its documented "%" limitation. cy.bat has its own,
+# capc.ps1 for the same logic and its documented "%" limitation. cy.bat has its own,
 # more severe "%" caveat (see there) that applies before this script ever runs.
 $commandLine = ($Command | ForEach-Object {
     $escaped = $_ -replace '"', '\"'
@@ -64,6 +64,9 @@ public static class CyLauncher
     [DllImport("kernel32.dll", SetLastError = true)]
     static extern bool GetExitCodeProcess(IntPtr hProcess, out uint lpExitCode);
 
+    [DllImport("kernel32.dll", SetLastError = true)]
+    static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode);
+
     [DllImport("kernel32.dll")]
     static extern bool CloseHandle(IntPtr hObject);
 
@@ -114,7 +117,7 @@ public static class CyLauncher
         si.cb = Marshal.SizeOf(si);
         PROCESS_INFORMATION pi = new PROCESS_INFORMATION();
 
-        // See cap.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
+        // See capc.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
         // CreateProcess silently re-invokes them through cmd.exe on its own, using
         // unescaped text, instead of failing the way a genuinely missing exe would.
         // A bare name like "claude" (typically an npm .cmd shim on Windows) isn't
@@ -139,6 +142,7 @@ public static class CyLauncher
             // across the whole command line, even across separate arguments) and
             // change what actually runs. Fail loudly here instead of silently risking
             // that - there's no reliable per-character escape for "%" at this level.
+            // No handle is held at this point, so this throw has nothing to clean up.
             foreach (var a in argv)
             {
                 if (a.IndexOf('%') >= 0)
@@ -162,15 +166,39 @@ public static class CyLauncher
                 throw new InvalidOperationException("CreateProcess failed: " + Marshal.GetLastWin32Error());
         }
 
-        WaitForSingleObject(pi.hProcess, 0xFFFFFFFF);
-
-        uint exitCode;
-        GetExitCodeProcess(pi.hProcess, out exitCode);
+        // Ownership of the child's handles starts here - CreateProcess has succeeded, so
+        // both are valid, and the finally below closes each of them exactly once on every
+        // way out: normal return, a thrown InvalidOperationException, or an unexpected
+        // managed exception.
+        IntPtr hProcess = pi.hProcess;
+        IntPtr hThread = pi.hThread;
+        try
+        {
+            if (WaitForSingleObject(hProcess, 0xFFFFFFFF) == 0xFFFFFFFF)
+            {
+                // The child's actual state is unknown here - don't just report
+                // failure and potentially leave it running unmanaged in the
+                // background. Best-effort kill before giving up.
+                int waitErr = Marshal.GetLastWin32Error();
+                string message = "WaitForSingleObject failed: " + waitErr;
+                // Report if the best-effort kill itself also failed.
+                if (!TerminateProcess(hProcess, 1))
+                    message += "; TerminateProcess also failed: " + Marshal.GetLastWin32Error();
+                throw new InvalidOperationException(message);
+            }
 
-        CloseHandle(pi.hThread);
-        CloseHandle(pi.hProcess);
+            uint exitCode;
+            if (!GetExitCodeProcess(hProcess, out exitCode))
+                throw new InvalidOperationException("GetExitCodeProcess failed: " + Marshal.GetLastWin32Error());
 
-        return (int)exitCode;
+            return (int)exitCode;
+        }
+        finally
+        {
+            // Same order as the code this replaces: thread handle, then process handle.
+            CloseHandle(hThread);
+            CloseHandle(hProcess);
+        }
     }
 }
 "@

