ansible-core 2.18.5rc1__py3-none-any.whl → 2.19.0b2__py3-none-any.whl

ansible/executor/powershell/async_wrapper.ps1

@@ -1,174 +1,225 @@
-# (c) 2018 Ansible Project
+# (c) 2025 Ansible Project
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 
-param(
-    [Parameter(Mandatory = $true)][System.Collections.IDictionary]$Payload
-)
-
-$ErrorActionPreference = "Stop"
+#AnsibleRequires -CSharpUtil Ansible._Async
 
-Write-AnsibleLog "INFO - starting async_wrapper" "async_wrapper"
+using namespace System.Collections
+using namespace System.Diagnostics
+using namespace System.IO
+using namespace System.IO.Pipes
+using namespace System.Text
+using namespace System.Threading
 
-if (-not $Payload.environment.ContainsKey("ANSIBLE_ASYNC_DIR")) {
-    Write-AnsibleError -Message "internal error: the environment variable ANSIBLE_ASYNC_DIR is not set and is required for an async task"
-    $host.SetShouldExit(1)
-    return
-}
-$async_dir = [System.Environment]::ExpandEnvironmentVariables($Payload.environment.ANSIBLE_ASYNC_DIR)
-
-# calculate the result path so we can include it in the worker payload
-$jid = $Payload.async_jid
-$local_jid = $jid + "." + $pid
-
-$results_path = [System.IO.Path]::Combine($async_dir, $local_jid)
-
-Write-AnsibleLog "INFO - creating async results path at '$results_path'" "async_wrapper"
-
-$Payload.async_results_path = $results_path
-[System.IO.Directory]::CreateDirectory([System.IO.Path]::GetDirectoryName($results_path)) > $null
-
-# we use Win32_Process to escape the current process job, CreateProcess with a
-# breakaway flag won't work for psrp as the psrp process does not have breakaway
-# rights. Unfortunately we can't read/write to the spawned process as we can't
-# inherit the handles. We use a locked down named pipe to send the exec_wrapper
-# payload. Anonymous pipes won't work as the spawned process will not be a child
-# of the current one and will not be able to inherit the handles
-
-# pop the async_wrapper action so we don't get stuck in a loop and create new
-# exec_wrapper for our async process
-$Payload.actions = $Payload.actions[1..99]
-$payload_json = ConvertTo-Json -InputObject $Payload -Depth 99 -Compress
-
-#
-$exec_wrapper = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Payload.exec_wrapper))
-$exec_wrapper += "`0`0`0`0" + $payload_json
-$payload_bytes = [System.Text.Encoding]::UTF8.GetBytes($exec_wrapper)
-$pipe_name = "ansible-async-$jid-$([guid]::NewGuid())"
-
-# template the async process command line with the payload details
-$bootstrap_wrapper = {
-    # help with debugging errors as we loose visibility of the process output
-    # from here on
-    trap {
-        $wrapper_path = "$($env:TEMP)\ansible-async-wrapper-error-$(Get-Date -Format "yyyy-MM-ddTHH-mm-ss.ffffZ").txt"
-        $error_msg = "Error while running the async exec wrapper`r`n$($_ | Out-String)`r`n$($_.ScriptStackTrace)"
-        Set-Content -Path $wrapper_path -Value $error_msg
-        break
-    }
+[CmdletBinding()]
+param (
+    [Parameter(Mandatory)]
+    [string]
+    $AsyncDir,
 
