dotfiles: detect that elevation is impossible instead of misreporting it

[dotfiles] / setup-windows.bat

diff --git a/setup-windows.bat b/setup-windows.bat
index b9e47529fe28e08d6d4164e51802df397e2749a5..bd248a917a057c349fade212e17ec5ebe26abd0b 100644 (file)
--- a/setup-windows.bat
+++ b/setup-windows.bat
@@ -26,6 +26,31 @@ set "IS_ARM64=0"
 if /i "%HOST_ARCH%"=="ARM64" set "IS_ARM64=1"\r
 echo [setup-windows] Host architecture: %HOST_ARCH%\r
 \r
 if /i "%HOST_ARCH%"=="ARM64" set "IS_ARM64=1"\r
 echo [setup-windows] Host architecture: %HOST_ARCH%\r
 \r

+@rem ---------------------------------------------------------------------------\r
+@rem Can this account elevate? Worked out ONCE, here, because it gates two very\r
+@rem different things: the elevated half far below, and a handful of the "per-user"\r
+@rem winget installs just after this, which are per-user in name only.\r
+@rem\r
+@rem   ALREADY - already elevated. IsInRole(Administrator) is false for an admin\r
+@rem             running unelevated under UAC, so this means actually elevated,\r
+@rem             not merely capable of it.\r
+@rem   PROMPT  - not elevated, UAC on, so elevation can be requested.\r
+@rem   NOLUA   - UAC is off machine-wide (EnableLUA = 0) AND this is not an\r
+@rem             administrator. Elevation is impossible, not merely declined:\r
+@rem             Windows has no prompt to offer. Note that with UAC off,\r
+@rem             `Start-Process -Verb RunAs` does not fail - it is silently\r
+@rem             ignored, runs the child with the caller's own token, and reports\r
+@rem             success, which is why this needs detecting rather than trying.\r
+@rem ---------------------------------------------------------------------------\r
+set "ELEV=PROMPT"\r
+for /f "usebackq tokens=*" %%A in (`powershell -NoProfile -ExecutionPolicy Bypass -Command "$id=[Security.Principal.WindowsIdentity]::GetCurrent(); if (([Security.Principal.WindowsPrincipal]$id).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { 'ALREADY' } elseif ((Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -ErrorAction SilentlyContinue).EnableLUA -eq 0) { 'NOLUA' } else { 'PROMPT' }"`) do set "ELEV=%%A"\r
+echo [setup-windows] Elevation: %ELEV%\r
+if "%ELEV%"=="NOLUA" (\r
+    echo [setup-windows] This account cannot elevate ^(UAC off, not an administrator^). Packages that\r
+    echo [setup-windows] need a machine-wide install will be SKIPPED rather than left to fail; details\r
+    echo [setup-windows] at each one, and a summary before the elevated half.\r
+)\r
+\r

 @rem --- Non-admin (per-user) winget installs ---\r
 @rem\r
 @rem No --architecture anywhere on purpose. winget already picks the best\r
 @rem --- Non-admin (per-user) winget installs ---\r
 @rem\r
 @rem No --architecture anywhere on purpose. winget already picks the best\r


@@ -44,7 +69,6 @@ echo [setup-windows] Host architecture: %HOST_ARCH%
 winget install Anthropic.ClaudeCode\r
 winget install Brave.Brave\r
 winget install Git.Git\r
 winget install Anthropic.ClaudeCode\r
 winget install Brave.Brave\r
 winget install Git.Git\r

-winget install Microsoft.DotNet.SDK.10\r

 winget install Microsoft.PowerShell Microsoft.Sysinternals.ProcessExplorer Microsoft.Sysinternals.ProcessMonitor Microsoft.Sysinternals.SDelete Microsoft.VisualStudioCode Microsoft.WindowsTerminal\r
 winget install Python.Python.3.13\r
 \r
 winget install Microsoft.PowerShell Microsoft.Sysinternals.ProcessExplorer Microsoft.Sysinternals.ProcessMonitor Microsoft.Sysinternals.SDelete Microsoft.VisualStudioCode Microsoft.WindowsTerminal\r
 winget install Python.Python.3.13\r
 \r


@@ -87,7 +111,10 @@ if "%IS_ARM64%"=="1" (
 @rem PATH, behind every machine and user entry. setup-windows-no-uac.ps1 then\r
 @rem pins the native ninja's directory to the FRONT of the user PATH so the\r
 @rem margin does not depend on two append orders staying as they are.\r
 @rem PATH, behind every machine and user entry. setup-windows-no-uac.ps1 then\r
 @rem pins the native ninja's directory to the FRONT of the user PATH so the\r
 @rem margin does not depend on two append orders staying as they are.\r