package/bin/high

@@ -1,11 +1,11 @@
-#!/bin/sh
-# SPDX-License-Identifier: MIT OR Apache-2.0
-# win-nice: managed-file
-# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
-# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
-# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
-# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
-MSYS2_ARG_CONV_EXCL='*'
-export MSYS2_ARG_CONV_EXCL
-script=$(cygpath -w "$(dirname "$0")/high.ps1" 2>/dev/null) || script="$(dirname "$0")/high.ps1"
-exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"
+#!/bin/sh
+# SPDX-License-Identifier: MIT OR Apache-2.0
+# win-nice: managed-file
+# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
+# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
+# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
+# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
+MSYS2_ARG_CONV_EXCL='*'
+export MSYS2_ARG_CONV_EXCL
+script=$(cygpath -w "$(dirname "$0")/high.ps1" 2>/dev/null) || script="$(dirname "$0")/high.ps1"
+exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"

package/bin/high.bat

@@ -5,8 +5,8 @@ if "%~1"=="" (
     echo usage: high ^<command^> [args...] 1>&2
     exit /b 1
 )
-:: A literal "%" in any argument gets corrupted here - see cap.bat for why (a
+:: A literal "%" in any argument gets corrupted here - see capc.bat for why (a
 :: cmd.exe batch-parameter quirk, not fixable from inside a .bat). Every other
 :: cmd.exe metacharacter (&|<>^) survives this hop untouched. Invoking "high"
 :: bare from an actual PowerShell session skips this file (high.ps1 preferred).
-powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0high.ps1" %*
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "%~dp0high.ps1" %*

package/bin/high.ps1

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MIT OR Apache-2.0
 # win-nice: managed-file
 # No param(): nothing here needs a named parameter, and $args sidesteps
-# PowerShell's parameter binder entirely - see cap.ps1 for why that matters.
+# PowerShell's parameter binder entirely - see capc.ps1 for why that matters.
 $Command = $args
 
 if (-not $Command -or $Command.Count -eq 0) {
@@ -11,7 +11,7 @@ if (-not $Command -or $Command.Count -eq 0) {
 
 # Fallback command line for when the target isn't a directly-launchable .exe (see
 # HighLauncher.Run below) - re-parsed by cmd.exe (via "cmd.exe /c"), so quoting must
-# neutralize its operators (&|<>^) and not just whitespace - see cap.ps1 for the
+# neutralize its operators (&|<>^) and not just whitespace - see capc.ps1 for the
 # same logic and its documented "%" limitation. high.bat has its own, more severe
 # "%" caveat (see there) that applies before this script ever runs.
 $commandLine = ($Command | ForEach-Object {
@@ -70,6 +70,9 @@ public static class HighLauncher
     [DllImport("kernel32.dll", SetLastError = true)]
     static extern bool GetExitCodeProcess(IntPtr hProcess, out uint lpExitCode);
 
+    [DllImport("kernel32.dll", SetLastError = true)]
+    static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode);
+
     [DllImport("kernel32.dll")]
     static extern bool CloseHandle(IntPtr hObject);
 
@@ -124,7 +127,7 @@ public static class HighLauncher
         si.cb = Marshal.SizeOf(si);
         PROCESS_INFORMATION pi = new PROCESS_INFORMATION();
 
-        // See cap.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
+        // See capc.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
         // CreateProcess silently re-invokes them through cmd.exe on its own, using
         // unescaped text, instead of failing the way a genuinely missing exe would.
         bool isBatOrCmd = argv.Length > 0 && (
@@ -146,6 +149,7 @@ public static class HighLauncher
             // across the whole command line, even across separate arguments) and
             // change what actually runs. Fail loudly here instead of silently risking
             // that - there's no reliable per-character escape for "%" at this level.
+            // No handle is held at this point, so this throw has nothing to clean up.
             foreach (var a in argv)
             {
                 if (a.IndexOf('%') >= 0)
@@ -169,15 +173,39 @@ public static class HighLauncher
                 throw new InvalidOperationException("CreateProcess failed: " + Marshal.GetLastWin32Error());
         }
 