-    &chcp.com 65001 > $null
-
-    # store the pipe name and no. of bytes to read, these are populated before
-    # before the process is created - do not remove or changed
-    $pipe_name = ""
-    $bytes_length = 0
-
-    $input_bytes = New-Object -TypeName byte[] -ArgumentList $bytes_length
-    $pipe = New-Object -TypeName System.IO.Pipes.NamedPipeClientStream -ArgumentList @(
-        ".", # localhost
-        $pipe_name,
-        [System.IO.Pipes.PipeDirection]::In,
-        [System.IO.Pipes.PipeOptions]::None,
-        [System.Security.Principal.TokenImpersonationLevel]::Anonymous
-    )
-    try {
-        $pipe.Connect()
-        $pipe.Read($input_bytes, 0, $bytes_length) > $null
-    }
-    finally {
-        $pipe.Close()
-    }
-    $exec = [System.Text.Encoding]::UTF8.GetString($input_bytes)
-    $exec_parts = $exec.Split(@("`0`0`0`0"), 2, [StringSplitOptions]::RemoveEmptyEntries)
-    Set-Variable -Name json_raw -Value $exec_parts[1]
-    $exec = [ScriptBlock]::Create($exec_parts[0])
-    &$exec
-}
+    [Parameter(Mandatory)]
+    [string]
+    $AsyncJid,
 
-$bootstrap_wrapper = $bootstrap_wrapper.ToString().Replace('$pipe_name = ""', "`$pipe_name = `"$pipe_name`"")
-$bootstrap_wrapper = $bootstrap_wrapper.Replace('$bytes_length = 0', "`$bytes_length = $($payload_bytes.Count)")
-$encoded_command = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($bootstrap_wrapper))
-$pwsh_path = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe"
-$exec_args = "`"$pwsh_path`" -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand $encoded_command"
-
-# create a named pipe that is set to allow only the current user read access
-$current_user = ([Security.Principal.WindowsIdentity]::GetCurrent()).User
-$pipe_sec = New-Object -TypeName System.IO.Pipes.PipeSecurity
-$pipe_ar = New-Object -TypeName System.IO.Pipes.PipeAccessRule -ArgumentList @(
-    $current_user,
-    [System.IO.Pipes.PipeAccessRights]::Read,
-    [System.Security.AccessControl.AccessControlType]::Allow
-)
-$pipe_sec.AddAccessRule($pipe_ar)
-
-Write-AnsibleLog "INFO - creating named pipe '$pipe_name'" "async_wrapper"
-$pipe = New-Object -TypeName System.IO.Pipes.NamedPipeServerStream -ArgumentList @(
-    $pipe_name,
-    [System.IO.Pipes.PipeDirection]::Out,
-    1,
-    [System.IO.Pipes.PipeTransmissionMode]::Byte,
-    [System.IO.Pipes.PipeOptions]::Asynchronous,
-    0,
-    0,
-    $pipe_sec
+    [Parameter(Mandatory)]
+    [int]
+    $StartupTimeout
 )
 
