dotfiles: keep the group membership, drop the grants that bought nothing

[dotfiles] / setup-windows.bat

diff --git a/setup-windows.bat b/setup-windows.bat
index 1d32adae6c50142d34c9a4067e72120ea16cec2e..a42c1182f3b6c2363089a8e5b9688a86b9450dd4 100644 (file)
--- a/setup-windows.bat
+++ b/setup-windows.bat
@@ -6,7 +6,9 @@
 \r
 @rem --- Non-admin (per-user) winget installs ---\r
 winget install Anthropic.ClaudeCode\r
 \r
 @rem --- Non-admin (per-user) winget installs ---\r
 winget install Anthropic.ClaudeCode\r

+winget install Brave.Brave\r

 winget install Git.Git\r
 winget install Git.Git\r

+winget install Google.AndroidGPUInspector\r

 winget install Microsoft.DotNet.SDK.10\r
 winget install Microsoft.PowerShell Microsoft.Sysinternals.ProcessExplorer Microsoft.Sysinternals.ProcessMonitor Microsoft.Sysinternals.SDelete Microsoft.VisualStudioCode Microsoft.WindowsTerminal\r
 winget install Oracle.VirtualBox\r
 winget install Microsoft.DotNet.SDK.10\r
 winget install Microsoft.PowerShell Microsoft.Sysinternals.ProcessExplorer Microsoft.Sysinternals.ProcessMonitor Microsoft.Sysinternals.SDelete Microsoft.VisualStudioCode Microsoft.WindowsTerminal\r
 winget install Oracle.VirtualBox\r


@@ -61,10 +63,20 @@ set "DOTNET_EXE=%ProgramFiles%\dotnet\dotnet.exe"
 @rem administrator's credentials runs the elevated half AS that administrator, so\r
 @rem it cannot see whose box this is; the account named here is the one it grants\r
 @rem non-elevated ETW collection rights to (xperf / wpr without a UAC prompt).\r
 @rem administrator's credentials runs the elevated half AS that administrator, so\r
 @rem it cannot see whose box this is; the account named here is the one it grants\r
 @rem non-elevated ETW collection rights to (xperf / wpr without a UAC prompt).\r

+@rem\r
+@rem The two values go through the environment, and the quotes the child needs\r
+@rem around them are built in PowerShell as [char]34, so the command line below\r
+@rem contains no embedded quote characters at all. Writing them inline as ""..""\r
+@rem works for ONE argument and quietly breaks at two: the quote-state parsing\r
+@rem swallows everything after the first into the -File value, and the elevated\r
+@rem PowerShell dies with "failed because the file does not have a '.ps1'\r
+@rem extension" and exit code -196608 (0xFFFD0000) before it can log a thing.\r

 set "UAC_LOG=%~dp0setup-windows-uac.log"\r
 if exist "%UAC_LOG%" del "%UAC_LOG%"\r
 set "UAC_LOG=%~dp0setup-windows-uac.log"\r
 if exist "%UAC_LOG%" del "%UAC_LOG%"\r

+set "UAC_SCRIPT=%~dp0setup-windows-with-uac.ps1"\r
+set "UAC_TRACE_USER=%USERDOMAIN%\%USERNAME%"\r

 \r
 \r

-powershell -NoProfile -Command "$p = Start-Process powershell -Verb RunAs -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-File','""%~dp0setup-windows-with-uac.ps1""','-TraceUser','""%USERDOMAIN%\%USERNAME%""' -Wait -PassThru; exit $p.ExitCode"\r
+powershell -NoProfile -Command "$q = [char]34; $p = Start-Process powershell -Verb RunAs -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-File',($q + $env:UAC_SCRIPT + $q),'-TraceUser',($q + $env:UAC_TRACE_USER + $q) -Wait -PassThru; exit $p.ExitCode"\r

 set "UAC_RC=%ERRORLEVEL%"\r
 \r
 @rem --- Surface the elevated session's output (its window has already closed) ---\r
 set "UAC_RC=%ERRORLEVEL%"\r
 \r
 @rem --- Surface the elevated session's output (its window has already closed) ---\r