-        WaitForSingleObject(pi.hProcess, 0xFFFFFFFF);
-
-        uint exitCode;
-        GetExitCodeProcess(pi.hProcess, out exitCode);
+        // Ownership of the child's handles starts here - CreateProcess has succeeded, so
+        // both are valid, and the finally below closes each of them exactly once on every
+        // way out: normal return, a thrown InvalidOperationException, or an unexpected
+        // managed exception.
+        IntPtr hProcess = pi.hProcess;
+        IntPtr hThread = pi.hThread;
+        try
+        {
+            if (WaitForSingleObject(hProcess, 0xFFFFFFFF) == 0xFFFFFFFF)
+            {
+                // The child's actual state is unknown here - don't just report
+                // failure and potentially leave it running unmanaged in the
+                // background. Best-effort kill before giving up.
+                int waitErr = Marshal.GetLastWin32Error();
+                string message = "WaitForSingleObject failed: " + waitErr;
+                // Report if the best-effort kill itself also failed.
+                if (!TerminateProcess(hProcess, 1))
+                    message += "; TerminateProcess also failed: " + Marshal.GetLastWin32Error();
+                throw new InvalidOperationException(message);
+            }
 
-        CloseHandle(pi.hThread);
-        CloseHandle(pi.hProcess);
+            uint exitCode;
+            if (!GetExitCodeProcess(hProcess, out exitCode))
+                throw new InvalidOperationException("GetExitCodeProcess failed: " + Marshal.GetLastWin32Error());
 
-        return (int)exitCode;
+            return (int)exitCode;
+        }
+        finally
+        {
+            // Same order as the code this replaces: thread handle, then process handle.
+            CloseHandle(hThread);
+            CloseHandle(hProcess);
+        }
     }
 }
 "@

package/bin/idle

@@ -1,11 +1,11 @@
-#!/bin/sh
-# SPDX-License-Identifier: MIT OR Apache-2.0
-# win-nice: managed-file
-# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
-# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
-# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
-# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
-MSYS2_ARG_CONV_EXCL='*'
-export MSYS2_ARG_CONV_EXCL
-script=$(cygpath -w "$(dirname "$0")/idle.ps1" 2>/dev/null) || script="$(dirname "$0")/idle.ps1"
-exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"
+#!/bin/sh
+# SPDX-License-Identifier: MIT OR Apache-2.0
+# win-nice: managed-file
+# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
+# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
+# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
+# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
+MSYS2_ARG_CONV_EXCL='*'
+export MSYS2_ARG_CONV_EXCL
+script=$(cygpath -w "$(dirname "$0")/idle.ps1" 2>/dev/null) || script="$(dirname "$0")/idle.ps1"
+exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"

package/bin/idle.bat

@@ -5,8 +5,8 @@ if "%~1"=="" (
     echo usage: idle ^<command^> [args...] 1>&2
     exit /b 1
 )
-:: A literal "%" in any argument gets corrupted here - see cap.bat for why (a
+:: A literal "%" in any argument gets corrupted here - see capc.bat for why (a
 :: cmd.exe batch-parameter quirk, not fixable from inside a .bat). Every other
 :: cmd.exe metacharacter (&|<>^) survives this hop untouched. Invoking "idle"
 :: bare from an actual PowerShell session skips this file (idle.ps1 preferred).
-powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0idle.ps1" %*
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "%~dp0idle.ps1" %*

package/bin/idle.ps1

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MIT OR Apache-2.0
 # win-nice: managed-file
 # No param(): nothing here needs a named parameter, and $args sidesteps
-# PowerShell's parameter binder entirely - see cap.ps1 for why that matters.
+# PowerShell's parameter binder entirely - see capc.ps1 for why that matters.
 $Command = $args
 
 if (-not $Command -or $Command.Count -eq 0) {
@@ -11,7 +11,7 @@ if (-not $Command -or $Command.Count -eq 0) {
 