+Import-CSharpUtil -Name 'Ansible._Async.cs'
+
+$AsyncDir = [Environment]::ExpandEnvironmentVariables($AsyncDir)
+if (-not [Directory]::Exists($asyncDir)) {
+    $null = [Directory]::CreateDirectory($asyncDir)
+}
+
+$parentProcessId = 0
+$parentProcessHandle = $stdoutReader = $stderrReader = $stdinPipe = $stdoutPipe = $stderrPipe = $asyncProcess = $waitHandle = $null
 try {
-    Write-AnsibleLog "INFO - creating async process '$exec_args'" "async_wrapper"
-    $process = Invoke-CimMethod -ClassName Win32_Process -Name Create -Arguments @{CommandLine = $exec_args }
-    $rc = $process.ReturnValue
-
-    Write-AnsibleLog "INFO - return value from async process exec: $rc" "async_wrapper"
-    if ($rc -ne 0) {
-        $error_msg = switch ($rc) {
-            2 { "Access denied" }
-            3 { "Insufficient privilege" }
-            8 { "Unknown failure" }
-            9 { "Path not found" }
-            21 { "Invalid parameter" }
-            default { "Other" }
+    $utf8 = [UTF8Encoding]::new($false)
+    $stdinPipe = [AnonymousPipeServerStream]::new([PipeDirection]::Out, [HandleInheritability]::Inheritable)
+    $stdoutPipe = [AnonymousPipeServerStream]::new([PipeDirection]::In, [HandleInheritability]::Inheritable)
+    $stderrPipe = [AnonymousPipeServerStream]::new([PipeDirection]::In, [HandleInheritability]::Inheritable)
+    $stdoutReader = [StreamReader]::new($stdoutPipe, $utf8, $false)
+    $stderrReader = [StreamReader]::new($stderrPipe, $utf8, $false)
+    $clientWaitHandle = $waitHandle = [Ansible._Async.AsyncUtil]::CreateInheritableEvent()
+
+    $stdinHandle = $stdinPipe.ClientSafePipeHandle
+    $stdoutHandle = $stdoutPipe.ClientSafePipeHandle
+    $stderrHandle = $stderrPipe.ClientSafePipeHandle
+
+    $executable = if ($PSVersionTable.PSVersion -lt '6.0') {
+        'powershell.exe'
+    }
+    else {
+        'pwsh.exe'
+    }
+    $executablePath = Join-Path -Path $PSHome -ChildPath $executable
+
+    # We need to escape the job of the current process to allow the async
+    # process to outlive the Windows job. If the current process is not part of
+    # a job or job allows us to breakaway we can spawn the process directly.
+    # Otherwise we use WMI Win32_Process.Create to create a process as our user
+    # outside the job and use that as the async process parent. The winrm and
+    # ssh connection plugin allows breaking away from the job but psrp does not.
+    if (-not [Ansible._Async.AsyncUtil]::CanCreateBreakawayProcess()) {
+        # We hide the console window and suspend the process to avoid it running
+        # anything. We only need the process to be created outside the job and not
+        # for it to run.
+        $psi = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{
+            CreateFlags = [uint32]4  # CREATE_SUSPENDED
+            ShowWindow = [uint16]0  # SW_HIDE
+        }
+        $procInfo = Invoke-CimMethod -ClassName Win32_Process -Name Create -Arguments @{
+            CommandLine = $executablePath
+            ProcessStartupInformation = $psi
+        }
+        $rc = $procInfo.ReturnValue
+        if ($rc -ne 0) {
+            $msg = switch ($rc) {
+                2 { "Access denied" }
+                3 { "Insufficient privilege" }
+                8 { "Unknown failure" }
+                9 { "Path not found" }
+                21 { "Invalid parameter" }
+                default { "Other" }
+            }
+            throw "Failed to start async parent process: $rc $msg"
         }
-        throw "Failed to start async process: $rc ($error_msg)"
+
+        # WMI returns a UInt32, we want the signed equivalent of those bytes.
+        $parentProcessId = [Convert]::ToInt32(
+            [Convert]::ToString($procInfo.ProcessId, 16),
+            16)
+
+        $parentProcessHandle = [Ansible._Async.AsyncUtil]::OpenProcessAsParent($parentProcessId)
+        $clientWaitHandle = [Ansible._Async.AsyncUtil]::DuplicateHandleToProcess($waitHandle, $parentProcessHandle)
+        $stdinHandle = [Ansible._Async.AsyncUtil]::DuplicateHandleToProcess($stdinHandle, $parentProcessHandle)
+        $stdoutHandle = [Ansible._Async.AsyncUtil]::DuplicateHandleToProcess($stdoutHandle, $parentProcessHandle)
+        $stderrHandle = [Ansible._Async.AsyncUtil]::DuplicateHandleToProcess($stderrHandle, $parentProcessHandle)
+        $stdinPipe.DisposeLocalCopyOfClientHandle()
+        $stdoutPipe.DisposeLocalCopyOfClientHandle()
+        $stderrPipe.DisposeLocalCopyOfClientHandle()
     }
-    $watchdog_pid = $process.ProcessId
-    Write-AnsibleLog "INFO - created async process PID: $watchdog_pid" "async_wrapper"
 