-winget install Kitware.CMake\r
+@rem\r
+@rem Ninja here, CMake in the machine-wide group below: Ninja is a portable zip\r
+@rem winget unpacks into the user profile, CMake is an MSI that installs for the\r
+@rem whole machine.\r

 winget install Ninja-build.Ninja\r
 \r
 @rem --- Second, independent Clang: compiler diversity ---\r
 winget install Ninja-build.Ninja\r
 \r
 @rem --- Second, independent Clang: compiler diversity ---\r


@@ -109,12 +136,10 @@ winget install Ninja-build.Ninja
 @rem -DCMAKE_CXX_COMPILER with a full path when you care.\r
 winget install LLVM.LLVM\r
 \r
 @rem -DCMAKE_CXX_COMPILER with a full path when you care.\r
 winget install LLVM.LLVM\r
 \r

-@rem x64-only manifests: winget falls back to the x64 installer on ARM64 and these\r
-@rem run under Prism emulation. Harmless for what they do here - iperf3 is a\r
-@rem network benchmark bounded by the link, and AGI is an Android-side GPU\r
-@rem profiler whose work happens on the phone. Neither is CPU-bound on this box.\r
+@rem x64-only manifest: winget falls back to the x64 installer on ARM64 and it runs\r
+@rem under Prism emulation. Harmless for what it does here - iperf3 is a network\r
+@rem benchmark bounded by the link, not by CPU.\r

 winget install ar51an.iPerf3\r
 winget install ar51an.iPerf3\r

-winget install Google.AndroidGPUInspector\r

 \r
 @rem NASM assembles x86/x86-64 only - there is no ARM64 target in it and no ARM64\r
 @rem build of it. Installed on ARM64 anyway (as emulated x64) because this box\r
 \r
 @rem NASM assembles x86/x86-64 only - there is no ARM64 target in it and no ARM64\r
 @rem build of it. Installed on ARM64 anyway (as emulated x64) because this box\r


@@ -138,6 +163,38 @@ if "%IS_ARM64%"=="1" (
     winget install Oracle.VirtualBox\r
 )\r
 \r
     winget install Oracle.VirtualBox\r
 )\r
 \r

+@rem ---------------------------------------------------------------------------\r
+@rem Machine-wide installers, despite sitting in the "per-user" section\r
+@rem\r
+@rem These four are not per-user at all. On an account that cannot elevate they\r
+@rem fail on every run, with installer exit codes that say nothing useful:\r
+@rem   Microsoft.DotNet.SDK.10      exit 5     (ERROR_ACCESS_DENIED)\r
+@rem   Kitware.CMake                exit 1603  (generic MSI failure)\r
+@rem   Google.AndroidGPUInspector   exit 1603\r
+@rem   OpenCppCoverage              exit 1     (its installer self-elevates)\r
+@rem\r
+@rem Grouped and skipped outright where elevation is impossible. Attempting a\r
+@rem guaranteed failure four times per run - and paying the download for it -\r
+@rem teaches nobody anything, and the four opaque error codes bury the one line\r
+@rem that matters. On an account that can elevate they run exactly as before.\r
+@rem\r
+@rem NOTE none of these is a build-blocker: the .NET SDK is only here for the WiX\r
+@rem MSI tooling, CMake also ships inside Visual Studio, AGI profiles Android\r
+@rem devices, and OpenCppCoverage cannot instrument ARM64 binaries anyway.\r
+@rem ---------------------------------------------------------------------------\r
+if "%ELEV%"=="NOLUA" (\r
+    echo.\r
+    echo [setup-windows] Skipping the machine-wide installers - this account cannot elevate:\r
+    echo [setup-windows]   Microsoft.DotNet.SDK.10, Kitware.CMake, Google.AndroidGPUInspector, OpenCppCoverage.\r
+    echo [setup-windows]   None blocks a build. Re-run from an administrator account to get them.\r
+    echo.\r
+    goto :after_admin_pkgs\r
+)\r
+\r
+winget install Microsoft.DotNet.SDK.10\r
+winget install Kitware.CMake\r
+winget install Google.AndroidGPUInspector\r
+\r

 @rem OpenCppCoverage: native (PE) line coverage for the C++ binaries. run-coverage-occ.py drives the\r
 @rem pytest suite under it to produce an HTML report (the binaries under test build with PDBs,\r
 @rem which it reads). The installer elevates via UAC.\r
 @rem OpenCppCoverage: native (PE) line coverage for the C++ binaries. run-coverage-occ.py drives the\r
 @rem pytest suite under it to produce an HTML report (the binaries under test build with PDBs,\r
 @rem which it reads). The installer elevates via UAC.\r