 # Fallback command line for when the target isn't a directly-launchable .exe (see
 # IdleLauncher.Run below) - re-parsed by cmd.exe (via "cmd.exe /c"), so quoting must
-# neutralize its operators (&|<>^) and not just whitespace - see cap.ps1 for the
+# neutralize its operators (&|<>^) and not just whitespace - see capc.ps1 for the
 # same logic and its documented "%" limitation. idle.bat has its own, more severe
 # "%" caveat (see there) that applies before this script ever runs.
 $commandLine = ($Command | ForEach-Object {
@@ -70,6 +70,9 @@ public static class IdleLauncher
     [DllImport("kernel32.dll", SetLastError = true)]
     static extern bool GetExitCodeProcess(IntPtr hProcess, out uint lpExitCode);
 
+    [DllImport("kernel32.dll", SetLastError = true)]
+    static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode);
+
     [DllImport("kernel32.dll")]
     static extern bool CloseHandle(IntPtr hObject);
 
@@ -123,7 +126,7 @@ public static class IdleLauncher
         si.cb = Marshal.SizeOf(si);
         PROCESS_INFORMATION pi = new PROCESS_INFORMATION();
 
-        // See cap.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
+        // See capc.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
         // CreateProcess silently re-invokes them through cmd.exe on its own, using
         // unescaped text, instead of failing the way a genuinely missing exe would.
         bool isBatOrCmd = argv.Length > 0 && (
@@ -145,6 +148,7 @@ public static class IdleLauncher
             // across the whole command line, even across separate arguments) and
             // change what actually runs. Fail loudly here instead of silently risking
             // that - there's no reliable per-character escape for "%" at this level.
+            // No handle is held at this point, so this throw has nothing to clean up.
             foreach (var a in argv)
             {
                 if (a.IndexOf('%') >= 0)
@@ -168,15 +172,39 @@ public static class IdleLauncher
                 throw new InvalidOperationException("CreateProcess failed: " + Marshal.GetLastWin32Error());
         }
 
-        WaitForSingleObject(pi.hProcess, 0xFFFFFFFF);
-
-        uint exitCode;
-        GetExitCodeProcess(pi.hProcess, out exitCode);
+        // Ownership of the child's handles starts here - CreateProcess has succeeded, so
+        // both are valid, and the finally below closes each of them exactly once on every
+        // way out: normal return, a thrown InvalidOperationException, or an unexpected
+        // managed exception.
+        IntPtr hProcess = pi.hProcess;
+        IntPtr hThread = pi.hThread;
+        try
+        {
+            if (WaitForSingleObject(hProcess, 0xFFFFFFFF) == 0xFFFFFFFF)
+            {
+                // The child's actual state is unknown here - don't just report
+                // failure and potentially leave it running unmanaged in the
+                // background. Best-effort kill before giving up.
+                int waitErr = Marshal.GetLastWin32Error();
+                string message = "WaitForSingleObject failed: " + waitErr;
+                // Report if the best-effort kill itself also failed.
+                if (!TerminateProcess(hProcess, 1))
+                    message += "; TerminateProcess also failed: " + Marshal.GetLastWin32Error();
+                throw new InvalidOperationException(message);
+            }
 
-        CloseHandle(pi.hThread);
-        CloseHandle(pi.hProcess);
+            uint exitCode;
+            if (!GetExitCodeProcess(hProcess, out exitCode))
+                throw new InvalidOperationException("GetExitCodeProcess failed: " + Marshal.GetLastWin32Error());
 
-        return (int)exitCode;
+            return (int)exitCode;
+        }
+        finally
+        {
+            // Same order as the code this replaces: thread handle, then process handle.
+            CloseHandle(hThread);
+            CloseHandle(hProcess);
+        }
     }
 }
 "@

package/bin/realtime

@@ -1,11 +1,11 @@
-#!/bin/sh
-# SPDX-License-Identifier: MIT OR Apache-2.0
-# win-nice: managed-file
-# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
-# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
-# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
-# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
-MSYS2_ARG_CONV_EXCL='*'
-export MSYS2_ARG_CONV_EXCL
-script=$(cygpath -w "$(dirname "$0")/realtime.ps1" 2>/dev/null) || script="$(dirname "$0")/realtime.ps1"
-exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"
+#!/bin/sh
+# SPDX-License-Identifier: MIT OR Apache-2.0
+# win-nice: managed-file
+# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
+# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
+# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
+# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
+MSYS2_ARG_CONV_EXCL='*'
+export MSYS2_ARG_CONV_EXCL
+script=$(cygpath -w "$(dirname "$0")/realtime.ps1" 2>/dev/null) || script="$(dirname "$0")/realtime.ps1"
+exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"