-    # populate initial results before we send the async data to avoid result race
+    $localJid = "$AsyncJid.$pid"
+    $resultsPath = [Path]::Combine($AsyncDir, $localJid)
+
+    $bootstrapWrapper = Get-AnsibleScript -Name bootstrap_wrapper.ps1
+    $execAction = Get-AnsibleExecWrapper -EncodeInputOutput
+
+    $execAction.Parameters.ActionParameters = @{
+        ResultPath = $resultsPath
+        WaitHandleId = [Int64]$clientWaitHandle.DangerousGetHandle()
+    }
+    $execWrapper = @{
+        name = 'exec_wrapper-async.ps1'
+        script = $execAction.Script
+        params = $execAction.Parameters
+    } | ConvertTo-Json -Compress -Depth 99
+    $asyncInput = "$execWrapper`n`0`0`0`0`n$($execAction.InputData)"
+
+    $encCommand = [Convert]::ToBase64String([Encoding]::Unicode.GetBytes($bootstrapWrapper.Script))
+    $asyncCommand = "`"$executablePath`" -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand $encCommand"
+
+    $asyncProcess = [Ansible._Async.AsyncUtil]::CreateAsyncProcess(
+        $executablePath,
+        $asyncCommand,
+        $stdinHandle,
+        $stdoutHandle,
+        $stderrHandle,
+        $clientWaitHandle,
+        $parentProcessHandle,
+        $stdoutReader,
+        $stderrReader)
+
+    # We need to write the result file before the process is started to ensure
+    # it can read the file.
     $result = @{
         started = 1
         finished = 0
-        results_file = $results_path
-        ansible_job_id = $local_jid
+        results_file = $resultsPath
+        ansible_job_id = $localJid
         _ansible_suppress_tmpdir_delete = $true
-        ansible_async_watchdog_pid = $watchdog_pid
+        ansible_async_watchdog_pid = $asyncProcess.ProcessId
+    }
+    $resultJson = ConvertTo-Json -InputObject $result -Depth 99 -Compress
+    [File]::WriteAllText($resultsPath, $resultJson, $utf8)
+
+    if ($parentProcessHandle) {
+        [Ansible._Async.AsyncUtil]::CloseHandleInProcess($stdinHandle, $parentProcessHandle)
+        [Ansible._Async.AsyncUtil]::CloseHandleInProcess($stdoutHandle, $parentProcessHandle)
+        [Ansible._Async.AsyncUtil]::CloseHandleInProcess($stderrHandle, $parentProcessHandle)
+        [Ansible._Async.AsyncUtil]::CloseHandleInProcess($clientWaitHandle, $parentProcessHandle)
+    }
+    else {
+        $stdinPipe.DisposeLocalCopyOfClientHandle()
+        $stdoutPipe.DisposeLocalCopyOfClientHandle()
+        $stderrPipe.DisposeLocalCopyOfClientHandle()
+    }
+
+    [Ansible._Async.AsyncUtil]::ResumeThread($asyncProcess.Thread)
+
+    # If writing to the pipe fails the process has already ended.
+    $procAlive = $true
+    $procIn = [StreamWriter]::new($stdinPipe, $utf8)
+    try {
+        $procIn.WriteLine($asyncInput)
+        $procIn.Flush()
+        $procIn.Dispose()
+    }
+    catch [IOException] {
+        $procAlive = $false
     }
 
-    Write-AnsibleLog "INFO - writing initial async results to '$results_path'" "async_wrapper"
-    $result_json = ConvertTo-Json -InputObject $result -Depth 99 -Compress
-    Set-Content $results_path -Value $result_json
-
-    $np_timeout = $Payload.async_startup_timeout * 1000
-    Write-AnsibleLog "INFO - waiting for async process to connect to named pipe for $np_timeout milliseconds" "async_wrapper"
-    $wait_async = $pipe.BeginWaitForConnection($null, $null)
-    $wait_async.AsyncWaitHandle.WaitOne($np_timeout) > $null
-    if (-not $wait_async.IsCompleted) {
-        $msg = "Ansible encountered a timeout while waiting for the async task to start and connect to the named"
-        $msg += "pipe. This can be affected by the performance of the target - you can increase this timeout using"
-        $msg += "WIN_ASYNC_STARTUP_TIMEOUT or just for this host using the win_async_startup_timeout hostvar if "
-        $msg += "this keeps happening."
-        throw $msg
+    if ($procAlive) {
+        # Wait for the process to signal it has started the async task or if it
+        # has ended early/timed out.
+        $waitTimespan = [TimeSpan]::FromSeconds($StartupTimeout)
+        $handleIdx = [WaitHandle]::WaitAny(
+            @(
+                [Ansible._Async.ManagedWaitHandle]::new($waitHandle),
+                [Ansible._Async.ManagedWaitHandle]::new($asyncProcess.Process)
+            ),
+            $waitTimespan)
+        if ($handleIdx -eq [WaitHandle]::WaitTimeout) {
+            $msg = -join @(
+                "Ansible encountered a timeout while waiting for the async task to start and signal it has started. "
+                "This can be affected by the performance of the target - you can increase this timeout using "
+                "WIN_ASYNC_STARTUP_TIMEOUT or just for this host using the ansible_win_async_startup_timeout hostvar "
+                "if this keeps happening."
+            )
+            throw $msg
+        }
+        $procAlive = $handleIdx -eq 0
     }
-    $pipe.EndWaitForConnection($wait_async)
 