@@ -148,6 +205,8 @@ if "%IS_ARM64%"=="1" (
 @rem cross-compiles but NOT an ARM64 one. For ARM64 coverage, build the ARM64\r
 @rem binaries with /fsanitize-coverage or use the x64 build for the coverage run.\r
 winget install OpenCppCoverage.OpenCppCoverage\r
 @rem cross-compiles but NOT an ARM64 one. For ARM64 coverage, build the ARM64\r
 @rem binaries with /fsanitize-coverage or use the x64 build for the coverage run.\r
 winget install OpenCppCoverage.OpenCppCoverage\r

+\r
+:after_admin_pkgs\r

 if "%IS_ARM64%"=="1" echo [setup-windows] NOTE: OpenCppCoverage is x86/x64-only - it cannot instrument ARM64 binaries. Run coverage against the x64 build.\r
 \r
 @rem --- WiX 5.0.2, pinned on purpose ---\r
 if "%IS_ARM64%"=="1" echo [setup-windows] NOTE: OpenCppCoverage is x86/x64-only - it cannot instrument ARM64 binaries. Run coverage against the x64 build.\r
 \r
 @rem --- WiX 5.0.2, pinned on purpose ---\r


@@ -214,10 +273,51 @@ if not exist "%DOTNET_EXE%" goto :after_wix
 set "UAC_LOG=%~dp0setup-windows-uac.log"\r
 if exist "%UAC_LOG%" del "%UAC_LOG%"\r
 \r
 set "UAC_LOG=%~dp0setup-windows-uac.log"\r
 if exist "%UAC_LOG%" del "%UAC_LOG%"\r
 \r

+@rem %ELEV% was worked out at the top of this script - see the comment there for\r
+@rem why `Start-Process -Verb RunAs` cannot be trusted to report this itself.\r
+if "%ELEV%"=="NOLUA" goto :elev_impossible\r
+if "%ELEV%"=="ALREADY" goto :elev_direct\r
+\r
+@rem Not elevated, UAC is on: request it. Expect a prompt.\r
+echo [setup-windows] Requesting elevation ^(expect a UAC prompt^)...\r

 powershell -NoProfile -Command "$p = Start-Process powershell -Verb RunAs -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-File','""%~dp0setup-windows-with-uac.ps1""' -Wait -PassThru; exit $p.ExitCode"\r
 set "UAC_RC=%ERRORLEVEL%"\r
 powershell -NoProfile -Command "$p = Start-Process powershell -Verb RunAs -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-File','""%~dp0setup-windows-with-uac.ps1""' -Wait -PassThru; exit $p.ExitCode"\r
 set "UAC_RC=%ERRORLEVEL%"\r

+goto :elev_done\r
+\r
+:elev_direct\r
+echo [setup-windows] Already running elevated; running the elevated half directly.\r
+powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0setup-windows-with-uac.ps1"\r
+set "UAC_RC=%ERRORLEVEL%"\r
+goto :elev_done\r
+\r
+:elev_impossible\r
+echo.\r
+echo [setup-windows] SKIPPING the elevated half: this account cannot elevate.\r
+echo [setup-windows]   UAC is disabled machine-wide ^(EnableLUA = 0^) and you are not an administrator,\r
+echo [setup-windows]   so Windows offers no way to elevate - there is no prompt to accept. With UAC off,\r
+echo [setup-windows]   'Start-Process -Verb RunAs' is silently ignored and reports success, which is why\r
+echo [setup-windows]   this used to look like a cancelled prompt.\r
+echo [setup-windows]\r
+echo [setup-windows]   Not installed: Visual Studio components ^(including clang-cl^), the WDK,\r
+echo [setup-windows]   rsync, and the OpenSSH server. Everything per-user above is unaffected.\r
+echo [setup-windows]\r
+echo [setup-windows]   To finish the box, either sign in to an administrator account and re-run this\r
+echo [setup-windows]   script, or have an administrator run setup-windows-with-uac.ps1 there. Then\r
+echo [setup-windows]   re-run setup-windows-no-uac.ps1 as yourself, so the per-user PATH and .gitconfig\r
+echo [setup-windows]   land in YOUR profile rather than the administrator's.\r
+echo.\r
+set "UAC_RC=SKIPPED"\r
+\r
+:elev_done\r

 \r
 @rem --- Surface the elevated session's output (its window has already closed) ---\r
 \r
 @rem --- Surface the elevated session's output (its window has already closed) ---\r