package/bin/realtime.bat

@@ -6,8 +6,8 @@ if "%~1"=="" (
     echo usage: realtime ^<command^> [args...] 1>&2
     exit /b 1
 )
-:: A literal "%" in any argument gets corrupted here - see cap.bat for why (a
+:: A literal "%" in any argument gets corrupted here - see capc.bat for why (a
 :: cmd.exe batch-parameter quirk, not fixable from inside a .bat). Every other
 :: cmd.exe metacharacter (&|<>^) survives this hop untouched. Invoking "realtime"
 :: bare from an actual PowerShell session skips this file (realtime.ps1 preferred).
-powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0realtime.ps1" %*
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "%~dp0realtime.ps1" %*

package/bin/realtime.ps1

@@ -5,7 +5,7 @@
 # stop responding - the exact failure mode this whole project exists to prevent. See
 # README before using this.
 # No param(): nothing here needs a named parameter, and $args sidesteps
-# PowerShell's parameter binder entirely - see cap.ps1 for why that matters.
+# PowerShell's parameter binder entirely - see capc.ps1 for why that matters.
 $Command = $args
 
 if (-not $Command -or $Command.Count -eq 0) {
@@ -15,7 +15,7 @@ if (-not $Command -or $Command.Count -eq 0) {
 
 # Fallback command line for when the target isn't a directly-launchable .exe (see
 # RealtimeLauncher.Run below) - re-parsed by cmd.exe (via "cmd.exe /c"), so quoting must
-# neutralize its operators (&|<>^) and not just whitespace - see cap.ps1 for the
+# neutralize its operators (&|<>^) and not just whitespace - see capc.ps1 for the
 # same logic and its documented "%" limitation. realtime.bat has its own, more
 # severe "%" caveat (see there) that applies before this script ever runs.
 $commandLine = ($Command | ForEach-Object {
@@ -74,6 +74,9 @@ public static class RealtimeLauncher
     [DllImport("kernel32.dll", SetLastError = true)]
     static extern bool GetExitCodeProcess(IntPtr hProcess, out uint lpExitCode);
 
+    [DllImport("kernel32.dll", SetLastError = true)]
+    static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode);
+
     [DllImport("kernel32.dll")]
     static extern bool CloseHandle(IntPtr hObject);
 
@@ -128,7 +131,7 @@ public static class RealtimeLauncher
         si.cb = Marshal.SizeOf(si);
         PROCESS_INFORMATION pi = new PROCESS_INFORMATION();
 
-        // See cap.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
+        // See capc.ps1 for why .bat/.cmd targets skip the direct attempt entirely:
         // CreateProcess silently re-invokes them through cmd.exe on its own, using
         // unescaped text, instead of failing the way a genuinely missing exe would.
         bool isBatOrCmd = argv.Length > 0 && (
@@ -150,6 +153,7 @@ public static class RealtimeLauncher
             // across the whole command line, even across separate arguments) and
             // change what actually runs. Fail loudly here instead of silently risking
             // that - there's no reliable per-character escape for "%" at this level.
+            // No handle is held at this point, so this throw has nothing to clean up.
             foreach (var a in argv)
             {
                 if (a.IndexOf('%') >= 0)
@@ -173,15 +177,39 @@ public static class RealtimeLauncher
                 throw new InvalidOperationException("CreateProcess failed: " + Marshal.GetLastWin32Error());
         }
 