-    Write-AnsibleLog "INFO - writing exec_wrapper and payload to async process" "async_wrapper"
-    $pipe.Write($payload_bytes, 0, $payload_bytes.Count)
-    $pipe.Flush()
-    $pipe.WaitForPipeDrain()
+    if ($procAlive) {
+        $resultJson
+    }
+    else {
+        # If the process had ended before it signaled it was ready, we return
+        # back the raw output and hope it contains an error.
+        Remove-Item -LiteralPath $resultsPath -ErrorAction Ignore
+
+        $stdout = $asyncProcess.StdoutReader.GetAwaiter().GetResult()
+        $stderr = $asyncProcess.StderrReader.GetAwaiter().GetResult()
+        $rc = [Ansible._Async.AsyncUtil]::GetProcessExitCode($asyncProcess.Process)
+
+        $host.UI.WriteLine($stdout)
+        Write-PowerShellClixmlStderr -Output $stderr
+        $host.SetShouldExit($rc)
+    }
 }
 finally {
-    $pipe.Close()
+    if ($parentProcessHandle) { $parentProcessHandle.Dispose() }
+    if ($parentProcessId) {
+        Stop-Process -Id $parentProcessId -Force -ErrorAction Ignore
+    }
+    if ($stdoutReader) { $stdoutReader.Dispose() }
+    if ($stderrReader) { $stderrReader.Dispose() }
+    if ($stdinPipe) { $stdinPipe.Dispose() }
+    if ($stdoutPipe) { $stdoutPipe.Dispose() }
+    if ($stderrPipe) { $stderrPipe.Dispose() }
+    if ($asyncProcess) { $asyncProcess.Dispose() }
+    if ($waitHandle) { $waitHandle.Dispose() }
 }
-
-Write-AnsibleLog "INFO - outputting initial async result: $result_json" "async_wrapper"
-Write-Output -InputObject $result_json
-Write-AnsibleLog "INFO - ending async_wrapper" "async_wrapper"

ansible/executor/powershell/become_wrapper.ps1

@@ -1,162 +1,107 @@
-# (c) 2018 Ansible Project
+# (c) 2025 Ansible Project
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 
-param(
-    [Parameter(Mandatory = $true)][System.Collections.IDictionary]$Payload
-)
-
-#Requires -Module Ansible.ModuleUtils.AddType
-#AnsibleRequires -CSharpUtil Ansible.AccessToken
 #AnsibleRequires -CSharpUtil Ansible.Become
 
-$ErrorActionPreference = "Stop"
+using namespace System.Collections
+using namespace System.Diagnostics
+using namespace System.IO
+using namespace System.Management.Automation
+using namespace System.Net
+using namespace System.Text
+
+[CmdletBinding()]
+param (
+    [Parameter()]
+    [AllowEmptyString()]
+    [string]
+    $BecomeUser,
+
+    [Parameter()]
+    [SecureString]
+    $BecomePassword,
+
+    [Parameter()]
+    [string]
+    $LogonType = 'Interactive',
+
+    [Parameter()]
+    [string]
+    $LogonFlags = 'WithProfile'
+)
 
