win-nice 0.1.0 → 0.2.0

package/install/paths.js

@@ -1,8 +1,17 @@
 'use strict';
+const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { execFileSync } = require('child_process');
 
+// Guards mutating commands (install/uninstall/reinstall) against touching the
+// real system PATH/install dir when run from inside a git clone - only a
+// genuine package install (running from inside someone's node_modules) or an
+// explicit WIN_NICE_HOME override proceeds.
+function isSourceCheckout() {
+  return fs.existsSync(path.join(__dirname, '..', '.git'));
+}
+
 // WIN_NICE_HOME overrides the install root - used by tests and by anyone who
 // wants a non-default location. Real installs default to %LOCALAPPDATA%\win-nice.
 function installRoot() {
@@ -57,10 +66,25 @@ function removeFromPathString(currentPath, dir) {
   return parts.filter((p) => comparisonForm(p) !== target).join(';');
 }
 
+// Windows PowerShell is a fixed system dependency. Passing only its bare
+// name to CreateProcess lets libuv search the current directory before PATH,
+// so a powershell.exe planted next to `npm install` could run during the
+// installer's registry update. Keep the path construction injectable through
+// the env argument for unit tests, but never resolve the Windows executable
+// through PATH in production.
+function powershellPath(env = process.env) {
+  const systemRoot = env.SystemRoot || env.WINDIR;
+  if (!systemRoot || !path.win32.isAbsolute(systemRoot)) {
+    throw new Error('SystemRoot must be an absolute Windows path');
+  }
+  return path.win32.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+}
+
 function runPowershell(script, extraEnv) {
-  return execFileSync('powershell', ['-NoProfile', '-Command', script], {
+  const env = extraEnv ? { ...process.env, ...extraEnv } : process.env;
+  return execFileSync(powershellPath(env), ['-NoProfile', '-Command', script], {
     encoding: 'utf8',
-    env: extraEnv ? { ...process.env, ...extraEnv } : process.env,
+    env,
   });
 }
 
@@ -129,11 +153,13 @@ function writeUserPath(newPath) {
 }
 
 module.exports = {
+  isSourceCheckout,
   installRoot,
   binDir,
   manifestPath,
   addToPathString,
   removeFromPathString,
+  powershellPath,
   readUserPath,
   writeUserPath,
   readRegistryString,

package/install/skill.js

@@ -45,6 +45,30 @@ function installSkill() {
   return results;
 }
 
+// Called from install() (postinstall / `win-nice install|reinstall`), not just
+// the explicit opt-in `win-nice skill install` - a package upgrade must not
+// leave a previously-installed skill copy silently stale (e.g. recommending
+// tool names a breaking rename just deleted). Only refreshes copies that are
+// ALREADY there and still carry the marker: never creates one for a user who
+// never opted in, and never touches a missing or foreign/unmarked file.
+function updateInstalledSkill() {
+  const content = fs.readFileSync(SOURCE, 'utf8');
+  const results = [];
+  for (const target of targets()) {
+    if (!fs.existsSync(target)) {
+      results.push({ file: target, updated: false, reason: 'not installed' });
+      continue;
+    }
+    if (!fs.readFileSync(target, 'utf8').includes(MARKER)) {
+      results.push({ file: target, updated: false, reason: 'marker missing (modified by user?)' });
+      continue;
+    }
+    fs.writeFileSync(target, content);
+    results.push({ file: target, updated: true });
+  }
+  return results;
+}
+
 function uninstallSkill() {
   const results = [];
   for (const target of targets()) {
@@ -65,4 +89,4 @@ function uninstallSkill() {
   return results;
 }
 
-module.exports = { installSkill, uninstallSkill, targets, MARKER };
+module.exports = { installSkill, uninstallSkill, updateInstalledSkill, targets, MARKER };

package/install/uninstall.js

@@ -25,6 +25,17 @@ function removeManagedFile(filePath, expectedDir, { requireMarker }) {
 }
 