-        WaitForSingleObject(pi.hProcess, 0xFFFFFFFF);
-
-        uint exitCode;
-        GetExitCodeProcess(pi.hProcess, out exitCode);
+        // Ownership of the child's handles starts here - CreateProcess has succeeded, so
+        // both are valid, and the finally below closes each of them exactly once on every
+        // way out: normal return, a thrown InvalidOperationException, or an unexpected
+        // managed exception.
+        IntPtr hProcess = pi.hProcess;
+        IntPtr hThread = pi.hThread;
+        try
+        {
+            if (WaitForSingleObject(hProcess, 0xFFFFFFFF) == 0xFFFFFFFF)
+            {
+                // The child's actual state is unknown here - don't just report
+                // failure and potentially leave it running unmanaged in the
+                // background. Best-effort kill before giving up.
+                int waitErr = Marshal.GetLastWin32Error();
+                string message = "WaitForSingleObject failed: " + waitErr;
+                // Report if the best-effort kill itself also failed.
+                if (!TerminateProcess(hProcess, 1))
+                    message += "; TerminateProcess also failed: " + Marshal.GetLastWin32Error();
+                throw new InvalidOperationException(message);
+            }
 
-        CloseHandle(pi.hThread);
-        CloseHandle(pi.hProcess);
+            uint exitCode;
+            if (!GetExitCodeProcess(hProcess, out exitCode))
+                throw new InvalidOperationException("GetExitCodeProcess failed: " + Marshal.GetLastWin32Error());
 
-        return (int)exitCode;
+            return (int)exitCode;
+        }
+        finally
+        {
+            // Same order as the code this replaces: thread handle, then process handle.
+            CloseHandle(hThread);
+            CloseHandle(hProcess);
+        }
     }
 }
 "@

package/bin/uiup

@@ -1,11 +1,11 @@
-#!/bin/sh
-# SPDX-License-Identifier: MIT OR Apache-2.0
-# win-nice: managed-file
-# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
-# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
-# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
-# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
-MSYS2_ARG_CONV_EXCL='*'
-export MSYS2_ARG_CONV_EXCL
-script=$(cygpath -w "$(dirname "$0")/uiup.ps1" 2>/dev/null) || script="$(dirname "$0")/uiup.ps1"
-exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"
+#!/bin/sh
+# SPDX-License-Identifier: MIT OR Apache-2.0
+# win-nice: managed-file
+# Git Bash ignores PATHEXT for bare-name resolution; this shim covers that shell.
+# MSYS2_ARG_CONV_EXCL='*' stops Git Bash/MSYS from rewriting user arguments
+# (e.g. /c, /d, C:\...) into Windows paths before the exec; the shim's own
+# .ps1 path is converted explicitly with cygpath -w so -File gets a Windows path.
+MSYS2_ARG_CONV_EXCL='*'
+export MSYS2_ARG_CONV_EXCL
+script=$(cygpath -w "$(dirname "$0")/uiup.ps1" 2>/dev/null) || script="$(dirname "$0")/uiup.ps1"
+exec powershell -NoProfile -ExecutionPolicy Bypass -File "$script" "$@"

package/bin/uiup.bat

@@ -1,4 +1,4 @@
 @echo off
 :: SPDX-License-Identifier: MIT OR Apache-2.0
 :: win-nice: managed-file
-powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0uiup.ps1"
+"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "%~dp0uiup.ps1"

package/bin/uiup.ps1

@@ -8,7 +8,8 @@ $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIden
 if (-not $isAdmin) {
     Write-Host "Not elevated - requesting admin rights (dwm/sihost run under a different account)..."
     try {
-        $p = Start-Process powershell -Verb RunAs -ArgumentList @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', "`"$PSCommandPath`"", '-SelfElevated') -Wait -PassThru
+        $powershellPath = [Environment]::SystemDirectory + '\WindowsPowerShell\v1.0\powershell.exe'
+        $p = Start-Process -FilePath $powershellPath -Verb RunAs -ArgumentList @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', "`"$PSCommandPath`"", '-SelfElevated') -Wait -PassThru
         exit $p.ExitCode
     } catch {
         Write-Error "Elevation was cancelled or failed: $($_.Exception.Message)"

