v0.2.2

Changed

• The permission helpers prefer PowerShell 7. Every ACL read and write now goes through
  Get-Acl / Set-Acl instead of DirectoryInfo.GetAccessControl(), which only exists in the
  .NET Framework — under PowerShell 7.6 it fails with "does not contain a method named
  GetAccessControl". The interpreter is chosen at runtime: PowerShell 7 from its installer
  locations, then pwsh.exe from PATH, then Windows PowerShell 5.1. FOLDER_TRUST_POWERSHELL
  pins one explicitly.

• Set-Acl still writes the DACL by path, so the grant keeps propagating into subfolders that
  already exist (verified: an inheritable ACE added on a parent appears on an existing child as
  inherited). The Low integrity label keeps its P/Invoke path, which works under both.

• Equivalence was measured on two fresh hierarchies with the same operations under PowerShell
  7.6.7 and 5.1.26100: probe, grant and propagate returned identical results and both applied the
  Low label.

Fixed

• Both helper scripts are asserted to carry a UTF-8 BOM. Without it Windows PowerShell 5.1 decodes
  the script as ANSI and the Chinese lines break the parse, while PowerShell 7 parses the same file
  fine — a failure that shipped once and was invisible on 7.

This release also carries the 0.2.1 fix: the permissions dialog reports and repairs the Low
integrity label, not just the capability grant (0.2.1 never reached npm, so publish this one).

v0.2.1

Fixed

• The permissions dialog now reports the Low integrity label, not just the grant. A folder
  can carry the sandbox's capability grant and still deny every write, because the confined
  shell's token is Low-integrity and write-restricted: without the Low no-write-up label the
  grant is inert. DSH itself counts a folder provisioned only when grant + deny + label all
  hold, and this plugin only ever looked at the first two — so it said "ready" for folders the
  sandbox refused.
• A failed label write is no longer reported as a successful repair. Writing that label
  needs SeSecurityPrivilege, which the user's token does not carry; the helper caught the
  failure and the result file still said ok: true. It now reports the failure and tells you an
  administrator has to run DSH once (or that the session needs full access).

Changed

• engines.dsh declares the DSH release line this plugin is built for (^0.2.0-rc.2), so the
  plugin manager and the market can answer the host-version question instead of unknown.