 function uninstall({ updatePath = true } = {}) {
+  // Mirrors install()'s own guard: without it, `win-nice reinstall`/`uninstall`
+  // run from inside a git clone (no WIN_NICE_HOME) would delete a real prior
+  // install and PATH entry, then (for reinstall) silently skip reinstalling it.
+  if (!process.env.WIN_NICE_HOME && paths.isSourceCheckout()) {
+    console.log(
+      'Running from a source checkout - skipping real uninstall. ' +
+        'Set WIN_NICE_HOME to force a target directory, or uninstall the published package.'
+    );
+    return [];
+  }
+
   const dir = paths.binDir();
   const manifestFile = paths.manifestPath();
   const data = manifest.read(manifestFile);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "win-nice",
-  "version": "0.1.0",
-  "description": "Windows nice/renice/cpulimit for parallel AI coding agents - process priority (idle/belownormal/abovenormal/high/realtime), hard CPU quotas and thread affinity via Job Objects, elevation (admin), a UI responsiveness boost, and an optional Claude Code/Codex reference skill, with no dependencies.",
+  "version": "0.2.0",
+  "description": "Windows nice/renice/cpulimit for parallel AI coding agents - process priority (idle/belownormal/abovenormal/high/realtime), hard CPU quotas, thread affinity, memory limits, and process-count ceilings via Job Objects (capc/capt/capm/capn), a wall-clock timeout that kills the whole tree on expiry (caps), elevation (admin), a UI responsiveness boost, and an optional Claude Code/Codex reference skill, with no dependencies.",
   "license": "MIT OR Apache-2.0",
   "author": {
     "name": "Marat K",
@@ -26,17 +26,21 @@
     "install",
     "skills",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE-MIT",
     "LICENSE-APACHE"
   ],
   "scripts": {
     "postinstall": "node install/cli.js install",
-    "test": "node --test test/cli.test.js test/docs-sync.test.js test/gitbash-shims.test.js test/install-uninstall.test.js test/manifest.test.js test/paths.test.js test/skill.test.js"
+    "test": "node --test test/cli.test.js test/docs-sync.test.js test/gitbash-shims.test.js test/install-uninstall.test.js test/manifest.test.js test/paths.test.js test/release-check-allowlist.test.js test/skill.test.js",
+    "test:elevated": "\"%SystemRoot%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -File test\\run-elevated.ps1",
+    "release-check": "node scripts/release-check.js"
   },
   "keywords": [
     "windows",
     "priority",
     "cpu",
+    "memory",
     "job-object",
     "nice",
     "cpulimit",

package/skills/win-nice/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: win-nice
-description: Reference for win-nice's Windows CLI tools for process priority, hard CPU quotas, and CPU affinity (idle, belownormal, abovenormal, high, realtime, cap, pint, uiup, admin). Use when the user asks how to limit CPU usage, priority, or thread/core affinity for a command on Windows, wants to avoid a build/test freezing the desktop, or mentions any of these tool names.
+description: Reference for win-nice's Windows CLI tools for process priority, hard CPU quotas, CPU affinity, memory limits, process-count ceilings, and a wall-clock timeout (idle, belownormal, abovenormal, high, realtime, capc, capt, capm, caps, capn, uiup, admin). Use when the user asks how to limit CPU usage, priority, thread/core affinity, memory, or the number of concurrent processes for a command on Windows, wants to kill a command after a timeout, wants to avoid a build/test freezing the desktop, or mentions any of these tool names.
 ---
 
 <!-- win-nice: managed-skill -->
@@ -41,39 +41,126 @@ runs at ordinary `Normal` priority. Confirmed empirically, not just from docs.
 
 Job-Object-based; cover the *whole* process tree from the wrapped command's
 first instruction (created suspended, assigned to the job, only then resumed —
-no race window), including anything it spawns, recursively.
+no race window), including anything it spawns, recursively via ordinary
+`CreateProcess` calls. Exceptions: explicit `CREATE_BREAKAWAY_FROM_JOB`, and
+processes brought up through an external broker/service (e.g. WMI's
+`Win32_Process.Create`) that never goes through the tree's own `CreateProcess`.
 