-Write-AnsibleLog "INFO - starting become_wrapper" "become_wrapper"
+Import-CSharpUtil -Name 'Ansible.AccessToken.cs', 'Ansible.Become.cs', 'Ansible.Process.cs'
 
-Function Get-EnumValue($enum, $flag_type, $value) {
-    $raw_enum_value = $value.Replace('_', '')
-    try {
-        $enum_value = [Enum]::Parse($enum, $raw_enum_value, $true)
-    }
-    catch [System.ArgumentException] {
-        $valid_options = [Enum]::GetNames($enum) | ForEach-Object -Process {
-            (($_ -creplace "(.)([A-Z][a-z]+)", '$1_$2') -creplace "([a-z0-9])([A-Z])", '$1_$2').ToString().ToLower()
-        }
-        throw "become_flags $flag_type value '$value' is not valid, valid values are: $($valid_options -join ", ")"
-    }
-    return $enum_value
+# We need to set password to the value of NullString so a null password is
+# preserved when crossing the .NET boundary. If we pass $null it will
+# automatically be converted to "" and we need to keep the distinction for
+# accounts that don't have a password and when someone wants to become without
+# knowing the password.
+$password = [NullString]::Value
+if ($null -ne $BecomePassword) {
+    $password = [NetworkCredential]::new("", $BecomePassword).Password
 }
 
-Function Get-BecomeFlag($flags) {
-    $logon_type = [Ansible.AccessToken.LogonType]::Interactive
-    $logon_flags = [Ansible.Become.LogonFlags]::WithProfile
-
-    if ($null -eq $flags -or $flags -eq "") {
-        $flag_split = @()
-    }
-    elseif ($flags -is [string]) {
-        $flag_split = $flags.Split(" ")
-    }
-    else {
-        throw "become_flags must be a string, was $($flags.GetType())"
-    }
-
-    foreach ($flag in $flag_split) {
-        $split = $flag.Split("=")
-        if ($split.Count -ne 2) {
-            throw "become_flags entry '$flag' is in an invalid format, must be a key=value pair"
-        }
-        $flag_key = $split[0]
-        $flag_value = $split[1]
-        if ($flag_key -eq "logon_type") {
-            $enum_details = @{
-                enum = [Ansible.AccessToken.LogonType]
-                flag_type = $flag_key
-                value = $flag_value
-            }
-            $logon_type = Get-EnumValue @enum_details
-        }
-        elseif ($flag_key -eq "logon_flags") {
-            $logon_flag_values = $flag_value.Split(",")
-            $logon_flags = 0 -as [Ansible.Become.LogonFlags]
-            foreach ($logon_flag_value in $logon_flag_values) {
-                if ($logon_flag_value -eq "") {
-                    continue
-                }
-                $enum_details = @{
-                    enum = [Ansible.Become.LogonFlags]
-                    flag_type = $flag_key
-                    value = $logon_flag_value
-                }
-                $logon_flag = Get-EnumValue @enum_details
-                $logon_flags = $logon_flags -bor $logon_flag
-            }
-        }
-        else {
-            throw "become_flags key '$flag_key' is not a valid runas flag, must be 'logon_type' or 'logon_flags'"
-        }
-    }
-
-    return $logon_type, [Ansible.Become.LogonFlags]$logon_flags
+$executable = if ($PSVersionTable.PSVersion -lt '6.0') {
+    'powershell.exe'
 }
-
-Write-AnsibleLog "INFO - loading C# become code" "become_wrapper"
-$add_type_b64 = $Payload.powershell_modules["Ansible.ModuleUtils.AddType"]
-$add_type = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($add_type_b64))
-New-Module -Name Ansible.ModuleUtils.AddType -ScriptBlock ([ScriptBlock]::Create($add_type)) | Import-Module > $null
-
-$new_tmp = [System.Environment]::ExpandEnvironmentVariables($Payload.module_args["_ansible_remote_tmp"])
-$access_def = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Payload.csharp_utils["Ansible.AccessToken"]))
-$become_def = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Payload.csharp_utils["Ansible.Become"]))
-$process_def = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Payload.csharp_utils["Ansible.Process"]))
-Add-CSharpType -References $access_def, $become_def, $process_def -TempPath $new_tmp -IncludeDebugInfo
-
-$username = $Payload.become_user
-$password = $Payload.become_password
-# We need to set password to the value of NullString so a null password is preserved when crossing the .NET
-# boundary. If we pass $null it will automatically be converted to "" and we need to keep the distinction for
-# accounts that don't have a password and when someone wants to become without knowing the password.
-if ($null -eq $password) {
-    $password = [NullString]::Value
+else {
+    'pwsh.exe'
 }
+$executablePath = Join-Path -Path $PSHome -ChildPath $executable
 
