v1.5.1 — hardening pass: a quoting fix, and failures that say what happened

v1.5.1 — hardening pass: a quoting fix, and failures that say what happened

A maintenance release. Update if you open .ssb printer files from anyone else.

• Critical: PowerShell injection from a printer file, closed. PowerShell treats the
  low double quote „ (U+201E) as a string delimiter, and SpoolSmith did not escape it. A
  printer or driver name containing it, in a .ssb someone sent you, could end the quoted
  value and run its own PowerShell during the preview's driver check — before any
  confirmation, and elevated if the session was. Every PowerShell quote character is now
  escaped, and a test runs hostile names through the real PowerShell tokenizer. The same
  test, run against v1.5.0's code, executed the payload.
• A failed step says what failed and what already changed. For example: install: step 2 of 2 failed: The spooler service is not reachable. (exit status 1). Already done before it: step 1: Created port, in the desktop, --json and the action log, for adding, removal
  and repoint. The reason comes from a marker line each generated command prints, so it is
  found in any Windows display language.
• The preview predicts the conflicts the apply would stop on. A same-named queue with a
  different driver or port, or a RAW9100-<ip> port that is not RAW 9100 at that address,
  used to fail only after you confirmed. The preview now fails the same way first (exit 1).
• A stopped spooler reads as a stopped spooler, instead of "driver not installed".
• The CLI's action log records why a run failed, as the desktop's already did.
• Shield button from a mapped drive. The elevated window can't see mapped drives, so a
  file opened from Z: was "not found" after the original window closed. Mapped paths are
  now handed over as UNC paths; if Windows can't give one, the desktop says so and asks first.

What is not verified

All of this was tested on Windows 11 without elevation and without changing any real
driver, queue, port or spooler. Not yet run: the PR's elevated hardware checklist (stopped
spooler, same-name conflict, forced step-2 failure, mapped-drive shield), a real mapped
share, a non-English Windows display language (localized layouts are hand-built fixtures),
and the FlaUI desktop suite. Everything listed as unverified in v1.5.0 still is.

Known and still open

Not changed by this release, recorded so you can decide: driver files are staged in a
predictable %TEMP%\SpoolSmith-bundle-<digest> folder (under Intune/SYSTEM that is
C:\Windows\Temp, where a standard user may be able to place files first); any Valid
catalog signer is added to TrustedPublisher without the plan naming it; spooler calls have no
timeout outside the Intune wrapper; exit code 1 does not distinguish "nothing changed" from
"partly changed".

Validation

gofmt, go vet ./... and go test ./... -count=1 pass on Windows 11; CI passed on
Linux and Windows, including the MSI build and install/upgrade/uninstall jobs. A read-only
Codex gpt-6-astra review of the change returned "ship after fixes" with three findings
(two Medium, one Low), each reproduced and fixed. See the 2026-10-19 entries in
the dev log.