-- `cap <percent 1-100> <command> [args...]` — hard CPU quota
+- `capc <percent 1-100> <command> [args...]` — hard CPU quota
   (`JOBOBJECT_CPU_RATE_CONTROL_INFORMATION`, hard cap). A real ceiling on total
   CPU%, not just scheduling priority — holds even when nothing else is
-  contending for CPU. Example: `cap 50 npm run build`.
-- `pint <thread-count> <command> [args...]` — short for "pin threads": restricts
+  contending for CPU. Example: `capc 50 npm run build`.
+- `capt <thread-count> <command> [args...]` — short for "cap threads": restricts
   the whole tree to the first N *logical processors* via process affinity
   (`JOB_OBJECT_LIMIT_AFFINITY`). Threads, not physical cores — on
   Hyper-Threading/SMT hardware, N logical processors can be fewer physical
   cores. `<thread-count>` must be between 1 and
-  `min([Environment]::ProcessorCount, 63)`. Example: `pint 4 npm run build`.
+  `min([Environment]::ProcessorCount, 63)` — under 32-bit PowerShell the cap
+  is additionally 32 (the affinity mask is a pointer-sized `UIntPtr`), and
+  counts above it are rejected with a usage error naming 64-bit PowerShell.
+  Example: `capt 4 npm run build`.
+- `capm <size> <command> [args...]` — hard memory ceiling
+  (`JOB_OBJECT_LIMIT_JOB_MEMORY`), aggregate across the whole tree, not
+  per-process. `<size>`: bare integer `1`-`100` = percent of total physical RAM
+  (same convention as `capc`'s own `<percent 1-100>`, deliberately no `%`
+  character - see Chaining below), or `m`/`M` = megabytes (`512m`), or `g`/`G`
+  = gigabytes (`2g`). Unlike `capc`, exceeding it doesn't throttle - it fails
+  the allocation (`OutOfMemoryException`/`VirtualAlloc` failure), which
+  usually crashes the wrapped program since most don't handle that
+  gracefully; set it too low and even the wrapped runtime can fail to start.
+  Example: `capm 512m npm run build`.
+- `caps <seconds> <command> [args...]` — wall-clock timeout for the whole
+  process tree: if the command is still running when `<seconds>` have passed, one
+  `TerminateJobObject` kernel call force-kills everything still in the Job
+  Object (the whole subtree, from the first instruction via the same
+  suspend-then-assign-then-resume mechanism as `capc`/`capt`/`capm`), and
+  `caps` exits with code 124 (unix `timeout(1)` convention). The deadline is
+  absolute — computed from `DateTime.UtcNow` and armed into a one-shot
+  waitable timer waited on together with the process handle
+  (`WaitForMultipleObjects`, with a `GetProcessTimes` check rejecting an exit
+  that only won the simultaneous-signal race after the deadline) — so time
+  the machine spends asleep/suspended counts against it, and it fires
+  immediately on wake if it passed during sleep; the due time is a
+  system-clock (FILETIME) value, so a manual or service-driven clock
+  adjustment during the wait can shorten or lengthen the actual wait relative
+  to `<seconds>`. The job carries
+  only `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE` — no resource limit — which is also
+  the backstop if the `caps` wrapper itself dies non-cooperatively; released
+  before a normal inside-the-deadline exit, so a daemon the command legitimately
+  left running survives. `<seconds>`:
+  positive whole or decimal (`2`, `2.5`), converted to whole milliseconds
+  (min 1 ms); max 4294967294 ms (~49.7 days) — a deliberate usage ceiling,
+  not a uint32 limit (the deadline is an absolute FILETIME and the wait
+  itself is INFINITE) — larger values are a usage error, never silently
+  truncated. Finishing in time propagates the exit code like every other launcher.
+  Example: `caps 300 npm test`.
+- `capn <count> <command> [args...]` — hard ceiling on the number of
+  simultaneously active processes in the whole tree
+  (`JOB_OBJECT_LIMIT_ACTIVE_PROCESS`). The count includes the directly
+  wrapped process itself (it is assigned to the still-empty job before it can
+  spawn anything), so `capn 1 <command>` lets the command run but fails its
+  first child-spawn attempt. Exceeding the limit fails only the offending
+  spawn attempt - nothing is killed or throttled, and a command within budget
+  is unaffected (all confirmed empirically). `<count>`: positive whole
+  number, 1 to 4294967295 (the uint32 `ActiveProcessLimit` field's own
+  range). Example: `capn 10 npm run build`.
 