-try {
-    $logon_type, $logon_flags = Get-BecomeFlag -flags $Payload.become_flags
-}
-catch {
-    Write-AnsibleError -Message "internal error: failed to parse become_flags '$($Payload.become_flags)'" -ErrorRecord $_
-    $host.SetShouldExit(1)
-    return
-}
-Write-AnsibleLog "INFO - parsed become input, user: '$username', type: '$logon_type', flags: '$logon_flags'" "become_wrapper"
+$actionInfo = Get-AnsibleExecWrapper -EncodeInputOutput
+$bootstrapManifest = ConvertTo-Json -InputObject @{
+    n = "exec_wrapper-become-$([Guid]::NewGuid()).ps1"
+    s = $actionInfo.Script
+    p = $actionInfo.Parameters
+} -Depth 99 -Compress
 
 # NB: CreateProcessWithTokenW commandline maxes out at 1024 chars, must
-# bootstrap via small wrapper which contains the exec_wrapper passed through the
-# stdin pipe. Cannot use 'powershell -' as the $ErrorActionPreference is always
-# set to Stop and cannot be changed. Also need to split the payload from the wrapper to prevent potentially
-# sensitive content from being logged by the scriptblock logger.
-$bootstrap_wrapper = {
-    [Console]::InputEncoding = [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding
-    $ew = [System.Console]::In.ReadToEnd()
-    $split_parts = $ew.Split(@("`0`0`0`0"), 2, [StringSplitOptions]::RemoveEmptyEntries)
-    Set-Variable -Name json_raw -Value $split_parts[1]
-    &([ScriptBlock]::Create($split_parts[0]))
+# bootstrap via small wrapper to invoke the exec_wrapper. Strings are used to
+# avoid sanity tests like aliases and spaces.
+[string]$command = @'
+$m=foreach($i in $input){
+    if([string]::Equals($i,"`0`0`0`0")){break}
+    $i
 }
-$exec_command = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($bootstrap_wrapper.ToString()))
-$lp_command_line = "powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand $exec_command"
-$lp_current_directory = $env:SystemRoot  # TODO: should this be set to the become user's profile dir?
-
-# pop the become_wrapper action so we don't get stuck in a loop
-$Payload.actions = $Payload.actions[1..99]
-# we want the output from the exec_wrapper to be base64 encoded to preserve unicode chars
-$Payload.encoded_output = $true
-
-$payload_json = ConvertTo-Json -InputObject $Payload -Depth 99 -Compress
-# delimit the payload JSON from the wrapper to keep sensitive contents out of scriptblocks (which can be logged)
-$exec_wrapper = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Payload.exec_wrapper))
-$exec_wrapper += "`0`0`0`0" + $payload_json
-
+$m=$m|ConvertFrom-Json
+$p=@{}
+foreach($o in $m.p.PSObject.Properties){$p[$o.Name]=$o.Value}
+$c=[System.Management.Automation.Language.Parser]::ParseInput($m.s,$m.n,[ref]$null,[ref]$null).GetScriptBlock()
+$input | & $c @p
+'@
+
+# Strip out any leading or trailing whitespace and remove empty lines.
+$command = @(
+    ($command -split "\r?\n") |
+        ForEach-Object { $_.Trim() } |
+        Where-Object { -not [string]::IsNullOrWhiteSpace($_) }
+) -join "`n"
+
+$encCommand = [Convert]::ToBase64String([Encoding]::Unicode.GetBytes($command))
+# Shortened version of '-NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand $encCommand'
+$commandLine = "$executable -noni -nop -ex Bypass -e $encCommand"
+$result = [Ansible.Become.BecomeUtil]::CreateProcessAsUser(
+    $BecomeUser,
+    $password,
+    $LogonFlags,
+    $LogonType,
+    $executablePath,
+    $commandLine,
+    $env:SystemRoot,
+    $null,
+    "$bootstrapManifest`n`0`0`0`0`n$($actionInfo.InputData)")
+
+$stdout = $result.StandardOut
 try {
-    Write-AnsibleLog "INFO - starting become process '$lp_command_line'" "become_wrapper"
-    $result = [Ansible.Become.BecomeUtil]::CreateProcessAsUser($username, $password, $logon_flags, $logon_type,
-        $null, $lp_command_line, $lp_current_directory, $null, $exec_wrapper)
-    Write-AnsibleLog "INFO - become process complete with rc: $($result.ExitCode)" "become_wrapper"
-    $stdout = $result.StandardOut
-    try {
-        $stdout = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($stdout))
-    }
-    catch [FormatException] {
-        # output wasn't Base64, ignore as it may contain an error message we want to pass to Ansible
-        Write-AnsibleLog "WARN - become process stdout was not base64 encoded as expected: $stdout"
-    }
-
-    $host.UI.WriteLine($stdout)
-    $host.UI.WriteErrorLine($result.StandardError.Trim())
-    $host.SetShouldExit($result.ExitCode)
+    $stdout = [Encoding]::UTF8.GetString([Convert]::FromBase64String($stdout))
 }
-catch {
-    Write-AnsibleError -Message "internal error: failed to become user '$username'" -ErrorRecord $_
-    $host.SetShouldExit(1)
+catch [FormatException] {
+    # output wasn't Base64, ignore as it may contain an error message we want to pass to Ansible
+    $null = $_
 }
 