package/install/install.js

@@ -4,6 +4,7 @@ const path = require('path');
 const paths = require('./paths');
 const manifest = require('./manifest');
 const { removeManagedFile } = require('./uninstall');
+const { updateInstalledSkill } = require('./skill');
 const pkg = require('../package.json');
 
 const SOURCE_BIN = path.join(__dirname, '..', 'bin');
@@ -14,32 +15,38 @@ function listSourceFiles() {
   return fs.readdirSync(SOURCE_BIN).filter((f) => f.endsWith('.bat') || f.endsWith('.ps1') || !f.includes('.'));
 }
 
-// Guards against `npm install`/`npm test` inside a source checkout silently
-// touching the real system PATH - only a genuine package install (running from
-// inside someone's node_modules) or an explicit WIN_NICE_HOME override proceeds.
-function isSourceCheckout() {
-  return fs.existsSync(path.join(__dirname, '..', '.git'));
-}
-
 // `npm install -g win-nice@newer` only runs postinstall (this function) - unlike
 // `win-nice reinstall`, which does uninstall()+install(), it never diffs against
 // what a previous version left behind. Without this, a tool dropped in a newer
 // version stays orphaned in binDir forever. Safe to call before the target dir
 // even exists (read() returns null, staleNames is empty).
 function cleanupStaleFiles(dir, currentFiles) {
+  const currentSet = new Set(currentFiles);
   const previous = manifest.read(paths.manifestPath());
-  if (!previous || !Array.isArray(previous.files)) return;
+  if (previous && Array.isArray(previous.files)) {
+    const staleNames = previous.files.filter((name) => !currentSet.has(name));
+    const previousDir = previous.binDir || dir;
+    for (const name of staleNames) {
+      removeManagedFile(path.join(previousDir, name), dir, { requireMarker: false });
+    }
+    return;
+  }
 
-  const currentSet = new Set(currentFiles);
-  const staleNames = previous.files.filter((name) => !currentSet.has(name));
-  const previousDir = previous.binDir || dir;
-  for (const name of staleNames) {
-    removeManagedFile(path.join(previousDir, name), dir, { requireMarker: false });
+  // Manifest missing/corrupt (deleted by hand, or predates this file's
+  // existence) - same recovery uninstall() already relies on for the same
+  // situation: scan the known install dir directly and remove only entries
+  // that both (a) aren't part of the CURRENT tool set and (b) still carry the
+  // "win-nice: managed-file" marker. An unmarked file (something the user
+  // dropped into binDir themselves) is never touched, marker or no manifest.
+  if (!fs.existsSync(dir)) return;
+  for (const name of fs.readdirSync(dir)) {
+    if (currentSet.has(name)) continue;
+    removeManagedFile(path.join(dir, name), dir, { requireMarker: true });
   }
 }
 
 function install({ updatePath = true } = {}) {
-  if (!process.env.WIN_NICE_HOME && isSourceCheckout()) {
+  if (!process.env.WIN_NICE_HOME && paths.isSourceCheckout()) {
     console.log(
       'Running from a source checkout - skipping real install. ' +
         'Set WIN_NICE_HOME to force a target directory, or install the published package.'
@@ -73,7 +80,15 @@ function install({ updatePath = true } = {}) {
   }
 
   console.log(`win-nice ${pkg.version} installed: ${files.join(', ')} -> ${dir}`);
+
+  // Only touches a skill copy that's already there and still ours (opt-in
+  // stays opt-in) - see updateInstalledSkill's own comment for why this needs
+  // to run on every install(), not just the explicit `win-nice skill install`.
+  for (const r of updateInstalledSkill()) {
+    if (r.updated) console.log(`updated skill: ${r.file}`);
+  }
+
   return { dir, files };
 }
 
-module.exports = { install, listSourceFiles, isSourceCheckout };
+module.exports = { install, listSourceFiles, isSourceCheckout: paths.isSourceCheckout };