Joseph Doherty 88e53f7f84 fix(install): Install-ScriptWorkerIsolation.ps1 works on PowerShell 7 and 5.1, -Uninstall included (#883) ...

First real run of the #780 installer (windev, #800 gate) failed on both hosts and its rollback failed too:
- PowerShell 7: DirectoryInfo.GetAccessControl/SetAccessControl do not exist on .NET. Use Get-Acl / Set-Acl.
- Windows PowerShell 5.1: an if-expression unrolled the wanted ACE to a scalar ($null on -Remove), so .Count threw under
  StrictMode. Wrap it in @(...).
- Found on the re-run: an apply from 5.1 was not idempotent. 5.1 passes the literal quotes in sc.exe binPath= with legacy
  quoting, so the anchor path was stored unquoted and AnchorService reported 'changed' on every run. sc create/config now
  runs through Invoke-OtOpcUaSc with an explicit command line, identical on both hosts.

Adds scripts/install/tests/Test-ScriptWorkerIsolation.Windows.ps1: a Windows-executed dry run -> apply -> re-apply ->
uninstall -> uninstall test (scratch names, stand-in host service) for either host. The plan-only harness cannot see these.

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

2026-11-12 11:24:01 -05:00

..

Test-ScriptWorkerIsolation.ps1

feat(scripting): ScriptWorker isolation on Windows: restricted worker identity, pipe ACL, firewall + PeCacheDir installer (lmxopcua#780)

2026-11-10 08:46:23 -05:00

Test-ScriptWorkerIsolation.Windows.ps1

fix(install): Install-ScriptWorkerIsolation.ps1 works on PowerShell 7 and 5.1, -Uninstall included (#883)

2026-11-12 11:24:01 -05:00