v0.2.0

Added

• cmd.exe built-ins dir (/b, /s, /a[:attributes], /o[:order],
  with Windows' listing layout and summaries), ren/rename (wildcard
  templates such as ren *.txt *.bak), move, and path.

• find.exe (/V /C /N /I, files or standard input), sort.exe (/R,
  /+n, /O), and more.com in System32, so cmd /c "dir | find ..."
  and friends work. A new cmd_builtins Windows oracle covers them.

• The npm-packaged tools run: CommandLineToArgvW, combase.dll's COM
  memory and GUID functions (biome), and for opencode (a Bun executable)
  timeBeginPeriod/timeEndPeriod, RtlGetFullPathName_U,
  NtQueryObject (ObjectBasicInformation, and ObjectNameInformation
  giving a file's NT path), and GetConsoleTitleA/W. SetConsoleTitleW
  now keeps the title and shows it in the terminal (OSC 0).

• wpkg installs npm tarballs (.tgz/.tar.gz package URLs), so tools
  npm ships as prebuilt Windows binaries install without npm:
  wpkg install opencode, wpkg install esbuild, wpkg install biome
  (x64 and arm64, from their npm platform packages).

• wpkg install python installs python.org's full NuGet distribution
  instead of the embeddable one, so site, exit(), venv, and pip
  work. Running it needed:

  • CRT _wgetcwd/_getcwd and iswctype; PathCchRemoveFileSpec;
    SetHandleCount; SetWaitableTimerEx.
  • ConvertStringSecurityDescriptorToSecurityDescriptorW (SDDL owner,
    group and DACL), which CPython uses for private directories.
  • CLSIDFromString, IIDFromString, StringFromGUID2, UuidCreate,
    UuidCreateSequential, and SHLWAPI!StrStrW/StrStrIW.
  • CertCreateCertificateContext, collection stores
    (CERT_STORE_PROV_COLLECTION, CertAddStoreToCollection) and store
    providers named by string ("Memory"), as pip's truststore and
    CPython's ssl use them.
  • A real FormatMessageA/W: system messages for common Win32, Winsock
    and certificate codes, FROM_STRING with %1 inserts, and
    FORMAT_MESSAGE_ALLOCATE_BUFFER (Python's WinError text was garbage).
  • SetFileInformationByHandle(FileBasicInfo) for times and attributes
    (CPython's os.chmod on a descriptor).
    Oracle cases cover the new version, string-search, attribute-list and
    FileBasicInfo behavior.

• GetVersionExA/W, and GetVersion/GetVersionEx report the version a
  program's manifest asks for, as Windows does: 10.0 to a program declaring
  Windows 10 support (Python's interactive prompt now starts), 6.3 build
  9600 for Windows 8.1, and 6.2 build 9200 otherwise. The native_startup
  oracle checks the unmanifested case.

• ScrollConsoleScreenBufferW for full-width vertical moves (mapped to the
  terminal's scroll region), so Python 3.14's new REPL (pyrepl) runs; other
  moves report ERROR_NOT_SUPPORTED.

• The native_startup oracle checks a certificate chain under an engine
  whose exclusive root store holds the certificate, replacing a case that
  chained the machine's first ROOT certificate (which differs per machine:
  the CI runner's is explicitly distrusted).

• GetMaximumProcessorGroupCount, GetActiveProcessorCount and
  GetMaximumProcessorCount (one processor group), which the .NET 10
  CoreCLR calls at startup.

• where.exe in System32: finds files in the current directory and along
  PATH with PATHEXT extensions (/Q, /F, /R), exiting 1 with
  Windows' message when a pattern matches nothing.

• Get-ChildItem on registry paths (HKLM:\…, HKCU:\…) lists subkeys
  under a Hive: header and yields key objects with Name and
  PSChildName in value position; Get-Content on a registry path
  reports the provider's error instead of a bad file path.

• $_ in a catch block is an error record with .Exception.Message.

• A Windows-oracle script, tests/oracle/powershell_expressions.ps1,
  for the expression engine and the new cmdlets.

Fixed

• Matched against Windows: a comma list written in a native command's
  arguments (cmd /c echo a,b) reaches the program as one argument with
  its commas; only array variables pass their elements separately.
  more.com adds its trailing empty line only for piped input.

• Matched against Windows: cmd's path prints PATH=(null) when PATH is
  unset; find.exe exits 1 (not 2) when a file is missing; more.com
  ends its output with an empty line.

• The headless control test retries WebSocket reads a signal interrupts.

• PowerShell command arguments understand arrays: comma lists (a,b,
  "a", "b") and array variables are passed as arrays instead of one
  joined string. Path cmdlets (Get-Content, Remove-Item, Test-Path,
  New-Item, Copy-Item, …) act on each path; Set-Content/Add-Content
  write each element as a line; Write-Output (and echo) output each
  argument and element on its own line, Write-Host separates them with
  spaces; script parameters receive arrays; programs get each element as
  an argument. Other cmdlets see the joined text as before.

• PowerShell passes cmd.exe, cscript.exe, wscript.exe, find.exe,
  sqlcmd.exe and batch/script files their arguments the legacy way, as
  its default $PSNativeCommandArgumentPassing (Windows) does: embedded
  quotes as typed, so cmd /c 'find "x" file' reaches cmd intact.

• Directories created in the guest get creation and write times (dir
  showed 01/01/1970).