 **A limit sticks to any daemon the wrapped command leaves running**, for that
-daemon's whole lifetime, not just the one `cap`/`pint` call — Job Object
-membership is permanent once assigned. Build tools that reuse a background
+daemon's whole lifetime, not just the one `capc`/`capt`/`capm`/`capn` call — Job
+Object membership is permanent once assigned. Build tools that reuse a background
 process to skip cold-start cost (`dotnet build`'s VBCSCompiler/MSBuild node
 reuse, a Gradle daemon, `npm run watch`-style file watchers) can leave a
 *later, uncapped-looking* invocation actually running inside an earlier
-`cap`/`pint` call's job. Escape hatches: `dotnet build
+`capc`/`capt` call's job. Escape hatches: `dotnet build
 -p:UseSharedCompilation=false`, `gradle --no-daemon` — or accept the daemon
 stays limited until it's killed.
 
+## Chaining
+
+These tools can be stacked, e.g. `capm 50 capc 50 idle npm run build`. Bare
+tool names resolve through the same `cmd.exe`/`PATHEXT` fallback as any other
+target, so chaining needs the tools' install directory on `PATH`, and any `%`
+in the command line still trips the fail-closed check. Nested Job Object
+limits do **not** follow one universal "smaller wins" rule: CPU rate
+(`capc`) is relative to its parent job and *multiplies* when nested (`capc 50
+capc 50 ...` ≈ 25% of system CPU, not 50% - see
+[`JOBOBJECT_CPU_RATE_CONTROL_INFORMATION`](https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-jobobject_cpu_rate_control_information)),
+while memory (`capm`) ceilings apply independently to accounting scopes of
+different sizes - a job's committed-memory accounting includes every child
+job's committed memory plus its own process, a child job's accounting
+doesn't see the outer wrapper's process at all - so nested `capm` ceilings
+don't reduce to a simple `min(limit1, limit2)`. Process count (`capn`) limits
+are likewise enforced independently per job - a spawn has to fit under every
+job in the chain at once, and an outer job's count already includes the inner
+wrapper process itself (plus anything it spawns, down to a PowerShell-based
+inner tool's own csc.exe/CVTRES.EXE compiler children), so `capn 1 capn 5 ...`
+fails before the inner limit even matters and the effective budget is not a
+plain `min()` - leave outer headroom for the chain itself (roughly 3 slots
+for a PowerShell-based inner tool). Priority (`idle`/etc.) isn't
+a Job Object limit at all - the last one applied wins. A timeout (`caps`) is
+likewise not a Job Object limit being combined - it's a deadline each `caps`
+wrapper enforces on its own direct child: the innermost `caps` fires at its own
+deadline (the outer propagates the 124), while an outer `caps` whose deadline
+fires first kills the whole subtree including the inner wrapper, whose own
+`KILL_ON_JOB_CLOSE` job then takes down everything beneath it - so the caller
+sees 124 either way. See README.md's
+"Chaining these tools together" for the full explanation.
+
 ## Elevation / desktop responsiveness
 
 - `admin <command> [args...]` — runs elevated (as Administrator); triggers the
   standard UAC consent prompt if the calling shell isn't already elevated, runs
-  inline with no extra prompt if it is. The elevated equivalent of `idle`.
+  inline with no extra prompt if it is. Blocking elevation wrapper with the same
+  wait-and-propagate-exit-code semantics as the other wrappers - it does not set
+  a priority class like `idle` does.
 - `uiup` (no arguments) — one-shot `HIGH` priority boost for the live
   shell/UI/audio processes (`explorer`, `dwm`, `sihost`,
   `ShellExperienceHost`, `StartMenuExperienceHost`, `StartMenu`, `SearchApp`,
-  `audiodg`) so the desktop stays responsive while heavy background work runs
-  underneath. Self-elevates via UAC. Does **not** affect apps launched from
+  `audiodg`), intended to improve desktop responsiveness while heavy
+  background work runs underneath - a best-effort one-shot tweak, not a
+  guarantee (memory pressure, I/O saturation, driver/GPU stalls, or a
+  realtime workload elsewhere can still make the desktop stutter). Self-
+  elevates via UAC. Does **not** affect apps launched from
   Explorer afterward (`HIGH` isn't inherited by default).
 