-Write-AnsibleLog "INFO - ending become_wrapper" "become_wrapper"
+$Host.UI.WriteLine($stdout)
+Write-PowerShellClixmlStderr -Output $result.StandardError
+$Host.SetShouldExit($result.ExitCode)

ansible/executor/powershell/bootstrap_wrapper.ps1

@@ -1,12 +1,27 @@
-try { [Console]::InputEncoding = [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding } catch { $null = $_ }
-
-if ($PSVersionTable.PSVersion -lt [Version]"3.0") {
-    '{"failed":true,"msg":"Ansible requires PowerShell v3.0 or newer"}'
+if ($PSVersionTable.PSVersion -lt [Version]"5.1") {
+    '{"failed":true,"msg":"Ansible requires PowerShell v5.1"}'
     exit 1
 }
 
-$exec_wrapper_str = $input | Out-String
-$split_parts = $exec_wrapper_str.Split(@("`0`0`0`0"), 2, [StringSplitOptions]::RemoveEmptyEntries)
-If (-not $split_parts.Length -eq 2) { throw "invalid payload" }
-Set-Variable -Name json_raw -Value $split_parts[1]
-& ([ScriptBlock]::Create($split_parts[0]))
+# First input is a JSON string with name/script/params of what to run. This
+# ends with a line of 4 null bytes and subsequent input is piped to the code
+# provided.
+$codeJson = foreach ($in in $input) {
+    if ([string]::Equals($in, "`0`0`0`0")) {
+        break
+    }
+    $in
+}
+$code = ConvertFrom-Json -InputObject $codeJson
+$splat = @{}
+foreach ($obj in $code.params.PSObject.Properties) {
+    $splat[$obj.Name] = $obj.Value
+}
+
+$cmd = [System.Management.Automation.Language.Parser]::ParseInput(
+    $code.script,
+    "$($code.name).ps1", # Name is used in stack traces.
+    [ref]$null,
+    [ref]$null).GetScriptBlock()
+
+$input | & $cmd @splat