• Socket handles fit in 32 bits, as Windows guarantees: OpenSSL keeps
  sockets as int, so TLS in Python failed with WSAEFAULT.

• InitializeProcThreadAttributeList accepts an empty list, which
  CPython's subprocess always builds.

• _open_osfhandle gives descriptors to device handles, so open("nul")
  works instead of failing with EMFILE.

• CreateFileMappingW and SetFileInformationByHandle follow
  DuplicateHandle copies to their file (CPython's mmap).

• Enumerating a collection store walks every member store's
  certificates; CertGetEnhancedKeyUsage uses the real
  CERT_FIND_EXT_ONLY (2) and CERT_FIND_PROP_ONLY (4) flags.

• FindFirstFileW applies Windows' DOS pattern rules: *.* matches every
  name (directories without a dot included), name.* matches name, and
  *. matches names without an extension plus . and .., so
  programs listing with *.* (CPython's os.listdir) see every entry.
  The fs_paths oracle covers it.

• The apc_io oracle accepts both outcomes Windows documents for an
  overlapped read at end of file (an immediate ERROR_HANDLE_EOF, or a
  queued completion carrying it), and counts each callback relative to the
  calls before it, so one cache-dependent result no longer fails later
  cases on Windows.

• Group-Object tables use PowerShell's GroupInfo layout (Count 5 wide,
  Name 25, longer names end in …); Format-Table aligns number columns
  right; Out-String makes one string ending in a newline (a blank line in
  output, one string when assigned or used in "$(...)").

• The powershell_expressions oracle captures each formatted block alone
  and avoids hashtable key order, which is hash order on Windows.

• "$(...)" joins multiple output objects with spaces, as PowerShell
  does, instead of keeping line breaks.

• Member access on an array enumerates its elements' members.

• Get-Command with a plain name returns the command that would run (an
  alias or built-in before a program, else the first program on PATH).

• 1 + '1' converts the string to the left operand's number type.

• Objects from ConvertFrom-Json and hashtable literals keep their key
  spellings in JSON and table output.

• PowerShell utility cmdlets: Get-Date (with .NET -Format strings),
  Get-Random, Out-String, Format-Table/Format-List,
  Group-Object, ConvertTo-Json (-Depth, -Compress) and
  ConvertFrom-Json (objects keep member access when assigned),
  Read-Host, Get-Process (this session's guest processes),
  Start-Process (runs to completion), and Get-ItemPropertyValue.
  Get-Command accepts several names (Get-Command cmd,tar).

• A PowerShell expression engine for statements and assignments:
  arithmetic (1+1, 7/2, %, kb/mb suffixes, hex), string and array
  repetition and concatenation, arrays (1,2,3, @(...), ranges
  1..5, negative indexes), hashtable literals with entries, comparison
  operators (with c/i forms and array filtering), -like, -match,
  -replace, -split, -join, -contains/-in, -is/-as, logical
  and bitwise operators, -f formatting (N, D, F, X, P), casts
  with .NET's range checks and rounding, [math]:: and [string]::
  members, and common string, array and hashtable properties and methods.
  Statements it does not cover keep their previous handling. $s += "x"
  now concatenates strings and [bool]'0' is True, as in PowerShell.

• winrun --help (-h) prints the usage and winrun --version (-V) the
  version, both exiting 0.

• PowerShell scripts take arguments (winrun script.ps1 -Name x, a script
  run in the shell, & .\script.ps1 a b): a leading param(...) block
  (after comments and attributes such as [CmdletBinding()]) binds them by
  name or position with its defaults; without one they are $args. A
  script run from a host path runs in the shell, so it can start programs.

• taskkill.exe in System32, as Windows ships it: /PID and /IM (with
  * wildcards), /F, and /T (descendants first), with Windows' messages
  and exit codes (128 when nothing matches). It finds guest processes in a
  per-session process table: each worker registers its PID (its host PID),
  parent and image, with its kernel start time so a reused PID is never
  signalled. Programs that end a child with taskkill /F /T (esdev's test
  timeout) no longer wait forever. The native_startup oracle probe ends a
  copy of itself this way.

• Certificate chains: CertGetCertificateChain (built and verified with
  rustls-webpki against the guest's ROOT store or a chain engine's roots,
  with the additional store as intermediates, returned as a
  CERT_CHAIN_CONTEXT with CERT_TRUST_* status), CertVerifyCertificateChainPolicy
  (base and SSL, with the server-name check and the documented ignore
  flags), CertCreateCertificateChainEngine, CertFreeCertificateChain(Engine),
  CertDuplicateCertificateChain, and CertSetCertificateContextProperty.
  Revocation is not checked. The native_startup oracle probe records a
  trusted and an untrusted chain.

• --memory=<size> (or WINRUN_MEMORY) sets the physical memory the guest
  reports (GlobalMemoryStatusEx, GetPerformanceInfo), e.g. 8G or
  4096M; the default stays 512 MiB.

• scripts/install.sh to install a published Linux x86-64 release: download
  the tarball and checksums, verify the SHA-256, and install winrun into
  /usr/local/bin or ~/.local/bin (override with --prefix /
  WINRUN_PREFIX, pin with --version / WINRUN_VERSION).

• README installation docs: requirements, installing from a GitHub Release
  (download, checksum, install), building from source, how to use the main
  CLI surfaces, and a short list of what is not supported yet.