 ## Argument safety
@@ -104,6 +191,14 @@ depends on the calling shell:
 | cmd.exe, or PATHEXT-based resolution (e.g. Node's `child_process` — `PATHEXT` doesn't include `.PS1` by default) | `name.bat` | corrupted before `.ps1` ever runs |
 | POSIX shell (Git Bash only — ignores `PATHEXT`; WSL not supported) | `name` (extensionless shim) | full argument safety — `exec`s straight into `name.ps1` with MSYS argument conversion disabled, same as PowerShell |
 
+Known limitation: the shims' `MSYS2_ARG_CONV_EXCL='*'` (what keeps their own
+arguments intact) is inherited by the wrapped command tree, so an MSYS
+program run *inside* the wrapped command (an inner `bash`/`sh` or a
+`#!/bin/sh` git hook — not a native program) stops converting POSIX paths in
+its own children's arguments (`caps 600 bash -c 'node /c/proj/run.js'` fails
+to find the module). The shim's own arguments and native wrapped commands are
+unaffected.
+
 The `.bat` file corrupts any literal `%` in its arguments before the command,
 and before `.ps1` (and its fail-closed `%` check), ever runs at all
 (cmd.exe's own batch-parameter substitution rescanning for `%...%` patterns

package/bin/cap.ps1

@@ -1,269 +0,0 @@
-# SPDX-License-Identifier: MIT OR Apache-2.0
-# win-nice: managed-file
-# Deliberately no param()/[CmdletBinding()]: a declared parameter name (even
-# without a [Parameter()] attribute) can still be ambiguously prefix-matched by
-# flags meant for the wrapped command (e.g. "-p" matching "-Percent"). Reading
-# everything from $args sidesteps PowerShell's parameter binder entirely.
-if ($args.Count -lt 2) {
-    Write-Error "usage: cap <percent 1-100> <command> [args...]"
-    exit 1
-}
-$percentValue = 0
-if (-not [int]::TryParse($args[0], [ref]$percentValue) -or $percentValue -lt 1 -or $percentValue -gt 100) {
-    Write-Error "usage: cap <percent 1-100> <command> [args...]"
-    exit 1
-}
-$Command = @($args[1..($args.Count - 1)])
-
-# Fallback command line for when the target isn't a directly-launchable .exe (see
-# CapLauncher.Run below) - re-parsed by cmd.exe (via "cmd.exe /c"), so quoting must
-# neutralize its operators (&|<>^) and not just whitespace, or e.g. "A&B" gets split
-# into two commands. NOTE: a literal "%" in an argument can still trigger cmd.exe
-# environment-variable expansion (e.g. "%PATH%") even when quoted, and cmd.exe pairs
-# up "%" characters across argument/quote boundaries - two unrelated arguments that
-# each contain one "%" can corrupt each other. There is no reliable per-character
-# escape for this at the cmd.exe /c level; it's a known, inherent limitation shared
-# by anything that shells out through cmd.exe (Node's own child_process included).
-# This fallback path only runs for .bat/.cmd/builtin targets - a direct .exe target
-# never goes through cmd.exe at all, so it isn't exposed to this limitation.
-$commandLine = ($Command | ForEach-Object {
-    $escaped = $_ -replace '"', '\"'
-    if ($escaped -eq '' -or $escaped -match '[\s"&|<>^]') { '"' + $escaped + '"' } else { $escaped }
-}) -join ' '
-
-$source = @"
-using System;
-using System.Runtime.InteropServices;
-using System.Text;
-
-public static class CapLauncher
-{
-    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
-    struct STARTUPINFO
-    {
-        public int cb;
-        public string lpReserved;
-        public string lpDesktop;
-        public string lpTitle;
-        public int dwX;
-        public int dwY;
-        public int dwXSize;
-        public int dwYSize;
-        public int dwXCountChars;
-        public int dwYCountChars;
-        public int dwFillAttribute;
-        public int dwFlags;
-        public short wShowWindow;
-        public short cbReserved2;
-        public IntPtr lpReserved2;
-        public IntPtr hStdInput;
-        public IntPtr hStdOutput;
-        public IntPtr hStdError;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    struct PROCESS_INFORMATION
-    {
-        public IntPtr hProcess;
-        public IntPtr hThread;
-        public int dwProcessId;
-        public int dwThreadId;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    struct JOBOBJECT_CPU_RATE_CONTROL_INFORMATION
-    {
-        public uint ControlFlags;
-        public uint CpuRate;
-    }
-
-    [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
-    static extern bool CreateProcess(string lpApplicationName, StringBuilder lpCommandLine,
