Stop a non-elevated run from continuing past the admin guard

Ensure-Admin.ps1 is dot-sourced, and `exit` inside a dot-sourced script
does not terminate the caller. Every exit in that guard was therefore
inert: WinSwift printed "must be run as Administrator" and then carried
on into the apply pipeline.

Reproduced non-elevated with stdin redirected, which is what any
scripted or CI invocation looks like. Read-Host returns an empty string
immediately, the prompt reads as declined, `exit 1` does nothing, and
the run proceeds:

    WinSwift must be run as Administrator.
    ...
    [WhatIf] Create registry backup
    [WhatIf] Apply 15 registry changes from 'Disable_Telemetry.reg'
    [WhatIf] Disable Scheduled Task: ...Microsoft Compatibility Appraiser
    exit code 0

Under -DryRun nothing is written. Without it, an unprivileged process
would attempt real registry imports and scheduled task changes, fail
partway through on access denied, and leave a half-applied system.

The same defect breaks the relaunch path: after Start-Process -Verb
RunAs succeeds, `exit 0` does not stop the parent, so the elevated child
and the original non-elevated process run WinSwift concurrently.

Confirmed the mechanism with a minimal repro. A dot-sourced script
invoked with arguments cannot terminate its caller through `exit`, with
or without [CmdletBinding()]; `throw` and caller-side handling both do.

Fix: the guard reports its outcome through $script:ElevationOutcome,
which propagates to the caller because dot-sourcing shares scope, and
WinSwift.ps1 exits on anything other than 'Elevated' before any runtime
module loads. 'Relaunched' exits 0 because the elevated child owns the
run; 'Denied' and 'Failed' exit 1.

Also stop prompting when no console can answer. A redirected read
returned instantly and was indistinguishable from a declined prompt, so
that case now reports why it cannot continue.

Verified after the fix: both the read-only -Verify path and the -DryRun
apply path exit 1 without reaching the pipeline.

Adds source assertions for the outcome contract and its position ahead
of module loading, plus a behavioral test that runs the entry script
unelevated and asserts the pipeline is never reached. That test skips
when already elevated, which is the case on CI runners.

Author: BiosSystem

Scripts/Helpers/Ensure-Admin.ps1

@@ -5,13 +5,30 @@ param(
     [array]$OriginalUnboundArguments
 )
 
+# This script is dot-sourced, and `exit` inside a dot-sourced script does not
+# terminate the caller. Relying on it let a non-elevated run continue into the
+# apply pipeline. The outcome is reported through $script:ElevationOutcome
+# instead, and WinSwift.ps1 exits on anything other than 'Elevated'.
+$script:ElevationOutcome = 'Elevated'
+
 $isAdmin = ([Security.Principal.WindowsPrincipal] `
     [Security.Principal.WindowsIdentity]::GetCurrent()
 ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 
 if (-not $isAdmin) {
     Write-Host "WinSwift must be run as Administrator." -ForegroundColor Red
 
+    # Prompting is pointless when nothing can answer, and a redirected read
+    # returns immediately, which previously read as a declined prompt.
+    $inputIsRedirected = $false
+    try { $inputIsRedirected = [Console]::IsInputRedirected } catch { }
+
+    if ($inputIsRedirected) {
+        Write-Host "No interactive console is available to confirm elevation. Re-run WinSwift from an elevated session." -ForegroundColor Red
+        $script:ElevationOutcome = 'Denied'
+        return
+    }
+
     $choice = Read-Host "Restart as Administrator? (y/n)"
 
     if ($choice -match '^[Yy]$') {
@@ -55,11 +72,16 @@ if (-not $isAdmin) {
         }
         catch {
             Write-Error "Failed to start WinSwift as Administrator: $_"
-            exit 1
+            $script:ElevationOutcome = 'Failed'
+            return
         }
 
-        exit 0
+        # The elevated child owns the run from here; this process must stop so the
+        # two do not execute concurrently.
+        $script:ElevationOutcome = 'Relaunched'
+        return
     }
 
-    exit 1
+    $script:ElevationOutcome = 'Denied'
+    return
 }

Tests/Unit/Test-SafetyGuards.ps1

@@ -31,6 +31,48 @@ Describe 'WinSwift startup safety guards' {
         $script:adminScript | Should -Match '-ErrorAction Stop'
     }
 
+    It 'reports the elevation outcome instead of relying on exit' {
+        # `exit` inside a dot-sourced script does not terminate the caller, so a
+        # non-elevated run used to continue into the apply pipeline.
+        $script:adminScript | Should -Match "\`$script:ElevationOutcome = 'Elevated'"
+        $script:adminScript | Should -Match "\`$script:ElevationOutcome = 'Denied'"
+        $script:adminScript | Should -Match "\`$script:ElevationOutcome = 'Relaunched'"
+        $script:adminScript | Should -Match "\`$script:ElevationOutcome = 'Failed'"
+        $script:adminScript | Should -Not -Match '(?m)^\s*exit \d'
+    }
+
+    It 'stops the run when elevation was not obtained' {
+        $guardPosition = $script:entryScript.IndexOf('$script:ElevationOutcome -ne')
+        $environmentPosition = $script:entryScript.IndexOf('Initialize-Environment.ps1')
+
+        $guardPosition | Should -BeGreaterThan -1
+        $guardPosition | Should -BeLessThan $environmentPosition -Because 'the run must stop before any runtime module loads'
+    }
+
+    It 'refuses a non-interactive run that cannot elevate' -Skip:(
+        ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()
+        ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+    ) {
+        # Only meaningful unelevated. CI runners are administrators, so this is
+        # skipped there and the source assertions above carry the contract.
+        $repoRoot = Resolve-Path (Join-Path $PSScriptRoot '..\..')
+        $psi = New-Object System.Diagnostics.ProcessStartInfo
+        $psi.FileName = 'powershell.exe'
+        $psi.Arguments = '-NoProfile -ExecutionPolicy Bypass -File "{0}" -DryRun -Silent -CLI -DisableTelemetry' -f (Join-Path $repoRoot 'WinSwift.ps1')
+        $psi.RedirectStandardOutput = $true
+        $psi.RedirectStandardError = $true
+        $psi.RedirectStandardInput = $true
+        $psi.UseShellExecute = $false
+
+        $process = [System.Diagnostics.Process]::Start($psi)
+        $process.StandardInput.Close()
+        $stdout = $process.StandardOutput.ReadToEnd()
+        $null = $process.WaitForExit(90000)
+
+        $process.ExitCode | Should -Not -Be 0
+        $stdout | Should -Not -Match '\[WhatIf\]' -Because 'the apply pipeline must never be reached without elevation'
+    }
+
     It 'quotes bound arrays and unbound arguments during elevation' {
         $script:adminScript | Should -Match 'paramValue -is \[array\]'
         $script:adminScript | Should -Match 'OriginalUnboundArguments'