+@rem\r
+@rem A missing log is NOT self-explanatory, so do not guess at one cause. The\r
+@rem elevated script writes its transcript as almost its first act, so no log\r
+@rem means it never got as far as running: either the prompt was declined, or it\r
+@rem started unelevated and stopped on its own #Requires line. Which of those it\r
+@rem was is already known from %ELEV%, so report that instead of speculating.\r
+if "%UAC_RC%"=="SKIPPED" goto :after_uac_log\r

 if exist "%UAC_LOG%" (\r
     echo.\r
     echo ===== elevated setup log ^(%UAC_LOG%^) =====\r
 if exist "%UAC_LOG%" (\r
     echo.\r
     echo ===== elevated setup log ^(%UAC_LOG%^) =====\r


@@ -225,8 +325,10 @@ if exist "%UAC_LOG%" (
     echo ===== end of elevated setup log =====\r
 ) else (\r
     echo [setup-windows] WARNING: no elevated log found at "%UAC_LOG%".\r
     echo ===== end of elevated setup log =====\r
 ) else (\r
     echo [setup-windows] WARNING: no elevated log found at "%UAC_LOG%".\r

-    echo [setup-windows] The elevated window may have been cancelled at the UAC prompt.\r
+    if "%ELEV%"=="PROMPT" echo [setup-windows] The elevated window never started - the UAC prompt was most likely declined.\r
+    if "%ELEV%"=="ALREADY" echo [setup-windows] The elevated half exited before writing its transcript; see its output above.\r

 )\r
 )\r

+:after_uac_log\r

 \r
 @rem --- Non-elevated PowerShell half ---\r
 @rem WinMerge on the user PATH, BinSkim, and the global git config (identity +\r
 \r
 @rem --- Non-elevated PowerShell half ---\r
 @rem WinMerge on the user PATH, BinSkim, and the global git config (identity +\r


@@ -249,6 +351,11 @@ if exist "%UAC_LOG%" (
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0setup-windows-no-uac.ps1"\r
 if not "%ERRORLEVEL%"=="0" echo [setup-windows] WARNING: setup-windows-no-uac.ps1 reported a failure ^(see above^); continuing.\r
 \r
 powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0setup-windows-no-uac.ps1"\r
 if not "%ERRORLEVEL%"=="0" echo [setup-windows] WARNING: setup-windows-no-uac.ps1 reported a failure ^(see above^); continuing.\r
 \r

+@rem Skipping the elevated half is a reported, understood outcome on a box where\r
+@rem elevation is impossible - not a failure to exit non-zero over. The per-user\r
+@rem provisioning above did run, and re-running from an administrator account is\r
+@rem the documented next step.\r
+if "%UAC_RC%"=="SKIPPED" goto :uac_reported\r

 if not "%UAC_RC%"=="0" (\r
     echo.\r
     echo [setup-windows] ELEVATED SETUP FAILED ^(exit code %UAC_RC%^). See log above.\r
 if not "%UAC_RC%"=="0" (\r
     echo.\r
     echo [setup-windows] ELEVATED SETUP FAILED ^(exit code %UAC_RC%^). See log above.\r


@@ -256,6 +363,11 @@ if not "%UAC_RC%"=="0" (
 )\r
 echo.\r
 echo [setup-windows] Elevated setup completed successfully.\r
 )\r
 echo.\r
 echo [setup-windows] Elevated setup completed successfully.\r

+goto :uac_reported\r
+\r
+:uac_reported\r
+if "%UAC_RC%"=="SKIPPED" echo.\r
+if "%UAC_RC%"=="SKIPPED" echo [setup-windows] Per-user setup complete; the elevated half was skipped ^(see above^).\r

 \r
 @rem Removed: this doesn't work as well as I hoped, maybe try again later\r
 @rem -- Install Headroom ---\r
 \r
 @rem Removed: this doesn't work as well as I hoped, maybe try again later\r
 @rem -- Install Headroom ---\r


@@ -280,3 +392,10 @@ if "%IS_ARM64%"=="1" (
     echo [setup-windows]   unavailable : VirtualBox, the Windows 7 x86 test VM, Intel VTune,\r
     echo [setup-windows]                 and the v141 / Windows XP targeting toolset.\r
 )\r
     echo [setup-windows]   unavailable : VirtualBox, the Windows 7 x86 test VM, Intel VTune,\r
     echo [setup-windows]                 and the v141 / Windows XP targeting toolset.\r
 )\r

+@rem The list above is what this script PROVIDES on ARM64, not necessarily what\r
+@rem landed on this run - so point at the audit, which reports the actual state.\r
+if "%ELEV%"=="NOLUA" (\r
+    echo [setup-windows]   NOT on this box: everything needing elevation was skipped, including\r
+    echo [setup-windows]                 Visual Studio's clang-cl, the .NET SDK and CMake. The\r
+    echo [setup-windows]                 architecture audit above lists what is really installed.\r
+)\r