-        IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles,
-        uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory,
-        ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    static extern IntPtr CreateJobObject(IntPtr lpJobAttributes, string lpName);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    static extern bool SetInformationJobObject(IntPtr hJob, int JobObjectInfoClass, IntPtr lpJobObjectInfo, uint cbJobObjectInfoLength);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    static extern bool AssignProcessToJobObject(IntPtr hJob, IntPtr hProcess);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    static extern uint ResumeThread(IntPtr hThread);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    static extern uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    static extern bool GetExitCodeProcess(IntPtr hProcess, out uint lpExitCode);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode);
-
-    [DllImport("kernel32.dll")]
-    static extern bool CloseHandle(IntPtr hObject);
-
-    const uint CREATE_SUSPENDED = 0x00000004;
-    const int JobObjectCpuRateControlInformation = 15;
-    const uint JOB_OBJECT_CPU_RATE_CONTROL_ENABLE = 0x1;
-    const uint JOB_OBJECT_CPU_RATE_CONTROL_HARD_CAP = 0x4;
-
-    // Standard MSVCRT/CommandLineToArgvW quoting: safe for a directly-launched .exe's
-    // own argv parsing. No cmd.exe involved on this path, so none of its operator or
-    // "%" expansion semantics apply - this is the safe path, used whenever possible.
-    static string ArgvQuote(string arg)
-    {
-        if (arg.Length > 0 && arg.IndexOfAny(new char[] { ' ', '\t', '\n', '\v', '"' }) < 0)
-            return arg;
-
-        var result = new StringBuilder();
-        result.Append('"');
-        int backslashes = 0;
-        foreach (char c in arg)
-        {
-            if (c == '\\')
-            {
-                backslashes++;
-            }
-            else if (c == '"')
-            {
-                result.Append('\\', backslashes * 2 + 1);
-                result.Append('"');
-                backslashes = 0;
-            }
-            else
-            {
-                if (backslashes > 0) { result.Append('\\', backslashes); backslashes = 0; }
-                result.Append(c);
-            }
-        }
-        if (backslashes > 0) result.Append('\\', backslashes * 2);
-        result.Append('"');
-        return result.ToString();
-    }
-
-    static string BuildArgvCommandLine(string[] argv)
-    {
-        var parts = new string[argv.Length];
-        for (int i = 0; i < argv.Length; i++) parts[i] = ArgvQuote(argv[i]);
-        return string.Join(" ", parts);
-    }
-
-    public static int Run(int percent, string[] argv, string cmdExeCommandLine)
-    {
-        IntPtr hJob = CreateJobObject(IntPtr.Zero, null);
-        if (hJob == IntPtr.Zero)
-            throw new InvalidOperationException("CreateJobObject failed: " + Marshal.GetLastWin32Error());
-
-        var cpuInfo = new JOBOBJECT_CPU_RATE_CONTROL_INFORMATION
-        {
-            ControlFlags = JOB_OBJECT_CPU_RATE_CONTROL_ENABLE | JOB_OBJECT_CPU_RATE_CONTROL_HARD_CAP,
-            CpuRate = (uint)(percent * 100)
-        };
-        int size = Marshal.SizeOf(cpuInfo);
-        IntPtr ptr = Marshal.AllocHGlobal(size);
-        Marshal.StructureToPtr(cpuInfo, ptr, false);
-        bool ok = SetInformationJobObject(hJob, JobObjectCpuRateControlInformation, ptr, (uint)size);
-        Marshal.FreeHGlobal(ptr);
-        if (!ok)
-        {
-            CloseHandle(hJob);
-            throw new InvalidOperationException("SetInformationJobObject failed: " + Marshal.GetLastWin32Error());
-        }
-
-        var si = new STARTUPINFO();
-        si.cb = Marshal.SizeOf(si);
-        PROCESS_INFORMATION pi = new PROCESS_INFORMATION();
-
-        // Try launching the target directly first (no shell at all) - unless it's a
-        // .bat/.cmd file. CreateProcess has an undocumented-but-real fallback of its
-        // own for those: instead of failing, it silently re-invokes them through
-        // cmd.exe using OUR unescaped argv text (ArgvQuote only protects CRT argv
-        // parsing, not cmd.exe's operators), reopening the exact "A&B" splits this
-        // whole file exists to prevent. A bare name with no extension is safe either
-        // way: CreateProcess only ever auto-appends ".exe" to it, never ".bat/.cmd",
-        // so it fails cleanly (ERROR_FILE_NOT_FOUND) when only a same-named .bat/.cmd
-        // exists, and falls through to the escaped path below.
-        bool isBatOrCmd = argv.Length > 0 && (
-            argv[0].EndsWith(".bat", StringComparison.OrdinalIgnoreCase) ||
-            argv[0].EndsWith(".cmd", StringComparison.OrdinalIgnoreCase));
-
-        bool created = false;
-        if (!isBatOrCmd)
-        {
-            var directCommandLine = new StringBuilder(BuildArgvCommandLine(argv));
-            created = CreateProcess(null, directCommandLine, IntPtr.Zero, IntPtr.Zero, true,
-                CREATE_SUSPENDED, IntPtr.Zero, null, ref si, out pi);
-        }
-
-        if (!created)
-        {
-            // Falling back to cmd.exe /c: a literal "%" in any argument could now
-            // trigger environment-variable expansion (cmd.exe pairs up "%" characters
-            // across the whole command line, even across separate arguments) and
-            // change what actually runs. Fail loudly here instead of silently risking
-            // that - there's no reliable per-character escape for "%" at this level.
-            foreach (var a in argv)
-            {
-                if (a.IndexOf('%') >= 0)
-                    throw new InvalidOperationException(
-                        "Refusing to run: argument contains '%' and the target needs the cmd.exe " +
-                        "fallback (not a directly-launchable .exe), where '%' can trigger unintended " +
-                        "environment-variable expansion. See README's Argument handling section.");
-            }
-
-            string cmdExe = Environment.SystemDirectory + "\\cmd.exe";
-            // /d: skip HKCU AutoRun (user-writable registry key). /v:off: disable delayed
-            // expansion so "!var!" in an argument can't be expanded. /s plus the extra outer
-            // quote pair: cmd's /S rule strips exactly that outer pair and leaves the rest of
-            // the string untouched - without /S, cmd strips the first and last quote of the
-            // whole line instead, which breaks quoting whenever the target path itself needs
-            // quotes AND another argument is also quoted.
-            var shellCommandLine = new StringBuilder("\"" + cmdExe + "\" /d /v:off /s /c \"" + cmdExeCommandLine + "\"");
-            created = CreateProcess(null, shellCommandLine, IntPtr.Zero, IntPtr.Zero, true,
-                CREATE_SUSPENDED, IntPtr.Zero, null, ref si, out pi);
-            if (!created)
-            {
-                CloseHandle(hJob);
-                throw new InvalidOperationException("CreateProcess failed: " + Marshal.GetLastWin32Error());
-            }
-        }
-
-        if (!AssignProcessToJobObject(hJob, pi.hProcess))
-        {
-            // Can't guarantee the cap - kill instead of letting it run uncapped and orphaned.
-            int err = Marshal.GetLastWin32Error();
-            TerminateProcess(pi.hProcess, 1);
-            CloseHandle(pi.hThread);
-            CloseHandle(pi.hProcess);
-            CloseHandle(hJob);
-            throw new InvalidOperationException("AssignProcessToJobObject failed: " + err);
-        }
-
-        ResumeThread(pi.hThread);
-        WaitForSingleObject(pi.hProcess, 0xFFFFFFFF);
-
-        uint exitCode;
-        GetExitCodeProcess(pi.hProcess, out exitCode);
-
-        CloseHandle(pi.hThread);
-        CloseHandle(pi.hProcess);
-        CloseHandle(hJob);
-
-        return (int)exitCode;
-    }
-}
-"@
-
-Add-Type -TypeDefinition $source -Language CSharp
-
-try {
-    exit ([CapLauncher]::Run($percentValue, [string[]]$Command, $commandLine))
-} catch {
-    Write-Error $_.Exception.InnerException.Message
-    exit 1
-}

package/bin/pint.bat

@@ -1,8 +0,0 @@
-@echo off
-:: SPDX-License-Identifier: MIT OR Apache-2.0
-:: win-nice: managed-file
-:: A literal "%" in any argument gets corrupted here - see cap.bat for why (a
-:: cmd.exe batch-parameter quirk, not fixable from inside a .bat). Every other
-:: cmd.exe metacharacter (&|<>^) survives this hop untouched. Invoking "pint"
-:: bare from an actual PowerShell session skips this file (pint.ps1 preferred).
-powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0pint.ps1" %*